HCTF 2015 Write-ups

?=PHPE9568F36-D428-11d2-A769-00AA001ACF42
?=PHPE9568F34-D428-11d2-A769-00AA001ACF42
?=PHPE9568F35-D428-11d2-A769-00AA001ACF42
?=PHPB8B5F2A0-3C92-11d3-A3A9-4C7B08C10000

ISG CTF 2014 Write-up (SQLMAP, Up-to-Date)

2014-09-29

SQLMAP

题目很简单，就给了一个数据包：

数据包下载：sqlmap

从数据包看，http://10.0.0.201/message.php?id=``？存在注入点，利用sqlmap进行拖库。前段时间刚好分析过sqlmap`拖库过程，还算比较熟悉。

ISG CTF 2014 Write-up (Out of Space, X-Area)

2014-09-29

Out of Space

这个程序不能直接运行，我队友试了，直接死机。看了看是用C#写的，直接用.NET Reflector反编译，源码如下：

public static void Main()
{
    Console.WriteLine("Generating data...");
    StreamWriter writer = new StreamWriter("temp.txt");
    ulong num = 1L;
    do
    {
        writer.Write("ISG");
        num += (ulong) 1L;
    }
    while (num <= 0xfa00000000L);
    writer.Close();
    Console.WriteLine("Almost done...");
    SHA1CryptoServiceProvider provider = new SHA1CryptoServiceProvider();
    FileStream inputStream = new FileStream("temp.txt", FileMode.Open, FileAccess.Read);
    byte[] buffer = provider.ComputeHash(inputStream);
    inputStream.Close();
    File.Delete("temp.txt");
    Console.WriteLine("ISG{" + BitConverter.ToString(buffer).ToLower() + "}");
    Console.ReadKey();
}

ISG CTF 2014 Write-up (Smile, Chopper, Cryptobaby, GIF)

2014-09-29

Smile

点击界面上的链接http://202.120.7.104:8888/?view-source即可看到界面源码，其中php部分如下：

<?php  
    if (isset($_GET['view-source'])) { 
        show_source(__FILE__); 
        exit(); 
    } 
    include('flag.php'); 
    $smile = 1;  
    if (!isset ($_GET['^_^'])) $smile = 0;  
    if (ereg ('\.', $_GET['^_^'])) $smile = 0;  
    if (ereg ('%', $_GET['^_^'])) $smile = 0;  
    if (ereg ('[0-9]', $_GET['^_^'])) $smile = 0;  
    if (ereg ('http', $_GET['^_^']) ) $smile = 0;  
    if (ereg ('https', $_GET['^_^']) ) $smile = 0;  
    if (ereg ('ftp', $_GET['^_^'])) $smile = 0;  
    if (ereg ('telnet', $_GET['^_^'])) $smile = 0;  
    if (ereg ('_', $_SERVER['QUERY_STRING'])) $smile = 0;  
    if ($smile) { 
        if (@file_exists ($_GET['^_^'])) $smile = 0;  
    }  
    if ($smile) { 
        $smile = @file_get_contents ($_GET['^_^']);  
        if ($smile === "(●'◡'●)") die($flag);  
    }  
?>