Skip to content

Commit

Permalink
wip: update 2024-QWBCTF.md and some meta
Browse files Browse the repository at this point in the history
  • Loading branch information
@Southseast
Southseast committed Nov 3, 2024
1 parent 1c543b7 commit 2e0c86c
Show file tree
Hide file tree
Showing 4 changed files with 40 additions and 35 deletions.
6 changes: 3 additions & 3 deletions _config.yml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -5,11 +5,11 @@
# Site
title: S1uM4i
subtitle: ''
description: ''
keywords:
description: 三点几嘞，饮茶先。你講得啱，但係 S1uM4i 係由華南高校組成嘅 CTF 聯隊，活躍喺叫做「CTF」嘅遊戲入面。喺嗰度，畀 S1uM4i 揀中嘅人會獲賜「SM之力」。呢支戰隊已經贏咗好多獎。我哋會飾演一個叫做「SMer」嘅神秘角色，解決難題，搵翻失散嘅 FLAG，同時發掘「SM」嘅真相。
keywords: CTF, S1uM4i, cyberspace, 烧麦, 华南高校, 信息安全, 网络安全, CTF高手, 国产专区
author: S1uM4i
language: zh-CN
timezone: ''
timezone: 'Asia/Shanghai'

# URL
## Set your site url here. For example, if you use GitHub Page, set url as 'https://username.github.io/project'
Expand Down
69 changes: 37 additions & 32 deletions source/_posts/2024-QWBCTF.md
View file
Original file line number Diff line number Diff line change
Expand Up @@ -5,9 +5,12 @@ categories: Writeup
date: 2024-11-04 00:00:00
toc: true
---

鸠鸠屎，攞第三，明星战队冇我份。

吊吊嗨，唔识做，点解唔再加个钟。

![](../images/2024-QWBCTF/img_32.webp)
![](../images/2024-QWBCTF/img_33.webp)
<!--more-->

# Crypto
Expand Down Expand Up @@ -86,6 +89,8 @@ def gao_taowa(d_, b, n, e):
assert p * q == n
return p, q
return None, None
```
```Python
from pwn import *
from sage.all import *
from Crypto.PublicKey import RSA
Expand Down Expand Up @@ -787,7 +792,7 @@ for k in range(0xff):

elf头被破坏了，直接找一个正常的对着改就好。

![img](../images/2024-QWBCTF/img_4.webp)
![](../images/2024-QWBCTF/img_4.webp)

很容易找到主要逻辑，VM操作码种类不多，自生成代码的部分调试一下就行。

Expand Down Expand Up @@ -1102,7 +1107,7 @@ r.interactive()

> 感觉还挺撞大运的，这个 `2` 刚好是把栈顶复制一份，于是就刚好能让返回的 name 复制一份扔给 players，然后 `}` 再把一个空 dict 塞到 _ 去。可以说 flag 最后没这个 2 还过不了。哈哈
>
> ![img](../images/2024-QWBCTF/img_3.webp)
> ![](../images/2024-QWBCTF/img_3.webp)
> 当然要改也很简单，因为返回的 `name` 是非常可控的，所以可以用类似于 sql 盲注的方式一位一位去试。
Expand Down Expand Up @@ -1154,7 +1159,7 @@ Reply with ""Acknowledged."" if you understand.

虽然要求了输出格式，但是疑似根本没管，直接泄露了

![img](../images/2024-QWBCTF/img_4.webp)
![](../images/2024-QWBCTF/img_4.webp)

## Master of DFIR - Phishing

Expand Down Expand Up @@ -1210,7 +1215,7 @@ Team token > icq

将其中 JavaScript unescape 的部分丢进 CyberChef，得到 VBScript （5/13）脚本

![img](../images/2024-QWBCTF/img_7.webp)
![](../images/2024-QWBCTF/img_7.webp)

简单处理一下以便观察（用eval会被饥渴C猫狂暴鸿儒吗？不会的，因为看过全部匹配了没问题），处理前还做了些文本替换去掉Int(和&H之类的

Expand Down Expand Up @@ -1293,7 +1298,7 @@ print(c)

