Skip to content

Commit 962aaa3

Browse files
le31eile31ei
committed
first commit
0 parents  commit 962aaa3

File tree

1,178 files changed

+140702
-0
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

1,178 files changed

+140702
-0
lines changed

‎.DS_Store

12 KB
Binary file not shown.

‎README.md

+67
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
# CTF培训题目集合
2+
3+
**这些题目均是在前安服工作时候积累的培训题目，做成了docker环境，可以直接使用`docker-compose up -d`启动题目，部分题目可能未完善，存在bug。目前的工作不再做一线安服了，就把题目开源，给还战斗在一线的安服兄弟们一个参考。如果有侵权，联系我删除。**
4+
5+
6+
7+
题目名称| 分类 | 难度 | 维护人
8+
-|-|-|-|
9+
[签到题](misc/MISC0/)| 杂项| 🌟 | le31ei
10+
[头等舱](web/toudengcang)| web | 🌟 |le31ei
11+
[代码审计](web/codeaudit1) | web | 🌟 |le31ei
12+
[胖虎](web/panghu) | web | 🌟🌟🌟🌟🌟 | le31ei
13+
[这是什么](crypto/zheshishenme)| 加密解密 | 🌟 | le31ei
14+
[php反序列化-1](web/unserialize-1)| web| 🌟🌟| le31ei
15+
[php反序列化-2](web/unserialize-2)| web| 🌟🌟| le31ei
16+
[文件包含-1](web/safe_include)| web| 🌟🌟|le31ei
17+
[找到证据](misc/findpass)| misc | 🌟 | le31ei
18+
[解压缩](misc/depress)| misc| 🌟 | le31ei
19+
[恢复文件](misc/backfile) | misc | 🌟 | le31ei
20+
[找到证据2](misc/findpass2) | misc | 🌟🌟 | le31ei
21+
[简单js](web/js_hell_1)| web | 🌟 | le31ei
22+
[简单js-2](web/js_hell_2) | web | 🌟 | le31ei
23+
[CISCN 2019 华东北 Web2](web/CISCN_2019_northeastern_China_web2) | web | 🌟🌟🌟🌟🌟| le31ei
24+
[CISCN2019 华东南赛区 Web11](web/CISCN_2019_southwestern_China_web11) | web | 🌟🌟🌟🌟🌟| le31ei
25+
[CISCN 2019 华东南 Double Secret](web/CISCN_2019_southeastern_China_double_secret) | web | 🌟🌟🌟🌟🌟| le31ei
26+
[CISCN2019 华东南赛区 Web4](web/CISCN_2019_southeastern_China_web4) | web | 🌟🌟🌟🌟| le31ei
27+
[文件包含](web/upload_include) | web | 🌟🌟🌟🌟 | le31ei
28+
[变量覆盖](web/phpBestLanguage) | web | 🌟 | SiJiDo
29+
[url绕过](web/curl) | web | 🌟 | SiJiDo
30+
[xff伪造](web/xff) | web | 🌟 | SiJiDo
31+
[url编码双写](web/urlencode) | web | 🌟 | SiJiDo
32+
