[{"data":1,"prerenderedAt":1533},["ShallowReactive",2],{"content:\u002F2026\u002Fwangdingcup-traffic-analysis":3,"surround:\u002F2026\u002Fwangdingcup-traffic-analysis":1522},{"id":4,"title":5,"body":6,"categories":1498,"date":1500,"description":1501,"draft":1502,"extension":1503,"image":1504,"meta":1505,"navigation":1508,"path":1509,"permalink":1510,"published":1510,"readingTime":1511,"recommend":1510,"references":1510,"seo":1516,"sitemap":1517,"stem":1518,"tags":1519,"type":1520,"updated":1510,"__hash__":1521},"content\u002Fposts\u002F2026\u002Fwangdingcup-traffic-analysis.md","网鼎杯流量分析两道题WP",{"type":7,"value":8,"toc":1465},"minimark",[9,13,16,36,39,43,46,51,54,57,146,149,160,163,230,235,238,252,255,259,262,265,269,275,281,307,310,313,315,319,326,329,397,401,404,410,413,419,423,426,458,462,465,471,478,499,502,506,509,512,514,518,523,526,532,539,543,550,556,559,596,603,612,615,621,624,683,686,690,693,735,741,752,759,765,768,860,866,872,878,881,894,898,904,907,915,918,926,929,935,938,958,960,964,969,972,977,983,987,993,999,1002,1009,1015,1021,1024,1095,1111,1121,1124,1130,1137,1147,1151,1161,1167,1170,1228,1231,1238,1244,1247,1296,1299,1303,1306,1315,1321,1324,1330,1357,1360,1368,1375,1379,1382,1385,1406,1413,1426,1428,1431,1434,1443,1455,1458,1460],[10,11,12],"p",{},"网鼎杯的两道流量分析题，一道是 4G 核心网信令分析，另一道是冰蝎 Webshell 加密流量解密。两道题都是关于\"流量分析\"这个方向的，但侧重点完全不同。第一道偏网络协议知识，第二道偏加解密逆向。",[10,14,15],{},"复现链接：",[17,18,19,29],"ul",{},[20,21,22,23],"li",{},"题目一（MME 流量分析）：",[24,25,26],"a",{"href":26,"rel":27},"https:\u002F\u002Fwww.nssctf.cn\u002Fproblem\u002F6959",[28],"nofollow",[20,30,31,32],{},"题目二（冰蝎加密流量）：",[24,33,34],{"href":34,"rel":35},"https:\u002F\u002Fwww.nssctf.cn\u002Fproblem\u002F6848",[28],[37,38],"hr",{},[40,41,42],"h2",{"id":42},"一些前置知识",[10,44,45],{},"在开始解题之前，先补充一些背景知识。这两道题涉及的知识面不太一样，分开来说。",[47,48,50],"h3",{"id":49},"_4g-lte-核心网架构epc","4G LTE 核心网架构（EPC）",[10,52,53],{},"4G 的核心网叫做 EPC（Evolved Packet Core，演进分组核心网）。跟 3G 时代相比，4G 把电路域砍掉了，整个核心网全部走分组交换，所以叫\"全 IP 网络\"。",[10,55,56],{},"EPC 主要由下面几个网元组成：",[58,59,60,76],"table",{},[61,62,63],"thead",{},[64,65,66,70,73],"tr",{},[67,68,69],"th",{},"网元",[67,71,72],{},"全称",[67,74,75],{},"功能",[77,78,79,94,107,120,133],"tbody",{},[64,80,81,88,91],{},[82,83,84],"td",{},[85,86,87],"strong",{},"MME",[82,89,90],{},"Mobility Management Entity",[82,92,93],{},"移动性管理实体，负责信令处理、用户位置管理、鉴权、寻呼等。是整个 EPC 的控制面核心",[64,95,96,101,104],{},[82,97,98],{},[85,99,100],{},"S-GW",[82,102,103],{},"Serving Gateway",[82,105,106],{},"服务网关，负责数据包的路由和转发。一个 MME 下面可以管多个 S-GW",[64,108,109,114,117],{},[82,110,111],{},[85,112,113],{},"P-GW",[82,115,116],{},"PDN Gateway",[82,118,119],{},"PDN 网关，对外连接互联网。负责 IP 地址分配、策略执行、计费",[64,121,122,127,130],{},[82,123,124],{},[85,125,126],{},"HSS",[82,128,129],{},"Home Subscriber Server",[82,131,132],{},"归属用户服务器，存储用户签约信息（类似于 3G 的 HLR）",[64,134,135,140,143],{},[82,136,137],{},[85,138,139],{},"eNB",[82,141,142],{},"eNodeB",[82,144,145],{},"4G 基站，跟 MME 通过 S1-MME 接口通信",[10,147,148],{},"这些网元之间使用不同的协议通信：",[150,151,156],"pre",{"className":152,"code":154,"language":155},[153],"language-text","  UE（手机）\n    |\n    | 空口（LTE-Uu）\n    |\n  eNB（基站）\n   \u002F \\\n  \u002F   \\\nS1-MME  S1-U\n(S1AP  (GTP-U\nover   over\nSCTP)  UDP)\n \u002F       \\\nMME      S-GW ──GTP-C── MME\n |        |\nS6a       S5\u002FS8\n(Diameter)(GTP-C)\n |        |\nHSS      P-GW ── 