1Jun 15 02:30:15 server sshd[5678]: Accepted password for attacker from 192.168.42.77 port 1337

1Jun 15 02:35:15 server systemd[1]: Started hidden_backdoor.service2Jun 15 02:35:15 server hidden_backdoor: listening on [any] 31337 ...

1Jun 15 02:40:15 dnsmasq[123]: query[A] CiAgICByb290Oio6MTk0Nzk6MDo5OTk5OTo3Ojo6.data.leak.ev from 192.168.42.772Jun 15 02:40:17 dnsmasq[123]: query[A] CmRhZW1vbjoqOjE5NDc5OjA6OTk5OTk6Nzo6Ogph.data.leak.ev from 192.168.42.773Jun 15 02:40:19 dnsmasq[123]: query[A] dHRhY2tlcjokNiRzZWNyZXQkZW5jcnlwdGVkcGFz.data.leak.ev from 192.168.42.774Jun 15 02:40:21 dnsmasq[123]: query[A] c3dvcmQ6MTk0Nzk6MDo5OTk5OTo3Ojo6CiAgICA.data.leak.ev from 192.168.42.77

1flag{attacker_192.168.42.77_hidden_backdoor_data.leak.ev}

1# -*- coding: utf-8 -*-2 3import os4import pyzipper5from tqdm import tqdm6import time7 8# --- 配置区 ---9# 使用原始字符串 (r"...") 来避免路径中的反斜杠问题10ZIP_DIRECTORY = r"E:\Desktop\flowzip2_fe9d6d2cf5a6fe83f1d7f0fe3c60fa25"11# --- 配置区结束 ---12 13def generate_passwords():14    """15    生成所有可能的密码 (000, 001, ..., 999)16    """17    # 使用 f-string 和 {:03d} 格式化来生成三位数的字符串，不足的前面补018    return [f"{i:03d}" for i in range(1000)]19 20def crack_zips():21    """22    爆破和解压ZIP文件23    """24    if not os.path.isdir(ZIP_DIRECTORY):25        print(f"错误：目录'{ZIP_DIRECTORY}'不存在。请检查路径是否正确。")26        return27 28    # 在主函数开始时生成密码列表并打印提示29    print("正在生成密码列表 (000-999)...")30    passwords = generate_passwords()31    print(f"密码列表生成完毕，共 {len(passwords)} 个。")32    print(f"开始处理目录'{ZIP_DIRECTORY}'中的ZIP文件...\n")33 34    # 使用 with 语句管理 tqdm 实例，确保进度条在结束或异常时能被正确关闭35    # bar_format 自定义了进度条的显示格式，{l_bar} 是左边的描述文本36    with tqdm(range(200),37              desc="[+] 准备开始...",38              bar_format="{l_bar}{bar}| {n_fmt}/{total_fmt} [{elapsed}<{remaining}]") as pbar:39        for i in pbar:40            file_number_str = f"{i:03d}"41            zip_filename = f"{file_number_str}.zip"42            zip_filepath = os.path.join(ZIP_DIRECTORY, zip_filename)43 44            if not os.path.exists(zip_filepath):45                # 更新描述信息，提示文件不存在46                pbar.set_description(f"[-] {zip_filename}不存在，已跳过")47                continue48            49            found_password = False50            # 遍历所有可能的密码51            for password in passwords:52                try:53                    # 尝试用当前密码打开和解压ZIP文件54                    # 密码需要被编码成bytes55                    with pyzipper.AESZipFile(zip_filepath, 'r') as zf:56                        zf.extractall(path=ZIP_DIRECTORY, pwd=password.encode('utf-8'))57                    58                    # 密码正确，更新tqdm的描述信息59                    # 这会覆盖上一条信息，实现动态更新的效果60                    pbar.set_description(f"[+] {zip_filename}已解压，密码是'{password}'")61                    found_password = True62                    break # 密码已找到，跳出内部的密码循环63 64                except RuntimeError as e:65                    # pyzipper在密码错误时会抛出RuntimeError66                    if 'Bad password' in str(e):67                        continue # 密码不对，继续尝试下一个密码68                    else:69                        # 其他运行时错误，更新描述并跳出密码循环70                        pbar.set_description(f"[!] 处理{zip_filename}时发生运行时错误")71                        break72                73                except Exception:74                    # 捕获其他可能的异常75                    pbar.set_description(f"[!] 处理{zip_filename}时发生意外错误")76                    break77            78            if not found_password:79                # 如果遍历完所有密码都未成功，更新描述信息80                pbar.set_description(f"[-] 未找到{zip_filename}的密码")81 82    # 在所有文件处理完毕后，光标移到新的一行，并打印最终的完成信息83    print("\n--- 所有文件处理完毕 ---")84 85if __name__ == "__main__":86    crack_zips()

