ciscn2025

smart_home

通过update.bin

得到

/var/www/html/api.php\00\00\42\CB<?php

class Database
{
private $db;
private $dbPath;

public function __construct($dbPath = '/data/smart_home.db')
{
$this->dbPath = $dbPath;
$this->connect();
}

private function connect()
{
$this->db = new PDO("sqlite:" . $this->dbPath);
$this->db->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
}

public function exec($sql)
{
return $this->db->exec($sql);
}

public function query($sql, $params = [])
{
$stmt = $this->db->prepare($sql);
$stmt->execute($params);
return $stmt;
}

public function fetch($sql, $params = [])
{
return $this->query($sql, $params)->fetch(PDO::FETCH_ASSOC);
}

public function fetchColumn($sql, $params = [])
{
return $this->query($sql, $params)->fetchColumn();
}

public function close()
{
$this->db = null;
}
}

class UserModel
{
private $db;
private $defaultAdminPassword = "0k4ckART@%F!,('DK>";

public function __construct(Database $db)
{
$this->db = $db;
$this->init();
}

public function init()
{

$this->db->exec("
CREATE TABLE IF NOT EXISTS users (
id INTEGER PRIMARY KEY AUTOINCREMENT,
username TEXT UNIQUE,
role TEXT,
password TEXT
)
");


$count = $this->db->fetchColumn("SELECT COUNT(*) FROM users");

if ($count == 0) {
$this->db->query("
INSERT INTO users (username, role, password)
VALUES ('admin', 'sadmin', :password)
", [
':password' => $this->defaultAdminPassword
]);
}
}

public function getUserByRole($role)
{
return $this->db->fetch(
"SELECT * FROM users WHERE role = :role LIMIT 1",
[':role' => $role]
);
}

public function getUserByName($username)
{
return $this->db->fetch(
"SELECT * FROM users WHERE username = :username LIMIT 1",
[':username' => $username]
);
}

public function addUser($args) {
$this->db->query("
INSERT INTO users (username, role, password)
VALUES (:username, :role, :password)
", [
':username' => $args['username'],
':role' => $args['role'],
':password' => $args['password']
]);
}

public function deleteUser($username) {
$this->db->query("
DELETE FROM users WHERE username = :username
", [
':username' => $username
]);
}

public function updateUser($args) {
$this->db->query("
UPDATE users
SET role = :role, password = :password
WHERE username = :username
", [
':username' => $args['username'],
':role' => $args['role'],
':password' => $args['password']
]);
}

public function listUsers() {
$stmt = $this->db->query("SELECT id, username, role FROM users");
return $stmt->fetchAll(PDO::FETCH_ASSOC);
}
}

class DeviceModel {
private $db;

public function __construct(Database $db) {
$this->db = $db;
$this->init();
}

public function init() {
$this->db->exec("
CREATE TABLE IF NOT EXISTS devices (
id INTEGER PRIMARY KEY AUTOINCREMENT,
name TEXT,
type TEXT,
status TEXT,
created_at DATETIME DEFAULT CURRENT_TIMESTAMP
)
");
}


public function addDevice($args) {

$this->db->query("
INSERT INTO devices (name, type, status)
VALUES (:name, :type, :status)
", [
':name' => $args['name'],
':type' => $args['type'],
':status' => $args['status']
]);
}

public function getDeviceById($deviceId) {
return $this->db->fetch(
"SELECT * FROM devices WHERE id = :id LIMIT 1",
[':id' => $deviceId]
);
}

public function listDevices() {
$stmt = $this->db->query("SELECT * FROM devices");
return $stmt->fetchAll(PDO::FETCH_ASSOC);
}

public function updateDevice($args) {
$this->db->query("
UPDATE devices
SET name = :name, type = :type, status = :status
WHERE id = :id
", [
':id' => $args['id'],
':name' => $args['name'],
':type' => $args['type'],
':status' => $args['status']
]);
}

public function deleteDevice($deviceId) {
$this->db->query("
DELETE FROM devices WHERE id = :id
", [
':id' => $deviceId
]);
}
}

class LogModel {
private $db;

public function __construct(Database $db) {
$this->db = $db;
$this->init();
}

public function init() {
$this->db->exec("
CREATE TABLE IF NOT EXISTS logs (
id INTEGER PRIMARY KEY AUTOINCREMENT,
message TEXT,
level TEXT,
created_at DATETIME DEFAULT CURRENT_TIMESTAMP
)
");
}

public function addLog($message, $level = 'info') {
$this->db->query("
INSERT INTO logs (message, level, created_at)
VALUES (:message, :level, :created_at)
", [
':message' => $message,
':level' => $level,
':created_at' => date('Y-m-d H:i:s')
]);
}

public function getLogs($limit = 100) {
$stmt = $this->db->query("
SELECT * FROM logs
ORDER BY created_at DESC
LIMIT :limit
", [
':limit' => $limit
]);
return $stmt->fetchAll(PDO::FETCH_ASSOC);
}

public function clearLogs() {
$this->db->exec("DELETE FROM logs");
}

public function deleteLog($logId) {
$this->db->query("DELETE FROM logs WHERE id = :id", [
':id' => $logId
]);
}
}

class CoreService {
private static $core = '/hub';

public static function execute($action, $core_args = []) {
$command = escapeshellcmd(self::$core) . ' ' . escapeshellarg($action);

foreach ($core_args as $arg) {
$command .= ' ' . escapeshellarg($arg);
}

$descriptorSpec = [
0 => ["pipe", "r"], 
1 => ["pipe", "w"], 
2 => ["pipe", "w"]  
];

