{"id":123670,"date":"2026-11-08T01:00:56","date_gmt":"2026-11-07T17:00:56","guid":{"rendered":"https:\/\/www.wsisp.com\/helps\/123670.html"},"modified":"2026-11-08T01:00:56","modified_gmt":"2026-11-07T17:00:56","slug":"%e9%93%b6%e7%8b%90%e6%9c%a8%e9%a9%ac-ctf-%e4%b8%bb%e8%a6%81%e7%9f%a5%e8%af%86%e7%82%b9%ef%bc%88%e7%b2%be%e7%ae%80%e7%89%88%ef%bc%89","status":"publish","type":"post","link":"https:\/\/www.wsisp.com\/helps\/123670.html","title":{"rendered":"\u94f6\u72d0\u6728\u9a6c CTF \u4e3b\u8981\u77e5\u8bc6\u70b9\uff08\u7cbe\u7b80\u7248\uff09"},"content":{"rendered":"<p>        \/* MD \/ \u5bcc\u6587\u672c\u4e2d\u7684 .toc\uff08\u542b\u535a\u5ba2\u56ed\u642c\u5bb6\u7b49\u5d4c\u5957\u7ed3\u6784\uff09\uff1b.toc-box \u5728\u4fa7\u680f\uff0c\u4e0d\u53d7\u5f71\u54cd *\/<br \/>\n        #content_views .toc,<br \/>\n        \/* \u7f16\u8f91\u5668\u5e38\u5728\u76ee\u5f55\u524d\u540e\u63d2\u5165\u7a7a p\uff08:empty \u4ecd\u5360 20px\uff09\uff0c\u4e00\u5e76\u53bb\u6389\u907f\u514d\u9876\u7a7a\u9699 *\/<br \/>\n        #content_views.markdown_views &gt; p:empty:has(+ .toc),<br \/>\n        #content_views.markdown_views &gt; .toc + p:empty,<br \/>\n        \/* \u5bcc\u6587\u672c\u65e7\u7248\u76ee\u5f55\u6807\u8bb0 *\/<br \/>\n        #content_views.htmledit_views #main-toc,<br \/>\n        #content_views.htmledit_views #hr-toc,<br \/>\n        #content_views.htmledit_views p[id*=\\&#8221;-toc\\&#8221;] {<br \/>\n          display: none !important;<br \/>\n        }<br \/>\n        \/* \u76ee\u5f55\u53bb\u6389\u540e\uff0c\u7d27\u8ddf\u7684\u9996\u4e2a\u6807\u9898\u4e0d\u518d\u591a\u51fa\u4e00\u5757\u4e0a\u8fb9\u8ddd *\/<br \/>\n        #content_views.markdown_views &gt; .toc + h1,<br \/>\n        #content_views.markdown_views &gt; .toc + h2,<br \/>\n        #content_views.markdown_views &gt; .toc + h3,<br \/>\n        #content_views.markdown_views &gt; .toc + h4,<br \/>\n        #content_views.markdown_views &gt; .toc + p:empty + h1,<br \/>\n        #content_views.markdown_views &gt; .toc + p:empty + h2,<br \/>\n        #content_views.markdown_views &gt; .toc + p:empty + h3,<br \/>\n        #content_views.markdown_views &gt; .toc + p:empty + h4 {<br \/>\n          margin-top: 0 !important;<br \/>\n        }<\/p>\n<h3>1. \u603b\u4f53\u5b9a\u4f4d<\/h3>\n<p>\u6458\u8981&#xff1a;\u672c\u6587\u68b3\u7406\u94f6\u72d0\u6728\u9a6c CTF \u7684\u6838\u5fc3\u8003\u70b9&#xff0c;\u56f4\u7ed5\u300c\u9493\u9c7c\u6295\u9012 \u2192 \u767d\u52a0\u9ed1\/\u975e PE \u8f7d\u8377 \u2192 \u5185\u5b58\u52a0\u8f7d \u2192 \u6301\u4e45\u5316 \u2192 C2 \u901a\u4fe1 \u2192 \u5bf9\u6297\u6e05\u7406\u300d\u7684\u5b8c\u6574\u653b\u51fb\u94fe\u5c55\u5f00&#xff0c;\u8986\u76d6\u9006\u5411\u5206\u6790&#xff08;\u53cd\u6c99\u7bb1\u95e8\u63a7\u3001\u52a0\u5bc6\u89e3\u5bc6\u3001\u767d\u52a0\u9ed1\u3001\u975e PE \u8f7d\u8377\u3001\u52a8\u6001\u89e3\u6790 API&#xff09;\u3001\u6d41\u91cf\u5206\u6790&#xff08;C2 \u4fe1\u9053\u3001\u5fc3\u8df3\u7279\u5f81\u3001\u7b80\u5355\u7f16\u7801\u3001\u9690\u853d\u901a\u4fe1\u8bc6\u522b&#xff09;\u3001\u9690\u5199\u4e0e\u53d6\u8bc1&#xff08;\u8f7d\u8377\u85cf\u533f\u4f4d\u7f6e\u3001&#034;\u589e\u80a5&#034;\u6218\u672f&#xff09;\u3001\u5e94\u6025\u54cd\u5e94\u4e0e\u65e5\u5fd7\u5206\u6790&#xff08;\u5080\u5121\u8ba1\u5212\u4efb\u52a1\u3001\u9690\u85cf\u6301\u4e45\u5316\u3001Rootkit\/BYOVD\u3001\u65e0\u6587\u4ef6\u9a7b\u7559\u3001\u5904\u7f6e\u5224\u636e&#xff09;\u4ee5\u53ca\u901a\u7528\u5224\u65ad\u539f\u5219&#xff0c;\u5e2e\u52a9\u8bfb\u8005\u5feb\u901f\u5efa\u7acb\u89e3\u9898\u601d\u8def\u4e0e\u6e05\u7406\u5b8c\u6574\u6027\u5224\u65ad\u6807\u51c6\u3002<\/p>\n<p>\u94f6\u72d0 CTF \u8003\u67e5\u7684\u4e0d\u662f\u5355\u4e00\u9759\u6001\u6837\u672c&#xff0c;\u800c\u662f\u4e00\u6761\u5b8c\u6574\u653b\u51fb\u94fe&#xff1a;<br \/>\n\u9493\u9c7c\u6295\u9012 \u2192 \u767d\u52a0\u9ed1\/\u975e PE \u8f7d\u8377 \u2192 \u5185\u5b58\u52a0\u8f7d \u2192 \u6301\u4e45\u5316 \u2192 C2 \u901a\u4fe1 \u2192 \u5bf9\u6297\u6e05\u7406<\/p>\n<p>\u6838\u5fc3\u7279\u5f81&#xff1a;<\/p>\n<ul>\n<li>\u514d\u6740\u8fed\u4ee3\u5feb<\/li>\n<li>\u591a\u5c42\u53cd\u5206\u6790<\/li>\n<li>\u767d\u52a0\u9ed1<\/li>\n<li>\u65e0\u6587\u4ef6\/\u975e PE \u8f7d\u8377<\/li>\n<li>\u5197\u4f59\u6301\u4e45\u5316<\/li>\n<li>Rootkit\/BYOVD \u5bf9\u6297<\/li>\n<\/ul>\n<p>\u9ad8\u9891\u9898\u578b&#xff1a;\u9006\u5411\u5206\u6790\u3001\u6d41\u91cf\u5206\u6790\u3001\u9690\u5199\u53d6\u8bc1\u3001\u5e94\u6025\u54cd\u5e94\u4e0e\u65e5\u5fd7\u5206\u6790\u3002<\/p>\n<p>\u4e0b\u9762\u7528\u4e00\u5f20\u6d41\u7a0b\u56fe\u6982\u62ec\u94f6\u72d0\u6728\u9a6c\u7684\u5b8c\u6574\u653b\u51fb\u94fe&#xff1a;<\/p>\n<p>#mermaid-svg-HcVXHQLlSjELkVc7{font-family:\\&#8221;trebuchet ms\\&#8221;,verdana,arial,sans-serif;font-size:16px;fill:#333;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#mermaid-svg-HcVXHQLlSjELkVc7 .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#mermaid-svg-HcVXHQLlSjELkVc7 .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#mermaid-svg-HcVXHQLlSjELkVc7 .error-icon{fill:#552222;}#mermaid-svg-HcVXHQLlSjELkVc7 .error-text{fill:#552222;stroke:#552222;}#mermaid-svg-HcVXHQLlSjELkVc7 .edge-thickness-normal{stroke-width:1px;}#mermaid-svg-HcVXHQLlSjELkVc7 .edge-thickness-thick{stroke-width:3.5px;}#mermaid-svg-HcVXHQLlSjELkVc7 .edge-pattern-solid{stroke-dasharray:0;}#mermaid-svg-HcVXHQLlSjELkVc7 .edge-thickness-invisible{stroke-width:0;fill:none;}#mermaid-svg-HcVXHQLlSjELkVc7 .edge-pattern-dashed{stroke-dasharray:3;}#mermaid-svg-HcVXHQLlSjELkVc7 .edge-pattern-dotted{stroke-dasharray:2;}#mermaid-svg-HcVXHQLlSjELkVc7 .marker{fill:#333333;stroke:#333333;}#mermaid-svg-HcVXHQLlSjELkVc7 .marker.cross{stroke:#333333;}#mermaid-svg-HcVXHQLlSjELkVc7 svg{font-family:\\&#8221;trebuchet ms\\&#8221;,verdana,arial,sans-serif;font-size:16px;}#mermaid-svg-HcVXHQLlSjELkVc7 p{margin:0;}#mermaid-svg-HcVXHQLlSjELkVc7 .label{font-family:\\&#8221;trebuchet ms\\&#8221;,verdana,arial,sans-serif;color:#333;}#mermaid-svg-HcVXHQLlSjELkVc7 .cluster-label