IDF实验室CTF题解——WEB(更新中，已完成5/7)

源

IDF实验室CTF训练营-WEB

题解

1 一种编码而已

老题，复制粘贴到console里运行，其实是js代码。

key：WCTF{H3110_J0t4er}

---

2 你关注最新的漏洞吗

下载发现是一个数据包，格式转换成pcap格式。
使用WireShark打开之，发现四个包。
协议不熟，查之发现是kerberos。
查了一下协议以及题中提示的漏洞。
第一反应是用漏洞原理破解这个包中的密文找到key之类的。

后发现漏洞编号就是答案= =

是在下输了

key：wctf{MS14-068}

---

3 简单的js解密

查看源代码：

function pseudoHash(string, method) {  // Default method is encryption  if (!('ENCRYPT' == method || 'DECRYPT' == method)) {    method = 'ENCRYPT';  }  // Run algorithm with the right method  if ('ENCRYPT' == method) {    // Variable for output string    var output = '';    // Algorithm to encrypt    for (var x = 0, y = string.length, charCode, hexCode; x < y; ++x) {      charCode = string.charCodeAt(x);      if (128 > charCode) {        charCode += 128;      } else if (127 < charCode) {        charCode -= 128;      }      charCode = 255 - charCode;      hexCode = charCode.toString(16);      if (2 > hexCode.length) {        hexCode = '0' + hexCode;      }      output += hexCode;    }    // Return output    return output;  } else if ('DECRYPT' == method) {    // DECODE MISS    // Return ASCII value of character    return string;  }}document.getElementById('password').value = pseudoHash('4e4a1a4e4d4d1a474c461b191b1e1e481c1a4649464a4c4919464b1e1a1c1949', 'DECRYPT');

意思就是我们要根据已给出的加密算法写一段解密的算法，如果解密成功就出key。
添加解密算法如下：

var output = '';for(var x=0,y=string.length,charcode,hexcode;x<y;x=x+2){    hexcode=string.substr(x,2);    charcode=parseInt(hexcode,16);    charcode=255-charcode;    if (charcode<128) {    charcode += 128;    }      if (charcode>127) {        charcode -= 128;    }    output+=String.fromCharCode(charcode);}return output;document.write(output);

提交解密字串得到key:wctf{jS_decRypt__Eaaasy}

---

4 超简单的js题

查看源码：

var p1 = '%66%75%6e%63%74%69%6f%6e%20%63%68%65%63%6b%53%75%62%6d%69%74%28%29%7b%76%61%72%20%61%3d%64%6f%63%75%6d%65%6e%74%2e%67%65%74%45%6c%65%6d%65%6e%74%42%79%49%64%28%22%70%61%73%73%77%6f%72%64%22%29%3b%69%66%28%22%75%6e%64%65%66%69%6e%65%64%22%21%3d%74%79%70%65%6f%66%20%61%29%7b%69%66%28%22%62%34%36%61%64%35%66%66%61%31';var p2 = '%30%66%66%33%36%32%31%63%32%66%64%63%39%33%22%3d%3d%61%2e%76%61%6c%75%65%29%72%65%74%75%72%6e%21%30%3b%61%6c%65%72%74%28%22%45%72%72%6f%72%22%29%3b%61%2e%66%6f%63%75%73%28%29%3b%72%65%74%75%72%6e%21%31%7d%7d%64%6f%63%75%6d%65%6e%74%2e%67%65%74%45%6c%65%6d%65%6e%74%42%79%49%64%28%22%6c%65%76%65%6c%51%75%65%73%74%22%29%2e%6f%6e%73%75%62%6d%69%74%3d%63%68%65%63%6b%53%75%62%6d%69%74%3b';eval(unescape(p1) + unescape('%61%64%62%33%61%66%33%63' + p2));

使用XSSEE解码得到：

//P1var p1 = 'function checkSubmit(){    var a=document.getElementById("password");    if("undefined"!=typeof a){        if("b46ad5ffa1';//P2var p2 = '0ff3621c2fdc93"==a.value)        return!0;        alert("Error");        a.focus();        return!1    }}document.getElementById("levelQuest").onsubmit=checkSubmit;';//evaleval(unescape(p1) + unescape('adb3af3c' + p2));

组合起来就是：

function checkSubmit(){    var a=document.getElementById("password");    if("undefined"!=typeof a){        if("4eeca40b0f5661864a12d73f4d3ddc0a"==a.value)            return!0;        alert("Error");        a.focus();        return!1    }}document.getElementById("levelQuest").onsubmit=checkSubmit;

提交4eeca40b0f5661864a12d73f4d3ddc0a
得到key：wctf{webclieNt_c0py}

---

5 古老的邮件密码

uuencode解码
key:wctf{uuuuuencode__}

---

6 COOKIE欺骗