湖湘杯2020 writeup

这个平台中间卡的离谱，卡完过后交了flag分还掉了

Web

题目名字不重要

也算是非预期吧，赛后y1ng师傅也说了因为要多端口环境必须这样配，预期解很难

NewWebsite

后台弱口令admin admin登进去是个假后台，啥功能点不动，登录的地方有sql注入

--os-shell写shell写不进去

后面找到真后台，r参数那里要改

.php3绕过后缀名限制

传上去会重命名

蚁剑连上去，flag在根目录

Misc

passwd

aad3b435b51404eeaad3b435b51404ee : 0a640404b5c386ab12092587fe19cd02

然后去这个网站解密：

https://www.objectif-securite.ch/ophcrack

解出明文：qwer1234

再去sha1

颜文字之谜

流量包提取出index-demo.html

解html里的base64

KO+8oF/vvKA7KSjvvKBf77ygOyko77ygX++8oDspCr==
KCtfKyk/KOOAgj7vuL88KV/OuCjjgII+77i/PClfzrgK
bygq77+j4pa977+jKinjg5bjgpwK
77yc77yI77y+77yN77y+77yJ77yeKOKVr+KWveKVsCAp5aW96aaZfn4K
44O9KOKcv+++n+KWve++nynjg44o77yg77y+77yQ77y+KQp=
KF5e44Kezqgo77+j4oiA77+jKc6oKuKYhSzCsCo6LuKYhijvv6Pilr3vv6MpLyQ6Ki7CsOKYhSog44CCCp==
flwo4omn4pa94ommKS9+byhe4pa9XilvKMKs4oC/wqwpKCriiafvuLbiiaYpKSjvv6Pilr3vv6MqICnjgp7ilLPilIHilLMo4pWv4oC14pah4oCyKeKVr++4teKUu+KUgeKUuwp=
4pSz4pSB4pSzIOODjigg44KcLeOCnOODjingsqBf4LKgCn==
4LKgX+CyoCjila/igLXilqHigLIp4pWv54K45by577yB4oCi4oCi4oCiKu+9nuKXjyjCrF/CrCApCp==
KOODjuOBuO+/o+OAgSlvKO+/o+KUsO+/oyop44Ke4pWwKOiJueeav+iJuSAp77yI77i2Xu+4tu+8iSgqIO+/o++4v++/oyko77+jzrUoI++/oykK
KO++n9CU776fKinvvonil4t877+jfF8gPTMo44OO772A0JQp44OOKOKAstC0772Az4Mpz4Mo77+i77i/zKvMv++/ouKYhinvvZ4o44CAVOODrVQpz4M8KCDigLXilqHigLIpPuKUgOKUgAo=
KMKsX8KsIiko77+j77mP77+j77ybKSjila/CsOKWocKw77yJ4pWv77i1IOKUu+KUgeKUu+ODvSjjgpzilr3jgpzjgIAp77yNQzwoLzvil4c7KS9+KOODmO+9pV/vvaUp44OY4pSz4pSB4pSzCu==
4LKgX+CyoCjila/igLXilqHigLIp4pWv54K45by577yB4oCi4oCi4oCiKu+9nuKXjyjCrF/CrCApCo==
KOKKmcuN4oqZKe+8nyjPg++9gNC04oCyKc+DPCgg4oC14pah4oCyKT7ilIDilIDilIDvvKPOtSjilKzvuY/ilKwpMzwoIOKAteKWoeKAsinilIDilIDilIBD77yc4pSAX19fLSl8fO+9nijjgIBU44OtVCnPgyjjgIMK
4oqZ77mP4oqZ4oil44O9KCrjgII+0JQ8KW/jgpwvKOOEkm/jhJIpL35+KCNfPC0p77yI77ye5Lq677yc77yb77yJCo==
KOODjuOBuO+/o+OAgSlvKO+/o+KUsO+/oyop44Ke4pWwKOiJueeav+iJuSAp77yI77i2Xu+4tu+8iSgqIO+/o++4v++/oyko77+jzrUoI++/oykK
KO++n9CU776fKinvvonil4t877+jfF8gPTMo44OO772A0JQp44OOKOKAstC0772Az4Mpz4Mo77+i77i/zKvMv++/ouKYhinvvZ4o44CAVOODrVQpz4M8KCDigLXilqHigLIpPuKUgOKUgAq=
KOKKmcuN4oqZKe+8nyjPg++9gNC04oCyKc+DPCgg4oC14pah4oCyKT7ilIDilIDilIDvvKPOtSjilKzvuY/ilKwpMzwoIOKAteKWoeKAsinilIDilIDilIBD77yc4pSAX19fLSl8fO+9nijjgIBU44OtVCnPgyjjgIPvvJ7nm67vvJwpCm==
KG/vvp92776fKeODjmQ9PT09PSjvv6Pilr3vv6MqKWLOtT3OtT3OtT0ofu+/o+KWve+/oyl+KOKdpCDPiSDinaQpVeKAouOCp+KAoipVCs==
