"网鼎杯"难度果然不一般,整理了部分解题过程,供大家学习。(后期会将做题文件上传)
解题过程
签到题
八道网络安全选择题,百度都能搜索,记不全了
杂项1
破压缩包
得到密码
得到excel里,打开,passwd解密
7EqufFnrSGk= |
用nmy0612打开flag.7z
里面韩文,用工具解密
Cyberchef
crypto582
题目
from Crypto.Util.number import getPrime
import hashlib
e = 2022
m = getPrime(512)
m1 = getPrime(512)
m2 = getPrime(512)
flag = m + m1 + m2
flag = hashlib.md5(str(flag).encode('utf-8')).hexdigest()
c1 = pow(m+m1,e,m*m1)
c2 = pow(m+m2,e,m*m2)
c3 = pow(m1+m2,e,m1*m2)
x = pow(m1+2022,m,m*m1)
y = pow(m2+2022,m,m*m2)
z = pow(m+2022,m1,m*m1)
print('c1 =',c1)
print('c2 =',c2)
print('c3 =',c3)
print('x =',x)
print('y =',y)
print('z =',z)
'''
c1 = 85139434329272123519094184286276070319638471046264384499440682030525456122476228324462769126167628121006213531153927884870307999106015430909361792093581895091445829379547633304737916675926004298753674268141399550405934376072486086468186907326396270307581239055199288888816051281495009808259009684332333344687
c2 = 104554808380721645840032269336579549039995977113982697194651690041676187039363703190743891658905715473980017457465221488358016284891528960913854895940235089108270134689312161783470000803482494370322574472422461483052403826282470850666418693908817591349159407595131136843764544166774390400827241213500917391144
c3 = 94771625845449128812081345291218973301979152577131568497740476123729158619324753128517222692750900524689049078606978317742545997482763600884362992468406577524708622046033409713416026145377740182233674890063333534646927601262333672233695863286637817471270314093720827409474178917969326556939942622112511819330
x = 78237329408351955465927092805995076909826011029371783256454322166600398149132623484679723362562600068961760410039241554232588011577854168402399895992331761353772415982560522912511879304977362225597552446397868843275129027248765252784503841114291392822052506837132093960290237335686354012448414804030938873765
y = 100442166633632319633494450595418167608036668647704883492068692098914206322465717138894302011092841820156560129280901426898815274744523998613724326647935591857728931946261379997352809249780159136988674034759483947949779535134522005905257436546335376141008113285692888482442131971935583298243412131571769294029
z = 104712661985900115750011628727270934552698948001634201257337487373976943443738367683435788889160488319624447315127992641805597631347763038111352925925686965948545739394656951753648392926627442105629724634607023721715249914976189181389720790879720452348480924301370569461741945968322303130995996793764440204452
'''
解密脚本
费马定理
import hashlib,math
e=2022
c1 = 85139434329272123519094184286276070319638471046264384499440682030525456122476228324462769126167628121006213531153927884870307999106015430909361792093581895091445829379547633304737916675926004298753674268141399550405934376072486086468186907326396270307581239055199288888816051281495009808259009684332333344687
c2 = 104554808380721645840032269336579549039995977113982697194651690041676187039363703190743891658905715473980017457465221488358016284891528960913854895940235089108270134689312161783470000803482494370322574472422461483052403826282470850666418693908817591349159407595131136843764544166774390400827241213500917391144
c3 = 94771625845449128812081345291218973301979152577131568497740476123729158619324753128517222692750900524689049078606978317742545997482763600884362992468406577524708622046033409713416026145377740182233674890063333534646927601262333672233695863286637817471270314093720827409474178917969326556939942622112511819330
