2024ISG观安杯

Web

R | emm | w3nx1z1

前面就是正常的随便输入用户密码邮箱进行安装然后登陆后台

找到一个emlog的任意文件上传漏洞CVE-2023-44974

在插件处上传webshell压缩包要求是文件夹要和webshell的名字相同可以用这个里面的

https://github.com/yangliukk/emlog/tree/main

然后访问webshell 执行命令得到flag

Reverse

R | rev_shell | 解题人

先看日志文件

跑一下程序对照，拿到cipher和key

再看可执行文件

die查壳

upx壳，工具脱不了，一开始以为是工具版本的问题，后来发现github最新版是4.2.4，但是题目是4.3，猜测可能是魔改？

再尝试下断点手脱，但是报错

再尝试直接跑起来attach，成功附加但是没dump下来，堵死

最后尝试直接爆破，先测试出明文长度37

大小写字母数字以及下划线组合，找pwn手from pwn写按位爆破脚本

from struct import pack
from ctypes import *
from LibcSearcher import *
from pwn import *
context(arch='amd64',log_level='debug')
#context(arch='i386',log_level='debug')
def s(a):
    io.send(a)
    
def sa(a, b):
    io.sendafter(a, b)

def sl(a):
    io.sendline(a)

def sla(a, b):
    io.sendlineafter(a, b)

def r():
    io.recv()

def pr():
    print(io.recv())

def rl(a):
    return io.recvuntil(a)

def inter():
    io.interactive()

def debug():
    gdb.attach(io)
    pause()

def get_addr():
    return u64(p.recvuntil(b'\x7f')[-6:].ljust(8, b'\x00'))

def ret_csu(r12, r13, r14, r15, last):
    payload = offset * 'a'
    #构造栈溢出的padding
    payload += p64(gadget1)
    #gadgets1的地址
    payload += p64(0) + p64(1)
    #rbx=0, rbp=1
    payload += p64(r12)
    #call调用的地址
    payload += p64(r13) + p64(r14) + p64(r15)
    #三个参数的寄存器
    payload += p64(gadget2)
    #gadgets2的地址
    payload += 'a' * 56
    #pop出的padding
    payload += p64(last)
    #函数最后的返回地址
    return payload

io=process('./encsh')
#io=remote('',)
#elf=ELF('./')
#libc=ELF('./')
import string

key = 'mykeymykeyhackergoawayyourkeyyou'

flag = '00000000000000000000000000000000000000000000000000000'
v = [227, 83, 162, 17, 197, 102, 127, 119, 94, 208, 82, 187, 221, 191, 112, 186, 0, 170, 191, 44, 233, 242, 209, 114,
     70, 116, 203, 80, 72, 65, 254, 111, 119, 146, 95, 180, 182, 77, 140, 110, 204, 249, 76, 34, 229, 39, 30, 12, 248,
     89, 158, 103, 170]
FLAG = ''
sla('>', 'key')
sl(key)
sla('>', 'enc')
sl(flag)
rl('[')
ans = rl(']').decode()
temp = ans[:-1].split(', ')
tmp = int(temp[i])
for i in range(len(v)):
    for j in string.printable:

        ans = flag[:i] + j + flag[i + 1:]

        S(ans)
        if tmp == v[i]:
            FLAG += j
            break
        print(FLAG)
        io.close()
ISG{ThIsisMYuPx_notYOuR5_Gg_hjD95wk1}

Misc

R | office | w3nx1z1

010打开末尾base64 解密得到用来打开excel文档的密码

SSN6aVR4bnh2YmcjR0M5   
I#ziTxnxvbg#GC9

打开之后发现有宏vba

尝试编辑宏发现有保护密码

使用LibreOffice Calc打开可以消除宏

写解密脚本恢复flag

def decrypt(encrypted_message):
    # 将加密字符串分割成整数字符串，并去除空字符串
    message_parts = [int(part) for part in encrypted_message.split(',') if part]

    # 初始化 S 数组
    s = list(range(256))
    j = 0

    # 创建 KSA
    for i in range(256):
        j = (j + s[i]) % 256
        s[i], s[j] = s[j], s[i]

    # 初始化 x 和 y
    x = 0
    y = 0
    decrypted_message = ""

    # 进行解密
    for i in range(len(message_parts)):
        x = (x + 1) % 256
        y = (y + s[x]) % 256
        s[x], s[y] = s[y], s[x]
        
        # 恢复原始字符
        char = chr(s[(s[x] + s[y]) % 256] ^ message_parts[i])
        decrypted_message += char

    return decrypted_message

# 测试代码
if __name__ == "__main__":
    encrypted = "184,116,232,38,216,127,29,89,225,84,108,82,8,0,161,49,232,127,45,252,147,140,185,210,26,107,123,2,82,189,0,167,205,130,94,54,94,242,138,139,102,79,250,139,9,142,17,42,198,113,246,6,142,31,"
    
    decrypted = decrypt(encrypted)
    print("Decrypted Message:", decrypted)