{"id":477,"date":"2025-03-18T16:06:05","date_gmt":"2025-03-18T08:06:05","guid":{"rendered":"https:\/\/noobxiaomeng.top\/?p=477"},"modified":"2025-03-18T16:22:17","modified_gmt":"2025-03-18T08:22:17","slug":"exyb","status":"publish","type":"post","link":"https:\/\/noobxiaomeng.top\/index.php\/2025\/03\/18\/exyb\/","title":{"rendered":"\u8bb0\u4e00\u6b21CTF\u6bd4\u8d5b\u4e2d\u7684\u6076\u610f\u6837\u672c\u5206\u6790"},"content":{"rendered":"

\u60f3\u8d77\u6765SICTF #Round3<\/code>\u6709\u4e00\u9053\u6076\u610f\u6837\u672c\u5206\u6790\u9898\uff0c\u6b63\u597d\u5bf9\u6076\u610f\u6837\u672c\u8fd9\u79cd\u4e1c\u897f\u6bd4\u8f83\u611f\u5174\u8da3\uff0c\u5c31\u62ff\u8fc7\u6765\u5206\u6790\u4e00\u4e0b<\/p>\n

\u53c2\u8003\u6587\u7ae0\uff1a
\n\u5b98\u65b9wp
\nSICTF Round#3 RE WP-CSDN\u535a\u5ba2<\/a>
\nSICTF Re\u9898\u89e3 \u2013 Sw'Blog<\/a>
\nP1\u5e08\u5085\u548cSWDD\u7684\u535a\u5ba2<\/p>\n

\"\"<\/div><\/a><\/p>\n

\u9898\u76ee\u8981\u6c42\u5728\u8fd9\u91cc<\/p>\n

\"\"<\/div><\/a><\/p>\n

\u6587\u4ef6\u4fe1\u606f\u4e0a\u770b\u662f32\u4f4d\u7684\u6613\u8bed\u8a00\u7a0b\u5e8f\uff0c\u800c\u4e14\u6ca1\u6709\u52a0\u58f3\uff0c\u6211\u4eec\u7528IDA\u9759\u6001\u770b\u770b
\n

\"\"<\/div><\/a><\/p>\n

\u8fdb\u53bb\u4e4b\u540e\u53ef\u4ee5\u770b\u89c1\u6709\u5f88\u660e\u663e\u7684\u538b\u7f29\u58f3\uff0c\u4e8b\u5b9e\u4e0a\u5b83\u7684\u71b5\u4e5f\u662f\u975e\u5e38\u5927\u7684
\n

\"\"<\/div><\/a><\/p>\n

\u6211\u4eec\u7528xdbg\u53bbdump\u4e00\u4e0b
\n

\"\"<\/div><\/a>
\n
\"\"<\/div><\/a>
\n
\"\"<\/div><\/a>
\n
\"\"<\/div><\/a>
\n
\"\"<\/div><\/a><\/p>\n

\u8131\u4e86\u58f3\u4e4b\u540e\u7528IDA\u6253\u5f00\uff0c\u4f46\u662f\u53d1\u73b0\u4ec0\u4e48\u90fd\u770b\u4e0d\u51fa\u6765\uff0c\u4e8e\u662f\u5148\u770b\u4e00\u4e0b\u5b57\u7b26\u4e32
\n

\"\"<\/div><\/a><\/p>\n

\u8fd9\u91cc\u770b\u89c1\u6709\u4e00\u884cPE\u6587\u4ef6\u7684\u7279\u5f81\uff0c\u6211\u4eec\u628a\u8fd9\u4e2aPE\u6587\u4ef6\u63d0\u51fa\u6765<\/p>\n

\"\"<\/div><\/a><\/p>\n

\u53d1\u73b0\u662f\u4e2a.net\u7a0b\u5e8f\uff0c\u6211\u4eec\u4f7f\u7528dnspy\u6253\u5f00<\/p>\n

\"\"<\/div><\/a><\/p>\n

\u5230\u8fd9\u91cc\u6211\u4eec\u5c31\u80fd\u770b\u89c1\u7b2c\u4e8c\u95ee\u7684\u7b54\u6848\u4e86\uff1a https:\/\/www.google.com<\/code><\/p>\n

