---

storage:writeup

time:2018/4/6

---

0x01 Wechall writeup

Limited Access

权限限制，限制了GET方法，改用POST或其他请求方式绕过限制

Plaintext code for .htaccess

AuthUserFile .htpasswd

AuthGroupFile /dev/null

AuthName "Authorization Required for the Limited Access Challenge"

AuthType Basic

<Limit GET>

require valid-user

</Limit>

---

Training: Crypto - Caesar II

明显是ascii码的数字，直接编写脚本，观察输出即可找到password

if __name__ == '__main__':

    str = '''XXXXXXXXXXXXXX'''

    str = str.split()

    for j in range(0, 256):

        for i in str:

            print(chr((int(i,16)+j)%128), end='')

        print()

---

Impossible n'est pas français

分解质因数，6秒内分解数百位的数字几乎不能实现，但是发现提交错误答案后会返回正确的答案，直接写脚本提交一次错误答案然后获取正确答案再次提交

---

Training: Crypto - Substitution I

还是凯撒加密，直接用词频分析破解网站

---

Limited Access Too

还是限制请求方法，除了PATCH其余都被限制了，使用PATCH绕过限制

---

PHP 0818

考虑ord()函数返回字符串的首个字符的ASCII值，提交3735929054的十六进制

---

Training: Net Ports

使用curl中 --local-port [端口]命令，校园网可以成功，但是联通网始终无法生效，也许是运营商限制了端口使用

---

Training: Encodings I

全是0和1先想办法转换成ascii字符，441位除8除不尽，考虑七位分一组，最前加0构造ascii码

---

Training: Baconian

培根加密，密文只有a和b，一般使用斜体字母为a其余为b，此处可假设大写为a小写为b，每五个ab为一组对应一个字母，U\V和I\J有可能拥有相同编码,先用python解出培根密码再用培根解密

---

Training: Crypto - Digraphs

字母两两配对替换一个真实字母，猜测第一个单词是congratulations.然后得出一部分密码对应，再逐步解码

---

Training: Regex

正则表达式的应用，注意正则表达式的前后在这里要加上/再提交，最后一个/^(wechall4?).(?:jpg|gif|tiff|bmp|png)$/

---

Training: MySQL II

用union直接把构造的账户密码传入

1' union select 1,'admin',md5('123') -- &password=123&login=Login

---

Training: Warchall - The Beginning

level0 was the welcome text:

$ grep solution 0/README.txt //grep搜索获取匹配模式的一行字符

Oh .... and your solution to level0 is: "bitwarrior" without the quotes.

level1 was finding the solution out of various files

$ find 1

gave me a file called SOLUTION.txt

$ grep solution 1/blue/pill/hats/gray/solution/is/SOLUTION.txt

Your solution for this level is: LameStartup

level2 was a hidden file //获取隐藏文件ls -a(显示所有文件目录选项)

$ grep solution 2/.porb/.solution

The solution is HiddenIsConfig

level3 was finding the solution in the bash_history file //.bash_history文件包含了操作历史

$ grep solution 3/.bash_history

The solution to SSH3 is: RepeatingHistory

level4 was chmod the file in your home dir (~) //chmod改变文件的权限

level5 was protecting your home folder:

$ umask 0077 //umask修改初始化文件的默认权限

$ chmod -R 0700 ~