Training:Get Sourced
查看頁面源代碼
最下邊
image.png
答案：html_sourcecode
Training:Stegano
圖片用winhex打開就有
image.png
Training:WWW-Robots
http://www.wechall.net/robots.txt
圖片.png
http://www.wechall.net/challenge/training/www/robots/T0PS3CR3T/
Training:ASCII
ASCII碼轉(zhuǎn)字符即可
Traing:URL
解碼得到一串URL肆糕，訪問即可
Training: Crypto - Caesar
凱撒密碼解密，每一次刷新后的密文都不一樣，所以答案也不同
圖片.png
答案應(yīng)該是劃掉的部分
java代碼
public class ceaser {
public static void main(String args[]){
String string="FTQ CGUOW NDAIZ RAJ VGYBE AHQD FTQ XMLK PAS AR OMQEMD MZP KAGD GZUCGQ EAXGFUAZ UE EDUNDTMNOAEU";
int length=string.length();
for(int i=0;i<26;i++){
StringBuilder ss=new StringBuilder("");
for(int j=0;j<length;j++){
char c=string.charAt(j);
if(c==' '){
ss.append(c);
}
else{
c=(char)(c+i);
if(c>'Z'){
c=(char)(c-26);
ss.append(c);
}
else ss.append(c);
}
}
System.out.println(ss);
}
}
}
Training: Encodings
題目給了一串二進(jìn)制瘪校，用工具JPK塔嬉，有一個(gè)Binary（二進(jìn)制）模塊独榴，設(shè)置寬度位7位贮尉，在選擇Binary中的Binary format選項(xiàng)，生成7位二進(jìn)制格式赞辩，再選擇Binary 中的 Binary to ASC II 生成ASC碼
圖片.png
圖片.png
Training: Crypto - Transposition I
替換密碼雌芽，把一串密文，寫成矩陣的形式诗宣，然后再打亂列的順序膘怕，即得到密文
因此，只需要把密文寫成矩陣召庞，根據(jù)列之間的規(guī)律關(guān)系岛心，恢復(fù)原順序即可
http://tholman.com/other/transposition/
當(dāng)列位數(shù)為2時(shí)，可以得到
Wonderful.You can ······ now：elsnaiellggc
Training:PHP LFI
LFI(local file include)篮灼，php的本地文件包含漏洞
題目要求是訪問../solution.php忘古，
圖片.png
分析代碼，后面有一個(gè) '.html' 诅诱，使用%00截?cái)啵?file=../solution.php%00提交髓堪，不對，再向上一級提交娘荡，file=../../solution.php%00干旁，通過。
Training:PHP 0817
圖片.png
看代碼邏輯炮沐，賦值給which提交争群，并且代碼后面有.php,因此只把solution賦值給which即可。
?which=solution提交通過大年。
Training:Crypto-Substitution
密文：
圖片.png
猜測CTFQ=THE,用https://quipqiup.com/解密
圖片.png
Training: Programming 1:
腳本：
import requests
url= 'http://www.wechall.net/challenge/training/programming1/index.php?action=request'
cookie = dict(WC = '************************')
re = requests.get(url, cookies = cookie)
key = re.text
url2 = 'http://www.wechall.net/challenge/training/programming1/index.php?answer='
a = requests.get(url2 + key, cookies = cookie)
wechall.net的cookie
Training: MYSQL I
看題目給的源碼
<?php
/* TABLE STRUCTURE
CREATE TABLE IF NOT EXISTS users (
userid INT(11) UNSIGNED AUTO_INCREMENT PRIMARY KEY,
username VARCHAR(32) CHARACTER SET utf8 COLLATE utf8_general_ci NOT NULL,
password CHAR(32) CHARACTER SET ascii COLLATE ascii_bin NOT NULL
) ENGINE=myISAM;
*/
# Username and Password sent?
if ( ('' !== ($username = Common::getPostString('username'))) && (false !== ($password = Common::getPostString('password', false))) ) {
auth1_onLogin($chall, $username, $password);
}
/**
* Get the database for this challenge.
