<?xml version="1.0" encoding="utf-8" ?><rss version="2.0"><channel><title><![CDATA[wp568的博客]]></title><description><![CDATA[]]></description><link>https://blog.youkuaiyun.com/wp568</link><language>zh-cn</language><generator>https://blog.youkuaiyun.com/</generator><copyright><![CDATA[Copyright &copy; wp568]]></copyright><item><title><![CDATA[NewStarCTF 2023 公开赛道 WEEK2|WEB 游戏高手]]></title><link>https://blog.youkuaiyun.com/wp568/article/details/133951661</link><guid>https://blog.youkuaiyun.com/wp568/article/details/133951661</guid><author>wp568</author><pubDate>Fri, 20 Oct 2023 18:15:50 +0800</pubDate><description><![CDATA[打开控制台，输入 gameScore = 1000000，回车。app_v2.js就是游戏文件。]]></description><category></category></item><item><title><![CDATA[NewStarCTF 2023 公开赛道 WEEK2|MISC1-序章]]></title><link>https://blog.youkuaiyun.com/wp568/article/details/133951557</link><guid>https://blog.youkuaiyun.com/wp568/article/details/133951557</guid><author>wp568</author><pubDate>Fri, 20 Oct 2023 17:57:12 +0800</pubDate><description><![CDATA[看起来是sql注入日志，盲注类型，而且已经是注入在最后一步，获取字段内容了。可以从日志里提取注入信息。]]></description><category></category></item><item><title><![CDATA[NewStarCTF 2023 WEEK1|PWN ret2text]]></title><link>https://blog.youkuaiyun.com/wp568/article/details/133689891</link><guid>https://blog.youkuaiyun.com/wp568/article/details/133689891</guid><author>wp568</author><pubDate>Sun, 08 Oct 2023 21:00:49 +0800</pubDate><description><![CDATA[main函数，里read函数，分配了32（0x20）个大小 指定了0x100，有栈溢出漏洞。查看起始地址 为4011FB。]]></description><category></category></item><item><title><![CDATA[buuctf PWN ciscn_2019_c_1]]></title><link>https://blog.youkuaiyun.com/wp568/article/details/133684753</link><guid>https://blog.youkuaiyun.com/wp568/article/details/133684753</guid><author>wp568</author><pubDate>Sun, 08 Oct 2023 16:40:06 +0800</pubDate><description><![CDATA[amd64的参数调用顺序是如下序列的自后而前，即：完成传递参数（地址）->本函数地址 -> 返回地址。encrypt()里面的get()可以溢出，栈大小为50h。puts()可以用来泄露libc基址。]]></description><category></category></item><item><title><![CDATA[buuctf PWN jarvisoj_level2]]></title><link>https://blog.youkuaiyun.com/wp568/article/details/133623487</link><guid>https://blog.youkuaiyun.com/wp568/article/details/133623487</guid><author>wp568</author><pubDate>Fri, 06 Oct 2023 22:40:54 +0800</pubDate><description><![CDATA[漏洞，buf数组只给了0x88的大小，但是最多可以读入0x100个字节的数据，所以多读入的数据就会向下把栈给覆盖掉。把function函数的返回地址覆盖成system函数的入口地址，然后把参数改成"bin/sh"字符串的地址0x0804A024。地址为：0x0804845C。地址为：0x0804849E。]]></description><category></category></item><item><title><![CDATA[[第五空间2019 决赛]PWN5]]></title><link>https://blog.youkuaiyun.com/wp568/article/details/133617248</link><guid>https://blog.youkuaiyun.com/wp568/article/details/133617248</guid><author>wp568</author><pubDate>Fri, 06 Oct 2023 18:45:15 +0800</pubDate><description><![CDATA[找到储存密码的地方为0x0804C044，我们一个字节一个字节的存入，所以不能是直接用0x0804C044，而是是用四个地址0x0804C044，0x0804C045，0x0804C046，0x0804C047，前面的四个构造地址总长度为4 * 4字节，构造b'%10$hhn%11$hhn%12$hhn%13$hhn'， 单次打印%n = 0x00000010是小端序, 导致0x10在高字节, 连续四次打印都覆盖了前面的三个字节, 最终值为 0x10101010。]]