text{fill:#333;}#mermaid-svg-HcVXHQLlSjELkVc7 .cluster-label span{color:#333;}#mermaid-svg-HcVXHQLlSjELkVc7 .cluster-label span p{background-color:transparent;}#mermaid-svg-HcVXHQLlSjELkVc7 .label text,#mermaid-svg-HcVXHQLlSjELkVc7 span{fill:#333;color:#333;}#mermaid-svg-HcVXHQLlSjELkVc7 .node rect,#mermaid-svg-HcVXHQLlSjELkVc7 .node circle,#mermaid-svg-HcVXHQLlSjELkVc7 .node ellipse,#mermaid-svg-HcVXHQLlSjELkVc7 .node polygon,#mermaid-svg-HcVXHQLlSjELkVc7 .node path{fill:#ECECFF;stroke:#9370DB;stroke-width:1px;}#mermaid-svg-HcVXHQLlSjELkVc7 .rough-node .label text,#mermaid-svg-HcVXHQLlSjELkVc7 .node .label text,#mermaid-svg-HcVXHQLlSjELkVc7 .image-shape .label,#mermaid-svg-HcVXHQLlSjELkVc7 .icon-shape .label{text-anchor:middle;}#mermaid-svg-HcVXHQLlSjELkVc7 .node .katex path{fill:#000;stroke:#000;stroke-width:1px;}#mermaid-svg-HcVXHQLlSjELkVc7 .rough-node .label,#mermaid-svg-HcVXHQLlSjELkVc7 .node .label,#mermaid-svg-HcVXHQLlSjELkVc7 .image-shape .label,#mermaid-svg-HcVXHQLlSjELkVc7 .icon-shape .label{text-align:center;}#mermaid-svg-HcVXHQLlSjELkVc7 .node.clickable{cursor:pointer;}#mermaid-svg-HcVXHQLlSjELkVc7 .root .anchor path{fill:#333333!important;stroke-width:0;stroke:#333333;}#mermaid-svg-HcVXHQLlSjELkVc7 .arrowheadPath{fill:#333333;}#mermaid-svg-HcVXHQLlSjELkVc7 .edgePath .path{stroke:#333333;stroke-width:2.0px;}#mermaid-svg-HcVXHQLlSjELkVc7 .flowchart-link{stroke:#333333;fill:none;}#mermaid-svg-HcVXHQLlSjELkVc7 .edgeLabel{background-color:rgba(232,232,232, 0.8);text-align:center;}#mermaid-svg-HcVXHQLlSjELkVc7 .edgeLabel p{background-color:rgba(232,232,232, 0.8);}#mermaid-svg-HcVXHQLlSjELkVc7 .edgeLabel rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#mermaid-svg-HcVXHQLlSjELkVc7 .labelBkg{background-color:rgba(232, 232, 232, 0.5);}#mermaid-svg-HcVXHQLlSjELkVc7 .cluster rect{fill:#ffffde;stroke:#aaaa33;stroke-width:1px;}#mermaid-svg-HcVXHQLlSjELkVc7 .cluster text{fill:#333;}#mermaid-svg-HcVXHQLlSjELkVc7 .cluster span{color:#333;}#mermaid-svg-HcVXHQLlSjELkVc7 div.mermaidTooltip{position:absolute;text-align:center;max-width:200px;padding:2px;font-family:\\&#8221;trebuchet ms\\&#8221;,verdana,arial,sans-serif;font-size:12px;background:hsl(80, 100%, 96.2745098039%);border:1px solid #aaaa33;border-radius:2px;pointer-events:none;z-index:100;}#mermaid-svg-HcVXHQLlSjELkVc7 .flowchartTitleText{text-anchor:middle;font-size:18px;fill:#333;}#mermaid-svg-HcVXHQLlSjELkVc7 rect.text{fill:none;stroke-width:0;}#mermaid-svg-HcVXHQLlSjELkVc7 .icon-shape,#mermaid-svg-HcVXHQLlSjELkVc7 .image-shape{background-color:rgba(232,232,232, 0.8);text-align:center;}#mermaid-svg-HcVXHQLlSjELkVc7 .icon-shape p,#mermaid-svg-HcVXHQLlSjELkVc7 .image-shape p{background-color:rgba(232,232,232, 0.8);padding:2px;}#mermaid-svg-HcVXHQLlSjELkVc7 .icon-shape .label rect,#mermaid-svg-HcVXHQLlSjELkVc7 .image-shape .label rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#mermaid-svg-HcVXHQLlSjELkVc7 .label-icon{display:inline-block;height:1em;overflow:visible;vertical-align:-0.125em;}#mermaid-svg-HcVXHQLlSjELkVc7 .node .label-icon path{fill:currentColor;stroke:revert;stroke-width:revert;}#mermaid-svg-HcVXHQLlSjELkVc7 :root{&#8211;mermaid-font-family:\\&#8221;trebuchet ms\\&#8221;,verdana,arial,sans-serif;}<span class=\"edgeLabel\"><\/span><span class=\"edgeLabel\"><\/span><span class=\"edgeLabel\"><\/span><span class=\"edgeLabel\"><\/span><span class=\"edgeLabel\"><\/span><span class=\"nodeLabel\"><\/p>\n<p>\u9493\u9c7c\u6295\u9012<\/p>\n<p><\/span><span class=\"nodeLabel\"><\/p>\n<p>\u767d\u52a0\u9ed1\/\u975e PE \u8f7d\u8377<\/p>\n<p><\/span><span class=\"nodeLabel\"><\/p>\n<p>\u5185\u5b58\u52a0\u8f7d<\/p>\n<p><\/span><span class=\"nodeLabel\"><\/p>\n<p>\u6301\u4e45\u5316<\/p>\n<p><\/span><span class=\"nodeLabel\"><\/p>\n<p>C2 \u901a\u4fe1<\/p>\n<p><\/span><span class=\"nodeLabel\"><\/p>\n<p>\u5bf9\u6297\u6e05\u7406<\/p>\n<p><\/span><\/p>\n<h3>2. \u9006\u5411\u5206\u6790<\/h3>\n<h4>2.1 \u53cd\u6c99\u7bb1\u95e8\u63a7<\/h4>\n<p>\u5e38\u89c1\u624b\u6bb5&#xff1a;CPUID\u3001RDTSC\u3001GPU-FPS\u3001\u5b89\u5168\u8f6f\u4ef6\u63a2\u6d4b\u3002<\/p>\n<p>\u8003\u70b9&#xff1a;\u5b9a\u4f4d\u95e8\u63a7\u7684\u6c47\u5408\u70b9\u5e76 patch\u3002<\/p>\n<h4>2.2 \u52a0\u5bc6\u89e3\u5bc6<\/h4>\n<p>\u5e38\u89c1\u7b97\u6cd5&#xff1a;XOR 0x36\u3001RC4 \u53d8\u4f53\u3001AES-ECB\u3001ChaCha20 &#043; LZNT1\u3001GPU shader\u3002<\/p>\n<p>\u8003\u70b9&#xff1a;\u8bc6\u522b Shellcode \u7279\u5f81\u5b57\u8282\u548c\u52a8\u6001\u51fd\u6570\u6307\u9488\u8c03\u7528\u3002<\/p>\n<h4>2.3 \u767d\u52a0\u9ed1<\/h4>\n<p>\u5408\u6cd5\u7b7e\u540d\u7a0b\u5e8f\u88ab PATCH&#xff08;\u5982 3 \u5b57\u8282 jmp&#xff09;&#xff0c;\u5165\u53e3\u4e0d\u5728\u5bfc\u5165\/\u5bfc\u51fa\u8868\u3002<\/p>\n<p>\u601d\u8def&#xff1a;\u5148\u5b9a\u4f4d\u300c\u767d\u300d\u6587\u4ef6\u4e2d\u7684\u5f02\u5e38\u8df3\u8f6c\u3002<\/p>\n<h4>2.4 \u975e PE \u8f7d\u8377<\/h4>\n<p>.oi\/.vc\/.ti\/.er \u7b49\u81ea\u5b9a\u4e49\u6587\u4ef6\u7531\u767d\u6587\u4ef6\u8bfb\u53d6\u89e3\u5bc6\u6267\u884c&#xff0c;\u78c1\u76d8\u65e0\u6076\u610f PE\u3002<\/p>\n<h4>2.5 \u52a8\u6001\u89e3\u6790 API<\/h4>\n<p>\u9759\u6001\u770b\u5230\u7684 API \u53ef\u80fd\u662f\u5047\u7684&#xff0c;\u9700\u52a8\u6001\u8c03\u8bd5\u786e\u8ba4\u3002<\/p>\n<p>\u9006\u5411\u5206\u6790\u7684\u6574\u4f53\u601d\u8def\u53ef\u5f52\u7eb3\u4e3a&#xff1a;<\/p>\n<p>#mermaid-svg-wz7WAT2Ew68M7CxU{font-family:\\&#8221;trebuchet ms\\&#8221;,verdana,arial,sans-serif;font-size:16px;fill:#333;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#mermaid-svg-wz7WAT2Ew68M7CxU .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#mermaid-svg-wz7WAT2Ew68M7CxU .