[{"data":1,"prerenderedAt":273},["ShallowReactive",2],{"content:\u002F2022\u002Fctf-xupt-skill":3,"surround:\u002F2022\u002Fctf-xupt-skill":261},{"id":4,"title":5,"body":6,"categories":235,"date":237,"description":238,"draft":239,"extension":240,"image":241,"meta":242,"navigation":244,"path":245,"permalink":246,"published":246,"readingTime":247,"recommend":246,"references":246,"seo":252,"sitemap":253,"stem":254,"tags":255,"type":258,"updated":259,"__hash__":260},"content\u002Fposts\u002F2022\u002Fctf-xupt-skill.md","西邮网安技能赛WriteUp",{"type":7,"value":8,"toc":215},"minimark",[9,22,26,31,34,38,53,57,64,70,73,76,79,83,86,90,93,97,100,103,114,117,120,123,126,129,132,135,140,144,147,150,153,160,182,187,193,196,200,203,206,209,212],[10,11,12],"blockquote",{},[13,14,15,16,21],"p",{},"前面废话比较多，",[17,18,20],"a",{"href":19},"#writeup","点此跳过","。",[23,24,25],"h2",{"id":25},"遇到的问题",[27,28,30],"h3",{"id":29},"_0-比赛报名组队两个队长干瞪眼","0. 比赛报名组队：两个队长干瞪眼",[13,32,33],{},"比赛为三人一队，报名时可选择创建队伍或者加入他人队伍。创建队伍后，队长可以删除队员，但队长不能解散队伍并加入他人队伍。导致本人在找到“二缺一”的队伍时无法加入，最后草草“孤军奋战”了事。",[27,35,37],{"id":36},"_1-比赛事项告知只有网安院新生群有真正参与方式","1. 比赛事项告知：只有网安院新生群有真正参与方式",[13,39,40,41,45,46,49,50,21],{},"本次比赛属于校级比赛，在比赛事项告知一事上，仍有可提升的方面：",[42,43,44],"strong",{},"登记学分、领取奖品","的事项需要加入“比赛QQ群”，但比赛宣传海报、公众号报名指引文章、第二课堂（学校学分、活动系统）、正式比赛平台（题目、公告）上",[42,47,48],{},"找不到任何有关“比赛QQ群”的信息","，导致本人",[42,51,52],{},"无法跟进后续环节",[27,54,56],{"id":55},"_2-比赛复盘要收费","2. 比赛复盘：要收费",[58,59],"pic",{":mirror":60,"densities":61,"src":62,"caption":63},"true","1.5x","https:\u002F\u002Fmmbiz.qpic.cn\u002Fmmbiz_png\u002F9sIibiadwv3fbR2djcvEqTjtOJavT3z9ibWlN2DuWkx4QegGN2iaWMibbt3G6xXDRwIHGgBww0ic9OV3hQH2tKlqWiakQ\u002F640","复盘题目需要付费",[13,65,66,67],{},"举办比赛本身需要耗费大量的人力物力财力，比赛依托第三方平台，赛后一个月复盘时收费属于正常现象。",[42,68,69],{},"本人在答题时只留存了WriteUp，但为了撰写此文章，题目内容均作了回忆，若有偏差，敬请谅解！",[27,71,72],{"id":72},"本人的反思",[13,74,75],{},"由于本人缺乏参加比赛的经验，遇到很多意料之外的情况，最后在比赛开始三个小时后不再答题。大学中的CTF竞赛一般都有对应的QQ群，后面有如果还有机会参加此类比赛，一定会尽力联系相关人员问清比赛事项。",[23,77,78],{"id":78},"解题情况",[58,80],{":mirror":60,"densities":61,"src":81,"caption":82},"https:\u002F\u002Fmmbiz.qpic.cn\u002Fmmbiz_png\u002F9sIibiadwv3fbR2djcvEqTjtOJavT3z9ibWogpgJDsZbfjY6fNmGejeGxUHniawPLkSDFGaLnHVgD39yQnrFvAOhcw\u002F640","排名",[13,84,85],{},"赛事设置一等奖1组、二等奖2组、三等奖3组、优秀奖5组，最后一个获奖队伍的排名为34，但由于种种原因，没有参加评奖环节。",[58,87],{":mirror":60,"densities":61,"src":88,"caption":89