怎样做网站流量,在线网站代码生成器,百度网盘网站开发文档模板,在手机上怎么制作网站工业互联网复现 Modbus协议#xff1a;MMS协议#xff1a;ISC工业互联网比赛题目复现#xff1a;Modbus协议分析#xff1a;组态软件安全分析#xff1a;工业协议分析1#xff1a;工业协议分析2#xff1a;特殊的工控流量#xff1a; Modbus协议#xff1a;
Modbus 市… 工业互联网复现 Modbus协议MMS协议ISC工业互联网比赛题目复现Modbus协议分析组态软件安全分析工业协议分析1工业协议分析2特殊的工控流量 Modbus协议
Modbus 市场占有率高、出题频率高,算是最常见的题目 因为这个协议也是工控领域最常见的协议之一主要有三类 Modbus/RTU 从机地址1B功能码1B数据字段xBCRC值2B 最大长度256B所以数据字段最大长度252B Modbus/ASCII 由Modbus/RTU衍生采用0123456789ABCDEF 表示原本的从机地址、功能码、数据字段并添加开始结束标记所以长度翻倍 开始标记:0x3A1B从机地址2B功能码2B数据字段xBLRC值2B结束标记\r\n2B 最大长度513B因为数据字段在RTU中是最大252B所以在ASCII中最大504B Modbus/TCP 不再需要从机地址改用UnitID不再需要CRC/LRC因为TCP自带校验 传输标识符2B协议标识符2B长度2B从机ID 1B功能码1B数据字段xB
功能编码
MMS协议
工控领域的TCP协议有时wireshark会将response包解析为tcp协议影响做题如果筛选mms时出现连续request包考虑wireshark解析错误将筛选条件删除手动看一下
initiate可以理解为握手initiate-RequestPDUinitiate-ResponsePDUconfirmed可以理解为交互即传数据confirmed-RequestPDUconfirmed-ResponsePDU通常情况为
1轮initiate即发送1个initiate-RequestPDU接收1个initiate-ResponsePDUn轮confirmed直到会话主动关闭或被动断开即confirmed-RequestPDU和confirmed-ResponsePDU交替发送和接收交互时的指令称为confirmedService 常见的confirmedService有
对象操作 getNameList (1) read (4) write (5) getVariableAccessAttributes (6) getNamedVariableListAttributes (12)
文件操作
fileOpen 打开文件(72)fileRead 读取文件(73)fileClose 关闭文件(74)fileDirectory 文件目录(77)
ISC工业互联网比赛题目复现
Modbus协议分析
2019-工业信息安全技能大赛-深圳站-Modbus协议分析
黑客通过外网进入一家工厂的控制网络之后对工控网络中的操作员站系统进行了攻击最终通过工控协议破坏了正常的业务。我们得到了操作员站在攻击前后的网络流量数据包我们需要分析流量中的蛛丝马迹找到FLAG。格式为flag{}
一般这种题目就是使用脚本提取然后 查看常见协议的功能码 然后在进一步分析。
这里是Moudbus协议而且是Modbus/TCP的脚本提取
import pyshark
def get_code():captures pyshark.FileCapture(Modbus.pcap)func_codes {}for c in captures:for pkt in c:if pkt.layer_name modbus:func_code int(pkt.func_code)if func_code in func_codes:func_codes[func_code] 1else:func_codes[func_code] 1print(func_codes)
if __name__ __main__:get_code()四个功能码都出现了702次唯独16预置多个寄存器功能码只出现了两次所以猜测与16功能码相关的流量可能存在关键数据于是运行脚本分析与16功能码相关的流量提取其中的数据脚本和运行结果如下