x = 78237329408351955465927092805995076909826011029371783256454322166600398149132623484679723362562600068961760410039241554232588011577854168402399895992331761353772415982560522912511879304977362225597552446397868843275129027248765252784503841114291392822052506837132093960290237335686354012448414804030938873765
y = 100442166633632319633494450595418167608036668647704883492068692098914206322465717138894302011092841820156560129280901426898815274744523998613724326647935591857728931946261379997352809249780159136988674034759483947949779535134522005905257436546335376141008113285692888482442131971935583298243412131571769294029
z = 104712661985900115750011628727270934552698948001634201257337487373976943443738367683435788889160488319624447315127992641805597631347763038111352925925686965948545739394656951753648392926627442105629724634607023721715249914976189181389720790879720452348480924301370569461741945968322303130995996793764440204452
a=(x-2022)**e-c1
b=(y-2022)**e-c2
c=math.gcd(a,b)
d=(x-e)%c
e=(y-e)%c+c
flag=c+d+e
flag=hashlib.md5(str(flag).encode('utf-8')).hexdigest()
print("flag{"+(flag)+"}")
Re
using namespace std;
uint32_t bit_move(uint32_t val, int n) {
int size = 8;
return (val << (size - n) | (val >> n));
}
unsigned char enc[] = {
0xF2, 0x7F, 0x09, 0x05, 0xD7, 0x77, 0x16, 0x91, 0x25, 0x01, 0x2E,
0xC5, 0x97, 0x26, 0x63, 0x82, 0x01, 0x40, 0x15, 0x2D, 0xFC, 0x53,
0xDB, 0xD3, 0xC4, 0xDB, 0x0A, 0x1F, 0x82, 0x1E, 0x99, 0x4E, 0xFE,
0x0C, 0x80, 0xB8, 0xA5, 0x61, 0x0E, 0x99, 0xDF, 0x39 };
//0x6526B0D9
void sub_140001950(unsigned char* enc) {
int i;
unsigned int v1;
unsigned int v2;
unsigned int sum;
int v4;
for (i = 0; i != 5; ++i) {
v1 = *(uint32_t*)&enc[8 * i];
v2 = *(uint32_t*)&enc[8 * i + 4];
sum = 0x6526B0D9;
v4 = 32;
do {
sum += 0x61C88647;
v2 -= ((v1 << 4) + 0x43) ^ (sum + v1) ^ ((v1 >> 5) + 0x56);
v1 -= (v2 + sum) ^ ((v2 << 4) | 0xC) ^ ((v2 >> 5) + 0x2D);
--v4;
} while (v4);
*(uint32_t*)&enc[8 * i] = v1;
*(uint32_t*)&enc[8 * i + 4] = v2;
}
}
int main() {
for (int i = 0; i < 42; ++i) {
enc[i] = bit_move(enc[i], 5);
}
for (int i = 0; i < 42; ++i) {
enc[i] ^= 0x66;
enc[i] -= 0x32;
}
sub_140001950(enc);
printf("%s", enc);
return 0;
}
Web1
1.dirmap目录扫描,御剑扫不到,git源代码泄漏,githack拉去源代码
2.扫描结果找到上传页面public/index.php,注意public/index上传不成功,审计源代码查看上传逻辑.htaccess绕过
3.同时上传一句话木马和.htaccess,保证两个文件在一个目录下,
4.getshell,查看flag
【Hacking黑白红】,一线渗透攻防实战交流公众号
回复“电子书”获取web渗透、CTF电子书:
回复“视频教程”获取渗透测试视频教程;
回复“内网书籍”获取内网学习书籍;
回复“CTF工具”获取渗透、CTF全套工具;
回复“内网渗透”;获取内网渗透资料;
回复“护网”;获取护网学习资料 ;
回复“python”,获取python视频教程;
回复“java”,获取Java视频教程;
回复“go”,获取go视频教程
知识星球
【Hacking藏经阁】知识星球致力于分享技术和认知。
1、技术方面。主攻渗透测试(web和内网)、CTF比赛、逆向、护网行动等;
400G渗透教学视频、80多本安全类电子书、50个渗透靶场(资料主要来自本人总结、以及学习过程中购买的课程)
2、认知方面。副业经营、人设IP打造,具体点公众号运营、抖*yin等自媒体运营(目前主要在运营两个平台4个号)。
如果你也想像我一样,不想35岁以后被动的去面试,那么加入星球我们一起成长。
欢迎加入99米/年,平均每天2毛7分钱,学习网络安全一整年。
▶【渗透实战系列】|45-记一次渗透实战-代码审计到getshell
▶【渗透实战系列】|44-记一次授权渗透实战(过程曲折,Java getshell)
▶【渗透实战系列】|42-防范诈骗,记一次帮助粉丝渗透黑入某盘诈骗的实战
▶【渗透实战系列】|40-APP渗透测试步骤(环境、代理、抓包挖洞)
▶【渗透实战系列】|35-旁站信息泄露的dedecms站点渗透
▶【渗透实战系列】|33-App渗透 ,由sql注入、绕过人脸识别、成功登录APP
▶【渗透实战系列】|32-FOFA寻找漏洞,绕过杀软拿下目标站
▶【渗透实战系列】|30-从SQL注入渗透内网(渗透的本质就是信息搜集)
▶【渗透实战系列】|29-实战|对某勒索APP的Getshell
▶【渗透实战系列】|27-对钓鱼诈骗网站的渗透测试(成功获取管理员真实IP)
▶【渗透实战系列】|25一次从 APP 逆向到 Getshell 的过程
▶【渗透实战系列】|24-针对CMS的SQL注入漏洞的代码审计思路和方法
▶【渗透实战系列】|18-手动拿学校站点 得到上万人的信息(漏洞已提交)
▶【渗透实战系列】|17-巧用fofa对目标网站进行getshell
▶【渗透实战系列】|15-博彩网站(APP)渗透的常见切入点
▶【渗透实战系列】|12 -渗透实战, 被骗4000花呗背后的骗局
▶【渗透实战系列】|10 - 记某色X商城支付逻辑漏洞的白嫖(修改价格提交订单)
▶【渗透实战系列】|9-对境外网站开展的一次web渗透测试(非常详细,适合打战练手)
▶【渗透实战系列】|8-记一次渗透测试从XSS到Getshell过程(详细到无语)
▶【渗透实战系列】|1一次对跨境赌博类APP的渗透实战(getshell并获得全部数据)
点分享
点收藏
点点赞
点在看
原文始发于微信公众号(Hacking黑白红):2022第三届“网鼎杯 第2天 白虎组 WriteUp(部分)
- 左青龙
- 微信扫一扫
-
- 右白虎
- 微信扫一扫
-
评论