[文件包含与文件上传结合](web/upload_include2) | web | 🌟🌟 | SiJiDo
33+
[sql盲注](web/sqliBlind) | web | 🌟🌟 | SiJiDo
34+
[多次解码](Crypto/Crypto1) | Crypto | 🌟 | SiJiDo
35+
[凯撒密码](Crypto/Crypto2) | Crypto | 🌟 | SiJiDo
36+
[栅栏密码](Crypto/Crypto3) | Crypto | 🌟 | SiJiDo
37+
[RSA基础](Crypto/Crypto4) | Crypto | 🌟🌟 | SiJiDo
38+
[剧情大反转](misc/MISC1) | misc | 🌟🌟 | SiJiDo
39+
[流量分析](misc/MISC2) | misc | 🌟 | SiJiDo
40+
[五彩斑斓的青春](misc/MISC3) | misc | 🌟 | SiJiDo
41+
[FindMe](misc/MISC4) | misc | 🌟🌟🌟🌟 | SiJiDo
42+
[Reverse1](reverse/reverse1) | reverse | 🌟🌟 | SiJiDo
43+
[Crackme-ok](reverse/reverse2) | reverse | 🌟🌟🌟 | SiJiDo
44+
[Reverse](reverse/reverse3) | reverse | 🌟🌟 | SiJiDo
45+
[难](reverse/reverse4) | reverse | 🌟🌟🌟🌟 | SiJiDo
46+
[百度搜索](web/web_ssrf) | web | 🌟 | SiJiDo
47+
[php特性](web/web_php) | web | 🌟 | SiJiDo
48+
[php反序列化基础](web/web_ser1) | web | 🌟 | SiJiDo
49+
[php反序列化2](web/web_ser2) | web | 🌟🌟 | SiJiDo
50+
[php反序列化3](web/web_ser3) | web | 🌟🌟🌟 | SiJiDo
51+
[最最最简单的sql注入](web/web_sql1) | web | 🌟 | SiJiDo
52+
[文件上传](web/web_upload1) | web | 🌟 | SiJiDo
53+
[php文件上传与包含再利用](web/web_upload1) | web | 🌟🌟🌟 | SiJiDo
54+
[XSS基础](web/web_xss) | web | 🌟 | SiJiDo
55+
[chall](mobile/mobile1) | mobile | 🌟🌟🌟 | SiJiDo
56+
[地狱](mobile/mobile2) | mobile | 🌟🌟🌟🌟🌟 | SiJiDo
57+
[php弱类型1](web/phpwake) | web | 🌟 | le31ei
58+
[php弱类型2](web/phpwake2) | web | 🌟🌟 | le31ei
59+
[php反序列化-3](web/unserialize-3)| web| 🌟🌟| le31ei
60+
[php反序列化-4](web/unserialize-4)| web| 🌟| le31ei
61+
[条件竞争](practice/race)| practice | 无 | le31ei
62+
[条件竞争2](web/upload)| web | 🌟 | le31ei
63+
[网络管理系统](web/sqlin1)| web | 🌟🌟🌟🌟 | le31ei
64+
[网鼎杯2018comment](web/wdb_2018_comment)| web | 🌟🌟🌟🌟 | le31ei
65+
[网鼎杯2018fakebook](web/wdb_2018_fakebook)| web | 🌟🌟🌟🌟 | le31ei
66+
[网鼎杯2018unfinish](web/wdb_2018_unfinish)| web | 🌟🌟🌟🌟 | le31ei
67+
[超级ping工具](web/weakradom)| web | 🌟🌟🌟🌟 | le31ei