1flag{5f5491b6-fddf-4be8-ab44-5a18831cc45b}

100000000 9e 45 02 82 ea 25 d2 62 0d 06 e7 b4 5f dc 62 bd |.E...%.b...._.b.|200000010 39 68 47 26 54 50 9e 26 4c 86 06 2e 2b af 3b 8b |9hG&TP.&L...+.;.|300000020 7c e4 99 0d ad 12 e2 7e 46 c9 00 29 a6 ea 1f b0 ||......~F..)....|400000030 ae c1 da 30 f3 98 94 82 33 fd 99 d3 d3 b9 a0 12 |...0....3.......|500000040 d9 de a5 d2 0e 95 f3 a5 bb f2 f9 91 b2 a3 c2 94 |................|600000050 b1 1c b7 eb 87 65 d7 0e 0c 6b d5 65 4d e1 43 1e |.....e...k.eM.C.|700000060 be b4 34 71 b5 53 d4 ea 62 4e b9 80 f3 6f f0 5c |..4q.S..bN...o.\|800000070 59 75 58 52 9e a4 ec e2 35 b7 d8 68 27 ee c0 94 |YuXR....5..h'...|

1flag{4eb88a16-be48-4de2-ab2a-ed09a09ed386}

1fastcoll_v1.0.0.5.exe -p prefix -o msg1.bin msg2.bin

1Z2FtZWxhYgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABgJW38EhH3hRbFIaBQ1pJrGjBHm7YrS5TlmOI0uqIkmIeLjwF5kFHpLMMBS9qHZu8CskXE6WmVGDv5KV/BJywYUt9xfoI2x/8k8ldPje4Yyx6N3WzwZgr8tsyDXKmCoxtcr9AOvCI4e+v6BkkqwGwu2OQlPh8TpgdH0Mq0Cic8m

1Z2FtZWxhYgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABgJW38EhH3hRbFIaBQ1pJrGjBFm7YrS5TlmOI0uqIkmIeLjwF5kFHpLMMBS9iHau8CskXE6WmVGDv5K1/BJywYUt9xfoI2x/8k8ldPje4Yyx6N32zwZgr8tsyDXKmCoxtcr9AOvCI4e+v6BkkowGwu2OQlPh8TpgdH0Mi0Cic8m