></description><category></category></item><item><title><![CDATA[buuctf pwn1_sctf_2016]]></title><link>https://blog.youkuaiyun.com/wp568/article/details/133578245</link><guid>https://blog.youkuaiyun.com/wp568/article/details/133578245</guid><author>wp568</author><pubDate>Thu, 05 Oct 2023 11:35:24 +0800</pubDate><description><![CDATA[看到有.‘rodata:0000000000400684    00000008    C    /bin/sh’，点进去看。read()并没有限制输入，显然存在栈溢出漏洞。存在后门函数，函数起始位置400596。拖入IDA，shift+F12查看。]]></description><category></category></item><item><title><![CDATA[buuctf PWN warmup_csaw_2016]]></title><link>https://blog.youkuaiyun.com/wp568/article/details/133557229</link><guid>https://blog.youkuaiyun.com/wp568/article/details/133557229</guid><author>wp568</author><pubDate>Wed, 04 Oct 2023 17:35:04 +0800</pubDate><description><![CDATA[发现函数gets(v5)，是栈溢出。查看程序起始地址0x40060D。发现直接有显示flag函数。看到v5占用64个位置。下载附件，IDA查看。]]></description><category></category></item><item><title><![CDATA[buuctf PWN rip]]></title><link>https://blog.youkuaiyun.com/wp568/article/details/133555477</link><guid>https://blog.youkuaiyun.com/wp568/article/details/133555477</guid><author>wp568</author><pubDate>Wed, 04 Oct 2023 16:42:56 +0800</pubDate><description><![CDATA[fun函数的地址是0x401186。下载pwn1 用IDA打开。]]></description><category></category></item><item><title><![CDATA[buuctf pwn test_your_nc]]></title><link>https://blog.youkuaiyun.com/wp568/article/details/133500203</link><guid>https://blog.youkuaiyun.com/wp568/article/details/133500203</guid><author>wp568</author><pubDate>Mon, 02 Oct 2023 21:02:10 +0800</pubDate><description><![CDATA[nc是个linux上的指令。下载test文件，使用。输入cat flag。]]></description><category></category></item><item><title><![CDATA[buuctf 流量！鲨鱼]]></title><link>https://blog.youkuaiyun.com/wp568/article/details/133466879</link><guid>https://blog.youkuaiyun.com/wp568/article/details/133466879</guid><author>wp568</author><pubDate>Sun, 01 Oct 2023 17:16:45 +0800</pubDate><description><![CDATA[使用http contains "cmd"进行筛选。进行两次base64解密，得到flag。使用工具WireShark的抓包筛选。发现了有远程命令行执行 RCE。右键，追踪流，http流。得到base64加密的。下载题目是个流量文件。]]></description><category></category></item><item><title><![CDATA[buuctf Begin of PHP]]></title><link>https://blog.youkuaiyun.com/wp568/article/details/133445255</link><guid>https://blog.youkuaiyun.com/wp568/article/details/133445255</guid><author>wp568</author><pubDate>Sat, 30 Sep 2023 23:57:56 +0800</pubDate><description><![CDATA[is_numeric($num)函数绕过。]]></description><category></category></item><item><title><![CDATA[buuctf AndroXor]]></title><link>https://blog.youkuaiyun.com/wp568/article/details/133438168</link><guid>https://blog.youkuaiyun.com/wp568/article/details/133438168</guid><author>wp568</author><pubDate>Sat, 30 Sep 2023 18:07:50 +0800</pubDate><description><![CDATA[xor函数为我们要逆向的函数，str就是我们要求的flag，str2为。使用工具jadx-gui-1.2.0打开。]]></description><category></category></item><item><title><![CDATA[buuctf babyaes]]></title><link>https://blog.youkuaiyun.com/wp568/article/details/133432389</link><guid>https://blog.youkuaiyun.com/wp568/article/details/133432389</guid><author>wp568</author><pubDate>Sat, 30 Sep 2023 13:43:11 +0800</pubDate><description><![CDATA[所以异或的结果高16为bytes、128位bits不变，key又是两个bytes重复16次所以，它的高128位bits和低128位bits是一样的。