Web1#
Check-in question
View source
Get qweasdrtyfgh.php
Web2#
index is a hyperlink go to test.php, after entering, there is a file inclusion at a glance
Read the source code of index and test, nothing found, cannot bypass strpos
But data stream is available, indicating that allow_url_fopen and allow_url_include are enabled
Directly execute system arbitrary command and write files, found that the current directory is not writable, also checked ls and found no other shells, write to tmp and combine with file inclusion to get shell
Got the second blood for this question, hahaha
Web3#
Analyze the question, this question has the following limitations
1. phone must be an array
2. avatar cannot contain the word "flag" in the post parameters
3. string cannot contain any "root" or other words
So, bypass the first limitation by using an array in the post, and then use __destruct to unserialize the chain with parameters. Use an escaped serialized string for the name in the chain to bypass the second limitation. The third limitation only affects the post, the avatar in the post is not related to the solution and does not affect the avatar in the chain.
Payload:
name=O:9:"user_info":3:{s:4:"name";s:126:"rootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootroot";s:5:"phone";a:2:{i:0;i:1;i:1;i:1;}s:6:"avatar";s:5:"/flag";}&phone[]=1&avatar=123
Two hundred points for this question. Got the first blood and got ten extra points! The only team that solved it!
Misc1#
It's an image, not LSB, no need to change weight
Change it to .rar by right-clicking to get the unencrypted compressed file rsa.txt
Change it to .zip by right-clicking to get an encrypted compressed file, inside is flag.txt, not pseudo-encrypted
Damn, I don't know how to encrypt. Asked gpt and solved it instantly
Misc2#
Check-in question. Scan the QR code in the compressed file to get the flag instantly
Crypto1#
Check-in question.
PWN#
Taught by other experts. I can't learn it either
Main inputs two truncated values and enters get_data
The length here is custom and can be -1
When entering token calculation, it XORs with 48 ('0'), if my name is 0, at this time the string will become empty
When assigning later, because len returns -1, it will be assigned infinitely, v7 can cover file on top of file
Calculate the stack offset and overwrite the flag in s to file, then open flag and output
Payload
Input 0:0:
This article is synchronized and updated to xLog by Mix Space
The original link is https://de3ay.com/posts/sec/maoming-ctf-writeup