[MRCTF2020]你传你马呢解题

╰+哭是因爲堅強的太久メ 2023-10-06 19:58 12阅读 0赞

1、首先右键查看页面源代码，可知后端支持PHP。

![watermark_type_ZHJvaWRzYW5zZmFsbGJhY2s_shadow_50_text_Q1NETiBAQmlnJkJpcmQ_size_20_color_FFFFFF_t_70_g_se_x_16][]

2、上传一句话木马，果断报错了

![watermark_type_ZHJvaWRzYW5zZmFsbGJhY2s_shadow_50_text_Q1NETiBAQmlnJkJpcmQ_size_16_color_FFFFFF_t_70_g_se_x_16][]

![watermark_type_ZHJvaWRzYW5zZmFsbGJhY2s_shadow_50_text_Q1NETiBAQmlnJkJpcmQ_size_18_color_FFFFFF_t_70_g_se_x_16][]

3、将文件后缀名修改为php3/php4/php5/phtml后，在上传，仍然报错。

4、那上传.htaccess文件试试吧

> SetHandler application/x-httpd-php

![watermark_type_ZHJvaWRzYW5zZmFsbGJhY2s_shadow_50_text_Q1NETiBAQmlnJkJpcmQ_size_18_color_FFFFFF_t_70_g_se_x_16 1][]

bp抓包，修改filename=".htaccess"

![watermark_type_ZHJvaWRzYW5zZmFsbGJhY2s_shadow_50_text_Q1NETiBAQmlnJkJpcmQ_size_20_color_FFFFFF_t_70_g_se_x_16 1][]

报错了，怀疑是对Content-Type做了过滤，将Content-Type修改为image/jpeg后在上传，上传成功了。

![watermark_type_ZHJvaWRzYW5zZmFsbGJhY2s_shadow_50_text_Q1NETiBAQmlnJkJpcmQ_size_20_color_FFFFFF_t_70_g_se_x_16 2][]

5、将shell.php修改为shell.jpg后上传。

![watermark_type_ZHJvaWRzYW5zZmFsbGJhY2s_shadow_50_text_Q1NETiBAQmlnJkJpcmQ_size_20_color_FFFFFF_t_70_g_se_x_16 3][]

上传成功，并返回了路径。

6、上菜刀连接，根目录下找到flag

![watermark_type_ZHJvaWRzYW5zZmFsbGJhY2s_shadow_50_text_Q1NETiBAQmlnJkJpcmQ_size_13_color_FFFFFF_t_70_g_se_x_16][]

![watermark_type_ZHJvaWRzYW5zZmFsbGJhY2s_shadow_50_text_Q1NETiBAQmlnJkJpcmQ_size_20_color_FFFFFF_t_70_g_se_x_16 4][]

