https://nan0in27.cn/categories/2024%E7%8D%AC%E8%B1%B8%E6%9D%AF/Recent content in 2024獬豸杯 on Nan0inPsyLogHugo -- gohugo.iozh-cn楠牧音 | glow Nan0inhttps://nan0in27.cn/p/2024%E7%8D%AC%E8%B1%B8%E6%9D%AF/Thu, 27 Mar 2025 16:19:00 +0000https://nan0in27.cn/p/2024%E7%8D%AC%E8%B1%B8%E6%9D%AF/<img src="https://nan0in27.cn/p/2024%E7%8D%AC%E8%B1%B8%E6%9D%AF/banner.png" alt="Featured image of post 2024獬豸杯" /><blockquote> <p>检材&amp;题目来源https://forensics.didctf.com/</p> </blockquote> <h1 id="手机基本信息">手机基本信息 </h1><p> <div class="post-img-view"> <a data-fancybox="gallery" href="14.png"> <img src="14.png" alt="" /> </a> </div> &hellip; 文件夹名称 <code>2024-01-15.14:19:44</code></p> <p> <div class="post-img-view"> <a data-fancybox="gallery" href="15.png"> <img src="15.png" alt="" /> </a> </div> <div class="post-img-view"> <a data-fancybox="gallery" href="14_ans.png"> <img src="14_ans.png" alt="" /> </a> </div> QQ momo 小西米 <code>3</code></p> <p> <div class="post-img-view"> <a data-fancybox="gallery" href="15-1.png"> <img src="15-1.png" alt="" /> </a> </div> 使用<code>itunesBackupTransfer</code>将ios备份文件导出后分析（可在github找到项目） <div class="post-img-view"> <a data-fancybox="gallery" href="ios.png"> <img src="ios.png" alt="" /> </a> </div> <div class="post-img-view"> <a data-fancybox="gallery" href="iosans1.png"> <img src="iosans1.png" alt="" /> </a> </div> vscode打开文件夹后搜索ICCID即可找到<code>89860320245121150689</code></p> <p> <div class="post-img-view"> <a data-fancybox="gallery" href="voice.png"> <img src="voice.png" alt="" /> </a> </div> 用如下软件打开后找到小西米语音，看log最新一条 <div class="post-img-view"> <a data-fancybox="gallery" href="voice_ans.png"> <img src="voice_ans.png" alt="" /> </a> </div> <div class="post-img-view"> <a data-fancybox="gallery" href="voice_true_ans.png"> <img src="voice_true_ans.png" alt="" /> </a> </div> 看起来这个应该就是真答案了 <code>20240115</code></p> <h2 id="地图数据">地图数据 </h2><p> <div class="post-img-view"> <a data-fancybox="gallery" href="map.png"> <img src="map.png" alt="" /> </a> </div> 由于高德地图数据库是加密的，我们使用<code>forensicstool</code>进行解密， <div class="post-img-view"> <a data-fancybox="gallery" href="decrypt.png"> <img src="decrypt.png" alt="" /> </a> </div> <code>sqlitebrowser</code>打开 <div class="post-img-view"> <a data-fancybox="gallery" href="navi_ans.png"> <img src="navi_ans.png" alt="" /> </a> </div> <code>天铂华庭</code></p> <h2 id="浏览器">浏览器 </h2><p> <div class="post-img-view"> <a data-fancybox="gallery" href="safari.png"> <img src="safari.png" alt="" /> </a> </div> <code>Bookmarks.db</code></p> <p> <div class="post-img-view"> <a data-fancybox="gallery" href="ios_trip.png"> <img src="ios_trip.png" alt="" /> </a> </div> 使用<code>autopsy</code>，创建case时选择logical file，然后选择我们之前导出的ios包 <div class="post-img-view"> <a data-fancybox="gallery" href="sele.png"> <img src="sele.png" alt="" /> </a> </div> 如上选择后打开，我们在Reports中就可以看到ios Analyzer了，用本地浏览器打开 <div class="post-img-view"> <a data-fancybox="gallery" href="map_ans.png"> <img src="map_ans.png" alt="" /> </a> </div> <code>拉萨</code></p> <blockquote> <p>后续，当然你也可以在History.db文件中直接搜索找到，但是备份中把它删了中不存在，Histroy因此在iback viewer中是空，这里可以简单写个脚本解密一下<code>com.apple.mobilesafari.plist</code>文件</p> </blockquote> <div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt">1 </span><span class="lnt">2 </span><span class="lnt">3 </span><span class="lnt">4 </span><span class="lnt">5 </span><span class="lnt">6 </span><span class="lnt">7 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-python" data-lang="python"><span class="line"><span class="cl"><span class="kn">import</span> <span