vulntarget-n 分析攻击事件是如何发生的，请给出攻击画像 解密勒索 恢复原来的index.jsp页面，恢复正常的web服务 找到隐藏在其中的3个flag 入侵事件，先备份命令历史
cat .bash_history >> bash_hi.bak 第一个flag
flag{vulntarget_very_G00d}
但没够继续翻日志
跟踪log可以看到服务器这里是tomcat的服务端位于/opt/tomcat/root这里在备份index后又新建了一个，接着跟踪
在根目录创建了一个.vulntarget文件夹，用python生成了一对密钥对，然后拷贝了公钥到根目录用py脚本进行了加密，跟踪来到生成密钥的位置
可以看到私钥没有删除，根据log文件信息也只做了rsa,那只需要写一个脚本解密就好，然后截至到这里遇到了卡住我的第一个点
flag解密是正常的，但相对较长的index与404文件无法正常解密，后续是使用python解决的
import base64 import os import rsa # 定义目标后缀 TARGET_EXTENSIONS = ['.vulntarget'] def load_private_key(key_path): """加载RSA私钥""" with open(key_path, mode="rb") as file: priv_key = file.read() return rsa.PrivateKey.load_pkcs1(priv_key) def rsa_decrypt(file_name, priv_key): """对文件进行RSA解密""" with open(file_name, mode="rb") as file: encoded_data = file.read() try:xin xi data = base64.b64decode(encoded_data) except Exception as e: print(f"Base64 decode error for file {file_name}: {e}") return # 打印解密前的数据块信息 print(f"Decrypting file: {file_name}") print(f"Encoded data length: {len(encoded_data)}") print(f"Decoded data length: {len(data)}") # 存储解密后的数据块 res = [] # 设置每次解密的数据块大小为128字节 chunk_size = 128 # 128大小 关键flag{https://github.com/crow821/vulntarget} for i in range(0, len(data), chunk_size): chunk = data[i:i + chunk_size] print(f"Decrypting chunk {i // chunk_size}: {chunk.hex()[:60]}...") try: decrypted_chunk = rsa.decrypt(chunk, priv_key) res.append(decrypted_chunk) except rsa.pkcs1.DecryptionError as e: # 如果解密过程中出现错误，则打印错误信息并跳过当前数据块 print(f"Decryption failed for chunk {i // chunk_size}: {e}") continue # 跳过失败的块 decrypted_data = b''.join(res) os.remove(file_name) # 去掉后缀 new_file_name = file_name.replace(".vulntarget", "") with open(new_file_name, mode="wb") as file: file.write(decrypted_data) print(f"[+] Decrypt success: {new_file_name}") def decrypt_files_in_directory(directory_path, priv_key): """递归解密目录下的所有文件""" for root, _, files in os.walk(directory_path): for file in files: file_path = os.path.join(root, file) if any(file_path.endswith(ext) for ext in TARGET_EXTENSIONS): rsa_decrypt(file_path, priv_key) def main(target_path, key_path): """主函数""" priv_key = load_private_key(key_path) if os.path.isdir(target_path): decrypt_files_in_directory(target_path, priv_key) else: if any(target_path.endswith(ext) for ext in TARGET_EXTENSIONS): rsa_decrypt(target_path, priv_key) if __name__ == '__main__': target_path = './' # 替换为实际路径 key_path = './key.pem' # 替换为私钥路径 main(target_path, key_path) 使用了分块解密
...