2026獬豸杯wp（全）

adb\lspd\log.old\kmsg.log
adb\ksu\log\dmesg.log

select rc._id, rc.deleted, rc.display_name, m.mimetype, d.data1
from raw_contacts rc
left join data d on d.raw_contact_id=rc._id
left join mimetypes m on m._id=d.mimetype_id
where rc.deleted=1;

风有约：1355997814
观云听海：1082423674

=SUMPRODUCT((--F2:F100>=40)*(--F2:F100<=60))

import struct
import zlib
import re
import xml.etree.ElementTree as ET

path = "1.zip"

data = open(path, "rb").read()

# 1. 找外层 ZIP 本地文件头
idx = data.find(b"PK\x03\x04")
if idx == -1:
    raise Exception("找不到 PK\\x03\\x04")

outer = data[idx:]

nlen = struct.unpack_from("<H", outer, 26)[0]
elen = struct.unpack_from("<H", outer, 28)[0]
dstart = 30 + nlen + elen

# 2. 解外层 deflate，尾部截断没关系，能解多少算多少
d = zlib.decompressobj(-15)
xlsx_data = d.decompress(outer[dstart:], max_length=200000)

print("恢复出的内层 xlsx 数据长度:", len(xlsx_data))
print("外层是否完整:", d.eof)

files = {}

# 3. 扫内层 xlsx 的本地文件头
off = 0
while off < len(xlsx_data) - 30:
    pos = xlsx_data.find(b"PK\x03\x04", off)
    if pos == -1:
        break

    method = struct.unpack_from("<H", xlsx_data, pos + 8)[0]
    csize = struct.unpack_from("<I", xlsx_data, pos + 18)[0]
    nlen = struct.unpack_from("<H", xlsx_data, pos + 26)[0]
    elen = struct.unpack_from("<H", xlsx_data, pos + 28)[0]

    name_start = pos + 30
    name = xlsx_data[name_start:name_start + nlen].decode("utf-8", errors="ignore")

    dstart = name_start + nlen + elen
    dend = dstart + csize

    # 不完整的文件直接跳过
    if dend > len(xlsx_data):
        off = pos + 4
        continue

    raw = xlsx_data[dstart:dend]

    if method == 8:
        try:
            raw = zlib.decompress(raw, -15)
        except Exception:
            off = dend
            continue

    files[name] = raw
    off = dend

print("已恢复文件:")
for k in files:
    print(" ", k)

shared_xml = files.get("xl/sharedStrings.xml")
sheet_xml = files.get("xl/worksheets/sheet1.xml")

if not shared_xml or not sheet_xml:
    raise Exception("没有恢复出 sharedStrings.xml 或 sheet1.xml")

# 4. 解析 sharedStrings
strings = re.findall(r"<t[^>]*>(.*?)</t>", shared_xml.decode("utf-8", errors="ignore"), re.DOTALL)

# 5. 解析 sheet1
root = ET.fromstring(sheet_xml)
ns = {"a": "http://schemas.openxmlformats.org/spreadsheetml/2006/main"}

def col_index(cell_ref):
    m = re.match(r"([A-Z]+)", cell_ref)
    col = m.group(1)
    num = 0
    for ch in col:
        num = num * 26 + ord(ch) - ord("A") + 1
    return num - 1

rows = []

for row in root.findall(".//a:row", ns):
    arr = []
    for c in row.findall("a:c", ns):
        ref = c.attrib.get("r", "")
        idx = col_index(ref) if ref else len(arr)

        while len(arr) <= idx:
            arr.append("")

        t = c.attrib.get("t")
        v = c.find("a:v", ns)

        if v is None:
            arr[idx] = ""
            continue

        val = v.text or ""

        if t == "s":
            arr[idx] = strings[int(val)]
        else:
            arr[idx] = val

    rows.append(arr)

# 6. 打印表格
for row in rows:
    print("\t".join(row))

key = int("11011010", 2)

binary_data = [
    "10001110", "10111011", "10110011", "10101010", "10111111", "10110011", "11111010",
    "11101011", "11101010", "11101011", "11111010", "10111000", "10101111", "10110011",
    "10110110", "10111110", "10110011", "10110100", "10111101", "11111010", "11101111",
    "11101010", "11101000", "11111010", "10101000", "10110101", "10110101", "10110111",
]

result = bytes(int(x, 2) ^ key for x in binary_data)
print(result.decode("utf-8"))

