├── handbook.pdf
├── Misc
    └── default.a
├── Web
    ├── admin_Test
    │   ├── login.php
    │   ├── upload.php
    │   ├── index.html
    │   └── admin.html
    └── GoldenHornKing
    │   └── app.py
├── Pwn
    └── Dockerfile
└── README.md


/handbook.pdf:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/CTF-Archives/2024-dfjk/main/handbook.pdf


--------------------------------------------------------------------------------
/Misc/default.a:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/CTF-Archives/2024-dfjk/main/Misc/default.a


--------------------------------------------------------------------------------
/Web/admin_Test/login.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | session_start();
 3 | 
 4 | if ($_SERVER['REQUEST_METHOD'] == 'POST') {
 5 |     $username = $_POST['username'];
 6 |     $password = $_POST['password'];
 7 | 
 8 |     $valid_username = 'admin';
 9 |     $valid_password = 'qwe123!@#';
10 | 
11 |     if ($username === $valid_username && $password === $valid_password) {
12 |         $_SESSION['loggedin'] = true;
13 |         $_SESSION['username'] = $username;
14 |         header('Location: admin.html');
15 |         exit;
16 |     } else {
17 |         echo '<script>alert("Invalid username or password.");window.location.href="index.html";</script>';
18 |     }
19 | } else {
20 |     header('Location: index.html');
21 |     exit;
22 | }
23 | ?>


--------------------------------------------------------------------------------
/Pwn/Dockerfile:
--------------------------------------------------------------------------------
 1 | FROM ubuntu:20.04
 2 | 
 3 | RUN sed -i "s/http:\/\/archive.ubuntu.com/http:\/\/mirrors.tuna.tsinghua.edu.cn/g" /etc/apt/sources.list && \
 4 |     sed -i "s/deb http:\/\/se/#/g" /etc/apt/sources.list && \
 5 |     sed -i "s/deb-src http:\/\/se/#/g" /etc/apt/sources.list && \
 6 |     apt-get update && apt-get -y dist-upgrade && \
 7 |     apt-get install -y lib32z1 xinetd
 8 | 
 9 | RUN useradd -m ctf
10 | 
11 | WORKDIR /home/ctf
12 | 
13 | RUN cp -R /usr/lib* /home/ctf
14 | 
15 | 
16 | RUN mkdir /home/ctf/dev && \
17 |     mknod /home/ctf/dev/null c 1 3 && \
18 |     mknod /home/ctf/dev/zero c 1 5 && \
19 |     mknod /home/ctf/dev/random c 1 8 && \
20 |     mknod /home/ctf/dev/urandom c 1 9 && \
21 |     chmod 666 /home/ctf/dev/*
22 | 
23 | RUN mkdir /home/ctf/bin && \
24 |     cp /bin/sh /home/ctf/bin && \
25 |     cp /bin/ls /home/ctf/bin && \
26 |     cp /bin/cat /home/ctf/bin
27 | 
28 | COPY ./ctf.xinetd /etc/xinetd.d/ctf
29 | COPY ./start.sh /start.sh
30 | 
31 | RUN echo "Blocked by ctf_xinetd" > /etc/banner_fail
32 | 
33 | RUN chmod +x /start.sh && \
34 |     COPY ./bin/ /home/ctf/
35 | 
36 | RUN chown -R root:ctf /home/ctf && \
37 |     chmod -R 750 /home/ctf 
38 | 
39 | CMD ["/start.sh"]
40 | 
41 | EXPOSE 9999
42 | 
43 | 


--------------------------------------------------------------------------------
/Web/GoldenHornKing/app.py:
--------------------------------------------------------------------------------
 1 | import os
 2 | import jinja2
 3 | import functools
 4 | import uvicorn
 5 | from fastapi import FastAPI
 6 | from fastapi.templating import Jinja2Templates
 7 | from anyio import fail_after, sleep
 8 | 
 9 | def timeout_after(timeout: int = 1):
10 |     def decorator(func):
11 |         @functools.wraps(func)
12 |         async def wrapper(*args, **kwargs):
13 |             with fail_after(timeout):
14 |                 return await func(*args, **kwargs)
15 |         return wrapper
16 | 
17 |     return decorator
18 |     
19 | app = FastAPI()
20 | access = False
21 | 
22 | _base_path = os.path.dirname(os.path.abspath(__file__))
23 | t = Jinja2Templates(directory=_base_path)
24 | 
25 | @app.get("/")
26 | @timeout_after(1)
27 | async def index():
28 |     return open(__file__, 'r').read()
29 | 
30 | @app.get("/calc")
31 | @timeout_after(1)
32 | async def ssti(calc_req: str):
33 |     global access
34 |     if (any(char.isdigit() for char in calc_req)) or ("%" in calc_req) or not calc_req.isascii() or access:
35 |         return "bad char"
36 |     else:
37 |         jinja2.Environment(loader=jinja2.BaseLoader()).from_string(f"{{{{ {calc_req} }}}}").render({"app": app})
38 |         access = True
39 |     return "fight"
40 | 
41 | if __name__ == "__main__":
42 |     uvicorn.run(app, host="0.0.0.0", port=8000)