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#mermaid-svg-wz7WAT2Ew68M7CxU .error-icon{fill:#552222;}#mermaid-svg-wz7WAT2Ew68M7CxU .error-text{fill:#552222;stroke:#552222;}#mermaid-svg-wz7WAT2Ew68M7CxU .edge-thickness-normal{stroke-width:1px;}#mermaid-svg-wz7WAT2Ew68M7CxU .edge-thickness-thick{stroke-width:3.5px;}#mermaid-svg-wz7WAT2Ew68M7CxU .edge-pattern-solid{stroke-dasharray:0;}#mermaid-svg-wz7WAT2Ew68M7CxU .edge-thickness-invisible{stroke-width:0;fill:none;}#mermaid-svg-wz7WAT2Ew68M7CxU .edge-pattern-dashed{stroke-dasharray:3;}#mermaid-svg-wz7WAT2Ew68M7CxU .edge-pattern-dotted{stroke-dasharray:2;}#mermaid-svg-wz7WAT2Ew68M7CxU .marker{fill:#333333;stroke:#333333;}#mermaid-svg-wz7WAT2Ew68M7CxU .marker.cross{stroke:#333333;}#mermaid-svg-wz7WAT2Ew68M7CxU svg{font-family:\\&#8221;trebuchet ms\\&#8221;,verdana,arial,sans-serif;font-size:16px;}#mermaid-svg-wz7WAT2Ew68M7CxU p{margin:0;}#mermaid-svg-wz7WAT2Ew68M7CxU .label{font-family:\\&#8221;trebuchet ms\\&#8221;,verdana,arial,sans-serif;color:#333;}#mermaid-svg-wz7WAT2Ew68M7CxU .cluster-label text{fill:#333;}#mermaid-svg-wz7WAT2Ew68M7CxU .cluster-label span{color:#333;}#mermaid-svg-wz7WAT2Ew68M7CxU .cluster-label span p{background-color:transparent;}#mermaid-svg-wz7WAT2Ew68M7CxU .label text,#mermaid-svg-wz7WAT2Ew68M7CxU span{fill:#333;color:#333;}#mermaid-svg-wz7WAT2Ew68M7CxU .node rect,#mermaid-svg-wz7WAT2Ew68M7CxU .node circle,#mermaid-svg-wz7WAT2Ew68M7CxU .node ellipse,#mermaid-svg-wz7WAT2Ew68M7CxU .node polygon,#mermaid-svg-wz7WAT2Ew68M7CxU .node path{fill:#ECECFF;stroke:#9370DB;stroke-width:1px;}#mermaid-svg-wz7WAT2Ew68M7CxU .rough-node .label text,#mermaid-svg-wz7WAT2Ew68M7CxU .node .label text,#mermaid-svg-wz7WAT2Ew68M7CxU .image-shape .label,#mermaid-svg-wz7WAT2Ew68M7CxU .icon-shape .label{text-anchor:middle;}#mermaid-svg-wz7WAT2Ew68M7CxU .node .katex path{fill:#000;stroke:#000;stroke-width:1px;}#mermaid-svg-wz7WAT2Ew68M7CxU .rough-node .label,#mermaid-svg-wz7WAT2Ew68M7CxU .node .label,#mermaid-svg-wz7WAT2Ew68M7CxU .image-shape .label,#mermaid-svg-wz7WAT2Ew68M7CxU .icon-shape .label{text-align:center;}#mermaid-svg-wz7WAT2Ew68M7CxU .node.clickable{cursor:pointer;}#mermaid-svg-wz7WAT2Ew68M7CxU .root .anchor path{fill:#333333!important;stroke-width:0;stroke:#333333;}#mermaid-svg-wz7WAT2Ew68M7CxU .arrowheadPath{fill:#333333;}#mermaid-svg-wz7WAT2Ew68M7CxU .edgePath .path{stroke:#333333;stroke-width:2.0px;}#mermaid-svg-wz7WAT2Ew68M7CxU .flowchart-link{stroke:#333333;fill:none;}#mermaid-svg-wz7WAT2Ew68M7CxU .edgeLabel{background-color:rgba(232,232,232, 0.8);text-align:center;}#mermaid-svg-wz7WAT2Ew68M7CxU .edgeLabel p{background-color:rgba(232,232,232, 0.8);}#mermaid-svg-wz7WAT2Ew68M7CxU .edgeLabel rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#mermaid-svg-wz7WAT2Ew68M7CxU .labelBkg{background-color:rgba(232, 232, 232, 0.5);}#mermaid-svg-wz7WAT2Ew68M7CxU .cluster rect{fill:#ffffde;stroke:#aaaa33;stroke-width:1px;}#mermaid-svg-wz7WAT2Ew68M7CxU .cluster text{fill:#333;}#mermaid-svg-wz7WAT2Ew68M7CxU .cluster span{color:#333;}#mermaid-svg-wz7WAT2Ew68M7CxU div.mermaidTooltip{position:absolute;text-align:center;max-width:200px;padding:2px;font-family:\\&#8221;trebuchet ms\\&#8221;,verdana,arial,sans-serif;font-size:12px;background:hsl(80, 100%, 96.2745098039%);border:1px solid #aaaa33;border-radius:2px;pointer-events:none;z-index:100;}#mermaid-svg-wz7WAT2Ew68M7CxU .flowchartTitleText{text-anchor:middle;font-size:18px;fill:#333;}#mermaid-svg-wz7WAT2Ew68M7CxU rect.text{fill:none;stroke-width:0;}#mermaid-svg-wz7WAT2Ew68M7CxU .icon-shape,#mermaid-svg-wz7WAT2Ew68M7CxU .image-shape{background-color:rgba(232,232,232, 0.8);text-align:center;}#mermaid-svg-wz7WAT2Ew68M7CxU .icon-shape p,#mermaid-svg-wz7WAT2Ew68M7CxU .image-shape p{background-color:rgba(232,232,232, 0.8);padding:2px;}#mermaid-svg-wz7WAT2Ew68M7CxU .icon-shape .label rect,#mermaid-svg-wz7WAT2Ew68M7CxU .image-shape .label rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#mermaid-svg-wz7WAT2Ew68M7CxU .label-icon{display:inline-block;height:1em;overflow:visible;vertical-align:-0.125em;}#mermaid-svg-wz7WAT2Ew68M7CxU .node .label-icon path{fill:currentColor;stroke:revert;stroke-width:revert;}#mermaid-svg-wz7WAT2Ew68M7CxU :root{&#8211;mermaid-font-family:\\&#8221;trebuchet ms\\&#8221;,verdana,arial,sans-serif;}<span class=\"edgeLabel\"><\/span><span class=\"edgeLabel\"><\/p>\n<p>\u662f<\/p>\n<p><\/span><span class=\"edgeLabel\"><\/p>\n<p>\u5426<\/p>\n<p><\/span><span class=\"edgeLabel\"><\/span><span class=\"edgeLabel\"><\/span><span class=\"edgeLabel\"><\/span><span class=\"edgeLabel\"><\/p>\n<p>\u662f<\/p>\n<p><\/span><span class=\"edgeLabel\"><\/p>\n<p>\u5426<\/p>\n<p><\/span><span class=\"edgeLabel\"><\/span><span class=\"edgeLabel\"><\/span><span class=\"nodeLabel\"><\/p>\n<p>\u62ff\u5230\u6837\u672c<\/p>\n<p><\/span><span class=\"nodeLabel\"><\/p>\n<p>\u662f\u5426\u4e3a\u767d\u52a0\u9ed1<\/p>\n<p><\/span><span class=\"nodeLabel\"><\/p>\n<p>\u5b9a\u4f4d\u767d\u6587\u4ef6\u5f02\u5e38\u8df3\u8f6c<\/p>\n<p><\/span><span class=\"nodeLabel\"><\/p>\n<p>\u76f4\u63a5\u5206\u6790\u8f7d\u8377<\/p>\n<p><\/span><span class=\"nodeLabel\"><\/p>\n<p>\u63d0\u53d6\u975e PE \u8f7d\u8377\u5e76\u89e3\u5bc6<\/p>\n<p><\/span><span class=\"nodeLabel\"><\/p>\n<p>\u662f\u5426\u5b58\u5728\u53cd\u6c99\u7bb1\u95e8\u63a7<\/p>\n<p><\/span><span class=\"nodeLabel\"><\/p>\n<p>\u5b9a\u4f4d\u6c47\u5408\u70b9\u5e76 patch<\/p>\n<p><\/span><span class=\"nodeLabel\"><\/p>\n<p>\u52a8\u6001\u8c03\u8bd5\u786e\u8ba4 API<\/p>\n<p><\/span><span class=\"nodeLabel\"><\/p>\n<p>\u8fd8\u539f Shellcode \u4e0e\u6267\u884c\u6d41<\/p>\n<p><\/span><\/p>\n<h3>3. \u6d41\u91cf\u5206\u6790<\/h3>\n<h4>3.1 C2 \u4fe1\u9053<\/h4>\n<p>\u5e38\u89c1\u4fe1\u9053&#xff1a;DoH\u3001WebSocket\u3001QUIC\u3001HTTP\/2 gRPC\u3002<\/p>\n<p>\u91cd\u70b9\u5173\u6ce8&#xff1a;TLS \u8bc1\u4e66\/SNI\u3001JA3\/JA4 \u6307\u7eb9\u3001\u901a\u4fe1\u65f6\u5e8f\u5468\u671f\u6027\u3001\u76ee\u7684\u5730\u5740\u4fe1\u8a89\u3002<\/p>\n<h4>3.2 \u5fc3\u8df3\u7279\u5f81<\/h4>\n<p>30\u201390 \u79d2\u4f4e\u4f53\u79ef HTTPS POST beacon&#xff0c;\u533a\u522b\u4e8e\u7a81\u53d1\u5927\u4f53\u79ef\u8f7d\u8377\u4e0b\u8f7d\u3002<\/p>\n<h4>3.3 \u7b80\u5355\u7f16\u7801<\/h4>\n<p>\u5982 (byte^0xfc&#043;0x31)&amp;0xff\u3001\u5355\u5b57\u8282 XOR\u3002<\/p>\n<p>\u5efa\u8bae\u5148\u5c1d\u8bd5\u7b80\u5355\u53d8\u6362&#xff0c;\u4e0d\u8981\u76f4\u63a5\u5047\u8bbe\u4e3a\u5f3a\u52a0\u5bc6\u3002<\/p>\n<h4>3.4 \u9690\u853d\u901a\u4fe1\u8bc6\u522b<\/h4>\n<ul>\n<li>DoH \u5185\u5c42\u57df\u540d\u5f02\u5e38<\/li>\n<li>\u8bf7\u6c42\u9891\u7387\/\u65f6\u5e8f\u4e0d\u5339\u914d<\/li>\n<li>\u4e91\u5b58\u50a8\u4e0b\u8f7d\u8def\u5f84\u968f\u673a\u6027<\/li>\n<\/ul>\n<p>\u6d41\u91cf\u5206\u6790\u53ef\u6309\u4ee5\u4e0b\u987a\u5e8f\u6392\u67e5&#xff1a;<\/p>\n<p>#mermaid-svg-pUgibZVkmDjbEiEj{font-family:\\&#8221;trebuchet ms\\&#8221;,verdana,arial,sans-serif;font-size:16px;fill:#333;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#mermaid-svg-pUgibZVkmDjbEiEj .