一开始扫了一下端口，发现了30951端口，浏览器打开后没有什么特别的，然后就按照题目提示写了，跟以前做的一个叫秋名山神的题目很像，就拿python跑了一个
lao@laolao:~$ sudo nmap -sS -Pn -A 188.166.173.208 Host discovery disabled (-Pn). All addresses will be marked ‘up‘ and scan times will be slower. Starting Nmap 7.91 ( https://nmap.org ) at 2021-08-16 23:48 CST Nmap scan report for 188.166.173.208 Host is up (0.28s latency). Not shown: 908 filtered ports, 91 closed ports PORT STATE SERVICE VERSION 30951/tcp open http Apache httpd 2.4.41 ((Ubuntu)) |_http-title: HTB Academy Aggressive OS guesses: Linux 2.6.32 or 3.10 (90%), Synology DiskStation Manager 5.1 (89%), Linux 3.10 (89%), Linux 2.6.35 (89%), Linux 4.9 (89%), Linux 2.6.32 (89%), Linux 2.6.39 (89%), Linux 3.10 - 3.12 (89%), Linux 3.4 (89%), Linux 4.4 (89%)
脚本如下，好久没写了，有点手生，修修补补了蛮久的，中间注释掉的是多线程，开了10个线程跑，然后网站就崩了？后来发现不用多线程也行??
import threading import requests import re import hashlib def A(): while 1: s = requests.session() url = "http://188.166.173.208:32449/" r = s.post(url).text t = re.search("<h3 align=\\‘center\\‘>(.*?)</h3>",r).group(1) print(t) print(hashlib.md5(t.encode("utf-8")).hexdigest()) rq = s.post(url,data={"hash":hashlib.md5(t.encode("utf-8")).hexdigest()}).text if "Too slow!" not in rq: print(rq) else: print(">>"+t) if __name__ == ‘__main__‘: # q=[] # for i in range(1): # q.append(threading.Thread(target=A)) # for i in q: # i.start() A()
获得的答案如下：
KWwe9oo7EHAIVDO6mcs5 472ac57e01139823e7a798bfde363ac2 <html> <head> <title>emdee five for life</title> </head> <body style="background-color:powderblue;"> <h1 align=‘center‘>MD5 encrypt this string</h1><h3 align=‘center‘>KWwe9oo7EHAIVDO6mcs5</h3><p align=‘center‘>HTB{N1c3_ScrIpt1nG_B0i!}</p><center><form action="" method="post"> <input type="text" name="hash" placeholder="MD5" align=‘center‘></input> </br> <input type="submit" value="Submit"></input> </form></center> </body> </html> XUvIDeqjtFfo58G0rB6m 287cdc8bd200c2f0928b3c7a88a99280
原文：https://www.cnblogs.com/chrysanthemum/p/15150632.html