‎crypto/Crypto1/Readme.md

+20
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
# 题目：Crypto1
2+
3+
### 题目描述：多次解码
4+
5+
### 题目难度： 🌟
6+
7+
### 维护：SiJiDo
8+
9+
### KEY: `flag{8ea44e39c914c5ddfbb9808c10033421}`
10+
11+
### 配置信息：
12+
13+
​ 1.开放端口： `8080`
14+
15+
### 解题过程：
16+
17+
1.将所给字符串进行16进制解码
18+
2.将1中解码结果进行unicode解码
19+
3.将2中解码结果进行base64解码
20+
4.将3中解码结果转换为ascii字符即可获取flag

‎crypto/Crypto1/desc.yaml

+6
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
name: Crypto1
2+
category: crypto
3+
description: 多次解码
4+
hardlevel: 1
5+
flag: flag{8ea44e39c914c5ddfbb9808c10033421}
6+
is_docker: true

‎crypto/Crypto1/docker-compose.yml

+9
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
version: "2"
2+
services:
3+
web:
4+
image: php:5.4-apache
5+
ports:
6+
- 80
7+
volumes:
8+
- ./www/:/var/www/html/
9+

‎crypto/Crypto1/www/decode.txt

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
0x262337373B262338343B262336353B26233132313B262336373B26233130363B262336393B26233131393B262337393B262336353B26233131313B262335333B262337383B26233131393B26233131313B26233132303B262337373B262336383B262337373B262337353B262337373B262338343B262337333B26233132323B262336373B26233130363B262338353B262335303B262336373B26233130363B262336393B26233131393B262337373B262338313B26233131313B262335333B262337383B26233131393B26233131313B262334393B262337373B26233130333B26233131313B262334393B262337373B26233130333B26233131313B26233132303B262337373B262336383B262336393B262337353B262337383B262338343B262336393B262337353B262337383B262338343B262339393B262337353B262337393B262338343B26233130373B262337353B262337383B262338343B262339393B262337353B262337383B262336383B26233130373B262337353B262337383B262338343B262337333B262337353B262337393B262338343B26233130373B262337353B262337383B262338343B262337373B262337353B262337373B262338343B262336353B26233131393B262336373B26233130363B262336393B26233131393B262337373B262336353B26233131313B26233132303B262337373B262336383B262337333B262337353B262337393B262338343B26233130333B262337353B262337393B262338343B26233130333B262337353B262337383B262338343B262339393B262337353B262337383B262338343B262338393B262337353B262337383B262336383B26233130333B262337353B262337383B262338343B262338393B262337353B262337393B262338343B26233130373B262337353B262337383B262336383B26233130373B262337353B262337383B262336383B26233130333B262337353B262337383B262336383B26233130333B262337353B262337383B262338343B262336393B262337353B262337383B262338343B262336393B262337353B262337383B262338343B262337333B262337353B262337383B262338343B262336353B262337353B262337383B262336383B26233130373B262337353B262337373B262338343B262337333B262334393B

‎crypto/Crypto1/www/index.php

+3
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
<?php
2+
header("Location: decode.txt");
3+
?>

‎crypto/Crypto2/Readme.md

+23
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
# 题目：Crypto2
2+
3+
### 题目描述：凯撒加密
4+
5+
### 题目难度： 🌟
6+
7+
### 维护：SiJiDo
8+
9+
### KEY: `flag{e57b9e18b08bff0d05a3c59900b109a4}`
10+
11+
### 配置信息：
12+
13+
​ 1.开放端口： `8080`
14+
15+
### 解题过程：
16+
17+
将给出数字转换为ascii字符后得到：
18+
mshn{l57i9l18i08imm0k05h3j59900i10???}tk5:742lh8152mm11i1m6m9314j3j4lmm93l
19+
再通过凯撒密码进行解密，当偏移量为7时，得到：
20+
flag{e57b9e18b08bff0d05a3c59900b10???}
21+
MD5:742ea8152ff11b1f6f9314c3c4eff93e
22+
在根据MD5值爆破出flag值为：
23+
flag{e57b9e18b08bff0d05a3c59900b109a4}

‎crypto/Crypto2/desc.yaml

+6
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
name: Crypto2
2+
category: crypto
3+
description: 凯撒加密
4+
hardlevel: 1
5+
flag: flag{e57b9e18b08bff0d05a3c59900b109a4}
6+
is_docker: true

‎crypto/Crypto2/docker-compose.yml

+8
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
version: "2"
2+
services:
3+
web:
4+
image: php:5.4-apache
5+
ports:
6+
- 80
7+
volumes:
8+
- ./www/:/var/www/html/

‎crypto/Crypto2/www/index.php

+3
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
<?php
2+
header("Location: 题目.txt");
3+
?>

‎crypto/Crypto2/www/题目.txt

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
109 115 104 110 123 108 53 55 105 57 108 49 56 105 48 56 105 109 109 48 107 48 53 104 51 106 53 57 57 48 48 105 49 48 63 63 63 125 116 107 53 58 55 52 50 108 104 56 49 53 50 109 109 49 49 105 49 109 54 109 57 51 49 52 106 51 106 52 108 109 109 57 51 108

‎crypto/Crypto3/Readme.md

+20
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
# 题目：Crypto3
2+
3+
### 题目描述：栅栏密码
4+
5+
### 题目难度： 🌟
6+
7+
### 维护：SiJiDo
8+
9+
### KEY: `flag{3644257ea4673a9e093663207f24008f}`
10+
11+
### 配置信息：
12+
13+
​ 1.开放端口： `8080`
14+
15+
### 解题过程：
16+
17+
1、将图片中包含的txt文件分离
18+
2、暴力破解栅栏密码，并进行base64解码
19+
3、当栏数为7时，获得flag：
20+
flag{3644257ea4673a9e093663207f24008f}

‎crypto/Crypto3/desc.yaml

+6
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
name: Crypto3
2+
category: crypto
3+
description: 栅栏密码
4+
hardlevel: 1
5+
flag: flag{3644257ea4673a9e093663207f24008f}
6+
is_docker: true

