GKSEC

2019 GXY_CTF 官方 Write Up

2019 GXY_CTF 官方 Write Up

　　首先因为这个题目其实是校内招新赛，所以可能比较简单（ak的V&N师傅们tql），也有些师傅说部 分题目分数设计不太合理，作为主办方这些我们也进行了反思，希望下次能让师傅们满意（如果还有下 次的话233333），这次比赛大家快乐就完事儿了。现在比赛结束了，我们能做的也就是尽量吧wp整理 得完善一些，尽量让萌新们有所提高，顺便聊一聊比赛中出现的非预期情况。

WEB

BabySqli

# username: 
-1' union select 1, 'admin', '202cb962ac59075b964b07152d234b70' # 
# password: 
123

BabySqli 2

BabySqli 3

<meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> 
<form action="" method="post" enctype="multipart/form-data">
    上传文件
  <input type="file" name="file" />
  <input type="submit" name="submit" value="上传" />
</form>
<?php
error_reporting(0);
class Uploader{
    public $Filename;
    public $cmd;
    public $token;
    
    function __construct(){
        $sandbox = getcwd()."/uploads/".md5($_SESSION['user'])."/";
        $ext = ".txt";
        @mkdir($sandbox, 0777, true);
        if(isset($_GET['name']) and !preg_match("/data:\/\/ | filter:\/\/ | 
php:\/\/ | \./i", $_GET['name'])){
            $this->Filename = $_GET['name'];
        }
        else{
            $this->Filename = $sandbox.$_SESSION['user'].$ext;
        }
        $this->cmd = "echo '<br><br>Master, I want to study rizhan!<br><br>';";
        $this->token = $_SESSION['user'];
    }
    function upload($file){
        global $sandbox;
        global $ext;
        if(preg_match("[^a-z0-9]", $this->Filename)){
            $this->cmd = "die('illegal filename!');";
        }
        else{
            if($file['size'] > 1024){
                $this->cmd = "die('you are too big (ʹ▽`〃)');";
            }
            else{
                $this->cmd = "move_uploaded_file('".$file['tmp_name']."', '" . 
$this->Filename . "');";
            }
        }
    }
    function __toString(){
        global $sandbox;
        global $ext;
        // return $sandbox.$this->Filename.$ext;
        return $this->Filename;
    }
    function __destruct(){
        if($this->token != $_SESSION['user']){
            $this->cmd = "die('check token falied!');";
        }
        eval($this->cmd);
    }
}
if(isset($_FILES['file'])) {
    $uploader = new Uploader();
    $uploader->upload($_FILES["file"]);
    if(@file_get_contents($uploader)){
        echo "下面是你上传的文件：<br>".$uploader."<br>";
        echo file_get_contents($uploader);
    }
}
?>

BabyUpload

Ping Ping Ping

Do you know robots

<?php 
class FileReader{
    public $Filename;
    public $start;
    public $max_length;
    function __construct(){
        $this->Filename = __DIR__ . "/bcm.txt";
        $this->start = 12;
        $this->max_length = 72;
    }
    function __wakeup(){
        $this->Filename = __DIR__ . "/fake_f1ag.php";
        $this->start = 10;
        $this->max_length = 0;
    }
    function __destruct(){
        $data = file_get_contents($this->Filename, 0, NULL, $this->start, $this-
>max_length);
if(preg_match("/\{|\}/", $data)){
            die("you can't read flag!");
        }
        else{
            echo $data;
        }
    }
}
if(isset($_GET['exp'])){
    if(preg_match("/.?f.?l.?a.?g.?/i", $_GET['exp'])){
        die("hack!");
    }
    $exp = $_REQUEST['exp'];
    $e = unserialize($exp);
    echo $e->Filename;
}
else{
    $exp = new FileReader();
}
?>

禁止套娃！

MISC

佛系青年

完整的WriteUp下载

完整的WP地址：http://suo.im/6rVkcI
图片备份：http://suo.im/64Cx7i

当前页面是本站的「Google AMP」版。查看和发表评论请点击：完整版 »