互联网\n","text",[157,158,154],"code",{"__ignoreMap":159},"",[10,161,162],{},"核心网三大控制面协议：",[58,164,165,181],{},[61,166,167],{},[64,168,169,172,175,178],{},[67,170,171],{},"协议",[67,173,174],{},"接口",[67,176,177],{},"传输层",[67,179,180],{},"用途",[77,182,183,199,215],{},[64,184,185,190,193,196],{},[82,186,187],{},[85,188,189],{},"S1AP",[82,191,192],{},"S1-MME",[82,194,195],{},"SCTP",[82,197,198],{},"eNB 与 MME 之间传递信令消息",[64,200,201,206,209,212],{},[82,202,203],{},[85,204,205],{},"GTPv2-C",[82,207,208],{},"S11\u002FS5",[82,210,211],{},"UDP（2123 端口）",[82,213,214],{},"MME 与 S-GW 之间管理隧道",[64,216,217,222,225,227],{},[82,218,219],{},[85,220,221],{},"Diameter",[82,223,224],{},"S6a",[82,226,195],{},[82,228,229],{},"MME 向 HSS 查询\u002F更新用户信息",[231,232,234],"h4",{"id":233},"sctp-协议简介","SCTP 协议简介",[10,236,237],{},"SCTP（Stream Control Transmission Protocol，流控制传输协议）是 4G 控制面的核心传输层协议，在 IP 协议号 132。可以把它理解为 TCP 的\"增强版\"——保留了 TCP 的可靠传输和拥塞控制，同时增加了：",[17,239,240,246],{},[20,241,242,245],{},[85,243,244],{},"多流（Multi-streaming）","：在一个连接里可以有多条逻辑流，不同的数据走不同的流，避免了 TCP 的队头阻塞问题",[20,247,248,251],{},[85,249,250],{},"多宿主（Multi-homing）","：一个端点可以绑定多个 IP 地址，主路径断了自动切备路径",[10,253,254],{},"在电信网络中，SCTP 被用来承载 S1AP（基站 ↔ MME）和 Diameter（MME ↔ HSS）等高层协议。",[231,256,258],{"id":257},"diameter-协议简介","Diameter 协议简介",[10,260,261],{},"Diameter 可以理解为 RADIUS 协议的升级版（名字也是个梗，半径的两倍是直径）。它运行在 SCTP 或 TCP 之上，使用 AVP（Attribute-Value Pair，属性值对）来承载数据。",[10,263,264],{},"Diameter 在 4G 核心网中扮演着关键角色。MME 通过 S6a 接口（使用 Diameter 协议）向 HSS 发送 Update Location Request（更新位置请求）时，会在 AVP 中携带用户的 ECGI（E-UTRAN 小区全局标识符），也就是用户的物理位置信息。",[231,266,268],{"id":267},"ecgi-是什么","ECGI 是什么",[10,270,271,274],{},[85,272,273],{},"ECGI","（E-UTRAN Cell Global Identifier，E-UTRAN 小区全局标识符）是一个 52 位（bit）的标识符，用于在全球范围内唯一标识一个基站的特定扇区（小区）。它的结构如下：",[150,276,279],{"className":277,"code":278,"language":155},[153],"ECGI (52 bits) = PLMN-ID (24 bits) + ECI (28 bits)\n\nPLMN-ID = MCC (12 bits) + MNC (12 bits)\nECI = eNB-ID (20 bits) + Cell-ID (8 bits)\n",[157,280,278],{"__ignoreMap":159},[17,282,283,289,295,301],{},[20,284,285,288],{},[85,286,287],{},"MCC","（Mobile Country Code）：移动国家码，460 = 中国",[20,290,291,294],{},[85,292,293],{},"MNC","（Mobile Network Code）：移动网络码，00 = 中国移动，01 = 中国联通，11 = 中国电信",[20,296,297,300],{},[85,298,299],{},"eNB-ID","：基站标识",[20,302,303,306],{},[85,304,305],{},"Cell-ID","：扇区标识",[10,308,309],{},"有了 ECGI，通过公开的基站数据库（如 OpenCelliD、Mozilla Location Service 等）就可以查出该基站的经纬度，进而定位用户。",[10,311,312],{},"在本题中，ECGI 以 14 位十六进制数（56 bits，含 4 bits 填充）的形式出现在 Diameter 的 AVP 中。",[37,314],{},[47,316,318],{"id":317},"冰蝎behinderwebshell-管理工具","冰蝎（Behinder）Webshell 管理工具",[10,320,321,322,325],{},"冰蝎是一个知名的 Webshell 管理工具，截至 2026 年最新版本为 v4.1。它的核心特点是使用",[85,323,324],{},"加密隧道","进行通信，规避传统 IDS\u002FIPS 的检测。",[231,327,328],{"id":328},"各版本加密方式对比",[58,330,331,344],{},[61,332,333],{},[64,334,335,338,341],{},[67,336,337],{},"版本",[67,339,340],{},"加密方式",[67,342,343],{},"通信特征",[77,345,346,357,368,379],{},[64,347,348,351,354],{},[82,349,350],{},"v1.x",[82,352,353],{},"无加密（Base64 简单编码）",[82,355,356],{},"容易被检测",[64,358,359,362,365],{},[82,360,361],{},"v2.x",[82,363,364],{},"AES-128-CBC + 动态密钥",[82,366,367],{},"引入加密",[64,369,370,373,376],{},[82,371,372],{},"v3.x",[82,374,375],{},"AES-128-CBC + 随机 IV",[82,377,378],{},"增强安全性",[64,380,381,386,391],{},[82,382,383],{},[85,384,385],{},"v4.x",[82,387,388],{},[85,389,390],{},"AES-128-CBC + 固定密钥（MD5 派生）",[82,392,393,394],{},"默认密钥 ",[157,395,396],{"code":396},"rebeyond",[231,398,400],{"id":399},"冰蝎-v40-加密流程","冰蝎 v4.0 加密流程",[10,402,403],{},"冰蝎 v4.0 的通信加密过程如下：",[150,405,408],{"className":406,"code":407,"language":155},[153],"1. 用户输入连接密码（默认 \"rebeyond\"）\n          ↓\n2. MD5(密码) → 取前 16 字节作为 AES-128 密钥\n          ↓\n3. 