2025数字中国创新大赛数字安全赛道｜数据安全产业积分争夺赛初赛Writeup

1

vol3 -f WIN-IRBP5Q8F25I-20250306-172341.raw windows.info

1

vol3 -f WIN-IRBP5Q8F25I-20250306-172341.raw windows.filescan | grep "log"

1

vol3 -f WIN-IRBP5Q8F25I-20250306-172341.raw windows.dumpfiles --physaddr 0x7c23ba40

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39

# -*- coding: utf-8 -*-
# @Author  : 1cePeak

import re

def extract_data(log_file, field):
    data = {}
    pattern = re.compile(
        rf'GET /manager/user/\?id=1.*?ascii\(substr\(\(select {field} from info limit (\d+),1\),(\d+),1\)\)=(\d+).*?" 200 704'
    )
    
    with open(log_file, 'r', encoding='utf-8') as f:
        for line in f:
            match = pattern.search(line)
            if match:
                index, char_pos, ascii_value = map(int, match.groups())
                char = chr(ascii_value)
                if index not in data:
                    data[index] = {}
                data[index][char_pos] = char
    
    # 组装完整的数据
    extracted_data = {
        index: ''.join(data[index][i] for i in sorted(data[index]))
        for index in sorted(data)
    }
    
    return extracted_data

if __name__ == "__main__":
    log_file = "access.log.1741305600"
    
    name_result = extract_data(log_file, "name")
    id_card_result = extract_data(log_file, "id_card")
    
    for idx in sorted(set(name_result.keys()) | set(id_card_result.keys())):
        name_value = name_result.get(idx, "N/A")
        id_card_value = id_card_result.get(idx, "N/A")
        print(f"name[{idx}] = {name_value}, id_card[{idx}] = {id_card_value}")

1

500101200012121234340104197612121234530102199810101234610112200109091234230107196504041234120105197411111234310115198502021234370202199404041234330106197708081234450305198303031234220203198808081234350203200202021234130104198707071234110101199001011234430104199707071234320508200005051234510104199311111234440305199503031234420103199912121234210202198609091234410105199206061234

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38

# -*- coding: utf-8 -*-
# @Author  : 1cePeak

import json
from scapy.all import *

# 解析JSON文件，建立IP到域名的映射
ip_domain = {}
with open('国外敏感域名清单.json', 'r') as f:
    data = json.load(f)
    for category in data['categories'].values():
        domains = category['domains']
        for domain, ip in domains.items():
            ip_domain[ip] = domain

# 解析PCAP文件，统计目标IP访问次数
ip_count = {}
packets = rdpcap('某流量审计平台导出的镜像流量.pcap')
for pkt in packets:
    if IP in pkt:
        dst_ip = pkt[IP].dst
        if dst_ip in ip_domain:
            ip_count[dst_ip] = ip_count.get(dst_ip, 0) + 1

# 找出访问次数最多的IP
max_ip = None
max_count = 0
for ip, count in ip_count.items():
    if count > max_count:
        max_count = count
        max_ip = ip

# 生成结果
if max_ip:
    domain = ip_domain[max_ip]
    print(f"{domain}:{max_ip}:{max_count}")
else:
    print("无访问记录")

1

tshark -r test.pcapng -Y "http.request.method == GET" -T fields -e http.request.uri

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29

# -*- coding: utf-8 -*-
# @Author  : 1cePeak

import re
from collections import defaultdict

# 读取SQL注入请求
with open("sql.txt", "r") as file:
    payloads = [line.strip() for line in file]

def analyze_sql_payloads():
    extracted_values = defaultdict(list)
    pattern = re.compile(r"hex\(substr\(.*?,(\d+),1\)\)='(\w+)'")
    
    for payload in payloads:
        match = pattern.search(payload)
        if match:
            index, hex_value = match.groups()
            extracted_values[int(index)].append(hex_value)
    
    final_values = {idx: values[-1] for idx, values in extracted_values.items()}
    sorted_values = sorted(final_values.items())
    decoded_chars = [bytes.fromhex(val).decode('utf-8') for _, val in sorted_values]
    extracted_string = ''.join(decoded_chars)
    
    print(extracted_string)

if __name__ == "__main__":
    analyze_sql_payloads()