class="nn">plistlib</span> </span></span><span class="line"><span class="cl"><span class="n">plist_path</span> <span class="o">=</span><span class="s1">&#39;&#39;</span> </span></span><span class="line"><span class="cl"><span class="k">with</span> <span class="nb">open</span><span class="p">(</span><span class="n">plist_path</span><span class="p">,</span> <span class="s1">&#39;rb&#39;</span><span class="p">)</span> <span class="k">as</span> <span class="n">fp</span><span class="p">:</span> </span></span><span class="line"><span class="cl"> <span class="n">plist_data</span> <span class="o">=</span> <span class="n">plistlib</span><span class="o">.</span><span class="n">load</span><span class="p">(</span><span class="n">fp</span><span class="p">)</span> </span></span><span class="line"><span class="cl"> </span></span><span class="line"><span class="cl"><span class="c1"># 现在 plist_data 包含了 plist 文件的内容，您可以通过字典的方式访问其中的键值对</span> </span></span><span class="line"><span class="cl"><span class="nb">print</span><span class="p">(</span><span class="n">plist_data</span><span class="p">)</span> </span></span></code></pre></td></tr></table> </div> </div><h2 id="即时通讯">即时通讯 </h2><p> <div class="post-img-view"> <a data-fancybox="gallery" href="connect1.png"> <img src="connect1.png" alt="" /> </a> </div> <div class="post-img-view"> <a data-fancybox="gallery" href="im5db.png"> <img src="im5db.png" alt="" /> </a> </div> 把每个通讯软件拉出来看，先看一下小西米数据库<br> <div class="post-img-view"> <a data-fancybox="gallery" href="im5_ans.png"> <img src="im5_ans.png" alt="" /> </a> </div> <div class="post-img-view"> <a data-fancybox="gallery" href="%e6%9f%a5%e8%af%a2.png"> <img src="%e6%9f%a5%e8%af%a2.png" alt="" /> </a> </div> <code>龙黑</code></p> <p> <div class="post-img-view"> <a data-fancybox="gallery" href="im5_2.png"> <img src="im5_2.png" alt="" /> </a> </div> <code>1100</code></p> <p> <div class="post-img-view"> <a data-fancybox="gallery" href="im5_3.png"> <img src="im5_3.png" alt="" /> </a> </div> <div class="post-img-view"> <a data-fancybox="gallery" href="im5_3_ans.png"> <img src="im5_3_ans.png" alt="" /> </a> </div> 六百六十六一人之下都来勒但是怎么诸葛青几个都是女的？看身份证第17位即可 <code>张二、李四、江三、王也</code></p> <h1 id="apk包分析">APK包分析 </h1><p> <div class="post-img-view"> <a data-fancybox="gallery" href="1.png"> <img src="1.png" alt="" /> </a> </div> <div class="post-img-view"> <a data-fancybox="gallery" href="1_ans.png"> <img src="1_ans.png" alt="" /> </a> </div> 雷电打开即可看到</p> <p> <div class="post-img-view"> <a data-fancybox="gallery" href="2.png"> <img src="2.png" alt="" /> </a> </div> <div class="post-img-view"> <a data-fancybox="gallery" href="2_ans.png"> <img src="2_ans.png" alt="" /> </a> </div> jadx打开后进入资源文件夹，找application中有name的部分,Intent Filter便是用来注册Activity等的模块，圈起来的就是主函数名了<br> <code>StartShow</code></p> <p> <div class="post-img-view"> <a data-fancybox="gallery" href="3.png"> <img src="3.png" alt="" /> </a> </div> <div class="post-img-view"> <a data-fancybox="gallery" href="3_ans.png"> <img src="3_ans.png" alt="" /> </a> </div> <code>SHA1withRSA</code></p> <p> <div class="post-img-view"> <a data-fancybox="gallery" href="4.png"> <img src="4.png" alt="" /> </a> </div> 随便看就有:<code>1.0</code></p> <p> <div class="post-img-view"> <a data-fancybox="gallery" href="5.png"> <img src="5.png" alt="" /> </a> </div> <div class="post-img-view"> <a data-fancybox="gallery" href="5_ans.png"> <img src="5_ans.png" alt="" /> </a> </div> 看jadx也可以<br> <div class="post-img-view"> <a data-fancybox="gallery" href="5_ans2.png"> <img