要传输的 JSON 数据 + PKCS7 填充\n          ↓\n4. AES-128-CBC 加密（随机生成 16 字节 IV）\n          ↓\n5. IV + 密文 → Base64 编码\n          ↓\n6. 放入 HTTP POST Body 发送\n",[157,409,407],{"__ignoreMap":159},[10,411,412],{},"服务端收到后逆向操作：",[150,414,417],{"className":415,"code":416,"language":155},[153],"Base64 解码 → 取前 16 字节作为 IV → AES-128-CBC 解密 → 去填充 → 得到 JSON\n",[157,418,416],{"__ignoreMap":159},[231,420,422],{"id":421},"aes-128-cbc-简介","AES-128-CBC 简介",[10,424,425],{},"AES（Advanced Encryption Standard）是目前最广泛使用的对称加密算法。几个关键参数：",[17,427,428,434,440,446,452],{},[20,429,430,433],{},[85,431,432],{},"密钥长度","：AES-128 使用 128 位（16 字节）密钥",[20,435,436,439],{},[85,437,438],{},"分组长度","：固定 128 位（16 字节）",[20,441,442,445],{},[85,443,444],{},"加密模式","：CBC（Cipher Block Chaining，密码块链接），每个明文块在加密前先与前一个密文块进行 XOR 运算",[20,447,448,451],{},[85,449,450],{},"IV（初始化向量）","：CBC 模式需要 16 字节随机 IV，每次加密都不同",[20,453,454,457],{},[85,455,456],{},"填充","：PKCS7 填充，将明文补齐到 16 字节（块大小）的整数倍",[231,459,461],{"id":460},"pcapng-文件格式","pcapng 文件格式",[10,463,464],{},"pcapng（PCAP Next Generation）是 Wireshark 的新一代抓包文件格式，用来替代旧的 pcap 格式。它的文件头结构如下：",[150,466,469],{"className":467,"code":468,"language":155},[153],"Section Header Block (SHB) 结构:\n┌──────────┬──────┬─────────────────────────────┐\n│  偏移    │ 大小 │ 字段                        │\n├──────────┼──────┼─────────────────────────────┤\n│  0x00    │  4   │ Block Type: 0x0A0D0D0A      │\n│  0x04    │  4   │ Block Total Length          │\n│  0x08    │  4   │ Byte-Order Magic: 0x1A2B3C4D │\n│          │      │ （大端机上是这个值）          │\n│  0x0C    │  2   │ Major Version               │\n│  0x0E    │  2   │ Minor Version               │\n│  0x10    │  8   │ Section Length              │\n│  0x18    │  N   │ Options（可变）              │\n│  0x18+N  │  4   │ Block Total Length（重复）   │\n└──────────┴──────┴─────────────────────────────┘\n",[157,470,468],{"__ignoreMap":159},[10,472,473,474,477],{},"关键字段是 0x08 处的 ",[85,475,476],{},"Byte-Order Magic","：",[17,479,480,487,493],{},[20,481,482,483,486],{},"如果是 ",[157,484,485],{"code":485},"1A 2B 3C 4D","，表示文件是大端序（Big-Endian）写入的",[20,488,482,489,492],{},[157,490,491],{"code":491},"4D 3C 2B 1A","，表示文件是小端序（Little-Endian）写入的",[20,494,495,498],{},[85,496,497],{},"0x04 和 0x08 处的 Block Total Length 必须相等","，Wireshark 会校验这个",[10,500,501],{},"如果这个魔数字段损坏了（比如本题），Wireshark 就无法识别文件格式。",[231,503,505],{"id":504},"base64-编码原理","Base64 编码原理",[10,507,508],{},"Base64 是一种用 64 个可打印字符（A-Z、a-z、0-9、+、\u002F）来表示任意二进制数据的编码方式。每 3 个字节（24 bits）被分为 4 组每组 6 bits，每组对应一个字符。",[10,510,511],{},"在冰蝎中，加密后的二进制数据（IV + 密文）会先进行 Base64 编码，然后作为 HTTP 请求体发送。解码是解密的第一步。",[37,513],{},[40,515,517],{"id":516},"题目一网鼎杯-mme-流量分析","题目一：网鼎杯 MME 流量分析",[10,519,15,520],{},[24,521,26],{"href":26,"rel":522},[28],[47,524,525],{"id":525},"题目描述",[527,528,529],"blockquote",{},[10,530,531],{},"某单位网络遭到非法的攻击，安全人员对流量调查取证之后保存了关键证据，发现人员的定位信息存在泄露，请对其进行分析。flag 为用户位置信息进行 32 位 MD5 哈希值。",[10,533,534,535,538],{},"到手一个 ",[157,536,537],{"code":537},"MME.cap","，大小约 48KB，包含 141 个数据包。",[47,540,542],{"id":541},"step-1初步分析流量包","Step 1：初步分析流量包",[10,544,545,546,549],{},"拿到 pcap 文件第一步，先用 Wireshark 打开，然后看 ",[85,547,548],{},"Statistics（统计）→ Protocol Hierarchy（协议层级）","，了解流量包的协议分布：",[150,551,554],{"className":552,"code":553,"language":155},[153],"Protocol          Packets   Percent\nSCTP              119       84.4%\n  S1AP            90        63.8%\n  Diameter        29        20.6%\nUDP               22        15.6%\n  GTPv2           22        15.6%\n",[157,555,553],{"__ignoreMap":159},[10,557,558],{},"可以看出三大类流量：",[17,560,561,574,584],{},[20,562,563,566,567,570,571],{},[85,564,565],{},"SCTP 