import pysharkdef find_flag():cap pyshark.FileCapture(Modbus.pcap)idx 1for c in cap:for pkt in c:func_code int(pkt.func_code)if pkt.layer_name modbus and if func_code 16:payload str(c[TCP].payload).replace(:, )print(hex_to_ascii(payload))print({0} *.format(idx))idx 1
def hex_to_ascii(payload):data payloadflags []for d in data:_ord ord(d)if (_ord 0) and (_ord 128):flags.append(chr(_ord))return .join(flags)if __name__ __main__:find_flag()将16进制字符串在线转换对应的ASII码得到TheModbusProtocolIsFunny! flag{TheModbusProtocolIsFunny!} 组态软件安全分析
2019-工业信息安全技能大赛-深圳站-组态软件安全分析
一些组态软件中进行会配置连接很多PLC设备信息。我们在SCADA 工程中写入了flag字段请获取该工程flagflag形式为 flag{}。
放入010 发现是PK 头修改zip后缀 因为文件比较多直接放入kali 使用 grep 进行过滤 找flag。
grep -r flag ./flag{D076-4D7E-92AC-A05ACB788292} 工业协议分析1
2019-工业信息安全技能大赛-深圳站-工业协议分析1
工业网络中存在异常尝试通过分析PCAP流量包分析出流量数据中的异常点并拿到FLAG。格式为 flag{}
这个是MMS协议先过滤然后在ctrl F 搜flag 先是77就是有目录然后就是打开了flag.txt文件 使用过滤规则 (mms) (mms.fileRead 87504092) 找到1800序列号
在使用过滤规则查看回显包(frame.number 1801) 因为是回显包所以过滤1801
看到一串数据 data 一眼Base64编码 只想想到转图片 然后提取即可。 iVBORw0KGgoAAAANSUhEUgAAAdAAAABiCAYAAADgKILKAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAABzXSURBVHhe7Z2Js11Fncfn75maqZmaqZkaS0elXAp1GHRUhGFAQHYQFQRFBWQRiBoBWQyyKaBsxo0tCAgkQHayQEL2jSxAyEoSIAHOvM/JPTPn9fv1Od199z3bvhqr5FkXe77z33ntO/7l//fr/m0IIIYQQ0ciACiGEEAnIgAohhBAJyIAKIYQQCciACiGEEAnIgAohhBAJyIAKIYQQCciACiGEEAnIgAohhBAJyIAKIYQQCciACiGEEAnIgAohhBAJyIAKIYQQCciACiGEEAnIgAohhBAJyIAKIYQQCciACiGEEAnIgAohhBAJyIAKIYQQCciACiGEEAnIgAohhBAJyIAKIYQQCciACiGEEAnIgAohhBAJyIAKIYQQCciACiGEEAnIgAohhBAJyIAKIYQQCciACiGEEAl0ZkDff78oNm/ZV8xfuK2Y8fxrxex5W4vlK3cVe/Ye6L1CCCGEGF6yGtC33n63uOPuNcW/fHJG8bcffsarf/3UjNLAVtz/h/Xm6/h3IYQQYiKSzYBufePt4thT55qG0NXxp8/ttTqIDGj/vP3OeVKf/L1y4qTzppffOq/ni/6bDpxYve7n3irHw/VrKzdsjE6tFL24v7p26rrhs0pLy8x3pZnFhz/zbDnZth/PFd86auzi3MuWFhccPy4qFpG4s1694cNcmKYf/94oXFm4rbr1zdXHe9xcVn/fWcVHPvv/7/WVkYU371kcXHbyN9nzd1a7JVXRHxAeGdknFi2YlfxFNbiql/3lA8MPK8/XJzcXLy3eWz80wcdxpc4t//sSMciw55Zz5xXW/WF4zwcODO46shhQBqCjvzbHNIKWfnjVS72WB2HQtl7XxWBKDJz9tbiM1eaX6HTQbUej3KxZKXdxRXTV5aehys92kThm/u/Dd6vbXD9sDd960tPvH558zfGKicfmPl5RGW4hBsnDx9lGT10q5YTuNyemHDn/WfAYQk8xf3LqyeGPb271W3bLl1X2l0bP01PRXe6/ygwG1ruOLx88uFr0o/eqbsliQPlhrAvxiZVBHW4Y63Vd3EiHGtOe2Gxd5XGw4CuWLWrOPv8BWbfsXp25uu9XptZMDIQSYRoXrksU293oToFp6Rc73yLwPUS7ee/94r6p64t//Ph0830sYWSffGZLr4duwLt0wcWLzfdHGNE2fAYU/f1HpxezR1ajXdO3Ad24aW/xdxxLLIY2cV0597rdj95v7yh9y9e3/pysOFUEcGNA1mcKyerO/us0fNLF2iv/vjht6rx2K1Q6ngAvrlHau890OKdu3a3vdz2NPbs7ynqtq/XoxDd8MrGvaUHzrr/6srBuX1w5eanZf4gwvF2BXbDes1KIAWXhdta3FxSHHWl7nNiueXNP/jRD30b0Fttcr88J/7ysxi/YwV4AMaBpTbls55js75uQ5xcpVu3uvaMZtWymFnbveKc449wWzv1SxV9rG3BfeyGI8d6E6IrXt75VDvisjKz7z1UOMEJW3zF68un8K9E9ew6U5bW1UKMaAVrGbJ9vj0F58f088fH3ql96pu6NuAEvzhfmjEDCMUGdA08PXXv69/Nj0cq8jlHrbumLZsfOdoD3wE8cV9zzwLrS3cpqjz1LghrwUODJwBiyh0lAAK8norsJ2n3yC2Mfmkpfv2BBOQDQ9959B8pgph073iknGLiL505P/2Z2/a/S2ghA52LV7f3Hrr1eXwS7u/dmkfmla4bG4mfqnDaU3kBiDm9YVfzbp3Px/OBpysnN94yduLvKsaAVry4ZMeYfggi7JKDCgrTPcDo3//3LNRkVAyoPGQMuRX0SWxuC2rxQDRunkrx80eD5dMPFwaviig0b9xSbNu/t/Z/NXfesNdP/Z6/PtMehAAYcaIRyVEWIjd4Uax7tE39wGTRWo0hDIqVi8/E252QVyJyPhfs/YZ4jFIMKBBhXHbIQu6cuAWhYfff/yF3uvCEMGNB5r8tK2YnNx21eK4Wc3LDP7QAQjPPNsuCciBvbUfYMEq0shJgKkSln36FfPmFemWvk8eP1wz/WmX1iXDCuPja8sse7Ul67vv8IdfZk8ULV/3a2fPNgMNUA0o0fb0fvHJd0pcBfXrGq6MbCVcFjHIgMaDa8j9vnhwYnDbVwpl/oJtZnvExv7qtXGrzhhWrdltvu9RJ85Jzh8VIjdLl0cdX/iPmVbgQkg5DagBPL5tjVw2bbx69uMdvfMqK3ivSYT/S7Ze8zRMco4pSDShZB/VcEF3SV8G9MPbBz1YSs1RX5ayIDGw2zO/b64WNw21cK4cDI2OsrPa4UEnM7hLC7K33nnL7qt4rhBh/eE7JSybHkqIFbHnUyW1AMUhWf6d/64XeK5ohnoFVm9uez99PoQVyS90cVAwnk13yvev/jlINKC7qej9HHD2r95du6MuAYijrH7ZSbOSTDGgargvzhl/GzRLrbesKgT1Gqy2i4lDXsG9pvTdBSkJMJJ6f/bo3HSu3AaVwidXfE0FR9N77IXzT4I/kvFSt2ZOedgnqaVhpJqQL98wujv89RvhE0cUunLgPoM33gaUGY0zHZwV7BKeXBklcznmfb45jLijIiyrlx89EvEJxFwvx8Z4Pn8vO9LS3eU0aa5YVZZ/75ct2y3l/CqLetKwRfcASBCIMoCeYzoKkP