KO++n9CU776fKinvvonil4t877+jfF8gPTMo44OO772A0JQp44OOKOKAstC0772Az4Mpz4Mo77+i77i/zKvMv++/ouKYhinvvZ4o44CAVOODrVQpz4M8KCDigLXilqHigLIpPuKUgOKUgAp=
KOKKmcuN4oqZKe+8nyjPg++9gNC04oCyKc+DPCgg4oC14pah4oCyKT7ilIDilIDilIDvvKPOtSjilKzvuY/ilKwpMzwoIOKAteKWoeKAsinilIDilIDilIBD77yc4pSAX19fLSl8fO+9nijjgIBU44OtVCnPgyjjgIPvvJ7nm67vvJwpCr==
KG/vvp92776fKeODjmQ9PT09PSjvv6Pilr3vv6MqKWLOtT3OtT3OtT0ofu+/o+KWve+/oyl+KOKdpCDPiSDinaQpVeKAouOCp+KAoipVCt==
KO++n9CU776fKinvvonil4t877+jfF8gPTMo44OO772A0JQp44OOKOKAstC0772Az4Mpz4Mo77+i77i/zKvMv++/ouKYhinvvZ4o44CAVOODrVQpz4M8KCDigLXilqHigLIpPuKUgOKUgAr=
KOKKmcuN4oqZKe+8nyjPg++9gNC04oCyKc+DPCgg4oC14pah4oCyKT7ilIDilIDilIDvvKPOtSjilKzvuY/ilKwpMzwoIOKAteKWoeKAsinilIDilIDilIBD77yc4pSAX19fLSl8fO+9nijjgIBU44OtVCnPgyjjgIPvvJ7nm67vvJwpCi==
KG/vvp92776fKeODjmQ9PT09PSjvv6Pilr3vv6MqKWLOtT3OtT3OtT0ofu+/o+KWve+/oyl+KOKdpCDPiSDinaQpVeKAouOCp+KAoipVCn==
KO++n9CU776fKinvvonil4t877+jfF8gPTMo44OO772A0JQp44OOKOKAstC0772Az4Mpz4Mo77+i77i/zKvMv++/ouKYhinvvZ4o44CAVOODrVQpz4M8KCDigLXilqHigLIpPuKUgOKUgAo=
KOKKmcuN4oqZKe+8nyjPg++9gNC04oCyKc+DPCgg4oC14pah4oCyKT7ilIDilIDilIDvvKPOtSjilKzvuY/ilKwpMzwoIOKAteKWoeKAsinilIDilIDilIBD77yc4pSAX19fLSl8fO+9nijjgIBU44OtVCnPgyjjgIPvvJ7nm67vvJwpCp==
KG/vvp92776fKeODjmQ9PT09PSjvv6Pilr3vv6MqKWLOtT3OtT3OtT0ofu+/o+KWve+/oyl+KOKdpCDPiSDinaQpVeKAouOCp+KAoipVCq==
KG/vvp92776fKeODjmQ9PT09PSjvv6Pilr3vv6MqKWLOtT3OtT3OtT0ofu+/o+KWve+/oyl+KOKdpCDPiSDinaQpVeKAouOCp+KAoipVCl==
KO++n9CU776fKinvvonil4t877+jfF8gPTMo44OO772A0JQp44OOKOKAstC0772Az4Mpz4Mo77+i77i/zKvMv++/ouKYhinvvZ4o44CAVOODrVQpz4M8KCDigLXilqHigLIpPuKUgOKUgAq=
KOKKmcuN4oqZKe+8nyjPg++9gNC04oCyKc+DPCgg4oC14pah4oCyKT7ilIDilIDilIDvvKPOtSjilKzvuY/ilKwpMzwoIOKAteKWoeKAsinilIDilIDilIBD77yc4pSAX19fLSl8fO+9nijjgIBU44OtVCnPgyjjgIPvvJ7nm67vvJwpCl==
KG/vvp92776fKeODjmQ9PT09PSjvv6Pilr3vv6MqKWLOtT3OtT3OtT0ofu+/o+KWve+/oyl+KOKdpCDPiSDinaQpVeKAouOCp+KAoipVCi==
KOKVr+KAteKWoeKAsinila/ngrjlvLnvvIHigKLigKLigKIK
KOKVr+KAteKWoeKAsinila/ngrjlvLnvvIHigKLigKLigKIK
KOKVr+KAteKWoeKAsinila/ngrjlvLnvvIHigKLigKLigKIK
KOKVr+KAteKWoeKAsinila/ngrjlvLnvvIHigKLigKLigKIo4pWv4oC14pah4oCyKeKVr+eCuOW8ue+8geKAouKAouKAoijila/igLXilqHigLIp4pWv54K45by577yB4oCi4oCi4oCiKOKVr+KAteKWoeKAsinila/ngrjlvLnvvIHigKLigKLigKIK
ZmxhZ+iiq+aIkeeCuOayoeS6huWTiOWTiOWTiC==

