web赛题3

2019--21省赛

wp：https://xz.aliyun.com/t/6458

2019-11-22蚂蚁金服（南邮）wp有了，微信

https://platform.d3ctf.io/#/

@d3ctf-Showhub

@d3ctf-EasyWeb

hint：source code is in attachments

注册成功

@d3ctf- d3guestbook

聊天题该死的流行

report：

@d3ctf-babyxss

@d3ctf-fake onelinephp

<?php ($_=@$_GET['orange']) && @substr(file($_)[0],0,6) === '@<?php' ? include($_) : highlight_file(__FILE__);

@d3ctf-ezts

 @d3ctf-ezupload

打开就只有这个php代码

<?php
class dir{
    public $userdir;
    public $url;
    public $filename;
    public function __construct($url,$filename) {
        $this->userdir = "upload/" . md5($_SERVER["HTTP_X_REAL_IP"]);
        $this->url = $url;
        $this->filename  =  $filename;
        if (!file_exists($this->userdir)) {
            mkdir($, true);
        }
    }
    public function checkdir(){
        if ($this->userdir != "upload/" . md5($_SERVER["HTTP_X_REAL_IP"])) {
            die('hacker!!!');
        }
    }
    public function checkurl(){
        $r = parse_url($this->url);
        if (!isset($r['scheme']) || preg_match("/file|php/i",$r['scheme'])){
            die('hacker!!!');
        }
    }
    public function checkext(){
        if (stristr($this->filename,'..')){
            die('hacker!!!');
        }
        if (stristr($this->filename,'/')){
            die('hacker!!!');
        }
        $ext = substr($);
        if (preg_match("/ph/i", $ext)){
            die('hacker!!!');
        }
    }
    public function upload(){
        $this->checkdir();
        $this->checkurl();
        $this->checkext();
        $content = file_get_contents($,);
        if (preg_match("/\<\?|value|on|type|flag|auto|set|\\\\/i", $content)){
            die('hacker!!!');
        }
        file_put_contents($this->userdir."/".$this->filename,$content);
    }
    public function remove(){
        $this->checkdir();
        $this->checkext();
        if (file_exists($this->userdir."/".$this->filename)){
            unlink($this->userdir."/".$this->filename);
        }
    }
    public function count($dir) {
        if ($dir === ''){
            $num = count(scandir($;
        }
        else {
            $num = count(scandir($dir)) - ;
        }
        ) {
            return "you have $num files";
        }
        else{
            return "you don't have file";
        }
    }
    public function __toString() {
        return implode(" ",scandir(__DIR__."/".$this->userdir));
    }
    public function __destruct() {
        $string = "your file in : ".$this->userdir;
        file_put_contents($this->filename.".txt", $string);
        echo $string;
    }
}

if (!isset($_POST['action']) || !isset($_POST['url']) || !isset($_POST['filename'])){
    highlight_file(__FILE__);
    die();
}

$dir = new dir($_POST['url'],$_POST['filename']);
if($_POST['action'] === "upload") {
    $dir->upload();
}
elseif ($_POST['action'] === "remove") {
    $dir->remove();
}
elseif ($_POST['action'] === "count") {
    if (!isset($_POST['dir'])){
        echo $dir->count('');
    } else {
        echo $dir->count($_POST['dir']);
    }
}

 

 安洵杯 2019-11-30

比赛：http；s://axb.d0g3.cn

题解+复盘：https://github.com/D0g3-Lab/i-SOON_CTF_2019

@安洵杯-easy_serialize_php

hint：反序列化

点击sourcecode，得到php代码

<?php

$function = @$_GET['f'];

function filter($img){
    $filter_arr = array('php','flag','php5','php4','fl1g');
    $filter = '/'.implode('|',$filter_arr).'/i';
    return preg_replace($filter,'',$img);
}

if($_SESSION){
    unset($_SESSION);
}

$_SESSION["user"] = 'guest';
$_SESSION['function'] = $function;

extract($_POST);

if(!$function){
    echo '<a href="index.php?f=highlight_file">source_code</a>';
}

if(!$_GET['img_path']){
    $_SESSION['img'] = base64_encode('guest_img.png');
}else{
    $_SESSION['img'] = sha1(base64_encode($_GET['img_path']));
}

$serialize_info = filter(serialize($_SESSION));

if($function == 'highlight_file'){
    highlight_file('index.php');
}else if($function == 'phpinfo'){
    eval('phpinfo();'); //maybe you can find something in here!
}else if($function == 'show_image'){
    $userinfo = unserialize($serialize_info);
    echo file_get_contents(base64_decode($userinfo['img']));
}

尝试url访问guest_img.png

一个base64，解码出来一句hi,here you want to find me?

没啥用

再尝试urlhttp://47.108.135.45:20355/?img_path=‘guest_img.png'还是不行

 @安洵杯-easy_web

源代码，左上表情包图片是一段base64

这一大串屁用没有，每张图都这样的，图片编码成base64而已，接出来前面一个PNG说明是png文件，别一看见==就激动解码，要解的是url里的那串

 

最后提示md5

思路应该是：首先扫一下目录，扫出一个img，555.png　　

http://47.108.135.45:20355/index.php?img=TXpVek5UTTFNbVUzTURabE5qYz0&cmd= z这一段加上=或者俩=，两次base64，然后ascii，解码出一个555.png，然后不知怎么能得到原码，然后开始代码审计

 @安洵杯-iamthinking

根据hint的/public/访问

 @安洵杯-cssgame

@安洵杯-Membershop

简单注入一波

该页面js代码

<script>
$(document).keyup(function (e) {
    ) {
        var userName = $("#member").val();
        window.location.href='/login?userName='+userName;
    }
});
</script>

该页面另一段超长js

 @安洵杯-这不是文件上传

 @安洵杯-ez_ez

https://github.com/D0g3-Lab/i-SOON_CTF_2019