1

http.request.method == POST

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40

# -*- coding: utf-8 -*-
# @Author  : 1cePeak

import re
import hashlib
import json
from collections import Counter

def extract_leaks(log_file):
    pattern = re.compile(r'\{.*?\}')
    
    with open(log_file, 'r', encoding='utf-8') as f:
        data = f.read()
    
    matches = pattern.findall(data)
    leaks = []
    for match in matches:
        try:
            info = json.loads(match)
            leaks.append((info["name"], info["phone"]))
        except json.JSONDecodeError:
            continue
    
    return leaks

def compute_top_leaks(log_file):
    leaks = extract_leaks(log_file)
    counter = Counter(leaks)
    
    top3 = counter.most_common(3)
    
    plaintext = "".join(f"{name},{phone},{count};" for (name, phone), count in top3)
    
    print(plaintext)
    flag = hashlib.md5(plaintext.encode()).hexdigest()
    return flag

if __name__ == "__main__":
    log_file = "http.log"
    print(compute_top_leaks(log_file))

1
2

王二蛋,15100266408,1053;石建,18623146812,1047;李二娃,13823137848,1037;
4a7cb07cd31c9ef2090f5f9126c6a996

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80

# -*- coding: utf-8 -*-
# @Author  : 1cePeak

import sqlite3
import os
import argparse

def search_databases(keyword, target_field=None):
    # 遍历当前目录下的所有.db文件
    for filename in os.listdir('.'):
        if not filename.endswith('.db'):
            continue
        
        print(f"\n正在搜索文件: {filename}")
        
        try:
            # 连接数据库
            conn = sqlite3.connect(filename)
            cursor = conn.cursor()
            
            # 获取所有表名
            cursor.execute("SELECT name FROM sqlite_master WHERE type='table';")
            tables = cursor.fetchall()
            
            for table in tables:
                table_name = table[0]
                print(f"  正在检查表: {table_name}")
                
                # 获取表结构信息
                cursor.execute(f"PRAGMA table_info({table_name})")
                columns = cursor.fetchall()
                column_names = [col[1] for col in columns]
                
                # 处理目标字段
                if target_field and target_field not in column_names:
                    print(f"    警告：字段 '{target_field}' 不存在，跳过该表")
                    continue
                    
                # 确定要搜索的字段列表
                search_columns = [target_field] if target_field else column_names
                
                # 获取所有数据
                cursor.execute(f"SELECT * FROM {table_name}")
                rows = cursor.fetchall()
                
                # 遍历每一行数据
                for row_idx, row in enumerate(rows):
                    # 遍历每个字段
                    for col_idx, col_name in enumerate(column_names):
                        if col_name not in search_columns:
                            continue
                            
                        cell_value = str(row[col_idx])  # 转换为字符串进行匹配

                        # 检查是否包含关键字
                        if keyword in cell_value:
                            print(f"    {filename}文件发现匹配！\n行号: {row_idx+1}")
                            print(f"    字段: {col_name}")
                            print(f"    命中内容: {cell_value[:100]}")
                            print(f"    所在行内容: {row}")
                            
            conn.close()
            
        except Exception as e:
            print(f"处理文件 {filename} 时出错: {str(e)}")

if __name__ == "__main__":
    parser = argparse.ArgumentParser(description="数据库文件内容搜索工具")
    parser.add_argument("keyword", help="需要搜索的关键字")
    parser.add_argument("-f", "--field", help="指定要搜索的字段（可选）")
    
    args = parser.parse_args()
    
    print(f"开始搜索：关键字 '{args.keyword}'", end="")
    if args.field:
        print(f" [仅限字段: {args.field}]")
    else:
        print(" [所有字段]")
    
    search_databases(args.keyword, args.field)

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43

# -*- coding: utf-8 -*-
# @Author  : 1cePeak

import os
import pytesseract
from PIL import Image

# 设置当前目录
current_dir = os.getcwd()

# 目标手机号
target_number = "13891889377"

# 获取当前目录下所有 jpg 文件
jpg_files = [f for f in os.listdir(current_dir) if f.lower().endswith(".jpg")]

# 存储包含目标手机号的文件名
matched_files = []

for jpg in jpg_files:
    try:
        print(f"[*] 正在识别 {jpg} 文件")
        # 打开图片
        img = Image.open(jpg)
        
        # 使用 OCR 提取文本
        text = pytesseract.image_to_string(img)
        # print(text)

        # 检查是否包含目标手机号
        if target_number in text:
            matched_files.append(jpg)
    
    except Exception as e:
        print(f"处理 {jpg} 时出错: {e}")

# 输出结果
if matched_files:
    print(f"[+] 含有关键字 {target_number} 的文件:")
    for file in matched_files:
        print(file)
else:
    print("[-] 未找到包含目标手机号的文件")