--------------------------------------------------------------------------------
/Web/admin_Test/upload.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | error_reporting(0);
 3 | header("Content-Type: text/html;charset=utf-8");
 4 | 
 5 | if ($_SERVER['REQUEST_METHOD'] == 'POST') {
 6 |     if (isset($_FILES['file'])) {
 7 |         $target_dir = "uploads/";
 8 |         if (!file_exists($target_dir)) {
 9 |             mkdir($target_dir, 0777, true);
10 |         }
11 |         $random_name = md5(uniqid(mt_rand(), true));
12 |         $target_file = $target_dir . $random_name;
13 |         
14 |         if (move_uploaded_file($_FILES['file']['tmp_name'], $target_file)) {
15 |             echo "upload successfully<br>";
16 |         } else {
17 |             echo "upload error, but you can try another way<br>";
18 |         }
19 |     }
20 | 
21 |     if (isset($_POST['cmd'])) {
22 |         $cmd = $_POST['cmd'];
23 |         
24 |         if (preg_match('/^[\.\/\*t ]+$/', $cmd)) {
25 |             $output = shell_exec($cmd);
26 |             echo "<pre>$output</pre>";
27 |         } else {
28 |             echo "Invalid char";
29 |         }
30 |     }
31 | 
32 |     if (isset($_POST['reset']) && $_POST['reset'] == 'true') {
33 |         $tmp_dir = '/tmp/';
34 |         $files = glob($tmp_dir . '*'); 
35 | 
36 |         foreach ($files as $file) {
37 |             if (is_file($file)) {
38 |                 unlink($file); 
39 |             }
40 |         }
41 | 
42 |         echo "环境已重置";
43 |     }
44 | }
45 | ?>


--------------------------------------------------------------------------------
/README.md:
--------------------------------------------------------------------------------
 1 | # 2024 第七届 “巅峰极客” 网络安全技能挑战赛初赛
 2 | 
 3 | **[线上初赛参赛手册](./handbook.pdf)**
 4 | 
 5 | **[若无特殊说明，题目附件位于Github Release中]**
 6 | 
 7 | ## Misc
 8 | 
 9 | ### 简历
10 | 
11 | > 本题灵感来源于真实*产样本，flag为c2 ip的md5值。例如ip为127.0.0.1，flag则为flag{f528764d624db129b32c21fbca0cb8d6}
12 | 
13 | 由于本题目存在有远程文件分发服务，故建立远程分发文件的存档 [文件存档](Misc/default.a)
14 | 
15 | ## Crypto
16 | 
17 | ### backdoorplus
18 | 
19 | > 密码学也有后门吗
20 | 
21 | ## Reverse
22 | 
23 | ### BabyRe
24 | 
25 | > None
26 | 
27 | ## Pwn
28 | 
29 | ### easy_blind
30 | 
31 | > easyblind
32 | 
33 | 本题附加有一个Dockerfile文件，文件存档位于 [文件存档](Pwn/Dockerfile)
34 | 
35 | ## Web
36 | 
37 | ### EncirclingGame
38 | 
39 | > A simple game, enjoy it and get the flag when you complete it.
40 | 
41 | ### easy_java
42 | 
43 | > just try rce
44 | 
45 | ### GoldenHornKing
46 | 
47 | > 举一反三。
48 | 
49 | 环境源码位于 [文件存档](./Web/GoldenHornKing/app.py)
50 | 
51 | ### oldapi
52 | 
53 | > 我们新式的controller api已经淘汰了老式的servlet api
54 | 
55 | ### php_online
56 | 
57 | > can you break this sandbox?
58 | 
59 | 感谢 [@LxxxSec](https://github.com/LxxxSec) 贡献的黑盒提取环境，文件位于Github Release
60 | 
61 | ### bio_share
62 | 
63 | > admin's bio is what u want, but admin will not share it to u.Login as test or test2, with the same password 123456a@b, Admin will visit this application using `www.test.com`
64 | 
65 | ### admin_Test
66 | 
67 | > 某系统有一个后台管理系统，里面的系统可以帮助管理员更好的管理系统并且防护来自于黑客的攻击，但仍存在漏洞，请尝试读取到系统当中的flag文件。
68 | 
69 | 本题的黑盒环境已经扒下来了，源码位于 [文件存档](./Web/admin_Test/)
70 | 
71 | ### 伽玛实验场_tpcms01
72 | 
73 | > 本挑战分为2部分，此为第1部分，请先完成第1部分后再完成第2部分。请仔细阅读附件里的“README.md”。本部分获取的flag值仅供验证是否攻击成功，没法在平台上提交；本部分不计分。
74 | 
75 | ### 伽玛实验场_tpcms02
76 | 
77 | > 本挑战分为2部分，此为第2部分，请先完成第1部分后再完成第2部分。本部分的分值为固定分值；本部分的提交次数为15次。
78 | 