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#mermaid-svg-pUgibZVkmDjbEiEj .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#mermaid-svg-pUgibZVkmDjbEiEj .error-icon{fill:#552222;}#mermaid-svg-pUgibZVkmDjbEiEj .error-text{fill:#552222;stroke:#552222;}#mermaid-svg-pUgibZVkmDjbEiEj .edge-thickness-normal{stroke-width:1px;}#mermaid-svg-pUgibZVkmDjbEiEj .edge-thickness-thick{stroke-width:3.5px;}#mermaid-svg-pUgibZVkmDjbEiEj .edge-pattern-solid{stroke-dasharray:0;}#mermaid-svg-pUgibZVkmDjbEiEj .edge-thickness-invisible{stroke-width:0;fill:none;}#mermaid-svg-pUgibZVkmDjbEiEj .edge-pattern-dashed{stroke-dasharray:3;}#mermaid-svg-pUgibZVkmDjbEiEj .edge-pattern-dotted{stroke-dasharray:2;}#mermaid-svg-pUgibZVkmDjbEiEj .marker{fill:#333333;stroke:#333333;}#mermaid-svg-pUgibZVkmDjbEiEj .marker.cross{stroke:#333333;}#mermaid-svg-pUgibZVkmDjbEiEj svg{font-family:\\&#8221;trebuchet ms\\&#8221;,verdana,arial,sans-serif;font-size:16px;}#mermaid-svg-pUgibZVkmDjbEiEj p{margin:0;}#mermaid-svg-pUgibZVkmDjbEiEj .label{font-family:\\&#8221;trebuchet ms\\&#8221;,verdana,arial,sans-serif;color:#333;}#mermaid-svg-pUgibZVkmDjbEiEj .cluster-label text{fill:#333;}#mermaid-svg-pUgibZVkmDjbEiEj .cluster-label span{color:#333;}#mermaid-svg-pUgibZVkmDjbEiEj .cluster-label span p{background-color:transparent;}#mermaid-svg-pUgibZVkmDjbEiEj .label text,#mermaid-svg-pUgibZVkmDjbEiEj span{fill:#333;color:#333;}#mermaid-svg-pUgibZVkmDjbEiEj .node rect,#mermaid-svg-pUgibZVkmDjbEiEj .node circle,#mermaid-svg-pUgibZVkmDjbEiEj .node ellipse,#mermaid-svg-pUgibZVkmDjbEiEj .node polygon,#mermaid-svg-pUgibZVkmDjbEiEj .node path{fill:#ECECFF;stroke:#9370DB;stroke-width:1px;}#mermaid-svg-pUgibZVkmDjbEiEj .rough-node .label text,#mermaid-svg-pUgibZVkmDjbEiEj .node .label text,#mermaid-svg-pUgibZVkmDjbEiEj .image-shape .label,#mermaid-svg-pUgibZVkmDjbEiEj .icon-shape .label{text-anchor:middle;}#mermaid-svg-pUgibZVkmDjbEiEj .node .katex path{fill:#000;stroke:#000;stroke-width:1px;}#mermaid-svg-pUgibZVkmDjbEiEj .rough-node .label,#mermaid-svg-pUgibZVkmDjbEiEj .node .label,#mermaid-svg-pUgibZVkmDjbEiEj .image-shape .label,#mermaid-svg-pUgibZVkmDjbEiEj .icon-shape .label{text-align:center;}#mermaid-svg-pUgibZVkmDjbEiEj .node.clickable{cursor:pointer;}#mermaid-svg-pUgibZVkmDjbEiEj .root .anchor path{fill:#333333!important;stroke-width:0;stroke:#333333;}#mermaid-svg-pUgibZVkmDjbEiEj .arrowheadPath{fill:#333333;}#mermaid-svg-pUgibZVkmDjbEiEj .edgePath .path{stroke:#333333;stroke-width:2.0px;}#mermaid-svg-pUgibZVkmDjbEiEj .flowchart-link{stroke:#333333;fill:none;}#mermaid-svg-pUgibZVkmDjbEiEj .edgeLabel{background-color:rgba(232,232,232, 0.8);text-align:center;}#mermaid-svg-pUgibZVkmDjbEiEj .edgeLabel p{background-color:rgba(232,232,232, 0.8);}#mermaid-svg-pUgibZVkmDjbEiEj .edgeLabel rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#mermaid-svg-pUgibZVkmDjbEiEj .labelBkg{background-color:rgba(232, 232, 232, 0.5);}#mermaid-svg-pUgibZVkmDjbEiEj .cluster rect{fill:#ffffde;stroke:#aaaa33;stroke-width:1px;}#mermaid-svg-pUgibZVkmDjbEiEj .cluster text{fill:#333;}#mermaid-svg-pUgibZVkmDjbEiEj .cluster span{color:#333;}#mermaid-svg-pUgibZVkmDjbEiEj div.mermaidTooltip{position:absolute;text-align:center;max-width:200px;padding:2px;font-family:\\&#8221;trebuchet ms\\&#8221;,verdana,arial,sans-serif;font-size:12px;background:hsl(80, 100%, 96.2745098039%);border:1px solid #aaaa33;border-radius:2px;pointer-events:none;z-index:100;}#mermaid-svg-pUgibZVkmDjbEiEj .flowchartTitleText{text-anchor:middle;font-size:18px;fill:#333;}#mermaid-svg-pUgibZVkmDjbEiEj rect.text{fill:none;stroke-width:0;}#mermaid-svg-pUgibZVkmDjbEiEj .icon-shape,#mermaid-svg-pUgibZVkmDjbEiEj .image-shape{background-color:rgba(232,232,232, 0.8);text-align:center;}#mermaid-svg-pUgibZVkmDjbEiEj .icon-shape p,#mermaid-svg-pUgibZVkmDjbEiEj .image-shape p{background-color:rgba(232,232,232, 0.8);padding:2px;}#mermaid-svg-pUgibZVkmDjbEiEj .icon-shape .label rect,#mermaid-svg-pUgibZVkmDjbEiEj .image-shape .label rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#mermaid-svg-pUgibZVkmDjbEiEj .label-icon{display:inline-block;height:1em;overflow:visible;vertical-align:-0.125em;}#mermaid-svg-pUgibZVkmDjbEiEj .node .label-icon path{fill:currentColor;stroke:revert;stroke-width:revert;}#mermaid-svg-pUgibZVkmDjbEiEj :root{&#8211;mermaid-font-family:\\&#8221;trebuchet ms\\&#8221;,verdana,arial,sans-serif;}<span class=\"edgeLabel\"><\/span><span class=\"edgeLabel\"><\/span><span class=\"edgeLabel\"><\/span><span class=\"edgeLabel\"><\/p>\n<p>\u662f<\/p>\n<p><\/span><span class=\"edgeLabel\"><\/p>\n<p>\u5426<\/p>\n<p><\/span><span class=\"edgeLabel\"><\/span><span class=\"edgeLabel\"><\/span><span class=\"edgeLabel\"><\/span><span class=\"nodeLabel\"><\/p>\n<p>\u6293\u5305\/\u6d41\u91cf\u65e5\u5fd7<\/p>\n<p><\/span><span class=\"nodeLabel\"><\/p>\n<p>\u7b5b\u9009 TLS \u8bc1\u4e66\u4e0e SNI<\/p>\n<p><\/span><span class=\"nodeLabel\"><\/p>\n<p>\u8ba1\u7b97 JA3\/JA4 \u6307\u7eb9<\/p>\n<p><\/span><span class=\"nodeLabel\"><\/p>\n<p>\u662f\u5426\u5b58\u5728\u5468\u671f\u6027\u5c0f\u4f53\u79ef POST<\/p>\n<p><\/span><span class=\"nodeLabel\"><\/p>\n<p>\u5224\u5b9a\u4e3a\u5fc3\u8df3 beacon<\/p>\n<p><\/span><span class=\"nodeLabel\"><\/p>\n<p>\u6392\u67e5 