承载 S1AP","：eNB（基站）和 MME 之间的控制面信令，收发双方为 ",[157,568,569],{"code":569},"1.1.1.1"," 和 ",[157,572,573],{"code":573},"2.2.2.2",[20,575,576,579,580,570,582],{},[85,577,578],{},"SCTP 承载 Diameter","：MME 和 HSS 之间的用户信息查询，同样是 ",[157,581,569],{"code":569},[157,583,573],{"code":573},[20,585,586,589,590,570,593],{},[85,587,588],{},"UDP 2123 端口承载 GTPv2-C","：MME 和 S-GW 之间的 GTP 隧道管理，",[157,591,592],{"code":592},"14.66.12.4",[157,594,595],{"code":595},"14.66.50.4",[10,597,598,599,602],{},"有了这张表，可以确定这是一个 ",[85,600,601],{},"4G LTE 核心网（EPC）"," 的信令流量包。",[527,604,605],{},[10,606,607,608,611],{},"Wireshark 小技巧：",[157,609,610],{"code":610},"Statistics → Protocol Hierarchy"," 是最常用的分析入口，可以一目了然地看到数据包中都有哪些协议，以及每种协议的数量和占比。",[10,613,614],{},"进一步看 S1AP 的明文内容，可以在 SCTP 的 Payload 中看到这样的字符串：",[150,616,619],{"className":617,"code":618,"language":155},[153],"mmec60.mmegi0361.mme.epc.mnc008.mcc460.3gppnetwork.org\n",[157,620,618],{"__ignoreMap":159},[10,622,623],{},"可以拆解出 PLMN 信息：",[58,625,626,639],{},[61,627,628],{},[64,629,630,633,636],{},[67,631,632],{},"字段",[67,634,635],{},"值",[67,637,638],{},"含义",[77,640,641,651,661,672],{},[64,642,643,645,648],{},[82,644,287],{},[82,646,647],{},"460",[82,649,650],{},"移动国家码，460 = 中国",[64,652,653,655,658],{},[82,654,293],{},[82,656,657],{},"008",[82,659,660],{},"移动网络码，008 = 中国移动",[64,662,663,666,669],{},[82,664,665],{},"MMEGI",[82,667,668],{},"0361",[82,670,671],{},"MME 组标识",[64,673,674,677,680],{},[82,675,676],{},"MMEC",[82,678,679],{},"60",[82,681,682],{},"MME 码",[10,684,685],{},"这意味着这个流量包是中国移动的 4G 核心网信令。",[47,687,689],{"id":688},"step-2定位用户位置信息","Step 2：定位用户位置信息",[10,691,692],{},"题目说要找\"人员的定位信息\"。在 4G 核心网中，有几个地方会携带用户位置信息：",[694,695,696,710,722],"ol",{},[20,697,698,701,702,705,706,709],{},[85,699,700],{},"S1AP 层"," — ",[157,703,704],{"code":704},"InitialUEMessage"," 消息中的 ",[157,707,708],{"code":708},"EUTRAN_CGI"," 字段",[20,711,712,701,715,705,718,721],{},[85,713,714],{},"GTPv2-C 层",[157,716,717],{"code":717},"Create Session Request",[157,719,720],{"code":720},"ULI","（User Location Information，用户位置信息）",[20,723,724,701,727,730,731,734],{},[85,725,726],{},"Diameter 层",[157,728,729],{"code":729},"Update-Location-Request (ULR)"," 中的 ",[157,732,733],{"code":733},"EPS-Location-Information"," AVP",[10,736,737,738,740],{},"三条路都可以走，但最清晰的是 ",[85,739,726],{},"，因为它把完整的位置信息封装在标准 AVP 结构中。",[10,742,743,744,747,748,751],{},"在 Wireshark 过滤栏输入 ",[157,745,746],{"code":746},"diameter"," 过滤出所有 Diameter 流量。或者直接用 ",[157,749,750],{"code":750},"diameter.avp.code == 1602"," 过滤到最关键的那个 AVP。",[10,753,754,755,758],{},"在任意一个 Diameter 包中，找到 ",[157,756,757],{"code":757},"AVP: EPS-Location-Information (1496)","，展开后可以看到：",[150,760,763],{"className":761,"code":762,"language":155},[153],"AVP Code: 1496 EPS-Location-Information\n  AVP Flags: 0x80, Vendor-Specific: Set\n  AVP Length: 80\n  AVP Vendor Id: 3GPP (10415)\n  EPS-Location-Information\n      MME-Location-Information\n          AVP Code: 1600 MME-Location-Information\n          AVP Length: 68\n          AVP Vendor Id: 3GPP (10415)\n          MME-Location-Information\n              E-UTRAN-Cell-Global-Identity: 0ddb88fbbcca4f\n                  AVP Code: 1602 E-UTRAN-Cell-Global-Identity\n                  AVP Flags: 0x80, Vendor-Specific: Set\n                  AVP Length: 19\n                  AVP Vendor Id: 3GPP (10415)\n                  E-UTRAN-Cell-Global-Identity: 0ddb88fbbcca4f\n                  Padding: 00\n              Tracking-Area-Identity: 64f08099f4\n              