},"https:\u002F\u002Fmmbiz.qpic.cn\u002Fmmbiz_png\u002F9sIibiadwv3fbR2djcvEqTjtOJavT3z9ibWxGHgLN7PvGS0LXvVaQcWJ0Me8HS1qRxqhHv2nodTKLAnlOqga1aAiag\u002F640","答题",[13,91,92],{},"比赛每队三人，但由于本人能力有限，在周围没能找到未组队的选手，最后独自一队参加比赛。",[23,94,96],{"id":95},"writeup","WriteUp",[27,98,99],{"id":99},"上不了网了",[13,101,102],{},"题目给出了一个流量包和文本文档：",[10,104,105,108,111],{},[13,106,107],{},"网络被黑客攻击了，有很多异常流量，并且发现了一串文本：",[13,109,110],{},"_SEWTRL_T1S@N",[13,112,113],{},"flag被打乱了，顺序藏在流量中",[13,115,116],{},"使用Wireshark打开下载的流量文件，根据提示，乱序flag的顺序就藏在流量中，筛选出ping命令，发现TTL值与1~13一一对应。",[58,118],{":mirror":60,"densities":61,"src":119},"https:\u002F\u002Fmmbiz.qpic.cn\u002Fmmbiz_png\u002F9sIibiadwv3fbR2djcvEqTjtOJavT3z9ibWxlySyBmXib5VYThQWiaLFT1VPqIOvasfeut9hTicBLfyaxXZjLTC1wHqw\u002F640",[13,121,122],{},"按照1~13的顺序将flag连接。",[58,124],{":mirror":60,"densities":61,"src":125},"https:\u002F\u002Fmmbiz.qpic.cn\u002Fmmbiz_png\u002F9sIibiadwv3fbR2djcvEqTjtOJavT3z9ibW4L5wiaDtV9XTrnb5T4H8cUT0O6UJoMwP0dLqBrSPicETKBmcrxdX96Yg\u002F640",[27,127,128],{"id":128},"broken_mp4",[13,130,131],{},"题目给出了一段正常的MP4，和一段损坏并藏有flag的MP4。",[13,133,134],{},"使用十六进制编辑器对比两段视频，损坏视频的文件头有很多元数据都异常。",[10,136,137],{},[13,138,139],{},"注：手动识别正常文件头部的元数据，并把对应参数填入损坏的视频的相应位置是标准的解题方式，为了节省时间，这里使用了小工具。",[58,141],{":mirror":60,"densities":61,"src":142,"caption":143},"https:\u002F\u002Fmmbiz.qpic.cn\u002Fmmbiz_png\u002F9sIibiadwv3fbR2djcvEqTjtOJavT3z9ibW4iaHIAwicF2or5nqyoSsPKtQk7OFiaqtDrvQyK7TibCge5AfvMiamvfPsmw\u002F640","DVR工具",[13,145,146],{},"使用Digital Video Repair工具，将能正常播放的视频作为样本，修复损坏的视频，得出答案。",[58,148],{":mirror":60,"densities":61,"src":149},"https:\u002F\u002Fmmbiz.qpic.cn\u002Fmmbiz_png\u002F9sIibiadwv3fbR2djcvEqTjtOJavT3z9ibWMOicz6JP7UibBgBLB9MLxGiakwficAjgFiaFojRaqDqVnN1vTjTHu0YoS2g\u002F640",[27,151,152],{"id":152},"双重凯撒",[13,154,155,156,21],{},"题目给出了加密脚本和加密后的文本，以及提示 ",[157,158,159],"code",{"code":159},"key为你所在的位置",[13,161,162,163,166,167,170,171,174,175,178,179,181],{},"根据提示“key为所在的位置”，尝试将西安邮电大学的英文缩写 ",[157,164,165],{"code":165},"XUPT"," 作为 ",[157,168,169],{"code":169},"key","，使用程序加密字符串 ",[157,172,173],{"code":173},"flag","，发现与 ",[157,176,177],{"code":177},"output"," 前四位相同，故 ",[157,180,169],{"code":169}," 正确。",[10,183,184],{},[13,185,186],{},"由于此题两层凯撒加密的算法有漏洞，加密后再加密即为解密，故完成本题时没有编写反向计算脚本。",[13,188,189,190,192],{},"根据加密原理，加密后的字符串再次加密可以得到原文，故将 ",[157,191,177],{"code":177}," 