2019安恒2月月赛Writeip-Web&Crypto&Misc Secer's Blog - 记录互联网安全历程与个人成长经历

前言

周末叕刷了安恒月赛，以下是Web&Crypto&Misc题解记录

Web

babycms

打开题目，发现是Yii2框架写的平台，首先进行信息搜集，得到源码泄露

101.71.29.5:10015/web.zip

审计代码，发现/views/medicine/view.php存在反序列化操作

寻找可利用类，查看composer.json，发现存在RCE漏洞组件

利用phpggc，可以看到有对应版本的攻击

查看文件运行路径

尝试文件目录

/var/www/html/runtime

直接使用

phpggc SwiftMailer/FW3 /var/www/html/runtime/sky.php ~/Desktop/sky.php -b

得到payload

同时发现登录密码

登入后，即可使用payload getshell拿到flag

Misc

来玩个游戏吧

第一关一看就知道是盲文加密

使用在线网站解密

https://www.qqxiuzi.cn/bianma/wenbenjiami.php?s=mangwen

⠏⠏⠄⠁⠄⠀⠂⡑⡒⡓⠄⡒⠂⡑⠇⠆⡒⠉⠇⠁⠉⡔⠉⠁⠁⠀⠁⠇⡓⠅⠉⠂=

得到结果

??41402abc4b2a76b9719d911017c592

发现是开头未知2位的md5，扔到百度去

发现是hello，提交通过第一关，第二关是一个md5碰撞，我们使用github的项目

python3 gen_coll_test.py

得到几百个相同md5的文件，随便挑选两个

得到最后一步

Dear Professional ; Especially for you - this cutting-edge 
intelligence ! If you no longer wish to receive our 
publications simply reply with a Subject: of "REMOVE" 
and you will immediately be removed from our club . 
This mail is being sent in compliance with Senate bill 
2216 , Title 9 ; Section 306 ! THIS IS NOT MULTI-LEVEL 
MARKETING . Why work for somebody else when you can 
become rich as few as 35 weeks . Have you ever noticed 
more people than ever are surfing the web and people 
will do almost anything to avoid mailing their bills 
. Well, now is your chance to capitalize on this ! 
WE will help YOU decrease perceived waiting time by 
120% & decrease perceived waiting time by 140% . You 
can begin at absolutely no cost to you . But don't 
believe us ! Mrs Jones of Minnesota tried us and says 
"I was skeptical but it worked for me" . We assure 
you that we operate within all applicable laws . Because 
the Internet operates on "Internet time" you must act 
now ! Sign up a friend and your friend will be rich 
too . Warmest regards . Dear Cybercitizen , We know 
you are interested in receiving red-hot announcement 
! We will comply with all removal requests ! This mail 
is being sent in compliance with Senate bill 1619 ; 
Title 2 ; Section 301 . This is NOT unsolicited bulk 
mail ! Why work for somebody else when you can become 
rich within 53 MONTHS ! Have you ever noticed more 
people than ever are surfing the web and more people 
than ever are surfing the web . Well, now is your chance 
to capitalize on this . We will help you use credit 
cards on your website plus decrease perceived waiting 
time by 150% . The best thing about our system is that 
it is absolutely risk free for you ! But don't believe 
us ! Mrs Simpson of Washington tried us and says "Now 
I'm rich, Rich, RICH" . We assure you that we operate 
within all applicable laws ! We beseech you - act now 
! Sign up a friend and your friend will be rich too 
. Thank-you for your serious consideration of our offer 
! Dear Friend ; This letter was specially selected 
to be sent to you ! If you no longer wish to receive 
our publications simply reply with a Subject: of "REMOVE" 
and you will immediately be removed from our mailing 
list . This mail is being sent in compliance with Senate 
bill 2716 , Title 2 ; Section 306 ! This is a ligitimate 
business proposal . Why work for somebody else when 
you can become rich inside 33 weeks . Have you ever 
noticed more people than ever are surfing the web plus 
more people than ever are surfing the web . Well, now 
is your chance to capitalize on this ! WE will help 
YOU SELL MORE and process your orders within seconds 
. You can begin at absolutely no cost to you . But 
don't believe us ! Mrs Jones of Kentucky tried us and 
says "I was skeptical but it worked for me" ! This 
offer is 100% legal ! We implore you - act now . Sign 
up a friend and you'll get a discount of 50% . God 
Bless .