DoH\/WebSocket\/QUIC \u4fe1\u9053<\/p>\n<p><\/span><span class=\"nodeLabel\"><\/p>\n<p>\u5c1d\u8bd5\u7b80\u5355\u7f16\u7801\u8fd8\u539f<\/p>\n<p><\/span><span class=\"nodeLabel\"><\/p>\n<p>\u5b9a\u4f4d C2 \u4e0e\u8f7d\u8377\u4e0b\u8f7d\u5730\u5740<\/p>\n<p><\/span><\/p>\n<h3>4. \u9690\u5199\u4e0e\u53d6\u8bc1<\/h3>\n<h4>4.1 \u8f7d\u8377\u85cf\u533f\u4f4d\u7f6e<\/h4>\n<p>PNG \u50cf\u7d20\u6570\u636e\u3001.pyc \u5f02\u5e38\u5b57\u8282\u7801\u3001HFEX \u5bb9\u5668\u3001\u5927 PE \u5c3e\u90e8 overlay\/\u9ad8\u71b5\u533a\u57df\u3002<\/p>\n<h4>4.2 &#034;\u589e\u80a5&#034;\u6218\u672f<\/h4>\n<p>\u5728\u5927\u6587\u4ef6\u4e2d\u6df7\u5165\u5c0f\u8f7d\u8377&#xff0c;\u4ee5\u7a00\u91ca YARA \u7279\u5f81\u3001\u5e72\u6270 strings \u63d0\u53d6\u3001\u7ed5\u8fc7\u6c99\u7bb1\u7684\u6587\u4ef6\u5927\u5c0f\u9650\u5236\u3002<\/p>\n<h4>4.3 \u8003\u70b9<\/h4>\n<p>\u78c1\u76d8\u65e0\u6076\u610f PE \u65f6&#xff0c;\u4ece\u5185\u5b58\u8f6c\u50a8\u3001\u56fe\u50cf\u71b5\u5f02\u5e38\u3001\u975e\u6807\u51c6\u6587\u4ef6\u7ed3\u6784\u4e2d\u63d0\u53d6 Stage-2\u3002<\/p>\n<p>\u9690\u5199\u4e0e\u53d6\u8bc1\u7684\u63d0\u53d6\u8def\u5f84\u5982\u4e0b&#xff1a;<\/p>\n<p>#mermaid-svg-vCrxiAKGZEgn8ZCc{font-family:\\&#8221;trebuchet ms\\&#8221;,verdana,arial,sans-serif;font-size:16px;fill:#333;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#mermaid-svg-vCrxiAKGZEgn8ZCc .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#mermaid-svg-vCrxiAKGZEgn8ZCc .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#mermaid-svg-vCrxiAKGZEgn8ZCc .error-icon{fill:#552222;}#mermaid-svg-vCrxiAKGZEgn8ZCc .error-text{fill:#552222;stroke:#552222;}#mermaid-svg-vCrxiAKGZEgn8ZCc .edge-thickness-normal{stroke-width:1px;}#mermaid-svg-vCrxiAKGZEgn8ZCc .edge-thickness-thick{stroke-width:3.5px;}#mermaid-svg-vCrxiAKGZEgn8ZCc .edge-pattern-solid{stroke-dasharray:0;}#mermaid-svg-vCrxiAKGZEgn8ZCc .edge-thickness-invisible{stroke-width:0;fill:none;}#mermaid-svg-vCrxiAKGZEgn8ZCc .edge-pattern-dashed{stroke-dasharray:3;}#mermaid-svg-vCrxiAKGZEgn8ZCc .edge-pattern-dotted{stroke-dasharray:2;}#mermaid-svg-vCrxiAKGZEgn8ZCc .marker{fill:#333333;stroke:#333333;}#mermaid-svg-vCrxiAKGZEgn8ZCc .marker.cross{stroke:#333333;}#mermaid-svg-vCrxiAKGZEgn8ZCc svg{font-family:\\&#8221;trebuchet ms\\&#8221;,verdana,arial,sans-serif;font-size:16px;}#mermaid-svg-vCrxiAKGZEgn8ZCc p{margin:0;}#mermaid-svg-vCrxiAKGZEgn8ZCc .label{font-family:\\&#8221;trebuchet ms\\&#8221;,verdana,arial,sans-serif;color:#333;}#mermaid-svg-vCrxiAKGZEgn8ZCc .cluster-label text{fill:#333;}#mermaid-svg-vCrxiAKGZEgn8ZCc .cluster-label span{color:#333;}#mermaid-svg-vCrxiAKGZEgn8ZCc .cluster-label span p{background-color:transparent;}#mermaid-svg-vCrxiAKGZEgn8ZCc .label text,#mermaid-svg-vCrxiAKGZEgn8ZCc span{fill:#333;color:#333;}#mermaid-svg-vCrxiAKGZEgn8ZCc .node rect,#mermaid-svg-vCrxiAKGZEgn8ZCc .node circle,#mermaid-svg-vCrxiAKGZEgn8ZCc .node ellipse,#mermaid-svg-vCrxiAKGZEgn8ZCc .node polygon,#mermaid-svg-vCrxiAKGZEgn8ZCc .node path{fill:#ECECFF;stroke:#9370DB;stroke-width:1px;}#mermaid-svg-vCrxiAKGZEgn8ZCc .rough-node .label text,#mermaid-svg-vCrxiAKGZEgn8ZCc .node .label text,#mermaid-svg-vCrxiAKGZEgn8ZCc .image-shape .label,#mermaid-svg-vCrxiAKGZEgn8ZCc .icon-shape .label{text-anchor:middle;}#mermaid-svg-vCrxiAKGZEgn8ZCc .node .katex path{fill:#000;stroke:#000;stroke-width:1px;}#mermaid-svg-vCrxiAKGZEgn8ZCc .rough-node .label,#mermaid-svg-vCrxiAKGZEgn8ZCc .node .label,#mermaid-svg-vCrxiAKGZEgn8ZCc .image-shape .label,#mermaid-svg-vCrxiAKGZEgn8ZCc .icon-shape .label{text-align:center;}#mermaid-svg-vCrxiAKGZEgn8ZCc .node.clickable{cursor:pointer;}#mermaid-svg-vCrxiAKGZEgn8ZCc .root .anchor path{fill:#333333!important;stroke-width:0;stroke:#333333;}#mermaid-svg-vCrxiAKGZEgn8ZCc .arrowheadPath{fill:#333333;}#mermaid-svg-vCrxiAKGZEgn8ZCc .edgePath .path{stroke:#333333;stroke-width:2.0px;}#mermaid-svg-vCrxiAKGZEgn8ZCc .flowchart-link{stroke:#333333;fill:none;}#mermaid-svg-vCrxiAKGZEgn8ZCc .edgeLabel{background-color:rgba(232,232,232, 0.8);text-align:center;}#mermaid-svg-vCrxiAKGZEgn8ZCc .edgeLabel p{background-color:rgba(232,232,232, 0.8);}#mermaid-svg-vCrxiAKGZEgn8ZCc .edgeLabel rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#mermaid-svg-vCrxiAKGZEgn8ZCc .labelBkg{background-color:rgba(232, 232, 232, 0.5);}#mermaid-svg-vCrxiAKGZEgn8ZCc .cluster rect{fill:#ffffde;stroke:#aaaa33;stroke-width:1px;}#mermaid-svg-vCrxiAKGZEgn8ZCc .cluster text{fill:#333;}#mermaid-svg-vCrxiAKGZEgn8ZCc .cluster span{color:#333;}#mermaid-svg-vCrxiAKGZEgn8ZCc div.mermaidTooltip{position:absolute;text-align:center;max-width:200px;padding:2px;font-family:\\&#8221;trebuchet ms\\&#8221;,verdana,arial,sans-serif;font-size:12px;background:hsl(80, 100%, 96.2745098039%);border:1px solid #aaaa33;border-radius:2px;pointer-events:none;z-index:100;}#mermaid-svg-vCrxiAKGZEgn8ZCc .flowchartTitleText{text-anchor:middle;font-size:18px;fill:#333;}#mermaid-svg-vCrxiAKGZEgn8ZCc rect.text{fill:none;stroke-width:0;}#mermaid-svg-vCrxiAKGZEgn8ZCc .icon-shape,#mermaid-svg-vCrxiAKGZEgn8ZCc .image-shape{background-color:rgba(232,232,232, 0.8);text-align:center;}#mermaid-svg-vCrxiAKGZEgn8ZCc .icon-shape p,#mermaid-svg-vCrxiAKGZEgn8ZCc .image-shape p{background-color:rgba(232,232,232, 0.8);padding:2px;}#mermaid-svg-vCrxiAKGZEgn8ZCc .icon-shape .label rect,#mermaid-svg-vCrxiAKGZEgn8ZCc .image-shape .label rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#mermaid-svg-vCrxiAKGZEgn8ZCc .label-icon{display:inline-block;height:1em;overflow:visible;vertical-align:-0.125em;}#mermaid-svg-vCrxiAKGZEgn8ZCc .node .label-icon path{fill:currentColor;stroke:revert;stroke-width:revert;}#mermaid-svg-vCrxiAKGZEgn8ZCc :root{&#8211;mermaid-font-family:\\&#8221;trebuchet ms\\&#8221;,verdana,arial,sans-serif;}<span class=\"edgeLabel\"><\/span><span class=\"edgeLabel\"><\/span><span class=\"edgeLabel\"><\/span><span class=\"edgeLabel\"><\/span><span class=\"edgeLabel\"><\/span><span