1__int64 sub_40487D()2{3  _QWORD *v1; // rax4  unsigned int v2; // ebx5  __int64 v3; // rbx6  __int64 v4; // rax7  _QWORD *v5; // rax8  __int64 result; // rax9  char v7; // [rsp+Fh] [rbp-481h] BYREF10  __int64 v8[2]; // [rsp+10h] [rbp-480h] BYREF11  __int64 v9[2]; // [rsp+20h] [rbp-470h] BYREF12  _QWORD v10[4]; // [rsp+30h] [rbp-460h] BYREF13  _QWORD v11[4]; // [rsp+50h] [rbp-440h] BYREF14  _QWORD v12[31]; // [rsp+70h] [rbp-420h] BYREF15  __int64 v13; // [rsp+168h] [rbp-328h] BYREF16  _QWORD v14[32]; // [rsp+270h] [rbp-220h] BYREF17  __int64 v15; // [rsp+370h] [rbp-120h] BYREF18  unsigned __int64 ______Stack_Canary_; // [rsp+478h] [rbp-18h]19 20  ______Stack_Canary_ = __readfsqword(0x28u);21  ifstream((__int64)v14, (__int64)"flag.txt", 4);// 读取 "flag.txt"22  ofstream((__int64)v12, (__int64)"enc.dat", 4);// 写入 "enc.dat"23  if ( sub_44FB80((__int64)&v15) || sub_44FB80((__int64)&v13) )// 检查文件是否成功打开24  {25    v1 = sub_46F140(qword_5DD320, (__int64)&unk_578019);26    sub_46DC30((__int64)v1, (__int64 (*)(void))sub_46EA20);// 如果文件打开失败，打印错误信息并退出27    v2 = 1;28  }29  else                                          // 如果文件打开成功，执行核心加密逻辑30  {31    sub_407080();32    sub_404E42((__int64)v9);33    sub_404DF8((__int64)v8, v14);               // 从文件流 v14 ("flag.txt")读取数据到 v834    sub_404E6C((__int64)v10, v8[0], v8[1], v9[0], v9[1], (__int64)&v7);// 再将数据从 v8 转移到 v1035    sub_4070A0();36    sub_407080();37    sub_404F50((__int64)v11, (__int64)"key2025lqb", (__int64)v9);// v11 是密钥结构，使用 "key2025lqb" 进行初始化38    sub_404605((__int64)v10, (__int64)v11);     // 使用密钥 v11 对数据 v10 进行 RC4 加密39    sub_475510(v11);40    sub_4070A0();41    v3 = sub_404DB4(v10);42    v4 = sub_405014(v10);43    sub_46E890(v12, v4, v3);                    // 将数据 (v4, v3) 写入文件流 v12 ("enc.dat")44    v5 = sub_46F140(qword_5DD440, (__int64)&unk_578040);45    sub_46DC30((__int64)v5, (__int64 (*)(void))sub_46EA20);46    v2 = 0;47    sub_404F08(v10);48  }49  sub_44C300(v12);50  sub_44C440(v14);51  result = v2;52  if ( ______Stack_Canary_ != __readfsqword(0x28u) )53    sub_52FBA0();54  return result;55}

1unsigned __int64 __fastcall sub_404605(_QWORD *a1, __int64 a2)2{3  int v2; // r12d4  unsigned __int64 v3; // rax5  __int64 v4; // kr00_86  _BYTE *v5; // rax7  unsigned __int64 result; // rax8  char v7; // [rsp+17h] [rbp-139h]9  int i; // [rsp+18h] [rbp-138h]10  int v9; // [rsp+1Ch] [rbp-134h]11  int v10; // [rsp+1Ch] [rbp-134h]12  int j; // [rsp+20h] [rbp-130h]13  int v12; // [rsp+24h] [rbp-12Ch]14  unsigned __int64 k; // [rsp+28h] [rbp-128h]15  _BYTE v14[264]; // [rsp+30h] [rbp-120h] BYREF16  unsigned __int64 v15; // [rsp+138h] [rbp-18h]17 18  v15 = __readfsqword(0x28u);19  for ( i = 0; i <= 255; ++i )                  // 初始化S盒20    v14[i] = i;21  v9 = 0;22  for ( j = 0; j <= 255; ++j )                  // 打乱S盒23  {24    v2 = (unsigned __int8)v14[j] + v9;25    v3 = sub_475730(a2);26    v9 = (v2 + *(char *)sub_475A40(a2, j % v3)) % 256;27    sub_404D3D(&v14[j], &v14[v9]);              // swap(S[i], S[j])28  }29  v12 = 0;                                      // i30  v10 = 0;                                      // j31  for ( k = 0LL; k < sub_404DB4(a1); ++k )32  {33    v12 = (v12 + 1) % 256;                      // i = (i + 1) % 25634    v4 = (unsigned __int8)v14[v12] + v10;35    v10 = (unsigned __int8)(HIBYTE(v4) + v14[v12] + v10) - HIBYTE(HIDWORD(v4));// j = (j + S[i]) % 25636    sub_404D3D(&v14[v12], &v14[v10]);           // swap(S[i], S[j])37    v7 = v14[(unsigned __int8)(v14[v12] + v14[v10])];// 生成密钥流中的一个字节38    v5 = (_BYTE *)sub_404DD8(a1, k);            // 获取第 k 个明文字节的地址39    *v5 ^= v7;                                  // XOR40  }41  result = v15 - __readfsqword(0x28u);42  if ( result )43    sub_52FBA0();44  return result;45}

