[网鼎杯 2018]Comment-Git泄露部分

R-S-PY 2020-04-23 原文

访问靶场首页

发现是一个留言板

访问/.git/

http://dd3bb0b5-41a5-46eb-bdb3-f5f2011e8b67.node3.buuoj.cn/.git/

访问.git发现，服务器返回403错误代码，代表服务区存在git目录

使用GitHacker

python GitHacker.py http://dd3bb0b5-41a5-46eb-bdb3-f5f2011e8b67.node3.buuoj.cn/.git/

进入网站的文件夹

查看write_do.php文件，发现write_do.php不全

(python2.7) root@DESKTOP-454TK54:~/tools/GitHacker/dd3bb0b5-41a5-46eb-bdb3-f5f2011e8b67_node3_buuoj_cn_# cat write_do.php

<?php
include "mysql.php";
session_start();
if($_SESSION['login'] != 'yes'){
    header("Location: ./login.php");
    die();
}
if(isset($_GET['do'])){
switch ($_GET['do'])
{
case 'write':
    break;
case 'comment':
    break;
default:
    header("Location: ./index.php");
}
}
else{
    header("Location: ./index.php");
}
?>

恢复write_do.php文件

查看git历史

git log --reflog # 查看git的历史记录

还原历史

git reset --hard e5b2a2443c2b6d395d06960123142bc91123148c

查看还原后的write_do.php文件

root@DESKTOP-454TK54:~/dd3bb0b5-41a5-46eb-bdb3-f5f2011e8b67_node3_buuoj_cn_# cat write_do.php
<?php
include "mysql.php";
session_start();
if($_SESSION['login'] != 'yes'){
    header("Location: ./login.php");
    die();
}
if(isset($_GET['do'])){
switch ($_GET['do'])
{
case 'write':
    $category = addslashes($_POST['category']);
    $title = addslashes($_POST['title']);
    $content = addslashes($_POST['content']);
    $sql = "insert into board
            set category = '$category',
                title = '$title',
                content = '$content'";
    $result = mysql_query($sql);
    header("Location: ./index.php");
    break;
case 'comment':
    $bo_id = addslashes($_POST['bo_id']);
    $sql = "select category from board where id='$bo_id'";
    $result = mysql_query($sql);
    $num = mysql_num_rows($result);
    if($num>0){
    $category = mysql_fetch_array($result)['category'];
    $content = addslashes($_POST['content']);
    $sql = "insert into comment
            set category = '$category',
                content = '$content',
                bo_id = '$bo_id'";
    $result = mysql_query($sql);
    }
    header("Location: ./comment.php?id=$bo_id");
    break;
default:
    header("Location: ./index.php");
}
}
else{
    header("Location: ./index.php");
}
?>