Windylh's blog
0%

Posted on Edited on

漏洞描述

CVE-2020-28948

Archive_Tar through 1.4.10 allows an unserialization attack because phar: is blocked but PHAR: is not blocked.

CVE-2020-28949

Archive_Tar through 1.4.10 has :// filename sanitization only to address phar attacks, and thus any other stream-wrapper attack (such as file:// to overwrite files) can still succeed.

Read more »

Posted on Edited on

漏洞描述

CVE-2020-16846: 命令注入漏洞

未经过身份验证的攻击者通过发送特制请求包，可通过Salt API注入ssh连接命令。导致命令执行。

CVE-2020-25592: 验证绕过漏洞

Salt 在验证eauth凭据和访问控制列表ACL时存在一处验证绕过漏洞。

Read more »

Posted on Edited on

zico2靶机渗透测试

主机发现及端口扫描

利用nmap进行主机发现，扫描vm网卡的端口。

172.16.158.1为本机ip，对172.16.158.129进行扫描

Read more »

Posted on Edited on

0x00 0ctf2019-Wallbreaker Easy

在刚刚结束的0ctf中有一个Web题，提供了webshell，但是禁用了执行命令的函数。在查询资料的时候知道了可以通过LD_PRELOAD绕过disbale_functions的方法。学到的东西在这里记录一下。

0x01 Wallbreaker Easy Writeup

首先记录一下这道题的解题过程。

index.php

1
2
3
4
5
6
7

Imagick is a awesome library for hackers to break `disable_functions`.
So I installed php-imagick in the server, opened a `backdoor` for you.
Let's try to execute `/readflag` to get the flag.
Open basedir: /var/www/html:/tmp/415c92e8be7c68409ca6bd369d87482f
Hint: eval($_POST["backdoor"]);

Read more »

Posted on Edited on

myblog

这道题脑洞很大。。。

index.php的header中有flag: JTNGZmxhZw==，解base64得到参数%3Fflag，猜测index.php存在文件包含，运用flag参数读文件。

payload:http://58.20.46.150:26293/index.php?flag=php://filter/convert.base64-encode/resource=index

Read more »

Posted on Edited on

又是一年双十一，又是一年hctf，web狗写一下自己学到的，做出来的题目

Warmup

查看源代码在注释里发现source.php，访问得到index.php的代码。

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
<?php
    class emmm
    {
        public static function checkFile(&$page)
        {
            $whitelist = ["source"=>"source.php","hint"=>"hint.php"];
            if (! isset($page) || !is_string($page)) {
                echo "you can't see it";
                return false;
            }

            if (in_array($page, $whitelist)) {
                return true;
            }

            $_page = mb_substr(
                $page,
                0,
                mb_strpos($page . '?', '?')
            );
            if (in_array($_page, $whitelist)) {
                return true;
            }

            $_page = urldecode($page);
            $_page = mb_substr(
                $_page,
                0,
                mb_strpos($_page . '?', '?')
            );
            if (in_array($_page, $whitelist)) {
                return true;
            }
            echo "you can't see it";
            return false;
        }
    }

    if (! empty($_REQUEST['file'])
        && is_string($_REQUEST['file'])
        && emmm::checkFile($_REQUEST['file'])
    ) {
        include $_REQUEST['file'];
        exit;
    } else {
        echo "<br><img src=\"https://i.loli.net/2018/11/01/5bdb0d93dc794.jpg\" />";
    }  
?>
Read more »