1

java Extract ../../Desktop/xxx.jpg -p password

1
2
3
4

./hashcat -m 22000 -a 3 <path_to_hash_hc22000_file> -1 <custom_charset> ?1?1?1?1?1?1?1?1
# -m 22000 用于 WPA/WPA2 模式
# -a 3 Brute-Force攻击模式
# -1: 所以使用?1, 每个?1代表一个字符位置 --custom-charset1=abcdefg...也可

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15

volatility.exe -f image.vmem imageinfo # 查看镜像的系统信息 获取Win7SP1x64值替换
volatility.exe -f image.vmem --profile=Win7SP1x64 pslist # 查看进程
volatility.exe -f image.vmem --profile=Win7SP1x64 svcscan # 查看服务
volatility.exe -f image.vmem --profile=Win7SP1x64 netscan # 查看网络连接
volatility.exe -f image.vmem --profile=Win7SP1x64 cmdscan # 查看历史cmd命令
volatility.exe -f image.vmem --profile=Win7SP1x64 cmdline # 查看进程命令行参数
volatility.exe -f image.vmem --profile=Win7SP1x64 filescan # 查找所有文件列表
volatility.exe -f image.vmem --profile=Win7SP1x64filescan | findstr ".txt\|.doc\|.zip\|.png" # 相关信息匹配查询
volatility.exe -f image.vmem --profile=Win7SP1x64 filescan | findstr "flag" # 查flag文件
volatility.exe -f image.vmem --profile=Win7SP1x64 privs # 显示进程权限
volatility.exe -f image.vmem --profile=Win7SP1x64 envars # 显示环境变量
volatility -f 1.vmem --profile=Win7SP1x64 hashdump # 查看用户名密码

# 提取文件 -Q 指向内存地址
volatility -f image.vmem --profile=Win7SP1x64 dumpfiles -Q 0x7a09f20 -D D:/out_put_dir

1
2
3

binwalk xx.xx
# 分离文件
binwalk -e xx.xx

1
2
3
4
5
6

.\Decode.exe -P password -X .\xxx.mp3 # 解密

# 需要进入 MP3Stego_1_1_19\MP3Stego 目录下 否则报错
# [Frame    0]OpenTable: could not find tables/huffdec
# Check local directory './tables/'
# Please check huffman table 'huffdec'

1
2
3

e = dict() # 使用字典
e.keys() # 键
sorted_dict = dict(sorted(e.items(), key=lambda item: item[1], reverse=True)) # 排序字典

1

xue hui  >  xt hv

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14

import binascii
import struct

crcbp = open("download.png", "rb").read()    #打开图片
for i in range(2000):
    for j in range(2000):
        data = crcbp[12:16] + \ # IHDR
                struct.pack('>i', i) + \ # 宽 返回字节 >:big-endian, i:int
                struct.pack('>i', j) + \ # 高
                crcbp[24:29]
        crc32 = binascii.crc32(data) & 0xffffffff
        if(crc32 == 0x9a3fc668):    #图片当前CRC
            print(i, j)
            print('hex:', hex(i), hex(j))

1
2
3
4

import zipfile # python实现解压缩

with zipfile.ZipFile(file_path, 'r') as zip_ref:
    zip_ref.extractall(output_dir)

1
2
3

from zlib import crc32
def crc32_f(data):
    return hex(crc32(data.encode('utf-8'))&0xffffffff)[2:10] # 获取值的CRC

1
2
3
4
5
6

# cmd
dir /r
# 2024/07/28  20:54                18 flag.txt
#                                  82 flag.txt:hello.txt:$DATA
#                1 个文件             18 字节
notepad flag.txt:hello.txt # 查看隐藏文件

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19

import json
# 该字典在https://www.usb.org/sites/default/files/documents/hut1_12v2.pdf
keys = {"5d":"5","5e":"6","5f":"7"} 
data = []

with open('a.json', 'r', encoding='utf-8') as f:
    data = json.load(f)

a1 = []
for i in data:
    try:
        a1.append(i['_source']['layers']['usbhid.data'])
    except Exception as e:
        pass
ans = ""
for x in a1:
    tmp = x[6:8] # 获取第三个字节
    ans+= keys[tmp]
print(ans)

