Posts Tags Categories Links About

Contents

2024 第四届全国网络空间取证竞赛

 included in  categories Forensics Wp
     494 words  3 minutes 
Contents

赛后完整复现

检材密码：

1

2024Fic@杭州Powered~by~HL!

1

Xiaomi MI 4

image-20240429003147316 

1

Xiaomi Pad 6s

2 

1

5aada11bc1b5

image-20240429003033202 

1

wxid_wnigmud8aj6j12

4 

1

http://www.honglian7001.com/down

5 

1

wxid_u6umc696cms422

image-20240429000706553

image-20240429000727923 

1

03-14 16:55:57

image-20240429003012929 

1

16:00-18:00

image-20240429002758856 

1

wxid_kolc5oaiap6z22

案件材料写了李某和赵某喜被抓获

image-20240429002627358

image-20240429002644744 

1

192.168.110.110:8000/login

image-20240429002719532 

1

6.7.0

image-20240429113036541 

1

2024 年 3 月 12 日 星期二 02:04:15 UTC

创建一个新的仅主机vm网卡，网段为192.168.8.0，空密码登录

image-20240429114907572

image-20240429115010725 

1

65efb8a8-ddd817f6-04ff-000c297bd0e6

由于重写Raid造成ESXi6.7存储名称丢失数据文件不能访问

存储丢失了，要恢复一下

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

[root@localhost:~] esxcfg-volume -l
Scanning for VMFS-6 host activity (4096 bytes/HB, 1024 HBs).
VMFS UUID/label: 65efb8a8-ddd817f6-04ff-000c297bd0e6/datastore1
Can mount: Yes
Can resignature: Yes
Extent name: t10.ATA_____VMware_Virtual_IDE_Hard_Drive___________00000000000000000001:3 range: 0 - 197119 (MB)


[root@localhost:~] esxcfg-volume -m 65efb8a8-ddd817f6-04ff-000c297bd0e6
Mounting volume 65efb8a8-ddd817f6-04ff-000c297bd0e6

image-20240429115425857

image-20240429115515623

image-20240429115740329 

1

192.168.8.112

image-20240429113803287 

1

4

image-20240429115840592 

1

192.168.8.89

image-20240507234710522

fscan扫描，结合超级弱口令扫描，确定服务信息

image-20240507234903816

192.168.8.89 是 web 服务器对应 www 这台虚拟机，密码为 qqqqqq 192.168.8.16 是聊天服务器，对应 rocketchat 这台虚拟机，密码未知 192.168.8.142 对应为 data 这台虚拟机，密码为 hl@7001

1

qqqqqq

根据题目信息，在Windows镜像中找到一个Commonpwd.txt，如上题爆破，得到密码

若出现该问题：

VMware Workstation 在此主机上不支持嵌套虚拟化

管理员权限power shell执行：

1

bcdedit /set hypervisorlaunchtype off

1

14131

image-20240508003610520

image-20240508004644180 

1

/webapp

在根目录的/webapp下发现网站信息

1

10s

image-20240508010336498

image-20240508010252668 

1

!@#qaaxcfvghhjllj788+)_)((

image-20240508010021741 

1

bcrypt

image-20240508084016443 

1

2022-05-09 14:44:41

exsi中data是数据库虚拟机，跟网站实行站库分离

登录data，发现docker中有mysql镜像，启动一下

image-20240508085020564

宝塔处可以连接，随后用navicat连接到服务器的数据库

数据库账号密码在宝塔面板可查看

在sys_user表中可看到超级管理员账户创建的时间

image-20240508085228656 

1

877

根据Windows镜像中获取的运维笔记

image-20240508090412796

对ruoyi的jar包进行修改

1

jar xf ruoyi-admin.jar BOOT-INF/classes/application-druid.yml

1

vim BOOT-INF/classes/application-druid.yml

改成data虚拟机的IP，password要改成宝塔中数据库对应用户的密码

image-20240508090856904

更新jar包配置

1

jar uf ruoyi-admin.jar BOOT-INF/classes/application-druid.yml

image-20240508091936759

随后

1
2
3
4
5
6
7

[root@localhost webapp]# chmod 777 restart.sh 
[root@localhost webapp]# ls
BOOT-INF  dist0906  index.html  luck-prize  qz          ruoyi-admin.jar      ruoyi-admin.jar0827   ruoyi-admin.jar0904  ruoyi-admin.jar 7.19  ruoyi-admin.jar8.15   ruoyi-admin.jarbak  test
dist      down      kill.sh     nohup.out   qz 7.11     ruoyi-admin.jar0818  ruoyi-admin.jar0828   ruoyi-admin.jar0907  ruoyi-admin.jar 7.26  ruoyi-admin.jar8.151  ruoyi-admin.pid
dist0826  group     logs        profile     restart.sh  ruoyi-admin.jar0826  ruoyi-admin.jar08281  ruoyi-admin.jar0915  ruoyi-admin.jar8.14   ruoyi-admin.jar8.16   start.sh
[root@localhost webapp]# ./restart.sh 
32099