* @return GDO_Database
*/
function auth1_db()
{
if (false === ($db = gdo_db_instance('localhost', WCC_AUTH_BYPASS1_USER, WCC_AUTH_BYPASS1_PASS, WCC_AUTH_BYPASS1_DB))) {
die('Database error 0815_1!');
}
$db->setLogging(false);
$db->setEMailOnError(false);
return $db;
}
/**
* Exploit this!
* @param WC_Challenge $chall
* @param unknown_type $username
* @param unknown_type $password
* @return boolean
*/
function auth1_onLogin(WC_Challenge $chall, $username, $password)
{
$db = auth1_db();
$password = md5($password);
$query = "SELECT * FROM users WHERE username='$username' AND password='$password'";
if (false === ($result = $db->queryFirst($query))) {
echo GWF_HTML::error('Auth1', $chall->lang('err_unknown'), false); # Unknown user
return false;
}
# Welcome back!
echo GWF_HTML::message('Auth1', $chall->lang('msg_welcome_back', htmlspecialchars($result['username'])), false);
# Challenge solved?
if (strtolower($result['username']) === 'admin') {
$chall->onChallengeSolved(GWF_Session::getUserID());
}
return true;
}
?>
<form action="index.php" method="post">
<table>
<tr>
<td><?php echo $chall->lang('username'); ?>:</td>
<td><input type="text" name="username" value="" /></td>
</tr>
<tr>
<td><?php echo $chall->lang('password'); ?>:</td>
<td><input type="password" name="password" value="" /></td>
</tr>
<tr>
<td></td>
<td><input type="submit" name="login" value="<?php echo $chall->lang('btn_login'); ?>" /></td>
</tr>
</table>
</form>
admin 'or'1=1
Training: MYSQL II
源碼：
<?php
/* TABLE STRUCTURE
CREATE TABLE IF NOT EXISTS users (
userid INT(11) UNSIGNED AUTO_INCREMENT PRIMARY KEY,
username VARCHAR(32) CHARACTER SET utf8 COLLATE utf8_general_ci NOT NULL,
password CHAR(32) CHARACTER SET ascii COLLATE ascii_bin NOT NULL
) ENGINE=myISAM;
*/
# Username and Password sent?
if ( ('' !== ($username = Common::getPostString('username'))) && (false !== ($password = Common::getPostString('password', false))) ) {
auth2_onLogin($chall, $username, $password);
}
/**
* Get the database for this challenge.
* @return GDO_Database
*/
function auth2_db()
{
if (false === ($db = gdo_db_instance('localhost', WCC_AUTH_BYPASS2_USER, WCC_AUTH_BYPASS2_PASS, WCC_AUTH_BYPASS2_DB))) {
die('Database error 0815_2!');
}
$db->setLogging(false);
$db->setEMailOnError(false);
return $db;
}
/**
* Exploit this! It is the same as MySQL-I, but with an additional check, marked with ###
* @param WC_Challenge $chall
* @param unknown_type $username
* @param unknown_type $password
* @return boolean
*/
function auth2_onLogin(WC_Challenge $chall, $username, $password)
{
$db = auth2_db();
$password = md5($password);
$query = "SELECT * FROM users WHERE username='$username'";
if (false === ($result = $db->queryFirst($query))) {
echo GWF_HTML::error('Auth2', $chall->lang('err_unknown'), false);
return false;
}
#############################
### This is the new check ###
if ($result['password'] !== $password) {
echo GWF_HTML::error('Auth2', $chall->lang('err_password'), false);
return false;
} # End of the new code ###
#############################
echo GWF_HTML::message('Auth2', $chall->lang('msg_welcome_back', array(htmlspecialchars($result['username']))), false);
if (strtolower($result['username']) === 'admin') {
$chall->onChallengeSolved(GWF_Session::getUserID());
}
return true;
}
?>
<form action="index.php" method="post">
<table>
<tr>
<td><?php echo $chall->lang('username'); ?>:</td>
<td><input type="text" name="username" value="" /></td>
</tr>
<tr>
<td><?php echo $chall->lang('password'); ?>:</td>
<td><input type="password" name="password" value="" /></td>
</tr>
<tr>
<td></td>
<td><input type="submit" name="login" value="<?php echo $chall->lang('btn_login'); ?>" /></td>
</tr>
</table>
</form>
空著吧先换薄，改天再補(bǔ)
Training:LSB
給了一張圖
圖片.png
stegsolve
圖片.png
Training: Register Globals
看源碼:
[chdir](http://www.php.net/chdir)('../../../../');
[define](http://www.php.net/define)('GWF_PAGE_TITLE', 'Training: Register Globals');
require_once('challenge/html_head.php');
if (false === ($chall = WC_Challenge::getByTitle(GWF_PAGE_TITLE))) { $chall = WC_Challenge::dummyChallenge(GWF_PAGE_TITLE, 2, 'challenge/training/php/globals/index.php');
}
$chall->showHeader();
GWF_Debug::setDieOnError(false);GWF_Debug::setMailOnError(false);