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28

from scapy.all import * # 处理网络数据包
from pwn import u32, u64, u16, u8 # 原始字节数据转换为相应长度的无符号整数

packets = rdpcap('flag.pcapng') # 加载
con = b'' # 数据总和

for pkt in packets:
    info = pkt.raw_packet_cache # 字节数据
    offset_addr = u16(info[:2]) # 2字节: USBPcap pseudoheader length
    packet_count = u32(info[0x1f:0x1f+4]) # 4字节: Isochronous transfer number of packets
    
    packet_lens = []
    for i in range(packet_count):
        # 子包的偏移量 0x27: 第一个子包起始位置, 0xc:每个子包头部长(不包括数据)
        off = u32(info[0x27+i*0xc:0x27+i*0xc+4])
        # 子包中数据长度
        packet_len = u32(info[0x27+i*0xc+4:0x27+i*0xc+8])
        packet_lens.append((off, packet_len))

    for off, packet_len in packet_lens: # 每个JPEG文件字节数据
        con += info[offset_addr+off+0xc:offset_addr+off+packet_len]

tmp = con.split(b'\xff\xd8\xff\xe0\x00\x10JFIF')
a = 0
for i in tmp:
    a += 1
    with open(f'./imgs/{a}.jpeg', 'wb') as f:
        f.write(b'\xff\xd8\xff\xe0\x00\x10JFIF' + i)

1
2
3
4

# kali
$ aircrack-ng xxx.cap
   #  BSSID              ESSID                     Encryption
   1  xx:xx:xx:xx:xx:xx  XXXXXXX                   WPA (1 handshake)

1
2
3
4
5

$ pngcheck -v x.png
...
chunk IDAT at offset 0x634d0, length 268:  EOF while reading data # IDAT块错误

$ binwalk -e x.png # 提取IDAT块，获取xxx.zlib文件(789C开头)

1
2
3
4
5
6
7

import zlib
import binascii
a = "789c45xxxxx"
re = binascii.unhexlify(a)
ans = zlib.decompress(re)
print(ans)
# b'89504E470D0'

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15

from PIL import Image
MAX = 25
pic = Image.new("RGB",(MAX, MAX))
sttr="01" # 255个
i=0
for y in range (0,MAX):
    for x in range (0,MAX):
        if(sttr[i] == '1'):
            pic.putpixel([x,y],(0, 0, 0))
        else:
            pic.putpixel([x,y],(255,255,255))
        i = i+1

pic.show()
pic.save("flag.png")

1

print("\033c") # 终端清屏

1
2

os.chdir(path) # 切换目录
os.listdir(path) # 列出目录文件

1
2
3
4

re.match("[\\\+]", code) # [..]匹配括号内任意一个字符, \\匹配\, \+匹配 +
re.search(r'["\'0-8bdhosxy_]|[^\x00-\xff]', code)
# [] 匹配其中内容中的一个, \' 转义: '
# ^ 取反 不匹配后面的范围 \x00-\xff : ASCII码 即匹配任何非ASCII码值

1

random.choices(string.ascii_uppercase + string.digits, k=6) # 6位: 大写字母及数字组成

1
2
3
4

dir(__builtins__) # 列出内置命名空间中所有属性和方法

__builtins__.__import__("os").system("cat /tmp/.f*") # 执行命令, *匹配某文件
eval(__import__('os').system('env'))

1
2
3
4
5
6
7

# 使用每个单词的chr值即ASCII码值
command = "__import__('os').system('ls')"
exp = ""
for i in command:
    exp += f"chr({ord(i)})+"
print(f"eval({exp[:-1]})")
# eval(chr(95)+chr(95)+chr(105)+chr(109)+chr(112)+chr(111)+chr(114)+chr(116)+chr(95)+chr(95)+chr(40)+chr(39)+chr(111)+chr(115)+chr(39)+chr(41)+chr(46)+chr(115)+chr(121)+chr(115)+chr(116)+chr(101)+chr(109)+chr(40)+chr(39)+chr(108)+chr(115)+chr(39)+chr(41))

1
2
3

if len(code) > 15 # 通过延后输入代码解析

eval(input()) # 使用该命令绕过初始限制

1
2
3

eval(code, {"__builtins__": {"eval": lambda *x: print("sry, no eval for u")}}, {})
# eval(code, globals, locals): globals 和 locals 定义了全局和局部命名空间
# {"__builtins__": {"eval": lambda *x: print("sry, no eval for u")}} 作为全局重写为无论输入什么都只打印

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

# 绕过
[klass for klass in "".__class__.__base__.__subclasses__() if klass.__name__ == "BuiltinImporter"][0].load_module("builtins").__import__("os").system("ls")

# "".__class__: 获取<class 'str'>
# .__base__: 获取基类<class 'object'>
# .__subclasses__(): 返回object类所有子类列表
# 列表推导式筛选出BuiltinImporter的类——用于导入内置模块
# [0]取出第一个元素BuiltinImporter类
# .load_module("builtins"): 加载builtins模块，包含python所有内置对象和函数
# .__import__("os").system("ls") # 执行命令

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12

a = "encrypt_data"
shift = 5
text = ""

for char in a:
    if char.isalpha():
        shift_base = ord('A') if char.isupper() else ord('a')
        text += chr((ord(char) - shift_base + shift) % 26 + shift_base)
    else:
        text += char

print(text)