src="5_ans2.png" alt="" /> </a> </div> </p> <p> <div class="post-img-view"> <a data-fancybox="gallery" href="6.png"> <img src="6.png" alt="" /> </a> </div> 上图就有:<code>10.0.102.135:8888</code></p> <p> <div class="post-img-view"> <a data-fancybox="gallery" href="7.png"> <img src="7.png" alt="" /> </a> </div> 上面也有:<code>Readdata.zip</code></p> <p> <div class="post-img-view"> <a data-fancybox="gallery" href="8.png"> <img src="8.png" alt="" /> </a> </div> 在下面<br> <div class="post-img-view"> <a data-fancybox="gallery" href="8_ans.png"> <img src="8_ans.png" alt="" /> </a> </div> </p> <ol start="9"> <li>平台的题目没描述，找了一下：APK发送回后台服务器的数据包含以下哪些内容？（多选）</li> </ol> <ul> <li>A. 手机通讯录</li> <li>B. 手机短信</li> <li>C. 相册</li> <li>D.GPS定位信息</li> <li>E. 手机应用列表 看jadx，竟然全用函数注明了， <div class="post-img-view"> <a data-fancybox="gallery" href="9_abs.png"> <img src="9_abs.png" alt="" /> </a> </div> 短信<br> <div class="post-img-view"> <a data-fancybox="gallery" href="9_ans2.png"> <img src="9_ans2.png" alt="" /> </a> </div> 通讯录<br> <div class="post-img-view"> <a data-fancybox="gallery" href="9_ans3.png"> <img src="9_ans3.png" alt="" /> </a> </div> app<br> 所以选ABE</li> </ul> <p>好下一部分</p> <h1 id="计算机取证">计算机取证 </h1><h2 id="基本信息">基本信息 </h2><p> <div class="post-img-view"> <a data-fancybox="gallery" href="1-1.png"> <img src="1-1.png" alt="" /> </a> </div> FTK挂载后查看 <div class="post-img-view"> <a data-fancybox="gallery" href="1_ans-1.png"> <img src="1_ans-1.png" alt="" /> </a> </div> <code>20240112</code></p> <h2 id="系统痕迹">系统痕迹 </h2><p> <div class="post-img-view"> <a data-fancybox="gallery" href="2-1.png"> <img src="2-1.png" alt="" /> </a> </div> 得用AXIOM了，挂载时也别挂加密磁盘，之后要找密钥的<br> <div class="post-img-view"> <a data-fancybox="gallery" href="2-2.png"> <img src="2-2.png" alt="" /> </a> </div> 过滤.zip后大概率就是这个 <code>data.zip</code></p> <h2 id="数据库分析">数据库分析 </h2><p> <div class="post-img-view"> <a data-fancybox="gallery" href="3-1.png"> <img src="3-1.png" alt="" /> </a> </div> 接上题，我们将zip文件取出后，发现有压缩包密码，在axiom中溯源不出什么东西了，我们用<code>Autospy</code>挂载后用<code>tools</code>中的<code>file search by attributes</code>进行搜索 <div class="post-img-view"> <a data-fancybox="gallery" href="database.png"> <img src="database.png" alt="" /> </a> </div> 右键选择后<code>view file in directory</code>后发现在桌面（好像没什么用），退回到<code>Recent Documents</code> <div class="post-img-view"> <a data-fancybox="gallery" href="docu.png"> <img src="docu.png" alt="" /> </a> </div> 欸，有相邻的图片，名字就很奇怪，我们溯源一下，好家伙 <div class="post-img-view"> <a data-fancybox="gallery" href="mail.png"> <img src="mail.png" alt="" /> </a> </div> 全是foxmail邮件信息，我们一个一个看一下 <div class="post-img-view"> <a data-fancybox="gallery" href="hint.png"> <img src="hint.png" alt="" /> </a> </div> 这里就是提示了，11位手机号（知道末3位）进行压缩包掩码爆破 <div class="post-img-view"> <a data-fancybox="gallery" href="%e7%88%86.png"> <img src="%e7%88%86.png" alt="" /> </a> </div> 15566666555解压出来 <div class="post-img-view"> <a data-fancybox="gallery" href="sql.png"> <img src="sql.png" alt="" /> </a> </div> 明显是sql数据库，给他仿真还原回去<br> <a class="link" href="https://mp.weixin.qq.com/s?