工控CTF协议分析学习题目合集

import pyshark import re from Crypto.Util.number import long_to_bytes import base64 cap = pyshark.FileCapture( 'IEC104.pcapng', display_filter="iec60870_asdu && tcp.stream == 0 && iec60870_asdu.normval && iec60870_asdu.typeid != 34 && iec60870_asdu.typeid != 9", tshark_path="E:/Wireshark/tshark.exe", ) flag_base = "" for pkt in cap: rst = re.search(r'Value: [0-9.]+? \(([0-9]+?)\)', str(pkt.iec60870_asdu)) rst = int(rst.group(1)) if rst == 0: flag_base = "" continue rst = long_to_bytes(rst) flag_base += rst.decode() print(base64.b64decode(flag_base).decode())