Hacker101-CTF | Postbook

mirror王宇阳
水平有限，不足之处还望指教 ^_

看看这个一大堆英文介绍

With this amazing tool you can write and publish your own posts. It'll allow you to write public and private posts. Public posts can be read by anyone that signs up. Private posts can only be read by you. See it as your own diary. We'll make sure that your private posts are safe with us.

===百度翻译===

有了这个神奇的工具，你可以写和发表你自己的文章。它允许你写公开和私人的帖子。任何注册的人都可以阅读公共帖子。私人帖子只能由你阅读。把它当作你自己的日记。我们会确保你的私人岗位安全。

提取关键字：

写文章、发文章、公开帖子、私密帖子

直观访问页面，首先注册一个test账户

越权访问/枚举参数(访问)

观察urlxxx/xxx/index.php?page=home.php发现可存在包含，测试后发现没有

浏览现有的几个留言信息发现

由URL得知留言的访问是通过id参数索引进行访问的，这里就有可能存在越权访问的可能；（考虑越权的理由是该留言板存在私人帖子）

将url加载到burp中

GET /xxxx/index.php?page=view.php&id=§1§ HTTP/1.1
Host: xxxxxx
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.79 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer: http://35.227.24.107/1825372d7a/index.php?page=home.php&message=
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: id=eccbc87e4b5ce2fe28308fd9f2a7baf3
Connection: close

将参数id从1开始1为单位进行递增（根据具体配置增加线程）