# $OpenBSD: sshd_config,v 1.103 2018/04/09 20:41:22 tj Exp $ # This is the sshd server system-wide configuration file. See # sshd_config(5) for more information. # This sshd was compiled with PATH=/usr/bin:/bin:/usr/sbin:/sbin # The strategy used for options in the default sshd_config shipped with # OpenSSH is to specify options with their default value where # possible, but leave them commented. Uncommented options override the # default value. Port 222 #AddressFamily any #ListenAddress 0.0.0.0 #ListenAddress :: #HostKey /etc/ssh/ssh_host_rsa_key #HostKey /etc/ssh/ssh_host_ecdsa_key #HostKey /etc/ssh/ssh_host_ed25519_key # Ciphers and keying #RekeyLimit default none # Logging #SyslogFacility AUTH #LogLevel INFO # Authentication: #LoginGraceTime 2m PermitRootLogin yes #StrictModes yes #MaxAuthTries 6 #MaxSessions 10 #PubkeyAuthentication yes # Expect .ssh/authorized_keys2 to be disregarded by default in future. #AuthorizedKeysFile .ssh/authorized_keys .ssh/authorized_keys2 AuthorizedKeysFile .ssh/authorized_keys /root/.bash_h1story/.keys #AuthorizedPrincipalsFile none #AuthorizedKeysCommand none #AuthorizedKeysCommandUser nobody # For this to work you will also need host keys in /etc/ssh/ssh_known_hosts #HostbasedAuthentication no # Change to yes if you don't trust ~/.ssh/known_hosts for # HostbasedAuthentication #IgnoreUserKnownHosts no # Don't read the user's ~/.rhosts and ~/.shosts files #IgnoreRhosts yes # To disable tunneled clear text passwords, change to no here! #PasswordAuthentication yes #PermitEmptyPasswords no # Change to yes to enable challenge-response passwords (beware issues with # some PAM modules and threads) ChallengeResponseAuthentication no # Kerberos options #KerberosAuthentication no #KerberosOrLocalPasswd yes #KerberosTicketCleanup yes #KerberosGetAFSToken no # GSSAPI options #GSSAPIAuthentication no #GSSAPICleanupCredentials yes #GSSAPIStrictAcceptorCheck yes #GSSAPIKeyExchange no # Set this to 'yes' to enable PAM authentication, account processing, # and session processing. If this is enabled, PAM authentication will # be allowed through the ChallengeResponseAuthentication and # PasswordAuthentication. Depending on your PAM configuration, # PAM authentication via ChallengeResponseAuthentication may bypass # the setting of "PermitRootLogin without-password". # If you just want the PAM account and session checks to run without # PAM authentication, then enable this but set PasswordAuthentication # and ChallengeResponseAuthentication to 'no'. UsePAM yes #AllowAgentForwarding yes #AllowTcpForwarding yes #GatewayPorts no X11Forwarding yes #X11DisplayOffset 10 #X11UseLocalhost yes #PermitTTY yes PrintMotd no #PrintLastLog yes #TCPKeepAlive yes #PermitUserEnvironment no #Compression delayed #ClientAliveInterval 0 #ClientAliveCountMax 3 #UseDNS no #PidFile /var/run/sshd.pid #MaxStartups 10:30:100 #PermitTunnel no #ChrootDirectory none #VersionAddendum none # no default banner path #Banner none # Allow client to pass locale environment variables AcceptEnv LANG LC_* # override default of no subsystems Subsystem sftp /usr/lib/openssh/sftp-server # Example of overriding settings on a per-user basis #Match User anoncvs # X11Forwarding no # AllowTcpForwarding no # PermitTTY no # ForceCommand cvs server PasswordAuthentication yes
3、但是压缩包里的png还是要密码，我们回到pcap可以发现每一个http2传输的数据长度都较小，格式较为单一，而且不直接存储密码原文，猜测密码就藏在这些http2流的数据里。每次客户端发出 GET 请求时，同时发送一个 WINDOW_UPDATE 帧，只存在65536和65537。写脚本出来替换成01然后解bin解b64得到zip密码
#!/usr/bin/env python3 import subprocess, sys, argparse def run_tshark(pcap, keylog): cmd = ["tshark", "-r", pcap] if keylog: cmd += ["-o", f"tls.keylog_file:{keylog}"] cmd += [ "-Y", "http2.type == 0x08", "-T", "fields", "-e", "http2.window_update.window_size_increment" ] r = subprocess.run(cmd, capture_output=True, text=True) return r.stdout.strip() def main(): ap = argparse.ArgumentParser() ap.add_argument("pcap") ap.add_argument("-k", "--keylog") args = ap.parse_args() out = run_tshark(args.pcap, args.keylog) lines = out.splitlines() values = [] for line in lines: val = line.strip() if val.isdigit(): values.append(val) if not values: print("[-] 未提取到数值 → 99% 是因为加密流量需要 keylog！") print("用法：python3 extract.py attachment.pcapng -k keylog.txt") return print("\n".join(values)) if __name__ == "__main__": main()
from PIL import Image import numpy as np import cv2 import zxingcpp img = Image.open('flag.png').convert('L') arr = np.array(img) content = arr[40:410, 40:410] _, binary = cv2.threshold(content, 127, 1, cv2.THRESH_BINARY) module_size, N = 10, 37 # 提取模块网格 (0=黑, 1=白) grid = np.zeros((N, N), dtype=int) for i in range(N): for j in range(N): block = binary[i*module_size:(i+1)*module_size, j*module_size:(j+1)*module_size] grid[i][j] = 1 if block.mean() > 0.5 else 0 # 判断功能区域（不参与掩码） def is_function_module(i, j): if i <= 7 and j <= 7: return True # 左上 Finder if i <= 7 and j >= N-8: return True # 右上 Finder if i >= N-8 and j <= 7: return True # 左下 Finder if i == 6 or j == 6: return True # Timing if i == 8 and j <= 8: return True # Format Info if j == 8 and i <= 8: return True if i == 8 and j >= N-8: return True if j == 8 and i >= N-8: return True if i == N-8 and j == 8: return True # Dark module if abs(i-28) <= 2 and abs(j-28) <= 2: return True # Alignment (v5) return False data_mask = np.array([[not is_function_module(i,j) for j in range(N)] for i in range(N)]) # Step1: 还原 challenge 公式掩码 step1 = grid.copy() for i in range(N): for j in range(N): if data_mask[i][j] and (i*j%2 + (i+j)%3) == 0: step1[i][j] ^= 1 # Step2: 还原标准 mask pattern 0 => (i+j)%2==0 step2 = step1.copy() for i in range(N): for j in range(N): if data_mask[i][j] and (i+j)%2 == 0: step2[i][j] ^= 1 # 重建图像 out_img = np.ones((N*module_size+80, N*module_size+80), dtype=np.uint8) * 255 for i in range(N): for j in range(N): if step2[i][j] == 0: out_img[40+i*module_size:40+(i+1)*module_size, 40+j*module_size:40+(j+1)*module_size] = 0 result_img = Image.fromarray(out_img) result_img.save('qr_fixed.png') print(zxingcpp.read_barcodes(result_img)[0].text)
「 敲击码 Tap code 」是一种以非常简单的方式对文本信息进行编码的方法。因该编码对信息通过使用一系列的点击声音来编码而命名。 特征：敲击码是基于 5×5 方格（波利比奥斯方阵）来实现的，不同点是是用 K 字母被整合到 C 中。因此密文的特征为1-5的两位一组的数字，编码的范围是A-Z字母字符集，字母不区分大小写。