Age-Of-Location-Information: 1\n",[157,764,762],{"__ignoreMap":159},[10,766,767],{},"关键字段逐一拆解：",[58,769,770,784],{},[61,771,772],{},[64,773,774,777,780,782],{},[67,775,776],{},"AVP Code",[67,778,779],{},"名称",[67,781,635],{},[67,783,638],{},[77,785,786,799,812,834,847],{},[64,787,788,791,793,796],{},[82,789,790],{},"1496",[82,792,733],{},[82,794,795],{},"-",[82,797,798],{},"封装 EPS 位置信息",[64,800,801,804,807,809],{},[82,802,803],{},"1600",[82,805,806],{},"MME-Location-Information",[82,808,795],{},[82,810,811],{},"封装 MME 级位置信息",[64,813,814,819,824,829],{},[82,815,816],{},[85,817,818],{},"1602",[82,820,821],{},[85,822,823],{},"E-UTRAN-Cell-Global-Identity",[82,825,826],{},[85,827,828],{},"0ddb88fbbcca4f",[82,830,831],{},[85,832,833],{},"ECGI，全球唯一基站扇区标识",[64,835,836,838,841,844],{},[82,837,795],{},[82,839,840],{},"Tracking-Area-Identity",[82,842,843],{},"64f08099f4",[82,845,846],{},"TAI（跟踪区标识）",[64,848,849,851,854,857],{},[82,850,795],{},[82,852,853],{},"Age-Of-Location-Information",[82,855,856],{},"1",[82,858,859],{},"位置信息已过去 1 分钟",[10,861,862,863,865],{},"ECGI 值就是 ",[157,864,828],{"code":828},"。",[10,867,868,869,871],{},"其中 TAI ",[157,870,843],{"code":843}," 可以进一步解析：",[150,873,876],{"className":874,"code":875,"language":155},[153],"TAI = TAC (2 bytes) + PLMN Identity (3 bytes)\n64f0 = TAC (Tracking Area Code) = 25840\n80 99 f4 → 解析 PLMN: MCC=460, MNC=099\n",[157,877,875],{"__ignoreMap":159},[10,879,880],{},"但本题只需要 ECGI，不需要关心 TAI 的还原。",[527,882,883],{},[10,884,885,886,889,890,893],{},"在 Wireshark 中，你可以右键点击任意 AVP 字段 → ",[157,887,888],{"code":888},"Copy → Value"," 直接复制字段值，也可以用 ",[157,891,892],{"code":892},"Apply as Filter → Selected"," 过滤所有包含相同 AVP 的数据包，非常好用。",[47,895,897],{"id":896},"step-3计算-flag","Step 3：计算 Flag",[10,899,900,901,903],{},"题目要求\"flag 为用户位置信息进行 32 位 MD5 哈希值\"，也就是对 ECGI 值 ",[157,902,828],{"code":828}," 进行 MD5 哈希。",[10,905,906],{},"Windows 系统上可以通过以下方式计算（PowerShell）：",[150,908,913],{"className":909,"code":911,"language":912,"meta":159},[910],"language-powershell","# PowerShell 方式\n$hash = [System.Security.Cryptography.MD5]::Create()\n$bytes = [System.Text.Encoding]::UTF8.GetBytes(\"0ddb88fbbcca4f\")\n$hashBytes = $hash.ComputeHash($bytes)\n$hashString = -join ($hashBytes | ForEach-Object { $_.ToString(\"x2\") })\nWrite-Output $hashString\n","powershell",[157,914,911],{"__ignoreMap":159},[10,916,917],{},"Linux \u002F macOS \u002F WSL 上：",[150,919,924],{"className":920,"code":922,"language":923,"meta":159},[921],"language-bash","echo -n \"0ddb88fbbcca4f\" | md5sum\n# 或\necho -n \"0ddb88fbbcca4f\" | openssl md5\n","bash",[157,925,922],{"__ignoreMap":159},[10,927,928],{},"结果：",[150,930,933],{"className":931,"code":932,"language":155},[153],"22226aba1d98c4302a6f508cad7da5d8\n",[157,934,932],{"__ignoreMap":159},[10,936,937],{},"这就是最终的 flag。",[527,939,940],{},[10,941,942,943,946,947,950,951,953,954,957],{},"注意：",[157,944,945],{"code":945},"echo -n"," 的 ",[157,948,949],{"code":949},"-n"," 参数很关键，它确保不会在字符串末尾自动添加换行符。如果不加 ",[157,952,949],{"code":949},"，相当于对 ",[157,955,956],{"code":956},"0ddb88fbbcca4f\\n"," 进行 MD5，结果会完全不一样。",[37,959],{},[40,961,963],{"id":962},"题目二冰蝎加密流量分析","题目二：冰蝎加密流量分析",[10,965,15,966],{},[24,967,34],{"href":34,"rel":968},[28],[47,970,525],{"id":971},"题目描述-1",[527,973,974],{},[10,975,976],{},"在一次网络安全的挑战中，你截获了一段神秘的冰蝎流量。据说这段流量中隐藏着重要的信息。