PicoCTF-2019-WirteUp

古城微笑少年丶 2023-06-16 10:35 8阅读 0赞

> **1. 2Warm-General Skills**

![format_png][]

直接将十进制转化为二进制

picoCTF\{101010\}

> **2. Insp3ct0r-Web Exploitation**

![format_png 1][]

*[https://2019shell1.picoctf.com/problem/63975/][https_2019shell1.picoctf.com_problem_63975]*

点击链接看到如下页面

![format_png 2][]

点击What没有变化，点击How出现如下页面

![format_png 3][]

说明是分别从HTML,CSS,JavaScript中找flag

![format_png 4][]

右键查看源代码可见三分之一的HTML部分flag

![format_png 5][]

![format_png 6][]

再点击mycss.css有

![format_png 7][]

点击myjs.js有

![format_png 8][]

三部分flag整合在一起即为完整flag

> **3. Lets Warm Up-General Skills**

![format_png 9][]

0x70即十六进制70，转化为ASCII码为p,故picoCTF\{p\}

> **4. The Numbers-Cryptography**

![format_png 10][]

点击numbers得到图片文件

![format_png 11][]

看上去是要解码的亚子，搜了一些常见的解码形式，插文https://www.cnblogs.com/mq0036/p/6544055.html。这一题全部都是数字，在线工具试一下，啥也出不来...后来看看这个格式，emmmmm,好像是picoCTF\{\}鸭，于是数自己就代表几号字母.......![format_png 12][]

于是提交答案picoCTF\{THENUMBERSMASON\},提交后发现不对？！![format_png 12][]

试了好多好多好多遍...点开Hint,原来这一题的flag格式不一样啊哈![format_png 13][]

> **5. Warmed Up-General Skills**

![format_png 14][]

过！picoCTF\{61\}

> **6. unzip-Forensics**

![format_png 15][]

点击file下载后得到图片文件

![format_png 16][]

即flag，这一题的本意是看我能不能解压这个文件结果电脑自动就给解压了....

> **7. Bases-General Skills**

![format_png 17][]

题目暗示很明显了，就是bases编码

所以就在线工具转化，base64解码

![format_png 18][]

> **8. First Grep-General Skills**

![format_png 19][]

下载文件后打开即得flag

![format_png 20][]

picoCTF\{grep\_is\_good\_to\_find\_things\_887251c6\}

> **9.Resources-General Skills**

![format_png 21][]

[https://picoctf.com/resources][https_picoctf.com_resources]

这一题就是指示了解网站的，下拉即可看见flag

![format_png 22][]

![format_png 23][]

> **10. dont-use-client-side-Web Exploitation**

![format_png 24][]

[https://2019shell1.picoctf.com/problem/21888/][https_2019shell1.picoctf.com_problem_21888]

点击Link有，是一个登陆界面，我们就要弄清楚什么时候密码正确

![format_png 25][]

查看源码有

![format_png 26][]

点开index.html有

![format_png 27][]

按照截取顺序把flag可拼凑出来

picoCTF\{no\_clients\_plz\_5 6a8eb\}

> **11. where are the robots-Web Exploitation**

![format_png 28][]

[https://2019shell1.picoctf.com/problem/4159/][https_2019shell1.picoctf.com_problem_4159]

和robots协议有关，于是访问robots.txt有

![format_png 29][]

不让访问某个网址，那就访问看看

![format_png 30][]

