LoRexxar's Blog

Hduisa_ctf_writeup01

2015/02/26

鍋囨湡涓鐩村湪鐜╀細闀垮ぇ澶ф悶寰梒tf闆嗚锛屼竴涓亣鏈熶篃瀛﹀埌浜嗭紝鐜板湪鏁寸悊writeup锛屼篃瀵瑰亣鏈熷涔犲埌鐨勪笢瑗挎湁涓涓竻鏅扮殑璁よ瘑鈥

WEEK10x01灏忔槑鐨勫コ绁

鎵撳紑棰樼洰鐪嬪埌鐨勬槸涓骞呭コ绁炵殑鍥剧墖


鐪嬩笂鍘诲緢鐔熸倝锛屽緢鍍忔槸涔嬪墠hctf鍋氳繃鐨勯鐩紝浜庢槸鏌ョ湅婧愮爜

鎶婅繖涓蹭唬鐮侀氳繃base64鍥剧墖瑙g爜涔嬪悗寰楀埌鐨勬槸鍜屼竴鏍风殑鍥剧墖锛岃繖閲屼竴涓嬪氨娌′粈涔堟兂娉曚簡锛屽悗鏉ラ氳繃闂闀垮緱鐭ユ妸涓ゅ紶鍥剧墖閫氳繃Bcompare锛屽彲浠ュ緱鍑鸿繖涔堜竴涓蹭笉鍚岀殑鏁板瓧銆

74.117.56.51.114.111.67.51

鍒拌繖閲岀洿鎺ヨ剳娲炵鎺変簡锛屼竴鐩撮兘娌′粈涔堟兂娉曪紝鍚庢潵鐪嬪埌鍒汉鐨剋riteup锛屽緱鐭ユ妸鏁板瓧杞崲涓篴csii鐮佸緱鍒癑u83roC3鈥

鐒跺悗鍔犲湪棰樼洰閾炬帴鍚庨潰鎴愪负锛

Flag get锛

ps锛氳繖閲岃剳娲炵畝鐩寸浜嗕竴鍦扳

WEEK2_0x02_getresponse

绗竴鐪肩湅鍒拌繖閬撻鐨勬椂鍊欙紝鎴戠畝鐩磋鍚撳摥浜嗏︽鏃犳濊矾锛屾彁绀哄憡璇夋垜浠槸鏉ヨ嚜鍘诲勾alictf鐨勪竴閬撻鐩紝鍏抽敭鍦ㄤ簬杩欑瘒鏂囩珷http://drops.wooyun.org/tips/750锛屼竴涓嬪瓙鍙互鎯冲埌杩欓亾棰樻槸瑕佷娇鐢ˊ鐨勯粦榄旀硶鈥︿絾鏄瘯浜嗗ソ澶氭鏃犳濊矾锛屾渶鍚庣湅浜唚riteup鎴戠殑浜虹敓瑙傝棰犺浜嗭紝寰楀埌鍏抽敭鐐瑰湪浜巋elp涓嬬殑鎻愮ず

涔嬪墠瀹屽叏娌℃湁娉ㄦ剰鍒帮紝杩欓噷鏈変袱涓瓧绗﹀湪涓嶆柇鐨勫埛鏂颁笅浼氬彉锛屽娆″埛鏂板悗寰楀埌

R2V0IFJlc3BvbnNlIEZyb20gaGR1aXNhLmNu

瑙e瘑鍑烘潵寰Get Response From hduisa.cn

涓涓嬪瓙寰楀埌鏂瑰悜鏋勯http://drops.hduisa.cn@hduisa.cn

Flag get锛

WEEK1_0x03_easy sqli

寮濮嬬湅鍒扮湅鍒拌繖涓棰樼殑鏃跺欑湡鐨勬槸姣棤鎬濊矾锛屽洜涓烘瘯绔熻繕娌℃湁寮濮嬪涔爏ql鍜宲hp锛屼簬鏄湅鍒颁簡涔嬪悗鐨剋riteup锛屼篃绠楁槸瀵箂ql鐨勫皬鍏ラ棬鍚р