‎crypto/Crypto3/docker-compose.yml

+9
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
version: "2"
2+
services:
3+
web:
4+
image: php:5.4-apache
5+
ports:
6+
- 80
7+
volumes:
8+
- ./www/:/var/www/html/
9+

‎crypto/Crypto3/www/index.php

+3
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
<?php
2+
header("Location: test.rar");
3+
?>

‎crypto/Crypto3/www/test.rar

658 KB
Binary file not shown.

‎crypto/Crypto4/Readme.md

+32
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
# 题目：Crypto4
2+
3+
### 题目描述：rsa基础
4+
5+
### 题目难度： 🌟🌟
6+
7+
### 维护：SiJiDo
8+
9+
### KEY: `flag{1e257b39a25c6a7c4d66e197}`
10+
11+
### 配置信息：
12+
13+
​ 1.开放端口： `8080`
14+
15+
### 解题过程：
16+
17+
1.使用factordb分解n，得到3个数，运用相关数学推导，编写exp，运行即可得到flag。
18+
19+
```
20+
import libnum
21+
import gmpy2
22+
q=782758164865345954251810941
23+
p=810971978554706690040814093
24+
r=1108609086364627583447802163
25+
e= 59159
26+
c= 449590107303744450592771521828486744432324538211104865947743276969382998354463377
27+
n= 703739435902178622788120837062252491867056043804038443493374414926110815100242619
28+
phi_n = (p-1)*(q-1)*(r-1)
29+
d = gmpy2.invert(e,phi_n)
30+
print libnum.n2s(pow(c,d,n))
31+
```
32+

‎crypto/Crypto4/desc.yaml

+6
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
name: Crypto4
2+
category: crypto
3+
description: rsa基础
4+
hardlevel: 2
5+
flag: flag{1e257b39a25c6a7c4d66e197}
6+
is_docker: true

‎crypto/Crypto4/docker-compose.yml

+9
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
version: "2"
2+
services:
3+
web:
4+
image: php:5.4-apache
5+
ports:
6+
- 80
7+
volumes:
8+
- ./www/:/var/www/html/
9+

‎crypto/Crypto4/www/index.php

+3
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
<?php
2+
header("Location: rsa.zip");
3+
?>

‎crypto/Crypto4/www/rsa.zip

269 Bytes
Binary file not shown.

‎crypto/Crypto5/Readme.md

+44
Large diffs are not rendered by default.

‎crypto/Crypto5/desc.yaml

+6
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
name: Crypto5
2+
category: crypto
3+
description: hafuhafu
4+
hardlevel: 1
5+
flag: flag{D0nT_uS3_Th3_kN0w_n}
6+
is_docker: true

‎crypto/Crypto5/docker-compose.yml

+8
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
version: "2"
2+
services:
3+
web:
4+
image: php:5.4-apache
5+
ports:
6+
- 80
7+
volumes:
8+
- ./www/:/var/www/html/

‎crypto/Crypto5/www/enc

+7
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
pk = (25572000680139535995611501720832880791477922165939342981900803052781801299380515116746468338767634903543966903733806796606602206278399959935132433794098659859300196212479681357625729637405673432324426686371817007872620401911782200407165085213561959188129407530503934445657941975876616947807157374921539755157591354073652053446791467492853468641331291383821277151309959102082454909164831353055082841581194955483740168677333571647148118920605752176786316535817860771644086331929655259439187676703604894258185651165017526744816185992824404330229600417035596255176459265305168198215607187593109533971751842888237880624087,65537)
2+
------ enc -------
3+
DTlEiAKLE24m19es4TBWl4Uo2MvmQMEYqWBCFggWJlJSjCwl3fT9322ytgudiQW2raDh53e6t2ed
4+
ygpFOP+MsAPXlU469rlmVng5JyDl0CF0ypevnaM5i+CvNT2mBoDadIYnPBVGMtj9HVVPDpMIgv5b
5+
F9N5ddQS7JB21oDdQBdDLTkKvcSqegtjNFv04R8+yrqOMZYpzdCRRw0j/MMt2JefC6z36mjrTL85
6+
A9EKlwKg5ydW7qELycfjBvzB/cwJ7mJ2I0xVPToa3sSLNDyddFttATwU6wmCa4XaWpTwVR/PfET2
7+
FRj0p+8UwYSDdlLLh6gRUVURpT+2jc9zx/rhOw==

‎crypto/Crypto5/www/index.php

+3
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
<?php
2+
header("Location: enc");
3+
?>

‎crypto/Crypto6/Readme.md

+39
Large diffs are not rendered by default.