得flag

[format_png]: https://imgconvert.csdnimg.cn/aHR0cHM6Ly91cGxvYWQtaW1hZ2VzLmppYW5zaHUuaW8vdXBsb2FkX2ltYWdlcy8xNjY0ODIzOS0xMGY2ZTllMWNhY2Y4N2EyLnBuZw?x-oss-process=image/format,png
[format_png 1]: https://imgconvert.csdnimg.cn/aHR0cHM6Ly91cGxvYWQtaW1hZ2VzLmppYW5zaHUuaW8vdXBsb2FkX2ltYWdlcy8xNjY0ODIzOS03NTE3ZDk2MzkwZjk1N2E1LnBuZw?x-oss-process=image/format,png
[https_2019shell1.picoctf.com_problem_63975]: https://2019shell1.picoctf.com/problem/63975/
[format_png 2]: https://imgconvert.csdnimg.cn/aHR0cHM6Ly91cGxvYWQtaW1hZ2VzLmppYW5zaHUuaW8vdXBsb2FkX2ltYWdlcy8xNjY0ODIzOS05YjFkZTViZWI1MDA1MDYwLnBuZw?x-oss-process=image/format,png
[format_png 3]: https://imgconvert.csdnimg.cn/aHR0cHM6Ly91cGxvYWQtaW1hZ2VzLmppYW5zaHUuaW8vdXBsb2FkX2ltYWdlcy8xNjY0ODIzOS1iNWNkNWY1YWM4MzU5MzVlLnBuZw?x-oss-process=image/format,png
[format_png 4]: https://imgconvert.csdnimg.cn/aHR0cHM6Ly91cGxvYWQtaW1hZ2VzLmppYW5zaHUuaW8vdXBsb2FkX2ltYWdlcy8xNjY0ODIzOS0wMzFhZjA4ZWFlZmVhOTQ0LnBuZw?x-oss-process=image/format,png
[format_png 5]: https://imgconvert.csdnimg.cn/aHR0cHM6Ly91cGxvYWQtaW1hZ2VzLmppYW5zaHUuaW8vdXBsb2FkX2ltYWdlcy8xNjY0ODIzOS0zNzczMThlZWI5ODBjZWJmLnBuZw?x-oss-process=image/format,png
[format_png 6]: https://imgconvert.csdnimg.cn/aHR0cHM6Ly91cGxvYWQtaW1hZ2VzLmppYW5zaHUuaW8vdXBsb2FkX2ltYWdlcy8xNjY0ODIzOS0xYTA2YzNlNWNlZWNkZTIwLnBuZw?x-oss-process=image/format,png
[format_png 7]: https://imgconvert.csdnimg.cn/aHR0cHM6Ly91cGxvYWQtaW1hZ2VzLmppYW5zaHUuaW8vdXBsb2FkX2ltYWdlcy8xNjY0ODIzOS01MTI2YjEwNTFhNDI4YjQxLnBuZw?x-oss-process=image/format,png
[format_png 8]: https://imgconvert.csdnimg.cn/aHR0cHM6Ly91cGxvYWQtaW1hZ2VzLmppYW5zaHUuaW8vdXBsb2FkX2ltYWdlcy8xNjY0ODIzOS0xNDUzNWI1OWJiMGUwODgwLnBuZw?x-oss-process=image/format,png
[format_png 9]: https://imgconvert.csdnimg.cn/aHR0cHM6Ly91cGxvYWQtaW1hZ2VzLmppYW5zaHUuaW8vdXBsb2FkX2ltYWdlcy8xNjY0ODIzOS05Mjk4Nzc5YzY1MTQzYTNmLnBuZw?x-oss-process=image/format,png
[format_png 10]: https://imgconvert.csdnimg.cn/aHR0cHM6Ly91cGxvYWQtaW1hZ2VzLmppYW5zaHUuaW8vdXBsb2FkX2ltYWdlcy8xNjY0ODIzOS1iMDU2NzM1YTc3NTU2MjdlLnBuZw?x-oss-process=image/format,png
[format_png 11]: https://imgconvert.csdnimg.cn/aHR0cHM6Ly91cGxvYWQtaW1hZ2VzLmppYW5zaHUuaW8vdXBsb2FkX2ltYWdlcy8xNjY0ODIzOS03NTJjY2Q0NWQzZTBiNGM3LnBuZw?x-oss-process=image/format,png
[format_png 12]: https://imgconvert.csdnimg.cn/aHR0cHM6Ly91cGxvYWQtaW1hZ2VzLmppYW5zaHUuaW8vdXBsb2FkX2ltYWdlcy8xNjY0ODIzOS03M2U5YmM3OTRjNTA2OTExLnBuZw?x-oss-process=image/format,png
[format_png 13]: https://imgconvert.csdnimg.cn/aHR0cHM6Ly91cGxvYWQtaW1hZ2VzLmppYW5zaHUuaW8vdXBsb2FkX2ltYWdlcy8xNjY0ODIzOS1mMGE4ZjkwMDFlMTRiN2I3LnBuZw?x-oss-process=image/format,png
[format_png 14]: https://imgconvert.csdnimg.cn/aHR0cHM6Ly91cGxvYWQtaW1hZ2VzLmppYW5zaHUuaW8vdXBsb2FkX2ltYWdlcy8xNjY0ODIzOS1kYTkwNTRlNmZiODFlOWUzLnBuZw?x-oss-process=image/format,png
[format_png 15]: https://imgconvert.csdnimg.cn/aHR0cHM6Ly91cGxvYWQtaW1hZ2VzLmppYW5zaHUuaW8vdXBsb2FkX2ltYWdlcy8xNjY0ODIzOS00NWM2YTMwNmVmZmVlNjM0LnBuZw?x-oss-process=image/format,png
