June 做题笔记

5月好忙，都没怎么写题了，6月一定好好做题，好好写博客💪

CovertChannel

这道题是2026御网杯数据安全赛里面的题目

题目内容：安全运营中心（SOC）在部署的网络探针中捕获了一段可疑流量。威胁情报分析师发现一台内网终端（10.10.20.33）在短时间内发送了大量异常的ICMP和DNS请求。初步研判为APT组织利用多种隐蔽信道进行数据外泄。请深入分析该流量捕获文件，还原被窃取的敏感数据。

TTL隐写

拿到附件，发现里面有ICMP流（DNA动了，发现流量包里面有ICMP流就直接滤过看看有什么东西🫡）

粗略扫视了一下，发现有一个地址的数据包TTL不断出现01，非常可疑，将地址重新排序，好家伙，地址为45.76.188.23的数据包的TTL全是01！直接搞个脚本提取出来

from scapy.all import rdpcap, IP, ICMP

def extract_ttl(pcap_file, target_ip):
    # 读取 pcapng 文件
    packets = rdpcap(pcap_file)
    ttl_values = []
    
    print(f"正在分析流量包，目标IP: {target_ip}...")
    
    for pkt in packets:
        # 检查是否为 IP 数据包且包含 ICMP 协议
        if pkt.haslayer(IP) and pkt.haslayer(ICMP):
            # 过滤目标 IP (这里假设 45.76.188.23 是源地址或目的地址)
            if pkt[IP].src == target_ip or pkt[IP].dst == target_ip:
                ttl = pkt[IP].ttl
                ttl_values.append(ttl)
                print(f"发现ICMP包，TTL: {ttl}")
    
    return ttl_values

# 配置文件路径和目标 IP
file_path = r"your_path"
target = "45.76.188.23"

# 执行提取
ttls = extract_ttl(file_path, target)

print("\n最终提取的TTL序列:")
print(ttls)

解码出密文

拿到这一串01编码我也好懵，不知道该怎么进行下一步，只好用出我cyberchef的magic大法了

001101100011000000110010001100100011011001100100001100110110001101100100001100110110001101100110001100110011010000110101011001000110011000110000011000100110000101100001001100110110001100111000011001000110010101100011001100000110010000111001011001000011001000110010001101010110001000110011011001100110011000111001001100010011011000110011001101000011010000111001001110000110010001100010001101000110011000110101011000010011011101100100001101000011010000110101001100100110010001100100001100010110000100110010011000110011001000110000001110000110010000110100011001010110011001100011001110010110010001100001001101110011001101100101011000100011100000111000001110000011010001100110011000100011011000111001011000110011001101100010001100010011001000110000001100100110001100110101011111000100000101000101010100110010110101000101010000110100001000101100001000000110101101100101011110010010000001101001011100110010000001101001011011100010000001000100010011100101001100100000010101000101100001010100

得到密文跟密钥所在地方的提示

AES解密

根据提示搜索txt里面有一串base64编码

TW9yZVNlY3VyZUFlczEyOA==

解码后得到密钥是MoreSecureAes128

解密脚本

from Crypto.Cipher import AES
from Crypto.Util.Padding import unpad
import binascii

# 密文 (Hex格式)
ciphertext_hex = "60226d3cd3cf345df0baa3c8dec0d9d225b3ff91634498db4f5a7d4452dd1a2c208d4efc9da73eb8884fb69c3b1202c5"
# 密钥 (AES-128 需要 16 字节)
key = b"MoreSecureAes128"

def decrypt_aes_ecb(hex_data, key):
    try:
        # 将十六进制转换为字节流
        ciphertext = binascii.unhexlify(hex_data)
        
        # 创建 AES 解密对象 (ECB模式)
        cipher = AES.new(key, AES.MODE_ECB)
        
        # 解密
        decrypted_data = cipher.decrypt(ciphertext)
        
        # 去除填充 (如果使用了 PKCS7)
        try:
            return unpad(decrypted_data, AES.block_size).decode('utf-8')
        except:
            return decrypted_data # 如果不是标准填充，直接返回原始字节
            
    except Exception as e:
        return f"解密失败: {e}"

result = decrypt_aes_ecb(ciphertext_hex, key)
print("解密结果:", result)

flag{5f356e09a565c656c6d8ae31f7973452}