MCTF--MISC

之前结束了我们学校的校赛，为了师弟更好的学，那就出个详细的wp吧，首先先讲杂项MISC，这次的MISC其实还是非常简单的。

一笔画完

这题其实只是一个简单的编程题，运用的思想就是递归，这个题不多解释，直接给出脚本：

#!/usr/bin/env python
# encoding: utf-8from pwn import *
#   * 0
#   # 2
#   . 1p=remote("123.206.131.120", 9998)
p.recvuntil("]\n")
p.sendline("y")for T in range(1):maze=[   "......","......","......","......","......","......"      ]#maze1=["....#.","......","...#..",".#*...","......"]p.recvuntil(":\n")for i in range(6):pic=p.recvuntil("\n",drop=True)maze[i]=picprint mazedata=[[],[],[],[],[]]for i in range(5):for j in range(6):if maze[i][j]==".":data[i].append(1)if maze[i][j]=="*":data[i].append(0)if maze[i][j]=="#":data[i].append(2)print dataways=[]waysx=""waysy=""payload=""def dfs(data,row,i,ways):#     a=[1,-1]data[row][i]=3 #这里置为3表示已经这个点已经走过if row+1<len(data) and data[row+1][i]==1:if not dfs(data,row+1,i,ways):data[row+1][i]=1if row-1>-1 and data[row-1][i]==1:if not dfs(data,row-1,i,ways):data[row-1][i]=1if i+1< len(data[0])and data[row][i+1]==1:if not dfs(data,row,i+1,ways):data[row][i+1]=1if i-1 >-1 and data[row][i-1]==1:if not dfs(data,row,i-1,ways):data[row][i-1]=1for row1 in data:for i1 in row1:if(i1==1):return Falseways.append((row,i))return Truefor row in data:for i in row:if i==0:dfs(data,data.index(row),row.index(i),ways)#print(ways)for i in range(len(ways)-1,-1,-1):sh=""sh=ways[i]waysx+=str(sh[0])waysy+=str(sh[1])print waysxprint waysyfor i in range(len(waysx)-1):a=int(waysx[i+1])-int(waysx[i])b=int(waysy[i+1])-int(waysy[i])if a==0:if b==1:payload+="d"if b==-1:payload+="a"if a==1:payload+="s"if a==-1:payload+="w"print payloadp.recvuntil("\n")p.sendline(payload)print p.recv()
#=============================================================================
maze=[   "......","......","......","......","......","......"     ]#maze1=["....#.","......","...#..",".#*...","......"]p.recvuntil(":\n")
for i in range(6):pic=p.recvuntil("\n",drop=True)maze[i]=pic
print maze
data=[[],[],[],[],[],[]]
for i in range(6):for j in range(6):if maze[i][j]==".":data[i].append(1)if maze[i][j]=="*":data[i].append(0)if maze[i][j]=="#":data[i].append(2)print dataways=[]
waysx=""
waysy=""
payload=""
def dfs(data,row,i,ways):#     a=[1,-1]data[row][i]=3 #这里置为3表示已经这个点已经走过if row+1<len(data) and data[row+1][i]==1:if not dfs(data,row+1,i,ways):data[row+1][i]=1if row-1>-1 and data[row-1][i]==1:if not dfs(data,row-1,i,ways):data[row-1][i]=1if i+1< len(data[0])and data[row][i+1]==1:if not dfs(data,row,i+1,ways):data[row][i+1]=1if i-1 >-1 and data[row][i-1]==1:if not dfs(data,row,i-1,ways):data[row][i-1]=1for row1 in data:for i1 in row1:if(i1==1):return Falseways.append((row,i))return Truefor row in data:for i in row:if i==0:dfs(data,data.index(row),row.index(i),ways)
#print(ways)for i in range(len(ways)-1,-1,-1):sh=""sh=ways[i]waysx+=str(sh[0])waysy+=str(sh[1])
print waysx
print waysyfor i in range(len(waysx)-1):a=int(waysx[i+1])-int(waysx[i])b=int(waysy[i+1])-int(waysy[i])if a==0:if b==1:payload+="d"if b==-1:payload+="a"if a==1:payload+="s"if a==-1:payload+="w"
print payloadp.recvuntil("\n")
p.sendline(payload)
print p.recv()#====================================================================
maze=[   ".......",".......",".......",".......",".......","......."       ]#maze1=["....#.","......","...#..",".#*...","......"]p.recvuntil(":\n")
for i in range(6):pic=p.recvuntil("\n",drop=True)maze[i]=pic
print maze
data=[[],[],[],[],[],[]]
for i in range(6):for j in range(7):if maze[i][j]==".":data[i].append(1)if maze[i][j]=="*":data[i].append(0)if maze[i][j]=="#":data[i].append(2)print dataways=[]
waysx=""
waysy=""
payload=""
def dfs(data,row,i,ways):#     a=[1,-1]data[row][i]=3 #这里置为3表示已经这个点已经走过if row+1<len(data) and data[row+1][i]==1:if not dfs(data,row+1,i,ways):data[row+1][i]=1if row-1>-1 and data[row-1][i]==1:if not dfs(data,row-1,i,ways):data[row-1][i]=1if i+1< len(data[0])and data[row][i+1]==1:if not dfs(data,row,i+1,ways):data[row][i+1]=1if i-1 >-1 and data[row][i-1]==1:if not dfs(data,row,i-1,ways):data[row][i-1]=1for row1 in data:for i1 in row1:if(i1==1):return Falseways.append((row,i))return Truefor row in data:for i in row:if i==0:dfs(data,data.index(row),row.index(i),ways)
#print(ways)for i in range(len(ways)-1,-1,-1):sh=""sh=ways[i]waysx+=str(sh[0])waysy+=str(sh[1])
print waysx
print waysyfor i in range(len(waysx)-1):a=int(waysx[i+1])-int(waysx[i])b=int(waysy[i+1])-int(waysy[i])if a==0:if b==1:payload+="d"if b==-1:payload+="a"if a==1:payload+="s"if a==-1:payload+="w"
print payloadp.recvuntil("\n")
p.sendline(payload)
print p.recv()p.interactive()

直接运行得到flag：

有玩过QQ炫舞吗？

这题可以说一个比较简单的编程题，就是一个替换字符串的题，脚本如下：

#!/usr/bin/env python
# encoding: utf-8from pwn import *
#context.log_level = 'debug'
#context.terminal = ['tmux', 'splitw', '-h']p=remote("123.206.131.120", 9999)p.sendlineafter("\n","y")a=["^","<",">","v"]
b=["W","A","D","S"]for j in range(0, 10):payload=""p.recvuntil(': ')string=p.recv(10)#print string for i in range(0, 10):if string[i]=='^':payload+='w'if string[i]=='<':payload+='a'if string[i]=='>':payload+='d'if string[i]=='v':payload+='s'p.recvuntil('performance: ')p.send(payload)print "success"
print p.recvall()

也是直接运行脚本就可以得到flag：

小结：这两个脚本我运用的都是pwntools这个库中的函数，这个库中的函数的优秀之处就是可以很方便的获得打印出来的各种字符串。

前两个是编程题，所以我就放一起讲了，接下来的就是一些有趣的杂项题：

听说你是萌新

这个题是一个图片隐写的入门题，将图片用010打开，搜索字符串，发现flag：

团长！团长你再做什么

这个图片也是一个比较常见的套路，就是改变图片的长度，改变了图片之后flag就可以很清楚地看见了，具体更改图片的方法可以参考https://blog.csdn.net/u010391191/article/details/80804177，这篇文章讲更改图片高度和长度都讲的很详细，更改了高度之后的图片如下：