AES加密算法全称是Advanced Encryption Standard（高级加密标准），是最为常见的对称加密算法之一。可知key是256bits，iv是128bits。然后再把key异或x就得到了iv。]]></description><category></category></item><item><title><![CDATA[[watevrCTF-2019]Cookie Store]]></title><link>https://blog.youkuaiyun.com/wp568/article/details/133313011</link><guid>https://blog.youkuaiyun.com/wp568/article/details/133313011</guid><author>wp568</author><pubDate>Tue, 26 Sep 2023 16:02:40 +0800</pubDate><description><![CDATA[对eyJtb25leSI6IDUwLCAiaGlzdG9yeSI6IFtdfQ==进行解码，发现是base64。2    解码结果：        {"money": 50, "history": []}要得到flag，必须购买最后一项，发现钱不够，那么我们修改。购买第一个发现，cookie值为。进行base64加密。]]></description><category></category></item><item><title><![CDATA[[红明谷CTF 2021]write_shell]]></title><link>https://blog.youkuaiyun.com/wp568/article/details/133282066</link><guid>https://blog.youkuaiyun.com/wp568/article/details/133282066</guid><author>wp568</author><pubDate>Mon, 25 Sep 2023 22:40:25 +0800</pubDate><description><![CDATA[意思是在/sandbox/c55e0cb61f7eb238df09ae30a206e5ee中的index.php写入data数据。过滤单引号，可以使用反引号绕过，在php中，被反引号包裹的代码会被当做。waf 过滤了’ 空格 _ php;]]></description><category></category></item><item><title><![CDATA[[GWCTF 2019]枯燥的抽奖]]></title><link>https://blog.youkuaiyun.com/wp568/article/details/133274714</link><guid>https://blog.youkuaiyun.com/wp568/article/details/133274714</guid><author>wp568</author><pubDate>Mon, 25 Sep 2023 19:13:14 +0800</pubDate><description><![CDATA[现在知道十个字符，那就可以通过工具php_mt_seed爆破 seed。使用php_mt_seed爆破seed得到：455472525。先用生成已知的十个字符“oS7tocGlzN”的格式为。F12查看 ，发现check.php。再把种子放进php程序中，生成字符串。]]></description><category></category></item><item><title><![CDATA[[CISCN2019 华北赛区 Day1 Web2]ikun]]></title><link>https://blog.youkuaiyun.com/wp568/article/details/133240877</link><guid>https://blog.youkuaiyun.com/wp568/article/details/133240877</guid><author>wp568</author><pubDate>Sun, 24 Sep 2023 16:39:40 +0800</pubDate><description><![CDATA[URL解码:        \u8fd9\u7f51\u7ad9\u4e0d\u4ec5\u53ef\u4ee5\u4ee5\u8585\u7f8a\u6bdb\uff0c\u6211\u8fd8\u7559\u4e86\u4e2a\u540e\u95e8\uff0c\u5c31\u85cf\u5728\u006c\u0076\u0036\u91cc。使用了JWT身份验证，这里用户名为tt，密码为123，用解密工具：c-jwt-cracker试着爆破一下。题目提示 ，一定要找到lv6！]]></description><category></category></item><item><title><![CDATA[[WUSTCTF2020]CV Maker]]></title><link>https://blog.youkuaiyun.com/wp568/article/details/133179555</link><guid>https://blog.youkuaiyun.com/wp568/article/details/133179555</guid><author>wp568</author><pubDate>Fri, 22 Sep 2023 17:58:53 +0800</pubDate><description><![CDATA[把名字 1juhua.php.jpg的末尾.jpg去掉上传，得到文件上传地址uploads/d41d8cd98f00b204e9800998ecf8427e.php。将这段代码粘贴到txt，文件另存为1juhua.php.jpg，然后用burpsuit 上传抓包。证明一句话图片码上传成功，利用中国蚁剑连接。发现可以上传图片，试试图片码🐎，先注册一个账号，然后登录。]]></description><category></category></item><item><title><![CDATA[[CSCCTF 2019 Qual]FlaskLight]]></title><link>https://blog.youkuaiyun.com/wp568/article/details/133046349</link><guid>https://blog.youkuaiyun.com/wp568/article/details/133046349</guid><author>wp568</author><pubDate>Tue, 19 Sep 2023 22:12:27 +0800</pubDate><description><![CDATA[F12看源码bp抓包由此判断为jinja2模板注入1. 获取配置{{config}}?]]></description><category></category></item></channel></rss>