[BSidesCF 2020]Hurdles

我们打开页面，发现页面提示

image-20240910194058802

我们访问/hurdles

image-20240910194129958

提示我们使用PUT方法

1
curl -X PUT http://node5.buuoj.cn:27128/hurdles

image-20240910195905317

接下来提示url末尾为!

1
curl -X PUT http://node5.buuoj.cn:27128/hurdles/!

image-20240910200041269

提示url要get flag

1
curl -X PUT 'http://node5.buuoj.cn:27128/hurdles/!?get=flag'

需要将请求链接以‘单引号包裹，访问后得到结果：

image-20240910200254190

需要传参的名为&=&=&，首先将其进行url编码，得到：%26%3D%26%3D%26，构造传参

1
curl -X PUT 'http://node5.buuoj.cn:27128/hurdles/!?get=flag&%26%3D%26%3D%26=1'

image-20240910200422210

提示&=&=&与%00(换行符)相等，其后还包含了一个换行符，也是进行URL编码：%2500%0a，构造传参：

1
curl -X PUT 'http://node5.buuoj.cn:27128/hurdles/!?get=flag&%26%3D%26%3D%26=%2500%0a'

image-20240910200638841

提示我们需要传username为player

1
curl -X PUT 'http://node5.buuoj.cn:27128/hurdles/!?get=flag&%26%3D%26%3D%26=%2500%0a' -u 'player:player'

image-20240910200748531

接着提示密码为open sesame的十六进制MD5值：54ef36ec71201fdf9d1423fd26f97f6b

1
curl -X PUT 'http://node5.buuoj.cn:27128/hurdles/!?get=flag&%26%3D%26%3D%26=%2500%0a' -u 'player:54ef36ec71201fdf9d1423fd26f97f6b'

image-20240910201111243

提示使用1337浏览器

1
2
curl -X PUT 'http://node5.buuoj.cn:27128/hurdles/!?get=flag&%26%3D%26%3D%26=%2500%0a' -u 'player:54ef36ec71201fdf9d1423fd26f97f6b'
-A'1337 Browser'

image-20240910201229721

提示浏览器版本为9000

1
2
curl -X PUT 'http://node5.buuoj.cn:27128/hurdles/!?get=flag&%26%3D%26%3D%26=%2500%0a' -u 'player:54ef36ec71201fdf9d1423fd26f97f6b'
-A'1337 Browser v.9000'

image-20240910201319602

期待有人将这个转发给我，提示给出了Forwarded-For，猜测为修改X-Forwared-For为127.0.0.1，使用-H参数添加HTTP请求头X-Forwarded-For:127.0.0.1

1
2
curl -X PUT 'http://node5.buuoj.cn:27128/hurdles/!?get=flag&%26%3D%26%3D%26=%2500%0a' -u 'player:54ef36ec71201fdf9d1423fd26f97f6b'
-A'1337 Browser v.9000' -H 'X-Forwarded-For:127.0.0.1'

image-20240910201408865

提示使用别的代理

1
2
3
curl -X PUT 'http://node5.buuoj.cn:27128/hurdles/!?get=flag&%26%3D%26%3D%26=%2500%0a' -u 'player:54ef36ec71201fdf9d1423fd26f97f6b'
-A'1337 Browser v.9000' -H 'X-Forwarded-For:1.1.1.1,127.0.0.1'

image-20240910201608610

提示使用代理13.37.13.37

1
2
curl -X PUT 'http://node5.buuoj.cn:27128/hurdles/!?get=flag&%26%3D%26%3D%26=%2500%0a' -u 'player:54ef36ec71201fdf9d1423fd26f97f6b'
-A'1337 Browser v.9000' -H 'X-Forwarded-For:13.37.13.37,127.0.0.1'

