BMZCTF：2018 redhat NotOnlyWireshark

http://bmzclub.cn/challenges#2018%20redhat%20NotOnlyWireshark

NotOnlyWireshark.pcapng

name中的值很明显是zip字节流数据，将这些长度426的URL中的name值提取出来

tshark -r NotOnlyWireshark.pcapng -e http.request.uri -T fields -Y 'http.request.uri' | grep -P 'name=[A-F0-9]{3}' | awk -F '=' '{printf $2}'

将1234修改为5

504B03040A0001080000739C8C4B7B36E495200000001400000004000000666C616781CD460EB62015168D9E64B06FC1712365FDE5F987916DD8A52416E83FDE98FB504B01023F000A0001080000739C8C4B7B36E4952000000014000000040024000000000000002000000000000000666C61670A00200000000000010018000DB39B543D73D301A1ED91543D73D301F99066543D73D301504B0506000000000100010056000000420000000000

Python处理转换一下

import struct

a = open("data.txt","r")#十六进制数据文件
lines = a.read()
res = [lines[i:i+2] for i in range(0,len(lines),2)]

with open("data.zip","wb") as f:
	for i in res:
		s = struct.pack('B',int(i,16))
		f.write(s)

得到的压缩包有密码，不是爆破不是伪加密

继续查看流量包，通过搜索关键字key找到类似密码的字符串

这里说实话有点脑洞，密码是?id=1128%23

解压得到flag

flag{1m_s0_ang4y_1s}