\"\"<\/div><\/a><\/p>\n

\u653e\u5230\u6c99\u7bb1\u91cc\u9762\u8dd1\u51fa\u6765\u4e5f\u662f\u4e00\u6837\u7684<\/p>\n

\u7b2c\u4e09\u95ee\u6211\u4eec\u4e0b\u4e2a\u65ad\u70b9\u8c03\u4e00\u4e0b<\/p>\n

\"\"<\/div><\/a><\/p>\n

\"\"<\/div><\/a><\/p>\n

\u7136\u540e\u628a\u8fd9\u4e2a\u5341\u516d\u5b57\u8282\u5bc6\u94a5\u63d0\u51fa\u6765<\/p>\n

\u7b2c\u56db\u95ee\u4e0d\u592a\u61c2\uff0c\u53bb\u770b\u4e86\u4e00\u4e0b\u5404\u79cdwp\uff0c\u53d1\u73b0\u8c03\u5230dll\u5185\u5bb9\u7136\u540e\u63d0\u51fa\u6765\u4fdd\u5b58\u5c31\u80fd\u770b\u89c1\u6587\u4ef6\u540d\u4e86
\n

\"\"<\/div><\/a><\/p>\n

\u7b2c\u4e94\u95ee\u4e5f\u662f\u53ef\u4ee5\u653e\u6c99\u7bb1\u91cc\u9762\u8dd1\u51fa\u6765
\n

\"\"<\/div><\/a><\/p>\n

\u5f97\u5230wyt.exe<\/p>\n

\u5219\u4e0a\u8ff0\u516d\u4e2a\u95ee\u9898\u7684\u7b54\u6848\u4f9d\u6b21\u662f
\n1)\u767d\u52a0\u9ed1
\n2)https:\/\/www.google.com<\/a>
\n3)0x264C7298BEE400000000000000000000
\n4)ArgenTINA.dll
\n5)wyt.exe
\n6)154.85.102.32<\/p>\n","protected":false},"excerpt":{"rendered":"

\u60f3\u8d77\u6765`SICTF #Round3`\u6709\u4e00\u9053\u6076\u610f\u6837\u672c\u5206\u6790\u9898\uff0c\u6b63\u597d\u5bf9\u6076\u610f\u6837\u672c\u8fd9\u79cd\u4e1c\u897f\u6bd4\u8f83\u611f\u5174\u8da3\uff0c\u5c31\u62ff\u8fc7\u6765\u5206\u6790\u4e00\u4e0b\uff0c\u7167\u7740\u522b\u4ebawp\u590d\u73b0\u7684\uff0c\u5f88\u6c34\u5f88\u6c34\u7684\u4e00\u671f\u2026\u2026<\/p>\n","protected":false},"author":1,"featured_media":495,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[5],"tags":[],"class_list":["post-477","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-re"],"_links":{"self":[{"href":"https:\/\/noobxiaomeng.top\/index.php\/wp-json\/wp\/v2\/posts\/477","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/noobxiaomeng.top\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/noobxiaomeng.top\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/noobxiaomeng.top\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/noobxiaomeng.top\/index.php\/wp-json\/wp\/v2\/comments?post=477"}],"version-history":[{"count":1,"href":"https:\/\/noobxiaomeng.top\/index.php\/wp-json\/wp\/v2\/posts\/477\/revisions"}],"predecessor-version":[{"id":496,"href":"https:\/\/noobxiaomeng.top\/index.php\/wp-json\/wp\/v2\/posts\/477\/revisions\/496"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/noobxiaomeng.top\/index.php\/wp-json\/wp\/v2\/media\/495"}],"wp:attachment":[{"href":"https:\/\/noobxiaomeng.top\/index.php\/wp-json\/wp\/v2\/media?parent=477"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/noobxiaomeng.top\/index.php\/wp-json\/wp\/v2\/categories?post=477"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/noobxiaomeng.top\/index.php\/wp-json\/wp\/v2\/tags?post=477"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}