1flag{db6007d2-9b1e-2f98-cef3-6595b63763dd}

1# Source Generated with Decompyle++2# File: rand_pyc_obf.pyc (Python 3.8)3 4import sys5import random6import base647Ii = input('Please input the flag: ').strip()8if not Ii.startswith('flag{') and Ii.endswith('}') or len(Ii) == 42:9    print('Length incorrect')10    sys.exit(-999)11oo0O000ooO = base64.b64encode(Ii.encode()).decode() + '_easyctf'12ii = []13for iiI in oo0O000ooO:14    random.seed(ord(iiI))15    ii.append(random.randint(1000000, 9999999))16iii111 = [17    4417023,18    5690625,19    9639225,20    1327718,21    4417023,22    5085550,23    5752075,24    9556690,25    5240080,26    6431679,27    3428007,28    3189766,29    3438336,30    5757818,31    3189766,32    5690625,33    4148389,34    2254831,35    6292433,36    2122126,37    5240080,38    6431679,39    9488271,40    2464675,41    7216908,42    5757818,43    3189766,44    5690625,45    3438336,46    6431679,47    2360475,48    6002055,49    5240080,50    9040261,51    8655414,52    9347278,53    3438336,54    2254831,55    2122126,56    5135281,57    2360475,58    9347278,59    4417023,60    1327718,61    3438336,62    3448715,63    9488271,64    5501611,65    5240080,66    5757818,67    9488271,68    5501611,69    5240080,70    9347278,71    4148389,72    1714134,73    9923116,74    4267438,75    4263793,76    5752075,77    2464675,78    7777627,79    6002055,80    3485900]81Iio0 = []82for iiI in oo0O000ooO:83    random.seed(ord(iiI))84    Iio0.append(random.randint(1000000, 9999999))85if Iio0 != iii111:86    print('Wrong flag')87    sys.exit(-1)88print('Correct!')

1import random2import base643 4iii111 = [5    4417023,6    5690625,7    9639225,8    1327718,9    4417023,10    5085550,11    5752075,12    9556690,13    5240080,14    6431679,15    3428007,16    3189766,17    3438336,18    5757818,19    3189766,20    5690625,21    4148389,22    2254831,23    6292433,24    2122126,25    5240080,26    6431679,27    9488271,28    2464675,29    7216908,30    5757818,31    3189766,32    5690625,33    3438336,34    6431679,35    2360475,36    6002055,37    5240080,38    9040261,39    8655414,40    9347278,41    3438336,42    2254831,43    2122126,44    5135281,45    2360475,46    9347278,47    4417023,48    1327718,49    3438336,50    3448715,51    9488271,52    5501611,53    5240080,54    5757818,55    9488271,56    5501611,57    5240080,58    9347278,59    4148389,60    1714134,61    9923116,62    4267438,63    4263793,64    5752075,65    2464675,66    7777627,67    6002055,68    3485900]69 70list1 = list("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz1234567890+/=_")71 72list2 = []73for guess_flag in list1:74    random.seed(ord(guess_flag))75    list2.append(random.randint(1000000, 9999999))76print(list2)77 78flag_list = []79for i in iii111:80    if i in list2:81        flag_list.append(list1[list2.index(i)])82    else:83        print(i)84flag = "".join(flag_list[:-8])85print(base64.b64decode(flag))

1flag{30de99f4-50d2-9f8f-2868-dcfa9d81483c}