克拉玛依初赛-wp
MISC签到
https://img2022.cnblogs.com/blog/2830174/202211/2830174-20221127000521355-901091568.png
16进制转字符串
https://img2022.cnblogs.com/blog/2830174/202211/2830174-20221127000808369-817590265.png
base64
https://img2022.cnblogs.com/blog/2830174/202211/2830174-20221127000823129-553338279.png
再来一次base64
https://img2022.cnblogs.com/blog/2830174/202211/2830174-20221127000832948-1662896781.png
flag{we1c0me-to-hEre}
论禅论道
7z解压得到jar
https://img2022.cnblogs.com/blog/2830174/202211/2830174-20221127000844293-2051543656.png
使用decom打开
https://img2022.cnblogs.com/blog/2830174/202211/2830174-20221127000851366-668752226.png
解密
https://img2022.cnblogs.com/blog/2830174/202211/2830174-20221127000859841-1477623056.png
https://img2022.cnblogs.com/blog/2830174/202211/2830174-20221127000946629-1738192704.png
https://img2022.cnblogs.com/blog/2830174/202211/2830174-20221127000951185-588378486.png
得到flag{y0u_@re_gr4aT}
WEB
pingme
抓包，修改POST提交的参数为127.0.0.1;ls
https://img2022.cnblogs.com/blog/2830174/202211/2830174-20221127001026222-302319167.png
修改POST提交的参数为127.0.0.1;cat%20flag.php
https://img2022.cnblogs.com/blog/2830174/202211/2830174-20221127001019067-17359831.png
flag{s0_3asy_flag_g1ve_you}
upload
抓包
https://img2022.cnblogs.com/blog/2830174/202211/2830174-20221127001044604-1580401680.png
传马
https://img2022.cnblogs.com/blog/2830174/202211/2830174-20221127001051873-205183269.png
主要是猜测上传目录 upload
蚁剑连接
https://img2022.cnblogs.com/blog/2830174/202211/2830174-20221127001103601-1217553713.png
https://img2022.cnblogs.com/blog/2830174/202211/2830174-20221127001109450-1719070545.png
flag{upload-Yes!!!}
signin
抓包传参
主要在于 c.php/. 绕过后缀检测
https://img2022.cnblogs.com/blog/2830174/202211/2830174-20221127001149717-467539077.png
flag{4ac93603cea737970d9b164dfab069c3}
RE
张三的程序
notepad打开出现flag
https://img2022.cnblogs.com/blog/2830174/202211/2830174-20221127001200223-695703230.png
flag{what_is_flag????}
上上签
https://img2022.cnblogs.com/blog/2830174/202211/2830174-20221127001205446-1780306968.png
flag{I_hope_you_have_a_good_beginning_and_a_good_ending.}
remain
走迷宫
向右是6
向下是2
向左是4
向上是8
https://img2022.cnblogs.com/blog/2830174/202211/2830174-20221127001254299-525365127.png
flag{66666666622224484444422}
CHARS
字符串转十进制
https://img2022.cnblogs.com/blog/2830174/202211/2830174-20221127001307172-1444096475.png
长度和密文比较
https://img2022.cnblogs.com/blog/2830174/202211/2830174-20221127001321942-1515807784.png
脚本如下
a=i=len(a)-1while(i>=0):print(chr(a),end='')i-=1
Remain plus
直接一键脱壳
https://img2022.cnblogs.com/blog/2830174/202211/2830174-20221127001952050-1761626678.png
脱掉UPX壳之后根据Error找到所在位置
https://img2022.cnblogs.com/blog/2830174/202211/2830174-20221127001506317-509086604.png
断点处函数为判断函数
https://img2022.cnblogs.com/blog/2830174/202211/2830174-20221127001517413-13837710.png
根据字符串判断输入ReMainPLUS得到flag
https://img2022.cnblogs.com/blog/2830174/202211/2830174-20221127001529871-684963914.png
flag{d133282e0c8d1ac581108f1adfc1fde0}
免责声明：如果侵犯了您的权益，请联系站长，我们会及时删除侵权内容，谢谢合作！
页:
[1]