‎crypto/Crypto6/desc.yaml

+6
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
name: Crypto6
2+
category: crypto
3+
description: Not only base??
4+
hardlevel: 1
5+
flag: flag{N0t_0NLy_b4sE32}
6+
is_docker: true

‎crypto/Crypto6/docker-compose.yml

+8
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
version: "2"
2+
services:
3+
web:
4+
image: php:5.4-apache
5+
ports:
6+
- 80
7+
volumes:
8+
- ./www/:/var/www/html/

‎crypto/Crypto6/www/code

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
MCJIJSGKP=ZZYXZXRMU=W3YZG3ZZ==G3HQHCUS==

‎crypto/Crypto6/www/index.php

+3
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
<?php
2+
header("Location: code");
3+
?>

‎crypto/Crypto7/Readme.md

+48
Large diffs are not rendered by default.

‎crypto/Crypto7/desc.yaml

+6
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
name: Crypto7
2+
category: crypto
3+
description: Trace the hacker!!!!
4+
hardlevel: 2
5+
flag: flag{U_f1nd_Me!}
6+
is_docker: true

‎crypto/Crypto7/docker-compose.yml

+8
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
version: "2"
2+
services:
3+
web:
4+
image: php:5.4-apache
5+
ports:
6+
- 80
7+
volumes:
8+
- ./www/:/var/www/html/

‎crypto/Crypto7/www/index.php

+3
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
<?php
2+
header("Location: shell.pcap");
3+
?>

‎crypto/Crypto7/www/shell.pcap

15 KB
Binary file not shown.

‎crypto/zheshishenme/README.md

+33
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
# 题目：这是什么
2+
3+
### 题目描述：
4+
某银行管理员，发现公司电脑中存在一串未知数据，你能解开数据的内容么
5+
```
6+
=E4=B8=89=E5=B8=9D=E4=BA=94=E5=B8=81=E4=B8=83=E6=98=93=E6=81=A9=E5=85=AD
7+
=E5=93=A6=E8=BE=9F=E6=9B=BF=E4=BC=98=E5=85=AB=E5=BE=AE=E5=A4=96=E4=B9=9D
8+
```
9+
10+
### 知识点：Quoted-Printable编码
11+
12+
### 题目难度： 🌟
13+
14+
### 维护：le31ei
15+
16+
### KEY: `flag{3D5B7EA6OPTU8VY9}`
17+
18+
### 配置信息：
19+
无
20+
21+
### 解题过程：
22+
23+
1. 打开文件，观察文件是一串字符
24+
=E4=B8=89=E5=B8=9D=E4=BA=94=E5=B8=81=E4=B8=83=E6=98=93=E6=81=A9=E5=85=AD
25+
=E5=93=A6=E8=BE=9F=E6=9B=BF=E4=BC=98=E5=85=AB=E5=BE=AE=E5=A4=96=E4=B9=9D
26+
2、Quoted-Printable编码寻找蛛丝马迹
27+
网上搜到是Quoted-Printable编码
28+
[http://www.mxcz.net/tools/quotedprintable.aspx](http://www.mxcz.net/tools/quotedprintable.aspx) 在线解码
29+
三帝五币七易恩六
30+
哦辟替优八微外九
31+
把数字和英文发音首字母组合下得到因此答案为：3D5B7EA6OPTU8VY9
32+
33+

‎crypto/zheshishenme/desc.yaml

+11
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
name: zheshishenme
2+
category: crypto
3+
description: >
4+
某银行管理员，发现公司电脑中存在一串未知数据，你能解开数据的内容么
5+
```
6+
=E4=B8=89=E5=B8=9D=E4=BA=94=E5=B8=81=E4=B8=83=E6=98=93=E6=81=A9=E5=85=AD
7+
=E5=93=A6=E8=BE=9F=E6=9B=BF=E4=BC=98=E5=85=AB=E5=BE=AE=E5=A4=96=E4=B9=9D
8+
```
9+
hardlevel: 2
10+
flag: flag{1e257b39a25c6a7c4d66e197}
11+
is_docker: false

0 commit comments

Comments
 (0)