CheckForDebugger()
WriteRegistryPersistence()
CreateLogFile()
WriteLogEntry()
CleanupFiles()
InitNetwork()
ConnectToC2()
SimulateProcessInjection()

ifconfig
systemctl status sshd

uname -a

getfacl /etc/shadow

netstat -antp

nginx -v

ps aux

[root@localhost ~]# cat /usr/local/bin/network-check.py
# -*- coding: utf-8 -*-
import os
import subprocess
import time

# --- 题目核心配置 ---
ALLOWED_IP = "192.168.203.100"  # 嫌疑人预设的安全IP
CHECK_INTERVAL = 30            # 检查间隔（秒）
KICK_DELAY = "5 minutes"       # 触发后延迟时间：5分钟

def get_current_logins():
    """获取当前所有登录用户的 IP 和 TTY 终端"""
    logins = []
    try:
        # 执行 who 命令获取当前登录信息
        process = subprocess.Popen(['who'], stdout=subprocess.PIPE)
        output, err = process.communicate()
        lines = output.decode('utf-8').splitlines()
        
        for line in lines:
            parts = line.split()
            if len(parts) >= 2:
                user = parts[0]
                tty = parts[1]
                ip = "unknown"
                # 提取括号中的 IP 地址
                for p in parts:
                    if '(' in p and ')' in p:
                        ip = p.strip('()')
                logins.append({'user': user, 'tty': tty, 'ip': ip})
    except:
        pass
    return logins

def is_job_exists(tty):
    """逻辑去重：检查 at 任务池中是否已存在针对该终端的任务"""
    try:
        # 扫描 at 任务池目录 /var/spool/at/
        at_dir = "/var/spool/at/"
        if os.path.exists(at_dir):
            for f in os.listdir(at_dir):
                file_path = os.path.join(at_dir, f)
                if os.path.isfile(file_path):
                    with open(file_path, 'r') as content:
                        # 如果任务脚本中已包含该 tty 编号，说明已排队
                        if tty in content.read():
                            return True
    except:
        pass
    return False

def trigger_kickout(tty):
    """触发踢人逻辑"""
    if is_job_exists(tty):
        return # 已存在任务则跳过，避免重复添加
    
    # 使用 pkill 强制杀死指定终端的所有进程
    kick_cmd = "pkill -9 -t {}".format(tty)
    
    # 调用 at 命令，并将所有输出重定向到黑洞，防止产生系统邮件
    os.system('echo "{}" | at now + {} > /dev/null 2>&1'.format(kick_cmd, KICK_DELAY))

if __name__ == "__main__":
    while True:
        current_users = get_current_logins()
        for u in current_users:
            # 逻辑判定：非安全IP 且 是远程终端(pts)
            if u['ip'] != ALLOWED_IP and 'pts' in u['tty']:
                trigger_kickout(u['tty'])
        time.sleep(CHECK_INTERVAL)

<?php
/*数据库配置*/
$dbconfig=array(
        "host" => "192.168.203.155", //数据库服务器
        "port" => 3306, //数据库端口
        "user" => "root", //数据库用户名
        "pwd" => "Root@123456", //数据库密码
        "dbname" => "fk", //数据库名
        "dbqz" => "shua" //数据表前缀
);

crontab -l

[root@localhost conf.d]# cat /etc/cron.daily/autobackup.sh
ER="root"
DB_PASSWORD="Root@123456"
DB_NAME="fk"


REMOTE_USER="root"
REMOTE_SERVER="8.208.44.202"
REMOTE_DIR="/root/"


BACKUP_DIR="/tmp/db_backup"
# ====================================================================


TIMESTAMP=$(date +"%Y%m%d_%H%M%S")
BACKUP_FILE="${BACKUP_DIR}/${DB_NAME}_${TIMESTAMP}.sql.gz"


mkdir -p ${BACKUP_DIR}


if mysqldump -h 127.0.0.1 -u${DB_USER} -p${DB_PASSWORD} \
    --single-transaction --set-gtid-purged=OFF \
    --routines --triggers --events \
    ${DB_NAME} | gzip > ${BACKUP_FILE}; then
    echo "$(date) - 数据库备份成功：${BACKUP_FILE}"
else
    echo "$(date) - 数据库备份失败！" >&2
    exit 1
fi