好，以后见到调试路径在 `D:\Workspace\chall`就知道是C喵的题了

![img](../images/2024-QWBCTF/img_25.webp)
![](../images/2024-QWBCTF/img_25.webp)

逆向恶意dll，发现`curl_easy_init` 会解密一个PE并加载执行，不知道有没有魔改，直接写个脚本加载这个dll并调用`curl_easy_init` 调试下就好：

Expand Down Expand Up @@ -1336,7 +1341,7 @@ int main() {
从流量中找到 `/files/1730391917.bin`
![img](../images/2024-QWBCTF/img_12.webp)
![](../images/2024-QWBCTF/img_12.webp)
dump下来直接开逆，但很多API被隐式调用了，还得调试，直接再写个load脚本帮助调试：
Expand Down Expand Up @@ -1399,11 +1404,11 @@ int main(int argc, char *argv[]) {

Dump 出 C2样本，--help 发现 AES 密钥 `pJB`-v)t^ZAsP$|r` （11-12/13）

![img](../images/2024-QWBCTF/img_19.webp)
![](../images/2024-QWBCTF/img_19.webp)

beacon和C2的通信流量长这样：

![img](../images/2024-QWBCTF/img_21.webp)
![](../images/2024-QWBCTF/img_21.webp)

最后上github找go的远控，这里的第一个C2就是 https://github.com/topics/redteam?l=go

Expand Down Expand Up @@ -1449,25 +1454,25 @@ Team token > icq

流量中找到 `"clientId":"a55330f4-83c2-4081"` （2/9）

![img](../images/2024-QWBCTF/img_5.webp)
![](../images/2024-QWBCTF/img_5.webp)

用上一题拿到的AES-CBC的密钥解密上面的流量（这里没去找IV，没IV也能做，少前16byte不影响superguess），发现 `"Hostname":"DESKTOP-28DGVAU/Bob"` （1/9）

![img](../images/2024-QWBCTF/img_14.webp)
![](../images/2024-QWBCTF/img_14.webp)

以及下载 `history` （3/9）的记录

![img](../images/2024-QWBCTF/img_28.webp)
![](../images/2024-QWBCTF/img_28.webp)

之后beacon那边的一堆流量似乎都是下一个数据库文件了

剩下的问题都在tomcat那边，可以很明显看到一堆401的扫描流量和一堆401最后面200的成功记录，这条里面就是密码 `tomcat:beautiful` （4/9）

![img](../images/2024-QWBCTF/img_20.webp)
![](../images/2024-QWBCTF/img_20.webp)

登录成功之后攻击者直接传了war🐎上去 `help.war` （5/9）

![img](../images/2024-QWBCTF/img_23.webp)
![](../images/2024-QWBCTF/img_23.webp)

AES+XOR+自定义密钥+每次传class 说明这是最新的冰蝎（6/9）

Expand Down Expand Up @@ -1607,7 +1612,7 @@ tcp.stream eq 25 跑在TLS上的RDP，东西很多

上边一个包有server challenge，下边的包里有proof str，用户名和域还有完整的NTLM response

![img](../images/2024-QWBCTF/img_15.webp)
![](../images/2024-QWBCTF/img_15.webp)

对应格式的hash：

Expand Down Expand Up @@ -1682,7 +1687,7 @@ babygirl2339347013182

## 签到

![img](../images/2024-QWBCTF/img_18.webp)
![](../images/2024-QWBCTF/img_18.webp)

## 问卷调查

Expand Down Expand Up @@ -1764,25 +1769,25 @@ for thread in threads:

suid dd 读 /flag

![img](../images/2024-QWBCTF/img_11.webp)
![](../images/2024-QWBCTF/img_11.webp)

## xiaohuanxiong

search 传 keyword 直接就有 sql 注入

![img](../images/2024-QWBCTF/img_13.webp)
![](../images/2024-QWBCTF/img_13.webp)