放入程序中再次加密，得到flag。",[58,194],{":mirror":60,"densities":61,"src":195,"caption":173},"https:\u002F\u002Fmmbiz.qpic.cn\u002Fmmbiz_png\u002F9sIibiadwv3fbR2djcvEqTjtOJavT3z9ibW6GNrWuOQruKuu8dYldMSrhnG8Ox830RqJibEljz43rIDFptbBetY6Vg\u002F640",[27,197,199],{"id":198},"signin","Signin",[13,201,202],{},"题目给出了一个 Win32 二进制程序。",[13,204,205],{},"使用 IDA 打开程序，反编译为类 C 代码，得到 flag。",[58,207],{":mirror":60,"densities":61,"src":208},"https:\u002F\u002Fmmbiz.qpic.cn\u002Fmmbiz_png\u002F9sIibiadwv3fbR2djcvEqTjtOJavT3z9ibWVHSED0ic7zNcOqkyQPvzcUffZxibIKYhplrVVe05gcUn96qDL8hL6vVw\u002F640",[23,210,211],{"id":211},"总结",[13,213,214],{},"由于本人水平有限，许多题目都走了捷径，并且由于各种原因，其他题目也没能解答，这场比赛给我的教训多于成就，在我参加的比赛中属于别具特色的类型。今后的学习中，不止要注重理论技术的学习，还要注意与人的沟通、办事的技巧，这样才能得到真正的成长。",{"title":216,"searchDepth":217,"depth":217,"links":218},"",4,[219,227,228,234],{"id":25,"depth":220,"text":25,"children":221},2,[222,224,225,226],{"id":29,"depth":223,"text":30},3,{"id":36,"depth":223,"text":37},{"id":55,"depth":223,"text":56},{"id":72,"depth":223,"text":72},{"id":78,"depth":220,"text":78},{"id":95,"depth":220,"text":96,"children":229},[230,231,232,233],{"id":99,"depth":223,"text":99},{"id":128,"depth":223,"text":128},{"id":152,"depth":223,"text":152},{"id":198,"depth":223,"text":199},{"id":211,"depth":220,"text":211},[236],"安全","2022-11-05 23:13:52","主办方组织能力、办事水平有待提升。自此之后，作者再未参与过 CTF 赛事。",false,"md","https:\u002F\u002Ffly.webp.se\u002F?url=https:\u002F\u002Fmmbiz.qpic.cn\u002Fmmbiz_png\u002F9sIibiadwv3fbR2djcvEqTjtOJavT3z9ibWSpuCJ6wj9ejjZz9Dp9l0NoRjRqXjZIibsKORpAk3WFEE4k5r02cdtXQ\u002F640",{"slots":243},{},true,"\u002F2022\u002Fctf-xupt-skill",null,{"text":248,"minutes":249,"time":250,"words":251},"6 min read",5.36,321600,1072,{"title":5,"description":238},{"loc":245},"posts\u002F2022\u002Fctf-xupt-skill",[256,96,257],"CTF","校赛","tech","2022-12-04 22:18:50","sVCca7yYOeSOEMrzH0Jf3BQHge5zkFa0GlMRumizjcM",[262,268],{"title":263,"path":264,"stem":265,"date":266,"type":267,"children":-1},"周四在FF305，在了又在。","\u002F2022\u002Fthoughts-in-classroom","posts\u002F2022\u002Fthoughts-in-classroom","2022-10-08 18:01:00","story",{"title":269,"path":270,"stem":271,"date":272,"type":258,"children":-1},"西邮Linux兴趣小组2022纳新面试题题解","\u002F2022\u002Flinux-interview-2022","posts\u002F2022\u002Flinux-interview-2022","2022-11-19 22:32:46",1782091377187]