https://g0g.top/tags/%E4%BF%A1%E5%AE%89/ Recent content in 信安 on wsmの随记 Hugo zh-CN Tue, 09 Jan 2024 16:11:00 +0000 https://g0g.top/2024/01/%E4%BA%A4%E5%A4%A7%E6%B0%B4%E5%8D%B0%E5%8E%9F%E7%90%86%E5%88%9D%E7%AA%A5/ Tue, 09 Jan 2024 16:11:00 +0000 https://g0g.top/2024/01/%E4%BA%A4%E5%A4%A7%E6%B0%B4%E5%8D%B0%E5%8E%9F%E7%90%86%E5%88%9D%E7%AA%A5/ <p>本来以为水源只是做了一个简单的 LSB 隐写，顺手撸了一个去除脚本。没想到前两天使用脚本时，水源居然自动刷新了！而且任何 Event Listener Breakpoint 都无法检测到这个回调函数，任由其刷新。今天考完军理，我倒要看看水源用了什么黑魔法。</p> <p>声明：本人只是出于理论研究的目的对源代码进行研究并提出可能的应对方案，请任何人都不要把水源截图外传，更不要利用本文提到的方式逃避管理。在校内群，请使用链接分享帖子。至于为什么，请自行水源上搜索 <a href="https://shuiyuan.sjtu.edu.cn/search?q=%E6%88%AA%E5%9B%BE%E5%A4%96%E4%BC%A0" target="_blank" rel="noopener" >截图外传</a>（ps <a href="https://shuiyuan.sjtu.edu.cn/t/topic/153895/94" target="_blank" rel="noopener" >一个我很喜欢的解释</a>）。</p> <blockquote> <p><strong><a href="https://shuiyuan.sjtu.edu.cn/t/topic/156250" target="_blank" rel="noopener" >水源社区管理规范</a></strong></p> <p><strong>第十一条</strong> 以下行为被界定为“恶意对抗行为”：</p> <p>（一）使用技术手段逃避管理；</p> <p><strong>第十二条</strong> 以下行为被界定为“对社区的恶意行为”：</p> <p>（二）未经授权许可，将他人发布的内容以图片、视频等形式发布到社区以外，并造成不良影响；</p> </blockquote> <h2 id="找到源代码">找到源代码</h2> <p>通过简单摸索我们会发现，水印被放在一个 <code>.ember-view</code> 内部，通过一个 <code>z-index=9999</code> 且 <code>opacity=0.005</code> 的全屏的 base64 化的 PNG 写入了可能唯一标识了个人账号的三位 base64（大概能表示 $64^3=262,144$ 人，也就是只有二十年的交大人吧/doge）。</p> <p>由于断点没有任何作用，我只好把一个网页的全部代码下载下来：</p> <details> <summary>全部文件</summary> <p><div class="highlight"><pre tabindex="0" style="background-color:#fff;-moz-tab-size:4;-o-tab-size:4;tab-size:4;-webkit-text-size-adjust:none;"><code class="language-text" data-lang="text"><span style="display:flex;"><span>$ ls </span></span><span style="display:flex;"><span> 05d79569ae40510aab461b2563db6b47d00e8cd4.js </span></span><span style="display:flex;"><span> 0aa74b582acb6a91dd3e411b2a7bfbc04e260211.js </span></span><span style="display:flex;"><span> 108af40fa662a89aaf7a21f877353d51e03f20ab.js </span></span><span style="display:flex;"><span> 11312c7a2877d0b500b0e6a8c206a7dddd248d68.js </span></span><span style="display:flex;"><span> 13256e7c9a732d6f122bd0ade6ce1667f1056fc8.js </span></span><span style="display:flex;"><span> 19b4640f9b7fefd688672e06cba5d97f064376b1.js </span></span><span style="display:flex;"><span> 2953c571d30c38ce62223ab7cb71bfa62ff7f6b3.js </span></span><span style="display:flex;"><span> 2e3da41114c0548f77ba38b143d059f6e71b6070.js </span></span><span style="display:flex;"><span> 3cd5da1afde47c3b2559a9d32fb22dae709bc452.js </span></span><span style="display:flex;"><span> 5a71c44fba2bc8a8ba3db3aaed76bbf2edc6ef2b.js </span></span><span style="display:flex;"><span> 609808483b2f30b853cf8365c6210db98a45e7bf.js </span></span><span style="display:flex;"><span> 755071_2.png </span></span><span style="display:flex;"><span> 819585_2.jpg </span></span><span style="display:flex;"><span> 9c11c73a9c8a1d753cb2c89ddf7215f2fcbb7d79.js </span></span><span style="display:flex;"><span> a1df1e94bf4b5b5825e5947ad9acccb47fdaaa08.js </span></span><span style="display:flex;"><span> abe5e87ff37d7d06fc18f6e696f906528dfc9da8.js </span></span><span style="display:flex;"><span> ba83de1a244eff6ea32b9cfdb456fc943d55fba2.js </span></span><span style="display:flex;"><span> browser-detect-13a181da51a93c36e477dd3626795ba449290653fdff8a.js </span></span><span style="display:flex;"><span> browser-update-a7811824a1beeecce86fb3546ab789b1788261ece30a33.js </span></span><span style="display:flex;"><span> c0eff5115343eeb12e312488f9572bf683b25619.js </span></span><span style="display:flex;"><span> c36051143379f82fc44d6b2b723f499d097138a6.js </span></span><span style="display:flex;"><span> cdb089134551f0d890ff37adaac1b7fa96a5ba1f.js </span></span><span style="display:flex;"><span> chat-3c2c0a87bea84663ed8fd3479fd008569160424dff2e5904463c1aea.js </span></span><span style="display:flex;"><span> chat_b2c67b8084a86f0477766fc1e3b4cc189a786e96.css </span></span><span style="display:flex;"><span> chat_desktop_b2c67b8084a86f0477766fc1e3b4cc189a786e96.css </span></span><span style="display:flex;"><span> checklist-f67957fc54745e2d28d433f45b8fdddd34d8930865fd51c82a0.js </span></span><span style="display:flex;"><span> checklist_b2c67b8084a86f0477766fc1e3b4cc189a786e96.css </span></span><span style="display:flex;"><span> chunk.5ef2f01c75e63a9864e3.js </span></span><span style="display:flex;"><span> chunk.ef28e73e3d8ce45a79d7.js </span></span><span style="display:flex;"><span> color_definitions_scheme_1_3_2ceb21439b63ac43c0d23727e715500.css </span></span><span style="display:flex;"><span> color_definitions_scheme_2_3_e0c576c10b96945224a8cfc1c5995b7.css </span></span><span style="display:flex;"><span> continous-days-visited-0a1f3a5a289feed212e3b738f8280656ac5cee.js </span></span><span style="display:flex;"><span> d9439395e9e8be8688cc93b588dd8ecf1115a1f8.js </span></span><span style="display:flex;"><span> db287b65037a3ce2491b9ad5245c877b323ff6a8.js </span></span><span style="display:flex;"><span> db38b836d86e35614ac30164555cd84c3bc3c6dd.js </span></span><span style="display:flex;"><span> desktop_b2c67b8084a86f0477766fc1e3b4cc189a786e96.css </span></span><span style="display:flex;"><span> desktop_theme_37_1522da10433779d746cafc79ea7feff6ebe9d770.css </span></span><span style="display:flex;"><span> desktop_theme_3_3d24bc909a4159746945cecfa8cee8de96493824.css </span></span><span style="display:flex;"><span> desktop_theme_56_353dbf58327f2e62005109874adbb04510666e04.css </span></span><span style="display:flex;"><span> desktop_theme_58_c6d6de17779690824e99a36648e4df96ab67615f.css </span></span><span style="display:flex;"><span> desktop_theme_59_1c846f489c78ccaf6afbd8bb7b7973150ec09bd1.css </span></span><span style="display:flex;"><span> desktop_theme_64_96b396354093d5bcb7d0dab382193683be0e77e8.css </span></span><span style="display:flex;"><span> desktop_theme_65_1cb59dc2d246bcf71678aefca67c06c27cfb7599.css </span></span><span style="display:flex;"><span> desktop_theme_68_8400573319944af0aa635a2f7f7e5d42c3b7fd6c.css </span></span><span style="display:flex;"><span> desktop_theme_74_677da7fcf51b0143ed98730f3aba364459b74f70.css </span></span><span style="display:flex;"><span> desktop_theme_79_a1825946d3fe7d97d214f84d21f15cc07b0884c3.css </span></span><span style="display:flex;"><span> desktop_theme_81_79a7a6e8301d472501b52ee8864518bd570def04.css </span></span><span style="display:flex;"><span> desktop_theme_83_85aa855d093c947c912fee33b90d3f77d331f292.css </span></span><span style="display:flex;"><span> desktop_theme_89_2d9dce6b7b598acbb798bcb9a4cbc8a4769c2d40.css </span></span><span style="display:flex;"><span> desktop_theme_91_259e9839336f626e95899ea3689c6383cce9f638.css </span></span><span style="display:flex;"><span> discourse-automation-797d429c98a553f481d0c33e150e5afe8261a1f4.js </span></span><span style="display:flex;"><span> discourse-automation_b2c67b8084a86f0477766fc1e3b4cc189a786e9.css </span></span><span style="display:flex;"><span> discourse-bbcode-3079b7785a470c5508894ce7e21ef4f760f675fb88ea.js </span></span><span style="display:flex;"><span> discourse-bbcode_b2c67b8084a86f0477766fc1e3b4cc189a786e96.css </span></span><span style="display:flex;"><span> discourse-cakeday-c97b9d03e7a391b25a24f008ca0ffebfd402e9bb3b6.js </span></span><span style="display:flex;"><span> discourse-cakeday_b2c67b8084a86f0477766fc1e3b4cc189a786e96.css </span></span><span style="display:flex;"><span> discourse-data-explorer-1248d71f16c4796d46d30ee2597df96b716ad.js </span></span><span style="display:flex;"><span> discourse-data-explorer_b2c67b8084a86f0477766fc1e3b4cc189a78.css </span></span><span style="display:flex;"><span> discourse-details-26aae552e6a41eaae05c07286af29e9d2f47fecac68.js </span></span><span style="display:flex;"><span> discourse-details_b2c67b8084a86f0477766fc1e3b4cc189a786e96.css </span></span><span style="display:flex;"><span> discourse-docs-d98420e41668b811fce6ebd0cf558a1b271a6e9f13a027.js </span></span><span style="display:flex;"><span> discourse-docs_b2c67b8084a86f0477766fc1e3b4cc189a786e96.css </span></span><span style="display:flex;"><span> discourse-graphviz-f5d1a9b315dbf288505004c1393ac993f5f053ea34.js </span></span><span style="display:flex;"><span> discourse-graphviz_b2c67b8084a86f0477766fc1e3b4cc189a786e96.css </span></span><span style="display:flex;"><span> discourse-lazy-videos-96992b2d9c70100602c892be1e0cdf0f3e0be9f.js </span></span><span style="display:flex;"><span> discourse-lazy-videos_b2c67b8084a86f0477766fc1e3b4cc189a786e.css </span></span><span style="display:flex;"><span> discourse-local-dates-453b2b53c09cec847757bb2efbaf4ab6162ecd6.js </span></span><span style="display:flex;"><span> discourse-local-dates_b2c67b8084a86f0477766fc1e3b4cc189a786e.css </span></span><span style="display:flex;"><span> discourse-math-0b9adce705e8554ecc8d6c4ddbf8713c5bb5a589e07a91.js </span></span><span style="display:flex;"><span> discourse-math_b2c67b8084a86f0477766fc1e3b4cc189a786e96.css </span></span><span style="display:flex;"><span> discourse-narrative-bot-643f10339e287d380f81413fde738a8ad3a6e.js </span></span><span style="display:flex;"><span> discourse-narrative-bot_b2c67b8084a86f0477766fc1e3b4cc189a78.css </span></span><span style="display:flex;"><span> discourse-no-bump-561edd77c2c9cfc1281128910880083ac1c91780c09.js </span></span><span style="display:flex;"><span> discourse-onebox-weibo_b2c67b8084a86f0477766fc1e3b4cc189a786.css </span></span><span style="display:flex;"><span> discourse-presence-eabb23f556643767cf848218ef5a093b1c99496fc6.js </span></span><span style="display:flex;"><span> discourse-presence_b2c67b8084a86f0477766fc1e3b4cc189a786e96.css </span></span><span style="display:flex;"><span> discourse-solved-08c562b8c2c8394867700f33ad2c8286d8a32019553f.js </span></span><span