[CTF]-蓝帽杯2022复现

---

电子取证

手机取证-1

打开.exe文件

搜索文件

627604C2-C586-48C1-AA16-FF33C3022159.PNG

导出文件，查看属性

360x360

---

手机取证-2

搜索姜总

聊天记录中找到

SF1142358694796

---

网站取证1

打开是个thinkphp5的框架，要求是找后门

使用D盾扫描后门

找到第一个代码段

lanmaobei666

---

网站取证2

加密文件 encrypt.php

<?php
function my_encrypt(){
    $str = 'P3LMJ4uCbkFJ/RarywrCvA==';
    $str = str_replace(array("/r/n", "/r", "/n"), "", $str);
    $key = 'PanGuShi';
    $iv = substr(sha1($key),0,16);
    $td = mcrypt_module_open(MCRYPT_RIJNDAEL_128,"",MCRYPT_MODE_CBC,"");
    mcrypt_generic_init($td, "PanGuShi", $iv);
    $decode = base64_decode($str);
    $dencrypted = mdecrypt_generic($td, $decode);
    mcrypt_generic_deinit($td);
    mcrypt_module_close($td);
    $dencrypted = trim($dencrypted);
    return $dencrypted;
}

是AES加密算法

KBLT123

---

网站取证3

jyzg123456

---

网站取证4

将2022-04-02 00:00:00-2022-04-18 23:59:59的张宝和王子豪的记录取出来，还有汇率取出来放着

汇率

0.04,0.06,0.05,0.07,0.10,0.15,0.17,0.23,0.22,0.25,0.29,0.20,0.28,0.33,0.35,0.35,0.37

# exp
import base64
import hashlib
sum = 0
p = [0.04,0.06,0.05,0.07,0.10,0.15,0.17,0.23,0.22,0.25,0.29,0.20,0.28,0.33,0.35,0.35,0.37]
with open('./data.txt','r',encoding="utf-8") as f:
    d = f.readlines()
    for i in range(len(d)):
        key = hashlib.md5(b'jyzg123456').hexdigest()
        x = 0
        char = ''
        s = ''
        if d[i].strip().split()[6] == '5,' and d[i].strip().split()[7] == '3,':     
            data = base64.b64decode(d[i].strip().split()[-1])
            date = int(d[i].strip().split()[4][9:11]) - 2
            for i in range(len(data)):
                if x == len(key):
                    x = 0
                char += key[x:x + 1]
                x += 1
            for i in range(len(data)):
                if ord(data[i:i + 1]) < ord(char[i:i + 1]):
                    s += chr(ord(data[i:i + 1]) + 256 - ord(char[i:i + 1]))
                else:
                    s += chr(ord(data[i:i + 1]) - ord(char[i:i + 1]))
            sum += float(s) * p[date]
        else:
            continue
    print(sum)

---

计算机取证1

taqi7:1000:aad3b435b51404eeaad3b435b51404ee:7f21caca5685f10d9e849cc84c340528:::

anxinqi

---

计算机取证2

volatility -f 1.dmp --profile=Win7SP1x64 pslist 

0xfffffa800f103b30 MagnetRAMCaptu         2192   2044     16      333      1      1 2022-04-28 05:54:30 UTC+0000

2192

---

Misc

domainhacker

搜http流 ，有个rar流量包

导出rar文件

用010打开，把冗余的部分删掉，保存为.rar

里面有个1.txt，需要解压密码

密码在 13 流中

有一段base64

YNY2QgL2QgImM6XFxXaW5kb3dzXFxUZW1wIiZyYXIuZXhlIGEgLVBTZWNyZXRzUGFzc3cwcmRzIDEucmFyIDEudHh0JmVjaG8gZWZhOTIzYmE1MDQmY2QmZWNobyAxYTRiZTg4MTVlZjg%3D

但是无法解码

然后是要前面加上几个字符

eeYNY2QgL2QgImM6XFxXaW5kb3dzXFxUZW1wIiZyYXIuZXhlIGEgLVBTZWNyZXRzUGFzc3cwcmRzIDEucmFyIDEudHh0JmVjaG8gZWZhOTIzYmE1MDQmY2QmZWNobyAxYTRiZTg4MTVlZjg%3D&yee092cda97a62

cd /d "c:\\Windows\\Temp"&rar.exe a -PSecretsPassw0rds 1.rar 1.txt&echo efa923ba504&cd&echo 1a4be8815ef87

密码是

SecretsPassw0rds

flag{416f89c3a5deb1d398a1a1fce93862a7}

---

domainhacker2

解压有两个文件

misc-2.pcapng
ntds.rar

在流 27 中发现密码

cd /d "c:\\Windows\\Temp"&rar.exe a -PFakePassword123$ ntds.rar new&echo 1d3632&cd&echo 78bc462ab

密码

FakePassword123$

解压得到文件

利用secretsdump.py

python .\secretsdump.py -system SYSTEM -ntds .\ntds.dit LOCAL -history

flag{07ab403ab740c1540c378b0f5aaa4087}