Wechall部分Web WriteUp

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14

<?php
final class SERIAL_Solution
{
        public $username = '';
        public $password = '';
        public $userlevel = 0;
}
$a = new SERIAL_Solution();
$a->username='admin';
$a->password='testtest';
$a->userlevel=100;

echo serialize($a);
?>

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12

foreach ($_GET as $key => $value)
{
        if ($key === 'src') {
                php0816SetSourceFile($value);
        }
        elseif ($key === 'mode') {
                php0816execute($value);
        }
        elseif ($key === 'hl') {
                php0816addHighlights($value);
        }
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23

function upload_please_by_url($url)
{
        if (1 === preg_match('#^[a-z]{3,5}://#', $url)) # Is URL?
        {
                $ch = curl_init($url);
                curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
                curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
                curl_setopt($ch, CURLOPT_FAILONERROR, true);
                if (false === ($file_data = curl_exec($ch)))
                {
                        htmlDisplayError('cURL failed.');
                }
                else
                {
                        // Thanks
                        upload_please_thx($file_data);
                }
        }
        else
        {
                htmlDisplayError('Your URL looks errorneous.');
        }
}

1
2
3
4
5
6
7
8
9

$query = "UPDATE noescvotes SET `$who`=`$who`+1 WHERE id=1";

...

if ($count == 111) {
                        noesc_solved();
                        noesc_resetVotes();
                        break;
                }

1

echo sprintf('<form action="%s" method="post">', $_SERVER['PHP_SELF']).PHP_EOL;

1

'ignore_user_abort' => false

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37

if (noother_timeout($sid) === false)
        {
                nooth_message('Checking your balance ...');
                nooth_message(sprintf('Your balance is $%.02f ...', noothtable::getMoney($sid)));
                if (noothtable::getMoney($sid) >= $price)
                {
                        nooth_message('Balance ok!');

                        # TODO: Do checks more checks!
                        nooth_message('Checking availability of your domain ...');
                        nooth_message('Domain is available ...');

                        # +1 domain
                        if (false === noothtable::purchaseDomain($sid))
                        {
                                die('Hacking attempt!');
                        }
                        nooth_message('Purchasing ...');
                        nooth_message('Domain purchased.');

                        # -$10.00
                        nooth_message('Reducing your balance ...');
                        noothtable::reduceMoney($sid, $price);
                        nooth_message('Thank you for your purchase!');

                        # Done!
                        nooth_message('Purchased!');

                        # Something weird? Oo
                        if (noothtable::getFundings($sid) < noothtable::getDomains($sid))
                        {
                                GWF_Module::loadModuleDB('Forum', true, true);
                                # Get here, hacker!
                                $chall->onChallengeSolved(GWF_Session::getUserID());
                        }
                        nooth_message('Thank you for using noother-domains.com!');
                }

1
2
3
4

$str = <<<s
1337
s;
echo $str //1337

1

"gbu_password  VARCHAR(255) CHARACTER SET ASCII COLLATE ascii_bin ) "; # Guestbook password <-- You need the password for username Admin

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22

function gbook_getIP()
{
        if (isset($_SERVER['HTTP_X_FORWARDED_FOR'])) {
                return $_SERVER['HTTP_X_FORWARDED_FOR'];
        }
        elseif (isset($_SERVER['HTTP_VIA'])) {
                return $_SERVER['HTTP_VIA'];
        }
        else {
                return $_SERVER['REMOTE_ADDR'];
        }
}

...

# insert the entry
$playerid = gbook_playerID(true); // Current Player
$userid = 0; # guestbook has no login yet.
$time = time();
$ip = gbook_getIP();
$message = GDO::escape($message);
$query = "INSERT INTO gbook_book VALUES('$playerid', $userid, $time, '$ip', '$message')";

1
2
3
4
5
6

$username = addslashes($username);
        $password = md5($password);

        if (false === ($db = gdo_db_instance('localhost', ADDSLASH_USERNAME, ADDSLASH_PASSWORD, ADDSLASH_DATABASE, GWF_DB_TYPE, 'GBK'))) {
                return htmlDisplayError('Can`t connect to database.');
        }

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34

<?php
require '../config.php';
$username = isset($_GET['username']) ? (string)$_GET['username'] : 'Guest';
?>
<!DOCTYPE html>
<html>
<head>
<title>Live RCE [Warchall]</title>
<style type="text/css">
* {
margin: 0;
padding: 0;
}
body {
background: #000;
color: #0f0;
padding: 24px;
}
p {
padding: 12px 0;
}
</style>
</head>
<body>
<h1>Live RCE!</h1>
<p>Hello <?php echo $username; ?>!</p>
<p>Here are your $_SERVER vars:</p>
<pre>
<?php print_r($_SERVER); ?>
</pre>
<p>Kind Regards<br/>The Warchall staff!</p>
<!-- We hope you like our signatures :) -->
</body>
</html>