「安全筆記」2019 Hgame week 1-2 writeup

//flag.php
if($_SERVER['REMOTE_ADDR'] != '127.0.0.1') {
    die('only localhost can see it');
}
$filename = $_GET['filename']??'';

if (file_exists($filename)) {
    echo "sorry,you can't see it";
}
else{
    echo file_get_contents($filename);
}
highlight_file(__FILE__);

看到這裡的file_exists()和file_get_contents()明顯衝突，使用php://filter/read=convert.base64-encode/resource=flag.php繞過
最後的payload

PHP Is The Best Language

源碼

include 'secret.php'; 

#echo $flag; 
#echo $secret; 

if (empty($_POST['gate']) || empty($_POST['key'])) { 
    highlight_file(__FILE__); 
    exit; 
} 

if (isset($_POST['door'])){ 
    $secret = hash_hmac('sha256', $_POST['door'], $secret); 
} 

$gate = hash_hmac('sha256', $_POST['key'], $secret); 

if ($gate !== $_POST['gate']) { 
    echo "Hacker GetOut!!"; 
    exit; 
} 

if ((md5($_POST['key'])+1) == (md5(md5($_POST['key'])))+1) { 
    echo "Wow!!!"; 
    echo "</br>"; 
    echo $flag; 
} 
else { 
    echo "Hacker GetOut!!"; 
} 

hash_hmac — 使用 HMAC 方法生成帶有密鑰的哈希值
當第二個參數為陣列的時候返回null，利用這個特性，即使不知道$secret，也可以控制$gate這個參數。
然後就是(md5($_POST['key'])+1) == (md5(md5($_POST['key'])))+1)繞過了，這個可以利用弱類型，構造0e，提供一個字符串V5VDSHva7fjyJoJ33IQl。然後把這個sha256加密後做gate提交，就可以了

Baby_Spider

學到很多東西的一題，題目明確爬蟲+python3來做，開始毫無頭緒，後來看了大佬的wp，知道了這裡有兩個反扒機制，一個是攜程用的css來打亂顯示數字，一個是使用字體替換來反扒。然後做了早就想開坑的selenuim，這次用了requests和selenuim兩種方法來做這道題，可以說是收穫良多了。

# selenuim方法
from selenium import webdriver

url = 'http://111.231.140.29:10000/'

driver = webdriver.Chrome("chromedriver.exe")
driver.get(url)

start_input = driver.find_element_by_name('token') #獲取輸入框
start_button = driver.find_element_by_tag_name('button') #獲取點擊按鈕

start_input.send_keys('your token') #輸入你的token
start_button.click()

def calc(value):
    answer = eval(str(value))
    submit = driver.find_element_by_tag_name('button')
    value_input = driver.find_element_by_name('answer')
    value_input.send_keys(str(answer))
    submit.click()

for i in range(0,30):
    if i <10:
        value = driver.find_element_by_class_name('question-container').text.split('=')[0]
        calc(value)
    if i >= 10 and i < 20:
        cal = driver.find_element_by_class_name('question-container').text.split('=')[0]
        intab = "1234567890"
        outtab = "0269435871"
        trantab = str.maketrans(intab, outtab)
        cal = cal.translate(trantab)
        """
            這裡是開始不知道有翻譯表這個方法的時候想的方法，畢竟也想了那麼久。。。記錄一下
        """
        #    key_values = {
        #   '1':'0',
        #   '2':'2',
        #   '3':'6',
        #   '4':'9',
        #   '5':'4',
        #   '6':'3',
        #   '7':'5',
        #   '8':'8',
        #   '9':'7',
        #   '0':'1',
        # }
        # for j in range(len(cal)):
        #   if key_values.__contains__(cal[j]):
        #       cal = cal[:j] + key_values[cal[j]] + cal[j+1:]
        #   else:
        #       cal = cal[:j] + cal[j] + cal[j+1:]
        calc(cal)
    if i >= 20:
        # 這裡使用js獲取偽元素的content的值
        js = "var h3 = document.querySelector('.question-container');var result= getComputedStyle(h3, '::after').content;return result;"
        result = driver.execute_script(js)
        result = result.replace("=?", "")
        result = result.replace(""", "")
        calc(result)

# requests方法
import requests
import re

url = 'http://111.231.140.29:10000/'
data = {'token' : 'your token'} #輸入你的token

# 這道題目如果你用requests的話，再後面二十題要加請求頭，不然會被強制關機！。。。。。，應該是有個請求頭檢測
headers = {'Content-Type': 'application/x-www-form-urlencoded', 'User-Agent' : 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3578.98 Safari/537.36' ,'Referer': 'http://111.231.140.29:10000/question'}

def get_cookie(req):
    Session = req.headers['Set-Cookie'].split(';')[0]
    return Session

def calc(formula):
    result = eval(str(formula))
    return result

def get_formula_(req,i):
    print("正在計算第%s題..."%str(i))
    template = re.compile('<div class="question-container"><span>(.*?)=?</span></div>',re.S)
    formula = template.findall(req.text)[0]
    print(formula)
    return formula

def tran(formula):
    intab = "1234567890"
    outtab = "0269435871"
    trantab = str.maketrans(intab, outtab)
    formula = formula.translate(trantab)
    return formula

def get_css_formula(css):
    template = re.compile('content:"(.*?)=?";',re.S)
    formula = template.findall(css)[0]
    # print(formula)
    return formula

req = requests.req = requests.post(url, data=data, headers=headers) #第一次請求

req = requests.get(
    url,
    headers={'Cookie':get_cookie(req)}
)
# print(req.text)

for i in range(1,31):
    url = 'http://111.231.140.29:10000/solution'
    formula = get_formula_(req, i)
    if i <= 10:
        Session = get_cookie(req)
        # print(result)
    # print(req.text)
    if  20 >= i > 10:
        formula = tran(formula)
        Session = get_cookie(req)
    if i > 20:
        # 這裡要重新獲取session不然請求的是20題的css得不到content
        Session = get_cookie(req)
        css = requests.get(
            'http://111.231.140.29:10000/statics/style.css',
            headers={'Content-Type': 'application/x-www-form-urlencoded', 'Cookie': Session,
                     'User-Agent': 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3578.98 Safari/537.36',
                     'Referer': 'http://111.231.140.29:10000/question'}
        ).text
        formula = get_css_formula(css)

    result = calc(formula)
    req = requests.post(
        'http://111.231.140.29:10000/solution', data={'answer': result},
        headers={
            'Content-Type': 'application/x-www-form-urlencoded', 'Cookie': Session,
            'User-Agent': 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3578.98 Safari/537.36',
            'Referer': 'http://111.231.140.29:10000/question'}
    )
    if 'hgame'in req.text:
        print(req.text)