bugku 432 whois writeup

启动场景后打开网址

发现是个whois查询的网页实现，盲猜命令行注入

尝试使用%0a拼接成功

查看flag

查看query.php

 1<?php
 2
 3error_reporting(0);
 4
 5$output = null;
 6$host_regex = "/^[0-9a-zA-Z][0-9a-zA-Z\.-]+$/";
 7$query_regex = "/^[0-9a-zA-Z\. ]+$/";
 8
 9
10if (isset($_GET['query']) && isset($_GET['host']) && 
11      is_string($_GET['query']) && is_string($_GET['host'])) {
12
13  $query = $_GET['query'];
14  $host = $_GET['host'];
15  
16  if ( !preg_match($host_regex, $host) || !preg_match($query_regex, $query) ) {
17    $output = "Invalid query or whois host";
18  } else {
19    $output = shell_exec("/usr/bin/whois -h ${host} ${query}");
20  }
21
22} 
23else {
24  highlight_file(__FILE__);
25  exit;
26}
27
28?>
29
30<!DOCTYPE html>
31<html>
32  <head>
33    <title>Whois</title>
34  </head>
35  <body>
36    <pre><?= htmlspecialchars($output) ?></pre>
37  </body>
38</html>