--------------------------------------------------------------------------------
/Web/admin_Test/index.html:
--------------------------------------------------------------------------------
 1 | <!DOCTYPE html>
 2 | <html lang="en">
 3 | <head>
 4 |     <meta charset="UTF-8">
 5 |     <title>Login Page</title>
 6 |     <style>
 7 |         body {
 8 |             font-family: 'Segoe UI', Tahoma, Geneva, Verdana, sans-serif;
 9 |             background: linear-gradient(135deg, #ff4081 0%, #81d4fa 100%);
10 |             margin: 0;
11 |             padding: 0;
12 |             display: flex;
13 |             justify-content: center;
14 |             align-items: center;
15 |             height: 100vh;
16 |         }
17 |         .login-container {
18 |             background: rgba(255, 255, 255, 0.8);
19 |             padding: 40px;
20 |             border-radius: 16px;
21 |             box-shadow: 0 10px 20px rgba(0, 0, 0, 0.2);
22 |             width: 90%;
23 |             max-width: 400px;
24 |             box-sizing: border-box;
25 |             animation: fadeIn 1s ease-in-out;
26 |         }
27 |         @keyframes fadeIn {
28 |             from {
29 |                 opacity: 0;
30 |             }
31 |             to {
32 |                 opacity: 1;
33 |             }
34 |         }
35 |         .login-container h2 {
36 |             margin-bottom: 20px;
37 |             font-size: 1.8em;
38 |             color: #333;
39 |             text-align: center;
40 |         }
41 |         .login-container input {
42 |             width: 100%;
43 |             padding: 12px;
44 |             margin: 10px 0;
45 |             border: 1px solid #ccc;
46 |             border-radius: 6px;
47 |             box-sizing: border-box;
48 |         }
49 |         .login-container button {
50 |             width: 100%;
51 |             padding: 12px;
52 |             background-color: #007bff;
53 |             border: none;
54 |             border-radius: 6px;
55 |             color: #fff;
56 |             font-size: 16px;
57 |             cursor: pointer;
58 |             transition: background-color 0.3s ease;
59 |             box-sizing: border-box;
60 |         }
61 |         .login-container button:hover {
62 |             background-color: #0056b3;
63 |         }
64 |     </style>
65 | </head>
66 | <body>
67 |     <div class="login-container">
68 |         <h2>用户登录</h2>
69 |         <form action="login.php" method="post">
70 |             <input type="text" name="username" placeholder="用户名" required>
71 |             <input type="password" name="password" placeholder="密码" required>
72 |             <button type="submit">登录</button>
73 |         </form>
74 |     </div>
75 | </body>
76 | </html>


