Web
Ezpop
ThinkPHP V6.0.12LTS反序列化，扫描路径得到www.zip
给出利于方法
poc.php
payload
.png%3Fid%3Df85ec321-65ff-4cc2-b41e-19b9a553dc08%26table%3Dblock%26spaceId%3Db1f0f519-95cf-4a8e-b754-27a7b5f397ba%26expirationTimestamp%3D1714147200000%26signature%3DSZi26gQKPdFzpJF6Sxvx3h22VOTvOZZmScD3xEJa-H4?table=block&id=f85ec321-65ff-4cc2-b41e-19b9a553dc08&cache=v2)
Crypto
签到电台
需要发送"弼时安全到达了"
电码表
密码本7*4
模十算法
发送
.png%3Fid%3D7a8231cf-ac0d-457a-a6c1-09d32f758b73%26table%3Dblock%26spaceId%3Db1f0f519-95cf-4a8e-b754-27a7b5f397ba%26expirationTimestamp%3D1714147200000%26signature%3D2cbuQdhjsCUSK7q-VwK1lxRVdOKNaZUt0J6DDv-HTOk?table=block&id=7a8231cf-ac0d-457a-a6c1-09d32f758b73&cache=v2)
基于挑战码的双向认证
flag在/root/cube-shell/instance/flag-server/flag1.txt位置
.png%3Fid%3Da6506efc-babb-4e9f-9aa3-f597a66336c0%26table%3Dblock%26spaceId%3Db1f0f519-95cf-4a8e-b754-27a7b5f397ba%26expirationTimestamp%3D1714147200000%26signature%3DkNzknV_ZM6j6ewg7Wvb-pVqasnUS3RwvL9wfhrOo_E4?table=block&id=a6506efc-babb-4e9f-9aa3-f597a66336c0&cache=v2)
基于挑战码的双向认证2
flag在/root/cube-shell/instance/flag_server/flag2.txt位置
.png%3Fid%3D2a28964b-b0a6-463d-8532-20c8ceca2934%26table%3Dblock%26spaceId%3Db1f0f519-95cf-4a8e-b754-27a7b5f397ba%26expirationTimestamp%3D1714147200000%26signature%3DGrMN_m6VWSRZ8SUDB4w6cIHBnUSbH2hLb8-5iEBwrGY?table=block&id=2a28964b-b0a6-463d-8532-20c8ceca2934&cache=v2)
基于挑战码的双向认证3
root密码弱口令，root/toor，find搜索flag*，得到flag路径
.png%3Fid%3D51d07b43-398c-4efd-9d36-72772aeefb3d%26table%3Dblock%26spaceId%3Db1f0f519-95cf-4a8e-b754-27a7b5f397ba%26expirationTimestamp%3D1714147200000%26signature%3DEx4ItnS2HNsekP3MTA41xOYEXHPJubV5YuEUoEniHLY?table=block&id=51d07b43-398c-4efd-9d36-72772aeefb3d&cache=v2)
MISC
ez_usb
用wireshark打开发现是usb的流量包
当Source=2.8.1和Destination=host时，会有HID Data数据，过滤流量，导出特定分组为文本，然后用脚本解
.png%3Fid%3D2881d5ef-f399-4fd9-8985-221e34c1b708%26table%3Dblock%26spaceId%3Db1f0f519-95cf-4a8e-b754-27a7b5f397ba%26expirationTimestamp%3D1714147200000%26signature%3Dgps1Y3Fp6OkfIrFGH5XUBDL0-T-Bxn5zd1N7YVvIF8Q?table=block&id=2881d5ef-f399-4fd9-8985-221e34c1b708&cache=v2)
解密脚本
解密数据
将特殊符号删除
5261为RAR文件头，直接生成压缩包，但是需要密码。
.png%3Fid%3D05eabe69-1a82-4eed-b3fa-9d623eba637e%26table%3Dblock%26spaceId%3Db1f0f519-95cf-4a8e-b754-27a7b5f397ba%26expirationTimestamp%3D1714147200000%26signature%3DWD7xoqMauK3dDc0xmbmWoOFqZoUE-cqNFqVsLKGxOIY?table=block&id=05eabe69-1a82-4eed-b3fa-9d623eba637e&cache=v2)
后来又发现当Source=2.10.1时也有数据，所以重复操作一次，得到密码：35c535765e50074a
解压得到flag
.png%3Fid%3D3f6d005c-bdd2-4641-bada-ac6c89cdeb8d%26table%3Dblock%26spaceId%3Db1f0f519-95cf-4a8e-b754-27a7b5f397ba%26expirationTimestamp%3D1714147200000%26signature%3D4UjtqVPkYv_-LsQqMDlyYS2Jzf8Lx3Oiy_ncdhh67oc?table=block&id=3f6d005c-bdd2-4641-bada-ac6c89cdeb8d&cache=v2)
- Author:Linuz
- URL:https://linuz.me/article/2022-CISCNCTF-Writeup
- Copyright:All articles in this blog, except for special statements, adopt BY-NC-SA agreement. Please indicate the source!
Relate Posts
