{"id":674,"date":"2026-01-31T23:13:02","date_gmt":"2026-01-31T15:13:02","guid":{"rendered":"http:\/\/shr1mp.top\/?p=674"},"modified":"2026-01-31T23:13:02","modified_gmt":"2026-01-31T15:13:02","slug":"unictf2026%e5%b7%a5%e5%8e%82%e5%ba%94%e6%80%a5%e6%b5%81%e9%87%8f%e5%88%86%e6%9e%90","status":"publish","type":"post","link":"http:\/\/shr1mp.top\/index.php\/2026\/01\/31\/unictf2026%e5%b7%a5%e5%8e%82%e5%ba%94%e6%80%a5%e6%b5%81%e9%87%8f%e5%88%86%e6%9e%90\/","title":{"rendered":"[unictf2026]\u5de5\u5382\u5e94\u6025\u6d41\u91cf\u5206\u6790"},"content":{"rendered":"\n

\u4e0b\u8f7d<\/a>O.o<\/p>\n\n\n\n

PCAP\uff08factory.pcap\uff0c\u7ea6 93KB\uff09<\/p>\n\n\n\n

\u5305\u542b Modbus\/TCP(502)\u3001OPC UA(4840)\u3001DNS(53)\u3001HTTP(80)\u3001ICMP\u3001SNMP(161) \u7b49\u5178\u578b\u5de5\u63a7\u4e0e\u7ba1\u7406\u6d41\u91cf\u3002<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

\u5de5\u5382\u7684\u6d41\u91cf\u5305\uff0c\u5f88\u591aUDP\uff0c\u800chtml\u5c11<\/p>\n\n\n\n

\u4efb\u52a1 1\uff1a\u8c01\u628a\u9600\u95e8\u6253\u5f00\u4e86\uff1f<\/h2>\n\n\n\n
\n

\u627e\u5230 Modbus \u6253\u5f00\u9600\u95e8\u6307\u4ee4\u7684\u76f8\u5173\u4fe1\u606f\u3002<\/p>\n\n\n\n

\u63d0\u4ea4\u683c\u5f0f\uff1aflag{0xtransaction_id_0xfunction_code_0xcoil_address}<\/p>\n<\/blockquote>\n\n\n\n

