Skip to content

Latest commit

 

History

History
92 lines (87 loc) · 8.66 KB

README.md

File metadata and controls

92 lines (87 loc) · 8.66 KB
Raw
  1. Открываем дамп трафика Wireshark'ом, сходу находим
CREATE USER 'wgctf'@'%' IDENTIFIED WITH 'mysql_native_password' AS '*A9FB855F6310E5B0A3D8F425B8CC2A3DF9FD5CD4'
CREATE DEFINER=`root`@`localhost` FUNCTION `get_flag`(s varchar(255)) RETURNS varchar(255) CHARSET latin1
 DETERMINISTIC
 return concat('WGCTF{', md5(s), '}')

Там же по первому mysql пакету делаем follow tcp stream, и находим

wg_db.wg_db.create table wg_table(id int, info varchar(255))
wg_db.wg_db.create table wg_flags (id int, flag varchar(255))

Плохо помним документацию mysql, поэтому решаем, что указанный пароль это sha1(sha1) и долго ищем альтернативные пути, включая патченый mysql сервер.

В конечном итоге просто брутим хэш и получаем пароль 'anubis'

 MariaDB [wg_db]> show tables;
 +-----------------+
 | Tables_in_wg_db |
 +-----------------+
 | secret          |
 | wg_flags        |
 | wg_table        |
 +-----------------+
 MariaDB [wg_db]> select * from secret;
 +-----------------------------------------+
 | text                                    |
 +-----------------------------------------+
 | WGCTF{434FB337C7821CBA4C06DA5F60C0D253} |
 +-----------------------------------------+
  1. Ищем доп.флаги. Первый, очевидно, будет отдаваться хранимой процедурой.
MariaDB [wg_db]> select * from wg_table;
+------+------------+
| id   | info       |
+------+------------+
|    1 | WGCTF_FLAG |
+------+------------+
1 row in set (0.055 sec)

MariaDB [wg_db]> select get_flag("WGCTF_FLAG") from wg_table;
+-----------------------------------------+
| get_flag("WGCTF_FLAG")                  |
+-----------------------------------------+
| WGCTF{ac9ede6b71cdca876375892e4f916a47} |
+-----------------------------------------+
1 row in set (0.324 sec)
  1. Поиск второго доп.флага как-то затянулся, но в итоге сообразили поискать его вне БД,
MariaDB [wg_db]> select load_file("/etc/passwd");
    +----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
    | load_file("/etc/passwd")                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
    +----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
    | root:x:0:0:root:/root:/bin/ash
    bin:x:1:1:bin:/bin:/sbin/nologin
    daemon:x:2:2:daemon:/sbin:/sbin/nologin
    adm:x:3:4:adm:/var/adm:/sbin/nologin
    lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
    sync:x:5:0:sync:/sbin:/bin/sync
    shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
    halt:x:7:0:halt:/sbin:/sbin/halt
    mail:x:8:12:mail:/var/spool/mail:/sbin/nologin
    news:x:9:13:news:/usr/lib/news:/sbin/nologin
    uucp:x:10:14:uucp:/var/spool/uucppublic:/sbin/nologin
    operator:x:11:0:operator:/root:/bin/sh
    man:x:13:15:man:/usr/man:/sbin/nologin
    postmaster:x:14:12:postmaster:/var/spool/mail:/sbin/nologin
    cron:x:16:16:cron:/var/spool/cron:/sbin/nologin
    ftp:x:21:21::/var/lib/ftp:/sbin/nologin
    sshd:x:22:22:sshd:/dev/null:/sbin/nologin
    at:x:25:25:at:/var/spool/cron/atjobs:/sbin/nologin
    squid:x:31:31:Squid:/var/cache/squid:/sbin/nologin
    xfs:x:33:33:X Font Server:/etc/X11/fs:/sbin/nologin
    games:x:35:35:games:/usr/games:/sbin/nologin
    postgres:x:70:70::/var/lib/postgresql:/bin/sh
    cyrus:x:85:12::/usr/cyrus:/sbin/nologin
    vpopmail:x:89:89::/var/vpopmail:/sbin/nologin
    ntp:x:123:123:NTP:/var/empty:/sbin/nologin
    smmsp:x:209:209:smmsp:/var/spool/mqueue:/sbin/nologin
    guest:x:405:100:guest:/dev/null:/sbin/nologin
    nobody:x:65534:65534:nobody:/:/sbin/nologin
    mysql:x:100:101:mysql:/var/lib/mysql:/sbin/nologin
    #flag:x:1001:1001:WGCTF{et56yHT65n8IM6Ygrn60Ki89Km6t4rEf}:/home/flag:/bin/sh
     |
    +----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+