VulnHub：Wallaby's NightmareでIRCから好ましくないものを捨てる

ルート：x：0：0：ルート：/ルート：/ bin / bash
デーモン：x：1：1：デーモン：/ usr / sbin：/ usr / sbin / nologin
bin：x：2：2：bin：/ bin：/ usr / sbin / nologin
sys：x：3：3：sys：/ dev：/ usr / sbin / nologin
sync：x：4：65534：sync：/ bin：/ bin / sync
ゲーム：x：5：60：ゲーム：/ usr / games：/ usr / sbin / nologin
man：x：6：12：man：/ var / cache / man：/ usr / sbin / nologin
lp：x：7：7：lp：/ var / spool / lpd：/ usr / sbin / nologin
メール：x：8：8：メール：/ var /メール：/ usr / sbin / nologin
ニュース：x：9：9：ニュース：/ var /スプール/ニュース：/ usr / sbin / nologin
uucp：x：10：10：uucp：/ var / spool / uucp：/ usr / sbin / nologin
www-data：x：33：33：www-data：/ var / www：/ usr / sbin / nologin
バックアップ：x：34：34：バックアップ：/ var /バックアップ：/ usr / sbin / nologin
リスト：x：38：38：メーリングリストマネージャー：/ var /リスト：/ usr / sbin / nologin
irc：x：39：39：ircd：/ var / run / ircd：/ usr / sbin / nologin
gnats：x：41：41：Gnatsバグ報告システム（管理者）：/ var / lib / gnats：/ usr / sbin / nologin
nobody：x：65534：65534：nobody：/ nonexistent：/ usr / sbin / nologin
syslog：x：104：108 :: / home / syslog：/ bin / false
_apt：x：105：65534 :: /存在しない：/ bin / false
uuidd：x：107：111 :: /実行/ uuidd：/ bin / false
walfin：x：1000：1000：walfin ,,,：/ home / walfin：/ bin / bash
sshd：x：108：65534 :: / var / run / sshd：/ usr / sbin / nologin
mysql：x：109：117：MySQL Server ,,,：/存在しない：/ bin / false
steven ?: x：1001：1001 :: / home / steven ?: / bin / bash
ircd：x：1003：1003：,,,：/ home / ircd：/ bin / bash

 <?php # basic webpage routing $page = filter_input(INPUT_GET, 'page'); $open = fopen("/var/www/html/uname.txt", "r"); $levelone = "/var/www/html/levelone.txt"; $username = fgets($open); $ip = $_POST['ip']; # whitelist webpage filter $webpageWhitelist = ['index', 'contact', 'home', 'blacklist', 'mailer', 'name']; # Begin filtering the $page variable if ($page === "name" and file_exists($levelone)) { include('/var/www/html/uname.txt'); } elseif ($page === "home" and file_exists($levelone)) { include('s13!34g$3FVA5e@ed/home.php'); } elseif ($page === "home" or isset($page) === false and !file_exists($levelone)) { include('s13!34g$3FVA5e@ed/althome.php'); } elseif (in_array($page, $webpageWhitelist, true) === true and $page !== "name") { # If the web page is on the whitelist. Show it. include "s13!34g$3FVA5e@ed/{$page}.php"; } elseif (isset($page) === false) { # Or else, IF the web page variable is NULL/Not Set. Assume home page is wanted. include 's13!34g$3FVA5e@ed/index.php'; } elseif (strpos($page, '/etc/passwd') !== false) { include 's13!34g$3FVA5e@ed/honeypot.php'; } elseif (strpos($page, '/') !== false and file_exists($levelone)) { echo "<h2>That's some fishy stuff you're trying there <em>{$username}</em>buddy. You must think Wallaby codes like a monkey! I better get to securing this SQLi though...</h2> <br />(Wallaby caught you trying an LFI, you gotta be sneakier! Difficulty level has increased.)"; system('rm /var/www/html/levelone.txt'); } elseif (strpos($page, '/') !== false) { echo "<h2>Nice try <em>{$username}</em>buddy, this vector is patched!</h2>"; } elseif (strpos($page, '\'') !== false) { echo "<script>window.RTCPeerConnection = window.RTCPeerConnection || window.mozRTCPeerConnection || window.webkitRTCPeerConnection; //compatibility for firefox and chrome var pc = new RTCPeerConnection({iceServers:[]}), noop = function(){}; pc.createDataChannel(\"\"); //create a bogus data channel pc.createOffer(pc.setLocalDescription.bind(pc), noop); // create offer and set local description pc.onicecandidate = function(ice){ //listen for candidate events if(!ice || !ice.candidate || !ice.candidate.candidate) return; var myIP = /([0-9]{1,3}(\.[0-9]{1,3}){3}|[a-f0-9]{1,4}(:[a-f0-9]{1,4}){7})/.exec(ice.candidate.candidate)[1]; alert('Your ip is ' + myIP + ', consider it blacklisted for a bit :D.'); post('/?page=blacklist', {bl: myIP}); pc.onicecandidate = noop; };</script> <noscript>Wtf...where'd you go <em>{$username}</em></noscript>"; } else { # Or else, we will show them a 404 web page instead #include 'pages/errors/404.php'; echo "<h2>Dude, <em>{$username}</em> what are you trying over here?!</h2>"; } ?> 

 <?php $cmd = $_GET['mail']; if (strpos($cmd, 'nc') !== false) { echo '<h5>How you gonna use netcat so obviously. Cmon man. This is all in the logs.</h5>'; } else { system("{$cmd}"); } echo "<h2 style='color:blue;'>Coming Soon guys!</h2> <!--a href='/?page=mailer&mail=mail wallaby \"message goes here\"'><button type='button'>Sendmail</button--> <!--Better finish implementing this so {$username} can send me all his loser complaints!-->"; ?>