其他CTF題目(記錄備忘)
阿新 • • 發佈:2019-01-31
/message.php?id=1 AND ORD(MID((SELECT IFNULL(CAST(`value` AS CHAR),0x20) FROM isg.flags ORDER BY `value` LIMIT 0,1),34,1))>1
首先將pcap包的字串匯出,指令為:
strings sqlmap.pcap | grep isg.flags > 11.txt
將前面的幾行去掉,從正式猜解句:GET /message.php?id=1 AND ORD(MID((SELECT IFNULL(CAST(value
AS CHAR),0x20) FROM isg.flags ORDER BY value
Message #1 AND ORD(MID((SELECT IFNULL(CAST(`value` AS CHAR),0x20) FROM isg.flags ORDER BY `value` LIMIT 0,1),1,1))>64: The quick brown fox jumps over the lazy dog
若條件成立,則會顯示後面的The quick brown fox jumps over the lazy dog,若不成功則不顯示。讀取每個檔案的內容儲存為12.txt
編寫程式碼如下:
import re
import os
f=open("12.txt",'w')
files = os.listdir()
for name in files:
f1=open(name,'r')
x=f1.read()
f.write(x+"\n")
f1.close()
f.close()
f=open("11.txt",'r')
f1=open("12.txt",'r')
content=f1.read()
f1.close()
fw=open("13.txt",'w')
lastpos,nowpos=1,1
lastchar,nowchar=64 ,64
lastline=''
flags=''
for l in f.readlines():
m=re.search(r"%29%2C(\d+)%2C\S*%3E(\d+)\s",l) #匹配字元位置和比較數
if m:
nowchar=int(m.group(2))
nowpos=int(m.group(1))
d="%d,1\S*%d:\s(\S+)"%(lastpos,lastchar) #匹配後面的The quick....
m1=re.search(d,content)
if(nowpos!=lastpos):
if(m1):
fw.write("%d:%c,,,%s\n"%(lastpos,chr(lastchar),m1.group(1)))
flags+=chr(lastchar+1) #匹配了,說明>條件成立,故字元+1
else:
fw.write("%d:%c\n"%(lastpos,chr(lastchar)))#不匹配,說明不成功,不需加1
flags+=chr(lastchar)
lastline=l
lastpos=nowpos
lastchar=nowchar
f.close()
fw.close()
print flags
得到key為ISG{BLind_SQl_InJEcTi0N_DeTEcTEd}
另外,還有種方法,可以直接分析pcap檔案,找到資料位置,按照gzip解壓再匹配識別:
import zlib
import re
f=open('sqlmap.pcap','rb')
c=f.read()
f.close()
mlist=re.finditer(r"Content-Length: (\d+)",c)
lastpos,nowpos=1,1
lastchar,nowchar=64,64
lastline=''
flags=''
for mx in mlist:
if(int(mx.group(1))<100):#長度小於100,應該不是需要的字串
continue
mc=c[mx.span()[1]+48:mx.span()[1]+48+int(mx.group(1))]#按照content-length長度來讀取相應字元數
content=zlib.decompress(mc,16+zlib.MAX_WBITS)#gzip解壓
#print content
m=re.search('0,1\),(\d+).*>(\d+):',content) #匹配判斷的字元和字元位置
if(m is None):
continue
nowchar=int(m.group(2)) #當前判斷的字元ACII值
nowpos=int(m.group(1)) #位置
if(nowpos!=lastpos): #跳到下個字元位置,說明該位置判斷已結束
d=">\d+:\s(\S+)"#匹配後面的The quick....
m1=re.search(d,lastline)#儲存的上一行中尋找
if m1 is not None:
flags+=chr(lastchar+1) #匹配到後面的Fox
else:
flags+=chr(lastchar) #未匹配到Fox
lastpos=nowpos
lastchar=nowchar
lastline=content
print 'Flag is '+flags
#Flag is ISG{BLind_SQl_InJEcTi0N_DeTEcTEd}
2、ISG 2014:哼
給了一個圖片,binwalk發現有兩張圖
@kali:~/Desktop$ binwalk final.png
DECIMAL HEXADECIMAL DESCRIPTION
-------------------------------------------------------------
0 0x0 PNG image, 1440 x 900, 8-bit/color RGB, non-interlaced
41 0x29 Zlib compressed data, default compression, uncompressed size >= 98304
1922524 0x1D55DC PNG image, 1440 x 900, 8-bit/color RGB, non-interlaced
1922565 0x1D5605 Zlib compressed data, default compression, uncompressed size >= 98304
有兩張圖片,第二張圖offset起始位置為0x1D55DC
用winhex將第二張圖摳出來,用stegsolve比較兩張圖片,做一下異或,發現存在少許差異,差異位置在0x1110~1330附近。在第二張圖片儲存為bmp位置,摳出對應位置的資料儲存為一個檔案ccc。將其中的00,01摳出來,再00轉化為’0’,01轉化為’1’,最後二進位制轉成字串即可。
編寫py程式碼:
f=open('ccc','rb')
x=list(f.read())
aa=''.join(str(ord(i)) for i in x if ord(i) in [0,1])
b='%x'%(int(aa,2))
print 'Flag:'+b.decode('hex')
#得到Flag:ISG{E4sY_StEg4n0gR4pHy}
f.close()