[format_png 16]: https://imgconvert.csdnimg.cn/aHR0cHM6Ly91cGxvYWQtaW1hZ2VzLmppYW5zaHUuaW8vdXBsb2FkX2ltYWdlcy8xNjY0ODIzOS00ZWMzYTViYjY0OTc4OGZmLnBuZw?x-oss-process=image/format,png
[format_png 17]: https://imgconvert.csdnimg.cn/aHR0cHM6Ly91cGxvYWQtaW1hZ2VzLmppYW5zaHUuaW8vdXBsb2FkX2ltYWdlcy8xNjY0ODIzOS02YmJhNGE4OTc0ZWVlMzMwLnBuZw?x-oss-process=image/format,png
[format_png 18]: https://imgconvert.csdnimg.cn/aHR0cHM6Ly91cGxvYWQtaW1hZ2VzLmppYW5zaHUuaW8vdXBsb2FkX2ltYWdlcy8xNjY0ODIzOS0yMjQ2MmE0MzZlODY2ZmYzLnBuZw?x-oss-process=image/format,png
[format_png 19]: https://imgconvert.csdnimg.cn/aHR0cHM6Ly91cGxvYWQtaW1hZ2VzLmppYW5zaHUuaW8vdXBsb2FkX2ltYWdlcy8xNjY0ODIzOS02NjYwZmY4YmFiYTQ4ODY3LnBuZw?x-oss-process=image/format,png
[format_png 20]: https://imgconvert.csdnimg.cn/aHR0cHM6Ly91cGxvYWQtaW1hZ2VzLmppYW5zaHUuaW8vdXBsb2FkX2ltYWdlcy8xNjY0ODIzOS0yMmI4MzE5NjU4NTUyYTA5LnBuZw?x-oss-process=image/format,png
[format_png 21]: https://imgconvert.csdnimg.cn/aHR0cHM6Ly91cGxvYWQtaW1hZ2VzLmppYW5zaHUuaW8vdXBsb2FkX2ltYWdlcy8xNjY0ODIzOS1hNmY1ZjRiOTA0YjI1YTkyLnBuZw?x-oss-process=image/format,png
[https_picoctf.com_resources]: https://picoctf.com/resources
[format_png 22]: https://imgconvert.csdnimg.cn/aHR0cHM6Ly91cGxvYWQtaW1hZ2VzLmppYW5zaHUuaW8vdXBsb2FkX2ltYWdlcy8xNjY0ODIzOS05YzNmNDAzYmZlMjZmNWVlLnBuZw?x-oss-process=image/format,png
[format_png 23]: https://imgconvert.csdnimg.cn/aHR0cHM6Ly91cGxvYWQtaW1hZ2VzLmppYW5zaHUuaW8vdXBsb2FkX2ltYWdlcy8xNjY0ODIzOS03ZmMzYmY3ZGE5MzFkMTk0LnBuZw?x-oss-process=image/format,png
[format_png 24]: https://imgconvert.csdnimg.cn/aHR0cHM6Ly91cGxvYWQtaW1hZ2VzLmppYW5zaHUuaW8vdXBsb2FkX2ltYWdlcy8xNjY0ODIzOS1jNjliZjMyMDQ2OTRhYWQ3LnBuZw?x-oss-process=image/format,png
[https_2019shell1.picoctf.com_problem_21888]: https://2019shell1.picoctf.com/problem/21888/
[format_png 25]: https://imgconvert.csdnimg.cn/aHR0cHM6Ly91cGxvYWQtaW1hZ2VzLmppYW5zaHUuaW8vdXBsb2FkX2ltYWdlcy8xNjY0ODIzOS0wNjQxM2ZlNzY0YjkyODM2LnBuZw?x-oss-process=image/format,png
[format_png 26]: https://imgconvert.csdnimg.cn/aHR0cHM6Ly91cGxvYWQtaW1hZ2VzLmppYW5zaHUuaW8vdXBsb2FkX2ltYWdlcy8xNjY0ODIzOS0zOTBkZDk0NjQxYjcyZjljLnBuZw?x-oss-process=image/format,png
[format_png 27]: https://imgconvert.csdnimg.cn/aHR0cHM6Ly91cGxvYWQtaW1hZ2VzLmppYW5zaHUuaW8vdXBsb2FkX2ltYWdlcy8xNjY0ODIzOS02ZDM1MGUyZTAzYTI2ZDQzLnBuZw?x-oss-process=image/format,png
[format_png 28]: https://imgconvert.csdnimg.cn/aHR0cHM6Ly91cGxvYWQtaW1hZ2VzLmppYW5zaHUuaW8vdXBsb2FkX2ltYWdlcy8xNjY0ODIzOS0xMzViMjViMmMzNzAxMDNkLnBuZw?x-oss-process=image/format,png
[https_2019shell1.picoctf.com_problem_4159]: https://2019shell1.picoctf.com/problem/4159/
[format_png 29]: https://imgconvert.csdnimg.cn/aHR0cHM6Ly91cGxvYWQtaW1hZ2VzLmppYW5zaHUuaW8vdXBsb2FkX2ltYWdlcy8xNjY0ODIzOS02ZmNjNTk3YTczMzRiMzk1LnBuZw?x-oss-process=image/format,png
[format_png 30]: https://imgconvert.csdnimg.cn/aHR0cHM6Ly91cGxvYWQtaW1hZ2VzLmppYW5zaHUuaW8vdXBsb2FkX2ltYWdlcy8xNjY0ODIzOS1kZmY4YzBhMjcxMmRiYjEwLnBuZw?x-oss-process=image/format,png