2019 高校运维赛 writeup

本文作者：MAIS 首发于“合天智汇”公众号！

MISC 0x01 misc1

f = open('724c6e962216407fa5fa1ad7efda2653_misc1_flag.txt','rb')
b = f.read()
a = []
max = int(0)
min = int(999)
for i in b:
    t = i
    if t >= max:
        max = i
    if t  文件 -> 重新载入 -> IBM EBCDIC英国编码
 
0x02 misc2 
#!/usr/bin/env python
# -*- coding: utf-8 -*-

import os
from flask import request
from flask import Flask

secret = open('/flag', 'rb')

os.remove('/flag')


app = Flask(__name__)
app.secret_key = '015b9efef8f51c00bcba57ca8c56d77a'


@app.route('/')
def index():
    return open(__file__).read()


@app.route("/r", methods=['POST'])
def r():
    data = request.form["data"]
    if os.path.exists(data):
        return open(data).read()
    return ''


if __name__ == '__main__':
    app.run(host='0.0.0.0', port=8000, debug=False)
 
存在任意文件读取，flag文件open后被删除，可以读取文件描述符拿到flag
 
data=/proc/self/fd/3
 
0x02 misc3 
使用010editor等十六进制编辑器打开html文件，可看见存在一段由序列E2 80 8C和序列E2 80 8B组成的隐藏字符，把E2 80 8C视为0，E2 80 8B视为1进行转换可得flag 在Chrome浏览器的开发者工具中打开也可以发现
 
0827h: E2 80 8C E2 80 8B E2 80 8B E2 80 8C E2 80 8C E2  ‌​​‌‌â 
0837h: 80 8B E2 80 8B E2 80 8C E2 80 8C E2 80 8B E2 80  €‹â€‹â€Œâ€Œâ€‹â€ 
0847h: 8B E2 80 8C E2 80 8B E2 80 8B E2 80 8C E2 80 8C  ‹â€Œâ€‹â€‹â€Œâ€Œ 
0857h: E2 80 8C E2 80 8B E2 80 8B E2 80 8C E2 80 8C E2  ‌​​‌‌â 
0867h: 80 8C E2 80 8C E2 80 8B E2 80 8C E2 80 8B E2 80  €Œâ€Œâ€‹â€Œâ€‹â€ 
0877h: 8B E2 80 8C E2 80 8C E2 80 8B E2 80 8B E2 80 8B  ‹â€Œâ€Œâ€‹â€‹â€‹ 
0887h: E2 80 8C E2 80 8B E2 80 8B E2 80 8B E2 80 8B E2  ‌​​​​â 
0897h: 80 8C E2 80 8B E2 80 8B E2 80 8C E2 80 8B E2 80  €Œâ€‹â€‹â€Œâ€‹â€ 
...
 
0000h: 01100110 01101100 01100001 01100111 01111011 01100101 00110010 01100001  flag{e2a 
0008h: 00111001 01100011 00111000 01100010 00110001 00110001 00110111 00110101  9c8b1175 
0010h: 01100101 00110110 00110110 01100011 01100110 00110010 00110001 01100110  e66cf21f 
0018h: 00111000 00110101 00111001 00110011 01100010 01100011 00111000 00110101  8593bc85 
0020h: 01100010 01100110 00111001 00110011 00111001 01111101                    bf939}
 
0x03 webshell 
分析流量可知，在服务器上执行的shell解密后大致如下
 

//ed3edq113
 
在第七个HTTP流中，读取了flag
 
In [4]: base64.b64decode('Y2QgIi92YXIvd3d3L2h0bWwvdG1wIjtjYXQgZmxhZ3xiYXNlNjQgO2VjaG8gW1NdO3B3ZDtlY2hvIFtFXQ==')
Out[4]: b'cd "/var/www/html/tmp";cat flag|base64 ;echo [S];pwd;echo [E]'
 
flag经过了一层base64加密，在asoutput方法中增加了前后缀，然后在套一下base64，顺便AES加密 响应的内容如下：
 
kRD1eD+vSZ81FAJ6XClabCR0xNFklup5/x+gixas3l0kdMTRZJbqef8foIsWrN5dJHTE0WSW6nn/H6CLFqzeXSR0xNFklup5/x+gixas3l0kdMTRZJbqef8foIsWrN5dZOTFg4DW9MYwG6k3rEvAAR8oFStGnfMRtUJOqc0mgokfKBUrRp3zEbVCTqnNJoKJHygVK0ad8xG1Qk6pzSaCiR8oFStGnfMRtUJOqc0mgokfKBUrRp3zEbVCTqnNJoKJ1qI47Cz1/qfnNoNARGhLfVhC0RJlfeKCvbPwpjFn//BSFY8RJlZyxz1a+TPy0D3cUhWPESZWcsc9Wvkz8tA93FIVjxEmVnLHPVr5M/LQPdxSFY8RJlZyxz1a+TPy0D3cUhWPESZWcsc9Wvkz8tA93GnMvJfVbvphfWnt17IOkzYjvv91k2fnYDR7u4nlGM3YitxGYGs9mn+HS5iJBXORtYrcRmBrPZp/h0uYiQVzkbWK3EZgaz2af4dLmIkFc5G1itxGYGs9mn+HS5iJBXORtUq4dBjDRFhDqDyzs9CScJhrd3yMusQ+qsnZkq4Ey7NVJHTE0WSW6nn/H6CLFqzeXSR0xNFklup5/x+gixas3l0kdMTRZJbqef8foIsWrN5dJHTE0WSW6nn/H6CLFqzeXSR0xNFklup5/x+gixas3l2hDPuDhVN4TaDLzp9bXyfGeCVhvglAaNo2rA/ovnRTTtfA5ZywMOOijj6md5RItqjXwOWcsDDjoo4+pneUSLao18DlnLAw46KOPqZ3lEi2qNfA5ZywMOOijj6md5RItqgS0b9hS7r5TX9YNZo2awgUAyqVacVgwr1NlNQ2k/kihhh0QQfnjeGdZhkz0N0jAKiMzFmAMa7xQ1URxTaHoHjDg3NaWl/8+PVG+pyaKrbNDjfl77POeQE8+0MCHpz6YxWLJ6mwCe1X3uzz/HSHcHSvQBB8FxjOhugOErOXkd3LZi/60Gr4gIEc1JIxA5A2pE/V6Z/DFwNOR4M/IIIWdGr5
 
解密脚本
 

 
拿到flag:flag{AntSword_is_Powerful_3222222!!!}
 
re 
re1 
init_array和fini_array都有一个函数，在init_array里的函数里加了反调，直接patch即可，然后还把key修改了
 
for ( j = 0; j