# 需要配置 ssh-copy-id 以实现免密登录
if scp -o StrictHostKeyChecking=no ${BACKUP_FILE} ${REMOTE_USER}@${REMOTE_SERVER}:${REMOTE_DIR}; then
    echo "$(date) - 文件上传至 ${REMOTE_SERVER} 成功"
    rm -f ${BACKUP_FILE}
    ssh ${REMOTE_USER}@${REMOTE_SERVER} "find ${REMOTE_DIR} -name '${DB_NAME}_*.sql.gz' -type f -mtime +30 -delete"
else
    echo "$(date) - 文件上传至 ${REMOTE_SERVER} 失败！" >&2
    exit 1
fi

exit 0

find /usr/share/nginx/html/fk/ -name "login.php"

zcat -f /var/log/nginx/access.log* | awk '$7 ~ /\/fk\/(static|admin)\/login/ {print $7}' | sort | uniq -c | sort -rn

zcat -f /var/log/nginx/access.log* | awk '$7 ~ /\/fk\/static\/login\.php/ {cnt[$1]++} END {for (ip in cnt) print cnt[ip], ip}' | sort -rn | head -5

hashcat -m 1410 -a 0 '94bd34e3010a6468f312eafe359e9d926fc16bba62c0b6cf646d041a5c281bf2:2025baofu!' rockyou.txt --potfile-disable --outfile-format 2,3 --status --status-timer 5

import re
import sys
from pathlib import Path

def php_int(s):
    s = s.strip()
    if s.lower().startswith("0x"):
        return int(s, 16)
    # PHP 里 01042 这种是八进制
    if len(s) > 1 and s.startswith("0") and re.fullmatch(r"[0-7]+", s):
        return int(s, 8)
    return int(s, 10)

def decode_hex(hx):
    try:
        return bytes.fromhex(hx).decode("utf-8", errors="ignore")
    except Exception:
        return ""

def find_big_explode_array(src):
    # 匹配 call_user_func_array("explode",array("分隔符","内容"))
    pattern = re.compile(
        r'explode",array\("(?P<sep>.*?)","(?P<data>.*?)"\)\)',
        re.S
    )

    candidates = []
    for m in pattern.finditer(src):
        sep = m.group("sep")
        data = m.group("data")
        parts = data.split(sep)
        if len(parts) > 20:
            candidates.append((len(parts), m, sep, data))

    if not candidates:
        raise RuntimeError("没找到主要的 explode 十六进制数组")

    # 选最大的一组，一般就是主混淆数组
    _, m, sep, data = max(candidates, key=lambda x: x[0])
    return m, sep, data

def main():
    if len(sys.argv) < 2:
        print("用法: python3 deob_setphp.py set.php")
        sys.exit(1)

    in_file = Path(sys.argv[1])
    src = in_file.read_text(encoding="utf-8", errors="ignore")

    m, sep, data = find_big_explode_array(src)

    # 1. 解出所有字符串块
    arr = []
    for hx in data.split(sep):
        arr.append(decode_hex(hx))

    strings_file = in_file.with_suffix(".strings.txt")
    with strings_file.open("w", encoding="utf-8", errors="ignore") as f:
        for i, text in enumerate(arr):
            if text.strip():
                f.write(f"\n===== INDEX {i} =====\n")
                f.write(text)
                f.write("\n")

    # 2. 尝试还原 echo pack(...) 拼出来的代码
    pack_pat = re.compile(
        r'call_user_func_array\("pack",array\([^)]*?\)\);echo\s+\$U4jeF0;',
        re.S
    )
    idx_pat = re.compile(
        r'U4jcV2\s*(?:=&|=)\s*\$GLOBALS\[B0000BB00\]\[([^\]]+)\]'
    )

    out = []
    last = m.end()

    for pm in pack_pat.finditer(src, m.end()):
        block = src[last:pm.start()]
        idxs = idx_pat.findall(block)

        if idxs:
            idx = php_int(idxs[-1])
            if 0 <= idx < len(arr):
                out.append(arr[idx])

        last = pm.end()

    deob_file = in_file.with_suffix(".deobf.php")
    deob_text = "".join(out)
    deob_file.write_text(deob_text, encoding="utf-8", errors="ignore")

    print(f"[+] 已输出还原代码: {deob_file}")
    print(f"[+] 已输出全部字符串: {strings_file}")

    # 3. 自动找 value=13 对应项
    corpus = deob_text + "\n".join(arr)
    found = False

    for mm in re.finditer(r'<option\s+value=["\']13["\']>(.*?)</option>', corpus):
        print(f"[+] 找到 value=13 对应: {mm.group(1)}")
        found = True

    if not found:
        print("[!] 没自动找到 value=13，可以手动 grep：")
        print(f"    grep -n 'value=\"13\"' {strings_file}")

if __name__ == "__main__":
    main()