3kSHqGXuK6InmaCwz4sbO/Re5jdZ8vLO8n4kv4/VEFswg8h95d4nXuLhaZvKz86zwUqJKOpQSAOhqMYfHnyl7IPnmmozuZ8rVmDsTfL9Mm48OjG8n2pUoXXJTc5DShuYcsYEbQTkk9dQUERtw/0q9/EebgqGHfdvtj7rO5dKwI45TmmPzcv/uIfja56l5soA9qW/Nqm8yyQ4r7NaC4SbjpybOigIDVV124DNgvzJVki1uGh833MCDqvhIuTjGJihtuXjHmdTGRtKRh1Nte/TN/1SGLetu62li3/k2zHaKowSDwrYBx2XQx0HXBFT8Zu1pwXdBMBM88z1/VicCQ52b5qzVhELjvcMFZ7REFN2Jd7gScWH3VB2qiPUkP8r03rn6eWT6jBQMi1WRO6Y/v5iI/7vvXVtGpaeC4SHYrS2PGRckv9mCRduCJy5t5DSg6zfYvwmBOzGsWWs/39wnsfC7UFDH7Yu8zQqrGEyKASUX3e2HMbZLht6AMpD6wq/bxN5ETK1VC2bW1g3iEwnEhHKDVSWEKLJQ3A1zSoPFUG9bVxusAKx2zCT37UsfyGJoMuKscIYBCv7n33StQcnQUwKb7q1PVuEgNFFZhSwRGCHz8irC4wq5SY2AVWrlY/m7YcTD1atXp3OZmxXuOKZ8KtQ0x97ZCKPZX5S55So1ltdef2uMJydE/Y4bFTkNqCoM9aI4K2wCj6wCIidODCBcvv5xncWjurH/TtKMaBECrv9dL2lM/QGlFJOVttQMXBwXSlwikFoZZG6uBEp6fUdoxYkM/JQfvrz0QMwq5EY6m3raoOZqNXu0qvz5Yu1wQPomzjxm3RRQSU37Fm7n52cWa4NQrrU31IDK2L1IqNBEYGML2HWNn4h8WlYw3OPW330iX68qYk6lGlx81uuahDGKcQuTZxLhWoSK6amdJAYchpQ0tisvnCdxLuJVaKKTS/bmRF7AYk4XVg7KtT/3ulFAPKqtbthzG6S4begOI6tdoiaiFWx3pZf69E7pP7o7bhm2FigHCzYlClEYMxR2Aud4Y6m3ragL3qC9X7NHHB1uMnYHBhyVmGCQ7jNR4VAF9zMT9MDnvvvIcJgYrzwiqRM7JA1wFlg5Kz2jBExHpm6LrnypXIVzThh/T1E1QqDfZOWbVafSCP8YOa3OIJtc5DSgbg5kJba3Yvn2DzfYLlTx9wHv6O1uMHd7uKBqUYUCbNbj9UNuSKAOK24xSa5V8pwnw7/XXVfJVO/HgFauJAYPfvRH/rKp/Jz1QBZTGZDFDq3QrRRzEPB/k/ToeHlHusD68o8SQKIOJqHmztkUIspKefOOOk/hnrbupogSMpqgyrX9KCg2pWVQ1YXkwoCZnKtGHJCUIb7edkvdI9/I9Gc54frwO3fNCHEq/Gfx4w2YASWXHvT8jIAiepNbV6bkMozb701thIWcmuc1tb7XJaCGrMAclGRl46QMPTZtbmue/jT89bE8Mf4cD8j5uhU7RlbbRNJi4BlnHv9rvlVNTgPq2ysOT5cJl1je0CqyNk2iIVw25L2ZgV9ua9DKQbUWkwRaNclUQbUpR/DV6fffu4cGRTayr5VEADgM2QhdWRxrzUFdWAAfVGoFBawcp7qiol0w0jX27IyjKHetq4mLDdJpXqA1KBgzy1kn49gE77b0AMOBgFG0fqslTiejdWkC9fsy8F1xfmOGDsX9vB89U95PnDRNsE9brWtC8PpTlyYzLr3rU8YMyKHXVj9XnSFf3Ua27DLfmGcDtvfaP5/iBQJd9ntOArY0tiXc89ZBFYiDuNsgmMd6Jq17GdzXoRQDykH8bj8pIxHBIGNJbrp4zde0KEyLcxZ97YkOxKv7m/fcOaoIWmA58ZVENxb3Iexhjqbetqgnwyqw0r8tgAg1ysXL07BBtJhl8bzzk481vR4X6zMiBqCmCR21gnG3Wm0rtZV2nPG8f0umbaDElW1q9RmxHwrnEq4T5sGPwy4z/tAtZme9FXwzsm/iAXOQ2oL9o5JbDPV5GIlXsbbnAjYjvFh/talGJArSISXRS/4E0oOSPWeHi6YN394AbjE3CtKHzwghBtUQeC93o59BKYZ627qa8O05E4wxnpDfG1O4mxUpe7bjZfTBd9jEDehNVBVOvbUuWUkbxNcu8ggBBjYrVDIbnATA6stpVCAvvY37Laoibjy1aD1SZm8pqLnAbUF5vQ9ltYLwjuNGbYJXptmFy2xSL4L4epRhQApzcfrqOyP9AGlD2NKz3a4tixRVitUNLXrbdExbs3VkJzyjkmjGeVgCKz0Xiw21fqQnfb4VrerxhoCC/1zeQWOLgAt0ikHgy4ZcEJOMyJH0mqPQgvqyZE7Ke1YbVDoZG8FFS32uO6DpmMsgpmImT10RQ4w8lAVhtfkGOX5DSgVj8oZZJ4//jx2SePtYw7aTkdzXoxQDCq5rn/sDD1VXfCANKAEC1vuRKN2EFeWFMLyxNmPfmqX3PJdMwMKqxL28aybNLaMH7h9VGrCVwGIQWiwD4Wbvq26OtKDOTj4dL13ffcGyGw6rbao9AzHH2rsZDf02qHQiPa3TSsSjEVtS681C471SCZg/TaoOowjNIchpQX9pSzNGSFd4VaMOKzjoFhtq0bWOj2walGlA8D9y79b4IHMW7yGQxNIo4lEPWgPJFUl2ElRqrjONPn1u6GZuiZ1ETnEhgtYk9fQYIfLL68l0zszvr9axWSHtImWVa/aEmrI161Db5GA/wNOASD9kfJX2kydVFdDe/TayaKvzwduzWKHFr6JIAqtxkTlIKt9yCkWVjsUWl7P9wyEbmOAL9ilba/uWxfaucyIil5twUS5yGlAfWNbPaI4FF9Oqe97xSXven74/5DAzHqbSqkGFPjtyHqwJhT99GtxSBlQSvMxy/C5hkLUhC/8n1qZscRes2VACTShtmnTwNE21lJkjJsdogK9pzIkCpRarstCX3NwXdAa6NjXdw/3e90yarPYoFN/EDLVhtUGh9Hv94FsptfVBdK/VrhLeC/aBSVnrkpwG1HeMWUwd3ArKP1p9WUXpuQt3F1qLofgtkP9Gjo8MPSRu1XQ8KA4t4kgrap3meomiC6z2rDnkossdfcNNDhQq5KqMVg9YWasIIEKpFrO5EhyOCb3/WvPBg0fZVWJqIBBas9isFqj9qw2qBQclx/P32EptNQn7qr4/lyGlBfjm2oO7Oz73OvruLVWCHILbQib3bFvVj6LAFvnz/2AM32hh6A8pBrUVrfYpasLnIglxU7ikXDOuMfLQCDF3UxiIfIwtqF1vX1cTvhqoiOpMEx32gzihwfr8yFc7UwZ0LFYbFEqO6nD1ZOBMv49g5dMfhSozcnOQ2ozy2dYvwpKWn15e4hkpPrFs9A1DHmNwiR2xaxpeKLiRQ0zpkgpgRjDzpSyHBaTEMtQHFYDTVzGRfjv0MqmIsG/nhycEkJ4pBNOXGtV6P6DeWfr87KwKT/ckY3PaVmuAGdA/GrTQeeXQp4GrwnH2787P5DBiXsmVuyduj3HgCrPYrBao/asNqgUHJcf448KpYhRUsMRjnTM7nHrHeJwWrihMKSQlyYQVp9eUWZfAdbNF2tKMSNtyTPi9oyyn6oDeiNt9gBBCzfbKbZospN64vPYKk9lhyfHfuKRKUcYuh3rauNqwiIjk92E5SowcUOsaWNnnnqX6yHEPWO1RDFZ71IbVBoWS4/pz9AHctxQetyLcXfGaiVhM3vddEB0bA/e/NdZRucp9Nppy2nOrzYBa6UldHyoxtAYUv75Vko9/CykgnHLjvZAFyac1J6SZVym5MLiislhnrbutrw5Q4ia49kIoLXwPr8yHcZW5yPD9WexSD1R61YbVBoeS4/hx91MGtSw5p27YQdbVzkNOAzvMUlsCdGoOv3jVBlC4TyYBanyX2kJBYhtaAqLvQupgQsqNS1Frq01IeSsXX6msmOO0oH1tqy8Y6i3rauNpn1QXKApKTWDpqkUXcyRTf2Q4/mx2qMYrPaoDasNCiXH9efowwdF5X11lknzybEKzWlAmfhZfRGdG/NMiLtrUnDRDKgBA5bVK212IYWgPqSymhYHsIKTcuxtlqQ55pLJxsb/UV8925oea4H2Oot60rBF9JQzQMZ3Gyf259dkRgxCDI8fxY7VEMVnvUhtUGhZLjnP00QQnmbin41RixdcvOQ0oPYuQ8dF8JWItA4R5zliwtmPrPe6avLSMa9rCCytmU4ZLtLhtaAmaGoUnDHHNltWCI42sNhiuHS2nV9Rhs9uXsxXz3bkFudmDjKHetq4Qmk5lIZ0o9HSc8cJXzo37alDkeH6s9igGqz1qw2qDQslx/Tn6aMMXa/Hgo3FBexa5Dah1RB4KPeWJnGkrHZAMhK6OBHTfC6WksWDg3X5iy5vGMrQG1Bd6HpJ71FTIuglmQL5UlpiDsCm8YPWBYr47ymTV23IOZAz1tnWFgEvonAv80TUxu3afdIPN3m8CT4It9hyW3keH6s9igGqz1qw2qDQslx/Tn6aMMXadpU1i6U3AaUlabVH9W4QgqdEEhltaeyT1dY75diQDn700nJQI5hqE1oL5UCvIk28DYWW1RG74EY4KXQmY71Fz1BSOhmO/OTZym3xjqbesKhSotTfVmWRGnnIYfSkoBC1i6bKc30XqQ7uccz4/VHsVgtUdtWG1QKDmuP0cfbbDStN4j5GzMNnIbUPAdrM1h6k2wQPCNTV2u5Kz3SzGgnGHr9kPAY5cMrQE95Rw7/5PI1CY4ysw3eKK2FAaiunwHclMqbv4Cv8EgKatzGDMdfWeOUA4hjqbeuKgTq8Vh91XT5pSbFmbdxeBJGATW2qgAlW4ZzRGlIwm1UzM1JfST9qJePCGhQ5nhrPYrBao/asNqgUHJcf2ofbDGEBNY0eVpynPLRhQH1ndLDuOWb0LKtRLSu1Q6DHBOEFIv1nikGlLHbHdtvvyuTnkMQ2tAfYWoQI5WNWFL5cZoy8goFKIC5hoNKttJdyAuGnJDyXdZtGL28ui123vjWKO3evwgozb6Letq4YeLBuuNkusuKyQN7MUQ34m5hQkFwAMaS2qS4yqbcvqo47rSDK2uK9/twD4NmT5tTTFgtMEmiT4pK8/1TwQR324meA5grWXUuyTH82O1RzFY7VEbVhsUSo7rTmDe/aIo2eVk3Aq1/gS7ZlMVz9bJe0TbZD6MKAcn1nn28HWeIxoi50tZ/Ja5kINJW47KqMYYX1nqml/Phd6v1MujbujORYhtaAMjA2rSQvuHhxeZgqxdaZhRx1YlilkZB9AkrqQ4iDtWZ59k3eOh3x43vroRDj8GqqLetKxYGEo5Ts/rqRxhcH9feNLZQdD6cvLS8jsdJDmeH6s9isFqj9qw2qBQclx/Sh94NuqvZRxh8kmwEEUHSJeggpkvUBER8ZmDLgwoMIGk8IHVNKaqcblC6asxIS2a6z3TTWgZ5w72n2Nh6pLhtaAgltIIFTcNL5jkELPhSTqtlopxYo9WF8xAmaHITA7dttyTTG47SulwlmKMYdZt4lAMUovumDo3JlmP7ps0pLgwtc5yfH8WO1RDFZ71IbVBoWS4/pTrDOrYwRxeVzrD6hKwMKeOJ8200hYhGScpZoLNZ7pxpQt871MSfP6f2lG4bagPLjg7U9Yl9LlwWCxbZaRjM3ELhLRLr15i9mOJWR8PLwbAZ0BDN70x4G7bmHMUwW1fqR/4/nyl/lL00tKxwQt8702rg1DhzuIeyzUYxpLjbHaoxis9qgNqw0KJcf1p/TRj/eInOcx/Z1aUCB7ZKQrSNXjGsp54imYL1/qgF1gzyJdiSoTaggBFlJdrkzq1E8QIq8gMDvfUa9itjISey6YBe8kQJpKkn9foM6LQnNvde0QzX4bYNzfWqcNtXygH7JrhFU1ekzJyZ6fvOY8SIPjByf/gGoCbh2sIFnHLMU05yPD9WexSD1R61YbVBoeS4/pQMCqxRpToVFI8crv5uzagQOBj6IlVLDC6uM4mrMRakAZcr9YBe6pC8DyiDJjeoqdtM5Rz8EpLB3wV4G0anMuqgNyY4Je/clSWzKs9znTklUhEaFEpjK449JcsHi7GaTgK0VoBUBZWJV0Lrkyrualdf0oJ7hgU7Yh8ZbwKkXBD9VriUmF/xOJ501v5z13n3v2vL1GMgQeNBJXXp42qZy9klgCOkz1YQKA467lwGE/ZyZc7Z2lhAeS4773mqPYrDaozasNiiUHNffTx9Mzij/xn1Hgfhqz5CtA4h9tPYFiGyvitXJqf1WJ/C/hOeAZ41qprZZzk2tnzJUJ9UKvOOtb1N2UzNHGCEyhIwZou6cuAinSIDqv/0JVWRYTGuzlbPBScjyqEEB80WGnXx0NEClKXyICOE5brhplvzP7K5OvHFnXgINyJssISQohBgPfPOhvad0BLmRAxwH2Qt0fGpGnGAOHhFv9HHbkcUKF9c17lAhhDjUeOzJzWV1JaLorZQdtodyHn5uIQM6DpCv6f7YiOIQsfhOoa/EyQpCCHGo0ZZGeO/UblefIAM6YNiot35sROWiWAhuuOZGf1EBGVAhxKGIz4CyFcbKdBCRxDKgiVAyjvM4if4NgVzDh6Zt9KbbpJwpWocC6Rxv5tbHlQEVQhyKuAaUoMrrp6zoK5MiFhnQROp5n6TO3Dd1fbFw8fbS506VIIozE8zDgbwYzqYi8iT0p6wLZh1UU2J/las2lVs2jKxzUUQogUKMlIURxSFHe/OT7ZBzKgCZDXGVK4IVS56moKIYQYHDKgCVDJxDKEKaLgghBCiOFDBjQBcossYxgj/PXzXlCKiRBCDCsyoIlwQjvlrz50uH04s0/Hnjq3DEAa5MHNQggh8iMD2icH3n2/WLlqd1kE/tY7VxdXTV5a1nw9/6JF5X8paECR96dnvDruxcuFEELkQwZUCCGESEAGVAghhEhABlQIIYRIQAZUCCGESEAGVAghhEhABlQIIYRIQAZUCCGESEAGVAghhEhABlQIIYRIQAZUCCGESEAGVAghhEhABlQIIYRIQAZUCCGESEAGVAghhIimKP4XBcAIzFfvoBoAAAAASUVORK5CYIIPS如果复制不出来可以使用 strings 提取命令如下
strings test.pcap |grep .pngflag{ICS-mms104} 工业协议分析2
数据包名称是UDP数据估计这个是考点 先过滤一下 发现len 的长度有些重复了 排个序看看。
发现这几个好像没重复 105 好像可以看到flag标识 131和137 下面好像是字符串提取转ASCII码 666c61677b37466f4d3253746b6865507a7dPS其实flag的16进制为666c6167 看到后面这一窜大概可以知道了 大家可以记一下。 flag{7FoM2StkhePz} 特殊的工控流量
某10段工控网络中工业协议中存在异常数据。请通过流量中的数据找寻flag。格式为flag{}
S7comm工控流量 直接筛选协议然后就排个序就一直按下键知道找到这一条。
然后转码 和上面的题目一样的 得到flag。 69735f6e6f745f7265616cflag{is_not_real}