__biz=MzUyOTcyNDg1OA==&amp;mid=2247483966&amp;idx=1&amp;sn=b5a5895e582f329abceb266b0c3e138d&amp;chksm=fa5de6ebcd2a6ffdccfc2f2859224547d9e2d5f67e6e13df803685cd28e2bb3f58d49b719f5a&amp;mpshare=1&amp;scene=1&amp;srcid=01242dz0URlxLlHuA7z4DhbW&amp;sharer_shareinfo=9dfefe1227ce1a82f26b4ac93be98989&amp;sharer_shareinfo_first=eb93aee8a905fa1c6af5c4789b9fdb38#rd" target="_blank" rel="noopener" >具体可看这篇文章</a> <span style="white-space: nowrap;"><svg width=".7em" height=".7em" viewBox="0 0 21 21" xmlns="http://www.w3.org/2000/svg"> <path d="m13 3l3.293 3.293l-7 7l1.414 1.414l7-7L21 11V3z" fill="currentColor" /> <path d="M19 19H5V5h7l-2-2H5c-1.103 0-2 .897-2 2v14c0 1.103.897 2 2 2h14c1.103 0 2-.897 2-2v-5l-2-2v7z" fill="currentColor"> </svg></span> <br> my.ini中 <div class="post-img-view"> <a data-fancybox="gallery" href="skip.png"> <img src="skip.png" alt="" /> </a> </div> 加上这一行跳过需要密码登录，然后用我们解压出的data文件夹把这里的data文件夹替换了 <div class="post-img-view"> <a data-fancybox="gallery" href="ans.png"> <img src="ans.png" alt="" /> </a> </div> 答案<code>2021-03-17.15:49:52</code>：（</p> <p> <div class="post-img-view"> <a data-fancybox="gallery" href="10.png"> <img src="10.png" alt="" /> </a> </div> <div class="post-img-view"> <a data-fancybox="gallery" href="11.png"> <img src="11.png" alt="" /> </a> </div> <code>5</code> <div class="post-img-view"> <a data-fancybox="gallery" href="12.png"> <img src="12.png" alt="" /> </a> </div> 不知道显示出了什么问题我修改排序顺序以后emp_no才正常显示，SQL查询语句</p> <div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt">1 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-sql" data-lang="sql"><span class="line"><span class="cl"><span class="k">SELECT</span><span class="w"> </span><span class="k">sum</span><span class="p">(</span><span class="n">salary</span><span class="p">)</span><span class="w"> </span><span class="k">FROM</span><span class="w"> </span><span class="o">`</span><span class="n">salaries_list</span><span class="o">`</span><span class="w"> </span><span class="k">where</span><span class="w"> </span><span class="n">emp_no</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="mi">204200</span><span class="p">;</span><span class="w"> </span></span></span></code></pre></td></tr></table> </div> </div><p> <div class="post-img-view"> <a data-fancybox="gallery" href="index.png"> <img src="index.png" alt="" /> </a> </div> <code>488313</code></p> <p> <div class="post-img-view"> <a data-fancybox="gallery" href="133.png"> <img src="133.png" alt="" /> </a> </div> team_list中有Finance部门，本来想在<code>hiredate</code>中直接找，但是排序会出问题，写查询吧 <code>1486</code></p> <h2 id="邮箱服务器">邮箱服务器 </h2><p> <div class="post-img-view"> <a data-fancybox="gallery" href="final1.png"> <img src="final1.png" alt="" /> </a> </div> 备忘录里有 <div class="post-img-view"> <a data-fancybox="gallery" href="%e5%a4%87%e4%bb%bd.png"> <img src="%e5%a4%87%e4%bb%bd.png" alt="" /> </a> </div> 但是是Bitlocker的密码<br> <div class="post-img-view"> <a data-fancybox="gallery" href="hamil.png"> <img src="hamil.png" alt="" /> </a> </div> hamilserver就是邮箱服务器，找到后密码用随波逐流梭一下<br> <div class="post-img-view"> <a data-fancybox="gallery" href="ans-1.png"> <img src="ans-1.png" alt="" /> </a> </div> <code>900110</code></p> <p> <div class="post-img-view"> <a data-fancybox="gallery" href="final2.png"> <img src="final2.png" alt="" /> </a> </div> <div class="post-img-view"> <a data-fancybox="gallery" href="final2_ans.png"> <img src="final2_ans.png" alt="" /> </a> </div> 对应3个账户</p> <p> <div class="post-img-view"> <a data-fancybox="gallery" href="final3.png"> <img src="final3.png" alt="" /> </a> </div> 应该对应3个吧我去还真是</p> <p> <div class="post-img-view"> <a data-fancybox="gallery" href="final_4.png"> <img src="final_4.png" alt="" /> </a> </div> 想起之前还有个待会见的图片，随波逐流爆一下宽高 <div class="post-img-view"> <a data-fancybox="gallery" href="final_4_ans.png"> <img src="final_4_ans.png" alt="" /> </a> </div> <code>中国路999号</code></p> <h1 id="over"><font color="#e5b9b7">OVER~</font> </h1><p>由于服务器带宽小大文件传不过去，所以基本没用取证一把梭工具，嘻嘻</p>