class=\"edgeLabel\"><\/span><span class=\"edgeLabel\"><\/span><span class=\"nodeLabel\"><\/p>\n<p>\u78c1\u76d8\u65e0\u6076\u610f PE<\/p>\n<p><\/span><span class=\"nodeLabel\"><\/p>\n<p>\u5185\u5b58\u8f6c\u50a8<\/p>\n<p><\/span><span class=\"nodeLabel\"><\/p>\n<p>\u56fe\u50cf\u71b5\u5f02\u5e38\u68c0\u6d4b<\/p>\n<p><\/span><span class=\"nodeLabel\"><\/p>\n<p>\u975e\u6807\u51c6\u6587\u4ef6\u7ed3\u6784\u89e3\u6790<\/p>\n<p><\/span><span class=\"nodeLabel\"><\/p>\n<p>\u63d0\u53d6 Stage-2<\/p>\n<p><\/span><span class=\"nodeLabel\"><\/p>\n<p>\u9a8c\u8bc1\u8f7d\u8377\u53ef\u6267\u884c\u6027<\/p>\n<p><\/span><\/p>\n<h3>5. \u5e94\u6025\u54cd\u5e94\u4e0e\u65e5\u5fd7\u5206\u6790<\/h3>\n<h4>5.1 \u5080\u5121\u8ba1\u5212\u4efb\u52a1<\/h4>\n<p>\u4e34\u65f6\u4efb\u52a1\u6267\u884c\u540e\u81ea\u5220&#xff0c;\u6bcd\u4f53\/\u770b\u95e8\u72d7\u4f1a\u91cd\u65b0\u62c9\u8d77\u8fdb\u7a0b\u3002<\/p>\n<p>\u5904\u7f6e\u987a\u5e8f&#xff1a;\u5148\u5207\u65ad\u6bcd\u4f53&#xff0c;\u518d\u6e05\u6301\u4e45\u5316\u3002<\/p>\n<h4>5.2 \u9690\u85cf\u6301\u4e45\u5316<\/h4>\n<p>\u6ce8\u518c\u8868\u952e\u503c\u4fee\u6539\u4f7f\u5e38\u89c4 API \u65e0\u6cd5\u679a\u4e3e\u5220\u9664&#xff0c;\u9700\u5b8c\u6574\u5b9a\u4f4d\u6240\u6709\u8f7d\u4f53\u3002<\/p>\n<h4>5.3 Rootkit\/BYOVD<\/h4>\n<p>Nidhogg \u7b49 Rootkit \u62e6\u622a\u8fdb\u7a0b\u5173\u95ed&#xff1b;BYOVD \u63d0\u6743\u5173\u6740\u8f6f&#xff1b;\u5185\u6838\u547d\u540d\u7ba1\u9053\u901a\u4fe1\u3002<\/p>\n<h4>5.4 \u65e0\u6587\u4ef6\u9a7b\u7559<\/h4>\n<p>MSI CustomAction \u5d4c\u5165 DLL\u3001\u53cd\u5c04\u5f0f\u52a0\u8f7d\u3001\u4e34\u65f6\u670d\u52a1\u81ea\u6bc1&#xff1b;\u78c1\u76d8\u65e0 PE&#xff0c;\u4f46\u4ecd\u6709\u5916\u8fde\u3002<\/p>\n<h4>5.5 \u5904\u7f6e\u5224\u636e<\/h4>\n<p>\u4e0d\u662f\u201c\u5220\u4e86\u67d0\u4e2a\u6587\u4ef6\/\u65ad\u4e86\u5f53\u524d\u8fde\u63a5\u201d&#xff0c;\u800c\u662f\u6240\u6709\u52a0\u8f7d\u9636\u6bb5\u3001\u6301\u4e45\u5316\u8f7d\u4f53\u3001C2 \u901a\u9053\u548c fallback \u5747\u88ab\u5207\u65ad\u3002<\/p>\n<p>\u5e94\u6025\u54cd\u5e94\u7684\u5904\u7f6e\u6d41\u7a0b\u5efa\u8bae\u5982\u4e0b&#xff1a;<\/p>\n<p>#mermaid-svg-zN7McS5aVFXowxKY{font-family:\\&#8221;trebuchet ms\\&#8221;,verdana,arial,sans-serif;font-size:16px;fill:#333;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#mermaid-svg-zN7McS5aVFXowxKY .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#mermaid-svg-zN7McS5aVFXowxKY .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#mermaid-svg-zN7McS5aVFXowxKY .error-icon{fill:#552222;}#mermaid-svg-zN7McS5aVFXowxKY .error-text{fill:#552222;stroke:#552222;}#mermaid-svg-zN7McS5aVFXowxKY .edge-thickness-normal{stroke-width:1px;}#mermaid-svg-zN7McS5aVFXowxKY .edge-thickness-thick{stroke-width:3.5px;}#mermaid-svg-zN7McS5aVFXowxKY .edge-pattern-solid{stroke-dasharray:0;}#mermaid-svg-zN7McS5aVFXowxKY .edge-thickness-invisible{stroke-width:0;fill:none;}#mermaid-svg-zN7McS5aVFXowxKY .edge-pattern-dashed{stroke-dasharray:3;}#mermaid-svg-zN7McS5aVFXowxKY .edge-pattern-dotted{stroke-dasharray:2;}#mermaid-svg-zN7McS5aVFXowxKY .marker{fill:#333333;stroke:#333333;}#mermaid-svg-zN7McS5aVFXowxKY .marker.cross{stroke:#333333;}#mermaid-svg-zN7McS5aVFXowxKY svg{font-family:\\&#8221;trebuchet ms\\&#8221;,verdana,arial,sans-serif;font-size:16px;}#mermaid-svg-zN7McS5aVFXowxKY p{margin:0;}#mermaid-svg-zN7McS5aVFXowxKY .label{font-family:\\&#8221;trebuchet ms\\&#8221;,verdana,arial,sans-serif;color:#333;}#mermaid-svg-zN7McS5aVFXowxKY .cluster-label text{fill:#333;}#mermaid-svg-zN7McS5aVFXowxKY .cluster-label span{color:#333;}#mermaid-svg-zN7McS5aVFXowxKY .cluster-label span p{background-color:transparent;}#mermaid-svg-zN7McS5aVFXowxKY .label text,#mermaid-svg-zN7McS5aVFXowxKY span{fill:#333;color:#333;}#mermaid-svg-zN7McS5aVFXowxKY .node rect,#mermaid-svg-zN7McS5aVFXowxKY .node circle,#mermaid-svg-zN7McS5aVFXowxKY .node ellipse,#mermaid-svg-zN7McS5aVFXowxKY .node polygon,#mermaid-svg-zN7McS5aVFXowxKY .node path{fill:#ECECFF;stroke:#9370DB;stroke-width:1px;}#mermaid-svg-zN7McS5aVFXowxKY .rough-node .label text,#mermaid-svg-zN7McS5aVFXowxKY .node .label text,#mermaid-svg-zN7McS5aVFXowxKY .image-shape .label,#mermaid-svg-zN7McS5aVFXowxKY .icon-shape .label{text-anchor:middle;}#mermaid-svg-zN7McS5aVFXowxKY .node .katex path{fill:#000;stroke:#000;stroke-width:1px;}#mermaid-svg-zN7McS5aVFXowxKY .rough-node .label,#mermaid-svg-zN7McS5aVFXowxKY .node .label,#mermaid-svg-zN7McS5aVFXowxKY .image-shape .label,#mermaid-svg-zN7McS5aVFXowxKY .icon-shape .label{text-align:center;}#mermaid-svg-zN7McS5aVFXowxKY .node.clickable{cursor:pointer;}#mermaid-svg-zN7McS5aVFXowxKY .root .anchor path{fill:#333333!important;stroke-width:0;stroke:#333333;}#mermaid-svg-zN7McS5aVFXowxKY .arrowheadPath{fill:#333333;}#mermaid-svg-zN7McS5aVFXowxKY .edgePath .path{stroke:#333333;stroke-width:2.0px;}#mermaid-svg-zN7McS5aVFXowxKY .flowchart-link{stroke:#333333;fill:none;}#mermaid-svg-zN7McS5aVFXowxKY .edgeLabel{background-color:rgba(232,232,232, 0.8);text-align:center;}#mermaid-svg-zN7McS5aVFXowxKY .edgeLabel p{background-color:rgba(232,232,232, 0.8);}#mermaid-svg-zN7McS5aVFXowxKY .edgeLabel rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#mermaid-svg-zN7McS5aVFXowxKY .labelBkg{background-color:rgba(232, 232, 232, 0.5);}#mermaid-svg-zN7McS5aVFXowxKY .cluster rect{fill:#ffffde;stroke:#aaaa33;stroke-width:1px;}#mermaid-svg-zN7McS5aVFXowxKY .cluster text{fill:#333;}#mermaid-svg-zN7McS5aVFXowxKY .cluster span{color:#333;}#mermaid-svg-zN7McS5aVFXowxKY div.mermaidTooltip{position:absolute;text-align:center;max-width:200px;padding:2px;font-family:\\&#8221;trebuchet ms\\&#8221;,verdana,arial,sans-serif;font-size:12px;background:hsl(80, 100%, 96.2745098039%);border:1px solid #aaaa33;border-radius:2px;pointer-events:none;z-index:100;}#mermaid-svg-zN7McS5aVFXowxKY .flowchartTitleText{text-anchor:middle;font-size:18px;fill:#333;}#mermaid-svg-zN7McS5aVFXowxKY rect.text{fill:none;stroke-width:0;}#mermaid-svg-zN7McS5aVFXowxKY .icon-shape,#mermaid-svg-zN7McS5aVFXowxKY .image-shape{background-color:rgba(232,232,232, 0.8);text-align:center;}#mermaid-svg-zN7McS5aVFXowxKY .icon-shape p,#mermaid-svg-zN7McS5aVFXowxKY .image-shape p{background-color:rgba(232,232,232, 0.8);padding:2px;}#mermaid-svg-zN7McS5aVFXowxKY .icon-shape .label rect,#mermaid-svg-zN7McS5aVFXowxKY .image-shape .label rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#mermaid-svg-zN7McS5aVFXowxKY .label-icon{display:inline-block;height:1em;overflow:visible;vertical-align:-0.125em;}#mermaid-svg-zN7McS5aVFXowxKY .node .label-icon path{fill:currentColor;stroke:revert;stroke-width:revert;}#mermaid-svg-zN7McS5aVFXowxKY :root{&#8211;mermaid-font-family:\\&#8221;trebuchet ms\\&#8221;,verdana,arial,sans-serif;}<span class=\"edgeLabel\"><\/span><span class=\"edgeLabel\"><\/span><span class=\"edgeLabel\"><\/span><span class=\"edgeLabel\"><\/span><span class=\"edgeLabel\"><\/span><span class=\"edgeLabel\"><\/span><span class=\"edgeLabel\"><\/p>\n<p>\u5426<\/p>\n<p><\/span><span class=\"edgeLabel\"><\/p>\n<p>\u662f<\/p>\n<p><\/span><span class=\"nodeLabel\"><\/p>\n<p>\u53d1\u73b0\u5f02\u5e38\u5916\u8fde<\/p>\n<p><\/span><span class=\"nodeLabel\"><\/p>\n<p>\u5b9a\u4f4d\u6bcd\u4f53\u4e0e\u770b\u95e8\u72d7\u8fdb\u7a0b<\/p>\n<p><\/span><span class=\"nodeLabel\"><\/p>\n<p>\u5207\u65ad\u6bcd\u4f53&#xff0c;\u963b\u6b62\u91cd\u65b0\u62c9\u8d77<\/p>\n<p><\/span><span class=\"nodeLabel\"><\/p>\n<p>\u6e05\u7406\u8ba1\u5212\u4efb\u52a1\u4e0e\u6ce8\u518c\u8868\u6301\u4e45\u5316<\/p>\n<p><\/span><span class=\"nodeLabel\"><\/p>\n<p>\u5378\u8f7d Rootkit\/BYOVD \u9a71\u52a8<\/p>\n<p><\/span><span class=\"nodeLabel\"><\/p>\n<p>\u963b\u65ad C2 \u901a\u9053\u4e0e fallback<\/p>\n<p><\/span><span class=\"nodeLabel\"><\/p>\n<p>\u6240\u6709\u52a0\u8f7d\u9636\u6bb5\u4e0e\u8f7d\u4f53\u662f\u5426\u6e05\u9664<\/p>\n<p><\/span><span class=\"nodeLabel\"><\/p>\n<p>\u5904\u7f6e\u5b8c\u6210<\/p>\n<p><\/span><\/p>\n<h3>6. \u901a\u7528\u5224\u65ad\u539f\u5219<\/h3>\n<p>\u94f6\u72d0\u628a\u771f\u5b9e\u610f\u56fe\u85cf\u5728\u201c\u6b63\u5e38\u201d\u4e4b\u4e0b&#xff1a;\u6b63\u5e38\u7b7e\u540d\u3001\u6b63\u5e38\u5b89\u88c5\u3001\u6b63\u5e38 DNS\u3001\u6b63\u5e38\u8ba1\u5212\u4efb\u52a1\u3002<\/p>\n<p>CTF \u89e3\u9898\u5173\u952e\u662f\u627e\u7ed3\u6784\u4e0d\u4e00\u81f4&#xff1a;<\/p>\n<ul>\n<li>\u767d\u6587\u4ef6\u591a\u51fa\u7684\u8df3\u8f6c<\/li>\n<li>\u5f02\u5e38\u8ba1\u5212\u4efb\u52a1<\/li>\n<li>DoH \u4e2d\u4e0d\u5e94\u51fa\u73b0\u7684\u57df\u540d<\/li>\n<li>\u5927 PE \u5c3e\u90e8\u52a0\u5bc6\u5757<\/li>\n<\/ul>\n<p>\u9ad8\u9891\u8bb0\u5fc6&#xff1a;<\/p>\n<p>\u95e8\u63a7\u627e\u6c47\u5408\u70b9&#xff0c;\u52a0\u5bc6\u627e\u7279\u5f81\u5b57\u8282&#xff0c;C2 \u770b\u5143\u6570\u636e&#xff0c;\u53d6\u8bc1\u627e\u71b5\u5f02\u5e38&#xff0c;\u5e94\u6025\u5148\u65ad\u6bcd\u4f53\u518d\u6e05\u8f7d\u4f53\u3002<\/p>\n<p>\u4e00\u53e5\u8bdd\u603b\u7ed3&#xff1a;\u94f6\u72d0 CTF \u7684\u6838\u5fc3\u4e0d\u662f\u201c\u8bc6\u522b\u6837\u672c\u201d&#xff0c;\u800c\u662f\u4ece\u767d\u52a0\u9ed1\u5165\u53e3\u3001\u5185\u5b58\u52a0\u8f7d\u3001\u9690\u853d C2\u3001\u5197\u4f59\u6301\u4e45\u5316\u3001\u5185\u6838\u5bf9\u6297\u4e94\u4e2a\u5c42\u9762\u8fd8\u539f\u653b\u51fb\u94fe&#xff0c;\u5e76\u5224\u65ad\u6e05\u7406\u662f\u5426\u5b8c\u6574\u3002<\/p>\n","protected":false},"excerpt":{"rendered":"<p>\/* MD \/ \u5bcc\u6587\u672c\u4e2d\u7684 .toc\uff08\u542b\u535a\u5ba2\u56ed\u642c\u5bb6\u7b49\u5d4c\u5957\u7ed3\u6784\uff09\uff1b.toc-box \u5728\u4fa7\u680f\uff0c\u4e0d\u53d7\u5f71\u54cd *\/#content_views .toc,\/* \u7f16\u8f91\u5668\u5e38\u5728\u76ee\u5f55\u524d\u540e\u63d2\u5165\u7a7a p\uff08:empty \u4ecd\u5360 20px\uff09\uff0c\u4e00\u5e76\u53bb\u6389\u907f\u514d\u9876\u7a7a\u9699 *\/#content_views.markdown_views &gt; p:empty:has(+ .toc),#content_views.markdown_views &gt; .toc + p:empty,\/* \u5bcc\u6587\u672c\u65e7\u7248\u76ee\u5f55\u6807\u8bb0 *\/#content<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[11820,87,78],"topic":[],"class_list":["post-123670","post","type-post","status-publish","format-standard","hentry","category-server","tag-atomgit","tag-87","tag-78"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v20.3 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>\u94f6\u72d0\u6728\u9a6c CTF \u4e3b\u8981\u77e5\u8bc6\u70b9\uff08\u7cbe\u7b80\u7248\uff09 - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.wsisp.com\/helps\/123670.html\" \/>\n<meta property=\"og:locale\" content=\"zh_CN\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"\u94f6\u72d0\u6728\u9a6c CTF \u4e3b\u8981\u77e5\u8bc6\u70b9\uff08\u7cbe\u7b80\u7248\uff09 - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3\" \/>\n<meta property=\"og:description\" content=\"\/* MD \/ \u5bcc\u6587\u672c\u4e2d\u7684 .toc\uff08\u542b\u535a\u5ba2\u56ed\u642c\u5bb6\u7b49\u5d4c\u5957\u7ed3\u6784\uff09\uff1b.toc-box \u5728\u4fa7\u680f\uff0c\u4e0d\u53d7\u5f71\u54cd *\/#content_views .toc,\/* \u7f16\u8f91\u5668\u5e38\u5728\u76ee\u5f55\u524d\u540e\u63d2\u5165\u7a7a p\uff08:empty \u4ecd\u5360 20px\uff09\uff0c\u4e00\u5e76\u53bb\u6389\u907f\u514d\u9876\u7a7a\u9699 *\/#content_views.markdown_views &gt; p:empty:has(+ .toc),#content_views.markdown_views &gt; .toc + p:empty,\/* \u5bcc\u6587\u672c\u65e7\u7248\u76ee\u5f55\u6807\u8bb0 *\/#content\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.wsisp.com\/helps\/123670.html\" \/>\n<meta property=\"og:site_name\" content=\"\u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3\" \/>\n<meta property=\"article:published_time\" content=\"2026-11-07T17:00:56+00:00\" \/>\n<meta name=\"author\" content=\"admin\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"\u4f5c\u8005\" \/>\n\t<meta name=\"twitter:data1\" content=\"admin\" \/>\n\t<meta name=\"twitter:label2\" content=\"\u9884\u8ba1\u9605\u8bfb\u65f6\u95f4\" \/>\n\t<meta name=\"twitter:data2\" content=\"12 \u5206\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/123670.html\",\"url\":\"https:\/\/www.wsisp.com\/helps\/123670.html\",\"name\":\"\u94f6\u72d0\u6728\u9a6c