Web
Ezpop
ThinkPHP V6.0.12LTS反序列化，扫描路径得到www.zip
给出利于方法
poc.php
payload
.png%3Ftable%3Dblock%26id%3Df85ec321-65ff-4cc2-b41e-19b9a553dc08%26spaceId%3Db1f0f519-95cf-4a8e-b754-27a7b5f397ba%26expirationTimestamp%3D1743595200000%26signature%3DzUzLh86UihGRPcTMQGbPcbvNgKMFY-Mf_e7jb1mXElo?table=block&id=f85ec321-65ff-4cc2-b41e-19b9a553dc08&cache=v2)
Crypto
签到电台
需要发送"弼时安全到达了"
电码表
密码本7*4
模十算法
发送
.png%3Ftable%3Dblock%26id%3D7a8231cf-ac0d-457a-a6c1-09d32f758b73%26spaceId%3Db1f0f519-95cf-4a8e-b754-27a7b5f397ba%26expirationTimestamp%3D1743595200000%26signature%3DPpHYc3q3CsCYs2WuasKQhflQt0tCicOAH9CCImcSLyI?table=block&id=7a8231cf-ac0d-457a-a6c1-09d32f758b73&cache=v2)
基于挑战码的双向认证
flag在/root/cube-shell/instance/flag-server/flag1.txt位置
.png%3Ftable%3Dblock%26id%3Da6506efc-babb-4e9f-9aa3-f597a66336c0%26spaceId%3Db1f0f519-95cf-4a8e-b754-27a7b5f397ba%26expirationTimestamp%3D1743595200000%26signature%3DBcytkW0oX7APpB2WqGJl_xdRXF082YW8x1_JcFJR-vg?table=block&id=a6506efc-babb-4e9f-9aa3-f597a66336c0&cache=v2)
基于挑战码的双向认证2
flag在/root/cube-shell/instance/flag_server/flag2.txt位置
.png%3Ftable%3Dblock%26id%3D2a28964b-b0a6-463d-8532-20c8ceca2934%26spaceId%3Db1f0f519-95cf-4a8e-b754-27a7b5f397ba%26expirationTimestamp%3D1743595200000%26signature%3DxHi0rrbtSOp4y1fg4W0tcghXy0LqAez0F5OoDRGIjpw?table=block&id=2a28964b-b0a6-463d-8532-20c8ceca2934&cache=v2)
基于挑战码的双向认证3
root密码弱口令，root/toor，find搜索flag*，得到flag路径
.png%3Ftable%3Dblock%26id%3D51d07b43-398c-4efd-9d36-72772aeefb3d%26spaceId%3Db1f0f519-95cf-4a8e-b754-27a7b5f397ba%26expirationTimestamp%3D1743595200000%26signature%3DtoozEKG6qNxFuQkGGH_M8IJ0GQR5vc6GoiXq3HwOFyw?table=block&id=51d07b43-398c-4efd-9d36-72772aeefb3d&cache=v2)
MISC
ez_usb
用wireshark打开发现是usb的流量包
当Source=2.8.1和Destination=host时，会有HID Data数据，过滤流量，导出特定分组为文本，然后用脚本解
.png%3Ftable%3Dblock%26id%3D2881d5ef-f399-4fd9-8985-221e34c1b708%26spaceId%3Db1f0f519-95cf-4a8e-b754-27a7b5f397ba%26expirationTimestamp%3D1743595200000%26signature%3DqKPsGylkb6gl7XASbO1flGmujxFrMl1G_kFkGbF_KsE?table=block&id=2881d5ef-f399-4fd9-8985-221e34c1b708&cache=v2)
解密脚本
解密数据
将特殊符号删除
5261为RAR文件头，直接生成压缩包，但是需要密码。
.png%3Ftable%3Dblock%26id%3D05eabe69-1a82-4eed-b3fa-9d623eba637e%26spaceId%3Db1f0f519-95cf-4a8e-b754-27a7b5f397ba%26expirationTimestamp%3D1743595200000%26signature%3DPCfkFbKBOI2x0sgvsdSBfrHoFYFPN1qwmMvlLdyQRLw?table=block&id=05eabe69-1a82-4eed-b3fa-9d623eba637e&cache=v2)
后来又发现当Source=2.10.1时也有数据，所以重复操作一次，得到密码：35c535765e50074a
解压得到flag
.png%3Ftable%3Dblock%26id%3D3f6d005c-bdd2-4641-bada-ac6c89cdeb8d%26spaceId%3Db1f0f519-95cf-4a8e-b754-27a7b5f397ba%26expirationTimestamp%3D1743595200000%26signature%3DI62c3I6UwJj-NFaKZQtmTCMG-EgBsgL6s4oKD4bjUT4?table=block&id=3f6d005c-bdd2-4641-bada-ac6c89cdeb8d&cache=v2)
- Author:Linuz
- URL:https://linuz.me/article/2022-CISCNCTF-Writeup
- Copyright:All articles in this blog, except for special statements, adopt BY-NC-SA agreement. Please indicate the source!
Relate Posts