[+] 已输出还原代码: set.deobf.php
[+] 已输出全部字符串: set.strings.txt
[+] 找到 value=13 对应: 无忧支付

SELECT 
    SUM(money) AS total_amount
FROM 
    shua_orders
WHERE 
    status = 1
    AND addtime >= '2025-06-01'
    AND addtime <= '2025-12-31 23:59:59';

SELECT 
    DATE(addtime) AS order_date,
    SUM(money) AS daily_total
FROM 
    shua_orders
WHERE 
    YEAR(addtime) = 2025
GROUP BY 
    DATE(addtime)
ORDER BY 
    daily_total DESC
LIMIT 1;

SELECT 
    t.name AS app_name,
    SUM(o.value) AS total_quantity
FROM 
    shua_orders o
LEFT JOIN 
    shua_tools t ON o.tid = t.tid
WHERE 
    t.name IS NOT NULL
GROUP BY 
    t.name
ORDER BY 
    total_quantity DESC
LIMIT 1;

SELECT 
    s.user AS username,
    t.total_spent
FROM 
    shua_site s
INNER JOIN (
    SELECT 
        userid,
        SUM(money) AS total_spent
    FROM 
        shua_orders
    GROUP BY 
        userid
    ORDER BY 
        SUM(money) DESC
    LIMIT 1
) t ON s.zid = t.userid;

SELECT 
    User, 
    Host, 
    Super_priv, 
    File_priv
FROM 
    mysql.user
WHERE 
    User LIKE '_tmp%'
    AND Super_priv = 'Y'
    AND File_priv = 'Y';

mysql -uroot -p'Root@123456' -e "SELECT User,Host,File_priv,Super_priv FROM
mysql.user WHERE File_priv='Y' AND Super_priv='Y';"

python3 pyinstxtractor.py EduRATSample.exe

import marshal
import types
import dis
import struct

def show(code, depth=0):
    pad = " " * depth
    print(f"{pad}[代码块] {code.co_name}")
    print(f"{pad}[起始行] {code.co_firstlineno}")
    print(f"{pad}[调用名称] {code.co_names}")
    print(f"{pad}[常量] {[c for c in code.co_consts if not isinstance(c, types.CodeType)]}\n")

    for const in code.co_consts:
        if isinstance(const, types.CodeType):
            show(const, depth + 1)

with open("edu_ratsample.pyc", "rb") as f:
    data = f.read()

# Python 3.7+: pyc header = 16 bytes
# Python 3.3–3.6: 12 bytes
# 保险起见：自动跳过 header
offset = 0
magic = data[:4]
offset += 4

if magic >= b'\x33\x0d\x0d\x0a':  # Python 3.7+
    offset += 12
else:
    offset += 8

root = marshal.loads(data[offset:])
show(root)

[代码块] <module>
[起始行] 1
[调用名称] ('base64', 'socket', 'sys', 'time', 'C2_HOST', 'C2_PORT', 'BEACON_B64', 'MUTEX_NAME', 'USER_AGENT', 'bytes', '_xor', 'build_payload', 'try_connect', 'int', 'main', '__name__', 'exit')
[常量] [0, None, '192.0.2.1', 64123, 'eyJ0IjoiYmVhY29uIiwidiI6IjEuMCJ9', 'Global\\EduLab_RAT_Mutex_2026', 'Mozilla/5.0 (EduLab; Win32) RAT-Stub/1.0', 'data', 'key', 'return', '__main__', ('return', None)]

 [代码块] _xor
 [起始行] 15
 [调用名称] ('bytes', 'enumerate')
 [常量] [None]

  [代码块] <genexpr>
  [起始行] 16
  [调用名称] ('len',)
  [常量] [None]

 [代码块] build_payload
 [起始行] 19
 [调用名称] ('base64', 'b64decode', 'BEACON_B64', '_xor')
 [常量] [None, b'EDU']

 [代码块] try_connect
 [起始行] 25
 [调用名称] ('build_payload', 'socket', 'AF_INET', 'SOCK_STREAM', 'settimeout', 'connect', 'C2_HOST', 'C2_PORT', 'sendall', 'USER_AGENT', 'encode', 'time', 'sleep', 'OSError', 'close')
 [常量] [None, 3.0, b'UA:', 'utf-8', b'\r\n', b'PAYLOAD:', 0.2]