[watermark_type_ZHJvaWRzYW5zZmFsbGJhY2s_shadow_50_text_Q1NETiBAQmlnJkJpcmQ_size_20_color_FFFFFF_t_70_g_se_x_16]: https://img-blog.csdnimg.cn/72cf4412388441b5b6554fd7e0e1dc89.png?x-oss-process=image/watermark,type_ZHJvaWRzYW5zZmFsbGJhY2s,shadow_50,text_Q1NETiBAQmlnJkJpcmQ=,size_20,color_FFFFFF,t_70,g_se,x_16
[watermark_type_ZHJvaWRzYW5zZmFsbGJhY2s_shadow_50_text_Q1NETiBAQmlnJkJpcmQ_size_16_color_FFFFFF_t_70_g_se_x_16]: https://img-blog.csdnimg.cn/835c0e5af8354b79bf86ec792458ffb3.png?x-oss-process=image/watermark,type_ZHJvaWRzYW5zZmFsbGJhY2s,shadow_50,text_Q1NETiBAQmlnJkJpcmQ=,size_16,color_FFFFFF,t_70,g_se,x_16
[watermark_type_ZHJvaWRzYW5zZmFsbGJhY2s_shadow_50_text_Q1NETiBAQmlnJkJpcmQ_size_18_color_FFFFFF_t_70_g_se_x_16]: https://img-blog.csdnimg.cn/ed699576df604ddc86d6903ce1c9bb63.png?x-oss-process=image/watermark,type_ZHJvaWRzYW5zZmFsbGJhY2s,shadow_50,text_Q1NETiBAQmlnJkJpcmQ=,size_18,color_FFFFFF,t_70,g_se,x_16
[watermark_type_ZHJvaWRzYW5zZmFsbGJhY2s_shadow_50_text_Q1NETiBAQmlnJkJpcmQ_size_18_color_FFFFFF_t_70_g_se_x_16 1]: https://img-blog.csdnimg.cn/62deafda27664b7c9d2b912b7ba5e405.png?x-oss-process=image/watermark,type_ZHJvaWRzYW5zZmFsbGJhY2s,shadow_50,text_Q1NETiBAQmlnJkJpcmQ=,size_18,color_FFFFFF,t_70,g_se,x_16
[watermark_type_ZHJvaWRzYW5zZmFsbGJhY2s_shadow_50_text_Q1NETiBAQmlnJkJpcmQ_size_20_color_FFFFFF_t_70_g_se_x_16 1]: https://img-blog.csdnimg.cn/57994fb8eaf54a929b2e26b8762c6cc1.png?x-oss-process=image/watermark,type_ZHJvaWRzYW5zZmFsbGJhY2s,shadow_50,text_Q1NETiBAQmlnJkJpcmQ=,size_20,color_FFFFFF,t_70,g_se,x_16
[watermark_type_ZHJvaWRzYW5zZmFsbGJhY2s_shadow_50_text_Q1NETiBAQmlnJkJpcmQ_size_20_color_FFFFFF_t_70_g_se_x_16 2]: https://img-blog.csdnimg.cn/1a7571dcae294a42ab7a67068f9beb5a.png?x-oss-process=image/watermark,type_ZHJvaWRzYW5zZmFsbGJhY2s,shadow_50,text_Q1NETiBAQmlnJkJpcmQ=,size_20,color_FFFFFF,t_70,g_se,x_16
[watermark_type_ZHJvaWRzYW5zZmFsbGJhY2s_shadow_50_text_Q1NETiBAQmlnJkJpcmQ_size_20_color_FFFFFF_t_70_g_se_x_16 3]: https://img-blog.csdnimg.cn/fe6f983af1154c0ca1e743fec144d9c7.png?x-oss-process=image/watermark,type_ZHJvaWRzYW5zZmFsbGJhY2s,shadow_50,text_Q1NETiBAQmlnJkJpcmQ=,size_20,color_FFFFFF,t_70,g_se,x_16
[watermark_type_ZHJvaWRzYW5zZmFsbGJhY2s_shadow_50_text_Q1NETiBAQmlnJkJpcmQ_size_13_color_FFFFFF_t_70_g_se_x_16]: https://img-blog.csdnimg.cn/a12ec52c4d6e46c8893c9b0ee34bc8ae.png?x-oss-process=image/watermark,type_ZHJvaWRzYW5zZmFsbGJhY2s,shadow_50,text_Q1NETiBAQmlnJkJpcmQ=,size_13,color_FFFFFF,t_70,g_se,x_16
[watermark_type_ZHJvaWRzYW5zZmFsbGJhY2s_shadow_50_text_Q1NETiBAQmlnJkJpcmQ_size_20_color_FFFFFF_t_70_g_se_x_16 4]: https://img-blog.csdnimg.cn/37b43eeffe2147f091bb44a917b0023d.png?x-oss-process=image/watermark,type_ZHJvaWRzYW5zZmFsbGJhY2s,shadow_50,text_Q1NETiBAQmlnJkJpcmQ=,size_20,color_FFFFFF,t_70,g_se,x_16