wireshark打开发现有好多tcp和http流
追踪TCP流可以发现,在众多HTTP协议中,像是执nux系统命令:ls cat etc/passwd
在这里进行了ls查看
tcp第五流发现QER1=cat+%2Ff14g%7Cbase64 ,url码转ascii 为QER1=at/flag|base,base关键词出现,按照这条线索往下查,过滤条件设为http,查看所有http
发现大量上传tmpshell.php文件,先导出,放起来备用
!!!第二种解题思路从这里开始,
随便选一个tmpshell.php,追踪http
在右下分组详情里有
和我们之前查的tcp stream内容一致,我们追踪http stream
发现两段16进制字符串,其中QER1=cat+%2Ff14g 对应
44516f4e4367306a49794d6a49794d6a49794d6a49794d6a49794d6a49794d6a49794d6a49794d6a49794d6a49794d6a49794d6a49794d6a49794d4b44534d674943416749434167494341344d446f784d446f774d6941774d79307a4d4330784d6a417949434167494341674943416749776f4e49794d6a49794d6a49794d6a49794d6a49794d6a49794d6a49794d6a49794d6a49794d6a49794d6a49794d6a49794d6a49794d6a436730744c5330744c5330744c5330744c5330744c5330744c5330744c5330744c5330744c5330744c5330744c5330744c5330744c5330744c5330744c5330744c5330744c516f3d
CyberChefThe Cyber Swiss Army Knife - a web app for encryption, encoding, compression and data analysishttps://icyberchef.com/去上面网站转换编码,hex >base4>ascsii
输出么有任何意义,看下一个
QER1=cat+%2Ff14g%7Cbase64 对应
64306c455357644251306c6e51554e4a5a3046355355737764306c7154586c4a616b31355357704e65556c7154586c4a616b31355357704e65556c7154586c4a616b31355357704e65556c7154586c4a616b31355357704e65556c7154576c44546d39525241707154586c4a616b31355357704e65556c7154586c4a616b31355357704e65556c7154586c4a616b31355357704e65556c7162314645616b46445357644251306c6e51554e4a5a32644554545a46524530325157704e5a3046365458524e524531305257704e436e5177553078304d464e4d6444425454485177553078304d464e4d6444425454485177553078304d464e4d6444425454485177553078304d464e4d6444425454485177553078304d464e4d644442705130354e65556c7154586c4a616b31355357704e65556b4b4e6b467154576442656b31305455524e644556715458644a616b38775a566f324d6d56774e557377643074795556645a64315a485a48593152556c3051576c4e4d5546355a4777316255733254545a7162475a7763573579555552304d464e4d64444254544170304d464e4d6444425454485177553078304d464e4d6444425454485177553078304d464e4d6444425454485177553078304d464e4d6444425454485177553078304d464e4d537a42425357526159585a764e7a567462485a735130354e564530325255524e436e6f77655531334d464e4e6555467154545a524e327877596a647362584a5252484a7a5131706f516c68614d446c745647637751306c355655524a4d315a74596e4676656d3951567974736357563151303477553078304d464e4d64444254544851775530774b63336858576d786b4d5659354d544e6c4e325179576d684752324a7a576d31615a7a427363446c7064573569567974585a7a427363446c7064573569567974585a7a427363446c706457356956797458537a423354586876564531336230524e6555464454517045546a4252524534775555527356324636546c684e65444258596d593562464a48556b524f5245347759584a6b4d464a6d4f565a6162444658596e644252456c6b556d46746345524c61577832526b6c6b556d46746345524c61577832566b747754544a5a436a303955556c6f545442525245347755516f3d
发现base64编码是倒序的,保存上面base64编码为a.txt文件
把这段base64使用下面命令逐行反序
rev a.tyxt > c.txt
DQoNCiMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIw0KIyAgICAgICAgIDIw
MjEtMDMtMzAgMjA6MDE6MDggICAgICAgICAjDQojIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMj
IyMjIyMjIyMjIyMNCi0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t
LS0tLS0tDQrnqpflj6M6Km5ldyA1MiAtIE5vdGVwYWQrKw0K5pe26Ze0OjIwMjEtMDMtMzAgMjA6
MDE6MTMNClvlm57ovaZdIA0KLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t
LS0tLS0tLS0tLS0NCueql+WPozoqbmV3IDUyIC0gTm90ZXBhZCsrDQrml7bpl7Q6MjAyMS0wMy0z
MCAyMDowMToxMw0KW+Wbnui9pl0gW+Wbnui9pl0gW+Wbnui9pl0gZmZsbGFhZ2d7e319V1dlZWxs
Y2MpKVvliKDpmaRdIFvliKDpmaRdIDAwbW1lZV9fR0dra0NDNDRGRl9fbW0xMXNzaWlDQ0NDQ0ND
Q0NDQ0MhIQ==
ffllaagg{{}}WWeellcc))[ffllaagg{{}}WWeellcc))[删除] [删除] 00mmee__GGkkCC44FF__mm11ssiiCCCCCCCCCCCC!!00mmee__GGkkCC44FF__mm11ssiiC
CCCCCCCCCCC!!
字符去重得到flag{Welc0me_GkC4F_m1siCCCCCC!}
另外一种解题思路
导出的php文件全部按大小排列
从上到下以此,进行下面操作,把逐个php文件以二进制打开,再进行Hex>ascii>base64解码
CTL+A选中字符
直到操作2k大小php文件时
发现base64编码是倒序的,保存上面base64编码为a.txt文件
把这段base64使用下面命令逐行反序
rev a.tyxt > c.txt
字符去重得到flag{Welc0me_GkC4F_m1siCCCCCC!}