Bugku_simple MQTT_WriteUp

根据题目下blueyst大佬评论，提示一个strings就可以做出来，所以拿到压缩包直接解压出mqtt.pcapng文件，strings之。

strings 结果如下：

#strings mqtt.pcapng | more

T7fR
Dn+@
xLd
MQTT
MQTT_FX_Client
7f:
R3xLd
9n-@
xLd
/game/flag
R1xLd
[!gQ
Cn5@
xLd
/game/flag/find_flag
!g;
R0xLd
Cn;@
xLd
/game/flagwhere is flag
xLd
/game/flagwhere is flag
Cn?@
xLd
/game/flagwhere is flag
xLd
/game/flagwhere is flag
DnG@
xLd
Hw!P
/game/flagwhere is flag.
xLd
Hw!
/game/flagwhere is flag.
nM@
xLd
Hw=P
/game/flag526172211a0701003392b5e50a01050600050101808000597b62d05d02033cb00004a6002073a10fe780030010666c61675f69735f686572652e747874300100030f17f69e4634a29347a81d0d9d379bec15d4c6c6c0dc85da4401b6192e03c639bae9ae8c2120ef8b93160855850a0302aa1f181e4ad8d70197fa95c70fd8084ee40579c7f99a91074ef0a9639880df0411126ed5c146bc11b1984e922c547be3a2fe07ac071651281d77565103050400
xLd
Hw=
/game/flag526172211a0701003392b5e50a01050600050101808000597b62d05d02033cb00004a6002073a10fe780030010666c61675f69735f686572652e747874300100030f17f69e4634a29347a81d0d9d379bec15d4c6c6c0dc85da4401b6192e03c639bae9ae8c2120ef8b93160855850a0302aa1f181e4ad8d70197fa95c70fd8084ee40579c7f99a91074ef0a9639880df0411126ed5c146bc11b1984e922c547be3a2fe07ac071651281d77565103050400
CnU@
xLd
/game/flagwhere is flag
xLd
/game/flagwhere is flag
CnW@
xLd
/game/flagwhere is flag
xLd
/game/flagwhere is flag
CnY@
xLd
/game/flagwhere is flag
xLd
/game/flagwhere is flag
Tng@
xLd
/game/flag/find_flagth1s_1s_rar_p@ssw0rd
xLd
/game/flag/find_flagth1s_1s_rar_p@ssw0rd
Fnm@
xLd
Hy+P
/game/flag/find_flaggogogot
xLd
Hy+
/game/flag/find_flaggogogot
*no@
xLd
HyIP
Counters provided by dumpcap

取两个关键信息：

1、
526172211a0701003392b5e50a01050600050101808000597b62d05d02033cb00004a6002073a10fe780030010666c61675f69735f686572652e747874300100030f17f69e4634a29347a81d0d9d379bec15d4c6c6c0dc85da4401b6192e03c639bae9ae8c2120ef8b93160855850a0302aa1f181e4ad8d70197fa95c70fd8084ee40579c7f99a91074ef0a9639880df0411126ed5c146bc11b1984e922c547be3a2fe07ac071651281d77565103050400

2、
th1s_1s_rar_p@ssw0rd

第一段是个16进制的代码，根据第二段提示，第一段应该是一个rar压缩包。

把第一段代码粘贴到010Editor里面

把16进制代码保存成RAR压缩包的010Editor具体操作：

1、新建一个Hex文件