CTF \u4e3b\u8981\u77e5\u8bc6\u70b9\uff08\u7cbe\u7b80\u7248\uff09 - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3\",\"isPartOf\":{\"@id\":\"https:\/\/www.wsisp.com\/helps\/#website\"},\"datePublished\":\"2026-11-07T17:00:56+00:00\",\"dateModified\":\"2026-11-07T17:00:56+00:00\",\"author\":{\"@id\":\"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/358e386c577a3ab51c4493330a20ad41\"},\"breadcrumb\":{\"@id\":\"https:\/\/www.wsisp.com\/helps\/123670.html#breadcrumb\"},\"inLanguage\":\"zh-Hans\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.wsisp.com\/helps\/123670.html\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/123670.html#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"\u9996\u9875\",\"item\":\"https:\/\/www.wsisp.com\/helps\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"\u94f6\u72d0\u6728\u9a6c CTF \u4e3b\u8981\u77e5\u8bc6\u70b9\uff08\u7cbe\u7b80\u7248\uff09\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/#website\",\"url\":\"https:\/\/www.wsisp.com\/helps\/\",\"name\":\"\u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3\",\"description\":\"\u9999\u6e2f\u670d\u52a1\u5668_\u9999\u6e2f\u4e91\u670d\u52a1\u5668\u8d44\u8baf_\u670d\u52a1\u5668\u5e2e\u52a9\u6587\u6863_\u670d\u52a1\u5668\u6559\u7a0b\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.wsisp.com\/helps\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"zh-Hans\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/358e386c577a3ab51c4493330a20ad41\",\"name\":\"admin\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"zh-Hans\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/gravatar.wp-china-yes.net\/avatar\/?s=96&d=mystery\",\"contentUrl\":\"https:\/\/gravatar.wp-china-yes.net\/avatar\/?s=96&d=mystery\",\"caption\":\"admin\"},\"sameAs\":[\"http:\/\/wp.wsisp.com\"],\"url\":\"https:\/\/www.wsisp.com\/helps\/author\/admin\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"\u94f6\u72d0\u6728\u9a6c CTF \u4e3b\u8981\u77e5\u8bc6\u70b9\uff08\u7cbe\u7b80\u7248\uff09 - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.wsisp.com\/helps\/123670.html","og_locale":"zh_CN","og_type":"article","og_title":"\u94f6\u72d0\u6728\u9a6c CTF \u4e3b\u8981\u77e5\u8bc6\u70b9\uff08\u7cbe\u7b80\u7248\uff09 - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","og_description":"\/* MD \/ \u5bcc\u6587\u672c\u4e2d\u7684 .toc\uff08\u542b\u535a\u5ba2\u56ed\u642c\u5bb6\u7b49\u5d4c\u5957\u7ed3\u6784\uff09\uff1b.toc-box \u5728\u4fa7\u680f\uff0c\u4e0d\u53d7\u5f71\u54cd *\/#content_views .toc,\/* \u7f16\u8f91\u5668\u5e38\u5728\u76ee\u5f55\u524d\u540e\u63d2\u5165\u7a7a p\uff08:empty \u4ecd\u5360 20px\uff09\uff0c\u4e00\u5e76\u53bb\u6389\u907f\u514d\u9876\u7a7a\u9699 *\/#content_views.markdown_views &gt; p:empty:has(+ .toc),#content_views.markdown_views &gt; .toc + p:empty,\/* \u5bcc\u6587\u672c\u65e7\u7248\u76ee\u5f55\u6807\u8bb0 *\/#content","og_url":"https:\/\/www.wsisp.com\/helps\/123670.html","og_site_name":"\u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","article_published_time":"2026-11-07T17:00:56+00:00","author":"admin","twitter_card":"summary_large_image","twitter_misc":{"\u4f5c\u8005":"admin","\u9884\u8ba1\u9605\u8bfb\u65f6\u95f4":"12 \u5206"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/www.wsisp.com\/helps\/123670.html","url":"https:\/\/www.wsisp.com\/helps\/123670.html","name":"\u94f6\u72d0\u6728\u9a6c CTF \u4e3b\u8981\u77e5\u8bc6\u70b9\uff08\u7cbe\u7b80\u7248\uff09 - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","isPartOf":{"@id":"https:\/\/www.wsisp.com\/helps\/#website"},"datePublished":"2026-11-07T17:00:56+00:00","dateModified":"2026-11-07T17:00:56+00:00","author":{"@id":"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/358e386c577a3ab51c4493330a20ad41"},"breadcrumb":{"@id":"https:\/\/www.wsisp.com\/helps\/123670.html#breadcrumb"},"inLanguage":"zh-Hans","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.wsisp.com\/helps\/123670.html"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.wsisp.com\/helps\/123670.html#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"\u9996\u9875","item":"https:\/\/www.wsisp.com\/helps"},{"@type":"ListItem","position":2,"name":"\u94f6\u72d0\u6728\u9a6c CTF \u4e3b\u8981\u77e5\u8bc6\u70b9\uff08\u7cbe\u7b80\u7248\uff09"}]},{"@type":"WebSite","@id":"https:\/\/www.wsisp.com\/helps\/#website","url":"https:\/\/www.wsisp.com\/helps\/","name":"\u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","description":"\u9999\u6e2f\u670d\u52a1\u5668_\u9999\u6e2f\u4e91\u670d\u52a1\u5668\u8d44\u8baf_\u670d\u52a1\u5668\u5e2e\u52a9\u6587\u6863_\u670d\u52a1\u5668\u6559\u7a0b","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.wsisp.com\/helps\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"zh-Hans"},{"@type":"Person","@id":"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/358e386c577a3ab51c4493330a20ad41","name":"admin","image":{"@type":"ImageObject","inLanguage":"zh-Hans","@id":"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/image\/","url":"https:\/\/gravatar.wp-china-yes.net\/avatar\/?s=96&d=mystery","contentUrl":"https:\/\/gravatar.wp-china-yes.net\/avatar\/?s=96&d=mystery","caption":"admin"},"sameAs":["http:\/\/wp.wsisp.com"],"url":"https:\/\/www.wsisp.com\/helps\/author\/admin"}]}},"_links":{"self":[{"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/posts\/123670","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/comments?post=123670"}],"version-history":[{"count":0,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/posts\/123670\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/media?parent=123670"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/categories?post=123670"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/tags?post=123670"},{"taxonomy":"topic","embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/topic?post=123670"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}