锐客网

  1. 首页 > 睿知 > >

wooyun 镜像站( 三 )

睿知经验知识


Python如下：
fromlibnum import n2s,s2n
fromgmpy2 import invert
importbase64
importgmpy2
defbignumber(n):
n= n.decode("hex")
rn= 0
forb in n:
rn= rn << 8
rn+= ord(b)
returnrn
n ="""00:89:89:a3:98:98:84:56:b3:fe:f4:a6:ad:86:df:
3c:99:57:7f:89:78:04:8d:e5:43:6b:ef:c3:0d:8d:
8c:94:95:89:12:aa:52:6f:f3:33:b6:68:57:30:6e:
bb:8d:e3:6c:2c:39:6a:84:ef:dc:5d:38:25:02:da:
a1:a3:f3:b6:e9:75:02:d2:e3:1c:84:93:30:f5:b4:
c9:52:57:a1:49:a9:7f:59:54:ea:f8:93:41:14:7a:
dc:dd:4e:95:0f:ff:74:e3:0b:be:62:28:76:b4:2e:
ea:c8:6d:f4:ad:97:15:d0:5b:56:04:aa:81:79:42:
4c:7d:9a:c4:6b:d6:b5:f3:22:b2:b5:72:8b:a1:48:
70:4a:25:a8:ef:cc:1e:7c:84:ea:7e:5c:e3:e0:17:
03:f0:4f:94:a4:31:d9:95:4b:d7:ae:2c:7d:d6:e8:
79:b3:5f:8a:2d:4a:5e:fb:e7:37:25:7b:f9:9b:d9:
ee:66:b1:5a:ff:23:3f:c7:7b:55:8a:48:7d:a5:95:
2f:be:2b:92:3d:a9:c5:eb:46:78:8c:05:03:36:b7:
e3:6a:5e:d8:2d:5c:1b:2a:eb:0e:45:be:e4:05:cb:
e7:24:81:db:25:68:aa:82:9e:ea:c8:7d:20:1a:5a:
8f:f5:ee:6f:0b:e3:81:92:ab:28:39:63:5f:6c:66:42:17"""
.replace(":","").replace("","").replace("\r","").replace("\n","")
#printn
n =bignumber(n)
printhex(n)
e1= 2333
e2=23333
defegcd(a,b):
ifa == 0:
return(b,0,1)
else:
g,y,x= egcd(b%a,a)
return(g,x - (b //a)*y,y)
flag1 = base64.b64decode(open("flag1.enc","rb").read())
flag2 = base64.b64decode(open("flag2.enc","rb").read())
c1= s2n(flag1)
c2= s2n(flag2)
c2= invert(c2,n)
#s= egcd(e1,e2)
#prints
s =gmpy2.gcdext(e1,e2)
#prints
s1= s[1]
s2= 0 - s[2]
prints1
prints2
m =pow(c1,s1,n) * pow(c2,s2,n)%n
printn2s(m)
flag{4b0b4c8a-82f3-4d80-902b-8e7a5706f8fe}

0x06 抛砖引玉

1.根据CMS版本 ， 在wooyun镜像站找到漏洞细节 ， 
网站存在注入 ， 但是数据库用户表为空 ， 另外发现发现文件下载漏洞 ， 
down.php?urls=data/../config.php
下载文件发现DB_user/mvoa用户的密码
define('DB_PWD','B!hpp3Dn1.');
flag值：B!hpp3Dn1.
2.http://url/www.zip ， 获得网站备份文件 ， 在config.php发现DB_user/root用户的密码
define('DB_PWD','mypasswd');
flag值：mypasswd

0x07 暗度陈仓

1.发现下载路径
/u-are-admin/download.php?dl=
显示文件找不到（u-Are-Admin/u-upload-file文件夹） ， 发现关键目录/u-Are-Admin/
flag值：/u-Are-Admin/
2.在/u-Are-Admin/目录 ， 可以上传文件 ， 上传Php（大小写绕过）一句话木马 ， 菜刀链接 ， netuser查看系统管理员Hack用户的全名
flag值：Hacked356
3.shell能够直接查看超级管理员用户桌面根目录admin.txt文件的内容
flag值：ad16a159581c7085c771f

0x08 瞒天过海

1.AWVS扫到注入点
/cat.php?id=2
sqlmap直接能跑 ， 通过注入即可获得后台管理员明文密码 ， serverlog
flag值：serverlog
2.注入也能获取root的密码hash ， 
*21C5210729A90C69019F01FED76FAD4654F27167
然后cmd5解密得rootserver
flag值：rootserver
3.登录进去 ， Downloadlog那里下载日志的地方 ， 可以下载任意文件 ， 可获取C盘根目录password.txt内容
/classes/downloadfile.php?file=../../../../../../password.txt
flag值：c9c35cf409344312146fa7546a94d1a6

0x09 偷梁换柱

1.AWVS扫到./git源码泄露 ， 用工具GitHack下载所有源码 ， 在数据库文件发现用户名 ， 密码（adminAdmin@pgsql）
flag值：Admin@pgsql
2.用用户名密码登录 ， 管理图片可以上传一句话木马的图片 ， 然后看到图片的地址 ， 把地址去掉 *** all ， 即使文件真正地址 ， 

推荐阅读


上一篇：2021天津高考分数线及一分一档表 2021天津高考分数线及位次

下一篇：迪奥化妆品加盟电话 迪奥化妆品加盟需要多少钱