image-20240910201711307

提示使用cookie Fortune

1
2
curl -X PUT 'http://node5.buuoj.cn:27128/hurdles/!?get=flag&%26%3D%26%3D%26=%2500%0a' -u 'player:54ef36ec71201fdf9d1423fd26f97f6b'
-A'1337 Browser v.9000' -H 'X-Forwarded-For:13.37.13.37,127.0.0.1' -b 'Fortune=1'

image-20240910201824749

需要Cookie中包含2011年的RFC编号，通过查阅资料：Datatracker

了解到2011版的RFC协议的值为6265，构造传参：

1
2
curl -X PUT 'http://node5.buuoj.cn:27128/hurdles/!?get=flag&%26%3D%26%3D%26=%2500%0a' -u 'player:54ef36ec71201fdf9d1423fd26f97f6b'
-A'1337 Browser v.9000' -H 'X-Forwarded-For:13.37.13.37,127.0.0.1' -b 'Fortune=6265'

image-20240910201909117

提示只接受text形式

1
2
curl -X PUT 'http://node5.buuoj.cn:27128/hurdles/!?get=flag&%26%3D%26%3D%26=%2500%0a' -u 'player:54ef36ec71201fdf9d1423fd26f97f6b'
-A'1337 Browser v.9000' -H 'X-Forwarded-For:13.37.13.37,127.0.0.1' -b 'Fortune=6265' -H 'Accept:text/plain'

image-20240910202015924

提示了一串俄语

在这里插入图片描述

我们修改语言为ru

1
2
curl -X PUT 'http://node5.buuoj.cn:27128/hurdles/!?get=flag&%26%3D%26%3D%26=%2500%0a' -u 'player:54ef36ec71201fdf9d1423fd26f97f6b'
-A'1337 Browser v.9000' -H 'X-Forwarded-For:13.37.13.37,127.0.0.1' -b 'Fortune=6265' -H 'Accept:text/plain' -H'Accept-Language:ru'

image-20240910202132163

提示请求来自https://ctf.bsidessf.net，尝试添加了请求头Referer属性，但始终未能成功进入下一个，发现是origin:https://ctf.bsidessf.net

1
2
curl -X PUT 'http://node5.buuoj.cn:27128/hurdles/!?get=flag&%26%3D%26%3D%26=%2500%0a' -u 'player:54ef36ec71201fdf9d1423fd26f97f6b'
-A'1337 Browser v.9000' -H 'X-Forwarded-For:13.37.13.37,127.0.0.1' -b 'Fortune=6265' -H 'Accept:text/plain' -H'Accept-Language:ru' -H'Origin:https://ctf.bsidessf.net'

image-20240910202241678

提示请求来自https://ctf.bsidessf.net/challenges，尝试添加了请求头Referer:https://ctf.bsidessf.net/challenges

1
2
curl -X PUT 'http://node5.buuoj.cn:27128/hurdles/!?get=flag&%26%3D%26%3D%26=%2500%0a' -u 'player:54ef36ec71201fdf9d1423fd26f97f6b'
-A'1337 Browser v.9000' -H 'X-Forwarded-For:13.37.13.37,127.0.0.1' -b 'Fortune=6265' -H 'Accept:text/plain' -H'Accept-Language:ru' -H'Origin:https://ctf.bsidessf.net' -H'Referer:https://ctf.bsidessf.net/challenges'

image-20240910202337106

然后就没了，也没看见flag，我们猜测flag在头信息中

1
x 1curl -X PUT 'http://node5.buuoj.cn:27128/hurdles/!?get=flag&%26%3D%26%3D%26=%2500%0a' -u 'player:54ef36ec71201fdf9d1423fd26f97f6b'2-A'1337 Browser v.9000' -H 'X-Forwarded-For:13.37.13.37,127.0.0.1' -b 'Fortune=6265' -H 'Accept:text/plain' -H'Accept-Language:ru' -H'Origin:https://ctf.bsidessf.net' -H'Referer:https://ctf.bsidessf.net/challenges' -i

image-20240910202416464

关于curl看这个：https://blog.csdn.net/deliciousion/article/details/78062521