$process = proc_open($command, $descriptorSpec, $pipes);

if (!is_resource($process)) {
throw new Exception("cannot start process");
}

$stdout = stream_get_contents($pipes[1]);
$stderr = stream_get_contents($pipes[2]);

foreach ($pipes as $pipe) {
fclose($pipe);
}

$returnCode = proc_close($process);

return [
'stdout' => trim($stdout),
'stderr' => trim($stderr),
'return_code' => $returnCode
];
}
}

class InputValidator {
public static function validateOption($option) {
$allowedOptions = ['core', 'manage'];
return in_array($option, $allowedOptions);
}

public static function sanitizeFilename($filename) {
$filename = basename($filename);
$allowedFiles = ['config.json', 'device_status.json', 'user_settings.json'];
return in_array($filename, $allowedFiles) ? $filename : false;
}
}

class AuthManager {
public static function checkPermission($limitRole = 'guest') {
$roles = ['guest' => 0, 'user' => 1, 'admin' => 2, 'sadmin' => 3];
$limit = is_numeric($limitRole) ? $limitRole : $roles[$limitRole];
$user_role = $_SESSION['user_role'] ?? 'guest';
return $roles[$user_role] >= $limit;
}

public static function checkLogin($args) {
$username = $args['username'] ?? 'guest';
$password = $args['password'] ?? '';

$db = new Database("/data/smart_home.db");
$userModel = new UserModel($db);


$user = $userModel->getUserByName($username);


if ($user && $password === $user['password']) {
$_SESSION['user_id'] = $user['id'];
$_SESSION['user_name'] = $user['username'];
$_SESSION['user_role'] = $user['role'];

return [
'status' => 'success',
'message' => 'Login successful',
'role'    => $user['role']
];
}


if (!empty($_SESSION['user_id'])) {
return [
'status' => 'success',
'message' => 'Already logged in',
'role'    => $_SESSION['user_role']
];
}


return [
'status' => 'error',
'message' => 'Incorrect username or password'
];
}

public static function routePermissions() {
return [
'core' => [
'get_status' => 0, 
'list_devices' => 0
],
'manage' => [
'login' => 0,
'log' => 2,
'user' => 3,
'system' => 2

]
];
}

public static function requireAuth($option, $action) {
$permissions = self::routePermissions();
$limitRole = $permissions[$option][$action] ?? 'sadmin';

if (!self::checkPermission($limitRole)) {
http_response_code(403);
exit('Access denied');
}
}
}

class Manager {
public function log($args) {

$action = $args['action'] ?? '';
$db = new Database("/data/smart_home.db");
$logModel = new LogModel($db);
switch ($action) {
case 'list':
$logs = $logModel->getLogs($args['limit'] ?? 100);
return ['status' => 'success', 'data' => $logs];
case 'clear':
if (!AuthManager::checkPermission('admin')) {
return ['status' => 'error', 'message' => 'Permission denied'];
}
$logModel->clearLogs();
return ['status' => 'success', 'message' => 'Logs cleared'];
case 'delete':
if (!AuthManager::checkPermission('admin')) {
return ['status' => 'error', 'message' => 'Permission denied'];
}
$logModel->deleteLog($args['log_id']);
return ['status' => 'success', 'message' => 'Log deleted'];
default:   
return ['status' => 'error', 'message' => 'Unknown log action'];
}
}

public function device($args) {

$action = $args['action'] ?? '';
$db = new Database("/data/smart_home.db");
$deviceModel = new DeviceModel($db);
switch ($action) {
case 'add':
if (!AuthManager::checkPermission('admin')) {
return ['status' => 'error', 'message' => 'Permission denied'];
}
$deviceModel->addDevice($args['device']);
return ['status' => 'success', 'message' => 'Device added'];
case 'delete':
if (!AuthManager::checkPermission('admin')) {
return ['status' => 'error', 'message' => 'Permission denied'];
}
$deviceModel->deleteDevice($args['device_id']);
return ['status' => 'success', 'message' => 'Device deleted'];
case 'update':
if (!AuthManager::checkPermission('admin')) {
return ['status' => 'error', 'message' => 'Permission denied'];
}
$deviceModel->updateDevice($args['device']);
return ['status' => 'success', 'message' => 'Device updated'];
case 'list':
$devices = $deviceModel->listDevices();
return ['status' => 'success', 'data' => $devices];
default:
return ['status' => 'error', 'message' => 'Unknown device action'];
}
}