你能解开这个谜团，找出隐藏在流量中的秘密吗？",[10,978,534,979,982],{},[157,980,981],{"code":981},"bx.pcapng","，大小约 60KB。",[47,984,986],{"id":985},"step-1修复损坏的-pcapng-文件","Step 1：修复损坏的 pcapng 文件",[10,988,989,990,992],{},"用 Wireshark 直接打开 ",[157,991,981],{"code":981},"，发现报错：",[150,994,997],{"className":995,"code":996,"language":155},[153],"The file \"bx.pcapng\" appears to be damaged or corrupt\n",[157,998,996],{"__ignoreMap":159},[10,1000,1001],{},"Wireshark 打不开，说明文件头有问题。遇到这种情况最常用的做法是用十六进制编辑器检查文件头。",[10,1003,1004,1005,1008],{},"这里用的是 ",[85,1006,1007],{},"010 Editor","，一款强大的十六进制编辑软件（也可以用免费的 HxD 或 Hex Fiend）。",[10,1010,1011,1012,1014],{},"打开 ",[157,1013,981],{"code":981},"，首先看到的是文件的前 16 个字节：",[150,1016,1019],{"className":1017,"code":1018,"language":155},[153],"0000h: 0A 0D 0D 0A 70 00 00 00 4D 3C 4A 01 00 00 00 FF\n0010h: FF FF FF FF FF FF FF FF 4C 00 00 31 74 46 88 20\n",[157,1020,1018],{"__ignoreMap":159},[10,1022,1023],{},"逐个字段对照 pcapng 的 Section Header Block 结构：",[58,1025,1026,1042],{},[61,1027,1028],{},[64,1029,1030,1033,1036,1039],{},[67,1031,1032],{},"偏移",[67,1034,1035],{},"实际值",[67,1037,1038],{},"期望值",[67,1040,1041],{},"判断",[77,1043,1044,1061,1077],{},[64,1045,1046,1049,1054,1058],{},[82,1047,1048],{},"0x00 (Block Type)",[82,1050,1051],{},[157,1052,1053],{"code":1053},"0A 0D 0D 0A",[82,1055,1056],{},[157,1057,1053],{"code":1053},[82,1059,1060],{},"✅ 正确",[64,1062,1063,1066,1071,1074],{},[82,1064,1065],{},"0x04 (Block Length)",[82,1067,1068],{},[157,1069,1070],{"code":1070},"70 00 00 00",[82,1072,1073],{},"0x00000070 = 112",[82,1075,1076],{},"✅ 合理",[64,1078,1079,1082,1087,1092],{},[82,1080,1081],{},"0x08 (Byte-Order Magic)",[82,1083,1084],{},[157,1085,1086],{"code":1086},"4D 3C 4A 01",[82,1088,1089,1091],{},[157,1090,491],{"code":491},"（小端）",[82,1093,1094],{},"❌ 错误！",[10,1096,1097,1098,1100,1101,1103,1104,1106,1107,1110],{},"0x08 位置的字节序魔数应该是小端序 ",[157,1099,491],{"code":491},"（大端序机器则是 ",[157,1102,485],{"code":485},"），但实际值是 ",[157,1105,1086],{"code":1086},"，其中 ",[157,1108,1109],{"code":1109},"4A 01"," 这个字段被损坏了。",[10,1112,1113,1114,1116,1117,1120],{},"修复方法：将 ",[157,1115,1109],{"code":1109}," 改为 ",[157,1118,1119],{"code":1119},"2B 1A","。在 010 Editor 中，直接在十六进制视图点击对应字节进行编辑。",[10,1122,1123],{},"修改后的文件头：",[150,1125,1128],{"className":1126,"code":1127,"language":155},[153],"0000h: 0A 0D 0D 0A 70 00 00 00 4D 3C 2B 1A 01 00 00 00\n",[157,1129,1127],{"__ignoreMap":159},[10,1131,1132,1133,1136],{},"保存为 ",[157,1134,1135],{"code":1135},"bx_fix.pcapng","，再用 Wireshark 打开，正常识别。",[527,1138,1139],{},[10,1140,1141,1142],{},"小技巧：如果你不确定怎么修复，可以找一个正常的 pcapng 文件对比前 16 个字节。或者直接去看 Wireshark 的 pcapng 规范文档：",[24,1143,1146],{"href":1144,"rel":1145},"https:\u002F\u002Fwww.ietf.org\u002Fstaging\u002Fdraft-ietf-opsawg-pcap-00.html",[28],"PCAP Next Generation Dump File Format",[47,1148,1150],{"id":1149},"step-2识别冰蝎流量","Step 2：识别冰蝎流量",[10,1152,1153,1154,1156,1157,1160],{},"用 Wireshark 打开修复后的 ",[157,1155,1135],{"code":1135},"，过滤器输入 ",[157,1158,1159],{"code":1159},"http","，看到多个 HTTP POST 请求。展开其中一个：",[150,1162,1165],{"className":1163,"code":1164,"language":155},[153],"POST \u002Fbx4.0\u002Faes.php HTTP\u002F1.1\nHost: 127.0.0.1\nUser-Agent: Mozilla\u002F5.0 (Windows NT 10.0; Win64; x64) ...\nContent-Type: application\u002Fx-www-form-urlencoded\nContent-Length: 3800\n\nm7nCS8n4OZG9akdDlxm6OdJevs\u002FjYQ5\u002FIcXK\u002FBRdpcFv7f8imFFv...