2024山东卫健行业测试赛wp

原创已于 2024-06-27 10:50:59 修改 · 526 阅读 ·

本内容遵循CC 4.0 BY-SA版权协议

GEO检测

代码可运行

于 2024-06-27 08:50:07 首次发布

测试赛wp

没有提示，可以通过apache日志发现问题。以下wp没有顺序，以下wp没有顺序，以下wp没有顺序：

1、查看/etc/passwd发现hacker用户使用userdel -rf hacker删除

2、"GET /manifest/ HTTP/1.1"200 762 "_""python-requests/2.26.0" 通过该日志发现访问/manifest/出现文件列表，猜想本题目可能是让关上文件列表

找到如下配置，删除Indexes即可

<Directory "/path/to/directory">
    Options Indexes FollowSymLinks
</Directory>

3、"POST /workspace/index.php HTTP/1.1"404 491 "_" "python-requests/2.26.0'webshell 直接删除源代码，或者删除恶意代码

4、"POST /install/data.php HTTP/1.1" 200 253 "_" "python-requests/2.26.0' 很明显的sql注入，通过id参数注入

在参数获取后面增加简单的过滤：

$pattern = '/(\"|\'|union|select)/i';
$id = preg_replace($pattern, '', $id);

5、 /vendor/.shell.php HTTP/1.1" 404 491 "_""python-requests/2.26.0' 不死马，把源码下载下来，使用d盾或者seay扫描一下，可以看到生成不死马的文件，删除生成文件和木马文件，重启apache

service apache2 restart

6、/extensions/index,php?kk=0:4:%22test%22:0:%78%7D&admin=system(% 反序列化漏洞

删除文件，或者删除代码中直接将kk置空或者删除kk变量

7、 /package.json HTTP/1.1" 200 1250 "_" "python-requests/2.26.0'重要文件泄露

把文件移走

以上解法不一定完全正确，跟check机制相关，在现有check机制下面可行

运维赛2wp：

和1一样通过日志

cat /var/log/apache2/access.log |grep python

因为比赛方用python脚本check的所以过滤关键字如下：

192.168.3.11 - - [27/Jun/2024:01:43:47 +0000] "HEAD /cms.zip HTTP/1.1" 200 298 "-" "python-requests/2.26.0"
192.168.3.11 - - [27/Jun/2024:01:43:47 +0000] "GET /cms/passwd.txt HTTP/1.1" 200 876 "-" "python-requests/2.26.0"
192.168.3.11 - - [27/Jun/2024:01:43:47 +0000] "GET /cms/detail.php?id=1 HTTP/1.1" 200 2709 "-" "python-requests/2.26.0"
192.168.3.11 - - [27/Jun/2024:01:43:47 +0000] "GET /cms/detail.php?id=-1+union+select+1,version(),3,4,database(),6,7,8,9,10,11 HTTP/1.1" 200 2353 "-" "python-requests/2.26.0"
192.168.3.11 - - [27/Jun/2024:01:43:47 +0000] "POST /.pass.php?pass=valen_not_is_hacker HTTP/1.1" 200 218 "-" "python-requests/2.26.0"
192.168.3.11 - - [27/Jun/2024:01:43:47 +0000] "POST /cms/process_login.php HTTP/1.1" 302 401 "-" "python-requests/2.26.0"
192.168.3.11 - - [27/Jun/2024:01:43:47 +0000] "GET /cms/admin/index.php HTTP/1.1" 200 1062 "-" "python-requests/2.26.0"
192.168.3.11 - - [27/Jun/2024:01:43:47 +0000] "POST /cms/index.php HTTP/1.1" 200 2317 "-" "python-requests/2.26.0"

对应了6个check点：

1、网站备份，把cms.zip移动走

2、敏感信息，把passwd.txt移动走

3、sql注入

$pattern = '/(\"|\'|union|select)/i';
$id = preg_replace($pattern, '', $id);

4、不死马，源码中没有发现写入木马的源代码，可能是内存马，即运行一遍删了源文件的木马，重启apache

service apache2 restart 然后删除对应木马即可

5、弱密码 admin的密码是admin

mysql
> use test;
>select * from user ;
+------+--------------+-------+-------+----------+-----------------+-----------+----------+
| u_id | u_fnm        | u_unm | u_pwd | u_gender | u_email         | u_contact | u_city   |
+------+--------------+-------+-------+----------+-----------------+-----------+----------+
|    1 | Adminstrator | admin | admin | Male     | admin@gmail.com | 09999999  | New York |
|    2 | John Smith   | john  | 12345 | Male     | john@gmail.com  | 09999999  | NYC      |
+------+--------------+-------+-------+----------+-----------------+-----------+----------+

> update user set u_pwd = "qwer123" where u_unm = "admin";
> update user set u_pwd = "qwer123" where u_unm = "john";

6、任意文件读取，删除对应代码即可

						<?php
						$filename=$_POST['filename'];
						if(filename){
								readfile($filename);
							}
						else{
							echo 'Welcome to Book Store';
							}
						?>

标签