解出来

(｡･∀･)ﾉﾞ嗨Hi~
(＠_＠;)(＠_＠;)(＠_＠;)
(+_+)?(。>︿<)_θ(。>︿<)_θ
o(*￣▽￣*)ブ゜
＜（＾－＾）＞(╯▽╰ )好香~~
ヽ(✿ﾟ▽ﾟ)ノ(＠＾０＾)
(^^ゞΨ(￣∀￣)Ψ*★,°*:.☆(￣▽￣)/$:*.°★* 。
~\(≧▽≦)/~o(^▽^)o(¬‿¬)(*≧︶≦))(￣▽￣* )ゞ┳━┳(╯‵□′)╯︵┻━┻
┳━┳ ノ( ゜-゜ノ)ಠ_ಠ
ಠ_ಠ(╯‵□′)╯炸弹！•••*～●(¬_¬ )
(ノへ￣、)o(￣┰￣*)ゞ╰(艹皿艹 )（︶^︶）(* ￣︿￣)(￣ε(#￣)
(ﾟДﾟ*)ﾉ○|￣|_ =3(ノ｀Д)ノ(′д｀σ)σ(￢︿̫̿￢☆)～( TロT)σ<( ‵□′)>──
(¬_¬")(￣﹏￣；)(╯°□°）╯︵ ┻━┻ヽ(゜▽゜ )－C<(/;◇;)/~(ヘ･_･)ヘ┳━┳
ಠ_ಠ(╯‵□′)╯炸弹！•••*～●(¬_¬ )
(⊙ˍ⊙)？(σ｀д′)σ<( ‵□′)>───Ｃε(┬﹏┬)3<( ‵□′)───C＜─___-)||～( TロT)σ(〃
⊙﹏⊙∥ヽ(*。>Д<)o゜/(ㄒoㄒ)/~~(#_<-)（＞人＜；）
(ノへ￣、)o(￣┰￣*)ゞ╰(艹皿艹 )（︶^︶）(* ￣︿￣)(￣ε(#￣)
(ﾟДﾟ*)ﾉ○|￣|_ =3(ノ｀Д)ノ(′д｀σ)σ(￢︿̫̿￢☆)～( TロT)σ<( ‵□′)>──
(⊙ˍ⊙)？(σ｀д′)σ<( ‵□′)>───Ｃε(┬﹏┬)3<( ‵□′)───C＜─___-)||～( TロT)σ(〃＞目＜)
(oﾟvﾟ)ノd=====(￣▽￣*)bε=ε=ε=(~￣▽￣)~( ω )U•ェ•*U
(ﾟДﾟ*)ﾉ○|￣|_ =3(ノ｀Д)ノ(′д｀σ)σ(￢︿̫̿￢☆)～( TロT)σ<( ‵□′)>──
(⊙ˍ⊙)？(σ｀д′)σ<( ‵□′)>───Ｃε(┬﹏┬)3<( ‵□′)───C＜─___-)||～( TロT)σ(〃＞目＜)
(oﾟvﾟ)ノd=====(￣▽￣*)bε=ε=ε=(~￣▽￣)~( ω )U•ェ•*U
(ﾟДﾟ*)ﾉ○|￣|_ =3(ノ｀Д)ノ(′д｀σ)σ(￢︿̫̿￢☆)～( TロT)σ<( ‵□′)>──
(⊙ˍ⊙)？(σ｀д′)σ<( ‵□′)>───Ｃε(┬﹏┬)3<( ‵□′)───C＜─___-)||～( TロT)σ(〃＞目＜)
(oﾟvﾟ)ノd=====(￣▽￣*)bε=ε=ε=(~￣▽￣)~( ω )U•ェ•*U
(ﾟДﾟ*)ﾉ○|￣|_ =3(ノ｀Д)ノ(′д｀σ)σ(￢︿̫̿￢☆)～( TロT)σ<( ‵□′)>──
(⊙ˍ⊙)？(σ｀д′)σ<( ‵□′)>───Ｃε(┬﹏┬)3<( ‵□′)───C＜─___-)||～( TロT)σ(〃＞目＜)
(oﾟvﾟ)ノd=====(￣▽￣*)bε=ε=ε=(~￣▽￣)~( ω )U•ェ•*U
(oﾟvﾟ)ノd=====(￣▽￣*)bε=ε=ε=(~￣▽￣)~( ω )U•ェ•*U
(ﾟДﾟ*)ﾉ○|￣|_ =3(ノ｀Д)ノ(′д｀σ)σ(￢︿̫̿￢☆)～( TロT)σ<( ‵□′)>──
(⊙ˍ⊙)？(σ｀д′)σ<( ‵□′)>───Ｃε(┬﹏┬)3<( ‵□′)───C＜─___-)||～( TロT)σ(〃＞目＜)
(oﾟvﾟ)ノd=====(￣▽￣*)bε=ε=ε=(~￣▽￣)~( ω )U•ェ•*U
(╯‵□′)╯炸弹！•••
(╯‵□′)╯炸弹！•••
(╯‵□′)╯炸弹！•••
(╯‵□′)╯炸弹！•••(╯‵□′)╯炸弹！•••(╯‵□′)╯炸弹！•••(╯‵□′)╯炸弹！•••
flag被我炸没了哈哈哈