\n",[157,1166,1164],{"__ignoreMap":159},[10,1168,1169],{},"从请求路径直接识别出几个关键信息：",[58,1171,1172,1181],{},[61,1173,1174],{},[64,1175,1176,1179],{},[67,1177,1178],{},"特征",[67,1180,638],{},[77,1182,1183,1200,1210,1220],{},[64,1184,1185,1190],{},[82,1186,1187],{},[157,1188,1189],{"code":1189},"\u002Fbx4.0\u002F",[82,1191,1192,1195,1196,1199],{},[85,1193,1194],{},"bx"," = Behinder（冰蝎），",[85,1197,1198],{},"4.0"," = 版本 4.0",[64,1201,1202,1207],{},[82,1203,1204],{},[157,1205,1206],{"code":1206},"aes.php",[82,1208,1209],{},"使用 AES 加密的 PHP Webshell",[64,1211,1212,1217],{},[82,1213,1214],{},[157,1215,1216],{"code":1216},"127.0.0.1",[82,1218,1219],{},"本机通信，说明攻击者在本机环境做测试",[64,1221,1222,1225],{},[82,1223,1224],{},"POST Body 为 Base64",[82,1226,1227],{},"冰蝎典型的加密传输特征",[10,1229,1230],{},"统计一下整个流量中的所有 HTTP 请求：",[10,1232,1233,1234,1237],{},"在 Wireshark 中，",[157,1235,1236],{"code":1236},"Statistics → HTTP → Requests"," 可以看到所有请求列表。或者用 tshark 命令行导出：",[150,1239,1242],{"className":1240,"code":1241,"language":923,"meta":159},[921],"tshark -r bx_fix.pcapng -Y \"http.request\" -T fields \\\n  -e http.request.method \\\n  -e http.request.uri \\\n  -e http.content_length\n",[157,1243,1241],{"__ignoreMap":159},[10,1245,1246],{},"去重后有三组不同长度的 POST Body：",[58,1248,1249,1262],{},[61,1250,1251],{},[64,1252,1253,1256,1259],{},[67,1254,1255],{},"编号",[67,1257,1258],{},"Content-Length",[67,1260,1261],{},"说明",[77,1263,1264,1274,1285],{},[64,1265,1266,1268,1271],{},[82,1267,856],{},[82,1269,1270],{},"3800",[82,1272,1273],{},"较短的请求",[64,1275,1276,1279,1282],{},[82,1277,1278],{},"2",[82,1280,1281],{},"6380",[82,1283,1284],{},"较长的请求",[64,1286,1287,1290,1293],{},[82,1288,1289],{},"3",[82,1291,1292],{},"4204",[82,1294,1295],{},"中等长度",[10,1297,1298],{},"这些全都是 Base64 编码的 AES 密文，需要破解冰蝎的加密密钥才能解密。",[47,1300,1302],{"id":1301},"step-3爆破冰蝎密钥","Step 3：爆破冰蝎密钥",[10,1304,1305],{},"冰蝎 v4.0 使用 AES-128-CBC 加密，密钥由密码通过 MD5 派生（取前 16 字节）。大多数使用者不会改默认密码，所以可以用默认密码字典进行爆破。",[10,1307,1308,1309,1314],{},"使用冰蝎专用的流量解密工具（如 ",[24,1310,1313],{"href":1311,"rel":1312},"https:\u002F\u002Fgithub.com\u002FArinue\u002FCTF-NetA",[28],"CTF-NetA"," 或冰蝎自带工具）：",[150,1316,1319],{"className":1317,"code":1318,"language":155},[153],"密钥派生流程：\n密码 \"rebeyond\" → MD5(\"rebeyond\") → e5e3529feb5d925b...（取前16字节）\n\n所以 AES 密钥 = e5e3529feb5d925b\n         IV = 密文 Base64 解码后的前 16 字节\n  实际密文 = IV 之后的部分\n",[157,1320,1318],{"__ignoreMap":159},[10,1322,1323],{},"爆破很快就得到结果：",[150,1325,1328],{"className":1326,"code":1327,"language":155},[153],"[2026-03-25 18:30:09] 开始爆破，线程数: 24\nFind Password: rebeyond\nAES key: e5e3529feb5d925b\nMessage:\n{\"status\":1,\"msg\":\"...\"}\n[2026-03-25 18:30:10] 爆破完成!\n",[157,1329,1327],{"__ignoreMap":159},[527,1331,1332,1335,1354],{},[10,1333,1334],{},"冰蝎各版本的默认密码：",[17,1336,1337,1343,1349],{},[20,1338,1339,1340,1342],{},"v2.x：",[157,1341,396],{"code":396}," → AES Key 为 MD5(password) 取前 16 位",[20,1344,1345,1346,1348],{},"v3.x：",[157,1347,396],{"code":396}," → AES Key 为 MD5(password) 取前 16 位，IV 随机",[20,1350,1351,1352,1348],{},"v4.x：",[157,1353,396],{"code":396},[10,1355,1356],{},"几乎没有人会在实际使用时修改默认密码...",[10,1358,1359],{},"用解密工具把全部流量解密后，得到 JSON 格式的通信内容：",[150,1361,1366],{"className":1362,"code":1364,"language":1365,"meta":159},[1363],"language-json","{\n  \"status\": 1,\n  \"msg\": \"base64编码的数据...\"\n}\n","json",[157,1367,1364],{"__ignoreMap":159},[10,1369,1370,1371,1374],{},"其中 ",[157,1372,1373],{"code":1373},"msg"," 字段内的 Base64 数据是冰蝎传输的实际内容（Shell 命令和回显）。",[47,1376,1378],{"id":1377},"step-4提取-flag","Step 4：提取 Flag",[10,1380,1381],{},"解密所有请求和响应后，按数据包大小（或 msg 字段长度）排序。