2022年6月8日,由工业和信息化部教育与考试中心主办,北京红亚华宇科技有限公司提供全赛程技术指导及平台支持的2022年度“强国杯”全国大数据技术应用竞赛正式启动。

WEB

upload_new

测试了一串只能提交jpg而且对

< ? 也进行了检测，可以构造小马

上传报错是Apache可以想到用.htaccess来执行php木马

用bp来修改类型

再修改图片类型

用蚁剑连接

得到flag

SQL

右键查看源代码。获取flag

MISC

Welcome_to_QGB

直接base64

包上flag即可flag

大佬大佬

题目是一张png图片，先用zsteg梭一下

发现一张png，将他分离出来

题目提示修改尺寸，将他的高修改

得到flag

The fun picture

题目是个加密的压缩包，直接爆破

密码为6yOK,解压后得到三个文件

查看flag.txt

提示flag为图片，把他放到010中没有前缀，添加上%png

得到一张二维码，扫描的到一串base64

解密得到flag

[email protected]

解压得到bat文件

不清楚是什么

先使用010打开

乱码

点击hex

经过多方资源查找 知其加密方式为batchencryption 使用py编写脚本进行解密，在此之前需要对该bat进行一些处理，以匹配该加密方式 使用010editor打开bat，切换为hex模式，在程序头部加入如下字段：

::BatchEncryption Build 201610 By [email protected]

保存为txt文件

这时候就需要脚本去修复了

附上脚本

#!/usr/bin/python
# -*- coding:utf-8 -*-
#
# Batch Decryption 202009 (BatchEncryption Build 201610)
#
 import os
import sys
 encrypt_file = ''
encodeErrByteArray = [b'\xfe', b'\xff']
 def decryption(data):
    # 去除头部后的源代码下标开始位置
    i = data.index(b'163.com\r\n') + 9
    vars = {}
    length = len(data)
    source = ''
    while i < length:
        Data = run(vars, data, i)
        i = Data.get('index')
        source += Data.get('buf')
    return source
 def run(vars, data, i):
    buf = ''
    f = 0
    t = 0
    x = False
    l = len(data)
    while(True):
        if data[i] == 0x0d and data[i+1] == 0x0a:
            i += 2
            break
        # get %var:~x,y% %0
        if data[i] == 0x25:
            if not x:
                x = True
                f = i
            else:
                x = False
                t = i
                rst = var_percent(data[f:t+1], vars)
                buf += rst
            i += 1
        else:
            if not x:
                try:
                    buf += str(data[i:i+1], encoding="utf-8")
                    i += 1
                except Exception as err:
                    # 过滤掉无法解析的字节
                    if data[i:i+1] in encodeErrByteArray:
                        buf = ''
                        i += 1
                    else:
                        # 以ansi码解析中文
                        chinese = b''
                        temp = i
                        while (str(data[temp:temp+1]).find('x') >= 0):
                            chinese += data[temp:temp+1]
                            temp += 1
                        buf += chinese.decode('ansi', 'ignore')
                        i = temp
            else:
                if (f + 1 == i) and ((data[i] >= 0x30 and data[i] <= 0x39) or data[i] == 0x2a):
                    x = False
                    t = i
                    rst = str(data[f:t+1], encoding="utf-8")
                    buf += rst
                i += 1
        if i >= l:
            break
    #print(buf)
    bufs = buf.split('&@')
    for var in bufs:
        if var[0:4] == 'set ':
            var = var[4:]
            b = var.find('=')
            vars[var[0:b]] = var[b+1:].replace('^^^', '^')
    buf += '\r\n'
    return {'index':i, 'buf':buf}
 """
%':~-53,1%
':~-53,1
["'", '-53,1']
"""
def var_percent(data, vars):
    full = str(data, encoding="utf-8")
    buf = full[1:len(full)-1]
    buf = buf.split(':~')
    var = buf[0]
    if not var in vars:
        vars[var] = os.getenv(var)
    ent = vars[var]
    if (len(buf) > 1):
        l = len(ent)
        buf = buf[1].split(',')
        f = int(buf[0])
        t = int(buf[1])
        if f < 0:
            f, t = l + f, t
        rst = ent[f: f+t]
    else:
        rst = full
    return rst
 def makeFile(path,content):
    try:
        encryptionFilePath = os.path.dirname(sys.argv[1])
        encryptionFileName = os.path.basename(sys.argv[1])
        encryptionFile = encryptionFileName.split('.')
        decryptionFileName = encryptionFile[0] + '_denctyption.' + encryptionFile[1]
        decryptionFile = encryptionFilePath + '/' + decryptionFileName
        print(decryptionFile)
        file = open(decryptionFile, 'w+')
        file.write(content)
        file.close()
    except Exception as err:
        print(err)
        exit        
 if __name__ == '__main__':
     try:
        if len(sys.argv) < 2:
            print('param len error\nuse: python dencrypt.py encrypt.bat')
            exit
        encrypt_file = sys.argv[1]
        file = open(encrypt_file, "rb")
        data = file.read()
        file.close()
        source = decryption(data)
        makeFile(encrypt_file, source)
    except Exception as err:
        print(err)
        exit

在cmd命令行输入

D:\py>python 2.py 2.txt

得到flag