style="display:flex;"><span> discourse-solved_b2c67b8084a86f0477766fc1e3b4cc189a786e96.css </span></span><span style="display:flex;"><span> discourse-templates-f4b7f891267b8392caee8f14278e39ed7e726b8d0.js </span></span><span style="display:flex;"><span> discourse-templates_b2c67b8084a86f0477766fc1e3b4cc189a786e96.css </span></span><span style="display:flex;"><span> discourse-user-notes-afd4dd7029f812c33e086df9b15444d614dae7a3.js </span></span><span style="display:flex;"><span> discourse-user-notes_b2c67b8084a86f0477766fc1e3b4cc189a786e9.css </span></span><span style="display:flex;"><span> docker_manager_admin-fe9cdca37bd3366d6a0ebb4d5b644d58bdb51647.js </span></span><span style="display:flex;"><span> docker_manager_b2c67b8084a86f0477766fc1e3b4cc189a786e96.css </span></span><span style="display:flex;"><span> ec422ab66afb234aef01dbfd5b072c1d82cfa5c4.js </span></span><span style="display:flex;"><span> enhanced-ignore-827409206e61dc07ed1362d726142ad57abb3468df0d3.js </span></span><span style="display:flex;"><span> ffc47fcf9607be2ef80b9ec1c4313c3abb1235f2.js </span></span><span style="display:flex;"><span> footnote-e4283bf95e4bdcc5062c1bde5e8962932a35f35298b193181cda.js </span></span><span style="display:flex;"><span> footnote_b2c67b8084a86f0477766fc1e3b4cc189a786e96.css </span></span><span style="display:flex;"><span> footnote_extra-7f7bb8e0891106317fe6883ba187d239709a385df2c386.js </span></span><span style="display:flex;"><span>&#39;logo dark_&#39;$&#39;\346\233\262\347\272\277\345\214\226&#39;&#39;.svg&#39; </span></span><span style="display:flex;"><span>&#39;logo_&#39;$&#39;\346\233\262\347\272\277\345\214\226&#39;&#39;.svg&#39; </span></span><span style="display:flex;"><span> optimized-move-posts-notice-0b54397438579007a4dddc41adc0ae280.js </span></span><span style="display:flex;"><span> overrides </span></span><span style="display:flex;"><span> people_hugging.png </span></span><span style="display:flex;"><span> poll-ff562b4ba36654269cfbdd883265f8f6c938a4f003aa2d8547d5d092.js </span></span><span style="display:flex;"><span> poll_b2c67b8084a86f0477766fc1e3b4cc189a786e96.css </span></span><span style="display:flex;"><span> poll_desktop_b2c67b8084a86f0477766fc1e3b4cc189a786e96.css </span></span><span style="display:flex;"><span> retort-e9ced6a1c13cdd0ec63d76b9374daafa59cd75762651e24fe095e3.js </span></span><span style="display:flex;"><span> retort_b2c67b8084a86f0477766fc1e3b4cc189a786e96.css </span></span><span style="display:flex;"><span> retort_desktop_b2c67b8084a86f0477766fc1e3b4cc189a786e96.css </span></span><span style="display:flex;"><span> sob.png </span></span><span style="display:flex;"><span> spoiler-alert-7994af0f89dbc4d8cfcda8388fbf06cef011ee2cb622a4d.js </span></span><span style="display:flex;"><span> spoiler-alert_b2c67b8084a86f0477766fc1e3b4cc189a786e96.css </span></span><span style="display:flex;"><span> start-discourse-7c0f5f4daf3c942b7b6ecfe8e62e2e5a0f6555924859c.js </span></span><span style="display:flex;"><span> svg-3-f4d1b64487be6085362dcf71d6570447745763ce.js </span></span><span style="display:flex;"><span> vendor.9e07dd0436aff8751322647cc975361e-0b8308ceb741824f018eb.js </span></span><span style="display:flex;"><span> zh_CN-84e3bf8fa7a50b4444752859a8317a818aa929dc3bc74c45a87c70c.js </span></span></code></pre></div></p>