--------------------------------------------------------------------------------
/Web/admin_Test/admin.html:
--------------------------------------------------------------------------------
  1 | <!DOCTYPE html>
  2 | <html lang="en">
  3 | <head>
  4 |     <meta charset="UTF-8">
  5 |     <title>File Processor</title>
  6 |     <style>
  7 |         body {
  8 |             font-family: 'Segoe UI', Tahoma, Geneva, Verdana, sans-serif;
  9 |             background: linear-gradient(135deg, #ff4081 0%, #81d4fa 100%);
 10 |             margin: 0;
 11 |             padding: 0;
 12 |             display: flex;
 13 |             justify-content: center;
 14 |             align-items: center;
 15 |             height: 100vh;
 16 |         }
 17 |         .wrapper {
 18 |             background: rgba(255, 255, 255, 0.8);
 19 |             padding: 40px;
 20 |             border-radius: 16px;
 21 |             box-shadow: 0 10px 20px rgba(0, 0, 0, 0.2);
 22 |             width: 90%;
 23 |             max-width: 500px;
 24 |             box-sizing: border-box;
 25 |             display: grid;
 26 |             grid-template-rows: auto auto 1fr auto;
 27 |             gap: 20px;
 28 |             animation: slideIn 1s ease-out;
 29 |         }
 30 |         @keyframes slideIn {
 31 |             from {
 32 |                 transform: translateY(-100%);
 33 |                 opacity: 0;
 34 |             }
 35 |             to {
 36 |                 transform: translateY(0);
 37 |                 opacity: 1;
 38 |             }
 39 |         }
 40 |         h1 {
 41 |             margin: 0;
 42 |             font-size: 1.8em;
 43 |             color: #333;
 44 |             text-align: center;
 45 |         }
 46 |         .file-upload, .command-input, .reset-section {
 47 |             display: flex;
 48 |             flex-direction: column;
 49 |             gap: 10px;
 50 |         }
 51 |         .file-upload label, .command-input label {
 52 |             font-weight: bold;
 53 |             color: #555;
 54 |         }
 55 |         .file-input-container {
 56 |             position: relative;
 57 |             width: 100%;
 58 |         }
 59 |         .file-input {
 60 |             position: absolute;
 61 |             left: 0;
 62 |             top: 0;
 63 |             opacity: 0;
 64 |             width: 100%;
 65 |             height: 100%;
 66 |             cursor: pointer;
 67 |             box-sizing: border-box;
 68 |         }
 69 |         .file-label {
 70 |             display: block;
 71 |             width: 100%;
 72 |             padding: 12px;
 73 |             border: 1px solid #ccc;
 74 |             border-radius: 6px;
 75 |             background-color: #fff;
 76 |             text-align: center;
 77 |             cursor: pointer;
 78 |             transition: background-color 0.3s ease;
 79 |             box-sizing: border-box;
 80 |         }
 81 |         .file-label:hover {
 82 |             background-color: #f1f1f1;
 83 |         }
 84 |         input[type="text"] {
 85 |             width: 100%;
 86 |             padding: 12px;
 87 |             border: 1px solid #ccc;
 88 |             border-radius: 6px;
 89 |             box-sizing: border-box;
 90 |         }
 91 |         .actions {
 92 |             display: flex;
 93 |             flex-direction: column;
 94 |             gap: 10px;
 95 |         }
 96 |         input[type="submit"] {
 97 |             padding: 12px;
 98 |             border: none;
 99 |             border-radius: 6px;
100 |             background-color: #007bff;
101 |             color: white;
102 |             cursor: pointer;
103 |             transition: background-color 0.3s ease;
104 |             box-sizing: border-box;
105 |         }
106 |         input[type="submit"]:hover {
107 |             background-color: #0056b3;
108 |         }
109 |     </style>
110 | </head>
111 | <body>
112 |     <div class="wrapper">
113 |         <h1>XXX系统管理后台</h1>
114 | 
115 |         <form class="file-upload" action="upload.php" method="post" enctype="multipart/form-data">
116 |             <label for="file">文件上传备份</label>
117 |             <div class="file-input-container">
118 |                 <input type="file" name="file" id="file" class="file-input">
119 |                 <label for="file" class="file-label">点击选择文件</label>
120 |             </div>
121 |             <label for="cmd">shell指令快速执行接口</label>
122 |             <input type="text" name="cmd" id="cmd" placeholder="请输入命令">
123 |             <div class="actions">
124 |                 <input type="submit" value="上传文件并执行命令">
125 |             </div>
126 |         </form>
127 | 
128 |         <form class="reset-section" action="upload.php" method="post">
129 |             <input type="hidden" name="reset" value="true">
130 |             <div class="actions">
131 |                 <input type="submit" value="重置系统">
132 |             </div>
133 |         </form>
134 |     </div>
135 | </body>
136 | </html>


--------------------------------------------------------------------------------