还是不行，根据报错进一步修复

添加一条127.0.0.1 localhost映射到hosts中

1

echo '127.0.0.1 localhost' > /etc/hosts

sys_job表

image-20240510090432732

修改后

image-20240510090455104

启动：

1

java -jar ruoyi-admin.jar

image-20240510094200512 

1
2

chmod 777 restart.sh
./restart.sh start

替换一个密码进去

在线Bcrypt密码生成工具-Bejson.com

image-20240510090626125

image-20240510094221800

进入192.168.8.89网站页面

image-20240510094306894

image-20240510094400427 

1

3.8.2

image-20240510090712865 

1

/api/shopOrder

image-20240510094545488 

1

10044888

image-20240510094614266

根据手机聊天记录得知其账号

image-20240510094722449 

1

465222

image-20240510094953068 

1

10

image-20240510095103836 

1

7354468.56

image-20240510095206217 

1

my-secret-pw"

docker inspect 9b

image-20240510095733134 

1

7.9.2009

image-20240510095931175 

1

1.13.1

image-20240510100026378 

1

9bf1cecec3957a5cd23c24c0915b7d3dd9be5238322ca5646e3d9e708371b765

image-20240510110711380 

1

66c0e7ca4921e941cbdbda9e92242f07fe37c2bcbbaac4af701b4934dfc41d8a

image-20240510110915003 

1

2024/3/13 20:15:23

image-20240510110959943 

1

172.17.0.2

image-20240510112415599 

1

182.33.2.250

image-20240510113223608

image-20240510113319137 

1

43.139.0.193

image-20240510113417524

回查该id的登录id即可

1

35821148.48

image-20240510113523086 

1

3

esxi得到ip，然后默认端口是3000

rocketchat:http://192.168.8.130:3000/home

账号密码在解密的容器里

1
2

admin@admin.com
Zhao

image-20240510113833547
image-20240510114636446

image-20240510114900487 

1

3000

1

admin@admin.com

image-20240510115312352 

1

5.0.24

image-20240510120631407 

1

104857600

image-20240510120653480 

1

2024/3/14 8:19:54

重置密码https://cn.linux-console.net/?p=1538

在启动系统时按e进入编辑模式

image-20240510135016080

在此处

image-20240510135256041

修改为rw single init=/bin/bash

image-20240510135422473

随后按CTRL+x，进入命令行模式

输入mount -a ，之后passwd root进行密码更新，然后重启即可登录

image-20240510140419971

开启ssh允许root用户密码登录

1

vi /etc/ssh/sshd_config

image-20240510140622473

去掉注释

image-20240510140756755

开启允许root用户登录

image-20240510143332719

保存，重启sshd systemctl restart sshd

image-20240510141059370

docker inspect 92 | more

image-20240510142137059

使用ssh隧道连接容器内的MongoDB

image-20240510142555799

image-20240510143321806

image-20240510143637652 

1

http://172.16.80.47

https://scofield-1313710994.cos.ap-beijing.myqcloud.com/image-20240510120850366.png?imageSlim 

1

35%

image-20240510120850366 

1

2024/3/15 16:00:00-17:00:00

image-20240510120922267 

1

lao@su.com

image-20240510121042998 

1

iStoreOS

image-20240510143924829

访问http://192.168.8.131/，root/hl@7001

image-20240510144156806 

1

5.10.201

图见上题

1

192.168.8.5

在Windows的访问记录里

image-20240510144316921 

1

br-lan

image-20240510144421770 

1

20.10.22

image-20240510144454345 

1

/root/Configs/NasTools

image-20240510144610283 

1

PassWall2

image-20240510144717786 

1

54

image-20240510144751551 

1

1070

image-20240510144815501 

1

https://pqjc.site/api/v1/client/subscribe?token=243d7bf31ca985f8d496ce078333196a

image-20240510144854299 

1

FFD2777C0B966D5FC07F2BAED1DA5782F8DE5AD6

image-20240429000840777 

1

b25e2804b586394778c800d410ed7bcdc05a19c8

image-20240429000941939 

1

E6EB3D28C53E903A71880961ABB553EF09089007

image-20240429001011517 

1

qwerasdfzxcv

image-20240429001033679

image-20240429001109319 

1

404052-011088-453090-291500-377751-349536-330429-257235

用veracrypt将2024.fic解开，密码如上题

image-20240429001220516 

1

146794496

image-20240429001313373 

1

Chrome

7 

1

Zhao

image-20240429001417440

9.分析技术员赵某的windows镜像，嫌疑人计算机中有疑似使用AI技术生成的进行赌博宣传的图片，该图片中，宣传的赌博网站地址为？

1

https://www.585975.com/

9 

1

ROOP

image-20240429001654155 

1

db.jpg

image-20240429001747797

12.分析技术员赵某的windows镜像，ai换脸生成图片的参数中–similar-face-distance值为

1

0.85

image-20240429001801913 

1

dst01.jpeg

image-20240429001814476 

1

http://hi.pcmoe.net/buddha.html

image-20240429001937486 

1

192.168.8.17

image-20240429002004082 

1

2024-03-14 20:32:08

image-20240429002045864 

1

hl@7001

image-20240429002116105 

1

易有云

18 

1

aa123456

image-20240429002210558

image-20240429002246254

image-20240429002258794

image-20240429002308104 

1

28300

image-20240429002336254

Updated on 2024-05-10
Read markdown | View source | Edit this page | Report issue
 Forensics, Wp
Back | Home