广西首届网络安全选拔赛 bin文件的分析

这个题 一开始 我看着很简单  照着网上的也都做了

但是怎么也没有找到 backdoor    过了好多天   想起 很多文件夹一个一个试试 才找到这个文件

[~]$ binwalk -e  '/home/pipixia/桌面/CTF.bin'                                 

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
0             0x0             TP-Link firmware header, firmware version: 1.-20432.3, image version: "", product ID: 0x0, product version: 155254791, kernel load address: 0x0, kernel entry point: 0x80002000, kernel offset: 4063744, kernel length: 512, rootfs offset: 772784, rootfs length: 1048576, bootloader offset: 2883584, bootloader length: 0
69424         0x10F30         Certificate in DER format (x509 v3), header length: 4, sequence length: 64
94080         0x16F80         U-Boot version string, "U-Boot 1.1.4 (Aug 26 2013 - 09:07:51)"
94256         0x17030         CRC32 polynomial table, big endian
131584        0x20200         TP-Link firmware header, firmware version: 0.0.3, image version: "", product ID: 0x0, product version: 155254791, kernel load address: 0x0, kernel entry point: 0x80002000, kernel offset: 3932160, kernel length: 512, rootfs offset: 772784, rootfs length: 1048576, bootloader offset: 2883584, bootloader length: 0
132096        0x20400         LZMA compressed data, properties: 0x5D, dictionary size: 33554432 bytes, uncompressed size: 2203728 bytes
1180160       0x120200        Squashfs filesystem, little endian, version 4.0, compression:lzma, size: 2774624 bytes, 519 inodes, blocksize: 131072 bytes, created: 2015-04-13 09:35:04

[~]$ cd f                                                                     
cd: 没有那个文件或目录: f
[~]$ cd firmware-mod-kit                                                      
[~/firmware-mod-kit]$ ls                                            *[master] 
build-firmware.sh           firmware_mod_kit_version.txt  shared.inc
check_for_upgrade.sh        ipkg_install_all.sh           shared-ng.inc
cleanup.sh                  ipkg_install.sh               squashfs-root
creating_ipkg_packages.htm  ipkg_remove_all.sh            src
ddwrt-gui-extract.sh        ipkg_remove.sh                trunk
ddwrt-gui-rebuild.sh        ipk_template                  uncpio.sh
extract-firmware.sh         old-build.sh                  uncramfs_all.sh
firmware_mod_kit.htm        old-extract.sh                unsquashfs_all.sh
[~/firmware-mod-kit]$ ./unsquashfs_all.sh '/home/pipixia/桌面/_CTF.bin.extracted/120200.squashfs' 
./unsquashfs_all.sh: 行 85: ./src/binwalk: 没有那个文件或目录
Attempting to extract SquashFS .X file system...


Trying ./src/squashfs-2.1-r2/unsquashfs... 
Trying ./src/squashfs-2.1-r2/unsquashfs-lzma... 
Trying ./src/squashfs-3.0/unsquashfs... 
Trying ./src/squashfs-3.0/unsquashfs-lzma... 
Trying ./src/squashfs-3.0-lzma-damn-small-variant/unsquashfs-lzma... 
Trying ./src/others/squashfs-2.0-nb4/unsquashfs... 
Trying ./src/others/squashfs-3.0-e2100/unsquashfs... 
Trying ./src/others/squashfs-3.0-e2100/unsquashfs-lzma... 
Trying ./src/others/squashfs-3.2-r2/unsquashfs... 
Trying ./src/others/squashfs-3.2-r2-lzma/squashfs3.2-r2/squashfs-tools/unsquashfs... 
Trying ./src/others/squashfs-3.2-r2-hg612-lzma/unsquashfs... 
Trying ./src/others/squashfs-3.2-r2-wnr1000/unsquashfs... 
Trying ./src/others/squashfs-3.2-r2-rtn12/unsquashfs... 
Trying ./src/others/squashfs-3.3/unsquashfs... 
Trying ./src/others/squashfs-3.3-lzma/squashfs3.3/squashfs-tools/unsquashfs... 
Trying ./src/others/squashfs-3.3-grml-lzma/squashfs3.3/squashfs-tools/unsquashfs... 
Trying ./src/others/squashfs-3.4-cisco/unsquashfs... 
Trying ./src/others/squashfs-3.4-nb4/unsquashfs... 
Trying ./src/others/squashfs-3.4-nb4/unsquashfs-lzma... 
Trying ./src/others/squashfs-4.2-official/unsquashfs... Parallel unsquashfs: Using 4 processors

Trying ./src/others/squashfs-4.2/unsquashfs... Parallel unsquashfs: Using 4 processors

Trying ./src/others/squashfs-4.0-lzma/unsquashfs-lzma... Parallel unsquashfs: Using 4 processors
480 inodes (523 blocks) to write

[=====================================================\         ] 454/523  86%
created 341 files
created 39 directories
created 70 symlinks
created 0 devices
created 0 fifos
File system sucessfully extracted!
MKFS="./src/others/squashfs-4.0

然后是在 tmp里面   我也是醉了 2333

然后backdoor 还有 upx壳  然后用upx 脱一下壳就可以了

 

 

嗯 服务器网址也就是 echo.byethost51.com:36667