Web1#
Check-in question
View the source code
Get qweasdrtyfgh.php
Web2#
index is a hyperlink that says go to test.php. After going in, there is a file inclusion at first glance.
I read the source code of index and test, but didn't find anything. Can't bypass strpos.
But data stream is available, indicating that allow_url_fopen and allow_url_include are enabled.
Directly executing system arbitrary commands and writing files, I found that the current directory is not writable. I also checked ls and didn't find any other shells. Write to tmp and combine with file inclusion to get shell.
I got second blood for this question hahaha.
Web3#
Analyze the question, this question has the following restrictions:
1. phone must be an array
2. avatar cannot contain the word "flag" in the post parameters
3. string cannot contain any "root" or other words
So, bypass the first restriction in the post array, and then use __destruct to unserialize the chain and pass the parameters. The name in the chain uses an unserialized string to escape the second restriction. The third restriction only affects the post, the post's avatar is not related to the solution, and does not affect the avatar in the chain.
Payload:
name=O:9:"user_info":3:{s:4:"name";s:126:"rootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootroot";s:5:"phone";a:2:{i:0;i:1;i:1;i:1;}s:6:"avatar";s:5:"/flag";}&phone[]=1&avatar=123
A two hundred point question. I got first blood and got ten points! The only team that solved it!
Misc1#
It's an image, not LSB, no need to change weight.
Change it to .rar by right-clicking to get the unencrypted compressed file rsa.txt.
Change it to .zip by right-clicking to get an encrypted compressed file with flag.txt inside, it's not pseudo-encrypted.
Damn it, I don't know how to encrypt. I'll ask gpt.
Misc2#
Check-in question. Scan the QR code in the compressed file to get the flag.
Crypto1#
Check-in question.
PWN#
Taught by other experts. I can't learn it either.
Main inputs two truncated values and enters get_data.
The length here is custom and can be -1.
Entering the token calculation will XOR with 48 ('0'), if my name is 0, at this time the string will become empty.
When assigning a value later, because len returns -1, it will be assigned infinitely, and v7 can cover file on top of file.
Calculate the stack offset and just overwrite the flag in s to file, then open flag and output.
Payload:
Input 0:0:
This article is synchronized and updated to xLog by Mix Space
The original link is https://de3ay.com/posts/sec/maoming-ctf-writeup