根据题目描述信息，google一下”垃圾邮件+栅格密码”，得到解密网站http://www.spammimic.com/decode.shtml进行解密得到

flag{a0dd1e2e6b87fe47e5ad0184dc291e04}

非常简单的流量分析

下载附件，打开流量包过滤http

发现robots.txt，进一步分析发现robots.txt，发现存在abc.html

继续分析abc.html

http contains "abc.html"

得到md5字符串和两串DES

md5 0x99a98e067af6b09e64f3740767096c96

DES 0xb19b21e80c685bcb052988c11b987802d2f2808b2c2d8a0d    (129->143)

DES 0x684a0857b767672d52e161aa70f6bdd07c0264876559cb8b    (143->129)

继续往下分析

发现都是IPSec加密后的流量，尝试使用wireshark和前面的信息进行还原

还原之后发现http带着ascii码，尝试拼接前几个，为flag

于是将38个asiic码提取出来，然后拼接

a = [102,108,97,103,123,50,55,98,48,51,98,55,53,56,102,50,53,53,50,55,54,101,53,97,57,56,100,97,48,101,49,57,52,55,98,101,100,125]
res = ''
for i in a:
    res +=chr(i)
print res

Crypto

密码本

拿到题目信息

这个密码本本该只使用一次的，但是却使用了多次，导致密文易被破解
经过一番尝试发现，秘钥的首字母很可能是y，剩下的就靠你了

cip1: rlojsfklecby
cip2: ulakqfgfsjlu
cip3: dpaxwxtjgtay

寻找首字母为y的单词，尝试一下year

key = 'year'
c1 = 'rlojsfklecby'
c2 = 'ulakqfgfsjlu'
c3 = 'dpaxwxtjgtay'
res1 = ''
res2 = ''
res3 = ''
for i in range(len(key)):
    res1+=chr((((ord(c1[i])-ord('a'))-(ord(key[i])-ord('a')))%26)+ord('a'))
    res2+=chr((((ord(c2[i])-ord('a'))-(ord(key[i])-ord('a')))%26)+ord('a'))
    res3+=chr((((ord(c3[i])-ord('a'))-(ord(key[i])-ord('a')))%26)+ord('a'))
print res1
print res2
print res3

得到结果

thos
what
flag

看到thos，猜测下一个是e，即those，测试了一下，发现key此时为yearo
得到结果为

those
whatc
flagi

估摸着下一个应该是s，毕竟flagis，继续探测出，此时为yearof，得到结果

thosea
whatca
flagis

此时没有了头绪，去词典搜一下

尝试了一下，发现key到yearofthe为止是有意义的，结果为

thosearea
whatcanyo
flagisacc

看第二个明文，猜测下一个是u，因为what can you，测试得到key为yearofthep，明文为

thosearean
whatcanyou
flagisacce

猜测第3个明文是flagisaccess，此时key为yearofthepig，解出明文

thoseareants
whatcanyoudo
flagisaccess

我真是服了这个出题人了………………

hahaha

拿到题目发现是CRC32爆破，使用工具进行如下破解

得到压缩包密码为：

tanny_is_very_beautifu1_

解密后拿到flag.pdf，得到如下信息

需要我们进行排列组合，得到结果的Sha1为

e6079c5ce56e781a50f4bf853cdb5302e0d8f054

排列组合大致如下

1!
2@
{[
}]
asefcghnl

直接刚可能性太多，这里我们知道应该是flag{}样式，所以缩小范围为

1!
2@
sechn

编写如下脚本

import itertools
import hashlib

def sha1(str):
    sha = hashlib.sha1(str)
    encrypts = sha.hexdigest()
    return encrypts
a1 = '1!'
a2 = '2@'
a3 = '{'
a4 = '}'
for str1 in itertools.combinations(a1,1):
    for str2 in itertools.combinations(a2,1):
        str3 = str1[0]+str2[0]+'sechn'
        for i in itertools.permutations(str3):
            tmp = (''.join(i))
            res = 'flag{'+tmp+'}'
            # print sha1(res)
            if sha1(res) == 'e6079c5ce56e781a50f4bf853cdb5302e0d8f054':
                print res
                break

运行后得到flag

flag{sh@1enc}