# EMULATE REGISTER GLOBALS = ON
foreach ($_GET as $k => $v) { $k = $v; }
# Send request?
if ([isset](http://www.php.net/isset)($_POST['password']) && [isset](http://www.php.net/isset)($_POST['username']) && [is_string](http://www.php.net/is_string)($_POST['password']) && [is_string](http://www.php.net/is_string)($_POST['username']) )
{
$uname = GDO::escape($_POST['username']); $pass = [md5](http://www.php.net/md5)($_POST['password']);
$query = "SELECT level FROM ".GWF_TABLE_PREFIX."wc_chall_reg_glob WHERE username='$uname' AND password='$pass'";
$db = gdo_db();
if (false === ($row = $db->queryFirst($query))) {
echo GWF_HTML::error('Register Globals', $chall->lang('err_failed')); } else {
# Login success
$login = [array](http://www.php.net/array)($_POST['username'], (int)$row['level']);
}
}
if ([isset](http://www.php.net/isset)($login))
{
echo GWF_HTML::message('Register Globals', $chall->lang('msg_welcome_back', [array](http://www.php.net/array)([htmlspecialchars](http://www.php.net/htmlspecialchars)($login[0]), [htmlspecialchars](http://www.php.net/htmlspecialchars)($login[1]))));
if ([strtolower](http://www.php.net/strtolower)($login[0]) === 'admin') { $chall->onChallengeSolved(GWF_Session::getUserID());
}
}
else
{?>
<form action="globals.php" method="post">
<table>
<tr>
<td><?php echo $chall->lang('th_username'); ?>:</td> <td><input type="text" name="username" value="" /></td>
</tr>
<tr>
<td><?php echo $chall->lang('th_password'); ?>:</td>
<td><input type="password" name="password" value="" /></td></tr>
<tr>
<td></td>
<td><input type="submit" name="send" value="<?php echo $chall->lang('btn_send'); ?>" /></td>
</tr></table>
</form>
<?php
}
# EMULATE REGISTER GLOBALS = OFF
foreach ($_GET as $k => $v) { [unset](http://www.php.net/unset)($k); }
require_once 'challenge/html_foot.php';
?></pre>
明顯要求login[0]=admin,登陸即可
Host me
源碼
<?php
$challenge = function()
{
return $_SERVER['HTTP_HOST'] === 'localhost';}
?>
本來以為改成host:localhost，嘗試不對翔试，看別人的wp
題目提示：
Fun Fact: There is even a virtualhost named localhost, which probably does not make it easier.
It seems like we need to reinstall the box, unless you can access this page with the correct constraints.
意思是還有一臺名localhost的虛擬機(jī)轻要，
訪問主機(jī)與虛擬host存在相同路徑，,而頭部是自省略的寫法垦缅，所以會因無法識別主機(jī)host而導(dǎo)致冲泥，
在修改host為localhost的前提下，需要補(bǔ)全路徑壁涎，加上http協(xié)議即可
圖片.png