试了aaencode不行，后面发现思路错了

HTML隐写 SNOW解出来

flag{→_→←_←←_←←_←←_← →_→→_→←_←←_←←_← →_→←_←←_←←_← ←_←←_←←_←→_→→_→ ←_←←_←←_
←→_→→_→ ←_← ←_←←_←←_←→_→→_→ →_→→_→→_→→_→←_← →_→←_←←_←←_← ←_←←_←←_←←_←←_←
 ←_←→_→→_→→_→→_→ →_→→_→→_→→_→→_→ ←_←←_←←_←←_←←_← ←_←←_←→_→←_← →_→←_←←_←←
_← ←_←←_←←_←←_←→_→ ←_←→_→ ←_←←_←→_→→_→→_→ →_→→_→→_→→_→←_← ←_←←_←←_←←_←←_
← ←_←←_←←_←→_→→_→ ←_←→_→ →_→→_→→_→→_→→_→ →_→←_←→_→←_← ←_← →_→→_→←_←←_←←_
← →_→→_→→_→→_→←_← →_→←_←→_→←_← ←_←←_←←_←→_→→_→ ←_←←_←←_←→_→→_→ →_→→_→←_←
←_←←_← →_→→_→→_→←_←←_←}

摩斯密码

虚实之间

看到mingwen.txt就想到明文攻击，因为工具问题浪费了很多时间，用那个archpr不行

123%asd!O

解压flag.txt

仅需5，跳过去

ffd5e341le25b2dcab15cbb}gc3bc5b{789b51

栅栏密码，http://ctf.ssleye.com/的那个栅栏也有问题

隐藏的秘密

先常规分析，看系统，进程

看文件

提取file.txt

然后vol.py -f 隐藏的秘密.vmem --profile=Win2003SP1x86 hashdump

两百多个隐藏账户，不知道该交那个

我估计就是大家都在爆破这个题然后平台变卡的，离谱（我也想爆破的，因为太卡放弃了