MISC-喧宾夺主的信号

ISCC2026 WriteUp 提交模板

MISC-喧宾夺主的信号

解题思路

1.看下基本信息：

└─$ capinfos attachment-17.pcapng
File name:           attachment-17.pcapng
File type:           Wireshark/tcpdump/... - pcap
File encapsulation:  Raw IPv4
File timestamp precision:  microseconds (6)
Packet size limit:   file hdr: 65535 bytes
Number of packets:   1,509
File size:           109 kB
Data size:           85 kB
Capture duration:    14.990000 seconds
Earliest packet time: 2020-12-31 19:00:00.000000
Latest packet time:   2020-12-31 19:00:14.990000
Data byte rate:      5,680 bytes/s
Data bit rate:       45 kbps
Average packet size: 56.43 bytes
Average packet rate: 100 packets/s
SHA256:              6a1542f50df0055530bb3f21cbf785d2de1959fde34f6fce20ec13eedc013f11
SHA1:                7b70b072a280573cf4f18a1b75c68f2a0ccf7f88
Strict time order:   True
Number of interfaces in file: 1
Interface #0 info:
                     Encapsulation = Raw IPv4 (129 - rawip4)
                     Capture length = 65535
                     Time precision = microseconds (6)
                     Time ticks per second = 1000000
                     Number of stat entries = 0
                     Number of packets = 1509
                                                                                                                                                                                                                
(base) ┌──(kali㉿kali)-[~/temp/wireshake]
└─$ tshark -n -r attachment-17.pcapng -q -z io,phs

===================================================================
Protocol Hierarchy Statistics
Filter: 

frame                                    frames:1509 bytes:85148
  raw                                    frames:1509 bytes:85148
    ip                                   frames:1509 bytes:85148
      udp                                frames:1500 bytes:84000
      tcp                                frames:9 bytes:1148
        http                             frames:1 bytes:828
          json                           frames:1 bytes:828
===================================================================

只有 1509 个包。其中 1500 个 UDP 包发往 239.255.255.250:1900，看起来像 SSDP；另外有 1 个 HTTP JSON 请求：

筛选一下追踪流有：

POST /command HTTP/1.1
Host: 45.78.1.1
Content-Type: application/json
Content-Length: 692
0.000000s

{"instruction": "UEsDBBQAAQBjAB1EdFyKqt6vUgEAAOIBAAAJAAsAaW1hZ2UucG5nAZkHAAEAQUUDCAAu5zMd+yURTGRveB5OC27wF6JL29dcWDAZhQZnDZHM5Dw9gFyQ8Pw8pbKP0OSc76nVGv1I1VjHg7mVj3/Lj4gHD/t4DZNDxAA81ZH6gWweZxBUOMtuRKUGq86cTi4p6FBipc1htedd+w+YB8tiVVZIfSkxPxWEKM1hnwIrq3bxeBldN7O4ZvytbMQR/Otgu4OKdygcNF1OTt1mHeKllErl60MiN5E4MtQiHffSmNy37+ZUK2T6etpOqB5MDVHTYrlgo3Y/WSQjOWsNFlyIJ+HGyIJXfkj4lU15NkQV3EuaRrPqweoa1Wpzu4CSN/bCh+SivviCyo6TRSnwKmuhe4LxJUHkKlkf8+mUSpkiwg00527a08Aoq0lLwzPupGu/YkHGITwbDtr8uKsYI+jnKHOZsQoMaiV3pGDjblAYsEz3glifTvZfWBxnzCEGc3nnczbuPFBLAQIUABQAAQBjAB1EdFyKqt6vUgEAAOIBAAAJAAsAAAAAAAAAAAC2gQAAAABpbWFnZS5wbmcBmQcAAQBBRQMIAFBLBQYAAAAAAQABAEIAAACEAQAAAAA=", "note": "This is the real command."
}

其实就是

{
  "instruction": "...base64...",
  "note": "This is the real command."
}

instruction base64 解码后是一个 ZIP 文件，里面有 image.png，但 ZIP 有加密。

2. 获取密码

UDP 目标端口固定为 1900，但每个包的 payload 都是 28 字节 base64 字符串。逐包解码后发现第 201、501、801、1101 个 UDP 包 payload 完全相同：
U2hlbmdEb25nSmlYaUAzNi0xLTY=
，base64解码ShengDongJiXi@36-1-6用该字符串作为 ZIP 密码即可解出图片。

3.lsB

随波逐流出：RGB:ISCC{1d3f1c4It10n_14s_th3w3_mk3y_t0Q_v1ct0ry}.....

Exp

无