棰樼洰鏄竴閬撳緢鏈夋剰鎬濈殑棰樼洰

鐪嬪埌mq==绗竴鍙嶅簲鏄痓ase64鐨勭紪鐮侊紝涔熷氨鏄1鈥︿箣鍚庡彂鐜伴鐩湁鍚勭鍧戯紝浼氶暱鍙婃椂缁欏嚭浜嗘彁绀衡

棣栧厛灏辨槸鍧1锛屽鏋滄病鏈変慨鏀逛紶閫掓柟寮忕殑璇濓紝鏃犺鎻愪氦浠涔堬紝閮戒細

鍐嶅姞涓婂潙3锛岃繃铏戜簡and鍜宱r浜庢槸鏋勯犲嚭鈥榺|1# base64缂栫爜鍚庡緱鍒J3x8MSM=娣诲姞鍒扮櫥褰曡〃鍗曚笂锛屽苟涓斾慨鏀规彁浜ゆ柟寮

鎻愪氦锛孎lag get锛

鎬讳綋鏉ヨWEEK1鐨勯鐩毦搴﹀拰缁煎悎绋嬪害閮芥瘮杈冮珮锛屼簬鏄垜绛夎彍楦熶竴閬撲篃娌″仛鍑烘潵锛屼笉杩囪繕鏄笉閿欙紝瀛﹀埌寰堝涓滆タ鈥

WEEK20x01棰囨湁鎶宸х殑sql娉ㄥ叆

杩欓亾棰樺疄鍦ㄦ槸闅惧害澶ぇ锛屽睘浜庣瓟妗堢粰鎴戞垜閮藉仛涓嶅嚭鐨勯偅绉嶏紝杩欓噷杩樻槸鏀句笂鍒汉鐨剋riteup浠呬緵鍙傞槄

WEEK20x02鏈绠鍗曠殑棰樼洰

鍥犱负涓婂懆鐨勯鐩毦搴﹁繃澶э紝杩欏懆缁欏嚭浜嗚澶氱畝鍗曠殑棰樼洰锛岃繖閬撻鐨勪篃灞炰簬浼犺涓仛涓嶅嚭涓嶈鐜ヽtf鐨勭被鍨.

鍚庢潵鎯冲埌杩欓锛屼竴鐩存劅瑙夋槸琚細闀胯嶄簡锛岄鐩瑕乬et id=flag锛岃皝鐭ラ亾鐩存帴鏌ョ湅婧愮爜灏卞彲寰楃煡

Flag get锛佽繖棰樺お澶氱畝鍗曪紝涔熷氨涓嶈禈杩扳

WEEK20x03鍩虹璁粌

棰樼洰姣旇緝绠鍗曪紝鑰屼笖鏄瘮杈冩湁鎰忔濈殑閭g锛岄鐩彁绀哄憡璇夋垜浠槸鍏充簬cookie鍜岀紪鐮佺殑

鏍规嵁椤甸潰涓婇潰鐨勬彁绀猴紝鍥剧墖鎼滅储杩欎釜浜猴紝寰楀埌缃楅┈闊充负Tobiichi Origami

鏍规嵁棰樼洰涓殑鎻愮ず锛屾煡鐪媍ookie

鍙戠幇flag:bGlnaHRsZXNzOjQ3NmExMGYxZjNkZGU1MWQxYjUyMjY3YzFhY2NjMzll

鎶婂悗闈㈢殑涓滆タ鐢╞ase64瑙g爜鍚庡緱鍒

lightless:476a10f1f3dde51d1b52267c1accc39e

寮濮嬪仛鍒拌繖閲屾椂鍊欐湁鐐瑰効鍗′綇浜嗭紝绐佺劧鎯冲埌鍙兘鏄痬d5锛岀敤md5瑙g爜鍚庡緱鍒帮紝鍚庨潰閭d覆鏄痩ightless锛屼竴涓嬪瓙鏄庣櫧浜

鎶婁笂闈㈢殑鐨勭綏椹煶鐓ф牸寮忎慨鏀瑰嚭鏉ワ紝淇敼cookie锛屾彁浜も︼紙杩欓噷浣跨敤鐨勬槸firefox鐨則emper data锛

Flag get锛

CATALOG
  1. 1. WEEK10x01灏忔槑鐨勫コ绁
  2. 2. WEEK2_0x02_getresponse
  3. 3. WEEK1_0x03_easy sqli
  4. 4. WEEK20x01棰囨湁鎶宸х殑sql娉ㄥ叆
  5. 5. WEEK20x02鏈绠鍗曠殑棰樼洰
  6. 6. WEEK20x03鍩虹璁粌