数据量最少的那一条请求，其 msg 字段解码后就是 flag。",[10,1383,1384],{},"如果手动操作，流程如下：",[694,1386,1387,1390,1397,1403],{},[20,1388,1389],{},"先用工具将所有 HTTP 请求的 Body 字段提取出来",[20,1391,1392,1393,1396],{},"对每个 Body 用密钥 ",[157,1394,1395],{"code":1395},"e5e3529feb5d925b"," 进行 AES-128-CBC 解密（IV 取前 16 字节）",[20,1398,1399,1400,1402],{},"解密后得到 JSON，提取 ",[157,1401,1373],{"code":1373}," 字段，再进行一次 Base64 解码",[20,1404,1405],{},"对每个解码后的 msg 按长度排序，最特殊（最短或最长）的那个就是 flag",[10,1407,1408,1409,1412],{},"最终 flag 的格式类似：",[157,1410,1411],{"code":1411},"flag{xxxxxx}"," 或一串特殊字符串。",[527,1414,1415,1418],{},[10,1416,1417],{},"在做解密操作时，如果无法直接使用图形化工具，用 Python 脚本也很方便：",[150,1419,1424],{"className":1420,"code":1422,"language":1423,"meta":159},[1421],"language-python","from Crypto.Cipher import AES\nimport base64, hashlib\n\npassword = \"rebeyond\"\nkey = hashlib.md5(password.encode()).digest()[:16]\n\n# 对每一段密文\nciphertext = base64.b64decode(payload)\niv = ciphertext[:16]\ndata = ciphertext[16:]\ncipher = AES.new(key, AES.MODE_CBC, iv=iv)\nplain = cipher.decrypt(data)\n# 去掉 PKCS7 填充\npad_len = plain[-1]\nresult = plain[:-pad_len]\n","python",[157,1425,1422],{"__ignoreMap":159},[37,1427],{},[40,1429,1430],{"id":1430},"总结",[10,1432,1433],{},"两道题练下来，对流量分析这个方向有了更具体的认识。",[10,1435,1436,1439,1440,865],{},[85,1437,1438],{},"题目一","的难点在于知识门槛——如果不知道 4G 核心网的架构和 ECGI 的概念，打开 pcap 文件看到 SCTP、Diameter、GTPv2 这些协议时真的是一脸懵。但一旦知道了\"用户位置信息藏在 Diameter 的 EPS-Location-Information AVP 里\"这层关系，定位 flag 就是几分钟的事。这道题本质上考的是",[85,1441,1442],{},"对电信网络协议栈的认知",[10,1444,1445,1448,1449,1451,1452,1454],{},[85,1446,1447],{},"题目二","相对更贴近常规 CTF 套路——修文件头 → 识别特征 → 爆破密钥 → 解密提取。每个步骤单独拿出来都不算特别难，但组合起来需要有一定的耐心和工具链积累。关键点有两个：一是 pcapng 文件头的字节序魔数（0x08 处的 ",[157,1450,485],{"code":485},"）；二是冰蝎 v4.0 的默认密码 ",[157,1453,396],{"code":396}," 和 AES-128-CBC 加密模式。",[10,1456,1457],{},"流量分析这个方向，经验积累很重要。见得多了，下次再遇到类似的题就能快速定位关键字段，不会像第一次这样到处乱翻。",[37,1459],{},[527,1461,1462],{},[10,1463,1464],{},"作者：明久",{"title":159,"searchDepth":1466,"depth":1466,"links":1467},4,[1468,1484,1490,1497],{"id":42,"depth":1469,"text":42,"children":1470},2,[1471,1477],{"id":49,"depth":1472,"text":50,"children":1473},3,[1474,1475,1476],{"id":233,"depth":1466,"text":234},{"id":257,"depth":1466,"text":258},{"id":267,"depth":1466,"text":268},{"id":317,"depth":1472,"text":318,"children":1478},[1479,1480,1481,1482,1483],{"id":328,"depth":1466,"text":328},{"id":399,"depth":1466,"text":400},{"id":421,"depth":1466,"text":422},{"id":460,"depth":1466,"text":461},{"id":504,"depth":1466,"text":505},{"id":516,"depth":1469,"text":517,"children":1485},[1486,1487,1488,1489],{"id":525,"depth":1472,"text":525},{"id":541,"depth":1472,"text":542},{"id":688,"depth":1472,"text":689},{"id":896,"depth":1472,"text":897},{"id":962,"depth":1469,"text":963,"children":1491},[1492,1493,1494,1495,1496],{"id":971,"depth":1472,"text":525},{"id":985,"depth":1472,"text":986},{"id":1149,"depth":1472,"text":1150},{"id":1301,"depth":1472,"text":1302},{"id":1377,"depth":1472,"text":1378},{"id":1430,"depth":1469,"text":1430},[1499],"未分类","2026-08-10","网鼎杯流量分析，两道题分别是 4G 核心网信令分析和冰蝎加密流量解密",false,"md","\u002Fwangdingcup-cover.jpg",{"category":1506,"slots":1507},"安全",{},true,"\u002F2026\u002Fwangdingcup-traffic-analysis",null,{"text":1512,"minutes":1513,"time":1514,"words":1515},"20 min read",20.005,1200300,4001,{"title":5,"description":1501},{"loc":1509},"posts\u002F2026\u002Fwangdingcup-traffic-analysis",[],"tech","ORi3D71hPrMeL0IpirEDYe3pUh9AuoHlO3Cq_EL9CPA",[1523,1528],{"title":1524,"path":1525,"stem":1526,"date":1527,"type":1520,"children":-1},"启日月星博客搭建全记录与操作指南","\u002F2026\u002Fsite-build-guide","posts\u002F2026\u002Fsite-build-guide","2026-07-17T02:50:00",{"title":1529,"path":1530,"stem":1531,"date":1532,"type":1520,"children":-1},"流量分析两道题WP","\u002F2026\u002Fweek6-traffic-analysis","posts\u002F2026\u002Fweek6-traffic-analysis","2026-08-14",1790348237538]