\u77e5\u8bc6\u70b9\uff1a<\/p>\n\n\n\n

Modbus\u662f\u4e00\u79cd\u5e7f\u6cdb\u5e94\u7528\u4e8e\u5de5\u4e1a\u81ea\u52a8\u5316\u9886\u57df\u7684\u4e32\u884c\u901a\u4fe1\u534f\u8bae\n\u652f\u6301\u4e32\u53e3\uff08Modbus RTU\/ASCII\uff09\u548c\u4ee5\u592a\u7f51\uff08Modbus TCP\uff09<\/code><\/pre>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\u627emodbus\u91cc\u9762write single coil\u7684\u542bff00\uff08\u8868\u793a\u9600\u95e8on\uff09\u6d41\u91cf<\/p>\n\n\n\n
\u7b2c\u4e00\u4e2amodbus\uff08No15\uff09:<\/p>\n\n\n\n
Modbus\/TCP\n    Transaction Identifier: 15437    #\u7aef\u53e3transaction_id\n    Protocol Identifier: 0\n    Length: 6\n    Unit Identifier: 1\nModbus\n    0... .... = Exception: No\n    .000 0101 = Function Code: Write Single Coil (5)  #\u6a21\u5f0ffunction_code\n    Reference Number: 21                              #\u5730\u5740coil_address\n    Data: ff00                                           #\u6570\u636e\n    Padding: 0x00<\/code><\/pre>\n\n\n\n
\u6ce8\u610f\u52300x\u8f6c\u5316\u4e3a16\u8fdb\u5236\u5c31\u5f97\u5230flag<\/p>\n\n\n\n
flag{0x3c4d_0x05_0x0015}<\/code><\/pre>\n\n\n\n
T_T\u5c0f\u63d2\u66f2\uff1a<\/p>\n\n\n\n
\u6700\u5f00\u59cb\u6211\u4e00\u76f4\u5728\u5c1d\u8bd5flag{0x3c4d_0x05_0x15}\uff0c\u4f46\u662f\u6807\u51c6Modbus\u662f16\u4f4d\u5730\u5740,\u6240\u4ee5\u662f0x0015<\/code><\/pre>\n\n\n\n
\u4efb\u52a1 2\uff1a\u88ab\u8bfb\u53d6\u7684 NodeId<\/h2>\n\n\n\n
\n
\u627e\u5230\u901a\u8fc7 OPC UA \u534f\u8bae\u8bfb\u53d6\u7684 NodeId\u3002<\/p>\n\n\n\n
\u63d0\u4ea4\u683c\u5f0f\uff1aflag{ns=X;s=Path\/To\/Node}<\/p>\n<\/blockquote>\n\n\n\n
\u77e5\u8bc6\u70b9<\/p>\n\n\n\n
OPC UA\uff08OPC Unified Architecture\uff0cOPC\u7edf\u4e00\u67b6\u6784\uff09\u200b \u662f\u4e00\u79cd\u5de5\u4e1a\u81ea\u52a8\u5316\u9886\u57df\u7684\u8de8\u5e73\u53f0\u3001\u8de8\u5382\u5546\u7684\u901a\u4fe1\u534f\u8bae\u6807\u51c6\uff0c\u7528\u4e8e\u5728\u5de5\u4e1a\u8bbe\u5907\u3001\u63a7\u5236\u7cfb\u7edf\u548c\u4f01\u4e1a\u4fe1\u606f\u7cfb\u7edf\u4e4b\u95f4\u5b89\u5168\u53ef\u9760\u5730\u4f20\u8f93\u6570\u636e\u3002\n\uff01\uff01\uff01OPC UA\u901a\u8fc7\u91c7\u7528TCP\/IP\u534f\u8bae\u6808<\/code><\/pre>\n\n\n\n
\u6ce8\u610f\u5230tcp4:<\/p>\n\n\n\n
ReadRequest;NodeId=ns=2;s=Valve\/Status;MaxAge=0<\/code><\/pre>\n\n\n\n
flag{ns=2;s=Valve\/Status}<\/code><\/pre>\n\n\n\n
\u4efb\u52a1 3\uff1a\u63a7\u5236\u7ad9\u57df\u540d\u89e3\u6790\u7ed3\u679c<\/h2>\n\n\n\n
\n
\u627e\u51fa\u63a7\u5236\u7ad9\u57df\u540d ctrlws.factory.local \u7684\u89e3\u6790 IP\u3002<\/p>\n\n\n\n
\u63d0\u4ea4\u683c\u5f0f\uff1aflag{IP\u5730\u5740}<\/p>\n<\/blockquote>\n\n\n\n
\u7b5b\u9009DNS<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
flag{192.168.1.10}<\/code><\/pre>\n\n\n\n
\u4efb\u52a1 4\uff1a\u8fde\u63a5\u5efa\u7acb\u65f6\u95f4<\/h2>\n\n\n\n
\n
\u786e\u5b9aSCADA\uff08\u6e90\uff1a192.168.1.5\uff09\u5230\u63a7\u5236\u7ad9\uff08\u76ee\u7684\uff1a192.168.1.10\uff09\u4e0a\u9996\u4e2a\u6210\u529f\u53d1\u8d77\u7684\u65f6\u95f4\u70b9(UTC)\u3002<\/p>\n\n\n\n
\u63d0\u4ea4\u683c\u5f0f\uff1aflag{YYYY-MM-DDTHH:MM:SSZ}<\/p>\n<\/blockquote>\n\n\n\n
\u627e\u5b8c\u6574\u7684tcp\u4e09\u6b21\u63e1\u624b<\/p>\n\n\n\n
ip.src == 192.168.1.5 and ip.dst == 192.168.1.10<\/code><\/pre>\n\n\n\n
\"\"<\/figure>\n\n\n\n
SYN     2025-03-15T09:30:01.079999Z\nSYN\/ACK 2025-03-15T09:30:01.089999Z\nACK     2025-03-15T09:30:01.099999Z<\/code><\/pre>\n\n\n\n