 [代码块] main
 [起始行] 40
 [调用名称] ('MUTEX_NAME', 'try_connect')
 [常量] [None, 0]

socket.socket(socket.AF_INET, socket.SOCK_STREAM)  

http.request.method==POST

dns

6578616c7468726561642d64726f702e696e7472616e65742e6c61622e

ftp

USER bob
PASS Ftp_S3cret_9z

icmp

ICMP_COVERT_FLAG{ping_payload_stego}

http.host == "api.corp.lab"

HTTP/1.1 200 OK

X-Admin-Token: TOKEN_LEAK{http_header_backup_key}

22
23
80
445
3389

telnet

tcp.port == 23

charlie

Telnet_PASS_FLAG{legacy_cleartext}

公司某员工的电脑感染了勒索病毒，所有办公文档都被加密。安全团队在病毒仍在运行时制作了内存镜像。要求从内存镜像中提取加密密钥，解密被加密的最重要文档，获取其中的 flag。

New-Item -ItemType Directory -Force -Path .\extracted

$env:PYTHONIOENCODING='utf-8'
vol.exe -q --cache-path .\volcache -s .\symbols -o .\extracted `
  -f .\HACKER-20260606-174920.dmp windows.dumpfiles.DumpFiles `
  --filter ransom --ignore-case

for (int i = 0; i < 256; i++)
    v51[i] = i;

偏移 0x00：4 字节 Magic，"RNSM"
偏移 0x04：4 字节原始文件大小，小端序
偏移 0x08：RC4 密文

BOOL CryptGenRandom(
    HCRYPTPROV hProv,  // phProv
    DWORD dwLen,       // 0x10u
    BYTE *pbBuffer     // qword_14000F030 + 4
);

偏移 0x00：0xDEADC0DE       4字节前哨
偏移 0x04：RC4 key         16字节
偏移 0x14：0xCAFEBABE       4字节后哨
总长度：0x18               24字节

DE C0 AD DE ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? BE BA FE CA

小张的摸鱼日记.txt
    
    
    ================================================================
      小张的摸鱼日记.txt
    ================================================================
    
    下午 2:15
    老板让我看财务发的"年度财报模板"。
    邮件标题【急！速看】，行吧，速看就速看。
    点开之后……好像没反应？算了，先去接杯水。
    
    下午 2:31
    回来桌面弹了个红框框，说我文件被加密了，
    让我转 0.5 个比特币。
    0.5 个比特币多少钱来着？我月薪都不够。
    
    下午 2:33
    冷静。先发个朋友圈。
    配文：在吗？教我一下怎么把今天从日历上删掉。
    零赞。连我妈都没赞。
    
    下午 2:40
    打给隔壁老李，占线。
    打给我对象，她说"活该谁让你上班摸鱼"。
    我没摸鱼啊，这是工作需要点的附件！
    ……好吧我确实也开着淘宝。
    
    下午 2:52
    老李终于回了，就一句："别关机，等我。"
    然后又没声了。
    你们搞安全的能不能把话说完整啊喂！
    
    下午 3:10
    等老李的时候我重读了一遍勒索信。
    错别字三个，标点不对俩，结尾还写"祝您生活愉快"。
    被你勒索还愉快个屁。
    
    下午 3:30
    老李来了，捣鼓了十分钟，文件回来了。
    我问他怎么弄的，他说"说了你也不懂"。
    行吧大佬，奶茶我请，三杯，加料的那种。
    
    下午 3:47
    今日总结：
      1. 标题带"急"和"！"的邮件，九成九有鬼。
      2. 中招了先别慌，更别发朋友圈，没人赞。
      3. 公司一定要养一个老李。
    
    ——— 完 ———
    
    P.S. 早知道今天就请假了。
    ================================================================

偏移 0x00：4 字节 Magic，"RNSM"
偏移 0x04：4 字节原始文件大小，小端序
偏移 0x08：RC4 密文

from pathlib import Path

from Crypto.Cipher import ARC4


BASE_DIR = Path(__file__).resolve().parent
ENC_PATH = BASE_DIR / "secret_project4.docx.enc"
OUT_PATH = BASE_DIR / "secret_project4.docx"
KEY = bytes.fromhex("cb8978dde5b08227aac1c40ba91849c5")


def main() -> None:
    data = ENC_PATH.read_bytes()
    plaintext = ARC4.new(KEY).decrypt(data[8:])
    OUT_PATH.write_bytes(plaintext)
    print(f"enc={ENC_PATH}")
    print(f"out={OUT_PATH}")
    print(f"magic={plaintext[:8]!r}")
    print(f"size={len(plaintext)}")


if __name__ == "__main__":
    main()