p0l1st's blog

L3HCTF2025 TellMeWhy

p0l1st published on 2026-05-04 included in CTF

使用了solon框架，存在fastjson2依赖

并且/baby/why路由可以反序列化

存在反序列化黑名单

javax.management.BadAttributeValueExpException
javax.swing.event.EventListenerList
javax.swing.UIDefaults$TextAndMnemonicHashMap

目的是想要过滤可以触发JsonArray.toString的链子，常见的可以触发toString方法的链子如下：

XString

Hashmap#readobject --> 
    XString#equals --> 
        JSONArray.toString

HotSwappableTargetSource

HashMap#readObject -> 
    HotSwappableTargetSource#equals -> 
        XString#equals -> 
            JSONArray.toString

BadAttributeValueExpException

BadAttributeValueExpException#readObject --> 
    JSONArray#toString

EventListenerList

EventListenerList#readobject --> 
    UndoManager#toString -->
        Vector#toString -->
            JSONArray#toString

TextAndMnemonicHashMap

hashmap#readObject-->
    HashMap#putVal-->
        AbstractMap#equals-->
            TextAndMnemonicHashMap#get-->
                JSONArray#toString

那么在这里我们可以利用XString去触发JsonArray.toString 或者可以用tabby去跑一下

Polaris Oa、软件系统安全赛Themeleaf

p0l1st published on 2026-05-04 included in CTF

Polaris oa

AuthController硬编码了admin的username和password，所以我们只能注册普通用户

Express应⽤预处理特性绕过服务端校验实现XSS

p0l1st published on 2026-03-03 included in Web安全

前言

之前推特上的一道题，题目环境：https://pwnbox.xyz/

阿里CTF 2026部分复现

p0l1st published on 2026-02-27 included in CTF

懒得写详细了

强网拟态2025初赛 Web Writeup

p0l1st published on 2025-10-27 included in CTF

smallcode

<?php
    highlight_file(__FILE__);
    if(isset($_POST['context'])){
        $context = $_POST['context'];
        file_put_contents("1.txt",base64_decode($context));
    }

    if(isset($_POST['env'])){
        $env = $_POST['env'];
        putenv($env);
    }
    system("nohup wget --content-disposition -N hhhh &");

写so，编译

LilCTF Blade_cc

p0l1st published on 2025-08-28 included in CTF

TransformedList触发transform

从EventListenerList#readObject触发toString开始

p0l1st