\u6309\u9898\u610f\u53d6\u201c\u6210\u529f\u53d1\u8d77\u201d\u7684\u8d77\u70b9\uff08SYN\uff09\u5e76\u6309\u79d2\u622a\u65ad\u5f97\u5230\uff1a2025-03-15T09:30:01Z\u3002<\/p>\n\n\n\n
flag{2025-03-15T09:30:01Z}<\/code><\/pre>\n\n\n\n
\u4efb\u52a1 5\uff1aHTTP \u8bf7\u6c42\u75d5\u8ff9<\/h2>\n\n\n\n
\n
\u63d0\u53d6 SCADA \u5bf9\u63a7\u5236\u7ad9\u53d1\u8d77\u7684 HTTP \u8bf7\u6c42\u7684 Host \u4e0e URI\u3002<\/p>\n\n\n\n
\u63d0\u4ea4\u683c\u5f0f\uff1aflag{Host_URI}<\/p>\n<\/blockquote>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\u5728\u8be5 HTTP \u4f1a\u8bdd\u4e2d\u63d0\u53d6\u5230\u5b8c\u6574\u8bf7\u6c42\u884c\u4e0e Host \u5934\uff1a<\/p>\n\n\n\n
GET \/api\/status HTTP\/1.1\nHost: ctrlws.factory.local<\/code><\/pre>\n\n\n\n
flag{ctrlws.factory.local_\/api\/status}<\/code><\/pre>\n\n\n\n
\u4efb\u52a1 6\uff1aICMP Echo Request \u5e8f\u5217\u53f7<\/h2>\n\n\n\n
\n
\u653b\u51fb\u8005\uff08192.168.1.100\uff09\u5bf9\u63a7\u5236\u7ad9\u53d1\u8d77\u4e86 ICMP Echo Request\uff08ping\uff09\u3002\u627e\u51fa\u8be5 ICMP \u8bf7\u6c42\u7684\u5e8f\u5217\u53f7\uff08Sequence Number\uff09\u3002<\/p>\n\n\n\n
\u63d0\u4ea4\u683c\u5f0f\uff1aflag{0x\u5e8f\u5217\u53f7}<\/p>\n<\/blockquote>\n\n\n\n
ip.src==192.168.1.100 && ip.dst==192.168.1.10<\/code><\/pre>\n\n\n\n
\"\"<\/figure>\n\n\n\n
ICMP id=0x5678, seq=0x0123<\/code><\/pre>\n\n\n\n
flag{0x0123}<\/code><\/pre>\n\n\n\n
\u4efb\u52a1 7\uff1aSNMP Get \u8bf7\u6c42\u7684 OID<\/h2>\n\n\n\n
\n
SCADA \u5bf9\u63a7\u5236\u7ad9\u53d1\u8d77\u4e86 SNMP Get \u8bf7\u6c42\u3002\u627e\u51fa\u8be5\u8bf7\u6c42\u67e5\u8be2\u7684 OID\uff08Object Identifier\uff09\u3002<\/p>\n\n\n\n
\u63d0\u4ea4\u683c\u5f0f\uff1aflag{OID}<\/p>\n<\/blockquote>\n\n\n\n
udp && ip.dst==192.168.1.10 && frame contains \"GetRequest\"<\/code><\/pre>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\u7531\u7b2c\u56db\u95ee\u6ce8\u610f\u5230SCADA\u7684ip\u662f192.168.1.5<\/p>\n\n\n\n
SNMPv2c;Community=public;PDU=GetRequest;OID=1.3.6.1.2.1.1.5.0<\/code><\/pre>\n\n\n\n
flag{1.3.6.1.2.1.1.5.0}<\/code><\/pre>\n","protected":false},"excerpt":{"rendered":"
\u4e0b\u8f7dO.o PCAP\uff08factory.pcap\uff0c\u7ea6 93KB\uff09 \u5305\u542b Modbus\/TCP(502)\u3001OPC UA(4840)\u3001D …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_gspb_post_css":"","emotion":"","emotion_color":"","title_style":"","license":"","footnotes":""},"categories":[9,10],"tags":[],"class_list":["post-674","post","type-post","status-publish","format-standard","hentry","category-misc","category-10"],"_links":{"self":[{"href":"http:\/\/shr1mp.top\/index.php\/wp-json\/wp\/v2\/posts\/674","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/shr1mp.top\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/shr1mp.top\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/shr1mp.top\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/shr1mp.top\/index.php\/wp-json\/wp\/v2\/comments?post=674"}],"version-history":[{"count":24,"href":"http:\/\/shr1mp.top\/index.php\/wp-json\/wp\/v2\/posts\/674\/revisions"}],"predecessor-version":[{"id":713,"href":"http:\/\/shr1mp.top\/index.php\/wp-json\/wp\/v2\/posts\/674\/revisions\/713"}],"wp:attachment":[{"href":"http:\/\/shr1mp.top\/index.php\/wp-json\/wp\/v2\/media?parent=674"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/shr1mp.top\/index.php\/wp-json\/wp\/v2\/categories?post=674"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/shr1mp.top\/index.php\/wp-json\/wp\/v2\/tags?post=674"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}