public function user($args) {
$action = $args['action'] ?? '';
$db = new Database("/data/smart_home.db");
$userModel = new UserModel($db);
$username = $args['username'] ?? '';
$role = $args['role'] ?? 'user';
$password = $args['password'] ?? '';
switch ($action) {
case 'add':
if (!AuthManager::checkPermission('sadmin')) {
return ['status' => 'error', 'message' => 'Permission denied'];
}
$userModel->addUser([
'username' => $username,
'role' => $role,
'password' => $password
]);
return ['status' => 'success', 'message' => 'User added'];
case 'delete':
if (!AuthManager::checkPermission('sadmin')) {
return ['status' => 'error', 'message' => 'Permission denied'];
}
$userModel->deleteUser($username);
return ['status' => 'success', 'message' => 'User deleted'];
case 'update':
if (!AuthManager::checkPermission('sadmin')) {
return ['status' => 'error', 'message' => 'Permission denied'];
}
$userModel->updateUser([
'username' => $username,
'role' => $role,
'password' => $password
]);
return ['status' => 'success', 'message' => 'User updated'];
case 'list':
$users = $userModel->listUsers();
return ['status' => 'success', 'data' => $users];
default:
return ['status' => 'error', 'message' => 'Unknown user action'];
}
}

public function system($args) {
$action = $args['action'] ?? '';
switch ($action) {
case 'status':
$result = CoreService::execute('status');
return [
'status' => 'success',
'data' => $result
];
case 'restart':
if (!AuthManager::checkPermission('sadmin')) {
return ['status' => 'error', 'message' => 'Permission denied'];
}
CoreService::execute('restart');
return [
'status' => 'success',
'message' => 'System is restarting...'
];
case 'backup':
if (!AuthManager::checkPermission('sadmin')) {
return ['status' => 'error', 'message' => 'Permission denied'];
}
$backfile = '/data/' . ($args['backfile'] ?? 'smart_home.db');
$content = file_get_contents($args['backfile'] ?? $backfile);
$encoded = base64_encode(gzcompress($content));
return [
'status' => 'success',
'data' => $encoded
];
default:
return ['status' => 'error', 'message' => 'Unknown system action'];
}
}

public function login($args) {
return AuthManager::checkLogin($args);
}
}

function toCamelCase($action) {
return str_replace('_', '', lcfirst(ucwords($action, '_')));
}

try {
session_start();
header('Content-Type: application/json');
$args = $_POST['args'] ?? '';
$args = base64_decode($args);
$args = json_decode($args, true);
if (!$args) {
throw new Exception("Invalid args parameter");
}

$option = $args['option'] ?? '';
$action = $args['action'] ?? '';
AuthManager::requireAuth($option, $action);

switch ($option) {
case 'manage':
$manager = new Manager();
if (!method_exists($manager, $actionMethod = toCamelCase($action))) {
throw new Exception("Unknown action for manage");
}
$sub_args = $args['sub_args'] ?? [];
$result = $manager->$actionMethod($sub_args);
echo json_encode($result);
break;
case 'core':

$core_args = $args['sub_args'] ?? [];
$result = CoreService::execute($action, $core_args);
echo json_encode([
'status' => 'success',
'message' => 'Core executed',
'data' => $result,
]);
break;
default:
throw new Exception("Unknown option");
}
} catch (Exception $e) {
http_response_code(400);
echo json_encode([
'status' => 'error',
'message' => $e->getMessage()
]);
}
?>
L\DE

$backfile = ‘/data/‘ . ($args[‘backfile’] ?? ‘smart_home.db’);
$content = file_get_contents($args[‘backfile’] ?? $backfile);

它首先构造了一个$backfile变量，然后使用file_get_contents时，如果$args[‘backfile’]存在，则使用$args[‘backfile’]，否则使用$backfile

我是真的搞不明白，password我都能读出来，“/flag”却显示根本没这个文件

ram_snoop

也是没见过的题

卡崩了

类似题型的wp也找不到

easy_rw

听学长说这个题还不错

也只能写这个了

Proxy加壳了

脱壳成功

终于有回显了

那它给我libc-2.31.so是干什么的

❯ LD_LIBRARY_PATH=./libssl1.1/usr/lib/x86_64-linux-gnu \ LD_PRELOAD=./libc-2.31.so \ ./server ./server: ./libc-2.31.so: version GLIBC_2.36' not found (required by /lib/x86_64-linux-gnu/libdl.so.2) ./server: ./libc-2.31.so: version GLIBC_ABI_DT_RELR' not found (required by /lib/x86_64-linux-gnu/libdl.so.2) ./server: ./libc-2.31.so: version GLIBC_2.36' not found (required by /lib/x86_64-linux-gnu/libpthread.so.0) ./server: ./libc-2.31.so: version GLIBC_ABI_DT_RELR' not found (required by /lib/x86_64-linux-gnu/libpthread.so.0)

我还是拉个docker吧

什么叫校园网把我docker 禁了