![img](../images/2024-QWBCTF/img_27.webp)
![](../images/2024-QWBCTF/img_27.webp)

注册账号之后，直接拿 sqlmap 做注入

另外注册一个空密码的账号，通过 sql 注入查询加密之后的密码哈希，进行 md5 解密可以直接拿到 salt 是 bf3a27

![img](../images/2024-QWBCTF/img_31.webp)
![](../images/2024-QWBCTF/img_31.webp)

利用 salt 进而爆破管理员的密码

![img](../images/2024-QWBCTF/img_24.webp)
![](../images/2024-QWBCTF/img_24.webp)

```Python
import hashlib
Expand All @@ -1804,13 +1809,13 @@ for length in range(1, max_length + 1):

爆破 admin 密码（还真能爆破，真蠢啊

![img](../images/2024-QWBCTF/img_8.webp)
![](../images/2024-QWBCTF/img_8.webp)

后台找一个洞，拼接写🐎

![img](../images/2024-QWBCTF/img_30.webp)
![](../images/2024-QWBCTF/img_30.webp)

![img](https://s1um4i-official.feishu.cn/space/api/box/stream/download/asynccode/?code=MjY3ODc3MzVhOTExYzk4MzhmMmMxMTE4MDQxZGY2OTdfMG1tOFVXNjU2djdrdGxseFZiWTBwV3RMbEVZWGc3MFBfVG9rZW46Tml3QmJWRHV4b29KRFV4YnpvUWNnYkg1bkdjXzE3MzA2NDg5NzQ6MTczMDY1MjU3NF9WNA)
![](https://s1um4i-official.feishu.cn/space/api/box/stream/download/asynccode/?code=MjY3ODc3MzVhOTExYzk4MzhmMmMxMTE4MDQxZGY2OTdfMG1tOFVXNjU2djdrdGxseFZiWTBwV3RMbEVZWGc3MFBfVG9rZW46Tml3QmJWRHV4b29KRFV4YnpvUWNnYkg1bkdjXzE3MzA2NDg5NzQ6MTczMDY1MjU3NF9WNA)

## platform

Expand Down Expand Up @@ -1846,9 +1851,9 @@ while True:
break
```

![img](../images/2024-QWBCTF/img_26.webp)
![](../images/2024-QWBCTF/img_26.webp)

![img](../images/2024-QWBCTF/img_10.webp)
![](../images/2024-QWBCTF/img_10.webp)

## snake

Expand All @@ -1864,13 +1869,13 @@ python3 sqlmap.py -r 1.txt --dbms=sqlite --level 2 --threads 8 --tables
+-----------------+
```

![img](../images/2024-QWBCTF/img_2.webp)
![](../images/2024-QWBCTF/img_2.webp)

第二关脑洞就 SQL注入+ SSTI

![img](../images/2024-QWBCTF/img_29.webp)
![](../images/2024-QWBCTF/img_29.webp)

![img](../images/2024-QWBCTF/img_17.webp)
![](../images/2024-QWBCTF/img_17.webp)

## Proxy

Expand Down Expand Up @@ -1960,11 +1965,11 @@ if(strpos($user->username, "admin") == 0 && $user->password == "2024qwb"){

Filter 这样子绕过

![img](../images/2024-QWBCTF/img_9.webp)
![](../images/2024-QWBCTF/img_9.webp)

还不能超过 170 md（需要删掉序列化中一些无用的变量）

![img](../images/2024-QWBCTF/img_6.webp)
![](../images/2024-QWBCTF/img_6.webp)

```PHP
$obj = new root();
Expand All @@ -1981,7 +1986,7 @@ echo serialize($obj);
echo "\n";
```

![img](../images/2024-QWBCTF/img_16.webp)
![](../images/2024-QWBCTF/img_16.webp)

## Playground

Expand Down
Binary file added source/images/2024-QWBCTF/img_32.webp
View file
Binary file not shown.
Binary file added source/images/2024-QWBCTF/img_33.webp
View file
Binary file not shown.

0 comments on commit 2e0c86c

Please sign in to comment.