web
奶龙牌图片处理器2.0
一个文件上传，有后缀名检测，然后内容过滤了php和?号
看到中间件是nginx，直接用.user.ini包含日志文件，发现可以包含
然后在UA头传马子，然后RCE就行了
1 | POST /uploads/ HTTP/1.1 |
外国山海经
扫目录发现存在/robots.txt文件，访问一下
1 | #shu.php sha.php wa.php flag.php flag.php.swp |
有flag.php，访问后在源码中拿到
1 | (function(_0x5bfa63,_0x281ba4){var _0x628a90={_0x28e595:0x190,_0x466706:0x17a,_0x570276:0x192,_0x4e238d:0x128,_0xf7fd91:0x139,_0x4ff7de:0x144,_0xf17c9a:0x132,_0x140c6f:0x117,_0x2e9d5d:0x124,_0x27ecfb:0x16f,_0x1f08ae:0x16e,_0x429bb1:0x185,_0x5259a4:0x186,_0xf069bc:0xfc,_0x36775b:0xda,_0x1a81bc:0x101,_0x4fbeb3:0x159,_0x5f0ac4:0x16a,_0x2b1d0c:0x15f,_0x45b6b4:0x160,_0x542167:0x17c,_0x300668:0x15a,_0x5d82fc:0x13b,_0x4fc9cc:0x176,_0x1f53f0:0x146,_0x99afde:0xfe,_0x39b153:0xf0,_0xed7676:0xef,_0x3a214b:0x10c,_0x18fd83:0x115,_0x44ec87:0x166,_0x3009e4:0x163,_0x362ea9:0x170},_0x28823e={_0x456064:0x20a},_0xb2ea4e={_0x332eb1:0x262};function _0x5afd48(_0x372bcf,_0x587d2c,_0x343524,_0x7ab981){return _0x2fa2(_0x7ab981- -_0xb2ea4e._0x332eb1,_0x343524);}var _0x19cd46=_0x5bfa63();function _0x180c55(_0x65cbe3,_0x1b7dab,_0x513f23,_0x2e4568){return _0x2fa2(_0x65cbe3- -_0x28823e._0x456064,_0x2e4568);}while(!![]){try{var _0x27e61b=parseInt(_0x5afd48(-0x18e,-_0x628a90._0x28e595,-_0x628a90._0x466706,-_0x628a90._0x570276))/(0x1f33+-0xda2+-0x1190)*(-parseInt(_0x180c55(-_0x628a90._0x4e238d,-_0x628a90._0xf7fd91,-_0x628a90._0x4ff7de,-_0x628a90._0xf17c9a))/(-0x97e*-0x2+0x8*-0x98+0x25f*-0x6))+parseInt(_0x180c55(-0x10d,-_0x628a90._0x140c6f,-0x111,-_0x628a90._0x2e9d5d))/(-0x115*-0xa+-0x63b+-0x24a*0x2)*(parseInt(_0x5afd48(-_0x628a90._0x27ecfb,-_0x628a90._0x1f08ae,-_0x628a90._0x429bb1,-_0x628a90._0x5259a4))/(-0x95+0x6c0+-0x627))+parseInt(_0x180c55(-_0x628a90._0xf069bc,-0x108,-_0x628a90._0x36775b,-_0x628a90._0x1a81bc))/(0x14ca+0xf94+-0x2459)+-parseInt(_0x5afd48(-_0x628a90._0x4fbeb3,-0x151,-_0x628a90._0x5f0ac4,-0x167))/(0x11ed+0x1133+-0x118d*0x2)*(-parseInt(_0x5afd48(-_0x628a90._0x2b1d0c,-_0x628a90._0x45b6b4,-_0x628a90._0x542167,-_0x628a90._0x300668))/(0x1d5*-0x6+0x1*-0x6dd+0x11e2))+-parseInt(_0x5afd48(-_0x628a90._0x5d82fc,-_0x628a90._0x4fc9cc,-_0x628a90._0x1f53f0,-0x157))/(-0x475+-0x172a+0x1ba7)*(parseInt(_0x180c55(-_0x628a90._0x99afde,-_0x628a90._0x39b153,-_0x628a90._0xed7676,-0xde))/(0x1caa+0x8ed+0xd1*-0x2e))+parseInt(_0x180c55(-_0x628a90._0x3a214b,-0x119,-0xee,-_0x628a90._0x18fd83))/(-0x687+-0x7c8+0xe59*0x1)*(-parseInt(_0x5afd48(-0x16c,-0x179,-_0x628a90._0x44ec87,-_0x628a90._0x3009e4))/(-0xdba*-0x2+-0x21bd+-0xc*-0x87))+parseInt(_0x5afd48(-_0x628a90._0x362ea9,-_0x628a90._0x3009e4,-0x174,-0x182))/(0xc54+-0x91*0x1+0xbb7*-0x1);if(_0x27e61b===_0x281ba4)break;else _0x19cd46['push'](_0x19cd46['shift']());}catch(_0x412f22){_0x19cd46['push'](_0x19cd46['shift']());}}}(_0x219d,-0x318d8+-0x1*-0x54f5+0x75601));var _0x3587de=(function(){var _0x4021ac={_0x58c1ae:0x13d,_0x3c3fdf:0x15a,_0x51959f:0x136,_0x1a346a:0x267,_0x970c7c:0x26b,_0x450fa8:0x27d,_0x3dffdb:0x27c,_0x20c184:0x295,_0x1d0c10:0x262,_0x1fdb73:0x130,_0x5a02fe:0x119,_0x4ee755:0x111,_0x5226ab:0x11b,_0xee055f:0x28b,_0xede8f3:0x252,_0x7e624b:0x143,_0x446a52:0x138,_0x308418:0x139,_0x4ebdea:0x27e,_0x26518b:0x29b,_0x51d380:0x28a,_0x18efbb:0x275,_0x1d15b8:0x13f,_0x1ab8ab:0x126,_0x20ee91:0x13e,_0x5cc3e2:0x157,_0x330753:0x260,_0x182013:0x272,_0x217183:0x27b,_0x3d043a:0x26c},_0x5724b4={_0x2f801f:0x22a,_0x3e3ff7:0x225,_0x4592b5:0x229,_0x23ef8d:0x23d,_0x4d4486:0x243,_0x1c90a0:0x220,_0x16effd:0x251,_0x4453ae:0x22f,_0x53295a:0x250},_0xb6c053={_0x43286b:0x152,_0x21fedd:0x13b,_0x2988ea:0x131,_0x3ae920:0x10e,_0x17968e:0xfb,_0x1b699f:0x14d,_0x5ccb44:0x146,_0x1270f6:0x15c,_0x44b00d:0x166,_0x147a9c:0x14e,_0x2e7542:0x134,_0x309998:0x14b,_0x5ee480:0x13f,_0x57614d:0x11f,_0xb63fe0:0x145,_0x18adec:0x114,_0x2d16b8:0x12a,_0x2e4b10:0x13e,_0x45c809:0x168,_0x2bfc7e:0x14f,_0x160f3a:0x159,_0x5e2224:0x167,_0x1d2868:0x152,_0x5909a1:0x130,_0x4a17f6:0x154,_0x3cdbb1:0x157,_0x23ed39:0x15a,_0x251934:0x12b,_0x37334a:0x156,_0x2aac5c:0x13b,_0x343854:0x157,_0x20b51c:0x16e,_0x1c1154:0x115,_0x6f8a3:0x12b,_0x2cdd60:0x13c},_0x141051={_0x4c0a4c:0x3e5,_0x5af9da:0x181},_0x331a16={_0x3b625e:0x235};function _0x16015f(_0x47cbe1,_0x203be2,_0x42df40,_0x2fc801){return _0x2fa2(_0x47cbe1- -_0x331a16._0x3b625e,_0x203be2);}var _0x1e85cf={};_0x1e85cf[_0x16015f(-_0x4021ac._0x58c1ae,-0x124,-_0x4021ac._0x3c3fdf,-_0x4021ac._0x51959f)]=function(_0x124e68,_0x375486){return _0x124e68!==_0x375486;};function _0x1d0710(_0x534c0e,_0xd016c3,_0x1cb96e,_0x177622){return _0x2fa2(_0x534c0e- -0x361,_0x1cb96e);}_0x1e85cf['bhVnY']=_0x1d0710(-_0x4021ac._0x1a346a,-0x282,-_0x4021ac._0x970c7c,-_0x4021ac._0x450fa8),_0x1e85cf[_0x1d0710(-_0x4021ac._0x3dffdb,-0x288,-_0x4021ac._0x20c184,-_0x4021ac._0x1d0c10)]=function(_0xf0c5e5,_0x41f4ee){return _0xf0c5e5===_0x41f4ee;},_0x1e85cf['FroGP']=_0x16015f(-_0x4021ac._0x1fdb73,-_0x4021ac._0x5a02fe,-_0x4021ac._0x4ee755,-_0x4021ac._0x5226ab),_0x1e85cf[_0x1d0710(-0x272,-_0x4021ac._0x20c184,-_0x4021ac._0xee055f,-_0x4021ac._0xede8f3)]=_0x16015f(-_0x4021ac._0x7e624b,-0x164,-_0x4021ac._0x446a52,-_0x4021ac._0x308418),_0x1e85cf[_0x1d0710(-_0x4021ac._0x4ebdea,-_0x4021ac._0x26518b,-_0x4021ac._0x51d380,-_0x4021ac._0x18efbb)]=function(_0x558755,_0x4bc882){return _0x558755===_0x4bc882;},_0x1e85cf[_0x16015f(-_0x4021ac._0x1d15b8,-_0x4021ac._0x1ab8ab,-_0x4021ac._0x20ee91,-_0x4021ac._0x5cc3e2)]=_0x1d0710(-_0x4021ac._0x330753,-_0x4021ac._0x182013,-_0x4021ac._0x217183,-_0x4021ac._0x3d043a);var _0x21f727=_0x1e85cf,_0x14c4a4=!![];return function(_0x1c40d7,_0x5cfc78){var _0x1d01a4={_0x493447:0x4a8};function _0x1cff74(_0x4d24a1,_0x343770,_0xfafe,_0x1eb6dc){return _0x1d0710(_0x4d24a1-_0x1d01a4._0x493447,_0x343770-0x46,_0x343770,_0x1eb6dc-0x190);}function _0x1c96af(_0x893911,_0x2291a8,_0x287241,_0x317f06){return _0x16015f(_0x317f06-_0x141051._0x4c0a4c,_0x287241,_0x287241-_0x141051._0x5af9da,_0x317f06-0x3b);}if(_0x21f727[_0x1cff74(_0x5724b4._0x2f801f,_0x5724b4._0x3e3ff7,_0x5724b4._0x4592b5,0x212)](_0x21f727[_0x1cff74(_0x5724b4._0x23ef8d,_0x5724b4._0x4d4486,_0x5724b4._0x1c90a0,_0x5724b4._0x16effd)],_0x21f727[_0x1cff74(0x23d,_0x5724b4._0x4453ae,_0x5724b4._0x53295a,0x25d)])){var _0x3a58cc=_0x14c4a4?function(){var _0x5c15d6={_0x4a8bea:0x15e,_0x38712d:0x30};function _0x140275(_0x526de1,_0x462836,_0x5d2e48,_0xcb505a){return _0x1c96af(_0x526de1-0x1d2,_0x462836-0x166,_0x462836,_0x5d2e48- -0x3c4);}function _0x575be4(_0xaacffc,_0x4294bf,_0x5d7f4c,_0x222164){return _0x1cff74(_0x4294bf- -0x37a,_0xaacffc,_0x5d7f4c-_0x5c15d6._0x4a8bea,_0x222164-_0x5c15d6._0x38712d);}if(_0x21f727[_0x575be4(-_0xb6c053._0x43286b,-_0xb6c053._0x21fedd,-0x12d,-_0xb6c053._0x2988ea)](_0x140275(-0x121,-_0xb6c053._0x3ae920,-0x11a,-_0xb6c053._0x17968e),_0x21f727[_0x140275(-0x153,-_0xb6c053._0x1b699f,-_0xb6c053._0x5ccb44,-_0xb6c053._0x1270f6)])){if(_0x2919f7){var _0x493883=_0xc6e29b['apply'](_0x4d40d9,arguments);return _0x35dcd6=null,_0x493883;}}else{if(_0x5cfc78){if(_0x21f727[_0x575be4(-_0xb6c053._0x44b00d,-_0xb6c053._0x147a9c,-_0xb6c053._0x2e7542,-0x168)](_0x21f727[_0x575be4(-_0xb6c053._0x309998,-_0xb6c053._0x5ee480,-_0xb6c053._0x57614d,-_0xb6c053._0xb63fe0)],_0x21f727['mGUiQ'])){var _0xa14e48=(_0x575be4(-_0xb6c053._0x18adec,-_0xb6c053._0x2d16b8,-0x12d,-_0xb6c053._0x2e4b10)+'4')['split']('|'),_0x2e30e9=-0x384+-0x1751+0x1ad5;while(!![]){switch(_0xa14e48[_0x2e30e9++]){case'0':var _0x1b7aa8=_0x59608f[_0x105f60]||_0xfc9fa9;continue;case'1':_0xfc9fa9['__proto__']=_0x20b288[_0x575be4(-_0xb6c053._0x45c809,-_0xb6c053._0x2bfc7e,-0x16e,-_0xb6c053._0x160f3a)](_0xd5c9ab);continue;case'2':var _0xfc9fa9=_0x55e4f3[_0x575be4(-_0xb6c053._0x5e2224,-_0xb6c053._0x1d2868,-_0xb6c053._0x5909a1,-_0xb6c053._0x4a17f6)+'r'][_0x575be4(-_0xb6c053._0x3cdbb1,-0x14b,-0x157,-_0xb6c053._0x5909a1)]['bind'](_0x22afd3);continue;case'3':var _0x105f60=_0x17d803[_0x3e5e3b];continue;case'4':_0x38656c[_0x105f60]=_0xfc9fa9;continue;case'5':_0xfc9fa9[_0x575be4(-_0xb6c053._0x3cdbb1,-_0xb6c053._0x23ed39,-_0xb6c053._0x21fedd,-_0xb6c053._0x44b00d)]=_0x1b7aa8[_0x140275(-_0xb6c053._0x251934,-_0xb6c053._0x37334a,-_0xb6c053._0x2aac5c,-0x118)][_0x575be4(-_0xb6c053._0x343854,-_0xb6c053._0x2bfc7e,-0x16b,-_0xb6c053._0x20b51c)](_0x1b7aa8);continue;}break;}}else{var _0x32d595=_0x5cfc78[_0x140275(-0x117,-_0xb6c053._0x1c1154,-_0xb6c053._0x6f8a3,-_0xb6c053._0x2cdd60)](_0x1c40d7,arguments);return _0x5cfc78=null,_0x32d595;}}}}:function(){};return _0x14c4a4=![],_0x3a58cc;}else _0xddb414=_0x3a1bf6;};}()),_0x5c1b7b=_0x3587de(this,function(){var _0x5ece5d={_0x4eda33:0x2a1,_0x4b8ce9:0x2aa,_0x23b363:0x2ae,_0x1c5de6:0x2b1,_0x18d716:0x4c6,_0x3a6307:0x4d1,_0x407b77:0x4c2,_0x4321fa:0x4d7,_0x341b4a:0x4b7,_0x48a6f0:0x49b,_0x519cab:0x490,_0x188735:0x298,_0x2797a6:0x2aa,_0x2468a3:0x27d,_0x3991c5:0x2b8,_0x4757e1:0x297,_0x36d645:0x29a,_0x3fe288:0x29f,_0x577630:0x4c2,_0x44c1c6:0x4a0,_0x26d6ba:0x4a2,_0x620647:0x4a0,_0x5471aa:0x28d,_0x4472b7:0x2a5,_0x5e590d:0x27e,_0x54bbea:0x4b3,_0x229042:0x4ac,_0x5d3eca:0x4ce,_0x80fb42:0x4bf,_0x1d559a:0x4bc,_0x1383bd:0x49d,_0x171396:0x49f},_0x3c7431={_0x4da769:0x3c7},_0x335210={_0x313b76:0x1ac};function _0x249218(_0x4c60fc,_0x6b220d,_0x3984ce,_0x10467c){return _0x2fa2(_0x4c60fc-_0x335210._0x313b76,_0x6b220d);}var _0x477b54={};_0x477b54[_0x249218(_0x5ece5d._0x4eda33,_0x5ece5d._0x4b8ce9,_0x5ece5d._0x23b363,_0x5ece5d._0x1c5de6)]=_0xfd96cd(_0x5ece5d._0x18d716,_0x5ece5d._0x3a6307,_0x5ece5d._0x407b77,_0x5ece5d._0x4321fa)+'+$';var _0x8ff005=_0x477b54;function _0xfd96cd(_0x110bc0,_0x4464b2,_0x10016b,_0x18ba04){return _0x2fa2(_0x4464b2-_0x3c7431._0x4da769,_0x110bc0);}return _0x5c1b7b[_0xfd96cd(_0x5ece5d._0x341b4a,0x4a0,_0x5ece5d._0x48a6f0,_0x5ece5d._0x519cab)]()[_0x249218(_0x5ece5d._0x188735,_0x5ece5d._0x2797a6,_0x5ece5d._0x2468a3,_0x5ece5d._0x3991c5)](_0x249218(0x2b6,_0x5ece5d._0x4757e1,_0x5ece5d._0x36d645,_0x5ece5d._0x3fe288)+'+$')[_0xfd96cd(_0x5ece5d._0x577630,_0x5ece5d._0x44c1c6,_0x5ece5d._0x26d6ba,_0x5ece5d._0x620647)]()[_0x249218(_0x5ece5d._0x5471aa,_0x5ece5d._0x4472b7,_0x5ece5d._0x4757e1,_0x5ece5d._0x5e590d)+'r'](_0x5c1b7b)[_0xfd96cd(0x4ba,_0x5ece5d._0x54bbea,_0x5ece5d._0x229042,_0x5ece5d._0x5d3eca)](_0x8ff005[_0xfd96cd(_0x5ece5d._0x80fb42,_0x5ece5d._0x1d559a,_0x5ece5d._0x1383bd,_0x5ece5d._0x171396)]);});_0x5c1b7b();function _0x2fa2(_0x4dde84,_0x478812){var _0x29462c=_0x219d();return _0x2fa2=function(_0x1089fd,_0x5a8a3d){_0x1089fd=_0x1089fd-(-0x4be*0x7+0x1bf5+-0x7*-0xdd);var _0x32bbf7=_0x29462c[_0x1089fd];if(_0x2fa2['MPcALq']===undefined){var _0x27114c=function(_0x1cfff3){var _0x30a4cb='abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+/=';var _0x15567f='',_0x3c3450='',_0x3727b6=_0x15567f+_0x27114c;for(var _0x5b35e=0x2465+0x4c9+-0x6dd*0x6,_0x305da,_0x2e25de,_0x45e1da=0x13a8+-0x1e99+-0x1*-0xaf1;_0x2e25de=_0x1cfff3['charAt'](_0x45e1da++);~_0x2e25de&&(_0x305da=_0x5b35e%(-0x8e1*-0x2+0x18ab+-0x2a69)?_0x305da*(-0x4ff+-0x2*-0x781+-0x9c3)+_0x2e25de:_0x2e25de,_0x5b35e++%(0x150+0x7*0x2a5+-0x13cf))?_0x15567f+=_0x3727b6['charCodeAt'](_0x45e1da+(-0x1a6c*0x1+0xaab+0xfcb))-(0x21f7+0x1d4c+-0x3f39)!==-0x2d+-0x133a+0x1*0x1367?String['fromCharCode'](0x1c0+-0x1db4+0x1cf3*0x1&_0x305da>>(-(0x52c+-0x1807+0x12dd)*_0x5b35e&0x1771*0x1+-0xf5c*0x2+0x74d)):_0x5b35e:-0x197e+0x12c5+-0x6b9*-0x1){_0x2e25de=_0x30a4cb['indexOf'](_0x2e25de);}for(var _0x3bef59=0x387+0xeea+-0x1271,_0x1b19f0=_0x15567f['length'];_0x3bef59<_0x1b19f0;_0x3bef59++){_0x3c3450+='%'+('00'+_0x15567f['charCodeAt'](_0x3bef59)['toString'](-0x3*0x9c1+-0x1*-0x17b9+-0x1de*-0x3))['slice'](-(-0x1dd*-0xd+0x50f+-0x1d46));}return decodeURIComponent(_0x3c3450);};_0x2fa2['iNUHtA']=_0x27114c,_0x4dde84=arguments,_0x2fa2['MPcALq']=!![];}var _0x1cf422=_0x29462c[0x23d9+-0x18fd+-0x5*0x22c],_0xf7632=_0x1089fd+_0x1cf422,_0x5c718f=_0x4dde84[_0xf7632];if(!_0x5c718f){var _0x4e8342=function(_0x5bb17b){this['vOUKmO']=_0x5bb17b,this['VyUlWP']=[0x1e*-0x12d+0x1bf2+-0x1*-0x755,-0x259b+-0x167*0x5+-0x164f*-0x2,-0x1*-0x88a+-0x15d0*0x1+0xd46],this['RgxWRj']=function(){return'newState';},this['lwrkKC']='\x5cw+\x20*\x5c(\x5c)\x20*{\x5cw+\x20*',this['IbivLK']='[\x27|\x22].+[\x27|\x22];?\x20*}';};_0x4e8342['prototype']['wDfUYW']=function(){var _0x47b17d=new RegExp(this['lwrkKC']+this['IbivLK']),_0x3d3b23=_0x47b17d['test'](this['RgxWRj']['toString']())?--this['VyUlWP'][0x82c+-0x2036+0x180b]:--this['VyUlWP'][0xc07+0x2228+0x3*-0xf65];return this['VDwzLi'](_0x3d3b23);},_0x4e8342['prototype']['VDwzLi']=function(_0xa402ba){if(!Boolean(~_0xa402ba))return _0xa402ba;return this['xwZujq'](this['vOUKmO']);},_0x4e8342['prototype']['xwZujq']=function(_0x65f30f){for(var _0x23db3e=-0x2*-0x1304+-0x1*-0x19b+-0x27a3,_0x1e8117=this['VyUlWP']['length'];_0x23db3e<_0x1e8117;_0x23db3e++){this['VyUlWP']['push'](Math['round'](Math['random']())),_0x1e8117=this['VyUlWP']['length'];}return _0x65f30f(this['VyUlWP'][-0x3a2+0x779*0x1+-0x3d7]);},new _0x4e8342(_0x2fa2)['wDfUYW'](),_0x32bbf7=_0x2fa2['iNUHtA'](_0x32bbf7),_0x4dde84[_0xf7632]=_0x32bbf7;}else _0x32bbf7=_0x5c718f;return _0x32bbf7;},_0x2fa2(_0x4dde84,_0x478812);}var _0x335615=(function(){var _0x3d32fd={_0x4dd412:0x4b3,_0x2e30cb:0x4c9,_0x1d7e3f:0x4b3,_0x505055:0x49c,_0x898066:0x36,_0x437ed2:0x24,_0xb80b08:0x4c1,_0x41955e:0x4b5,_0x226e13:0x4b8,_0x527505:0x4ba,_0x45ce2c:0x4de,_0x16e492:0x4dd,_0x165aa5:0x4e0,_0x3511bd:0x502},_0x42d65f={_0x2ddf3c:0xd0,_0x402929:0xcd,_0x4f6aa1:0xf0,_0x417947:0xc0,_0x5c83e3:0xcf,_0x3fcd55:0xf3,_0x30ce5c:0xde,_0x264507:0xff,_0x1c0668:0x93,_0x4241c9:0x97,_0x1e3a87:0x83,_0x37379e:0xf2,_0x50678c:0xcb,_0x3df9e5:0xdc,_0x19ebaf:0xd3,_0x4ec263:0xa0,_0x1f45ec:0xcc,_0x2e359a:0x11b,_0x1bb5a5:0x123,_0x498c1f:0xed,_0x5c94ca:0x111},_0x217b59={_0x138f06:0x1cf,_0x327865:0x38,_0x1b3b35:0xf9},_0x2789f1={_0x22fbb1:0x5f,_0x3fd558:0x3e5,_0x3623a4:0x1cd},_0x2087ec={_0x33f829:0xb4},_0x147f99={};function _0x3bef6d(_0x5b56d3,_0x3a091c,_0x130de8,_0x562c6f){return _0x2fa2(_0x562c6f- -_0x2087ec._0x33f829,_0x5b56d3);}_0x147f99[_0x3ca6da(_0x3d32fd._0x4dd412,_0x3d32fd._0x2e30cb,_0x3d32fd._0x1d7e3f,_0x3d32fd._0x505055)]=_0x3bef6d(_0x3d32fd._0x898066,0xb,0x24,_0x3d32fd._0x437ed2);function _0x3ca6da(_0x3fe9d1,_0xe366d9,_0x25f5a3,_0x379f71){return _0x2fa2(_0x25f5a3-0x3e4,_0xe366d9);}_0x147f99[_0x3ca6da(_0x3d32fd._0xb80b08,_0x3d32fd._0x41955e,_0x3d32fd._0x226e13,_0x3d32fd._0x527505)]=_0x3ca6da(_0x3d32fd._0x45ce2c,_0x3d32fd._0x16e492,0x4ce,0x4d0),_0x147f99['ZZqwF']=_0x3ca6da(_0x3d32fd._0x45ce2c,_0x3d32fd._0xb80b08,_0x3d32fd._0x165aa5,_0x3d32fd._0x3511bd);var _0x3d4fb9=_0x147f99,_0x3b189a=!![];return function(_0x4c04a2,_0x24bac0){var _0x11031c={_0x14b596:0xd,_0x170af6:0x1a,_0x3a5b25:0x4,_0x46e1f8:0x2a,_0x117854:0x30,_0x53a9fb:0x38,_0x5455dc:0x4a,_0x2b5959:0x29,_0x34c283:0x10,_0x1d9e57:0x4ed,_0xb9a172:0x4ff,_0xe479af:0x4ea,_0x4adc73:0x22,_0x426376:0x41,_0x5ddded:0x3e},_0x49bbd1={};function _0x4145d7(_0x509318,_0x4ce127,_0x11b7da,_0x381469){return _0x3ca6da(_0x509318-_0x2789f1._0x22fbb1,_0x11b7da,_0x381469- -_0x2789f1._0x3fd558,_0x381469-_0x2789f1._0x3623a4);}_0x49bbd1[_0x4145d7(0xd0,_0x42d65f._0x2ddf3c,_0x42d65f._0x402929,_0x42d65f._0x4f6aa1)]=function(_0x1d942d,_0x50c3e4){return _0x1d942d===_0x50c3e4;};function _0x472cde(_0x277dde,_0x742ce5,_0x42937a,_0x202bcf){return _0x3bef6d(_0x277dde,_0x742ce5-_0x217b59._0x138f06,_0x42937a-_0x217b59._0x327865,_0x42937a- -_0x217b59._0x1b3b35);}_0x49bbd1[_0x472cde(-_0x42d65f._0x417947,-_0x42d65f._0x402929,-_0x42d65f._0x5c83e3,-0xad)]=_0x3d4fb9[_0x472cde(-_0x42d65f._0x3fcd55,-0xf1,-_0x42d65f._0x30ce5c,-_0x42d65f._0x264507)],_0x49bbd1[_0x472cde(-_0x42d65f._0x1c0668,-_0x42d65f._0x4241c9,-0x9d,-_0x42d65f._0x1e3a87)]=_0x3d4fb9[_0x4145d7(_0x42d65f._0x37379e,_0x42d65f._0x50678c,_0x42d65f._0x3df9e5,_0x42d65f._0x19ebaf)],_0x49bbd1['JvBtk']=_0x3d4fb9[_0x472cde(-_0x42d65f._0x4ec263,-_0x42d65f._0x1f45ec,-0xbf,-0xd0)],_0x49bbd1[_0x4145d7(_0x42d65f._0x2e359a,_0x42d65f._0x1bb5a5,_0x42d65f._0x498c1f,0x10e)]=_0x4145d7(0x11a,_0x42d65f._0x5c94ca,0xfd,0x110);var _0x2748d4=_0x49bbd1,_0x4a5a98=_0x3b189a?function(){var _0x3de893={_0x3f0d48:0x1b7,_0x40ca85:0x1de,_0x44cc63:0x3e8},_0x10455e={_0x3083d1:0x90,_0x632be9:0x1b6};function _0xbb3584(_0x135760,_0x1cecff,_0x1b373f,_0x2eb568){return _0x472cde(_0x2eb568,_0x1cecff-0x1a8,_0x135760-_0x10455e._0x3083d1,_0x2eb568-_0x10455e._0x632be9);}function _0x42ddc5(_0x2531ca,_0x3f3c80,_0x35d7ae,_0x118508){return _0x4145d7(_0x2531ca-_0x3de893._0x3f0d48,_0x3f3c80-_0x3de893._0x40ca85,_0x118508,_0x35d7ae-_0x3de893._0x44cc63);}if(_0x2748d4['XbQPZ'](_0x2748d4['rdzih'],_0x2748d4[_0xbb3584(-_0x11031c._0x14b596,-_0x11031c._0x170af6,_0x11031c._0x3a5b25,-_0x11031c._0x46e1f8)])){var _0x137536=_0x5b716f[_0xbb3584(-0x34,-_0x11031c._0x117854,-0x32,-_0x11031c._0x53a9fb)](_0x1130dd,arguments);return _0x16d37e=null,_0x137536;}else{if(_0x24bac0){if(_0x2748d4[_0xbb3584(-0x2c,-_0x11031c._0x5455dc,-_0x11031c._0x2b5959,-_0x11031c._0x34c283)](_0x2748d4[_0x42ddc5(_0x11031c._0x1d9e57,_0x11031c._0xb9a172,_0x11031c._0xe479af,0x4ef)],_0x2748d4['iiEnj'])){if(_0x2bd5a3){var _0x233e4b=_0x31bac3[_0xbb3584(-0x34,-_0x11031c._0x4adc73,-_0x11031c._0x426376,-_0x11031c._0x5ddded)](_0x20c483,arguments);return _0x2f7999=null,_0x233e4b;}}else{var _0x27b3a6=_0x24bac0['apply'](_0x4c04a2,arguments);return _0x24bac0=null,_0x27b3a6;}}}}:function(){};return _0x3b189a=![],_0x4a5a98;};}());function _0x43b95d(_0x16a9da,_0x24077d,_0x3b1e2f,_0x31bd32){var _0x415853={_0x365bca:0x88};return _0x2fa2(_0x16a9da-_0x415853._0x365bca,_0x24077d);}function _0x219d(){var _0x30f34b=['BgvUz3rO','x19WCM90B19F','yMHwBLK','r0fpB2y','ndq1mdK3vKXQD2Xf','BMn0Aw9UkcKG','qKriuhy','zNnOyNmUCgHW77Ym','sNfnv2u','sNvZDcbWyxj0ia','CMv0DxjUicHMDq','Bg9N','u3zVDMK','Dg9tDhjPBMC','vgHLCMuGAxmGBq','y29UC29Szq','mtq4mduYrhfgDePg','BeXZrMi','CMr6AwG','Ce1LCLO','mtqXmJaYmJbQrxjKtvi','y29UC3rYDwn0BW','mM9nEvvdtW','t2HSvg4','yMLUza','t1PSvLu','DhjHy2u','zxHJzxb0Aw9U','ChjVDg90ExbL','yxbWBhK','CLLSzKW','qM1dzLO','C2vHCMnO','sgTmCuS','wLPXD0y','BuDvAve','B3jLihrVignVBq','wgjrufO','qNzWyvK','DgfIBgu','rNjVr1a','rxH0Bwy','zMnKt0u','Dg9NzxrOzxi','DxHZruG','C0D1wvO','rwfHEK0','mtHwzwnYDvu','v0fUDfi','mtjowMn0uw4','mtu4mfnrCuLsuq','mZu5odf6wfHwA3q','y3rVCIGICMv0Dq','sgzKDhe','u3rPDgnOigL0ia','sNzcDgS','yvjIzxm','uwn3ALG','zxjYB3i','EKjJqLm','mJa3mtuXuMLZrvzf','mNWZFdb8mxW1Fa','kcGOlISPkYKRkq','ota4oe1Jtwz3Ba','mJa3meXSzg9OuG','ywXLCNq','ntq2mtq1D2r3rhP4','AwLfBMO','rM1vuuu','zLf1DKW'];_0x219d=function(){return _0x30f34b;};return _0x219d();}var _0xfb81ef=_0x335615(this,function(){var _0x86515e={_0x286f56:0x193,_0x19da52:0x187,_0x2b457d:0x1a9,_0x128216:0x1b2,_0x4ffbab:0x1c9,_0x28ed0e:0x170,_0x291b9a:0x199,_0x4bb0db:0x19a,_0x7c06bb:0x46d,_0x27e896:0x48c,_0x45dc0:0x190,_0x1489c9:0x1ad,_0x347965:0x1a9,_0x59f0ab:0x449,_0x2c1a61:0x430,_0x9df6de:0x451,_0x4f3b7c:0x197,_0x445b79:0x184,_0x35dac4:0x196,_0x2e155b:0x463,_0x4163a0:0x440,_0x35590a:0x449,_0x5a92d9:0x48e,_0x5713dd:0x486,_0x9ce866:0x469,_0x5d2011:0x47a,_0x2fb363:0x43a,_0x49d807:0x441,_0x4773f9:0x191,_0x2f7d38:0x189,_0x32352a:0x19c,_0xa28e16:0x1a3,_0x393026:0x1be,_0x4bed42:0x1e0,_0x3138ee:0x468,_0x1efc32:0x48a,_0x1e00d8:0x46f,_0x14f997:0x49a,_0x1fabb8:0x491,_0x18ef54:0x489,_0x3642df:0x455,_0x5e5450:0x459,_0x15d374:0x45a,_0xbb9bff:0x452,_0x540c80:0x433,_0x28a91f:0x453,_0x174890:0x44f,_0x17342b:0x1b1,_0x13795f:0x18f,_0x3c7980:0x18e,_0x397a84:0x439,_0x1dacac:0x457,_0x500c6c:0x1a6,_0x2d2155:0x186,_0x26599c:0x190},_0x1e0392={_0x2a0a5c:0xac},_0x3d04ad={_0x4cc0de:0x376},_0x218a07={_0x334681:0x437,_0x3e0531:0x423,_0x265858:0x427,_0x328b53:0x42d,_0x25e2fd:0x3ff,_0x12cc97:0x405,_0x4c19ff:0x419,_0x2f93b9:0x415,_0x122edb:0x428,_0x46fbc7:0x40c,_0x58105b:0x428},_0x18d994={_0xa1a695:0x41},_0x274b97={'pMerZ':function(_0x11187d,_0x1e4667){return _0x11187d+_0x1e4667;},'zBcBS':function(_0xfc867a){return _0xfc867a();},'HkLqK':_0xfcd4c3(0x16f,_0x86515e._0x286f56,0x183,_0x86515e._0x19da52),'BDHPv':'info','hnIHA':_0xfcd4c3(0x1d1,_0x86515e._0x2b457d,_0x86515e._0x128216,_0x86515e._0x4ffbab),'aRbes':_0xfcd4c3(_0x86515e._0x28ed0e,_0x86515e._0x291b9a,0x193,_0x86515e._0x4bb0db),'ORqsS':_0x2b8afa(_0x86515e._0x7c06bb,0x462,_0x86515e._0x27e896,0x469),'lLsFb':function(_0x34a9a3,_0x4110b5){return _0x34a9a3<_0x4110b5;},'sGuYZ':'5|2|1|0|3|'+'4'},_0x23eea3=function(){var _0x28ca73={_0x5c6bb7:0x17a,_0x4e7ce5:0x298,_0x802c84:0x7d};function _0x5515cc(_0x2e8499,_0x270277,_0xa14d2e,_0x435b89){return _0xfcd4c3(_0x270277,_0x270277-0x160,_0x435b89-0x285,_0x435b89-_0x18d994._0xa1a695);}var _0x171219;function _0x51b2df(_0xedb1f2,_0x188f0f,_0x5ba311,_0x81a1a1){return _0xfcd4c3(_0x81a1a1,_0x188f0f-_0x28ca73._0x5c6bb7,_0x188f0f-_0x28ca73._0x4e7ce5,_0x81a1a1-_0x28ca73._0x802c84);}try{_0x171219=Function(_0x274b97[_0x51b2df(_0x218a07._0x334681,_0x218a07._0x3e0531,_0x218a07._0x265858,_0x218a07._0x328b53)](_0x5515cc(_0x218a07._0x25e2fd,_0x218a07._0x12cc97,_0x218a07._0x4c19ff,0x407)+_0x51b2df(0x411,_0x218a07._0x2f93b9,_0x218a07._0x122edb,_0x218a07._0x46fbc7),'{}.constru'+_0x5515cc(_0x218a07._0x58105b,0x421,0x448,0x431)+'rn\x20this\x22)('+'\x20)')+');')();}catch(_0x421704){_0x171219=window;}return _0x171219;},_0x1b449f=_0x274b97[_0xfcd4c3(_0x86515e._0x45dc0,_0x86515e._0x1489c9,0x1b3,_0x86515e._0x347965)](_0x23eea3),_0xf883ee=_0x1b449f[_0x2b8afa(_0x86515e._0x59f0ab,0x44d,_0x86515e._0x2c1a61,_0x86515e._0x9df6de)]=_0x1b449f['console']||{},_0x53109c=[_0x274b97[_0xfcd4c3(_0x86515e._0x4f3b7c,_0x86515e._0x445b79,_0x86515e._0x291b9a,_0x86515e._0x35dac4)],'warn',_0x274b97[_0x2b8afa(_0x86515e._0x2e155b,_0x86515e._0x4163a0,_0x86515e._0x35590a,0x448)],_0x274b97['hnIHA'],_0x274b97[_0x2b8afa(_0x86515e._0x5a92d9,_0x86515e._0x5713dd,_0x86515e._0x9ce866,_0x86515e._0x5d2011)],_0x274b97['ORqsS'],_0x2b8afa(_0x86515e._0x2fb363,_0x86515e._0x49d807,0x447,0x45c)];function _0x2b8afa(_0x410775,_0x271235,_0xaede52,_0x7ad671){return _0x2fa2(_0x7ad671-_0x3d04ad._0x4cc0de,_0xaede52);}function _0xfcd4c3(_0x270100,_0x1435df,_0x586469,_0x24f88a){return _0x2fa2(_0x586469-_0x1e0392._0x2a0a5c,_0x270100);}for(var _0x52328e=-0x1c37+-0x2db+0x1f12;_0x274b97[_0xfcd4c3(_0x86515e._0x45dc0,_0x86515e._0x4773f9,_0x86515e._0x2f7d38,_0x86515e._0x32352a)](_0x52328e,_0x53109c[_0xfcd4c3(0x1c2,_0x86515e._0xa28e16,_0x86515e._0x393026,_0x86515e._0x4bed42)]);_0x52328e++){var _0x161f25=_0x274b97[_0x2b8afa(0x46b,_0x86515e._0x3138ee,_0x86515e._0x1efc32,_0x86515e._0x1e00d8)]['split']('|'),_0x5ed1e0=0x162d+-0x1d*0xda+0x3*0xd7;while(!![]){switch(_0x161f25[_0x5ed1e0++]){case'0':_0x2e72f3[_0x2b8afa(_0x86515e._0x14f997,_0x86515e._0x5d2011,_0x86515e._0x1fabb8,_0x86515e._0x18ef54)]=_0x335615[_0x2b8afa(0x455,_0x86515e._0x3642df,_0x86515e._0x5e5450,_0x86515e._0x15d374)](_0x335615);continue;case'1':var _0x5b572d=_0xf883ee[_0x2327c2]||_0x2e72f3;continue;case'2':var _0x2327c2=_0x53109c[_0x52328e];continue;case'3':_0x2e72f3['toString']=_0x5b572d[_0x2b8afa(_0x86515e._0xbb9bff,_0x86515e._0x540c80,_0x86515e._0x28a91f,_0x86515e._0x174890)][_0xfcd4c3(_0x86515e._0x17342b,_0x86515e._0x13795f,0x190,_0x86515e._0x3c7980)](_0x5b572d);continue;case'4':_0xf883ee[_0x2327c2]=_0x2e72f3;continue;case'5':var _0x2e72f3=_0x335615[_0x2b8afa(_0x86515e._0x397a84,_0x86515e._0x28a91f,0x43c,_0x86515e._0x1dacac)+'r'][_0xfcd4c3(0x1ad,_0x86515e._0x128216,0x194,_0x86515e._0x500c6c)][_0xfcd4c3(0x18f,_0x86515e._0x2d2155,_0x86515e._0x26599c,0x19f)](_0x335615);continue;}break;}}});_0xfb81ef(),window[_0x43b95d(0x195,0x186,0x177,0x185)]=function(){var _0x11e4ba={_0x54ce81:0x81,_0x3f05fd:0x8b,_0x3c12d8:0x66,_0x4f7709:0x24b,_0x4097be:0x261,_0x26b0f8:0x24e,_0x34a3a3:0xb7,_0x67fb88:0x9c,_0x4337fa:0xbb,_0x2d8f19:0xbe,_0x16ffa7:0x25c,_0x29c7a0:0x239,_0x4fd058:0x245,_0x1eed2e:0x251,_0x3d8cce:0x25c,_0x135008:0x27e,_0x1548b1:0x264,_0x1aa760:0x23c,_0x229bf7:0x244,_0xe6db95:0x239,_0x3aa31e:0x23b,_0x3c19c3:0x93,_0x52b346:0xba,_0x48ed1f:0x268,_0x5d4762:0x26c,_0x3c9e76:0x254,_0x2a9f09:0x276},_0x28ad78={_0x5cc3bd:0xd7,_0x17ef46:0x1a2,_0x53dab6:0x129},_0x36a7b3={_0x2f2c5a:0xe9,_0x101124:0x10b},_0x8bd32d={'BmCfZ':function(_0x571dda,_0x15b43b){return _0x571dda(_0x15b43b);},'rjCiw':'rqxvweqty，'+_0x2f5b69(_0x11e4ba._0x54ce81,0x86,_0x11e4ba._0x3f05fd,_0x11e4ba._0x3c12d8)+'of\x20it'},_0x12c806=_0xf4e5c(_0x11e4ba._0x4f7709,_0x11e4ba._0x4097be,0x258,0x25a)+_0xf4e5c(0x261,0x252,0x282,_0x11e4ba._0x26b0f8)+'e';function _0xf4e5c(_0x5cdb5f,_0x1bf623,_0x4be90e,_0x2b1dd6){return _0x43b95d(_0x5cdb5f-_0x36a7b3._0x2f2c5a,_0x1bf623,_0x4be90e-_0x36a7b3._0x101124,_0x2b1dd6-_0x36a7b3._0x2f2c5a);}_0x8bd32d[_0x2f5b69(_0x11e4ba._0x34a3a3,_0x11e4ba._0x67fb88,_0x11e4ba._0x4337fa,_0x11e4ba._0x2d8f19)](confirm,_0x12c806);function _0x2f5b69(_0xfde3ce,_0x57f13f,_0x4cdb67,_0x13e691){return _0x43b95d(_0x57f13f- -_0x28ad78._0x5cc3bd,_0x13e691,_0x4cdb67-_0x28ad78._0x17ef46,_0x13e691-_0x28ad78._0x53dab6);}_0x8bd32d[_0xf4e5c(_0x11e4ba._0x16ffa7,_0x11e4ba._0x29c7a0,_0x11e4ba._0x4fd058,_0x11e4ba._0x1eed2e)](confirm,_0x8bd32d['rjCiw']),_0x8bd32d[_0xf4e5c(_0x11e4ba._0x3d8cce,_0x11e4ba._0x135008,_0x11e4ba._0x1548b1,_0x11e4ba._0x1aa760)](confirm,_0xf4e5c(_0x11e4ba._0x229bf7,0x23d,_0x11e4ba._0xe6db95,_0x11e4ba._0x3aa31e)+_0x2f5b69(0xcd,0xb3,_0x11e4ba._0x3c19c3,_0x11e4ba._0x52b346)+_0xf4e5c(_0x11e4ba._0x48ed1f,_0x11e4ba._0x5d4762,_0x11e4ba._0x3c9e76,_0x11e4ba._0x2a9f09));}; |
js混淆，解密一下https://obf-io.deobfuscate.io/
1 | (function (_0x5bfa63, _0x281ba4) { |
刚好在末尾看到几句话，意思是让我们拼起来访问rqxvweqtyfshbs.php然后就能拿到flag了
PPC
1 | 已知 6 位嫌疑人的手机号分别是： |
001
瞪眼法，在40和52图片中看到大量170开头嫌疑人的通话记录，看到很多条133****0181通话记录，这个直接交flag就行，一开始以为是133081这么写，后面发现中间的星号也不能漏掉flag{133****0181}
002
受不了了，开个WPS会员将图片转成excel表格，然后对每个嫌疑人号码进行去重处理
先是对135的嫌疑人进行了一部分排查，找到以下通讯号码
135****2345
1 | 045****3555 |
然后刚好运气不错，对上面数据进行排查的时候刚好就查到158****6074号码在六个嫌疑人都有通话，试着交了结果过了，看来就一个号码同时跟六个人有过通话
004
这个题算是最简单的了，但是我却是最后才看的
先将138号码的通讯记录全部调出来
然后进行去重处理，再看看2021-12-01对应的序号是多少，从2021-12-01后开始排查最后找到四个号码
1 | 130****9357 |
直接交就通过了
Crypto
Lattice
1 | from Crypto.Util.number import * |
这段代码先用格密码生成公钥、密钥，并用格密码加密部分信息，之后对flag进行AES加密。
这里的key是随机生成的16字节的字符串，可以先处理iv
关于leak的话可以推导出 iv = arctan(-leak)，用 numpy 计算 iv，并结合key和iv解密
1 | import numpy as np |
这里的话因为iv 的 bytes 表达方式不唯一，需要多种方式去尝试解密，并且解密后的密文可能有杂质，不能直接输出，需要正从中用正则提取 flag
所以最终的wp
1 | from Crypto.Util.Padding import unpad |
sandwitch
1 | from Crypto.Util.number import * |
一个RSA加密算法，直接使用三明治攻击爆破 RSA 参数，但是不会，只能问ai
Misc
small_challenge
附件是一个图片，直接用binwalk分离
拿到一个2.png和flag.zip，但是flag.zip是需要密码的
到这里就没什么思路了，后面发现两个图片长得差不多，尝试合并看看能不能拿到什么线索
拿到一个二维码，拿去解码https://zxing.org/w/decode，然后放到随波逐流里面解码
直接掩码爆破
9h!Y_a_8D就是压缩包密码，解压后拿到flag
数学天才
压缩包是一个图片一个txt和一个葵花宝典
txt文件
1 | 小伙子，我看你骨骼清奇，必是旷世奇才，那就考验一下你的悟性吧！ |
根据前两个试炼，设置一下字典
根据第三个试炼，猜测长度是60
直接爆出密码，解压后拿到一串字符串
1 | DJ?ELtbo`0+o8F0Eb2G9dPN |
放随波逐流解密
1 | Rot47解码: synt{E3@1_Z@gu_t3avh5!} |
Re
Victory Melody
分析过后发现先经过sub_7FF76AFD1109才进入if，跟进函数名
分析发现这个函数其实就实现了个异或计算的功能
该调教ai了，喊ai写个解释器出来
1 | # 将十六进制字符串转换为字节码 |
拿到一些为汇编，然后拿去异或计算拿到zywO0o!，一看就是go学长出的题，把这个拿去md5加密就行了
qgd
说是签到题，但是一时间没看懂怎么做emmm
附件中提示flag{part1flag/part2flag}，part2flag.exe先解包一下
拿到pyc文件，然后我们反编译
WO0o.pyc
1 | # Decompiled with PyLingual (https://pylingual.io) |
可以发现导了⼀个secret，尝试解包secret得到⼀个魔改rc4
1 | # Decompiled with PyLingual (https://pylingual.io) |
RC4其实是一种对称加密技术，所以他们的加解密的过程其实是一样的，将函数直接全部复制下来就⾏，把数据传进去
exp
1 | # Decompiled with PyLingual (https://pylingual.io) |
这里就拿到后半段flag了，前半段flag的话一直没搞明白，一直问ai之后发现这里是异或算法
解密脚本
1 | encrypted_flag = [88, 47, 80, 54, 95, 57, 90, 54, 94, 47] |
最终flag：flag{iwannaknow/what_DO_you_mean#@!}