暑假集训7.01

mysql

给了好多文件，有个FLAG文件，但里面什么都没有，问了web师傅也不是sql的题目

然后用strings指令去搜索字符，发现在flag藏在ibdata1和ib_logfile0

[HZNU]math

一道交互题

连接环境，让我们计算56除一个数的结果

去看一下源码，flag就是FLAG = open('flag').read

然后发现里面有assert函数和eval函数，这两个函数存在着漏洞，就是若函数里面的内容是字符串，就会被当成代码来执行

#!/usr/bin/env python3.8
from hashlib import sha256
import socketserver
import signal
import string
import random
import os
FLAG = open('flag').read

class Task(socketserver.BaseRequestHandler):
    def _recvall(self):
        BUFF_SIZE = 2048
        data = b''
        while True:
            part = self.request.recv(BUFF_SIZE)
            data += part
            if len(part) < BUFF_SIZE:
                break
        return data.strip()

    def send(self, msg, newline=True):
        try:
            if newline:
                msg += b'\n'
            self.request.sendall(msg)
        except:
            pass

    def recv(self, prompt=b'value 2: '):
        self.send(prompt, newline=False)
        return self._recvall()

    def proof_of_work(self):
        random.seed(os.urandom(8))
        proof = ''.join(
            [random.choice(string.ascii_letters+string.digits) for _ in range(20)])
        _hexdigest = sha256(proof.encode()).hexdigest()
        self.send(f"[+] sha256(XXXX+{proof[4:]}) == {_hexdigest}".encode())
        x = self.recv(prompt=b'[+] Plz tell me XXXX: ')
        if len(x) != 4 or sha256(x+proof[4:].encode()).hexdigest() != _hexdigest:
            return False
        return True

    def multiply_func(self, x):
        self.send(f'value 1: {repr(x)} '.encode())
        v = self.recv().decode()
        assert v
        # if len(v) > 8: return
        self.send(f'{x} * {v}'.encode())
        self.send(str(eval(f'{x} * {v}')).encode())
        return eval(f'{x} * {v}')

    def handle(self):
        # if not self.proof_of_work():
        #     return

        self.send(b"Welcome to the 4XWi11's Arithmetic classroom")
        self.send(b"I will give value1, you need to answer value2")
        self.send(b"and you need to multiply the two to equal 56")

        signal.alarm(500)

        for x in [7, 7.77, '77777', [777777777]]:
            if self.multiply_func(x) != 56:
                self.send(b"wrong!")
                return
            else:
                self.send(b"Correct!")

        self.send(b"Congrats! Here is your flag: ")
        self.send(FLAG.encode())


class ThreadedServer(socketserver.ThreadingMixIn, socketserver.TCPServer):
    pass


class ForkedServer(socketserver.ForkingMixIn, socketserver.TCPServer):
    pass


if __name__ == "__main__":
    HOST, PORT = '0.0.0.0', 80
    server = ForkedServer((HOST, PORT), Task)
    server.allow_reuse_address = True
    print(HOST, PORT)
    server.serve_forever()